Function at 0x1400b039c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rax, str.replPropertyMetaData
mov rdi, rcx
xor ecx, ecx
mov qword [r11 - 0x78], rax
lea rax, str.objectSid
mov rbx, r8
mov qword [r11 - 0x70], rax
lea rax, str.objectGUID
mov rbp, rdx
mov rdx, qword [rbx]
mov qword [r11 - 0x68], rax
lea rax, str.parentGUID
mov qword [r11 - 0x60], rax
lea rax, str.1.2.840.113556.1.4.417
mov esi, ecx
mov qword [r11 - 0x38], rax
xor eax, eax
mov dword [rsp + 0x118], ecx
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
lea rax, [rsp + 0x60]
mov qword [r11 - 0x58], rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x3e8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
lea rax, [r11 - 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
lea rax, [r11 - 0x78]
mov qword [rsp + 0x60], rcx
mov dword [r11 - 0x30], ecx
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x74], ecx
lea r9, str._objectclass_
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x3c
call qword [sym.imp.WLDAP32.dll_Ordinal_203]
test eax, eax
jne 0x1400b06b7
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_36]
cmp eax, 1
jne 0x1400b0692
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400afce0
mov rbp, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400b05c8
mov rcx, qword [rax + 8]
xor eax, eax
cmp dword [rcx], 1
sete al
mov dword [rsp + 0x118], eax
test eax, eax
je 0x1400b05a2
and dword [rsp + 0x68], esi
cmp dword [rbx + 0x44], esi
jbe 0x1400b05b0
mov ebp, dword [rsp + 0x68]
mov rdi, rcx
mov rax, qword [rbx + 0x48]
lea r8, [rsp + 0x68]
lea rcx, [0x1400d0760]
mov rdx, qword [rsi + rax]
xor r9d, r9d
mov rdx, qword [rdx + 8]
call fcn.1400100b0
test eax, eax
je 0x1400b0564
xor eax, eax
xor edx, edx
cmp dword [rdi + 8], eax
jbe 0x1400b0581
mov r8d, dword [rsp + 0x68]
lea rcx, [rdi + 0x10]
cmp r8d, dword [rcx]
je 0x1400b053a
inc edx
inc rax
add rcx, 0x30
cmp edx, dword [rdi + 8]
jb 0x1400b0525
jmp 0x1400b0581
mov rcx, qword [rbx + 0x48]
lea rdx, [rax + rax*2]
add rdx, rdx
mov eax, dword [rdi + rdx*8 + 0x14]
mov dword [rsi + rcx + 0x28], eax
mov rcx, qword [rdi + rdx*8 + 0x18]
mov rax, qword [rbx + 0x48]
imul rcx, rcx, 0x989680
mov qword [rsi + rax + 0x2c], rcx
jmp 0x1400b0581
mov rax, qword [rbx + 0x48]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___Unable_to_MakeAttid_from_SCHEMA_DEFAULT_PREFIX_TABLE_for_Oid:__S__version__u__can_be_problematic_n
mov rdx, qword [rsi + rax]
mov r8d, dword [rsi + rax + 0x28]
mov rdx, qword [rdx + 8]
call fcn.14000a838
inc ebp
add rsi, 0x50
cmp ebp, dword [rbx + 0x44]
jb 0x1400b04ef
mov rdi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xa8]
jmp 0x1400b05b0
mov edx, dword [rcx]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___Repl_Blob_version_is_not_1___u__n
call fcn.14000a838
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400b05bf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov rsi, rax
test rax, rax
je 0x1400b0607
mov rdx, qword [rax]
cmp dword [rdx], 0x1c
ja 0x1400b0607
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
lea rcx, [rbx + 8]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b0649
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b0649
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x24], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x2c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b068b
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b068b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x34], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x3c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov esi, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b06a2
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov eax, esi
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
cmp eax, 0x20
jne 0x1400b06df
lea rcx, str.Object_does_not_exist_n
lea esi, [rax - 0x1f]
call fcn.14000a838
mov rdx, qword [rbx]
or dword [rbx + 0x50], esi
lea r8, [rbx + 0x34]
mov rcx, rdi
call fcn.1400b01ac
jmp 0x1400b0692
cmp eax, 0x22
jne 0x1400b071a
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b00e4
test eax, eax
je 0x1400b0692
mov rdx, qword [rbx]
lea rcx, str.DN:_s_n
call fcn.14000a838
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b039c
mov esi, eax
jmp 0x1400b0692
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s_0x_x___u__n
mov r8d, eax
mov edx, eax
call fcn.14000a838
lea r8, [rsp + 0x118]
mov edx, Ordinal_54
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_12]
test eax, eax
jne 0x1400b0692
mov rdx, qword [rsp + 0x118]
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s__s_n
call fcn.14000a838
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.WLDAP32.dll_Ordinal_147]
jmp 0x1400b0692