Function at 0x1019ff00
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x1023c014]
xor eax, esp
mov dword [esp + 0x68], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1019ff2c
mov dword [esp + 0x1c], ecx
jmp 0x1019ff33
mov ebx, dword [ecx + 8]
mov dword [esp + 0x1c], ebx
test ecx, ecx
jne 0x1019ff3d
mov dword [esp + 0x38], ecx
jmp 0x1019ff5e
mov ebx, dword [ecx + 4]
mov eax, ebx
and eax, 0xffbfffff
or ebx, 0x400000
cmp dword [ecx + 0x74], 1
cmovne ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edi + 4]
mov dword [esp + 0x38], ebx
mov esi, dword [eax + 4]
lea ecx, [edx + 0x14]
mov dword [esp + 0x30], ecx
test esi, esi
je 0x1019ff6f
mov esi, dword [esi + 0x5c]
mov eax, dword [ecx]
mov ebx, dword [esp + 0x1c]
mov dword [esi + 0x50], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x54], eax
test bl, 0x18
jne 0x1019ffa9
test ebx, 0x8000000
jne 0x1019ff93
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x28]
jne 0x1019ffa9
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4
mov eax, ebx
and eax, 1
mov dword [esp + 0x20], eax
add eax, 0x114
mov dword [esp + 0x3c], eax
mov eax, dword [edx]
add eax, 0xfffffe00
cmp eax, 3
ja case.0x1019ffe8.4
jmp dword [eax*4 + 0x101a04a0]
push ecx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCScrollBar::HitTestScrollBar_struct_tagPOINT_const__
mov ebx, eax
lea eax, [ebx - 1]
cmp eax, 6
ja case.0x1019ffe8.4
jmp dword [eax*4 + 0x101a04b0]
mov eax, dword [edi + 4]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ecx, dword [eax + 4]
call fcn.1001bad0
mov ecx, dword [edi + 4]
lea edx, [esp + 0x64]
mov dword [esp + 0x34], eax
mov ecx, dword [ecx + 4]
call fcn.1001bb30
mov ecx, dword [esi + 0x34]
movzx eax, cx
shl eax, 0x10
push 0
or eax, 5
mov dword [esi + 0x40], ebx
push eax
push dword [esp + 0x44]
mov dword [esi + 0x38], ecx
mov eax, dword [edi + 4]
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
mov ecx, dword [esp + 0x44]
lea ebx, [esp + 0x28]
add esp, 0x10
lea edx, [esi + 0x20]
mov eax, dword [ecx]
push ebx
lea ebx, [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x40]
push edx
push ebx
push dword [esp + 0x2c]
lea edx, [esp + 0x78]
push edx
push 3
call dword [eax + 0x15c]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x28]
push edx
mov eax, dword [ecx]
lea edx, [esi + 0x20]
push edx
push ebx
push dword [esp + 0x2c]
lea edx, [esp + 0x78]
push edx
push 4
call dword [eax + 0x15c]
cmp dword [esp + 0x20], 0
je 0x101a00aa
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov eax, dword [eax + 4]
sub eax, edx
jmp 0x101a00e4
mov eax, dword [edi]
mov edx, dword [eax + 0x54]
cmp eax, sym.HncOfficeFramework.dll_const_CHDCScrollBar::vftablefor__CHDlgItem
jne 0x101a046e
mov eax, dword [edi + 4]
xor ebx, ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x101a00cd
cmp dword [eax + 0x74], 1
sete bl
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [eax]
sub ecx, eax
sub eax, edx
test ebx, ebx
cmovne eax, ecx
cmp dword [esp + 0x20], 0
mov dword [esi + 0x48], eax
jne 0x101a0118
mov eax, dword [edi]
mov ebx, dword [eax + 0x54]
cmp eax, sym.HncOfficeFramework.dll_const_CHDCScrollBar::vftablefor__CHDlgItem
jne 0x101a0479
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
xor eax, eax
test ecx, ecx
je 0x101a0111
cmp dword [ecx + 0x74], 1
sete al
test eax, eax
cmovne edx, dword [esp + 0x18]
mov dword [esi + 0x4c], edx
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x101a0136
mov dword [esp + 0x2c], eax
jmp 0x101a0140
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 8]
mov dword [esp + 0x2c], eax
mov ebx, 1
push 0
push 0
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x101a0379
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 0x4c]
mov ecx, 0xff00
and ax, cx
cmp edx, 0x12
je 0x101a0189
xor ecx, ecx
test ax, ax
cmovne ecx, ebx
mov ebx, ecx
cmp edx, 0x202
jne 0x101a018b
xor ebx, ebx
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x48], eax
jne 0x101a01a1
cmp edx, 0x10
je 0x101a019f
cmp edx, 2
jne 0x101a01a1
xor ebx, ebx
cmp edx, 0x200
jne 0x101a0333
mov eax, dword [esi + 0x40]
cmp eax, 7
jne 0x101a01dd
mov eax, dword [esp + 0x30]
movzx ecx, word [eax + 4]
movzx eax, word [eax]
shl ecx, 0x10
or ecx, eax
mov eax, dword [edi + 4]
push ecx
push 0
push 5
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
jmp 0x101a032f
cmp eax, 3
