Help with asm

[Valik]

BrewManNH is correct as far as I can see. You have exactly one person to blame for this: You. Instead of learning your lesson and looking into sandbox or virtual machine software your response is to make an ass of yourself on their forum? Someone explain to me why I shouldn't preemptively block this user now just so I don't have to later when they do something stupid and then decide to blame somebody from our forum for it?

[Blue_Drache]

I can only give you (currently) 434 reasons in favor of your argument, Valik.

Edited December 4, 2011 by Blue_Drache

[Valik]

I can only give you (currently) 434 reasons in favor of your argument, Valik.

The number grew by the time I saw your post but "heh" none-the-less.

[jaberwacky]

Even though I have no idea what in the **** this function 'posed t' do, I just don't even like the name.

expandcollapse popup

BlindSucker    proc uses ebx
    LOCAL     lbrw:DWORD
    LOCAL     lBuff[256]:BYTE
    
    ; ------- seh installation ------- ;
    SehBegin     __bs
    
    call     GetTickCount
    invoke     nseed,eax
    
    ; ------- check for key ------- ;
    invoke     GetModuleHandle,reparg("user32.dll")
    .if     eax
        lea     edx,lBuff
        mov     dword ptr [edx],'AteG' ;"GetAsyncKeyState"
        mov     dword ptr [edx+4],'cnys'
        mov     dword ptr [edx+8],'SyeK'
        mov     dword ptr [edx+12],'etat'
        mov     byte ptr [edx+12+4],0
        invoke     GetProcAddress,eax,edx
        .if     !eax
            SehPop
            return_0
        .endif
    .endif
    scall     eax,VK_B
    .if     eax
        jmp     @blind
    .endif
    
    invoke     MyZeroMemory,ADDR lBuff,256
    mov     lbrw,0
    invoke     GetPrivateProfileString,ADDR  szAnsavName,ADDR szBlindCnt,ADDR lbrw,ADDR lBuff,256,ADDR szAnsavIniPath
    cmp     lBuff[0],0
    je        @writeit
    invoke     atodw,ADDR lBuff
    mov        ebx,eax
    add     ebx,5000
    call     GetTickCount
    .if     eax < ebx
        sub     ebx,5000*2
        cmp     eax,ebx
        jb        @writeit
@blind:
        ; ------- time for blind all sucker ------- ;
        invoke     Random,10
        add     eax,20 ; min
        invoke     MakeRandomString,ADDR szRandomString,eax
        invoke     MakeRandomString,ADDR szAppName,5
        mov     TimeForBlind,1
        jmp     @owrite
    .else
@writeit:
        mov     TimeForBlind,0
@owrite:
        ; set it last
        call     GetTickCount
        lea     ebx,lBuff
        invoke     wsprintf,ebx,ADDR szdTosF,eax
        invoke     WritePrivateProfileString,ADDR szAnsavName,ADDR szBlindCnt,ebx,ADDR szAnsavIniPath
        
    .endif
    
    ; ------- seh trapper ------- ;
    SehTrap     __bs
        ErrorDump     "BlindSucker",offset BlindSucker,offset szAnsavStuffasm
    SehEnd        __bs
    
    ret

BlindSucker endp

[Shaggi]

I think the irony of this story is to download the source of an program, then run the binary.

[BigDod]

Stupid is as stupid does

[Bowmore]

Seeing this would start some alarm bells ringing for me.

; ------- time for blind sucker ------- ;
call BlindSucker

[jchd]

Downloading and launching some random binary from a hackers' site outside of a serious VM or hardened sandbox quite often triggers a reinstall. Even visiting such sites without thick condoms is risky.

Can we say that looking at a small part of alledged accompanying source dated early 2008 is digital tourism?

[MvGulik]

Even visiting such sites without thick condoms is risky.

You think that helps. Seems to me the user got the stick instead of the site.

... open wide ...

[Skitty]

First and foremost, how do you guy's think I took a snapshot of the bios error? do you think I have some kind of software built into it that can enable screencap's? of course I was using a vm, but I still lost a bunch of udf's and other things I had accumulated over a period of 15 hours that I hadn't saved it.

