Function at 0x6c37c1d8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x17c
mov ebx, dword [0x6c3c6628]
test ebx, ebx
je 0x6c37cc1e
mov eax, dword [0x6c3c661c]
cmp dword [0x6c3c662c], eax
je 0x6c37cb01
mov dword [0x6c3c662c], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x15c], eax
mov ecx, 0x100
xor eax, eax
mov edi, dword [ebp - 0x15c]
rep stosb byte es:[edi], al
mov dword [0x6c3c6620], 0
mov dword [0x6c3900a0], 1
mov dword [ebp - 0x144], 4
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x150], 0
xor edi, edi
jmp 0x6c37c2ab
cmp edi, 0x6f
je 0x6c37c2db
mov eax, dword [0x6c3c6628]
mov edx, dword [ebp - 0x13c]
mov dword [eax + edx + 0xc], 0xffffff
mov dword [eax + edx + 8], 0xffffff
mov ecx, dword [ebp - 0x144]
mov dword [eax + ecx], 0xffffff
mov dword [eax + edx], 0xffffff
inc edi
add dword [ebp - 0x13c], 0x10
add dword [ebp - 0x144], 0x10
cmp edi, 0x100
je 0x6c37ca4a
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._MapVirtualKeyA_8
sub esp, 8
mov dword [ebp - 0x148], eax
test eax, eax
je 0x6c37c25c
cmp edi, 0xa1
jne 0x6c37c2db
mov eax, dword [ebp - 0x148]
mov dword [0x6c3c6624], eax
mov byte [ebp + edi - 0x12c], pe_nt_image_headers32
mov ecx, dword [ebp - 0x13c]
xor ebx, ebx
lea edx, [edi - 3]
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x14c], edi
mov edi, ecx
mov esi, dword [0x6c3c6628]
add esi, edi
cmp ebx, 2
je 0x6c37c8cc
cmp ebx, 3
je 0x6c37c8b0
cmp ebx, 1
je 0x6c37c8e8
mov byte [ebp - 0x11c], 0
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], 0
mov dword [esi], 0
cmp dword [ebp - 0x140], 0xa2
jbe 0x6c37c504
mov word [ebp - 0x2a], 0
mov word [ebp - 0x2c], 0
mov eax, dword [0x6c3c8fb8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0xa
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], eax
lea edx, [ebp - 0x12c]
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sym._ToUnicodeEx_28
sub esp, 0x1c
cmp eax, 1
je 0x6c37c902
cmp eax, 0xffffffff
je 0x6c37c944
test eax, eax
je 0x6c37c4f4
mov edx, dword [esi]
test edx, edx
jne 0x6c37c3c0
mov edx, 0xffffff
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
nop
mov edi, dword [ebp - 0x14c]
mov byte [ebp + edi - 0x12c], 0
mov ecx, dword [0x6c3c6620]
test ecx, ecx
jne 0x6c37c416
mov eax, dword [0x6c3c6628]
mov ecx, dword [ebp - 0x13c]
mov edx, dword [eax + ecx + 8]
cmp edx, 0xffffff
je 0x6c37c918
cmp edx, dword [eax + ecx]
je 0x6c37c918
mov dword [0x6c3c6620], 1
mov edx, dword [ebp - 0x150]
test edx, edx
jne 0x6c37c290
mov ebx, dword [0x6c3c6628]
mov eax, dword [ebp - 0x13c]
mov esi, dword [ebx + eax]
mov dword [esp], esi
call sym.libgdk_win32_2.0_0.dll_gdk_keyval_to_unicode
mov dword [esp], eax
call sym._g_unichar_isgraph
test eax, eax
je 0x6c37c290
mov edx, dword [ebp - 0x144]
mov ebx, dword [ebx + edx]
cmp esi, ebx
je 0x6c37c290
mov dword [esp], ebx
call sym.libgdk_win32_2.0_0.dll_gdk_keyval_to_unicode
mov dword [esp], eax
call sym._g_unichar_isgraph
test eax, eax
je 0x6c37c290
mov dword [esp], esi
call sym.libgdk_win32_2.0_0.dll_gdk_keyval_to_upper
cmp ebx, eax
je 0x6c37c290
mov byte [ebp - 0x11c], 0
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], 0
mov byte [ebp - 0x118], 1
mov eax, dword [0x6c3c8fb8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x2c]
mov dword [esp + 0xc], ecx
lea eax, [ebp - 0x12c]
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x148]
mov dword [esp + 4], edx
mov dword [esp], edi
call sym._ToAsciiEx_24
sub esp, 0x18
dec eax
je 0x6c37cb4f
mov byte [ebp - 0x118], 0
mov dword [ebp - 0x150], 1
jmp 0x6c37c290
lea eax, [ebp - 0x12c]
call sym._reset_after_dead
jmp 0x6c37c3b5
mov ecx, dword [ebp - 0x140]
jmp dword [ecx*4 + 0x6c3be724]
mov dword [esi], 0xffea
mov edx, dword [esi]
lea esi, [esi]
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
mov dword [esi], 0xffe4
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe2
