The app uses CallWindowProcA to send WM_CHAR messages with bogus lParam values. Intercept these and replace the LOWORD(lParam) ...