Function at 0x131331e0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x131f6580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3328
call fcn.1314d090
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [0x13233800]
test eax, eax
je 0x13133798
mov eax, dword [0x13233828]
test eax, eax
je 0x13133798
mov eax, dword [ebp + 8]
test eax, eax
jne 0x13133798
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x13133798
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x13133798
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x1c], 0
cmp edi, 1
je 0x131332d0
cmp edi, 0x102
je 0x131332d0
cmp edi, 0x437
je 0x131332d0
cmp edi, 0xc2
je 0x131332d0
cmp edi, 0xc
je 0x131332d0
cmp edi, 0x104d
je 0x131332d0
cmp edi, 0x1007
je 0x131332d0
cmp edi, 0x1008
je 0x131332d0
cmp edi, 0x104c
je 0x131332d0
cmp edi, 0x1074
je 0x131332d0
cmp edi, 0x10
je 0x131332d0
cmp edi, 0x210
je 0x131332d0
cmp edi, 0x18
je 0x131332d0
cmp edi, 8
je 0x131332d0
cmp edi, 0x201
je 0x131332d0
cmp edi, 2
je 0x131332d0
cmp edi, 0xa
je 0x131332d0
cmp edi, 0x10d
jne 0x13133798
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1323380c]
test eax, eax
je 0x13133798
cmp dword [ebp - 0x1c], eax
jne 0x13133798
mov dword [ebp - 4], 0
cmp edi, 0x102
ja 0x1313435e
je 0x13134316
dec edi
cmp edi, 0xc1
ja case.0x13133322.8
xor ecx, ecx
mov cl, byte [edi + 0x13134860]
jmp dword [ecx*4 + 0x13134840]
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x240], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x23e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x240]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [0x13234310]
mov dword [ebp - 0x3324], eax
test eax, eax
je 0x13133394
push esi
lea eax, [ebp - 0x240]
push eax
push str.wm_create___s____08x_
push 0x132185f8
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x248], eax
cmp dword [0x13233814], eax
jne 0x1313344f
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x240]
push ecx
push esi
call fcn.13132780
add esp, 0x14
mov edi, eax
mov dword [ebp - 0x34], edi
mov ebx, edx
mov dword [ebp - 0x30], ebx
mov edx, edi
or edx, ebx
je 0x13133436
mov dword [0x13233818], 1
mov eax, dword [ebp - 0x1c]
mov dword [0x1323380c], eax
mov ecx, dword [ebp - 0x20]
mov dword [0x13233810], ecx
mov eax, dword [ebp - 0x248]
mov dword [0x13233808], eax
mov edx, dword [ebp - 0x38]
mov dword [0x13233814], edx
mov dword [0x13233820], edi
mov dword [0x13233824], ebx
cmp edi, 0x2010008
jne 0x13133436
cmp ebx, 0x400
jne 0x13133436
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x244], 1
mov eax, dword [0x13233814]
test eax, eax
je case.0x13133322.8
jmp 0x13133479
cmp dword [0x13233800], eax
je 0x1313371f
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x240]
push ecx
push esi
call fcn.131308d0
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x34], edi
mov ebx, edx
mov dword [ebp - 0x30], ebx
mov edx, edi
or edx, ebx
je 0x1313371c
mov dword [ebp - 0x24c], 0
push ebx
push edi
call fcn.13128f40
add esp, 8
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x13133519
cmp dword [0x13233814], 0x1000000
jne 0x13133519
cmp edi, 0x10001
jne 0x13133519
cmp ebx, 0x1000000
jne 0x13133519
push 1
push ebx
mov ecx, 0x132335b8
call fcn.1312fdd0
mov ecx, 0x132335b8
call fcn.1312fd80
mov dword [0x13233828], eax
push 0x8000000
push eax
mov ecx, 0x13233440
call fcn.1312f350
push 1
mov ecx, dword [0x132335b0]
call fcn.13138690
mov dword [0x1321be5c], 1
push esi
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [0x132331a4]
jmp 0x13133783
mov ecx, 0x10000
cmp edi, ecx
jne 0x13133547
cmp ebx, 0x8000000
jne 0x13133547
mov dword [0x13233820], ecx
mov dword [0x13233824], ebx
push 1
mov ecx, 0x13234ca8
call fcn.131485c0
jmp case.0x13133322.8
mov eax, 0x20000
cmp edi, eax
jne 0x13133582
cmp ebx, 0x8000000
jne 0x13133582
mov dword [0x13233820], eax
mov dword [0x13233824], ebx
push 2
mov ecx, 0x13234ca8
call fcn.131485c0
push esi
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [0x132331a4]
jmp 0x13133783
cmp edi, ecx
jne 0x131335ab
cmp ebx, 0x80000000
jne 0x131335ab
mov dword [0x13233820], ecx
mov dword [0x13233824], ebx
push 1
mov ecx, 0x13233440
call fcn.1312f540
jmp case.0x13133322.8
cmp edi, eax
jne 0x131335e1
cmp ebx, 0x80000000