Anyway, a moderator over there was nice enough to submit my complaint for me.

I sort of exaggerated the claim but still, it's a good warning to anyone else who might download it and unwittingly run the damn thing.

Edited December 5, 2011 by THAT1ANONYMOUSEDUDE

[Valik]

First and foremost, how do you guy's think I took a snapshot of the bios error?

There's this thing called a "camera".

[MvGulik]

"Camera" ... hehe

I knew Valik would say that. NO I really DID. TRUST me. REALLY ... (Kinda don't work. Bad timing might be one factor here.)

... BUT's: generally best used for sitting on ...

[Skitty]

Even though I have no idea what in the **** this function 'posed t' do, I just don't even like the name.

expandcollapse popup

BlindSucker proc uses ebx
    LOCAL    lbrw:DWORD
    LOCAL    lBuff[256]:BYTE
    
    ; ------- seh installation ------- ;
    SehBegin     __bs
    
    call     GetTickCount
    invoke   nseed,eax
    
    ; ------- check for key ------- ;
    invoke   GetModuleHandle,reparg("user32.dll")
    .if  eax
        lea  edx,lBuff
        mov  dword ptr [edx],'AteG' ;"GetAsyncKeyState"
        mov  dword ptr [edx+4],'cnys'
        mov  dword ptr [edx+8],'SyeK'
        mov  dword ptr [edx+12],'etat'
        mov  byte ptr [edx+12+4],0
        invoke   GetProcAddress,eax,edx
        .if  !eax
            SehPop
            return_0
        .endif
    .endif
    scall    eax,VK_B
    .if  eax
        jmp  @blind
    .endif
    
    invoke   MyZeroMemory,ADDR lBuff,256
    mov  lbrw,0
    invoke   GetPrivateProfileString,ADDR  szAnsavName,ADDR szBlindCnt,ADDR lbrw,ADDR lBuff,256,ADDR szAnsavIniPath
    cmp  lBuff[0],0
    je      @writeit
    invoke   atodw,ADDR lBuff
    mov     ebx,eax
    add  ebx,5000
    call     GetTickCount
    .if  eax < ebx
        sub  ebx,5000*2
        cmp  eax,ebx
        jb      @writeit
@blind:
        ; ------- time for blind all sucker ------- ;
        invoke   Random,10
        add  eax,20 ; min
        invoke   MakeRandomString,ADDR szRandomString,eax
        invoke   MakeRandomString,ADDR szAppName,5
        mov  TimeForBlind,1
        jmp  @owrite
    .else
@writeit:
        mov  TimeForBlind,0
@owrite:
        ; set it last
        call     GetTickCount
        lea  ebx,lBuff
        invoke   wsprintf,ebx,ADDR szdTosF,eax
        invoke   WritePrivateProfileString,ADDR szAnsavName,ADDR szBlindCnt,ebx,ADDR szAnsavIniPath
        
    .endif
    
    ; ------- seh trapper ------- ;
    SehTrap  __bs
        ErrorDump    "BlindSucker",offset BlindSucker,offset szAnsavStuffasm
    SehEnd      __bs
    
    ret

BlindSucker endp

Wow, I hadn't seen that, If I would have noticed that I would have probably saved everything to my network share before running it after disabling the network, I'm just glad it didn't reach out to my network share and molest everything there too.

[trancexx]

I don't get it. What do you see there except funny name?

[Shaggi]

It might write something dangerous to an .ini file.

[trancexx]

Something like "Johnny, la gente esta muy loca. What the fuck?!?"

[Skitty]

no te creo, mentirosa.

[jaberwacky]

Like I said, I don't know what it is supposed to do. My concern is over the odd choice of name.

[jchd]

That's a moot point: should it be called RemoveTrojan or PrepareGUI would you trust it more?

[trancexx]

AutoIt has funny names for functions and variables sometimes too. For example check this:

bool bDoBatshitLocoCopy = true;

You just have to laugh honestly seeing stuff like that.