Function at 0x1800221f0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push r12
push r13
push r14
mov eax, 0x35a0
call fcn.18011bdc0
sub rsp, rax
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rsp + 0x35c0], rbx
mov qword [rsp + 0x35c8], rsi
mov qword [rsp + 0x35d8], rdi
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x3590], rax
mov r12, r8
cmp dword [0x1801aa490], 0
je case.0x1800223aa.3
cmp qword [0x1801aa4b8], 0
je case.0x1800223aa.3
test ecx, ecx
jne case.0x1800223aa.3
test rdx, rdx
jne case.0x1800223aa.3
test r8, r8
je case.0x1800223aa.3
mov rbx, qword [r8 + 0x18]
mov edi, dword [r8 + 0x10]
xor r14d, r14d
mov dword [rsp + 0x40], r14d
cmp edi, 1
je 0x18002233d
cmp edi, 0x102
je 0x180022336
cmp edi, 0x437
je 0x18002232f
cmp edi, 0xc2
je 0x18002232f
cmp edi, 0xc
je 0x18002232f
cmp edi, 0x104d
je 0x180022328
cmp edi, 0x1007
je 0x180022321
cmp edi, 0x1008
je 0x18002231a
cmp edi, 0x104c
je 0x18002231a
cmp edi, 0x1074
je 0x18002231a
cmp edi, 0x10
je 0x18002231a
cmp edi, 0x210
je 0x180022313
cmp edi, 0x18
je 0x180022313
cmp edi, 8
je 0x180022313
mov esi, 0x201
cmp edi, esi
je 0x180022342
cmp edi, 2
je 0x180022342
cmp edi, 0xa
je 0x180022342
cmp edi, 0x10d
jne case.0x1800223aa.3
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
jmp 0x180022342
mov esi, 0x201
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r13d, eax
mov ecx, dword [0x1801aa4a0]
test ecx, ecx
je case.0x1800223aa.3
cmp dword [rsp + 0x40], ecx
jne case.0x1800223aa.3
cmp edi, 0x102
ja 0x1800235b9
cmp edi, 0x102
je 0x180023568
dec edi
cmp edi, 0xc1
ja case.0x1800223aa.3
lea rdx, [0x180000000]
movzx eax, byte [rdx + rdi + 0x23b50]
mov ecx, dword [rdx + rax*4 + 0x23b30]
add rcx, rdx
jmp rcx
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r12d, eax
mov word [rsp + 0x620], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x622]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x620]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [0x1801b0450], 0
je 0x18002242c
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, str.wm_create___s____08x_
lea r8, [0x18012b1a8]
mov edx, 0xffffffff
lea rcx, [0x1801afb58]
call fcn.1800b3b40
mov esi, r14d
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x78], r14
cmp dword [0x1801aa4a8], r14d
jne 0x1800224da
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8d, r12d
lea rdx, [rsp + 0x620]
mov rcx, rbx
call fcn.1800217b0
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1800224c5
mov dword [0x1801aa4ac], 1
mov ecx, dword [rsp + 0x40]
mov dword [0x1801aa4a0], ecx
mov dword [0x1801aa4a4], r13d
mov rcx, qword [rsp + 0x78]
mov qword [0x1801aa498], rcx
mov eax, dword [rsp + 0x44]
mov dword [0x1801aa4a8], eax
mov qword [0x1801aa4b0], rdi
movabs rdx, 0x40002010008
cmp rdi, rdx
cmove rbx, rcx
jmp 0x1800224cb
mov eax, dword [0x1801aa4a8]
mov esi, 1
test eax, eax
je case.0x1800223aa.3
jmp 0x180022501
cmp dword [0x1801aa490], esi
je 0x180022801
mov r8d, r12d
lea rdx, [rsp + 0x620]
mov rcx, rbx
call fcn.18001f810
mov rdi, rax
mov qword [rsp + 0x70], rax
test rdi, rdi
je 0x180022801
mov rcx, rdi
call fcn.18000e9d0
mov r12d, eax
test esi, esi
je 0x180022593
cmp dword [0x1801aa4a8], 0x1000000
jne 0x180022593
movabs rax, 0x100000000010001
cmp rdi, rax
jne 0x180022593
mov edx, 0x1000000
mov r8d, 1
lea rcx, [0x1801aa210]
call fcn.18001f010
lea rcx, [0x1801aa210]
call fcn.18001efb0
mov qword [0x1801aa4b8], rax
mov r8d, 0x8000000
mov rdx, rax
lea rcx, [0x1801a9dc0]
call fcn.180016b90
mov edx, 1
mov rcx, qword [0x1801aa0c0]
call fcn.180029080
mov dword [reloc.WS2_32.dll_accept], 1
jmp 0x1800227e3
movabs rax, 0x800000000010000
cmp rdi, rax
jne 0x1800225bf
mov qword [0x1801aa4b0], rax
mov edx, 1
lea rcx, [0x1801a2230]
call fcn.1800024d0
jmp case.0x1800223aa.3
movabs rax, 0x800000000020000
cmp rdi, rax
jne 0x180022604
mov qword [0x1801aa4b0], rax
mov edx, 2
lea rcx, [0x1801a2230]
call fcn.1800024d0
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
movabs rax, 0x8000000000010000
cmp rdi, rax
jne 0x180022630
mov qword [0x1801aa4b0], rax
mov edx, 1
lea rcx, [0x1801a9dc0]
call fcn.180016dc0
jmp case.0x1800223aa.3
movabs rax, 0x8000000000020000
cmp rdi, rax
jne 0x180022675
mov qword [0x1801aa4b0], rax
mov edx, 2
lea rcx, [0x1801a9dc0]
call fcn.180016dc0
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
movabs rax, 0x4000000000010000
cmp rdi, rax
jne 0x18002275e
mov word [rsp + 0x830], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x832]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x830]
