Function at 0x140008be0
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov r15, rdx
call fcn.140001b50
mov rbx, qword [0x14000bac0]
mov rax, qword [rbx]
mov qword [rsp + 0xc8], rax
xor eax, eax
cmp qword [r15 + 8], 0
je 0x1400093b8
mov rbp, qword [fcn.140008980]
xor ecx, ecx
lea r12, str.protocol
lea r13, str.host
call rbp
mov rdi, qword [sym.imp.msvcrt.dll__fileno]
lea r14, str.path
mov rcx, rax
call rdi
mov edx, 0x8000
mov rsi, qword [sym.imp.msvcrt.dll__setmode]
mov ecx, eax
call rsi
mov ecx, 1
call rbp
mov rcx, rax
call rdi
mov edx, 0x8000
mov ecx, eax
call rsi
mov edx, 1
mov ecx, 0x19000
call sub.msvcrt.dll_calloc
mov rsi, rax
nop dword [rax]
xor ecx, ecx
call rbp
mov edx, 0x19000
mov rcx, rsi
mov r8, rax
call sub.msvcrt.dll_fgets
test rax, rax
je 0x140008cdc
mov rcx, rsi
call sub.msvcrt.dll_strlen
test rax, rax
je 0x140008cbf
lea r8, [rax - 1]
lea rcx, [rsi + r8]
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140008cd0
cmp dl, 0xd
je 0x140008e40
mov rdx, rsi
lea rcx, str.bad_input:__s
call fcn.140001610
nop
mov byte [rcx], 0
test r8, r8
jne 0x140008e48
mov rcx, rsi
call fcn.140008a70
cmp qword [0x14000f870], 0
je 0x140008e17
cmp qword [0x14000f868], 0
je 0x140008fac
lea rsi, [0x14000f060]
lea r8, str.git:
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcscpy_s]
test eax, eax
jne 0x1400091eb
mov rdx, qword [0x14000f870]
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
lea rdx, [0x14000b046]
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
mov rdx, qword [0x14000f880]
test rdx, rdx
je 0x140008d7d
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
mov r8d, 0x400
lea rdx, [0x14000b04e]
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
mov rdx, qword [0x14000f868]
test rdx, rdx
je 0x140008d97
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
cmp qword [0x14000f860], 0
je 0x140008dcb
mov r8d, 0x400
lea rdx, [0x14000b052]
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
mov rdx, qword [0x14000f860]
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_wcsncat
mov rdi, qword [r15 + 8]
lea rdx, [0x14000b0f2]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov r13d, eax
test eax, eax
je 0x140008fbf
lea rdx, str.store
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140009018
lea rdx, str.erase
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000917c
mov rax, qword [rsp + 0xc8]
sub rax, qword [rbx]
jne 0x1400093d3
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rcx], 0
jmp 0x140008cbf
lea rax, [rsi + rax - 2]
cmp byte [rax], 0xd
je 0x1400093cb
cmp byte [rsi], 0
je 0x140008cdc
mov edx, 0x3d
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x140008cbf
mov byte [rax], 0
mov rdx, r12
mov rcx, rsi
lea rdi, [rax + 1]
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f28
mov rdx, r13
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f40
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f58
lea rdx, str.username
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f70
lea rdx, str.password
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f84
lea rdx, str.password_expiry_utc
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140008f98
lea rdx, [0x14000b0d3]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f040], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f870], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f868], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f860], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f880], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f878], rax
jmp 0x140008c80
mov rcx, rdi
call fcn.1400016e0
mov qword [0x14000f048], rax
jmp 0x140008c80
cmp qword [0x14000f860], 0
jne 0x140008d00
jmp 0x140008e17
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
xor edx, edx
xor edi, edi
lea rcx, [0x14000b0f6]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
jne 0x140009002
jmp 0x140008e17
mov rcx, qword [rcx + rdi*8]
xor edx, edx
lea rsi, [rdi*8]
add rdi, 1
call fcn.1400018e0
test eax, eax
jne 0x1400091f0
mov rcx, qword [rsp + 0x48]
cmp edi, dword [rsp + 0x44]
jb 0x140008fe3
call qword [sym.imp.ADVAPI32.dll_CredFree]
jmp 0x140008e17
cmp qword [0x14000f880], 0
je 0x140008e17
mov rdx, qword [0x14000f878]
test rdx, rdx
je 0x140008e17
mov r8, qword [0x14000f040]
test r8, r8
je 0x1400093a4
lea r13, str._s_r_noauth_refresh_token_s
mov rcx, r13
call qword [sym.imp.msvcrt.dll__scwprintf]
movsxd rbp, eax
lea r12, [rbp + rbp]
mov rcx, r12
call fcn.1400016a0
mov r8, rbp
mov r9, r13
mov rdx, r12
mov rdi, rax
mov rax, qword [0x14000f040]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov rax, qword [0x14000f878]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf_s]
