Function at 0x101a8600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x101a861c
xor eax, eax
jmp 0x101a861f
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], 1
cmp dword [ecx], 0x100
jne 0x101a8a10
mov ecx, dword [ecx + 4]
or esi, 0xffffffff
lea edx, [ecx - 0x20]
cmp edx, 8
ja case.default.0x101a864c
jmp dword [edx*4 + 0x101a8aa8]
cmp ecx, 0x28
je 0x101a8662
cmp ecx, 0x27
je 0x101a8662
or esi, 0xffffffff
jmp 0x101a8667
mov esi, 1
test ebx, ebx
jne 0x101a866f
xor eax, eax
jmp 0x101a8675
mov eax, dword [ebx + 0x5c]
mov eax, dword [eax + 4]
test eax, 0x10000000
je 0x101a868a
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetFocusIndex_void_const
add esi, eax
jmp 0x101a8826
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8697
mov eax, dword [eax + 8]
mov ecx, edi
test eax, 0x808
je 0x101a86ac
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetFocusIndex_void_const
add esi, eax
jmp 0x101a8826
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetCurSel_void_const
add esi, eax
jmp 0x101a8826
xor esi, esi
jmp 0x101a8826
mov esi, dword [eax + 0x50]
sub esi, dword [eax + 0x4c]
sar esi, 2
dec esi
jmp 0x101a8826
xor eax, eax
cmp ecx, 0x21
mov ecx, edi
setne al
lea eax, [eax*2 - 1]
mov dword [esp + 0x14], eax
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetCount_void_const
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0x9c]
mov dword [esp + 0x20], eax
test ebx, ebx
jne 0x101a8710
xor ecx, ecx
jmp 0x101a8716
mov eax, dword [ebx + 0x5c]
mov ecx, dword [eax + 4]
test ecx, 0x10000000
jne 0x101a8739
test ebx, ebx
jne 0x101a8726
xor eax, eax
jmp 0x101a8729
mov eax, dword [ebx + 8]
test eax, 0x808
jne 0x101a8739
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetCurSel_void_const
jmp 0x101a8740
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetFocusIndex_void_const
mov ebx, eax
mov esi, ebx
test ebx, ebx
js 0x101a878d
mov ecx, ebx
nop word [eax + eax]
mov esi, ecx
cmp ecx, dword [esp + 0x18]
jge 0x101a878d
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 0x4c]
mov eax, dword [eax + 0x50]
sub eax, edx
sar eax, 2
cmp eax, ecx
jbe 0x101a8aa2
mov eax, dword [edx + ecx*4]
mov edx, dword [esp + 0x10]
add edx, dword [eax + 0x38]
mov dword [esp + 0x10], edx
cmp edx, dword [esp + 0x20]
jg 0x101a87a3
mov esi, dword [esp + 0x14]
add esi, ecx
mov ecx, esi
jns 0x101a8750
mov eax, dword [esp + 0x18]
dec eax
cmp esi, eax
cmovge esi, eax
xor eax, eax
test esi, esi
cmovle esi, eax
jmp 0x101a8826
mov esi, ecx
cmp ecx, ebx
je 0x101a878d
sub esi, dword [esp + 0x14]
jmp 0x101a878d
test ebx, ebx
jne 0x101a87b7
xor eax, eax
jmp 0x101a87ba
mov eax, dword [ebx + 8]
test eax, 0x808
je case.default.0x101a864c
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetFocusIndex_void_const
push eax
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetSel_int_const
neg eax
mov ecx, edi
sbb eax, eax
inc eax
push eax
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::GetFocusIndex_void_const
push eax
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::SetSel_int__int_
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x101a87f3
xor eax, eax
jmp 0x101a87f7
movzx eax, word [ecx + 0x24]
movzx eax, ax
push 0
or eax, 0x10000
push eax
push 0x111
push ecx
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [edi + 0x68], eax
test esi, esi
js 0x101a8a05
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x50]
sub eax, dword [ebx + 0x4c]
sar eax, 2
cmp esi, eax
jge 0x101a8a05
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x101a885a
xor eax, eax
jmp 0x101a8860
mov eax, dword [ecx + 0x5c]
mov eax, dword [eax + 4]
test eax, 0x10000000
jne 0x101a8925
test ecx, ecx
jne 0x101a8873
xor eax, eax
jmp 0x101a8876
mov eax, dword [ecx + 8]
test al, 8
jne 0x101a8925
push 0
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDlgItem::SetRedraw_int_
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x101a8898
mov ecx, dword [ecx + 8]
test ecx, 0x800
je 0x101a88ca
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xff00
test cx, ax
mov ecx, edi
push esi
je 0x101a88bc
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListBox::_ExtendSel_int_
jmp 0x101a88d2
mov dword [ebx + 0x40], 0xffffffff
call sym.HncOfficeFramework.dll_private:_void___thiscall_CHDCListBox::_ExtendSel_int_
