shell32.Asm

.386
.model flat, stdcall
assume fs:nothing

.code
	main proc
		push 	eax
		push 	ebx
		push 	ecx
		push 	edx
		push 	esi
		push 	edi
		push 	ebp	
		
		mov 	ebp, esp
		sub		esp, 48h		; Allocate memory for variables
							; one var = 4 bytes
							; last one reserved
		
		; init vars by zeroes	
		xor 	eax, eax		
		mov 	[ebp - 4h], eax		; [ebp - 0x04] - addres of kernel32.dll
		mov 	[ebp - 8h], eax		; [ebp - 0x08] - num of exported funcs
		mov 	[ebp - 0Ch], eax	; [ebp - 0x0C] - export address table
		mov 	[ebp - 10h], eax	; [ebp - 0x10] - address of name pointer table
		mov 	[ebp - 14h], eax	; [ebp - 0x14] - address of ordinal table
		mov 	[ebp - 18h], eax	; CreateFileA
		mov 	[ebp - 1Ch], eax	; "services.txt"
		mov 	[ebp - 20h], eax	; WriteFile
		mov 	[ebp - 24h], eax	; OpenSCManagerA
		mov 	[ebp - 28h], eax	; EnumServicesStatusA
		mov 	[ebp - 2Ch], eax	; funcion search var
		mov 	[ebp - 30h], eax	; for num of written bytes / hFile
		mov 	[ebp - 34h], eax	; address to string to be written
		mov 	[ebp - 38h], eax	; LoadLibraryA
		mov 	[ebp - 3Ch], eax	; advapi32.dll
		mov 	[ebp - 40h], eax	; hSCM
		mov 	[ebp - 44h], eax	; limit
		mov 	[ebp - 48h], eax	; reserved
		
		
		; --- find kernel32.dll ---
		xor 	esi,esi				; for null-free bytes
		mov 	eax, [fs:30h + esi]	; PEB
		mov 	eax, [eax + 0Ch]	; Ldr
		mov 	eax, [eax + 14h]	; InMemoryOrderModuleList
		mov 	eax, [eax + esi]	; current exe module
		mov 	eax, [eax + esi]	; ntdll
		mov 	eax, [eax + 10h] 	; Kernel32.DllBase
		mov 	[ebp - 4h], eax
		
		jmp Continue
		
		
		; --- find export table in module ---
		GetExportTableInfo:
		    
			mov 	ebx, eax			; save module base address
			mov 	eax, [ebx + 3Ch]	; 0x3C intro the image - RVA of PE signature
			add 	eax, ebx			; PE signature = RVA of PE signature + module base
			
			; get address of Export Table
			mov  	eax, [eax + 78h]	; RVA of Export Table
			add 	eax, ebx			; Export Table = RVA ExpTable + module base
			
			; ebx = module base
			; eax = Export Table
			
			;get number of exported functios in export table
			mov 	ecx, [eax + 14h]	; number
			mov 	[ebp - 8h], ecx
			
			mov 	ecx, [eax + 1Ch]	; Address of exported functions
			add 	ecx, ebx
			mov 	[ebp - 0Ch], ecx
			
			;get addr of name pointer table
			mov 	ecx, [eax + 20h]
			add 	ecx, ebx
			mov 	[ebp - 10h], ecx
			
			;get addr of ordinal table
			mov 	ecx, [eax + 24h]
			add 	ecx, ebx
			mov 	[ebp - 14h], ecx
			
		    ret
		
		; --- find function ---
		
		; ebx = base of module
		; [ebp-10h] = NamePtrTable, [ebp-14h] = OrdinalTable, [ebp-0Ch] = ExportAddrTable
		; [ebp-08h] = NumExported, [ebp-2Ch] = ptr to ASCII name
		; out: eax = func addr 
		FindProcVA:
		    push esi
		    push edi
		
		    ; count len + 1, save in EDX
		    mov     esi, [ebp-2Ch]
		    mov     edi, esi
		    xor     ecx, ecx
		    dec     ecx            ; ECX = 0xFFFFFFFF
		    xor     eax, eax       ; AL = 0
		    repne   scasb          ; looking for '\0'
		    not     ecx            ; ECX = len+1
		    mov     edx, ecx       ; EDX = len+1
		
		    xor     eax, eax      
		@@loop:
		    mov     esi, [ebp-2Ch] 
		    mov     edi, [ebp-10h] 
		    cld
		    mov     edi, [edi + eax*4]
		    add     edi, ebx
		
		    mov     ecx, edx       
		    repe    cmpsb
		    jz      short @@found
		
		    inc     eax
		    cmp     eax, [ebp-08h]
		    jne     short @@loop
		
		    sub     eax, eax       
		    jmp     short @@done
		
		@@found:
		    mov     ecx, [ebp-14h] ; OrdinalTable
		    mov     edx, [ebp-0Ch] ; ExportAddrTable
		    mov     ax,  [ecx + eax*2]
		    mov     eax, [edx + eax*4]
		    add     eax, ebx       ; VA func
		
		@@done:
		    pop     edi
		    pop     esi
		    ret		
		
		final:
			mov 	esp, ebp
			pop 	ebp
			pop 	edi
			pop 	esi
			pop 	edx
			pop 	ecx
			pop 	ebx
			pop 	eax
		
			ret  
			
		Continue:
		
		; --- push on stack ---
		xor 	esi, esi
		
		;push on stack "CreateFileA"
		xor 	eax, eax
		push 	eax
		push 	4141656Ch	;"CreateFileAA" in ASCII little-endian
		push 	69466574h
		push 	61657243h
		mov 	[ebp - 18h], esp	;save pointer to string on stack
		; AL = 0 (for null-free)
		mov 	byte ptr [esp+11], al	; change last 'A' to '\0'
		
		; push on stack name of file
		; "services.txt"
		push 	eax	; "\0"
		push 	7478742Eh		; "txt."		
		push 	73656369h		; "seci"
		push 	76726573h		; "vres"
		mov 	[ebp - 1Ch], esp
		
		; push "WriteFile"
		mov 	si, 4165h	; "Ae" 
		movzx 	esi, si
		push 	esi
		push 	6C694665h		; "liFe" 
		push 	74697257h		; "tirW"
		mov 	[ebp - 20h], esp
		mov 	byte ptr [esp + 9], al ; change last 'A' to '\0'
		
		; push "OpenSCManagerA"
		mov 	si, 4172h	; "Ar" 
		movzx 	esi, si
		push 	esi
		push 	6567616Eh		; "egan"
		push 	614D4353h		; "aMCS" 
		push 	6E65704Fh		; "nepO"
		mov 	[ebp - 24h], esp
		
		; push "EnumServicesStatusA"
		push 	eax
		push 	41417375h		; "AAsu" 
		push 	74617453h		; "tatS"
		push 	73656369h		; "seci"
		push 	76726553h		; "vreS" 
		push 	6D756E45h		; "munE"
		mov 	[ebp - 28h], esp
		mov 	byte ptr [esp + 19], al	; change last 'A' to '\0'
				
		; push "LoadLibraryA"
		xor 	eax, eax
		push 	eax
		push 	41797261h		; "Ayra"
		push 	7262694Ch		; "rbiL"
		push 	64616F4Ch		; "daoL"
		mov 	[ebp - 38h], esp
		
		; push "advapi32.dll"
		xor 	eax, eax
		push 	eax
		push 	6C6C642Eh 		; "lld."
		push 	32336970h		; "23ip"
		push 	61766461h		; "avda"
		mov 	[ebp - 3Ch], esp
		
		; --- find funcs in kernel32.dll ---
		mov 	eax, [ebp - 4h]			; kernel32 address
		call 	GetExportTableInfo
		
		xor 	ecx, ecx
		; CreateFileA
		mov 	eax, [ebp - 18h]
		mov 	[ebp - 2Ch], eax 				   ; ptr to "CreateFileA"
    	call    FindProcVA                     ; EAX = VA CreateFileA
    	mov 	[ebp - 18h], eax
		
		; WriteFile
		mov     eax, [ebp-20h]
		mov     [ebp-2Ch], eax
    	call    FindProcVA
    	mov     [ebp-20h], eax
    	
    	; LoadLibraryA
    	mov     eax, [ebp-38h]
    	mov     [ebp-2Ch], eax
    	call    FindProcVA
    	mov     [ebp-38h], eax
    	  
    	; --- use LoadLibraryA ---
		mov 	eax, [ebp - 38h]
		mov 	edx, [ebp - 3Ch]
		push 	edx
		call 	eax				; load advapi32.dll
    	
    	; --- find funcs in advapi32.dll ---
    	; eax = advapi32 address
    	
    	call GetExportTableInfo
    	    	
    	; OpenSCManagerA
    	mov     eax, [ebp-24h]
    	mov     [ebp-2Ch], eax
    	call    FindProcVA
    	mov     [ebp-24h], eax

    	; EnumServicesStatusA
    	mov     eax, [ebp-28h]
    	mov     [ebp-2Ch], eax
    	call    FindProcVA
    	mov     [ebp-28h], eax
    	