jne 0x101a034c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x101a032f
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a0209
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 8]
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x101a0262
mov eax, dword [edi]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x54]
cmp eax, sym.HncOfficeFramework.dll_const_CHDCScrollBar::vftablefor__CHDlgItem
jne 0x101a0486
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
xor eax, eax
test edx, edx
je 0x101a0248
cmp dword [edx + 0x74], 1
sete al
mov edx, dword [esi + 0x48]
test eax, eax
je 0x101a025a
add ecx, edx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x4c], ecx
jmp 0x101a0274
mov eax, dword [esp + 0x20]
sub ecx, edx
jmp 0x101a0269
mov ecx, dword [esp + 0x44]
sub ecx, dword [esi + 0x48]
mov dword [esp + 0x14], ecx
mov dword [esi + 0x4c], ecx
test eax, eax
jne 0x101a02b4
mov eax, dword [edi]
mov edx, dword [eax + 0x54]
cmp eax, sym.HncOfficeFramework.dll_const_CHDCScrollBar::vftablefor__CHDlgItem
jne 0x101a0493
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
xor eax, eax
test edx, edx
je 0x101a0297
cmp dword [edx + 0x74], 1
sete al
test eax, eax
je 0x101a02b4
cmp dword [esp + 0x28], ecx
mov eax, dword [esp + 0x18]
cmovl ecx, dword [esp + 0x28]
sub eax, dword [esp + 0x10]
add eax, dword [esp + 0x24]
cmp ecx, eax
jmp 0x101a02cb
cmp ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmovl ecx, dword [esp + 0x24]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x28]
cmp eax, ecx
push 0
lea edx, [esp + 0x18]
mov dword [esi + 0x4c], ecx
push edx
lea edx, [esi + 0x20]
cmovge eax, ecx
mov ecx, dword [esp + 0x3c]
push edx
push dword [esp + 0x44]
mov dword [esi + 0x4c], eax
lea edx, [esp + 0x74]
push dword [esp + 0x2c]
mov eax, dword [ecx]
push edx
push 8
call dword [eax + 0x15c]
mov eax, dword [esp + 0x14]
cmp dword [esi + 0x38], eax
je 0x101a0324
mov dword [esi + 0x38], eax
movzx eax, ax
shl eax, 0x10
push 0
or eax, 5
push eax
mov eax, dword [edi + 4]
push dword [esp + 0x44]
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bc30
mov edx, dword [esp + 0x4c]
cmp edx, 0x104
ja 0x101a034c
je 0x101a0359
cmp edx, 0x20
je 0x101a0371
cmp edx, 0x100
je 0x101a0359
jmp 0x101a035b
sub edx, 0x200
je 0x101a0371
sub edx, 2
jne 0x101a035b
xor ebx, ebx
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
test ebx, ebx
jne 0x101a0145
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
test edx, edx
je 0x101a03ca
mov ebx, dword [edx + 0x5c]
test ebx, ebx
je 0x101a03ca
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x101a03ca
test edx, edx
jne 0x101a0399
xor eax, eax
jmp 0x101a03aa
test ebx, ebx
mov dword [esp + 0x2c], 0
mov eax, ecx
cmove eax, dword [esp + 0x2c]
mov eax, dword [eax + 4]
cmp dword [eax + 0x18], edx
jne 0x101a03ca
test edx, edx
jne 0x101a03ba
xor ecx, ecx
jmp 0x101a03c1
xor eax, eax
test ebx, ebx
cmove ecx, eax
push 0x64
push 0
call sym.HncOfficeFramework.dll_public:_void____thiscall_CHDlgCtrlGrp::SetHDlgCtrl_void___unsigned_int_
mov eax, dword [esi + 0x28]
dec eax
mov dword [esi + 0x40], 0
push 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x38], eax
mov eax, dword [edi + 4]
push 8
push dword [esp + 0x44]
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
jmp 0x101a044a
push ebx
mov ecx, edi
mov dword [esi + 0x40], ebx
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCScrollBar::_DoScrollByHitArea_int_
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCScrollBar::_RunMouseLButtonDownLoop_void_
jmp case.0x1019ffe8.4
mov dword [esi + 0x40], ebx
jmp case.0x1019ffe8.4
mov dword [esi + 0x40], 0
jmp 0x101a044a
cmp dword [esi + 0x40], 0
jne case.0x1019ffe8.4
push ecx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCScrollBar::HitTestScrollBar_struct_tagPOINT_const__
mov ebx, eax
cmp ebx, 7
jne 0x101a0442
push 0x7f82
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [esi + 0x3c], ebx
je case.0x1019ffe8.4
mov dword [esi + 0x3c], ebx
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov ecx, dword [esp + 0x74]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call edx
mov ebx, eax
jmp 0x101a00cd
mov ecx, edi
call ebx
mov edx, dword [esp + 0x10]
jmp 0x101a0111
mov ecx, edi
call edx
mov ecx, dword [esp + 0x14]
jmp 0x101a0248
mov ecx, edi
call edx
mov ecx, dword [esi + 0x4c]
jmp 0x101a0297