jne 0x131335e1
mov dword [0x13233820], eax
mov dword [0x13233824], ebx
push 2
mov ecx, 0x13233440
call fcn.1312f540
push esi
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [0x132331a4]
jmp 0x13133783
cmp edi, ecx
jne 0x131336d3
cmp ebx, 0x40000000
jne 0x131336d3
mov word [ebp - 0x458], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x456]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x458]
push eax
push esi
call fcn.1312d4b0
lea ecx, [ebp - 0x458]
push ecx
call fcn.1314cebe
add esp, 0x10
mov dword [ebp - 0x45c], eax
cmp eax, 2
jne 0x1313367f
push eax
push 0x13218748
lea edx, [ebp - 0x458]
push edx
call fcn.1314cf89
add esp, 0xc
test eax, eax
je 0x131336a5
push 2
push 0x1321d164
lea eax, [ebp - 0x458]
push eax
call fcn.1314cf89
add esp, 0xc
test eax, eax
je 0x131336a5
push esi
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [0x132331a4]
jmp 0x13133783
cmp eax, 8
jne 0x13133506
push eax
push str.DingTalk
lea ecx, [ebp - 0x458]
push ecx
call fcn.1314cf89
add esp, 0xc
test eax, eax
jne 0x13133506
push esi
mov edx, dword [ebp - 0x24c]
push edx
mov eax, dword [0x132331a0]
push eax
mov ecx, dword [0x13233828]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [0x132331a4]
jmp 0x13133783
cmp edi, 0x20001
jne 0x13133506
cmp ebx, 0x1000
jne 0x13133506
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], 2
mov dword [ebp - 0x468], 0
lea edx, [ebp - 0x468]
push edx
push 2
push esi
call fcn.1313c330
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp case.0x13133322.8
mov ebx, dword [ebp - 0x2c]
push ebx
lea eax, [ebp - 0x240]
push eax
call fcn.13133170
add esp, 8
test eax, eax
je 0x1313374a
push esi
push 0
mov ecx, dword [0x1323325c]
push ecx
mov edx, dword [0x13233828]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x13233800], 0x10
jne case.0x13133322.8
cmp ebx, 0x1006
je 0x13133763
cmp ebx, 0x1008
jne case.0x13133322.8
push str.RICHEDIT
lea eax, [ebp - 0x240]
push eax
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
push ebx
mov ecx, dword [0x132331c0]
push ecx
mov edx, dword [0x13233828]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x13233800]
cmp eax, 1
jne 0x13133881
xor ebx, ebx
mov word [ebp - 0xaa4], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xaa2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0xaa4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
mov dword [ebp - 0x89c], edi
push str.RichEdit20A
lea ecx, [ebp - 0xaa4]
push ecx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
cmp edi, 0x37e
jne case.0x13133322.8
cmp dword [0x13233830], ebx
je case.0x13133322.8
mov dword [0x13233830], ebx
mov dword [ebp - 0x898], ebx
mov dword [ebp - 0x894], ebx
mov dword [ebp - 0x898], ebx
mov dword [ebp - 0x894], 0x4b0
push ebx
lea edx, [ebp - 0x898]
push edx
push 0x45f
push esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
mov dword [ebp - 0x890], eax
cmp eax, ebx
je case.0x13133322.8
push esi
push ebx
mov eax, dword [0x132331b0]
push eax
mov ecx, dword [0x13233828]
push ecx
call edi
jmp case.0x13133322.8
cmp eax, 0x10
jne case.0x13133322.8
xor ebx, ebx
mov word [ebp - 0xcbc], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xcba]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0xcbc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.RICHEDIT
lea eax, [ebp - 0xcbc]
push eax
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0xab4], eax
cmp eax, 0x37e
je 0x131338f4
cmp eax, 0x1006
jne case.0x13133322.8
cmp dword [0x13233830], ebx
je case.0x13133322.8
mov dword [0x13233830], ebx
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xaac], ebx
push ebx
lea ecx, [ebp - 0xab0]
push ecx
push 0x45f
push esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
mov dword [ebp - 0xaa8], eax
cmp eax, ebx
je case.0x13133322.8
push esi
push ebx
mov edx, dword [0x132331b0]
push edx
mov eax, dword [0x13233828]
push eax
call edi
jmp case.0x13133322.8
mov eax, dword [0x13233800]
cmp eax, 2
jne 0x13133a0c
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0xcc0], eax
cmp eax, 0x401
je 0x13133985
cmp eax, 0x65
jne case.0x13133322.8
mov word [ebp - 0xecc], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xeca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0xecc]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.RichEdit20A
lea edx, [ebp - 0xecc]
push edx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
mov edi, dword [ebx]
mov dword [ebp - 0xcc4], edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne case.0x13133322.8
push edi
call fcn.1314cebe
add esp, 4
test eax, eax
jne case.0x13133322.8
push esi
push eax
mov eax, dword [0x132331f4]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
cmp eax, 0x100
jne 0x13133aa7
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0xed0], eax
cmp eax, 0x1f71
je 0x13133a38
cmp eax, 0xfa8
jne case.0x13133322.8
mov word [ebp - 0x10dc], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x10da]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x10dc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.Static
lea eax, [ebp - 0x10dc]
push eax
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
mov edi, dword [ebx]
mov dword [ebp - 0xed4], edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne case.0x13133322.8
push esi
push edi
mov ecx, dword [0x132331f4]
jmp 0x13133783
cmp eax, 0x800
jne case.0x13133322.8
mov word [ebp - 0x12e4], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x12e2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x12e4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne case.0x13133322.8
push str.FxWnd
lea ecx, [ebp - 0x12e4]
push ecx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
mov edx, dword [ebx]
push edx
mov eax, dword [0x132331c0]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
mov eax, dword [0x13233800]
cmp eax, 1
je 0x13133c08
cmp eax, 0x10
je 0x13133c08
cmp eax, 0x10000
jne 0x13133bb4
mov word [ebp - 0x17b0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x17ae]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x17b0]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.Tfm_chat
lea eax, [ebp - 0x17b0]
push eax
call fcn.1314cedb
add esp, 8
test eax, eax
je 0x13133b9f
push str.Tfm_message
lea ecx, [ebp - 0x17b0]
push ecx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
push 1
mov edx, dword [0x132331a8]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
cmp eax, 0x1000000
jne case.0x13133322.8
push esi
push 1
mov ecx, dword [0x132331a8]
push ecx
mov edx, dword [0x13233828]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x13234310]
mov dword [ebp - 0x3328], eax
test eax, eax
je case.0x13133322.8
push esi
push str.line_destory_1___x_
push 0x132185f8
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x14
jmp case.0x13133322.8
mov word [ebp - 0x15a8], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x15a6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x15a8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.TXGuiFoundation
lea ecx, [ebp - 0x15a8]
push ecx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
push 1
mov edx, dword [0x132331a8]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
mov eax, dword [0x13233800]
cmp eax, 0x800
jne 0x13133ddc
mov word [ebp - 0x19d4], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x19d2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x19d4]
push ecx
push esi
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
call ebx
cmp dword [0x13233820], 0x1010008
jne 0x13133d21
cmp dword [0x13233824], 0x800
jne 0x13133d21
push str.FxRichEdit
lea edx, [ebp - 0x19d4]
push edx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x19d8], eax
test eax, eax
je case.0x13133322.8
push 0
push str.FxEdit
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x19dc], eax
test eax, eax
je case.0x13133322.8
push esi
push 0
mov eax, dword [0x13233208]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
push str.Edit
lea edx, [ebp - 0x19d4]
push edx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov edx, eax
mov dword [ebp - 0x19e0], edx
test edx, edx
je case.0x13133322.8
mov word [ebp - 0x1be8], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1be6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x1be8]
push eax
push edx
call ebx
push str.CFxAccountComboBox
call fcn.1314cebe
push eax
push str.CFxAccountComboBox
lea ecx, [ebp - 0x1be8]
push ecx
call fcn.1314cf89
add esp, 0x10
test eax, eax
je 0x13133dc7
push str.WindowsForms10.COMBOBOX.app.0.
