Function at 0x1800cd3d0
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x180183c70]
xor rax, rsp
mov qword [rbp + 0x408], rax
mov dword [rsp + 0x34], r8d
mov r11, rdx
mov qword [rbp - 0x50], rdx
mov rdi, rcx
mov qword [rsp + 0x78], rcx
xor r15d, r15d
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
mov ecx, r8d
mov dword [rsp + 0x40], ecx
imul eax, r8d, 0x29e
mov dword [rsp + 0x68], eax
lea r14, [0x180000000]
movabs r13, 0x7ffffffffffffffe
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x38], edx
cmp r8d, eax
ja 0x1800cdceb
lea r12d, [r15 + 0x2e]
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x30], al
mov r10d, 0x6e69
mov r9d, 0x6666
mov esi, 0x300
mov ebx, 0x203
cmp ecx, 0xda
ja 0x1800cd5ee
je 0x1800cd5cd
mov eax, ecx
sub eax, 0xe
je 0x1800cd59c
sub eax, 0x58
je 0x1800cd53c
sub eax, 0x17
je 0x1800cd527
sub eax, 0x18
je 0x1800cd4df
mov rbx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x38]
cmp eax, 0x37
jne 0x1800cdcb8
mov sil, 1
mov byte [rsp + 0x30], sil
jmp 0x1800cdcbd
movzx eax, word [rdi]
cmp ax, bx
jne 0x1800cd504
lea rdx, str._s:_Fatal_session_error._Cleaning_up_AIO_session
mov ecx, 0x40
call fcn.1800eba40
movzx eax, word [rdi]
mov ecx, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x34]
sub ax, si
cmp ax, 1
ja 0x1800cdcaf
lea rdx, str.AMT_ThirdPartyDataStorageAdministrationService
mov ecx, 0x40
call fcn.1800eba40
jmp 0x1800cdca6
mov r8d, 0xcf
mov rdx, rdi
xor ecx, ecx
call fcn.180114960
jmp 0x1800cdca6
mov r8d, 0x2d8
lea rdx, [rbp + 0xf0]
mov ecx, dword [rdi]
call qword [0x180183e78]
test eax, eax
je 0x1800cd582
mov ecx, 0xc2
nop word [rax + rax]
mov eax, ecx
sub eax, 0xc2
je 0x1800cd574
cmp eax, 1
je case.0x1800cdd60.15
jmp 0x1800cd578
mov qword [rbp - 0x48], r15
inc ecx
cmp ecx, 0xc4
jb 0x1800cd560
movsxd rax, dword [rdi]
lea rcx, [rax + rax*8]
mov rcx, qword [r14 + rcx*8 + 0x183ef8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800cdca6
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x34]
mov rcx, r11
call fcn.1800c0a30
mov rbx, rax
mov qword [rsp + 0x48], rax
mov edx, 0xffffffff
mov dword [rsp + 0x38], edx
mov ecx, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x34]
jmp 0x1800cdcb8
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, 0x124
lea rdx, [0x1801d4de0]
xor ecx, ecx
call fcn.180034020
jmp 0x1800cdca6
cmp ecx, 0x1b18
je 0x1800cdc63
cmp ecx, 0x3630
je 0x1800cdaf9
cmp ecx, 0x6b94
je 0x1800cd743
cmp ecx, 0xa0f8
jne 0x1800cdcaf
mov dword [rsp + 0x70], r15d
mov rdi, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
cmp rdi, rcx
jae 0x1800cd656
lea rax, [rdi + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rcx, 8
cmovae rax, qword [rbp + 0x20]
mov dword [rax + rdi*2], 0x2e
mov rdi, qword [rsp + 0x78]
jmp 0x1800cdcab
mov rax, r13
sub rax, rdi
cmp rax, 1
jb 0x1800ce5f4
lea r15, [rdi + 1]
mov rsi, qword [rbp + 0x38]
mov rbx, r15
or rbx, 7
cmp rbx, r13
jbe 0x1800cd67f
mov rbx, r13
jmp 0x1800cd6a0
mov rcx, rsi
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp rsi, rax
jbe 0x1800cd695
mov rbx, r13
jmp 0x1800cd6a0
lea rax, [rcx + rsi]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.180040c80
mov r14, rax
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
add rdi, rdi
mov r8, rdi
mov rcx, rax
cmp rsi, 8
jb 0x1800cd721
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x2e
xor r15d, r15d
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x1800cd70b
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ce570
mov rbx, rcx
mov rcx, rbx
call fcn.18015bd10
mov qword [rbp + 0x20], r14
mov rdi, qword [rsp + 0x78]
jmp 0x1800cdca6
lea rdx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x2e
xor r15d, r15d
mov qword [rbp + 0x20], r14
mov rdi, qword [rsp + 0x78]
jmp 0x1800cdca6
movups xmm0, xmmword [str.553_OF_WITH_NOT_122_TO]
movups xmmword [rbp + 0x3d0], xmm0
movups xmm1, xmmword [0x18016dac8]
movups xmmword [rbp + 0x3e0], xmm1
movups xmm0, xmmword [0x18016dad8]
movups xmmword [rbp + 0x3f0], xmm0
movzx eax, word [0x18016dae8]
mov word [rbp + 0x400], ax
mov rdx, r15
mov qword [rbp - 0x70], rdx
cmp qword [0x180182b98], 0
jbe 0x1800cdcaf
mov ebx, r15d
cmp ebx, 0x12
ja case.default.0x1800cd7a9
mov eax, ebx
mov ecx, dword [r14 + rax*4 + 0xce600]
add rcx, r14
jmp rcx
mov word [rbp + 0x47], 0x65
jmp case.default.0x1800cd7a9
mov word [rbp + 0x45], r9w
jmp case.default.0x1800cd7a9
cmp byte [rsp + 0x31], 0
je 0x1800cd7e8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mmioSetBuffer]
mov edx, 0x10
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mmioClose]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp - 0x30]
mov edx, dword [rbp - 0x80]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
jmp 0x1800cdaad
mov dword [rbp - 0x7c], r15d
jmp case.default.0x1800cd7a9
mov word [rbp + 0x49], r10w
mov byte [rbp + 0x4b], 0
jmp case.default.0x1800cd7a9
mov eax, dword [0x18016db16]
mov dword [rbp + 0x4e], eax
movzx eax, byte [0x18016db1a]
mov byte [rbp + 0x52], al
mov byte [rbp + 0x53], 0
jmp case.default.0x1800cd7a9
mov byte [rbp + 0x49], 0
jmp case.default.0x1800cd7a9
mov byte [rbp + 0x47], 0
jmp case.default.0x1800cd7a9
mov byte [rsp + 0x31], 1
jmp case.default.0x1800cd7a9
movups xmm0, xmmword [str.Vmount_library:___]
movups xmmword [rbp + 0x60], xmm0
movzx eax, word [0x18016db30]
mov word [rbp + 0x70], ax
movzx eax, byte [0x18016db32]
mov byte [rbp + 0x72], al
jmp case.default.0x1800cd7a9
mov dword [rbp - 0x80], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov dword [rbp + 0xe0], eax
jmp case.default.0x1800cd7a9
mov byte [rbp + 0x53], 0x73
jmp case.default.0x1800cd7a9
mov byte [rbp + 0x54], 0
jmp case.default.0x1800cd7a9
mov r8d, 1
lea rdx, [0x18016db4c]
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800cdaad
lea rax, [0x180182b88]
cmp qword [0x180182ba0], 0x10
cmovae rax, qword [0x180182b88]
movsx r13d, byte [rax + rdx]
mov rsi, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
cmp rsi, rcx
jae 0x1800cd93b
lea rax, [rsi + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rcx, 8
cmovae rax, qword [rbp + 0x20]
mov word [rax + rsi*2], r13w
mov word [rax + rsi*2 + 2], r15w
jmp case.default.0x1800cd7a9
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x1800ce5fa
lea r12, [rsi + 1]
mov r15, qword [rbp + 0x38]
mov rdi, r12
or rdi, 7
cmp rdi, rdx
jbe 0x1800cd96e
mov rdi, rdx
jmp 0x1800cd98f
mov rcx, r15
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r15, rax
jbe 0x1800cd984
mov rdi, rdx
jmp 0x1800cd98f
lea rax, [r15 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x20]
call fcn.180040c80
mov r14, rax
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r15, 8
jb 0x1800cda17
mov rdi, qword [rbp + 0x20]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + r14], r13w
xor eax, eax
mov word [rsi + r14 + 2], ax
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x1800cd9fc
