Function at 0x180016c00
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
lea r12d, [rcx + 0xe]
mov r13, r8
lea r11, [0x180000000]
mov rsi, rdx
mov r15d, ecx
cmp ecx, r12d
jae 0x180016e05
mov edx, dword [rbp + 0x40]
lea r14d, [rcx - 0xa3]
mov r8d, 0x4f
mov r9d, 0x4552
lea r10d, [r8 - 3]
nop
cmp r14d, 0x1f
ja case.0x180016c6e.11
movzx eax, byte [r11 + r14 + 0x16f8c]
mov ecx, dword [r11 + rax*4 + 0x16f5c]
add rcx, r11
jmp rcx
mov dword [rbp - 0x50], 0
mov edx, 4
mov eax, dword [rbp - 0x50]
jmp case.0x180016c6e.11
mov dword [rbp + 0x58], edx
jmp case.0x180016c6e.11
movzx ecx, byte [rbp + 0x40]
mov byte [rbp + 0x58], cl
jmp case.0x180016c6e.11
mov word [rbp - 0x19], r8w
jmp case.0x180016c6e.11
mov ecx, dword [r13 + 8]
movzx eax, word [rsi]
test eax, ecx
setne al
mov byte [rbp + 0x40], al
jmp case.0x180016c6e.11
mov dword [rbp - 0x20], 0x5f444642
jmp case.0x180016c6e.11
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x48], ILRemoveLastID
mov ecx, 0x75
call fcn.18000e320
mov edx, eax
cmp eax, 4
jne 0x180016ddb
mov edi, 0xaf
nop word [rax + rax]
mov ecx, edi
sub ecx, 0xad
je 0x180016d43
sub ecx, 1
je 0x180016d27
cmp ecx, 1
jne 0x180016dcd
mov eax, dword [0x40022010]
or eax, ecx
mov dword [0x40022010], eax
mov eax, dword [r13]
movzx ecx, word [rsi]
mov word [rax], cx
jmp 0x180016dcd
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], ILRemoveLastID
mov ecx, 0x75
call fcn.18000e320
mov edx, eax
jmp 0x180016dcd
cmp edx, 4
jne 0x180016db5
mov ebx, 0xdd
nop dword [rax]
cmp ebx, 0xdd
je 0x180016d91
cmp ebx, 0x7ee7
jne 0x180016da5
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x38], ILRemoveLastID
mov ecx, 0x75
call fcn.18000e320
mov edx, eax
cmp eax, 5
je 0x180016da5
mov eax, dword [0x40022010]
and eax, 0x1ffe
mov dword [0x40022010], eax
jmp 0x180016da5
mov eax, dword [r13]
movzx ecx, word [rsi + 2]
add eax, 2
mov dword [rbp - 0x50], eax
mov eax, dword [rbp - 0x50]
mov word [rax], cx
add ebx, 0x7e0a
cmp ebx, 0xfc14
jbe 0x180016d50
jmp 0x180016dcd
cmp edx, 5
je 0x180016dcd
mov eax, dword [0x40022010]
and eax, 0x1ffe
mov dword [0x40022010], eax
dec edi
cmp edi, 0xac
ja 0x180016cf0
mov r10d, 0x4c
lea r11, [0x180000000]
mov r9d, 0x4552
lea r8d, [r10 + 3]
inc r14d
lea eax, [r14 + 0xa3]
cmp eax, r12d
jb 0x180016c50
lea edi, [r15 + 0xa9]
cmp r15d, edi
jae case.0x180016e60.12
movzx esi, byte [rbp + 0x40]
lea ebx, [r15 - 0xbf]
mov r15d, dword [rbp + 0x40]
mov edx, 0x4349
mov r12d, dword [rbp + 0x40]
mov r8d, 0x43
mov r14, qword [rbp + 0x58]
nop word [rax + rax]
cmp ebx, 0x9c
ja case.0x180016e60.13
movzx eax, byte [r11 + rbx + 0x16fe4]
mov ecx, dword [r11 + rax*4 + 0x16fac]
add rcx, r11
jmp rcx
mov word [rbp - 0x1c], r9w
jmp case.0x180016c6e.11
xor al, al
mov byte [rbp + 0x40], al
jmp case.0x180016c6e.11
mov word [rbp - 0x1a], r10w
jmp case.0x180016c6e.11
xor r15d, r15d
mov dword [rbp - 0x30], r15d
jmp case.0x180016e60.13
test sil, sil
je 0x180016e95
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CredFree]
cmp qword [r13 + 0x40], 0
setne byte [rbp + 0x58]
jmp case.0x180016e60.13
xor ecx, ecx
movzx eax, sil
test r12d, r12d
cmovne ecx, eax
movzx esi, cl
jmp case.0x180016e60.13
mov dword [rbp - 0x17], 0x50535f
jmp case.0x180016e60.13
mov word [rbp - 0xd], dx
jmp case.0x180016e60.13
mov dword [rbp - 0x14], 0x44415f55
jmp case.0x180016e60.13
mov byte [rbp - 0xb], 0
mov sil, 1
jmp case.0x180016e60.13
mov dword [rbp - 0x10], 0x505f44
jmp case.0x180016e60.13
mov rcx, r14
call qword [sym.imp.GDI32.dll_UnrealizeObject]
jmp case.0x180016e60.13
xor r14d, r14d
jmp case.0x180016e60.13
mov word [rbp - 0x18], r8w
jmp case.0x180016e60.13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
lea r9, [rbp - 0x28]
mov edx, r15d
lea r8, [rbp - 0x30]
mov qword [r13 + 0x40], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateA]
mov r12d, eax
add ebx, 0xd
lea r11, [0x180000000]
mov edx, 0x4349
mov r8d, 0x43
lea ecx, [rbx + 0xbf]
cmp ecx, edi
jb 0x180016e40
mov eax, dword [rbp + 0x58]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret