Function at 0x4127a2
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc364
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x270f
mov byte [ebp - 0x7538], 0
push esi
lea eax, [ebp - 0x7537]
mov ebx, ecx
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x4e28], 0
lea eax, [ebp - 0x4e27]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x9c48], 0
lea eax, [ebp - 0x9c47]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x2718], 0
lea eax, [ebp - 0x2717]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0xc358], 0
lea eax, [ebp - 0xc357]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0xc35c]
push eax
lea eax, [ebp - 0xc364]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x412869
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4131ee
xor eax, eax
mov dword [ebp - 0xc360], eax
cmp dword [ebp - 0xc364], eax
jbe 0x4131df
mov ecx, dword [ebp - 0xc35c]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 0x1c], 0
je 0x4131c6
cmp dword [eax + 0x18], 0
je 0x4131c6
mov esi, dword [ebp - 0xc360]
mov byte [ebp - 0x9c48], 0
mov byte [ebp - 0x4e28], 0
mov byte [ebp - 0x7538], 0
mov eax, dword [ecx + esi*4]
push dword [eax + 8]
lea eax, [ebp - 0x9c48]
push 0x2710
push eax
call fcn.006494f3
mov eax, dword [ebp - 0xc35c]
add esp, 0xc
mov eax, dword [eax + esi*4]
push dword [eax + 8]
lea eax, [ebp - 0x2718]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x2718]
push eax
call fcn.00643470
pop ecx
inc eax
push eax
lea eax, [ebp - 0x2718]
push eax
call fcn.0064ffd4
lea eax, [ebp - 0x2718]
push str.:oauth2:
push eax
call fcn.00639500
add esp, 0x10
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.adobe_app
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.adobe_user
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.sso_pop_device
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.virtualapp_didlogical
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.microsoftoffice
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x4129c4
lea eax, [ebp - 0x2718]
push str.:oauth
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.drivefs
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.whatsapp
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.onedrive_cached_credential
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.skype_for_desktop
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
lea eax, [ebp - 0x2718]
push str.yandex.browser
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
mov ecx, dword [ebp - 0xc35c]
mov eax, dword [ecx + esi*4]
cmp dword [eax + 0x30], 0
je 0x412a77
push dword [eax + 0x30]
lea eax, [ebp - 0x7538]
push 0x2710
push eax
call fcn.006494f3
mov ecx, dword [ebp - 0xc35c]
add esp, 0xc
mov eax, dword [ecx + esi*4]
mov esi, dword [eax + 0x18]
mov edi, dword [eax + 0x1c]
cmp esi, 0x10
jbe 0x412bfe
push 0x10
push 0x70f010
push edi
call fcn.00639b07
add esp, 0xc
test eax, eax
jne 0x412bfe
lea eax, [ebp - 0x2718]
push str.microsoft_wininet_
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412bb1
xor eax, eax
mov byte [ebp - 0x4e28], al
mov byte [ebp - 0x7538], al
mov byte [ebp - 0x9c48], al
lea eax, [ebp - 0x4e28]
push eax
lea eax, [ebp - 0x7538]
push eax
push esi
push edi
call fcn.00412668
test eax, eax
je 0x4131c6
lea eax, [ebp - 0x9c48]
push 0x2f
push eax
call fcn.006393d0
pop ecx
pop ecx
test eax, eax
je 0x412b04
mov byte [eax], 0
lea eax, [ebp - 0x2718]
push str.:443
push eax
call fcn.00639500
push str.Microsoft_WinInet_
mov esi, eax
call fcn.00643470
add esp, 0xc
lea ecx, [ebp - 0x9c48]
add ecx, eax
mov eax, str.https:___s
test esi, esi
push ecx
mov ecx, str.http:___s
cmovne ecx, eax
lea eax, [ebp - 0xc358]
push ecx
push 0x2710
push eax
call fcn.00402e0a
lea eax, [ebp - 0xc358]
push eax
lea eax, [ebp - 0x9c48]
push 0x2710
push eax
call fcn.006494f3
add esp, 0x1c
lea eax, [ebp - 0x2718]
push str.microsoft_wininet_www.google.com
push eax
call fcn.00639500
pop ecx
pop ecx
push 0xffffffffffffffff
mov esi, 0x6c5bb9
test eax, eax
push esi
lea eax, [ebp - 0x4e28]
mov ecx, ebx
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
je 0x412baa
push 0x106
jmp 0x4131bf
push 0
jmp 0x4131bf
mov edx, dword [ebp - 0xc360]
lea eax, [ebp - 0x4e28]
push eax
mov eax, dword [ebp - 0xc35c]
push esi
push edi
mov eax, dword [eax + edx*4]
push dword [eax + 4]
call fcn.00412503
test eax, eax
je 0x4131c6
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0xffffffffffffffff
jmp 0x4131bd
cmp esi, 0x32
jbe 0x412e5e
lea eax, [ebp - 0x2718]
push str.appsense_datanow_
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412ceb
xor eax, eax
push edi
push str.AppN_DN_Win
mov byte [ebp - 0x4e28], al
mov byte [ebp - 0x7538], al
mov byte [ebp - 0x9c48], al
call fcn.00650fe0
pop ecx
pop ecx
test eax, eax
jne 0x4131c6