mov rcx, rbx
call fcn.180013a90
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x830]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jne 0x180022717
mov r8, rcx
lea rdx, [0x18012bed8]
lea rcx, [rsp + 0x830]
call fcn.18007f540
test eax, eax
je 0x180022740
mov r8d, 2
lea rdx, [0x18013287c]
lea rcx, [rsp + 0x830]
call fcn.18007f540
test eax, eax
je 0x180022740
jmp 0x1800227e3
cmp rcx, 8
jne 0x1800227e3
mov r8, rcx
lea rdx, str.DingTalk
lea rcx, [rsp + 0x830]
call fcn.18007f540
test eax, eax
jne 0x1800227e3
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1800227e3
movabs rax, 0x100000020001
cmp rdi, rax
jne 0x180022789
mov dword [rsp + 0x68], r14d
lea r8, [rsp + 0x68]
mov edx, 2
mov rcx, rbx
call fcn.18002d5e0
jmp case.0x1800223aa.3
movabs rax, 0x2000000010000
cmp rdi, rax
jne 0x1800227b6
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
movabs rax, 0x4000020000
cmp rdi, rax
jne 0x1800227e3
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92d4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov edx, r12d
lea rcx, [rsp + 0x620]
call fcn.180022160
test eax, eax
je 0x18002282e
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a938c]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x1801aa490], 0x10
jne case.0x1800223aa.3
cmp r12d, 0x1006
je 0x180022851
cmp r12d, 0x1008
jne case.0x1800223aa.3
lea rsi, [rsp + 0x620]
lea rdi, str.RICHEDIT
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov r8, r12
mov r9, rbx
mov edx, dword [0x1801a92f0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 1
jne 0x18002296e
mov word [rsp + 0x1280], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1282]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x1280]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
lea rsi, [rsp + 0x1280]
lea rdi, str.RichEdit20A
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
cmp eax, 0x37e
jne case.0x1800223aa.3
cmp dword [0x1801aa494], 0
je case.0x1800223aa.3
mov dword [0x1801aa494], r14d
mov dword [rsp + 0x48], r14d
xor eax, eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x4c], 0x4b0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x45f
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a92e0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x10
jne case.0x1800223aa.3
mov word [rsp + 0x2f60], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2f62]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2f60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x2f60]
lea rdi, str.RICHEDIT
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x37e
je 0x1800229e9
cmp eax, 0x1006
jne case.0x1800223aa.3
cmp dword [0x1801aa494], 0
je case.0x1800223aa.3
mov dword [0x1801aa494], r14d
mov dword [rsp + 0x50], r14d
xor eax, eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0x45f
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a92e0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 2
jne 0x180022b1c
lea edx, [rax - 0xe]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x401
je 0x180022a79
cmp eax, 0x65
jne case.0x1800223aa.3
mov word [rsp + 0x3380], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3382]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x3380]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x3380]
lea rdi, str.RichEdit20A
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov r12, qword [r12]
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne case.0x1800223aa.3
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9324]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x100
jne 0x180022bd1
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x1f71
je 0x180022b47
cmp eax, 0xfa8
jne case.0x1800223aa.3
mov word [rsp + 0x2510], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2512]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2510]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x2510]
lea rdi, str.Static
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov rsi, qword [r12]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne case.0x1800223aa.3
mov r9, rbx
mov r8, rsi
mov edx, dword [0x1801a9324]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x800
jne case.0x1800223aa.3
mov word [rsp + 0x18b0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x18b2]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x18b0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne case.0x1800223aa.3
lea rsi, [rsp + 0x18b0]
