Function at 0x1400b97ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rax, str.replPropertyMetaData
mov rdi, rcx
xor ecx, ecx
mov qword [r11 - 0x78], rax
lea rax, str.objectSid
mov rbx, r8
mov qword [r11 - 0x70], rax
lea rax, str.objectGUID
mov rbp, rdx
mov rdx, qword [rbx]
mov qword [r11 - 0x68], rax
lea rax, str.parentGUID
mov qword [r11 - 0x60], rax
lea rax, str.1.2.840.113556.1.4.417
mov esi, ecx
mov qword [r11 - 0x38], rax
xor eax, eax
mov dword [rsp + 0x118], ecx
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
lea rax, [rsp + 0x60]
mov qword [r11 - 0x58], rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x3e8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
lea rax, [r11 - 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
lea rax, [r11 - 0x78]
mov qword [rsp + 0x60], rcx
mov dword [r11 - 0x30], ecx
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x74], ecx
lea r9, str._objectclass_
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x3c
call qword [sym.imp.WLDAP32.dll_Ordinal_203]
test eax, eax
jne 0x1400b9ac7
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_36]
cmp eax, 1
jne 0x1400b9aa2
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400b90f0
mov rbp, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400b99d8
mov rcx, qword [rax + 8]
xor eax, eax
cmp dword [rcx], 1
sete al
mov dword [rsp + 0x118], eax
test eax, eax
je 0x1400b99b2
and dword [rsp + 0x68], esi
cmp dword [rbx + 0x44], esi
jbe 0x1400b99c0
mov ebp, dword [rsp + 0x68]
mov rdi, rcx
mov rax, qword [rbx + 0x48]
lea r8, [rsp + 0x68]
lea rcx, [0x1400df670]
mov rdx, qword [rsi + rax]
xor r9d, r9d
mov rdx, qword [rdx + 8]
call fcn.140011a94
test eax, eax
je 0x1400b9974
xor eax, eax
xor edx, edx
cmp dword [rdi + 8], eax
jbe 0x1400b9991
mov r8d, dword [rsp + 0x68]
lea rcx, [rdi + 0x10]
cmp r8d, dword [rcx]
je 0x1400b994a
inc edx
inc rax
add rcx, 0x30
cmp edx, dword [rdi + 8]
jb 0x1400b9935
jmp 0x1400b9991
mov rcx, qword [rbx + 0x48]
lea rdx, [rax + rax*2]
add rdx, rdx
mov eax, dword [rdi + rdx*8 + 0x14]
mov dword [rsi + rcx + 0x28], eax
mov rcx, qword [rdi + rdx*8 + 0x18]
mov rax, qword [rbx + 0x48]
imul rcx, rcx, 0x989680
mov qword [rsi + rax + 0x2c], rcx
jmp 0x1400b9991
mov rax, qword [rbx + 0x48]
lea rcx, str.PA7LB_kuhl_m_lsadump_dcshadow_build_replication_version___Unable_to_MakeAttid_from_SCHEMA_DEFAULT_PREFIX_TABLE_for_Oid:__S__version__u__can_be_problematic_n
mov rdx, qword [rsi + rax]
mov r8d, dword [rsi + rax + 0x28]
mov rdx, qword [rdx + 8]
call fcn.14000c030
inc ebp
add rsi, 0x50
cmp ebp, dword [rbx + 0x44]
jb 0x1400b98ff
mov rdi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xa8]
jmp 0x1400b99c0
mov edx, dword [rcx]
lea rcx, str.PA7LB_kuhl_m_lsadump_dcshadow_build_replication_version___Repl_Blob_version_is_not_1___u__n
call fcn.14000c030
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400b99cf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov rsi, rax
test rax, rax
je 0x1400b9a17
mov rdx, qword [rax]
cmp dword [rdx], 0x1c
ja 0x1400b9a17
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
lea rcx, [rbx + 8]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b9a59
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b9a59
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x24], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x2c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_142]
mov r11, rax
test rax, rax
je 0x1400b9a9b
mov rcx, qword [rax]
cmp dword [rcx], 0x10
jne 0x1400b9a9b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbx + 0x34], rax
mov rax, qword [rcx + 8]
mov rcx, r11
mov qword [rbx + 0x3c], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_79]
mov esi, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b9ab2
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov eax, esi
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
cmp eax, 0x20
jne 0x1400b9aef
lea rcx, str.Object_does_not_exist_n
lea esi, [rax - 0x1f]
call fcn.14000c030
mov rdx, qword [rbx]
or dword [rbx + 0x50], esi
lea r8, [rbx + 0x34]
mov rcx, rdi
call fcn.1400b95bc
jmp 0x1400b9aa2
cmp eax, 0x22
jne 0x1400b9b2a
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b94f4
test eax, eax
je 0x1400b9aa2
mov rdx, qword [rbx]
lea rcx, str.DN:_s_n
call fcn.14000c030
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1400b97ac
mov esi, eax
jmp 0x1400b9aa2
lea rcx, str.PA7LB_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s_0x_x___u__n
mov r8d, eax
mov edx, eax
call fcn.14000c030
lea r8, [rsp + 0x118]
mov edx, 0x33
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_12]
test eax, eax
jne 0x1400b9aa2
mov rdx, qword [rsp + 0x118]
lea rcx, str.PA7LB_kuhl_m_lsadump_dcshadow_build_replication_version___ldap_search_s__s_n
call fcn.14000c030
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.WLDAP32.dll_Ordinal_147]
jmp 0x1400b9aa2