Function at 0x4244dd
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x753c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, str.RecoverCyberduckPasswords
push ebx
push str._s___Entered_...
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x753c]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x42453f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.__s_:_CredEnumerate_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4248fc
push edi
push dword [ebp - 0x753c]
push ebx
push str._s_:_CredEnumerate_found__d_accounts
call fcn.00449974
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0x753c], edi
jbe 0x4248ec
push esi
mov eax, dword [ebp - 0x7538]
mov byte [ebp - 0x2714], 0
mov byte [ebp - 0x4e24], 0
mov byte [ebp - 0x7534], 0
mov eax, dword [eax + edi*4]
push dword [eax + 8]
push dword [eax + 4]
push ebx
push 0x677248
call fcn.00449974
mov eax, dword [ebp - 0x7538]
add esp, 0x10
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x1c], 0
je 0x4248cd
cmp dword [eax + 0x18], 0
je 0x4248cd
push str.ftp:__
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push str.ftp:__
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4246ae
push str.ftps:__
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push str.ftps:__
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4246ae
push str.sftp:__
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push str.sftp:__
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4246ae
push 0x6772b0
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push 0x6772b0
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4246ae
push 0x6772b8
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push 0x6772b8
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
je 0x4246ae
push str.file:__
call fcn.00631510
push eax
mov eax, dword [ebp - 0x7538]
push str.file:__
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x4248de
mov eax, dword [ebp - 0x7538]
mov eax, dword [eax + edi*4]
push dword [eax + 8]
push ebx
push str._s_:_Found_Cyberduck_password_with_target___s
call fcn.00449974
mov eax, dword [ebp - 0x7538]
push 0x40
mov eax, dword [eax + edi*4]
push dword [eax + 8]
call fcn.006270b0
add esp, 0x14
test eax, eax
je 0x4246e2
inc eax
jmp 0x4246ee
mov eax, dword [ebp - 0x7538]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x7534]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x7534]
push eax
push ebx
push str._s_:_Found_FTP_server___s
call fcn.00449974
mov ecx, dword [ebp - 0x7538]
add esp, 0x18
mov eax, dword [ecx + edi*4]
cmp dword [eax + 0x30], 0
je 0x424753
push dword [eax + 0x30]
lea eax, [ebp - 0x4e24]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x4e24]
push eax
push ebx
push str._s_:_Found_FTP_user___s
call fcn.00449974
mov ecx, dword [ebp - 0x7538]
add esp, 0x18
mov esi, dword [ecx + edi*4]
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x4248b9
mov esi, dword [esi + 0x18]
cmp esi, 1
jb 0x4248b9
cmp esi, 0x10
jbe 0x42480c
push 0x10
push section..data
push ebx
call fcn.0062534d
add esp, 0xc
test eax, eax
jne 0x424811
push esi
push str.RecoverCyberduckPasswords
push str._s_Password_is_DPAPI_Blob__size_d_....need_to_decrypt_it_now
call fcn.00449974
lea eax, [ebp - 0x2714]
push eax
mov eax, dword [ebp - 0x7538]
push esi
push ebx
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call fcn.004091b2
add esp, 0x1c
mov ebx, str.RecoverCyberduckPasswords
test eax, eax
je 0x4248de
lea eax, [ebp - 0x2714]
push eax
push ebx
push str._s_Successfully_decrypted_credential_password_blob...pass_s
call fcn.00449974
push 0xffffffffffffffff
mov esi, 0x66ae5d
lea eax, [ebp - 0x2714]
push esi
push eax
lea eax, [ebp - 0x4e24]
push eax
lea eax, [ebp - 0x7534]
push eax
push esi
push 0x135
push 4
call fcn.00412c85
add esp, 0x2c
jmp 0x4248de
cmp esi, 2
jb 0x42484e
cmp byte [ebx + 1], 0
jne 0x42484e
shr esi, 1
push esi
push str.RecoverCyberduckPasswords
push str._s___Password_is_in_Unicode___length_d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x2714]
xor ecx, ecx
push ecx
push ecx
push 0x2710
push eax
push esi
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x2710
jmp 0x424877
push esi
push str.RecoverCyberduckPasswords
push str._s___Password_is_in_ASCII___length_d
call fcn.00449974
push esi
push ebx
mov ebx, 0x2710
lea eax, [ebp - 0x2714]
push ebx
push eax
call fcn.00631360
add esp, 0x1c
cmp esi, ebx
jae 0x424909
push 0xffffffffffffffff
mov byte [ebp + esi - 0x2714], 0
lea eax, [ebp - 0x2714]
mov esi, 0x66ae5d
push esi
push eax
lea eax, [ebp - 0x4e24]
push eax
lea eax, [ebp - 0x7534]
push eax
push esi
push 0x135
push 4
call fcn.00412c85
add esp, 0x20
mov ebx, str.RecoverCyberduckPasswords
jmp 0x4248de
mov ebx, str.RecoverCyberduckPasswords
push ebx
push str._s_:__Password_is_empty
call fcn.00449974
pop ecx
pop ecx
jmp 0x4248de
push dword [eax + 8]
push ebx
push 0x677264
call fcn.00449974
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x753c]
jb 0x424563
pop esi
push dword [ebp - 0x7538]
call dword [sym.imp.ADVAPI32.dll_CredFree]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3