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x1800cdcdd
mov rdi, rcx
mov rcx, rdi
call fcn.18015bd10
mov qword [rbp + 0x20], r14
xor r15d, r15d
lea r14, [0x180000000]
jmp 0x1800cdaad
lea rdx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + r14], r13w
xor r15d, r15d
mov word [rsi + r14 + 2], r15w
mov qword [rbp + 0x20], r14
lea r14, [0x180000000]
jmp 0x1800cdaad
mov r8d, 3
lea rdx, str.gP_SetPortgroup_DistributedVirtualPortgroupInfo_Dvs_Vim__QAEXPAVMoRef_Vmomi___Z
lea rcx, [rbp + 0x4b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x4e], 0
jmp 0x1800cdaad
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov ecx, r15d
movzx eax, byte [rsp + 0x31]
cmp qword [rbp - 0x78], 0
cmovne ecx, eax
mov byte [rsp + 0x31], cl
jmp case.default.0x1800cd7a9
mov eax, dword [0x18016dbca]
mov dword [rbp + 0x40], eax
movzx eax, byte [0x18016dbce]
mov byte [rbp + 0x44], al
jmp case.default.0x1800cd7a9
mov r8d, dword [rbp - 0x7c]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov qword [rbp - 0x78], rax
mov r10d, 0x6e69
mov r9d, 0x6666
mov rdx, qword [rbp - 0x70]
inc ebx
lea ecx, [rbx + 0x5e]
cmp ecx, 0x71
jb 0x1800cd793
inc rdx
mov qword [rbp - 0x70], rdx
cmp rdx, qword [0x180182b98]
jb 0x1800cd790
mov rdi, qword [rsp + 0x78]
mov r12d, 0x2e
movabs r13, 0x7ffffffffffffffe
jmp 0x1800cdca6
mov rdi, qword [0x180182b78]
lea rbx, [0x180182b68]
cmp qword [0x180182b80], 8
cmovae rbx, qword [0x180182b68]
cmp rdi, 8
jae 0x1800cdb2f
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x40], xmm0
mov esi, 7
mov r15, qword [rbp + 0x40]
jmp 0x1800cdb64
mov rsi, rdi
or rsi, 7
cmp rsi, r13
cmova rsi, r13
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x40]
call fcn.180040c80
mov r15, rax
mov qword [rbp + 0x40], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rdi
lea r14, [rbp + 0x40]
cmp rsi, 8
cmovae r14, r15
cmp rdi, 8
jae 0x1800cdb8c
movups xmm0, xmmword [r14]
mov qword [rbp + 0x78], 7
jmp 0x1800cdbc6
mov rbx, rdi
or rbx, 7
cmp rbx, r13
cmova rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x60]
call fcn.180040c80
mov qword [rbp + 0x60], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x78], rbx
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp + 0x70], rdi
mov rcx, qword [rbp + 0x38]
cmp rcx, 8
jb 0x1800cdc0e
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800cdc09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800cdce4
call fcn.18015bd10
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x20], xmm0
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp + 0x30], xmm0
cmp rsi, 8
jb 0x1800cdc59
lea rdx, [rsi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1800cdc51
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ce570
mov rcx, r15
call fcn.18015bd10
mov rdi, qword [rsp + 0x78]
xor r15d, r15d
jmp 0x1800cdca6
mov dword [rsp + 0x28], 0x151
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xf4]
xor ecx, ecx
call fcn.180004f50
movsxd rcx, dword [rdi]
lea rdx, [rcx + rcx*8]
mov qword [r14 + rdx*8 + 0x183ef8], rax
movsxd rax, dword [rdi]
lea rax, [rax + rax*8]
mov rax, qword [r14 + rax*8 + 0x183ef8]
mov qword [rbp - 0x48], rax
mov r8d, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
movzx esi, byte [rsp + 0x30]
imul eax, r8d, 0x43
add ecx, eax
mov dword [rsp + 0x40], ecx
mov r11, qword [rbp - 0x50]
cmp ecx, dword [rsp + 0x68]
ja 0x1800cdd0a
lea r14, [0x180000000]
jmp 0x1800cd47a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, qword [rbp - 0x78]
mov qword [rsp + 0x48], rbx
mov r10d, dword [rsp + 0x68]
mov dword [rsp + 0x70], r10d
movzx esi, byte [rsp + 0x3c]
mov byte [rsp + 0x30], sil
jmp 0x1800cdd0f
mov r10d, dword [rsp + 0x70]
lea eax, [r8 - 0xb]
mov dword [rbp - 0x80], eax
cmp r8d, eax
jbe case.0x1800cdd60.15
mov r14d, 0x74
lea r9d, [r14 - 0x13]
mov r13, qword [rbp - 0x40]
mov r12, qword [rbp - 0x40]
lea eax, [r8 - 0xc]
cmp eax, 0xc0
ja case.0x1800cdd60.22
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0xce678]
mov ecx, dword [rcx + rax*4 + 0xce64c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x54], r15d
jmp case.0x1800cdd60.22
mov r14d, r15d
cmp dword [rbx + 8], 0
jbe 0x1800ce068
nop dword [rax]
mov esi, 6
lea r15d, [rsi + 1]
nop dword [rax]
cmp esi, 6
ja case.default.0x1800cddbc
mov eax, esi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xce73c]
add rcx, rdx
jmp rcx
mov rax, qword [rbp - 0x60]
mov rax, qword [rax + 8]
mov qword [rbp - 0x78], rax
jmp case.default.0x1800cddbc
cmp byte [rsp + 0x31], 0
je 0x1800cde3f
mov ebx, 0x3f
mov rdi, qword [rbp - 0x78]
nop
cmp ebx, 0x3f
je 0x1800cde1a
cmp ebx, 0x56a
jne 0x1800cde2a
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 0xfe
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rdi
call fcn.1800e9d30
jmp 0x1800cde2a
xor edx, edx
mov r8d, 0x95
mov rcx, rdi
call fcn.1800cd3d0
add ebx, 0x52b
cmp ebx, 0xa56
jbe 0x1800cdde0
mov rdi, qword [rsp + 0x78]
jmp 0x1800cde52
mov r8d, 0xcc
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp + 0x60]
call fcn.180154900
test r14d, r14d
jne 0x1800cdef0
mov ebx, 0xe4
mov eax, ebx
sub eax, 0xe4
je 0x1800cdeac
sub eax, 1
je 0x1800cde84
cmp eax, 1
jne 0x1800cded3
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 8]
shl eax, 2
mov dword [r13 + 0x20], eax
jmp 0x1800cded3
mov byte [rsp + 0x50], 0x47
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, rdi
mov edx, 0xe1
lea rcx, [rsp + 0x50]
call fcn.1800966f0
mov r13, rax
jmp 0x1800cded3
mov dword [rsp + 0x28], 0xdd
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1801d4e90]
call fcn.180142f90
mov dword [rsp + 0x38], eax
inc ebx
cmp ebx, 0xe7
jb 0x1800cde60
mov rbx, qword [rsp + 0x48]
jmp case.default.0x1800cddbc
mov byte [rsp + 0x58], 0x48
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x60]
mov edx, 0x91
xor ecx, ecx
call fcn.1800e9650
mov r13, rax
mov ebx, 0xdf
mov eax, ebx
sub eax, 0xdf
je 0x1800cdf56
cmp eax, 1
jne 0x1800cdf5d
cmp byte [rdi], al
jne 0x1800cdf4c
lea rdx, [rdi + 8]
mov dword [rsp + 0x20], 0x55
mov r9, qword [0x1801d4e90]
xor r8d, r8d
xor ecx, ecx
call fcn.180075f40
mov dword [r13 + 0x18], eax
jmp 0x1800cdf5d
mov rax, qword [rdi + 8]
mov qword [r13 + 0x18], rax
jmp 0x1800cdf5d
movzx eax, byte [rdi]
mov byte [r13 + 0x2b], al
inc ebx
cmp ebx, 0xe1
jb 0x1800cdf17
mov rbx, qword [rsp + 0x48]
jmp case.default.0x1800cddbc
mov rax, qword [rbp - 0x60]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x70], rax
jmp case.default.0x1800cddbc
mov eax, r14d
mov rax, qword [rbx + rax*8 + 0x10]
mov qword [rbp - 0x60], rax
jmp case.default.0x1800cddbc
cmp qword [rbp - 0x70], 0
je case.default.0x1800cddbc
mov ebx, 0x6e
mov rdi, qword [rbp - 0x70]
mov eax, ebx
sub eax, 0x6c
je 0x1800cdfe2
sub eax, 1
je 0x1800cdfcc
cmp eax, 1
jne 0x1800cdfe6
mov r8d, 0xcc
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.180154900
jmp 0x1800cdfe6
mov r9d, 0xe9
