Function at 0x1800208a0
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x18006f730]
xor rax, rsp
mov qword [rbp + 0x90], rax
lea ebx, [r8 + 0xc]
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x28], ebx
cmp r8d, ebx
movzx ebx, byte [rsp + 0x20]
mov rdi, r9
mov r9, rdx
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x20], bl
mov rdx, rcx
mov dword [rsp + 0x30], r8d
mov esi, r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x24], r8d
jae 0x180020b44
movzx r12d, byte [rsp + 0x20]
lea r13d, [r8 - 0x2b]
mov eax, dword [rsp + 0x28]
lea rdx, [0x180000000]
mov r8d, 0x6f6d
nop word [rax + rax]
cmp r13d, 0x19
ja case.default.0x180020945
mov ecx, dword [rdx + r13*4 + 0x20d98]
add rcx, rdx
jmp rcx
xor bl, bl
mov byte [rsp + 0x20], bl
jmp case.0x180020945.7
mov dword [rsp + 0x65], 0x656d6f72
jmp case.0x180020945.7
mov byte [rsp + 0x6e], 0
jmp case.0x180020945.7
mov r8d, 5
lea rdx, [0x180052734]
lea rcx, [rsp + 0x6e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180020b13
mov word [rsp + 0x60], r8w
mov byte [rsp + 0x62], 0
jmp case.0x180020945.7
xor r8d, r8d
nop dword [rax]
mov edx, 0xd6
mov eax, edx
sub eax, 0xd6
je 0x1800209f4
sub eax, 1
je 0x1800209bd
cmp eax, 1
jne 0x180020a09
inc qword [r9]
jmp 0x180020a09
lea eax, [r12 - 0x67]
cmp al, 0x13
jbe 0x180020a09
mov eax, 0x12b
nop dword [rax + rax]
cmp eax, 0x12b
je 0x1800209e4
cmp eax, 0x2fe3
je case.0x180020945.14
jmp 0x1800209e6
xor bl, bl
add eax, 0x2eb8
cmp eax, 0x5d70
jbe 0x1800209d0
jmp 0x180020a09
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x180020a01
mov rcx, qword [rdi]
mov rax, qword [r9]
movzx r12d, byte [rcx + rax]
inc edx
cmp edx, 0xd9
jb 0x1800209a5
inc r8
cmp r8, 4
jb 0x1800209a0
mov bl, 1
mov byte [rsp + 0x20], bl
jmp 0x180020b18
mov r8d, 3
mov byte [rsp + 0x73], 0
lea rdx, [0x180052761]
lea rcx, [rsp + 0x73]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180020b13
mov r8d, 3
lea rdx, [0x180052796]
lea rcx, [rsp + 0x62]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180020b13
mov eax, dword [0x1800527e4]
mov dword [rsp + 0x69], eax
movzx eax, byte [0x1800527e8]
mov byte [rsp + 0x6d], al
jmp case.0x180020945.7
mov r10, qword [r9]
mov r15, qword [r9 + 8]
cmp r10, r15
je case.0x180020945.7
mov r11, qword [rdi + 8]
mov r14, qword [rdi]
mov r9, r14
cmp r14, r11
je 0x180020af8
mov rdi, qword [r10 + 0x18]
mov rsi, qword [r10 + 0x10]
mov rcx, r10
cmp rdi, 8
jb 0x180020ab3
mov rcx, qword [r10]
cmp qword [r9 + 0x18], 8
mov r8, r9
jb 0x180020ac0
mov r8, qword [r9]
mov rdx, qword [r9 + 0x10]
cmp rdx, rsi
jne 0x180020bd3
test rdx, rdx
je 0x180020af8
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180020bd3
add rcx, 2
sub rdx, 1
jne 0x180020ae0
cmp r9, r11
jne 0x180020be5
add r10, 0x20
cmp r10, r15
jne 0x180020a97
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
lea rdx, [0x180000000]
mov r8d, 0x6f6d
mov eax, dword [rsp + 0x28]
inc esi
inc r13d
mov dword [rsp + 0x24], esi
cmp esi, eax
jb 0x180020930
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
lea ecx, [r8 + 0x1b0]
mov dword [rsp + 0x24], ecx
cmp r8d, ecx
jae case.0x180020945.14
movzx r15d, byte [rsp + 0x20]
lea rax, [0x180020e00]
mov r14d, dword [rsp + 0x34]
movzx r12d, byte [rsp + 0x20]
mov r13d, dword [rsp + 0x34]
mov esi, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x34]
nop dword [rax]
cmp r8d, 0x103
ja 0x180020c39
je 0x180020c31
mov eax, r8d
sub eax, 0x2b
je 0x180020c24
sub eax, 0x24
je 0x180020c1c
sub eax, 0x48
je 0x180020bf4
sub eax, 0x24
je 0x180020bec
cmp eax, 0x24
lea rax, [0x180020e00]
jne 0x180020d42
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x40], 0
jmp 0x180020d42
add r9, 0x20
cmp r9, r11
jne 0x180020aa7
jmp 0x180020b01
mov al, 1
jmp 0x180020d6b
xor r13d, r13d
jmp 0x180020d3b
movzx eax, word [rdx]
mov r8, rdi
lea rdx, [rsp + 0x28]
mov word [rsp + 0x28], ax
mov ecx, 0xaa
call fcn.180003540
mov qword [rsp + 0x28], 0
jmp 0x180020d32
mov r12b, 1
jmp 0x180020d3b
mov byte [rsp + 0x76], 0
mov r15b, 1
jmp 0x180020d3b
mov qword [rdi], rax
jmp 0x180020d42
mov eax, r8d
sub eax, 0x127
je 0x180020d05
sub eax, 0x24
je 0x180020cf4
sub eax, 0x24
je 0x180020ce2
sub eax, 0x24
je 0x180020c8f
cmp eax, 0x24
jne 0x180020d3b
lea rcx, [rdi + 0xa]
cmp rcx, r9
je 0x180020d37
cmp qword [r9 + 0x18], 0x10
mov rdx, r9
jb 0x180020c81
mov rdx, qword [r9]
mov r8, qword [r9 + 0x10]
call fcn.180022c10
jmp 0x180020d32
test r15b, r15b
je 0x180020ca8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov ecx, dword [rsp + 0x24]
mov r8d, dword [rsp + 0x30]
test r12b, r12b
je 0x180020d3b
mov edi, 0x52
mov eax, edi
sub eax, 0x52
je 0x180020cd4
cmp eax, 1
jne 0x180020cd9
mov r8d, esi
lea rdx, [rbp - 0x80]
mov ecx, r14d
call qword [sym.imp.WINMM.dll_midiInGetErrorTextA]
jmp 0x180020cd9
mov esi, 0x104
inc edi
cmp edi, 0x54
jb 0x180020cb6
jmp 0x180020d32
xor ecx, ecx
movzx eax, r12b
test r14d, r14d
cmovne ecx, eax
movzx r12d, cl
jmp 0x180020d37
xor ecx, ecx
movzx eax, r15b
test ebx, ebx
cmovne ecx, eax
movzx r15d, cl
jmp 0x180020d37
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WINMM.dll_midiInGetID]
lea r9, [rsp + 0x58]
mov edx, r13d
lea r8, [rsp + 0x34]
mov r14d, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateA]
mov ebx, eax
mov r8d, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
lea rax, [0x180020e00]
mov r9, qword [rsp + 0x38]
add r8d, 0x24
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x30], r8d
cmp r8d, ecx
jb 0x180020b80
movzx ebx, byte [rsp + 0x20]
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.18003c900
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret