Function at 0x435317
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x9c4c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, str.RecoverOutlookPasswordsFromCredManager
push ebx
push str._s___Entered_...
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x9c48]
push eax
lea eax, [ebp - 0x9c4c]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x435379
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.__s_:_CredEnumerate_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4356af
push edi
push dword [ebp - 0x9c4c]
push ebx
push str._s_:_CredEnumerate_found__d_accounts
call fcn.00449974
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0x9c4c], edi
jbe 0x43569f
push esi
mov eax, dword [ebp - 0x9c48]
mov byte [ebp - 0x2714], 0
mov byte [ebp - 0x7534], 0
mov byte [ebp - 0x9c44], 0
mov eax, dword [eax + edi*4]
push dword [eax + 8]
push dword [eax + 4]
push ebx
push str._s_:_Found_account__d____s
call fcn.00449974
mov eax, dword [ebp - 0x9c48]
add esp, 0x10
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x1c], 0
je 0x435680
cmp dword [eax + 0x18], 0
je 0x435680
push dword [eax + 8]
lea eax, [ebp - 0x9c44]
push 0x2710
push eax
call fcn.006311ec
mov eax, dword [ebp - 0x9c48]
mov eax, dword [eax + edi*4]
push dword [eax + 8]
lea eax, [ebp - 0x4e24]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x4e24]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x4e24]
push eax
call fcn.00631711
lea eax, [ebp - 0x4e24]
push str.:oauth2:
push eax
call fcn.00627320
add esp, 0x2c
test eax, eax
jne 0x43566c
lea eax, [ebp - 0x4e24]
push str.microsoftoffice
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x435485
lea eax, [ebp - 0x4e24]
push str.:oauth
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x43566c
lea eax, [ebp - 0x4e24]
push str.microsoftoffice16_data
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x4354b7
lea eax, [ebp - 0x4e24]
push str.microsoftoffice15_data
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x435691
push ebx
push str._n_n__s____Found_Outlook_password
call fcn.00449974
pop ecx
pop ecx
mov ecx, dword [ebp - 0x9c48]
mov eax, dword [ecx + edi*4]
cmp dword [eax + 0x30], 0
je 0x435502
push dword [eax + 0x30]
lea eax, [ebp - 0x7534]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x7534]
push eax
push ebx
push str._s_:_Found_outlook_user___s
call fcn.00449974
mov ecx, dword [ebp - 0x9c48]
add esp, 0x18
mov eax, dword [ecx + edi*4]
mov esi, dword [eax + 0x18]
mov ebx, dword [eax + 0x1c]
cmp esi, 0x10
jbe 0x4355a6
push 0x10
push section..data
push ebx
call fcn.0062534d
add esp, 0xc
test eax, eax
jne 0x4355a6
push esi
push str.RecoverOutlookPasswordsFromCredManager
push str._s_Password_is_DPAPI_Blob__size_d_....need_to_decrypt_it_now
call fcn.00449974
lea eax, [ebp - 0x2714]
push eax
mov eax, dword [ebp - 0x9c48]
push esi
push ebx
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call fcn.004091b2
add esp, 0x1c
mov ebx, str.RecoverOutlookPasswordsFromCredManager
test eax, eax
je 0x435691
lea eax, [ebp - 0x2714]
push eax
push ebx
push str._s_Successfully_decrypted_credential_password_blob...pass_s
call fcn.00449974
push 0xffffffffffffffff
mov esi, 0x66ae5d
lea eax, [ebp - 0x2714]
push esi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push esi
push 0xfc
push 2
call fcn.00412c85
add esp, 0x2c
jmp 0x435691
cmp esi, 0x32
jbe 0x4355c2
mov ebx, str.RecoverOutlookPasswordsFromCredManager
push ebx
push str._s__password_length_more_than_25_chars...mostly_invalid_password..checking_special_cases...
call fcn.00449974
pop ecx
pop ecx
jmp 0x435691
cmp esi, 2
jb 0x43560a
cmp byte [ebx + 1], 0
jne 0x43560a
shr esi, 1
push esi
push str.RecoverOutlookPasswordsFromCredManager
push str._s___Password_is_in_Unicode___length_d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x2714]
xor ecx, ecx
push ecx
push ecx
push 0x2710
push eax
push esi
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0x2710
jae 0x4356bc
jmp 0x435630
push esi
push str.RecoverOutlookPasswordsFromCredManager
push str._s___Password_is_in_ASCII___length_d
call fcn.00449974
push esi
push ebx
lea eax, [ebp - 0x2714]
push 0x2710
push eax
call fcn.00631360
add esp, 0x1c
push 0xffffffffffffffff
mov byte [ebp + esi - 0x2714], 0
lea eax, [ebp - 0x2714]
mov esi, 0x66ae5d
push esi
push eax
lea eax, [ebp - 0x7534]
push eax
lea eax, [ebp - 0x9c44]
push eax
push esi
push 0xfc
push 2
call fcn.00412c85
add esp, 0x20
mov ebx, str.RecoverOutlookPasswordsFromCredManager
jmp 0x435691
mov eax, dword [ebp - 0x9c48]
mov eax, dword [eax + edi*4]
push dword [eax + 8]
push ebx
push str._s_:__Ignoring_target___s
jmp 0x435689
push dword [eax + 8]
push ebx
push 0x677264
call fcn.00449974
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x9c4c]
jb 0x43539d
pop esi
push dword [ebp - 0x9c48]
call dword [sym.imp.ADVAPI32.dll_CredFree]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3