ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#pragma comment(linker, "/MERGE:.data=.text")
#pragma comment(linker, "/MERGE:.rdata=.text")
#pragma comment(linker, "/SECTION:.text,EWR")
#pragma comment(linker,"/ENTRY:New_Main")
#pragma comment(linker, "/INCREMENTAL:NO" ) 
#pragma comment(linker, "/NODEFAULTLIB")
#pragma optimize( "gsy", on )

#include <windows.h>
#undef RtlZeroMemory
void (__stdcall *RtlZeroMemory)(void *dst, int count);

void New_Main()
{
	LPWSTR *argv;
	HANDLE hFile; 
	static char szAlphabet[256],bAlphabet[256],szPassword[256],buf[512]; 
	int i = 0, k = 0;
	OVERLAPPED over;

	argv=CommandLineToArgvW(GetCommandLineW(),&i);
	if(i==3) {
		hFile=CreateFileW(argv[2], 
                   GENERIC_WRITE,        
                   0,                    
                   NULL,                  
                   OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,  NULL); 
		RtlZeroMemory = (void (__stdcall *)(void *dst, int count))GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "RtlZeroMemory");

		RtlZeroMemory(bAlphabet,sizeof(bAlphabet));
		RtlZeroMemory(szPassword,sizeof(szPassword));
		RtlZeroMemory(&over,sizeof(OVERLAPPED));
		over.hEvent=NULL;

		CharToOemW(argv[1],szAlphabet);

		i=0;
		while (TRUE) 
		{ 
			bAlphabet[k] = (unsigned char)szAlphabet[i]; 
			if (!szAlphabet[i]) 
				break; 
			k = (unsigned char)szAlphabet[i]; 
			i++; 
		} 

		while (TRUE) 
		{ 
			__asm 
			{ 
				pushad 
					mov edi,offset szPassword 
					mov ebx,offset bAlphabet 
				L1: movzx eax,byte ptr [edi] 
					xlat 
					cmp al,0 
					je L3 
					mov [edi],al 
					jmp L5 

				L3: xlat 
					stosb 
					jmp L1 

				L5: popad 
			} 
			i=wsprintfA(buf,"%s\n", szPassword); 
			WriteFile(hFile,buf,i,(LPDWORD)&k,&over);
			over.Offset+=i;
		}
		CloseHandle(hFile);
	}

	ExitProcess(0);
}