mov rbp, qword [sym.imp.msvcrt.dll__wcsdup]
mov rax, qword [0x14000b200]
movq xmm0, rsi
mov rcx, rdi
mov qword [rsp + 0x70], rax
lea rax, str.saved_by_git_credential_wincred
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x78], xmm0
call sub.msvcrt.dll_wcslen
mov rcx, rdi
add eax, eax
mov dword [rsp + 0x90], eax
call rbp
xor ecx, ecx
mov qword [rsp + 0xa0], 2
mov qword [rsp + 0xa8], rcx
mov rcx, qword [0x14000f048]
mov qword [rsp + 0x98], rax
test rcx, rcx
je 0x14000913a
lea rax, str.git_password_expiry_utc
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_wcslen
xor edx, edx
mov dword [rsp + 0xa4], 1
add eax, eax
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0xb0], rax
mov rax, qword [0x14000f880]
mov qword [rsp + 0xb8], rax
call fcn.140008a70
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CredWriteW]
test eax, eax
jne 0x140008e17
lea rcx, str.CredWrite_failed
call fcn.140001610
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x50]
xor edx, edx
xor esi, esi
lea rcx, [0x14000b0f6]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
mov rdi, qword [sym.imp.ADVAPI32.dll_CredDeleteW]
test eax, eax
jne 0x1400091ab
jmp 0x140008e17
add rsi, 1
mov rcx, qword [rsp + 0x70]
cmp esi, dword [rsp + 0x50]
jae 0x14000900d
xor edx, edx
mov rcx, qword [rcx + rsi*8]
cmp qword [0x14000f878], 0
setne dl
call fcn.1400018e0
test eax, eax
je 0x1400091a7
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov rax, qword [rax + rsi*8]
mov edx, dword [rax + 4]
mov rcx, qword [rax + 8]
call rdi
jmp 0x1400091a7
call fcn.140002b80
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rax, qword [rcx + rsi]
mov rax, qword [rax + 0x48]
test rax, rax
je 0x140009215
mov rcx, rax
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsp + 0x48]
mov r8d, eax
mov rax, qword [rcx + rsi]
lea rcx, str.username
mov rdx, qword [rax + 0x48]
call fcn.140001780
mov rax, qword [rsp + 0x48]
mov rbp, qword [rax + rsi]
mov edi, dword [rbp + 0x20]
test edi, edi
je 0x14000936e
mov r12d, edi
shr edi, 1
mov rcx, r12
call fcn.1400016a0
mov r8, qword [rbp + 0x28]
mov rdx, r12
mov r9d, edi
lea r12, [rsp + 0x50]
mov rdi, rax
mov rcx, rax
mov qword [rsp + 0x30], rax
lea rbp, [0x14000b102]
and r9d, 0x7fffffff
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
mov rcx, rdi
mov r8, r12
mov rdx, rbp
mov rdi, qword [sym.imp.msvcrt.dll_wcstok_s]
call rdi
mov r9, rax
test rax, rax
je 0x1400092a7
mov rcx, rax
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_wcslen
mov r9, qword [rsp + 0x38]
mov r13d, eax
mov r8d, r13d
mov rdx, r9
lea rcx, str.password
mov qword [rsp + 0x38], r9
lea r14, [0x14000b108]
lea r13, str.oauth_refresh_token
call fcn.140001780
lea r15, [0x14000b0d3]
mov r9, qword [rsp + 0x38]
jmp 0x140009325
mov rdx, r14
mov rcx, r9
lea r8, [rsp + 0x70]
call rdi
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140009318
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000930d
mov rcx, rdx
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x70]
mov r8d, eax
mov rcx, r15
call fcn.140001780
mov r8, r12
mov rdx, rbp
xor ecx, ecx
call rdi
mov r9, rax
test r9, r9
jne 0x1400092da
mov rcx, qword [rsp + 0x30]
call fcn.140008a70
xor edi, edi
lea r12, str.git_password_expiry_utc
jmp 0x14000935b
imul rbp, rdi, 0x18
add rbp, qword [rax + 0x38]
mov rdx, r12
add rdi, 1
mov rcx, qword [rbp]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140009383
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + rsi]
cmp edi, dword [rax + 0x34]
jb 0x14000933f
jmp 0x14000900d
mov rdx, qword [rbp + 0x28]
xor r8d, r8d
lea rcx, str.password
call fcn.140001780
jmp 0x140009334
mov r8d, dword [rbp + 0xc]
mov rdx, qword [rbp + 0x10]
lea rcx, str.password_expiry_utc
shr r8d, 1
call fcn.140001780
mov rcx, qword [rsp + 0x48]
jmp 0x14000900d
mov rbp, qword [sym.imp.msvcrt.dll__wcsdup]
mov rcx, rdx
call rbp
mov rdi, rax
jmp 0x14000909a
lea rdx, str.usage:_git_credential_wincred__getstoreerase__n
lea rcx, [0x14000b089]
call fcn.140001610
mov byte [rax], 0
jmp 0x140008e56
call fcn.140002bd0
nop
nop
nop
nop
nop
nop
nop
nop
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x14000f9d0], 0
je 0x1400093f7
add rsp, 0x38
pop rbx
pop rsi
ret
lea rsi, [rsp + 0x2c]
mov rbx, qword [0x14000a0b0]
mov rcx, rsi
call rbx
test eax, eax
je 0x14000941f
movabs rax, 0xdeadbeefdeadbeef
mov qword [0x14000f9d0], rax
jmp 0x1400093f0
mov eax, dword [rsp + 0x2c]
mov rcx, rsi
mov qword [0x14000f9d0], rax
call rbx
mov rax, qword [0x14000f9d0]
mov edx, dword [rsp + 0x2c]
shl rax, 0x20
or rax, rdx
mov qword [0x14000f9d0], rax
jmp 0x1400093f0