Understanding the basics of Reverse Engineering a segment of code

Question

Currently trying to understand the following code and what it is doing.

mov     eax, 1
test    eax, eax
jz      loc_411503
mov     esi, esp
call    ds:_kbhit
cmp     esi, esp
call    sub_411159
test    eax, eax
jz      short loc_4114FE
mov     esi, esp
call    ds:_getch
cmp     esi, esp
call    sub_411159
mov     [ebp+var_11], al
movsx   eax, [ebp+var_11]
mov     [ebp+var_8], eax
mov     esi, esp
push    offset Mode     ; "a+"
push    offset Filename ; "KEYS.TXT"
call    ds:fopen
add     esp, 8
cmp     esi, esp
call    sub_411159
mov     [ebp+File], eax
mov     esi, esp
mov     eax, [ebp+File]
push    eax             ; File
movsx   ecx, [ebp+var_11]
push    ecx             ; Ch
call    ds:fputc
add     esp, 8
cmp     esi, esp
call    sub_411159
mov     esi, esp
mov     eax, [ebp+File]
push    eax             ; File
call    ds:fclose
add     esp, 4
cmp     esi, esp
call    sub_411159
cmp     [ebp+var_8], 1Bh
jnz     short loc_4114FE
xor     eax, eax
jmp     short loc_411503

I do get that this seems to be, in effect, a keylogger from the function calls that are made but I am struggling how the character that is pulled from with the _getch function and makes it all the way into the file. Is this character that is pulled by _getch placed in the stack and then essentially moved around to where it is able to get the file open - with fopen and then puts it back in. I am struggling to understand how this works with the additional instructions that are included within the overall segment of code.

Any help is appreciated. Thanks in advance.

Answer 1

The charecter that is returned by getch seems to be saved in a local variable var_11 and reused by fputc.

This is seems to be because i cant be sure what the 411159() does