call fcn.1314cebe
push eax
push str.WindowsForms10.COMBOBOX.app.0.
lea edx, [ebp - 0x1be8]
push edx
call fcn.1314cf89
add esp, 0x10
test eax, eax
jne case.0x13133322.8
push esi
push 0
mov eax, dword [0x13233204]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
cmp eax, 0x400000
jne 0x13133e91
cmp dword [0x13233820], 0x10001
jne case.0x13133322.8
cmp dword [0x13233824], 0x400000
jne case.0x13133322.8
mov word [ebp - 0x1df0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1dee]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x1df0]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.RichEdit20W
lea eax, [ebp - 0x1df0]
push eax
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x1df4], eax
test eax, eax
je case.0x13133322.8
push 0
push str.SysListView32
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x1df8], eax
test eax, eax
je case.0x13133322.8
push esi
push 0
mov ecx, dword [0x13233208]
jmp 0x13133783
cmp eax, 2
je case.0x13133322.8
cmp eax, 0x1000
jne 0x13133f60
mov word [ebp - 0x2000], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1ffe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x2000]
push eax
push esi
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
call ebx
push str.Edit
lea ecx, [ebp - 0x2000]
push ecx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov edx, eax
mov dword [ebp - 0x2004], edx
test edx, edx
je case.0x13133322.8
mov word [ebp - 0x220c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x220a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220c]
push eax
push edx
call ebx
push str.ComboBox
lea ecx, [ebp - 0x220c]
push ecx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
push eax
mov edx, dword [0x13233204]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
cmp eax, 0x80000
jne case.0x13133322.8
mov word [ebp - 0x2414], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x2414]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.Edit
lea edx, [ebp - 0x2414]
push edx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov dword [ebp - 0x2418], ebx
test ebx, ebx
je case.0x13133322.8
mov dword [ebp - 0x2624], 0
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x2624], eax
test ah, 4
je case.0x13133322.8
mov word [ebp - 0x2620], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x261e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x2620]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.32770
lea ecx, [ebp - 0x2620]
push ecx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
push esi
push eax
mov edx, dword [0x13233208]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
cmp dword [0x13233820], 0x1010008
jne 0x131341a7
cmp dword [0x13233824], 0x800
jne 0x131341a7
mov word [ebp - 0x282c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x282a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea ecx, [ebp - 0x282c]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.FxWnd
lea edx, [ebp - 0x282c]
push edx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
mov eax, dword [ebx + 4]
test eax, eax
jne case.0x13133322.8
xor ebx, ebx
mov word [ebp - 0x2cdc], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2cda]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea eax, [ebp - 0x2cdc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.vU_
lea ecx, [ebp - 0x2cdc]
push ecx
call fcn.1314cf10
add esp, 8
test eax, eax
je case.0x13133322.8
mov dword [ebp - 0x2cfc], esi
mov dword [ebp - 0x2cf8], str.FxEdit
mov dword [ebp - 0x2cf4], ebx
mov dword [ebp - 0x2cf0], ebx
mov dword [ebp - 0x2cec], 0x10002000
mov dword [ebp - 0x2ce8], 2
mov dword [ebp - 0x2ce4], 1
mov dword [ebp - 0x2ce0], ebx
mov dword [ebp - 0x2ad4], ebx
mov ecx, 0xa9
xor eax, eax
lea edi, [ebp - 0x2ad0]
rep stosd dword es:[edi], eax
push ebx
push ebx
push ebx
push ebx
push 1
lea edx, [ebp - 0x2cfc]
push edx
