Function at 0x140034b30
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push rbp
push rsi
mov rbp, rsp
sub rsp, 0x48
mov ecx, 0x20
call fcn.1400462e4
mov rsi, rax
test rax, rax
je 0x140034b60
mov rcx, rax
call fcn.140005f10
test al, al
jne 0x140034b69
mov rcx, rsi
call fcn.1400462d0
xor eax, eax
add rsp, 0x48
pop rsi
pop rbp
ret
mov ecx, 0x20
mov qword [rsp + 0x38], r12
call fcn.1400462e4
mov r12, rax
test rax, rax
je 0x140034f65
mov qword [rsp + 0x70], rbx
mov rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r13
call fcn.140005f10
xor r13d, r13d
test al, al
je 0x140034cb4
lea r9, [rbp + 0x20]
mov qword [rbp + 0x20], r13
lea r8, [rbp + 0x18]
mov dword [rbp + 0x18], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
mov rdx, qword [rbp + 0x20]
test eax, eax
je 0x140034bd1
test rdx, rdx
je 0x140034cb4
mov r8d, dword [rbp + 0x18]
mov rbx, r13
test r8d, r8d
je 0x140034cab
mov rax, qword [rdx + rbx*8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140034c9c
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140034c00
test rax, rax
je 0x140034c9c
mov ecx, 0x20
call fcn.1400462e4
mov rcx, qword [rbp + 0x20]
mov rdi, rax
mov rcx, qword [rcx + rbx*8]
mov rcx, qword [rcx + 8]
call fcn.14004db8c
mov qword [rdi], rax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + rbx*8]
mov rcx, qword [rcx + 0x48]
call fcn.14004db8c
mov qword [rdi + 8], rax
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rcx + rbx*8]
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x140034c74
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], r13b
jne 0x140034c61
inc rdx
call fcn.140009910
jmp 0x140034c77
mov rax, r13
mov qword [rdi + 0x10], rax
mov rdx, rdi
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + rbx*8]
mov eax, dword [rcx + 0x20]
mov rcx, r12
mov dword [rdi + 0x18], eax
call fcn.1400057c0
mov rdx, qword [rbp + 0x20]
mov r8d, dword [rbp + 0x18]
inc rbx
mov eax, r8d
cmp rbx, rax
jb 0x140034be1
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rax, qword [r12 + 8]
test rax, rax
je 0x140034e6d
mov qword [rsp + 0x20], r15
mov rcx, r13
mov r15d, r13d
mov qword [rsp + 0x28], r14
mov rax, qword [r12]
lea r8, [rbp + 0x18]
mov r14, qword [rax + rcx*8]
lea rcx, [0x140085ad0]
mov qword [rbp + 0x18], r13
mov rdx, qword [r14 + 8]
call fcn.14000b180
cmp eax, 0xffffffff
je 0x140034d55
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140034d55
mov rax, qword [rcx + 8]
test rax, rax
je 0x140034d55
mov ebx, r13d
test eax, eax
jle 0x140034d41
mov rdi, r13
mov rax, qword [rcx]
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140034d36
mov rcx, rdx
call fcn.14004db8c
mov rdx, rax
mov rcx, rsi
call fcn.1400057c0
mov rcx, qword [rbp + 0x18]
inc ebx
add rdi, 8
cmp ebx, dword [rcx + 8]
jl 0x140034d13
mov dl, 1
call fcn.140005c80
mov rcx, qword [rbp + 0x18]
call fcn.1400462d0
mov qword [rbp + 0x18], r13
mov rdx, qword [r14]
lea r8, [rbp + 0x18]
lea rcx, [0x140085ad0]
call fcn.14000b180
cmp eax, 0xffffffff
je 0x140034dd2
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140034dd2
mov rax, qword [rcx + 8]
test rax, rax
je 0x140034dd2
mov ebx, r13d
test eax, eax
jle 0x140034dbe
mov rdi, r13
nop dword [rax]
mov rax, qword [rcx]
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140034db3
mov rcx, rdx
call fcn.14004db8c
mov rdx, rax
mov rcx, rsi
call fcn.1400057c0
mov rcx, qword [rbp + 0x18]
inc ebx
add rdi, 8
cmp ebx, dword [rcx + 8]
jl 0x140034d90
mov dl, 1
call fcn.140005c80
mov rcx, qword [rbp + 0x18]
call fcn.1400462d0
mov qword [rbp + 0x18], r13
mov rdx, qword [r14 + 0x10]
lea r8, [rbp + 0x18]
lea rcx, [0x140085ad0]
call fcn.14000b180
cmp eax, 0xffffffff
je 0x140034e52
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140034e52
mov rax, qword [rcx + 8]
test rax, rax
je 0x140034e52
mov ebx, r13d
test eax, eax
jle 0x140034e3e
mov rdi, r13
nop word [rax + rax]
mov rax, qword [rcx]
mov rdx, qword [rdi + rax]
test rdx, rdx
je 0x140034e33
mov rcx, rdx
call fcn.14004db8c
mov rdx, rax
mov rcx, rsi
call fcn.1400057c0
mov rcx, qword [rbp + 0x18]
inc ebx
add rdi, 8
cmp ebx, dword [rcx + 8]
jl 0x140034e10
mov dl, 1
call fcn.140005c80
mov rcx, qword [rbp + 0x18]
call fcn.1400462d0
mov qword [rbp + 0x18], r13
inc r15d
mov ecx, r15d
cmp rcx, qword [r12 + 8]
jb 0x140034cd2
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rcx, r12
call fcn.140005f50
test al, al
je 0x140034f56
mov rdi, r13
cmp qword [r12 + 8], r13
jbe 0x140034f44
nop dword [rax + rax]
mov rax, qword [r12]
mov rbx, qword [rax + rdi*8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140034ecf
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140034eb0
add r8, r8
xor edx, edx
call fcn.1400452a0
mov rcx, qword [rbx]
call fcn.1400462d0
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140034f01
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140034ee0
add r8, r8
xor edx, edx
call fcn.1400452a0
mov rcx, qword [rbx + 8]
call fcn.1400462d0
mov qword [rbx + 8], r13
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140034f32
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140034f11
add r8, r8
xor edx, edx
call fcn.1400452a0
mov rcx, qword [rbx + 0x10]
call fcn.1400462d0
mov qword [rbx + 0x10], r13
inc rdi
mov dword [rbx + 0x18], r13d
cmp rdi, qword [r12 + 8]
jb 0x140034e90
mov dl, 1
mov rcx, r12
call fcn.140005c80
mov rcx, r12
call fcn.1400462d0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rax, rsi
add rsp, 0x48
pop rsi
pop rbp
ret