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff14
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff7f
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd5
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd4
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd3
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd2
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd1
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffd0
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffcf
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffce
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffcd
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffcc
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffcb
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffca
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc9
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc8
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc7
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc6
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc5
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc4
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc3
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc2
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc1
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffc0
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffbf
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffbe
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffaf
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffad
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffac
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffab
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffaa
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb9
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb8
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb7
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb6
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb5
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb4
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb3
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb2
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb1
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffb0
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff67
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe8
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe7
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff6a
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffff
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff63
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff62
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff61
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff60
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff54
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff53
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff52
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff51
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff50
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff57
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff56
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff55
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff1b
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff13
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe9
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe3
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xffe1
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff0d
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff0b
mov edx, dword [esi]
jmp 0x6c37c51c
mov eax, ebx
and eax, 1
cmp eax, 1
sbb eax, eax
and eax, 0xe9
add eax, 0xfe20
mov dword [esi], eax
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff08
mov edx, dword [esi]
jmp 0x6c37c51c
mov dword [esi], 0xff69
mov edx, dword [esi]
jmp 0x6c37c51c
mov byte [ebp - 0x11c], pe_nt_image_headers32
mov byte [ebp - 0x11a], pe_nt_image_headers32
mov byte [ebp - 0x11b], pe_nt_image_headers32
jmp 0x6c37c334
mov byte [ebp - 0x11c], 0
mov byte [ebp - 0x11a], pe_nt_image_headers32
mov byte [ebp - 0x11b], pe_nt_image_headers32
jmp 0x6c37c334
mov byte [ebp - 0x11c], pe_nt_image_headers32
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], 0
jmp 0x6c37c334
movzx eax, word [ebp - 0x2c]
mov dword [esp], eax
call sym.libgdk_win32_2.0_0.dll_gdk_unicode_to_keyval
mov edx, eax
mov dword [esi], eax
jmp 0x6c37c3b7
mov ecx, dword [ebp - 0x13c]
mov edx, dword [eax + ecx + 0xc]
cmp edx, 0xffffff
je 0x6c37c416
mov ecx, dword [ebp - 0x144]
cmp edx, dword [eax + ecx]
jne 0x6c37c40c
jmp 0x6c37c416
movzx eax, word [ebp - 0x2c]
mov dword [esp], eax
call sym.libgdk_win32_2.0_0.dll_gdk_unicode_to_keyval
mov edx, eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x154], edx
call sym._reset_after_dead
mov edx, dword [ebp - 0x154]
cmp edx, 0xb7
je 0x6c37cb36
ja 0x6c37c9c0
cmp edx, 0x60
je 0x6c37cbec
ja 0x6c37cb09
cmp edx, 0x27
je 0x6c37ca31
cmp edx, 0x5e
je 0x6c37cbe2
cmp edx, 0x22
je 0x6c37c9a4
mov dword [esi], edx
jmp 0x6c37c3b7
mov edx, 0xfe57
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
cmp edx, 0x1b7
je 0x6c37cc0a
ja 0x6c37ca07
cmp edx, 0x1a2
je 0x6c37cc00
cmp edx, 0x1b2
je 0x6c37cbf6
cmp edx, 0xb8
jne 0x6c37c99d
mov edx, 0xfe5b
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
cmp edx, 0x1ff
je 0x6c37cb36
jbe 0x6c37cba4
cmp edx, 0x7ae
je 0x6c37c3c0
cmp edx, 0x1000384
jne 0x6c37c99d
mov edx, 0xfe51
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
test byte [0x6c3c60a4], 2
je 0x6c37cb01
test byte [0x6c3900a0], 2
je 0x6c37cbba
mov edx, str.__has_ShiftLock_
mov eax, dword [0x6c3c6620]
test eax, eax
je 0x6c37cbcc
mov eax, str.__uses_AltGr_
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.keymap:_s_s_n
call sym._g_print
mov dword [ebp - 0x13c], 0
xor edi, edi
nop
mov dword [esp + 4], edi
mov dword [esp], str._.02x:
call sym._g_print
mov esi, dword [ebp - 0x13c]
xor ebx, ebx
mov eax, dword [0x6c3c6628]
mov eax, dword [eax + esi]
mov dword [esp], eax
call sym.libgdk_win32_2.0_0.dll_gdk_keyval_name
test eax, eax
je 0x6c37cbd8
mov dword [esp + 4], eax
mov dword [esp], 0x6c3be71d
call sym._g_print
inc ebx
add esi, 4
cmp ebx, 4
jne 0x6c37cab4
mov dword [esp], 0x6c3be721
call sym._g_print
inc edi
add dword [ebp - 0x13c], 0x10
cmp edi, 0x100
jne 0x6c37ca9c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
cmp edx, 0xa8
je 0x6c37c9a4
jbe 0x6c37cb82
cmp edx, 0xb0
je 0x6c37cc14
cmp edx, 0xb4
je 0x6c37ca31
mov dword [esi], edx
jmp 0x6c37c3b7
mov edx, 0xfe56
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
mov al, byte [ebp - 0x2c]
lea edx, [eax - 0x20]
cmp dl, 0x5e
ja 0x6c37c4de
movzx eax, al
mov edx, dword [0x6c3c6628]
mov ecx, dword [ebp - 0x144]
cmp eax, dword [edx + ecx]
jne 0x6c37c4de
or dword [0x6c3900a0], 2
jmp 0x6c37c4de
cmp edx, 0x7e
jne 0x6c37c99d
mov edx, 0xfe53
mov dword [esi], edx
inc ebx
add edi, 4
cmp ebx, 4
jne 0x6c37c2fc
jmp 0x6c37c3d0
cmp edx, 0x1bd
jne 0x6c37c99d
mov edx, 0xfe59
jmp 0x6c37c3c0
mov edx, 0x6c3be6f1
mov eax, dword [0x6c3c6620]
test eax, eax
jne 0x6c37ca76
mov eax, 0x6c3be6f1
jmp 0x6c37ca7b
mov eax, 0x6c3be700
jmp 0x6c37cacc
mov edx, 0xfe52
jmp 0x6c37c3c0
mov edx, 0xfe50
jmp 0x6c37c3c0
mov edx, 0xfe5c
jmp 0x6c37c3c0
mov edx, 0xfe55
jmp 0x6c37c3c0
mov edx, 0xfe5a
jmp 0x6c37c3c0
mov edx, 0xfe58
jmp 0x6c37c3c0
mov eax, dword [0x6c3c661c]
mov dword [0x6c3c662c], eax
mov dword [esp], 0x1000
call sym._g_malloc
mov dword [0x6c3c6628], eax
jmp 0x6c37c208