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.1800fa020
jmp 0x1800cdfe6
lea r12, [rbp + 0x40]
dec ebx
cmp ebx, 0x6b
ja 0x1800cdfa7
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x48]
jmp case.default.0x1800cddbc
movzx eax, byte [rsp + 0x31]
or dword [r13 + 0x20], eax
cmp qword [rbp - 0x70], 0
je case.default.0x1800cddbc
cmp byte [rbp + 0x40], 1
jne case.default.0x1800cddbc
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1800aa6a0
cmp al, 6
jne case.default.0x1800cddbc
mov byte [rsp + 0x3c], 0
jmp case.default.0x1800cddbc
mov rax, qword [rbp - 0x60]
movzx eax, byte [rax + 2]
mov byte [rsp + 0x31], al
xor eax, eax
mov r12d, eax
dec esi
sub r15, 1
jne 0x1800cdda0
inc r14d
cmp r14d, dword [rbx + 8]
jb 0x1800cdd90
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
mov r9d, 0x61
mov r14d, 0x74
dec r8d
mov dword [rsp + 0x34], r8d
cmp r8d, dword [rbp - 0x80]
jbe case.0x1800cdd60.15
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x70]
mov r11, qword [rbp - 0x50]
jmp 0x1800cdd31
mov r8, rdi
mov edx, 0xad
lea rcx, [rbp + 0x20]
call fcn.180059da0
mov byte [rbp - 0x48], al
mov r8d, dword [rsp + 0x34]
mov r9d, 0x61
jmp case.0x1800cdd60.22
mov ecx, r15d
movzx eax, sil
cmp dword [rbp - 0x7c], 0
cmovne ecx, eax
movzx esi, cl
mov byte [rsp + 0x30], cl
test cl, cl
je case.0x1800cdd60.22
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov r8d, dword [rsp + 0x34]
mov r9d, 0x61
jmp case.0x1800cdd60.22
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
mov r8d, dword [rsp + 0x34]
mov r9d, 0x61
jmp case.0x1800cdd60.22
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x54]
mov edx, r10d
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
mov dword [rbp - 0x7c], eax
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x38]
cmp rsi, rdi
jae 0x1800ce168
lea rcx, [rsi + 1]
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x20]
cmp rdi, 8
cmovae rcx, qword [rbp + 0x20]
mov dword [rcx + rsi*2], 0x74
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
mov r9d, 0x61
jmp case.0x1800cdd60.22
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x1800ce5f4
lea r15, [rsi + 1]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x1800ce197
mov rbx, rdx
jmp 0x1800ce1b8
mov rcx, rdi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rdi, rax
jbe 0x1800ce1ad
mov rbx, rdx
jmp 0x1800ce1b8
lea rax, [rdi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.180040c80
mov r14, rax
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp rdi, 8
jb 0x1800ce23e
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + rsi], 0x74
xor r15d, r15d
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x1800ce223
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ce570
mov rbx, rcx
mov rcx, rbx
call fcn.18015bd10
mov qword [rbp + 0x20], r14
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
jmp 0x1800ce062
lea rdx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + rsi], 0x74
xor r15d, r15d
mov qword [rbp + 0x20], r14
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
jmp 0x1800ce062
mov rsi, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
cmp rsi, rcx
jae 0x1800ce297
lea rax, [rsi + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rcx, 8
cmovae rax, qword [rbp + 0x20]
mov dword [rax + rsi*2], 0x64
mov rdi, qword [rbp + 0x20]
jmp 0x1800ce381
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x1800ce5f4
lea r15, [rsi + 1]