jmp 0x101a88d2
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::SetCurSel_int_
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_void___thiscall_CHDCListBox::SetAnchorIndex_int_
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::MakeItemVisible_int_
push dword [esp + 0x20]
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDlgItem::SetRedraw_int_
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bbc0
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x101a8906
xor eax, eax
jmp 0x101a890a
movzx eax, word [ecx + 0x24]
movzx eax, ax
push 0
or eax, 0x10000
push eax
push 0x111
push ecx
call sym.HncOfficeFramework.dll_public:_static_long_int___cdecl_CHDlgItem::SendCommand_void___unsigned_int__unsigned_int__long_int_
add esp, 0x10
jmp 0x101a8939
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_protected:_int___thiscall_CHDCListBox::_SetFocusIndexNotify_int_
test eax, eax
je 0x101a8939
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCListBox::MakeItemVisible_int_
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8a05
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x101a8a05
cmp dword [eax + 0x60], 0
je 0x101a8a05
push esi
mov ecx, edi
xor ebx, ebx
call sym.HncOfficeFramework.dll_public:_struct_tagRECT_const____thiscall_CHDCListBox::GetItemRect_int_const
push esi
mov ecx, edi
mov dword [esp + 0x1c], eax
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListBox::IsItemTextOverSize_int_const
cmp eax, 1
jne 0x101a89ea
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bc30
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_private:_int___thiscall_CHDCListBox::IsItemTextOverSize_int_const
cmp eax, 1
jne 0x101a89ea
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.1001bc30
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a89bb
mov eax, dword [eax + 0x5c]
mov ebx, dword [eax + 8]
push esi
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_unsigned_short_int_const____thiscall_CHDCListBox::GetText_int_const
mov esi, eax
call sym.HncOfficeFramework.dll_class_CHDCToolTipCtrl____cdecl_GetToolTipCtrl_void_
push 1
push 0x400a
push esi
push 0
push dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
push ebx
mov ecx, eax
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHDCToolTipCtrl::HitTest_struct_HWND____const__struct_tagPOINT_const___struct_tagRECT_const___unsigned_short_int_const___unsigned_short_int_const___unsigned_long_int__int_
mov ebx, 1
call sym.HncOfficeFramework.dll_class_CHDCToolTipCtrl____cdecl_GetToolTipCtrl_void_
mov ecx, eax
mov eax, dword [ecx + 4]
test ebx, ebx
je 0x101a89fd
call sym.HncOfficeFramework.dll_private:_class__HDCToolTipCtrlImpl____thiscall_CHDCToolTipCtrl::_GetToolTipCtrlImpl_void_
push ebx
mov ecx, eax
call fcn.10154920
cmp dword [esp + 0x1c], 0
jne 0x101a8810
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x101a8a1e
xor esi, esi
jmp 0x101a8a21
mov esi, dword [edx + 8]
mov ebx, dword [ebp + 8]
mov eax, ecx
test esi, 0x800
je 0x101a8a66
cmp dword [ebx], 0x100
jne 0x101a8a66
cmp dword [ebx + 4], 0x10
jne 0x101a8a66
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x40], 0xffffffff
jne 0x101a8a66
test edx, edx
je 0x101a8a56
mov eax, dword [edx + 0x5c]
test eax, eax
je 0x101a8a56
mov eax, dword [eax + 0x38]
jmp 0x101a8a59
or eax, 0xffffffff
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], 1
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x101a8a79
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x101a8a79
mov ecx, dword [ecx + 0x38]
jmp 0x101a8a7c
or ecx, 0xffffffff
test eax, eax
je 0x101a8a86
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 8]
push ecx
push eax
push ebx
lea ecx, [edi + 0x54]
call sym.HncOfficeFramework.dll_public:_int___thiscall_CIncrementalTextSearcher::RelayITSKeyEvent_class_CHDlgCtrlKeyEvent___struct_HWND_____int_
test eax, eax
jne 0x101a8810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10014370
nop
scasd eax, dword es:[edi]
xchg dword [edx], ebx
adc dh, cl
xchg byte [edx], bl
adc dh, cl
xchg byte [edx], bl
adc byte [edi - 0x47efe57a], bh
xchg byte [edx], bl
adc byte [ebx - 0x7a], dl
sbb dl, byte [eax]
push ebx
xchg byte [edx], bl
adc byte [ebx - 0x7a], dl
sbb dl, byte [eax]
push ebx
xchg byte [edx], bl
adc ah, cl
int3