Currently trying to understand the following code and what it is doing.
mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test eax, eax jz short loc_4114FE mov esi, esp call ds:_getch cmp esi, esp call sub_411159 mov [ebp+var_11], al movsx eax, [ebp+var_11] mov [ebp+var_8], eax mov esi, esp push offset Mode ; "a+" push offset Filename ; "KEYS.TXT" call ds:fopen add esp, 8 cmp esi, esp call sub_411159 mov [ebp+File], eax mov esi, esp mov eax, [ebp+File] push eax ; File movsx ecx, [ebp+var_11] push ecx ; Ch call ds:fputc add esp, 8 cmp esi, esp call sub_411159 mov esi, esp mov eax, [ebp+File] push eax ; File call ds:fclose add esp, 4 cmp esi, esp call sub_411159 cmp [ebp+var_8], 1Bh jnz short loc_4114FE xor eax, eax jmp short loc_411503
I do get that this seems to be, in effect, a keylogger from the function calls that are made but I am struggling how the character that is pulled from with the _getch function and makes it all the way into the file. Is this character that is pulled by _getch placed in the stack and then essentially moved around to where it is able to get the file open - with fopen and then puts it back in. I am struggling to understand how this works with the additional instructions that are included within the overall segment of code.
Any help is appreciated. Thanks in advance.