Function at 0x18006ff50
Capabilities:
Acquire credentials from windows credential manager
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0xd0]
lea esi, [rdx - 0xe]
mov rbx, r8
mov edi, edx
cmp edx, esi
jbe case.0x18006ffd8.231
mov r15d, dword [rsp + 0x40]
lea r13, [0x180000000]
movzx r14d, byte [rsp + 0x30]
xor r12d, r12d
mov r11d, 0x73
lea eax, [rdi - 0xe7]
lea edx, [r11 - 0x11]
cmp eax, 0x31
ja case.0x18006ffd8.243
movzx eax, byte [rax + r13 + 0x702e4]
mov ecx, dword [r13 + rax*4 + 0x702b0]
add rcx, r13
jmp rcx
cmp byte [rbx + 0x118], r12b
jne 0x18007029b
mov r15d, r12d
mov dword [rsp + 0x40], r12d
jmp case.0x18006ffd8.243
mov dword [rsp + 0x50], 0x650053
jmp case.0x18006ffd8.243
mov r9, qword [rbx + 0x100]
lea r8, [rbx + 0x78]
mov rdx, qword [rbx]
mov ecx, 1
call fcn.18004fc40
lea r9, [rsp + 0x48]
mov byte [rbx + 0x118], al
lea r8, [rsp + 0x40]
mov edx, r15d
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
jne 0x180070043
xor r14b, r14b
jmp case.0x18006ffd8.243
test r14b, r14b
je case.0x18006ffd8.243
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CredFree]
jmp case.0x18006ffd8.243
movzx eax, byte [rbx + 0x118]
mov byte [rsp + 0x38], al
jmp case.0x18006ffd8.243
mov dword [rsp + 0x68], 0x65
mov r14b, 1
jmp case.0x18006ffd8.243
mov ecx, dword [rbx]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800702a2
mov dword [rsp + 0x38], 1
jmp case.0x18006ffd8.243
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je case.0x18006ffd8.243
xor r8d, r8d
lea edx, [r8 + 0x25]
call fcn.18005d3f0
test al, al
je case.0x18006ffd8.243
mov r9, qword [rbx + 0xa8]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea ecx, [rdx + 0x55]
call fcn.1800402c0
movzx ecx, al
lea r8, [rsp + 0x30]
mov word [rsp + 0x30], cx
mov edx, 0x5e
mov rcx, rbx
call fcn.180055f40
mov rcx, qword [rbx + 0xa8]
xor r8d, r8d
lea edx, [r8 + 0x25]
call fcn.18005d3f0
test al, al
jne 0x1800700c0
jmp case.0x18006ffd8.243
mov dword [rsp + 0x5e], 0x65006c
mov dword [rsp + 0x62], 0x610042
mov word [rsp + 0x66], r11w
jmp case.0x18006ffd8.243
mov dword [rsp + 0x54], 0x4f0074
mov dword [rsp + 0x58], 0x610054
mov word [rsp + 0x5c], dx
jmp case.0x18006ffd8.243
movzx ecx, byte [rbx + 0x20]
sub ecx, 1
je 0x180070246
sub ecx, 1
je 0x180070246
sub ecx, 1
je 0x180070246
sub ecx, 1
je 0x1800701f4
cmp ecx, 1
jne 0x180070259
mov edi, 0x39
nop word [rax + rax]
mov eax, edi
sub eax, 0x37
je 0x18007022a
sub eax, 1
je 0x1800701c5
cmp eax, 1
jne 0x1800701ed
mov rax, qword [rbx + 0xb8]
inc dword [rbx + 0x28]
cmp dword [rax + 0x23c], r12d
je 0x1800701ed
movzx eax, byte [rbx + 0x21]
inc al
movzx ecx, al
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov byte [rbx + 0x21], cl
jmp 0x1800701ed
mov rax, qword [rbx + 0xb0]
lea rcx, [rax + 0x60]
call qword [rax + 0x60]
mov ecx, eax
mov byte [rbx + 0x48], r12b
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rbx + 0x2c], edx
dec edi
cmp edi, 0x36
ja 0x180070180
mov rax, qword [rbx + 0xb0]
lea rcx, [rax + 0x60]
call qword [rax + 0x60]
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
sub edx, dword [rbx + 0x2c]
cmp edx, 0x9c4
jbe 0x180070259
mov dword [rsp + 0x30], 5
jmp 0x180070232
mov dword [rsp + 0x30], 1
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0xa1
call fcn.180057b90
jmp 0x180070259
mov r9d, 0xe6
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.1800556f0
mov edi, 0xfb
dec edi
cmp edi, esi
ja 0x18006ffab
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800938b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov byte [rsp + 0x38], r12b
jmp case.0x18006ffd8.231
mov dword [rsp + 0x38], r12d
jmp case.0x18006ffd8.231
mov rax, rbp
jmp 0x18007026d