lea rdi, str.FxWnd
mov ecx, 6
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov r9, rbx
mov r8, qword [r12]
mov edx, dword [0x1801a92f0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 1
je 0x180022d6b
cmp eax, 0x10
je 0x180022d6b
cmp eax, 0x10000
jne 0x180022d0e
mov word [rsp + 0xe60], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xe62]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0xe60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0xe60]
lea rdi, str.Tfm_chat
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
je 0x180022ced
lea rsi, [rsp + 0xe60]
lea rdi, str.Tfm_message
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov r9, rbx
mov r8d, 1
mov edx, dword [0x1801a92d8]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x1000000
jne case.0x1800223aa.3
mov r9, rbx
mov r8d, 1
mov edx, dword [0x1801a92d8]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1801b0450], 0
je case.0x1800223aa.3
mov qword [rsp + 0x20], rbx
lea r9, str.line_destory_1___x_
lea r8, [0x18012b1a8]
mov edx, 0xffffffff
lea rcx, [0x1801afb58]
call fcn.1800b3b40
jmp case.0x1800223aa.3
mov word [rsp + 0x2d50], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2d52]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2d50]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x2d50]
lea rdi, str.TXGuiFoundation
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov r9, rbx
mov r8d, 1
mov edx, dword [0x1801a92d8]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 0x800
jne 0x180022f65
mov word [rsp + 0xc50], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xc52]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0xc50]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
movabs rdx, 0x80001010008
cmp qword [0x1801aa4b0], rdx
jne 0x180022ea1
lea rdx, str.FxRichEdit
lea rcx, [rsp + 0xc50]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je case.0x1800223aa.3
xor r9d, r9d
lea r8, str.FxEdit
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9338]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
lea rdx, [0x18012c318]
lea rcx, [rsp + 0xc50]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je case.0x1800223aa.3
mov word [rsp + 0x1070], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1072]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x1070]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea rdx, str.CFxAccountComboBox
lea rcx, [rsp + 0x1070]
call fcn.18007f540
test eax, eax
je 0x180022f47
mov r8d, 0x1e
lea rdx, str.WindowsForms10.COMBOBOX.app.0.
lea rcx, [rsp + 0x1070]
call fcn.18007f540
test eax, eax
jne case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9334]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x400000
jne 0x180023026
movabs rax, 0x40000000010001
cmp qword [0x1801aa4b0], rax
jne case.0x1800223aa.3
mov word [rsp + 0x1cd0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1cd2]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x1cd0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.RichEdit20W
lea rcx, [rsp + 0x1cd0]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je case.0x1800223aa.3
xor r9d, r9d
lea r8, str.SysListView32
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9338]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 2
je case.0x1800223aa.3
cmp eax, 0x1000
jne 0x18002310f
mov word [rsp + 0x2930], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2932]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2930]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x18012c318]
lea rcx, [rsp + 0x2930]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je case.0x1800223aa.3
mov word [rsp + 0x20f0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x20f2]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x20f0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.ComboBox
lea rcx, [rsp + 0x20f0]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9334]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x80000
jne case.0x1800223aa.3
mov word [rsp + 0x3170], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x3172]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x3170]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x18012c318]
lea rcx, [rsp + 0x3170]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, rax
test rax, rax
je case.0x1800223aa.3
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0xa
jae case.0x1800223aa.3