push esi
lea eax, [ebp - 0x2ad4]
push eax
call fcn.1313c1e0
add esp, 0x20
cmp dword [ebp - 0x2ad4], 1
jne case.0x13133322.8
mov eax, dword [ebp - 0x2ad0]
mov dword [ebp - 0x2d00], eax
cmp eax, ebx
je case.0x13133322.8
push eax
push ebx
mov ecx, dword [0x13233204]
jmp 0x13133783
cmp dword [0x13233800], 0x1000000
jne case.0x13133322.8
mov word [ebp - 0x2f08], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2f06]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x2f08]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x1321d064
lea ecx, [ebp - 0x2f08]
push ecx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
cmp dword [0x13233a40], esi
je case.0x13133322.8
mov dword [0x13233a40], esi
push esi
push 1
mov edx, dword [0x13233298]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
cmp dword [0x13233800], 0x1000000
jne case.0x13133322.8
mov word [ebp - 0x3110], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x310e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x3110]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.Edit
lea edx, [ebp - 0x3110]
push edx
call fcn.1314d0bf
add esp, 8
test eax, eax
jne case.0x13133322.8
mov eax, dword [ebx + 4]
test eax, eax
jne case.0x13133322.8
mov word [ebp - 0x3318], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x3316]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea eax, [ebp - 0x3318]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x1321d060
lea ecx, [ebp - 0x3318]
push ecx
call fcn.1314cf10
add esp, 8
test eax, eax
je case.0x13133322.8
mov eax, dword [0x13234310]
mov dword [ebp - 0x3338], eax
test eax, eax
je 0x13134303
lea edx, [ebp - 0x3318]
push edx
push str._Line___WM_ENABLE__user___s
push 0x132185f8
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x14
lea eax, [ebp - 0x3318]
push eax
push esi
mov ecx, dword [0x132331f0]
jmp 0x13133783
cmp dword [0x13233800], 0x1000000
jne case.0x13133322.8
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
mov dword [ebp - 0x46c], eax
test eax, eax
jne case.0x13133322.8
cmp dword [ebx + 4], 0xd
jne case.0x13133322.8
push esi
push 3
mov eax, dword [0x1323318c]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
cmp edi, 0x1007
ja 0x13134645
je 0x13134765
cmp edi, 0x10d
je 0x13134636
cmp edi, 0x210
je 0x131344c3
cmp edi, 0x437
jne case.0x13133322.8
mov eax, dword [0x13233800]
cmp eax, 1
jne 0x1313440e
mov word [ebp - 0x67c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x67a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x67c]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
mov dword [ebp - 0x474], esi
push str.RichEdit20A
lea eax, [ebp - 0x67c]
push eax
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
cmp esi, 0x37e
jne case.0x13133322.8
mov esi, dword [ebx]
mov dword [ebp - 0x470], esi
jmp 0x13134489
cmp eax, 0x10
jne case.0x13133322.8
mov word [ebp - 0x88c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x88a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x88c]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.RICHEDIT
lea edx, [ebp - 0x88c]
push edx
call fcn.1314cedb
add esp, 8
test eax, eax
jne case.0x13133322.8
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x684], eax
cmp eax, 0x37e
je 0x13134481
cmp eax, 0x1006
jne case.0x13133322.8
mov esi, dword [ebx]
mov dword [ebp - 0x680], esi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne case.0x13133322.8
cmp dword [esi], 0
jne 0x131344b4
cmp dword [esi + 4], 0xffffffff
jne 0x131344b4
mov dword [0x13233830], 1
jmp case.0x13133322.8
mov dword [0x13233830], 0
jmp case.0x13133322.8
mov eax, dword [0x13233800]
cmp eax, 2
jne 0x131344e7
cmp word [ebx + 4], ax
jne case.0x13133322.8
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [0x132331a8]
jmp 0x13133783
cmp eax, 0x80
jne case.0x13133322.8
cmp word [ebx + 4], 0x201
jne case.0x13133322.8
