0

Currently trying to understand the following code and what it is doing.

mov     eax, 1
test    eax, eax
jz      loc_411503
mov     esi, esp
call    ds:_kbhit
cmp     esi, esp
call    sub_411159
test    eax, eax
jz      short loc_4114FE
mov     esi, esp
call    ds:_getch
cmp     esi, esp
call    sub_411159
mov     [ebp+var_11], al
movsx   eax, [ebp+var_11]
mov     [ebp+var_8], eax
mov     esi, esp
push    offset Mode     ; "a+"
push    offset Filename ; "KEYS.TXT"
call    ds:fopen
add     esp, 8
cmp     esi, esp
call    sub_411159
mov     [ebp+File], eax
mov     esi, esp
mov     eax, [ebp+File]
push    eax             ; File
movsx   ecx, [ebp+var_11]
push    ecx             ; Ch
call    ds:fputc
add     esp, 8
cmp     esi, esp
call    sub_411159
mov     esi, esp
mov     eax, [ebp+File]
push    eax             ; File
call    ds:fclose
add     esp, 4
cmp     esi, esp
call    sub_411159
cmp     [ebp+var_8], 1Bh
jnz     short loc_4114FE
xor     eax, eax
jmp     short loc_411503

I do get that this seems to be, in effect, a keylogger from the function calls that are made but I am struggling how the character that is pulled from with the _getch function and makes it all the way into the file. Is this character that is pulled by _getch placed in the stack and then essentially moved around to where it is able to get the file open - with fopen and then puts it back in. I am struggling to understand how this works with the additional instructions that are included within the overall segment of code.

Any help is appreciated. Thanks in advance.

1

The charecter that is returned by getch seems to be saved in a local variable var_11 and reused by fputc.

This is seems to be because i cant be sure what the 411159() does

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.