Function at 0x101a8b40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1023c014]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, ecx
mov dword [esp + 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x101a917a
mov eax, dword [ecx + 0x5c]
mov dword [esp + 0xc], eax
test eax, eax
je 0x101a917a
cmp dword [edi], 0x201
jne 0x101a8c5d
test ecx, ecx
je 0x101a8c5d
test eax, eax
je 0x101a8c03
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x20], eax
test eax, eax
je 0x101a8c03
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x10], edx
mov dword [eax + 0x10], ecx
test edx, edx
je 0x101a8c03
cmp edx, ecx
je 0x101a8c03
mov ecx, dword [edx + 0x58]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8bd6
mov eax, dword [eax + 0x5c]
and dword [eax + 4], 0xfffeffff
mov ecx, dword [edx + 0x58]
mov eax, dword [ecx]
push 0
call dword [eax + 0x30]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0x14]
cmp dword [eax + 0x10], ecx
jne 0x101a8c5d
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x58]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8c1d
mov eax, dword [eax + 0x5c]
or dword [eax + 4], 0x10000
mov edx, dword [ecx + 0x58]
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax + 0x30]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x58]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov ecx, dword [esp + 0x14]
test dword [ecx + 8], 0x10000000
je 0x101a8c5d
mov eax, dword [ecx + 0x5c]
push 0
push 0
push ecx
push dword [eax + 8]
push 0x8005
call sym.HncOfficeFramework.dll_public:_static_void___cdecl_CHncAAEventProxy::HncNotifyWinEvent_unsigned_long_int__struct_HWND_____void___long_int__long_int_
add esp, 0x14
push edi
mov ecx, esi
call sym.HncOfficeFramework.dll_public_virtual:_long_int___thiscall_CHDCScrollItem::OnMouseEvent_class_CHDlgCtrlMouseEvent__
test eax, eax
je 0x101a8c76
mov dword [esp + 0x1c], 1
jmp case.0x101a8c8f.516
mov eax, dword [edi]
add eax, 0xfffffe00
cmp eax, 0xa3
ja case.0x101a8c8f.516
movzx eax, byte [eax + 0x101a91a4]
jmp dword [eax*4 + 0x101a9190]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_unsigned_long_int___thiscall_CHDlgItem::GetStatus_void_const
and eax, 0x10000000
mov eax, dword [edi]
je 0x101a8cad
cmp eax, 0x201
jmp 0x101a8cc6
cmp eax, 0x202
jne 0x101a8ccc
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8cc1
mov eax, dword [eax + 8]
test eax, 0x800
je case.0x101a8c8f.516
push dword [edi + 0x18]
mov ecx, esi
push dword [edi + 0x14]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::ItemFromPoint_struct_tagPOINT_const
mov dword [esp + 0x14], eax
test eax, eax
js case.0x101a8c8f.516
push 0
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDlgItem::SetRedraw_int_
push dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x14], eax
call sym.HncOfficeFramework.dll_public:_void___thiscall_CHDCListBox::SetAnchorIndex_int_
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x101a8d0b
xor eax, eax
jmp 0x101a8d0e
mov eax, dword [ecx + 8]
test eax, 0x800
je 0x101a8db1
cmp dword [edi], 0x201
jne 0x101a8d74
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xff00
test cx, ax
jne 0x101a8d74
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push 0x11
mov dword [ecx + 0x40], eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xff00
test cx, ax
je 0x101a8d69
push dword [esp + 0x14]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetSel_int_const
mov ecx, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 0x44], eax
jmp 0x101a8d74
mov eax, dword [esp + 0xc]
mov dword [eax + 0x44], 1
push dword [esp + 0x14]
mov ecx, esi
call sym.HncOfficeFramework.dll_protected:_int___thiscall_CHDCListBox::_SetFocusIndexNotify_int_
push dword [esp + 0x14]
mov ecx, esi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListBox::_ExtendSel_int_
cmp dword [edi], 0x202
jne 0x101a8df9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xff00
test cx, ax
jne 0x101a8df9
mov eax, dword [esp + 0xc]
mov dword [eax + 0x40], 0xffffffff
jmp 0x101a8df9
test ecx, ecx
jne 0x101a8db9
xor eax, eax
jmp 0x101a8dbc
mov eax, dword [ecx + 8]
mov ecx, esi
push dword [esp + 0x14]
test al, 8
je 0x101a8de9
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetSel_int_const
neg eax
mov ecx, esi
sbb eax, eax
inc eax
push eax
push dword [esp + 0x18]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::SetSel_int__int_
push dword [esp + 0x14]
mov ecx, esi
call sym.HncOfficeFramework.dll_protected:_int___thiscall_CHDCListBox::_SetFocusIndexNotify_int_
jmp 0x101a8df9
call sym.HncOfficeFramework.dll_protected:_int___thiscall_CHDCListBox::_SetFocusIndexNotify_int_
push dword [esp + 0x14]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::SetCurSel_int_
push dword [esp + 0x10]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDlgItem::SetRedraw_int_
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov eax, dword [edi]
cmp eax, 0x201
je 0x101a8e28
cmp eax, 0x202
jne case.0x101a8c8f.516
mov ecx, dword [esi + 4]
jmp 0x101a8e40
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x101a8e35
mov eax, dword [eax + 8]
test eax, 0x800
jne case.0x101a8c8f.516
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x101a8e4b
xor eax, eax
jmp 0x101a8e4f
movzx eax, word [ecx + 0x24]