mov word [rsp + 0x1490], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1492]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x1490]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.32770
lea rcx, [rsp + 0x1490]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
mov r9, rbx
xor r8d, r8d
mov edx, dword [0x1801a9338]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
movabs rdx, 0x80001010008
cmp qword [0x1801aa4b0], rdx
jne 0x1800233bb
mov word [rsp + 0x16a0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x16a2]
call fcn.18007ead0
mov r8d, 0x103
lea rdx, [rsp + 0x16a0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.FxWnd
lea rcx, [rsp + 0x16a0]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
cmp dword [r12 + 8], eax
jne case.0x1800223aa.3
mov word [rsp + 0x1ac0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1ac2]
call fcn.18007ead0
mov r8d, 0x103
lea rdx, [rsp + 0x1ac0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, str.vU_
lea rcx, [rsp + 0x1ac0]
call fcn.18007dfc8
test rax, rax
je case.0x1800223aa.3
mov qword [rsp + 0x80], rbx
lea rcx, str.FxEdit
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x98], r14d
mov dword [rsp + 0x9c], 0x10002000
mov dword [rsp + 0xa0], 2
mov dword [rsp + 0xa4], 1
mov dword [rsp + 0xa8], r14d
mov qword [rsp + 0xc0], r14
xor edx, edx
mov r8d, 0x318
lea rcx, [rsp + 0xc8]
call fcn.18007ead0
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x3e0]
call fcn.18007ead0
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 1
lea r8, [rsp + 0x80]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.18002d9a0
cmp qword [rsp + 0xc0], 1
jne case.0x1800223aa.3
mov r9, qword [rsp + 0xc8]
test r9, r9
je case.0x1800223aa.3
xor r8d, r8d
mov edx, dword [0x1801a9334]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp dword [0x1801aa490], 0x1000000
jne case.0x1800223aa.3
mov word [rsp + 0x1ee0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1ee2]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x1ee0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x1ee0]
lea rdi, [0x180132778]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
cmp qword [0x1801aa6d8], rbx
je case.0x1800223aa.3
mov qword [0x1801aa6d8], rbx
mov r9, rbx
mov r8d, 1
mov edx, dword [0x1801a93c8]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp dword [0x1801aa490], 0x1000000
jne case.0x1800223aa.3
mov word [rsp + 0x2300], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2302]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2300]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x18012c318]
lea rcx, [rsp + 0x2300]
call fcn.18007f704
test eax, eax
jne case.0x1800223aa.3
cmp dword [r12 + 8], eax
jne case.0x1800223aa.3
mov word [rsp + 0xa40], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xa42]
call fcn.18007ead0
mov r8d, 0x103
lea rdx, [rsp + 0xa40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [0x180132774]
lea rcx, [rsp + 0xa40]
call fcn.18007dfc8
test rax, rax
je case.0x1800223aa.3
cmp dword [0x1801b0450], 0
je 0x180023545
lea rax, [rsp + 0xa40]
mov qword [rsp + 0x20], rax
lea r9, str._Line___WM_ENABLE__user___s
lea r8, [0x18012b1a8]
mov edx, 0xffffffff
lea rcx, [0x1801afb58]
call fcn.1800b3b40
lea r9, [rsp + 0xa40]
mov r8, rbx
mov edx, dword [0x1801a9320]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp dword [0x1801aa490], 0x1000000
jne case.0x1800223aa.3
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne case.0x1800223aa.3
cmp qword [r12 + 8], 0xd
jne case.0x1800223aa.3
mov r9, rbx
mov r8d, 3
mov edx, dword [0x1801a92bc]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp edi, 0x1007
ja 0x180023901
cmp edi, 0x1007
je 0x180023a34
cmp edi, 0x10d
je 0x1800238e2
cmp edi, 0x210
je 0x180023768
cmp edi, 0x437
jne case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 1
jne 0x1800236ae
mov word [rsp + 0x2720], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2722]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2720]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
lea rsi, [rsp + 0x2720]
lea rdi, str.RichEdit20A
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
cmp eax, 0x37e
jne case.0x1800223aa.3
mov rdi, qword [r12]
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne case.0x1800223aa.3
cmp dword [rdi], eax
jne 0x1800236a2
cmp dword [rdi + 4], 0xffffffff
jne 0x1800236a2
mov dword [0x1801aa494], 1
jmp case.0x1800223aa.3
mov dword [0x1801aa494], r14d
jmp case.0x1800223aa.3
cmp eax, 0x10
jne case.0x1800223aa.3