mov eax, dword [ebx]
mov ebx, eax
mov dword [ebp - 0x17c8], ebx
shr eax, 0x10
mov edi, eax
mov dword [ebp - 0x17cc], edi
mov eax, dword [0x13234310]
mov dword [ebp - 0x332c], eax
test eax, eax
je 0x1313454c
mov eax, edi
and eax, 0xffff
push eax
mov ecx, ebx
and ecx, 0xffff
push ecx
push str.WM_PARENTNOTIFY_1__XY:_d__d_
push str.skype
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x18
cmp di, 0xfa
jbe case.0x13133322.8
mov dword [ebp - 0x17c0], 0
xor edx, edx
mov dword [ebp - 0x17bc], edx
mov dword [ebp - 0x17b8], edx
mov dword [ebp - 0x17b4], edx
lea eax, [ebp - 0x17c0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x13234310]
mov dword [ebp - 0x3330], eax
test eax, eax
je 0x131345b9
mov ecx, dword [ebp - 0x17b8]
push ecx
mov edx, dword [ebp - 0x17c0]
push edx
push str.WM_PARENTNOTIFY_2__LR:_d__d_
push str.skype
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x18
mov eax, dword [ebp - 0x17b8]
sub eax, dword [ebp - 0x17c0]
cmp eax, 0x302
jle 0x131345d7
cmp bx, 0x14a
ja case.0x13133322.8
call fcn.1312db90
mov esi, eax
mov dword [ebp - 0x17c4], esi
mov eax, dword [0x13234310]
mov dword [ebp - 0x3334], eax
test eax, eax
je 0x13134615
mov ecx, esi
and ecx, 0xffff
push ecx
push str.WM_PARENTNOTIFY_3___08x_
push str.skype
push 0xffffffffffffffff
push 0x132342a4
call fcn.131403d0
add esp, 0x14
cmp si, 0x7f89
jne case.0x13133322.8
push 0
push 0
mov edx, dword [0x132332a0]
push edx
mov eax, dword [0x13233828]
push eax
jmp 0x1313378b
push 0
push 1
mov ecx, dword [0x13233190]
jmp 0x13133783
sub edi, 0x104d
je 0x131346fa
sub edi, 0x27
jne case.0x13133322.8
cmp dword [0x13233800], 0x400
jne case.0x13133322.8
cmp dword [0x132337fc], 0x12
je case.0x13133322.8
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0x3f6
jne case.0x13133322.8
mov edx, dword [ebx]
mov dword [ebp - 0x1300], edx
mov eax, dword [edx + 0x14]
test eax, eax
je case.0x13133322.8
cmp eax, 0xffffff
je case.0x13133322.8
mov word [ebp - 0x13a0], 0
mov ecx, 0x27
xor eax, eax
lea edi, [ebp - 0x139e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x50
lea eax, [ebp - 0x13a0]
push eax
push 0xffffffffffffffff
mov ecx, dword [edx + 0x14]
push ecx
call fcn.1312a310
push esi
call fcn.1313c310
add esp, 0x14
push eax
lea edx, [ebp - 0x13a0]
push edx
mov eax, dword [0x132331d4]
push eax
mov ecx, dword [0x13233828]
push ecx
jmp 0x1313378b
cmp dword [0x13233800], 0x100
jne case.0x13133322.8
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x12ec], eax
cmp eax, 0x1f43
je 0x13134732
cmp eax, 0xfa3
je 0x13134732
cmp eax, 0x4e26
jne case.0x13133322.8
mov eax, dword [ebx]
mov dword [ebp - 0x12e8], eax
mov eax, dword [eax + 0x14]
test eax, eax
je case.0x13133322.8
cmp eax, 0xffffff
je case.0x13133322.8
push esi
push eax
mov edx, dword [0x132331c4]
push edx
mov eax, dword [0x13233828]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x13233800], 0x100
jne case.0x13133322.8
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x12f4], eax
cmp eax, 0x1f43
je 0x1313479d
cmp eax, 0xfa3
je 0x1313479d
cmp eax, 0x4e26
jne case.0x13133322.8
mov eax, dword [ebx]
mov dword [ebp - 0x12f0], eax
mov edi, dword [eax + 0x14]
test edi, edi
je case.0x13133322.8
cmp edi, 0xffffff
je case.0x13133322.8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x12f8], ecx
je case.0x13133322.8
lea ebx, [ecx + 1]
lea ecx, [ebx + ebx]
push ecx
call fcn.131e7f70
add esp, 4
mov edi, eax
mov dword [ebp - 0x331c], edi
mov dword [ebp - 0x12fc], edi
test edi, edi
je case.0x13133322.8
push ebx
push edi
push 0xffffffffffffffff
mov edx, dword [ebp - 0x12f0]
mov eax, dword [edx + 0x14]
push eax
call fcn.1312a460
add esp, 0x10
push esi
push edi
mov ecx, dword [0x132331c4]
push ecx
mov edx, dword [0x13233828]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3320], edi
push edi
call fcn.131e7f99
add esp, 4
jmp case.0x13133322.8