Function at 0x101addf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x101ade09
xor esi, esi
jmp 0x101ade0c
mov esi, dword [ebx + 0x5c]
call sym.HncOfficeFramework.dll_private:_class_CListCtrlViewBase____thiscall_CHDCListCtrl::GetView_void_const
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101ae342
test esi, esi
je 0x101ae342
cmp dword [esi + 0x2c], 0
jl 0x101ade76
mov eax, dword [edi]
mov eax, dword [eax + 0x78]
cmp eax, sym.HncOfficeFramework.dll_public_virtual:_class_CHDCEdit____thiscall_CHDCListCtrl::GetEditControl_void_const
jne 0x101ae34d
test ebx, ebx
jne 0x101ade49
lea eax, [ebx + 0x64]
neg ebx
sbb ebx, ebx
and ebx, eax
jmp 0x101ade55
mov ebx, dword [ebx + 0x5c]
lea eax, [ebx + 0x64]
neg ebx
sbb ebx, ebx
and ebx, eax
test ebx, ebx
je 0x101ade76
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_IsInplaceEditing_void_const
test eax, eax
je 0x101ade76
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 8]
call dword [eax + 0x34]
test eax, eax
jne case.0x101ae29b.32
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0x100
jne case.0x101ae29b.4
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x101ade97
mov dword [ebp - 4], eax
jmp 0x101ade9d
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
push 1
push 0xffffffffffffffff
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::GetNextItem_int__int_const
mov ebx, eax
test ebx, ebx
js 0x101ae286
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jge case.0x101adf36.4
mov eax, dword [ecx + ebx*4]
mov dword [ebp - 8], eax
test eax, eax
je case.0x101adf36.4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 0xfffffff1
mov dword [ebp - 0x28], 0
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x101adef5
xor edx, edx
jmp 0x101adef9
movzx edx, word [ecx + 0x24]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], edx
movzx eax, word [eax + 0xa]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push edx
push 0x4e
push ecx
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
test eax, eax
jne case.0x101ae29b.32
mov eax, dword [ebp - 0xc]
add eax, 0xfffffffd
cmp eax, 0x5e
ja case.0x101adf36.4
movzx eax, byte [eax + 0x101ae370]
jmp dword [eax*4 + 0x101ae358]
cmp dword [esi + 0x2c], 0
jl case.0x101adf36.4
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_CancelEditLabel_void_
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x2c], 0
jl case.0x101adf36.4
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_OkEditLabel_void_
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::GetItemCount_void_const
cmp dword [esi + 0x2c], 0
mov dword [ebp - 4], eax
jl 0x101adf95
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_CancelEditLabel_void_
mov eax, dword [ebp - 4]
test eax, eax
je 0x101ae068
push dword [ebp - 0xc]
mov ecx, edi
push ebx
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_GetNextItemByKey_int__unsigned_int_
mov ebx, eax
mov eax, dword [ebp - 4]
test ebx, ebx
js 0x101ae068
cmp ebx, eax
jge 0x101ae068
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
test edx, edx
je 0x101adfe3
mov edx, dword [edx + 0x5c]
test edx, edx
je 0x101adfe3
mov eax, dword [edx + 0x38]
cmp eax, dword [edx + 0x3c]
je 0x101adfe3
mov ecx, dword [eax]
add eax, 4
and dword [ecx], 0xfffffffe
cmp eax, dword [edx + 0x3c]
jne 0x101adfd6
push 1
push 1
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::SetItemState_int__unsigned_int__unsigned_int_
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jns 0x101ae040
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
test edx, edx
je 0x101ae024
mov edx, dword [edx + 0x5c]
test edx, edx
je 0x101ae024
mov eax, dword [edx + 0x38]
cmp eax, dword [edx + 0x3c]
je 0x101ae024
mov ecx, dword [eax]
add eax, 4
and dword [ecx], 0xffffffed
cmp eax, dword [edx + 0x3c]
jne 0x101ae017
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_GetAnchorIndex_void_const
push eax
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SetSelRange_int__int_
push 0
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SelectByKeyboard_int__int_
jmp 0x101ae065
push 0x11
call esi
mov ecx, edi
test ax, ax
js 0x101ae05d
push ebx
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_SetAnchorIndex_int_
push 1
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SelectByKeyboard_int__int_
jmp 0x101ae065
push 0
push ebx
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::EnsureVisible_int__int_
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], 0x28
jne 0x101ae08a
cmp ebx, 0xffffffff