mov r14, qword [rbp + 0x38]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x1800ce2ca
mov rbx, rdx
jmp 0x1800ce2eb
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x1800ce2e0
mov rbx, rdx
jmp 0x1800ce2eb
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.180040c80
mov rdi, rax
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x1800ce35f
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x64
xor r15d, r15d
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x1800ce355
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ce570
mov rbx, rcx
mov rcx, rbx
call fcn.18015bd10
jmp 0x1800ce372
lea rdx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x64
xor r15d, r15d
mov r9d, 0x61
mov r8d, dword [rsp + 0x34]
mov qword [rbp + 0x20], rdi
mov r14, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
cmp r14, rsi
jae 0x1800ce3b4
lea rax, [r14 + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rsi, 8
cmovae rax, rdi
mov dword [rax + r14*2], 0x61
movzx esi, byte [rsp + 0x30]
jmp 0x1800ce068
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x1800ce5f4
lea r15, [r14 + 1]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x1800ce3e3
mov rbx, rdx
jmp 0x1800ce404
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x1800ce3f9
mov rbx, rdx
jmp 0x1800ce404
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.180040c80
mov rdi, rax
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
add r14, r14
mov r8, r14
mov rcx, rax
cmp rsi, 8
jb 0x1800ce48a
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + rdi], 0x61
xor r15d, r15d
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x1800ce46f
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800ce570
mov rbx, rcx
mov rcx, rbx
call fcn.18015bd10
mov qword [rbp + 0x20], rdi
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
jmp 0x1800ce062
lea rdx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 0x61
mov dword [r14 + rdi], r9d
xor r15d, r15d
mov qword [rbp + 0x20], rdi
mov r8d, dword [rsp + 0x34]
movzx esi, byte [rsp + 0x30]
jmp 0x1800ce068
cmp dword [rbx + 8], 0
jne 0x1800ce4e7
mov byte [rsp + 0x60], 0x47
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rdi
mov edx, 0xe1
lea rcx, [rsp + 0x60]
call fcn.1800966f0
mov edx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov r9d, 0x61
cmp byte [rsp + 0x3c], 0
jne case.0x1800cdd60.22
mov ecx, 0xfd
cmp ecx, 0xfd
je 0x1800ce50e
cmp ecx, 0x7892
jne 0x1800ce523
or dword [r13 + 0x20], 2
jmp 0x1800ce523
mov eax, edx
lea r13, [rax + rax*2]
shl r13, 4
mov rax, qword [0x1801d4e90]
add r13, qword [rax + 0x40]
add ecx, 0x7795
cmp ecx, 0xef2a
jbe 0x1800ce4f7
jmp case.0x1800cdd60.22
mov byte [rsp + 0x3c], 1
lea rax, [rdi + 8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov r9d, 0x8f
xor r8d, r8d
xor edx, edx
mov rcx, r11
call fcn.1801444f0
test al, al
jne 0x1800ce580
mov r8d, dword [rsp + 0x34]
mov r9d, 0x61
jmp case.0x1800cdd60.22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov byte [rdi], 1
mov rcx, qword [rbp + 0x38]
cmp rcx, 8
jb 0x1800ce5c6
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ce5c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ce5c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18015bd10
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp + 0x408]
xor rcx, rsp
call fcn.18015c4c0
mov rbx, qword [rsp + 0x560]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001bbe0
nop
call fcn.18001bbe0
int3