mov word [rsp + 0x2b40], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2b42]
call fcn.18007ead0
mov r8d, 0x104
lea rdx, [rsp + 0x2b40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x2b40]
lea rdi, str.RICHEDIT
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
jne case.0x1800223aa.3
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x37e
je 0x180023729
cmp eax, 0x1006
jne case.0x1800223aa.3
mov rdi, qword [r12]
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne case.0x1800223aa.3
cmp dword [rdi], eax
jne 0x18002375c
cmp dword [rdi + 4], 0xffffffff
jne 0x18002375c
mov dword [0x1801aa494], 1
jmp case.0x1800223aa.3
mov dword [0x1801aa494], r14d
jmp case.0x1800223aa.3
mov eax, dword [0x1801aa490]
cmp eax, 2
jne 0x18002379e
cmp word [r12 + 8], ax
jne case.0x1800223aa.3
mov r9, qword [r12]
xor r8d, r8d
mov edx, dword [0x1801a92d8]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp eax, 0x80
jne case.0x1800223aa.3
cmp word [r12 + 8], si
jne case.0x1800223aa.3
movzx r13d, word [r12]
movzx esi, word [r12 + 2]
cmp dword [0x1801b0450], 0
je 0x1800237fb
movzx eax, si
movzx ecx, r13w
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r9, str.WM_PARENTNOTIFY_1__XY:_d__d_
lea r8, str.skype
mov edi, 0xffffffff
mov edx, edi
lea rcx, [0x1801afb58]
call fcn.1800b3b40
jmp 0x180023800
mov edi, 0xffffffff
mov eax, 0xfa
cmp si, ax
jbe case.0x1800223aa.3
mov dword [rsp + 0x58], r14d
xor eax, eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [0x1801b0450], 0
je 0x180023864
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
lea r9, str.WM_PARENTNOTIFY_2__LR:_d__d_
lea r8, str.skype
mov edx, edi
lea rcx, [0x1801afb58]
call fcn.1800b3b40
mov eax, dword [rsp + 0x60]
sub eax, dword [rsp + 0x58]
cmp eax, 0x302
jle 0x180023882
mov eax, 0x14a
cmp r13w, ax
ja case.0x1800223aa.3
call fcn.180014070
movzx esi, ax
cmp dword [0x1801b0450], 0
je 0x1800238b6
movzx ecx, ax
mov dword [rsp + 0x20], ecx
lea r9, str.WM_PARENTNOTIFY_3___08x_
lea r8, str.skype
mov edx, edi
lea rcx, [0x1801afb58]
call fcn.1800b3b40
mov eax, 0x7f89
cmp si, ax
jne case.0x1800223aa.3
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x1801a93cc]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, dword [0x1801a92c0]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
sub edi, 0x104d
je 0x1800239c9
cmp edi, 0x27
jne case.0x1800223aa.3
cmp dword [0x1801aa490], 0x400
jne case.0x1800223aa.3
cmp dword [0x1801aa48c], 0x12
je case.0x1800223aa.3
lea edx, [rdi - 0x33]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x3f6
jne case.0x1800223aa.3
mov rdi, qword [r12]
cmp qword [rdi + 0x18], 0
je case.0x1800223aa.3
cmp dword [rdi + 0x18], 0xffffff
je case.0x1800223aa.3
mov word [rsp + 0x580], r14w
xor edx, edx
mov r8d, RegisterTypeLib
lea rcx, [rsp + 0x582]
call fcn.18007ead0
mov r9d, 0x50
lea r8, [rsp + 0x580]
or edx, 0xffffffff
mov rcx, qword [rdi + 0x18]
call fcn.18000f870
mov rcx, rbx
call fcn.18002d5b0
mov r9, rax
lea r8, [rsp + 0x580]
mov edx, dword [0x1801a9304]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1800223aa.3
cmp dword [0x1801aa490], 0x100
jne case.0x1800223aa.3
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x1f43
je 0x180023a00
cmp eax, 0xfa3
je 0x180023a00
cmp eax, 0x4e26
jne case.0x1800223aa.3
mov rax, qword [r12]
mov r8, qword [rax + 0x18]
test r8, r8
je case.0x1800223aa.3
cmp r8d, 0xffffff
je case.0x1800223aa.3
mov r9, rbx
mov edx, dword [0x1801a92f4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1801aa490], 0x100
jne case.0x1800223aa.3
mov edx, 0xfffffff4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x1f43
je 0x180023a6b
cmp eax, 0xfa3
je 0x180023a6b
cmp eax, 0x4e26
jne case.0x1800223aa.3
mov r12, qword [r12]
cmp qword [r12 + 0x18], 0
je case.0x1800223aa.3
cmp dword [r12 + 0x18], 0xffffff
je case.0x1800223aa.3
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, qword [r12 + 0x18]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
mov qword [rsp + 0xb0], rcx
je case.0x1800223aa.3
lea rdx, [rcx + 1]
mov eax, 2
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.180030824
mov r13, rax
test rax, rax
je case.0x1800223aa.3
lea r9d, [rdi + 1]
mov r8, rax
mov edx, esi
mov rcx, qword [r12 + 0x18]
call fcn.18000fa70
mov r9, rbx
mov r8, r13
mov edx, dword [0x1801a92f4]
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r13
call fcn.18003081c
nop
mov rcx, qword [rsp + 0x3590]
xor rcx, rsp
call fcn.18007e1e0
lea r11, [rsp + 0x35a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret