Function at 0x10001c80
Capabilities:
Acquire credentials from windows credential manager
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x444
mov dword [ebp - 0x420], edx
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0x65
mov dword [esp], eax
call edi
sub esp, 8
mov dword [ebp - 0x430], eax
mov dword [esp + 4], 0x66
mov dword [esp], esi
call edi
sub esp, 8
mov dword [ebp - 0x42c], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 8
mov dword [esp], esi
call dword [sym.imp.user32.dll_SetWindowLongW]
mov ebx, dword [ebx + 0xc]
sub esp, 0xc
test ebx, ebx
je 0x10001d17
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call edi
sub esp, 8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x172
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov eax, dword [ebp - 0x420]
mov eax, dword [eax + 4]
test eax, eax
je 0x10002118
mov dword [esp + 8], eax
mov dword [esp + 4], 0x67
mov dword [esp], esi
call dword [sym.imp.user32.dll_SetDlgItemTextW]
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x434], eax
sub esp, 0xc
mov eax, dword [ebp - 0x420]
mov ebx, dword [sym.imp.user32.dll_SetWindowTextW]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x430]
mov dword [esp], ecx
mov dword [ebp - 0x438], ebx
call ebx
mov eax, dword [ebp - 0x420]
sub esp, 8
mov eax, dword [eax + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x434]
sub esp, 8
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.advapi32.dll_CredEnumerateW]
sub esp, 0x10
test eax, eax
je 0x10001f18
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x428], ecx
test ecx, ecx
je 0x10001f0c
mov dword [ebp - 0x43c], esi
xor ebx, ebx
mov dword [ebp - 0x440], edi
jmp 0x10001e11
cmp dword [ebp - 0x424], 1
je 0x10001e42
mov dword [edx + 0x30], 0
mov ecx, dword [ebp - 0x428]
add ebx, 1
cmp ebx, ecx
jae 0x10001f00
lea esi, [ebx*4]
lea ecx, [eax + esi]
mov edx, dword [ecx]
mov edi, dword [edx + 0x30]
test edi, edi
je 0x10001e00
mov edi, dword [edx + 4]
mov dword [ebp - 0x424], edi
mov edi, dword [ebp - 0x420]
test byte [edi + 0x26], 4
jne 0x10001df0
cmp dword [ebp - 0x424], 1
je 0x10001df9
xor edi, edi
test ebx, ebx
je 0x10001e88
lea esi, cs:[esi]
mov edx, dword [eax + edi*4]
mov edx, dword [edx + 0x30]
test edx, edx
je 0x10001e7e
mov dword [esp + 4], edx
mov eax, dword [eax + esi]
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
mov eax, dword [ebp - 0x40c]
je 0x10002030
add edi, 1
cmp edi, ebx
jne 0x10001e50
lea ecx, [eax + esi]
mov dword [ebp - 0x20c], 1
add ebx, 1
mov dword [ebp - 0x208], 0xffffffff
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x204], eax
lea eax, [ebp - 0x20c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40b
mov eax, dword [ebp - 0x430]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [ebp - 0x41c]
sub esp, 0x10
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x40c]
cmp ebx, ecx
jb 0x10001e11
lea esi, cs:[esi]
nop
mov esi, dword [ebp - 0x43c]
mov edi, dword [ebp - 0x440]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CredFree]
sub esp, 4
mov ebx, dword [ebp - 0x420]
mov eax, dword [ebx + 0x10]
cmp word [eax], 0
je 0x10002048
mov eax, dword [ebp - 0x42c]
mov dword [ebx + 0x2c], 1
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov eax, dword [ebp - 0x420]
mov dword [ebx + 0x2c], 0
sub esp, 4
mov eax, dword [eax + 8]
test eax, eax
je 0x1000206b
mov dword [esp + 4], eax
mov dword [esp], esi
mov eax, dword [ebp - 0x438]
call eax
sub esp, 8
mov eax, dword [ebp - 0x420]
mov eax, dword [eax + 0x24]
test ah, 0x10
jne 0x10001fb0
and eax, 0x42
cmp eax, 2
je 0x10001fb0
mov eax, dword [ebp - 0x420]
mov edx, dword [eax + 0x20]
test edx, edx
je 0x10001fd4
mov dword [esp + 8], 1
mov dword [esp + 4], 0x68
mov dword [esp], esi
call dword [sym.imp.user32.dll_CheckDlgButton]
sub esp, 0xc
jmp 0x10001fd4
mov dword [esp + 4], 0x68
mov dword [esp], esi
call edi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
mov ebx, dword [ebp - 0x420]
mov dword [esp + 8], 1
mov dword [esp + 4], sym._CredDialogPasswordSubclassProc_24
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call dword [sym.imp.comctl32.dll_SetWindowSubclass]
sub esp, 0x10
test byte [ebx + 0x24], 1
je 0x100020d8
mov eax, dword [ebx + 0x10]
cmp word [eax], 0
je 0x1000201e
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x1000218c
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x41c]
mov dword [ebp - 0x428], esi
jmp 0x10001e00
mov eax, dword [ebp - 0x430]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov eax, dword [ebp - 0x420]
sub esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x10001f5c
mov dword [esp + 0xc], 0x100
mov ebx, dword [ebp - 0x434]
mov dword [esp + 4], 0x12c
mov dword [esp + 8], ebx
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov eax, dword [ebp - 0x420]
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20c]
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._swprintf.constprop.0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov eax, dword [ebp - 0x438]
call eax
sub esp, 8
jmp 0x10001f6e
call dword [sym.imp.user32.dll_GetFocus]
cmp dword [ebp - 0x42c], eax
jne 0x1000201e
mov dword [esp], 0x14
call dword [sym.imp.user32.dll_GetKeyState]
sub esp, 4
test al, 1
je 0x1000201e
mov edx, dword [ebp - 0x420]
mov eax, esi
call sym._CredDialogShowCapsLockBalloon
jmp 0x1000201e
lea ebx, [ebp - 0x40c]
mov dword [esp + 0xc], 0x100
mov dword [ebp - 0x434], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x12d
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov eax, dword [ebp - 0x420]
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20c]
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._swprintf.constprop.0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x67
mov dword [esp], esi
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
jmp 0x10001d4c
lea ebx, [ebp - 0x20c]
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x12e
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x100021f1
test byte [0x10007060], 2
je 0x1000201e
mov dword [esp + 0xc], str.failed_to_load_IDS_INCORRECTPASSWORDTITLE_n
mov dword [esp + 8], str.CredDialogShowIncorrectPasswordBalloon
mov dword [esp + 4], 0x10007060
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
jmp 0x1000201e
mov edx, dword [ebp - 0x420]
mov eax, esi
call sym._CredDialogCreateBalloonTip
pxor xmm0, xmm0
mov dword [ebp - 0x40c], 0x30
movups xmmword [ebp - 0x408], xmm0
movups xmmword [ebp - 0x3f8], xmm0
mov dword [ebp - 0x404], esi
movups xmmword [ebp - 0x3ec], xmm0
mov dword [ebp - 0x400], 1
mov dword [esp + 0xc], ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 8], 3
mov dword [esp + 4], 0x421
mov eax, dword [ebp - 0x420]
mov eax, dword [eax + 0x28]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], 0x66
call edi
lea ecx, [ebp - 0x41c]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowRect]
mov edx, dword [ebp - 0x410]
add edx, dword [ebp - 0x418]
mov eax, edx
mov ecx, dword [ebp - 0x414]
sub esp, 8
shr eax, 0x1f
mov dword [esp + 8], 0
add eax, edx
lea edx, [ecx - 0xc]
mov dword [esp + 4], 0x412
sar eax, 1
movzx edx, dx
shl eax, 0x10
or eax, edx
mov dword [esp + 0xc], eax
mov esi, dword [ebp - 0x420]
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x434]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x411
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call ebx
mov dword [esi + 0x2c], 1
sub esp, 0x10
jmp 0x1000201e