Function at 0x46e9c0
Capabilities:
Acquire credentials from windows credential manager
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4308
call fcn.0047aea0
push ebx
push ebp
mov ebp, dword [esp + 0x4314]
push esi
mov esi, ecx
push edi
mov ecx, ebp
call fcn.0046e780
push 0x1ff
push str.WindowsSystem32Config
mov eax, ebp
mov ecx, esi
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x400]
push str.WindowsSystem32MicrosoftProtect
mov ecx, esi
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x800]
push str.ProgramDataMicrosoftVault
mov ecx, esi
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x1400]
push str.ProgramDataMicrosoftWlansvcProfiles
mov ecx, esi
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x1800]
push str.WindowsSystem32_ras
mov ecx, esi
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0xc00]
push str.systemprofileAppDataLocalMicrosoftVault
mov ecx, ebp
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x1000]
push str.systemprofileAppDataLocalMicrosoftCredentials
mov ecx, ebp
call fcn.00468830
push 0x1ff
lea eax, [ebp + 0x2000]
push str.systemprofileAppDataLocalMicrosoftWindowsCloudAPCacheMicrosoftAccount
mov ecx, ebp
call fcn.00468830
add esp, 0x40
xor edi, edi
push 0x3fe
lea ecx, [esp + 0x276]
lea eax, [esp + 0x678]
push edi
push ecx
mov dword [esp + 0x67c], 0xffffffff
mov word [esp + 0x680], di
mov word [esp + 0x10d4], di
mov word [esp + 0xcd4], di
mov dword [esp + 0xa80], eax
mov word [esp + 0x27c], di
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.Users
lea eax, [esp + 0x278]
mov ecx, esi
mov dword [esp + 0x1c], 1
call fcn.00468830
add esp, 8
lea edx, [esp + 0x270]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46eb3b
push 0x104
push str.Documents_And_Settings
lea eax, [esp + 0x278]
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.00468830
add esp, 8
lea eax, [esp + 0x270]
lea ebx, [ebp + 0x1c00]
lea edx, [eax + 2]
jmp 0x46eb50
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x46eb50
sub eax, edx
sar eax, 1
cmp eax, 0x1ff
jl 0x46eb6b
mov eax, 0x1fe
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x274]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x270]
push ecx
mov word [esi + ebx], di
push 0x47c970
lea ebx, [esp + 0x678]
call fcn.00466830
mov esi, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00466780
test eax, eax
je 0x46eefa
jmp 0x46ebc0
test byte [esp + 0xa78], 0x10
je 0x46eee6
test dword [esp + 0xa78], 0x400
jne 0x46eee6
lea esi, [esp + 0xaa4]
call fcn.00467780
test eax, eax
jne 0x46eee6
mov edx, esi
push str.default
push edx
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x46eee6
mov eax, esi
push str.LocalService
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x46eee6
mov ecx, esi
push str.All_Users
push ecx
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x46eee6
mov edx, esi
push str.NetworkService
push edx
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x46eee6
mov eax, esi
push str.Default_User
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x46eee6
lea ecx, [esp + 0xcc8]
push ecx
call fcn.0046e850
add esp, 4
push 0x3fe
lea edx, [esp + 0x14ce]
push edi
push edx
mov word [esp + 0x14d4], di
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1ff
push str.ntuser.dat
lea eax, [esp + 0x14d0]
lea ecx, [esp + 0xcd0]
call fcn.00468830
push 0x24c
lea eax, [esp + 0x30]
push edi
push eax
mov dword [esp + 0x34], edi
call sub.msvcrt.dll_memset
lea ecx, [esp + 0x34]
add esp, 0x14
push ecx
lea ecx, [esp + 0x14cc]
call fcn.00467060
add esp, 4
test eax, eax
je 0x46eee6
push 0x2a4c
lea edx, [esp + 0x18d0]
push edi
push edx
call sub.msvcrt.dll_memset
mov ecx, 0x94
lea esi, [esp + 0xa84]
lea edi, [esp + 0x18d4]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov eax, 0x1ff
lea ebx, [esp + 0xcc8]
lea edi, [esp + 0x1f18]
call fcn.00467c20
mov eax, 0x1ff
lea ebx, [esp + 0x14c8]
lea edi, [esp + 0x2318]
call fcn.00467c20
mov eax, 0x1ff
lea ebx, [esp + 0xaa4]
lea edi, [esp + 0x1b18]
call fcn.00467c20
cmp dword [esp + 0x14], 0
push 0x1ff
lea eax, [esp + 0x271c]
lea ecx, [esp + 0x1f1c]
je 0x46edfd
push str.AppDataRoaming
call fcn.00468830
push 0x1ff
push str.AppDataLocal
lea eax, [esp + 0x2b28]
lea ecx, [esp + 0x1f28]
call fcn.00468830
push 0x1ff
push str.MicrosoftVault
lea eax, [esp + 0x3730]
lea ecx, [esp + 0x2b30]
call fcn.00468830
push 0x1ff
push str.AppDataLocalMicrosoftWindowsUsrClass.dat
lea eax, [esp + 0x2f38]
lea ecx, [esp + 0x1f38]
call fcn.00468830
push 0x1ff
push str.AppDataRoamingMicrosoftProtect
lea eax, [esp + 0x3340]
lea ecx, [esp + 0x1f40]
call fcn.00468830
add esp, 0x28
jmp 0x46ee61
push str.Application_Data
call fcn.00468830
push 0x1ff
push str.Local_SettingsApplication_Data
lea eax, [esp + 0x2b28]
lea ecx, [esp + 0x1f28]
call fcn.00468830
push 0x1ff
push str.Local_SettingsApplication_DataMicrosoftWindowsUsrclass.dat
lea eax, [esp + 0x2f30]
lea ecx, [esp + 0x1f30]
call fcn.00468830
push 0x1ff
push str.Application_DataMicrosoftProtect
lea eax, [esp + 0x3338]
lea ecx, [esp + 0x1f38]
call fcn.00468830
add esp, 0x20
push 0x1ff
push str.MicrosoftCredentials
lea eax, [esp + 0x3b20]
lea ecx, [esp + 0x2720]
call fcn.00468830
push 0x1ff
push str.MicrosoftCredentials
lea eax, [esp + 0x3f28]
lea ecx, [esp + 0x2b28]
call fcn.00468830
mov esi, dword [ebp + 0x2410]
add esp, 0x10
lea eax, [ebp + 0x2404]
lea ecx, [esp + 0x18c8]
push ecx
push eax
mov eax, esi
call fcn.00401900
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_CompareFileTime]
xor edi, edi
test eax, eax
jle 0x46eee6
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [ebp + 0x2400], esi
lea esi, [esp + 0x670]
call fcn.00466780
test eax, eax
jne 0x46ebc0
mov eax, dword [esp + 0x670]
cmp eax, 0xffffffff
je 0x46ef0d
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4308
ret 4