movzx eax, ax
push 0
or eax, 0x10000
push eax
push 0x111
push ecx
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
jmp case.0x101a8c8f.516
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x101a8e7b
xor eax, eax
jmp 0x101a8e7f
movzx eax, word [ecx + 0x24]
movzx eax, ax
push 0
or eax, 0x20000
push eax
push 0x111
push ecx
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
jmp case.0x101a8c8f.516
mov eax, dword [0x10240e24]
cmp eax, dword [edi + 0x14]
jne 0x101a8eb5
mov eax, dword [0x10240e28]
cmp eax, dword [edi + 0x18]
je case.0x101a8c8f.516
mov eax, dword [edi + 0x14]
mov ecx, esi
mov dword [0x10240e24], eax
mov eax, dword [edi + 0x18]
mov dword [0x10240e28], eax
push dword [edi + 0x18]
push dword [edi + 0x14]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::ItemFromPoint_struct_tagPOINT_const
mov ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x101a8eec
mov ecx, dword [ecx + 8]
test ecx, 0x800
je case.0x101a8c8f.675
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xff00
test cx, ax
je case.0x101a8c8f.675
push dword [esp + 0x10]
mov ecx, esi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListBox::_ExtendSel_int_
push dword [edi + 0x18]
mov ecx, esi
push dword [edi + 0x14]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::ItemFromPoint_struct_tagPOINT_const
mov edx, dword [esp + 0xc]
mov ecx, eax
mov dword [edx + 0x34], ecx
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8f37
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 4]
test eax, 0x10000000
je case.0x101a8c8f.516
movups xmm1, xmmword [edx + 0x98]
movaps xmm0, xmm1
movaps xmmword [esp + 0x20], xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd edx, xmm1
mov dword [esp + 0x10], eax
sub eax, edx
cmp eax, 3
jle case.0x101a8c8f.516
mov eax, dword [edi + 0x14]
cmp dword [esp + 0x20], eax
jge case.0x101a8c8f.516
cmp dword [esp + 0x28], eax
jle case.0x101a8c8f.516
test ecx, ecx
jns 0x101a8fcd
cmp dword [edi + 0x18], edx
jg 0x101a8f89
inc edx
jmp 0x101a8f8e
mov edx, dword [esp + 0x10]
dec edx
mov eax, dword [esp + 0x20]
mov ecx, esi
inc eax
push edx
push eax
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::ItemFromPoint_struct_tagPOINT_const
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jns 0x101a8fcd
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetCount_void_const
dec eax
mov ecx, esi
push eax
mov dword [esp + 0x14], eax
call sym.HncOfficeFramework.dll_public:_struct_tagRECT_const____thiscall_CHDCListBox::GetItemRect_int_const
mov ecx, dword [esp + 0x14]
test eax, eax
je 0x101a8fcd
mov eax, dword [eax + 4]
cmp eax, dword [edi + 0x18]
cmovl ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call sym.HncOfficeFramework.dll_protected:_int___thiscall_CHDCListBox::_SetFocusIndexNotify_int_
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a9163
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x101a9163
cmp dword [eax + 0x60], 0
je 0x101a9163
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a9013
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [edi]
cmp eax, 0x200
je 0x101a905c
cmp eax, 0x201
je 0x101a905c
cmp eax, 0x203
je 0x101a905c
cmp eax, 0x202
je 0x101a905c
cmp eax, 0x204
je 0x101a905c
cmp eax, 0x206
je 0x101a905c
cmp eax, 0x205
je 0x101a905c
cmp eax, 0x20a
jmp 0x101a9152
mov eax, dword [edi + 0x14]
mov ecx, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x34]
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListBox::IsItemTextOverSize_int_const
cmp eax, 1
jne 0x101a913d
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], eax
test eax, eax
js 0x101a913d
push eax
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_struct_tagRECT_const____thiscall_CHDCListBox::GetItemRect_int_const
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [esi + 0x68]
cmp eax, 0x12c
jbe 0x101a9163
mov ecx, dword [edi]
cmp ecx, 0x201
je 0x101a90c6
cmp ecx, 0x203
jne 0x101a90d1
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bc30
push dword [esp + 0xc]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_unsigned_short_int_const____thiscall_CHDCListBox::GetTooltipText_int_const
mov edi, eax
test edi, edi
je 0x101a90e8
cmp word [edi], 0
jne 0x101a90f5
push dword [esp + 0xc]
mov ecx, esi
call sym.HncOfficeFramework.dll_public:_unsigned_short_int_const____thiscall_CHDCListBox::GetText_int_const
mov edi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x101a9103
xor esi, esi
jmp 0x101a9109
mov eax, dword [eax + 0x5c]
mov esi, dword [eax + 8]
call sym.HncOfficeFramework.dll_class_CHDCToolTipCtrl____cdecl_GetToolTipCtrl_void_
push 1
push 0
push edi
push 0
push dword [esp + 0x20]
lea ecx, [esp + 0x34]
push ecx
push esi
mov ecx, eax
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCToolTipCtrl::HitTest_struct_HWND____const__struct_tagPOINT_const___struct_tagRECT_const___unsigned_short_int_const___unsigned_short_int_const___unsigned_long_int__int_
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
cmp eax, 0x201
je 0x101a9154
cmp eax, 0x203
je 0x101a9154
cmp eax, 0x202
jne 0x101a9163
call sym.HncOfficeFramework.dll_class_CHDCToolTipCtrl____cdecl_GetToolTipCtrl_void_
push 0
mov ecx, dword [eax + 4]
call fcn.10154920
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4