Function at 0x180001c50
Capabilities:
Acquire credentials from windows credential manager
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
mov r13, qword [sym.imp.user32.dll_GetDlgItem]
mov rdi, rcx
mov rbx, rdx
mov edx, 0x65
call r13
mov edx, 0x66
mov rcx, rdi
mov qword [rsp + 0x28], rax
call r13
mov r8, rbx
mov edx, 0x10
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov rsi, qword [rbx + 0x18]
test rsi, rsi
je 0x180001cc4
mov edx, 0xc8
mov rcx, rdi
call r13
mov r9, rsi
xor r8d, r8d
mov edx, 0x172
mov rcx, rax
call qword [sym.imp.user32.dll_SendMessageW]
mov r8, qword [rbx + 8]
test r8, r8
je 0x180001fc0
mov edx, 0x67
mov rcx, rdi
call qword [sym.imp.user32.dll_SetDlgItemTextW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x28]
mov r14, qword [sym.imp.user32.dll_SetWindowTextW]
call r14
mov rdx, qword [rbx + 0x30]
mov rcx, rbp
call r14
lea rax, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov r9, qword [rsp + 0x30]
mov r8, rax
call qword [sym.imp.advapi32.dll_CredEnumerateW]
test eax, eax
je 0x180001e49
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
test r9d, r9d
je 0x180001e43
xor r15d, r15d
xor r12d, r12d
mov qword [rsp + 0x4a0], rdi
mov rsi, qword [sym.imp.kernel32.dll_lstrcmpW]
mov rdi, rbx
mov ebx, r15d
mov r15, r12
jmp 0x180001d7e
cmp r8d, 1
je 0x180001d9c
mov qword [rax + 0x48], 0
add ebx, 1
add r15, 8
cmp ebx, r9d
jae 0x180001e38
lea rdx, [rcx + r15]
mov rax, qword [rdx]
cmp qword [rax + 0x48], 0
je 0x180001d6e
mov r8d, dword [rax + 4]
test byte [rdi + 0x42], 4
jne 0x180001d60
cmp r8d, 1
je 0x180001d66
xor r12d, r12d
test ebx, ebx
je 0x180001dd9
nop dword [rax + rax]
mov rax, qword [rcx + r12]
mov rdx, qword [rax + 0x48]
test rdx, rdx
je 0x180001dcc
mov rax, qword [rcx + r15]
mov rcx, qword [rax + 0x48]
call rsi
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x180001f18
add r12, 8
cmp r12, r15
jne 0x180001da8
lea rdx, [rcx + r15]
mov rcx, qword [rsp + 0x28]
xor r8d, r8d
add ebx, 1
add r15, 8
mov dword [rsp + 0x250], 1
lea r9, [rsp + 0x250]
mov qword [rsp + 0x258], 0xffffffffffffffff
mov rax, qword [rdx]
mov edx, 0x40b
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x260], rax
call qword [sym.imp.user32.dll_SendMessageW]
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
cmp ebx, r9d
jb 0x180001d7e
nop dword [rax]
mov rbx, rdi
mov rdi, qword [rsp + 0x4a0]
call qword [sym.imp.advapi32.dll_CredFree]
mov rax, qword [rbx + 0x20]
cmp word [rax], 0
je 0x180001f28
mov dword [rbx + 0x50], 1
mov rcx, rbp
call qword [sym.imp.user32.dll_SetFocus]
mov rdx, qword [rbx + 0x10]
mov dword [rbx + 0x50], 0
test rdx, rdx
je 0x180001f40
mov rcx, rdi
call r14
mov eax, dword [rbx + 0x40]
test ah, 0x10
jne 0x180001eb0
and eax, 0x42
cmp eax, 2
je 0x180001eb0
mov edx, dword [rbx + 0x3c]
test edx, edx
je 0x180001ec6
mov r8d, 1
mov edx, 0x68
mov rcx, rdi
call qword [sym.imp.user32.dll_CheckDlgButton]
jmp 0x180001ec6
mov edx, 0x68
mov rcx, rdi
call r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.user32.dll_ShowWindow]
mov r9, rbx
mov r8d, 1
lea rdx, [sym.CredDialogPasswordSubclassProc]
mov rcx, rbp
call qword [sym.imp.comctl32.dll_SetWindowSubclass]
test byte [rbx + 0x40], 1
je 0x180001f88
mov rax, qword [rbx + 0x20]
cmp word [rax], 0
je 0x180001efe
mov eax, dword [rbx + 0x50]
test eax, eax
je 0x180002019
xor eax, eax
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, dword [rsp + 0x40]
jmp 0x180001d6e
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.user32.dll_SetFocus]
mov rdx, qword [rbx + 0x10]
test rdx, rdx
jne 0x180001e7b
mov r15, qword [rsp + 0x30]
mov r9d, 0x100
mov rcx, qword [section..bss]
mov edx, 0x12c
lea rsi, [rsp + 0x250]
mov r8, r15
call qword [sym.imp.user32.dll_LoadStringW]
mov r9, qword [rbx]
mov edx, 0x100
mov r8, r15
mov rcx, rsi
call sym.swprintf.constprop.0
mov rdx, rsi
jmp 0x180001e7b
call qword [sym.imp.user32.dll_GetFocus]
cmp rbp, rax
jne 0x180001efe
mov ecx, 0x14
call qword [sym.imp.user32.dll_GetKeyState]
test al, 1
je 0x180001efe
mov rdx, rbx
mov rcx, rdi
call sym.CredDialogShowCapsLockBalloon
jmp 0x180001efe
lea rax, [rsp + 0x50]
lea rsi, [rsp + 0x250]
mov edx, 0x12d
mov rcx, qword [section..bss]
mov r14, rax
mov qword [rsp + 0x30], rax
mov r9d, 0x100
mov r8, rax
call qword [sym.imp.user32.dll_LoadStringW]
mov r9, qword [rbx]
mov r8, r14
mov rcx, rsi
mov edx, 0x100
call sym.swprintf.constprop.0
mov r8, rsi
mov edx, 0x67
mov rcx, rdi
call qword [sym.imp.user32.dll_SetDlgItemTextW]
jmp 0x180001ce9
lea rsi, [rsp + 0x250]
mov r9d, 0x100
mov edx, 0x12e
mov rcx, qword [section..bss]
mov r8, rsi
call qword [sym.imp.user32.dll_LoadStringW]
test eax, eax
jne 0x180002071
test byte [0x1800070c0], 2
je 0x180001efe
lea r9, str.failed_to_load_IDS_INCORRECTPASSWORDTITLE_n
lea r8, str.CredDialogShowIncorrectPasswordBalloon
mov ecx, 1
lea rdx, [0x1800070c0]
call sym.wine_dbg_log.constprop.1
jmp 0x180001efe
mov rdx, rbx
mov rcx, rdi
call sym.CredDialogCreateBalloonTip
pxor xmm0, xmm0
mov r9, rsi
mov rcx, qword [rbx + 0x48]
movups xmmword [rsp + 0x54], xmm0
mov r8d, 3
mov rsi, qword [sym.imp.user32.dll_SendMessageW]
mov edx, 0x421
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
mov dword [rsp + 0x94], 0
mov dword [rsp + 0x50], 0x48
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 1
call rsi
mov edx, 0x66
mov rcx, rdi
call r13
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowRect]
mov eax, dword [rsp + 0x4c]
add eax, dword [rsp + 0x44]
xor r8d, r8d
mov r9d, eax
mov rcx, qword [rbx + 0x48]
mov edx, 0x412
shr r9d, 0x1f
add r9d, eax
mov eax, dword [rsp + 0x48]
sar r9d, 1
sub eax, 0xc
shl r9d, 0x10
movzx eax, ax
or r9d, eax
movsxd r9, r9d
call rsi
mov rcx, qword [rbx + 0x48]
mov r9, qword [rsp + 0x30]
mov edx, 0x411
mov r8d, 1
call rsi
mov dword [rbx + 0x50], 1
jmp 0x180001efe