jne 0x101ae08a
cmp eax, 1
jne 0x101ae08a
mov esi, dword [ebp - 8]
test byte [esi], 2
jne 0x101ae08a
push eax
push 0
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SelectByKeyboard_int__int_
mov ecx, dword [ebp - 0x14]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test byte [ebp - 4], 4
jne 0x101ae135
cmp dword [esi + 0x2c], 0
jl 0x101ae0ba
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_CancelEditLabel_void_
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
xor ecx, ecx
test ax, ax
push 0x10
sets cl
mov dword [ebp - 0x14], ecx
call esi
xor ecx, ecx
test ax, ax
sets cl
mov dword [ebp + 8], ecx
test ax, ax
js 0x101ae0ee
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_SetAnchorIndex_int_
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x101ae0fd
test ecx, ecx
je 0x101ae0fd
push 1
jmp 0x101ae12d
mov esi, dword [ebp - 8]
test byte [esi], 2
je 0x101ae117
test eax, eax
je 0x101ae117
push 2
push 0
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::SetItemState_int__unsigned_int__unsigned_int_
jmp 0x101ae135
test ecx, ecx
je 0x101ae12b
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_GetAnchorIndex_void_const
push eax
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SetSelRange_int__int_
push 0
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SelectByKeyboard_int__int_
mov eax, dword [edi + 4]
mov dword [ebp - 0x4c], 0xffffff9b
mov dword [ebp - 0x54], 0
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x101ae154
xor esi, esi
jmp 0x101ae158
movzx esi, word [eax + 0x24]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0
mov eax, dword [ecx + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
mov ecx, edi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
call sym.HncOfficeFramework.dll_public:_unsigned_long_int___thiscall_CHDCListCtrl::GetExtendedStyle_void_const
test al, 4
je 0x101ae1b8
push ebx
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::GetCheck_int_const
neg eax
mov ecx, edi
sbb eax, eax
inc eax
push eax
push ebx
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::SetCheck_int__int_
mov esi, dword [ebp - 8]
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0x3c]
mov ebx, dword [esi]
mov esi, dword [ebp - 0x50]
jmp 0x101ae1c1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp ebx, edx
mov edi, 8
mov dword [ebp - 0x40], ebx
cmovne eax, edi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push eax
push esi
push 0x4e
push dword [ecx + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
lea eax, [edi - 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je case.0x101adf36.4
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::GetItemCount_void_const
dec eax
mov ecx, edi
push eax
push 0
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SetSelRange_int__int_
mov edx, dword [edi + 4]
mov dword [ebp - 0x4c], 0xffffff9b
mov dword [ebp - 0x54], 0
mov eax, dword [edx + 4]
test eax, eax
jne 0x101ae236
xor ecx, ecx
jmp 0x101ae23a
movzx ecx, word [eax + 0x24]
mov esi, dword [ebp - 8]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
push eax
push ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x4e
push dword [edx + 4]
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x101ae29b.4
movzx eax, byte [eax + 0x101ae3e0]
jmp dword [eax*4 + 0x101ae3d0]
cmp dword [esi + 0x2c], 0
jl 0x101ae342
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_CancelEditLabel_void_
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
sub eax, ecx
test eax, 0xfffffffc
jle case.0x101ae29b.32
mov eax, dword [ecx]
test eax, eax
je case.0x101ae29b.32
test byte [eax], 2
jne case.0x101ae29b.32
push 1
push 0
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListCtrl::_SelectByKeyboard_int__int_
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListCtrl::_IsInplaceEditing_void_const
test eax, eax
jne 0x101ae342
push 2
push 0xffffffffffffffff
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListCtrl::GetNextItem_int__int_const
mov ecx, dword [edi + 4]
mov edx, eax
mov eax, dword [ecx + 4]
test eax, eax
jne 0x101ae329
xor ecx, ecx
jmp 0x101ae32f
mov eax, dword [eax + 0x5c]
mov ecx, dword [eax + 8]
push edx
push ecx
push ebx
lea ecx, [edi + 0x54]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CIncrementalTextSearcher::RelayITSKeyEvent_class_CHDlgCtrlKeyEvent___struct_HWND_____int_
test eax, eax
jne case.0x101ae29b.32
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call eax
mov ebx, eax
jmp 0x101ade55