cmp dword [edi + 0xc], eax
je 0x412c97
lea eax, [ebp - 0x4e28]
push eax
push dword [edi + 0xc]
lea eax, [edi + 0x14]
push eax
push 5
call fcn.00412503
mov esi, 0x6c5bb9
test eax, eax
je 0x412c9c
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4e28]
mov ecx, ebx
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0x2d4
push 8
call fcn.0043ee6b
jmp 0x412c9c
mov esi, 0x6c5bb9
cmp dword [edi + 0x10], 0
je 0x4131c6
lea eax, [ebp - 0x4e28]
push eax
mov eax, dword [edi + 0xc]
push dword [edi + 0x10]
add eax, 0x14
add eax, edi
push eax
push 5
call fcn.00412503
test eax, eax
je 0x4131c6
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4e28]
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0x2d4
jmp 0x4131bd
cmp esi, 0x3e8
jae 0x4131c6
cmp byte [edi + 1], 0
lea eax, [ebp - 0x4e28]
jne 0x412d27
xor ecx, ecx
shr esi, 1
push ecx
push ecx
push 0x2710
push eax
push esi
push edi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x2710
jae 0x4131fd
jmp 0x412d37
push esi
push edi
push 0x2710
push eax
call fcn.00650b7d
add esp, 0x10
mov edi, str.ftp:__
mov byte [ebp + esi - 0x4e28], 0
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.ftps:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.sftp:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.http:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.https:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.file:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.duck:
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x412bd9
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0x135
jmp 0x4131bd
cmp esi, 2
jb 0x412e93
cmp byte [edi + 1], 0
jne 0x412e93
xor ecx, ecx
shr esi, 1
push ecx
push ecx
push 0x2710
lea eax, [ebp - 0x4e28]
push eax
push esi
push edi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x2710
jae 0x4131fd
jmp 0x412ea9
push esi
push edi
lea eax, [ebp - 0x4e28]
push 0x2710
push eax
call fcn.00650b7d
add esp, 0x10
lea eax, [ebp - 0x2718]
mov byte [ebp + esi - 0x4e28], 0
push str.termsrv_
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412f1a
lea eax, [ebp - 0x9c48]
push 0x2f
push eax
call fcn.006393d0
pop ecx
pop ecx
test eax, eax
je 0x412ef2
inc eax
push eax
lea eax, [ebp - 0x9c48]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0x2c2
jmp 0x4131bd
lea eax, [ebp - 0x2718]
push str.gopro_desktop_app
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412f53
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
push esi
push esi
push 0x2c6
jmp 0x4131bd
lea eax, [ebp - 0x2718]
push str.windowslive
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412f89
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
push esi
push esi
push 0x69
jmp 0x4131bd
lea eax, [ebp - 0x2718]
push str.microsoftaccount:
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x412fc2
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
push esi
push esi
push 0x2d5
jmp 0x4131bd
lea eax, [ebp - 0x2718]
push str.microsoftoffice16_data
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x41319a
lea eax, [ebp - 0x2718]
push str.microsoftoffice15_data
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x41319a
mov edi, str.ftp:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.ftps:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.sftp:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.http:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.https:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.file:__
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
mov edi, str.duck:
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x2718]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
je 0x412e36
cmp byte [ebp - 0x2718], 0x7b
jne 0x413152
lea eax, [ebp - 0x2718]
push eax
call fcn.00643470
pop ecx
cmp byte [ebp + eax - 0x2719], 0x7d
jne 0x413152
cmp byte [ebp - 0x7538], 0
jne 0x413152
mov ecx, dword [ebp - 0xc35c]
mov edx, dword [ebp - 0xc360]
mov eax, dword [ecx + edx*4]
cmp dword [eax + 0x20], 2
jne 0x41315e
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
push esi
push esi
push esi
push 0x2d6
jmp 0x4131bd
mov ecx, dword [ebp - 0xc35c]
mov edx, dword [ebp - 0xc360]
mov eax, dword [ecx + edx*4]
cmp dword [eax + 4], 2
jne 0x412bd9
cmp dword [eax + 0x20], 3
jne 0x412bd9
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0x2d7
jmp 0x4131bd
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x4e28]
push esi
push eax
lea eax, [ebp - 0x7538]
push eax
lea eax, [ebp - 0x9c48]
push eax
push esi
push 0xfc
mov ecx, ebx
push 8
call fcn.0043ee6b
mov eax, dword [ebp - 0xc360]
inc eax
mov dword [ebp - 0xc360], eax
cmp eax, dword [ebp - 0xc364]
jb 0x41287d
push dword [ebp - 0xc35c]
call dword [sym.imp.ADVAPI32.dll_CredFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3