    	; --- use CreateFileA ---
		mov 	eax, [ebp - 18h]
		xor 	edx, edx
		push 	edx		   ; hTemplateFile = NULL	
		mov 	dl, 80h			; dwFlagsAndAttributes = 
		push 	edx			; FILE_ATTRIBUTE_NORMAL (0x80)
		xor 	edx, edx		;dwCreationDisposition =
		mov 	dl, 2h			; CREATE_ALWAYS(0x02)
		push 	edx
		xor 	edx, edx
		push 	edx			;lpSecurityAttributes = NULL
		push	edx			;dwShareMode = NULL
		mov 	edx, 41111111h	;0x40000000 (GENEIC_WRITE)
		sub 	edx, 01111111h
		push 	edx			;dwDesiredAccess
		mov 	edx, [ebp - 1Ch] ;lpFileName =
		push 	edx			 ; "services.txt"	
		call 	eax			; after call eax = hFile
	
		mov     [ebp-30h], eax  ; save hFile from CreateFileA

        ; --- OpenSCManagerA ---
        xor 	eax, eax
        mov     esi, [ebp-24h]	; OpenSCManagerA
        push    4h				; SC_MANAGER_ENUMERATE_SERVICE
        push    eax				; NULL
        push    eax				; NULL
        call    esi				; after call eax = hSCM	
        test    eax, eax		; if failed		
        jz      final			; exit
        mov     [ebp-40h], eax	; else save hSCM

        ; 400h = 1024 bytes buffer on stack for EnumServicesStatusA
        mov 	edx, 11110501h
        sub 	edx, 11110101h		; 1024 bytes
        sub 	esp, edx
        mov 	edi, esp            ; EDI = lpServices (base of buffer)

        xor 	eax, eax
        mov 	[ebp-2Ch], eax      ; ResumeHandle = 0
        mov 	edx, 11110501h
        sub 	edx, 11110101h
        mov     dword ptr [ebp-44h], edx     

		ES_NextPage:
	        mov 	[ebp-34h], eax            ; dwServicesReturned = 0
	        mov 	[ebp-38h], eax            ; dwBytesNeeded     = 0
	
	        ; EnumServicesStatusA(hSCM, SERVICE_WIN32(0x30), SERVICE_STATE_ALL(3),
	        ;                     lpServices, 0x4000, &cbNeeded, &dwReturned, &ResumeHandle)
	        lea		 edx, [ebp-2Ch]
	        push	 edx                        ; lpResumeHandle
	        lea		 edx, [ebp-34h]
	        push	 edx                        ; lpdwServicesReturned
	        lea		 edx, [ebp-38h]
	        push	 edx                        ; lpcbBytesNeeded
	        mov 	 edx, 11110501h
	        sub 	 edx, 11110101h
	        push	 edx                        ; 400h = 1024: bytescbBufSize
	        push	 edi                        ; lpServices
	        push	 3                          ; SERVICE_STATE_ALL
	        push	 30h                        ; SERVICE_WIN32
	        push	 dword ptr [ebp-40h]        ; hSCM
	        call	 dword ptr [ebp-28h]        ; EnumServicesStatusA
	

        mov     eax, [ebp-34h]
        test    eax, eax
        jz      final

        ; cycle through page items
        mov     esi, edi                       ; current item
        mov     ebx, [ebp-20h]                 ; WriteFile
        mov     [ebp-38h], eax                 ; loop_count = dwServicesReturned

		ES_Each:
		    xor     ecx, ecx
		    
		    cmp     dword ptr [ebp-44h], ecx
		    jle     final
		
		    ; if all are processed go to the next page
		    cmp     dword ptr [ebp-38h], ecx
		    je      ES_NextPage
		
		    ; get lpServiceName from current item
		    mov     edx, [esi]                 ; EDX = lpServiceName
		
		    ; len of string in eax
		    xor     eax, eax
		ES_LenLoop:
		    cmp     byte ptr [edx+eax], cl
		    je      ES_LenGot
		    inc     eax
		    jmp     ES_LenLoop
		ES_LenGot:
		    mov     ecx, [ebp-44h]
		    cmp     ecx, 2
		    jbe     final
		    sub     ecx, 2
		    cmp     eax, ecx
		    jbe     ES_LenOk
		    mov     eax, ecx
		ES_LenOk:
		
		    ; --- WriteFile(hFile, name, len, NULL, NULL) ---
		    mov     [ebp-48h], eax             ; save len
		    xor     ecx, ecx                   ; ecx = 0
		    push    ecx                        ; lpOverlapped = NULL
		    push    ecx                        ; lpNumberOfBytesWritten = NULL
		    push    eax                        ; nNumberOfBytesToWrite = len
		    push    edx                        ; lpBuffer = name
		    push    dword ptr [ebp-30h]        ; hFile
		    call    ebx                        ; WriteFile
		    mov		eax, [ebp - 48h]
		    sub     dword ptr [ebp-44h], eax
		
		    cmp     dword ptr [ebp-44h], 2
		    jb      final
		
		    mov     dx, 0A0Dh                  ; "\r\n"
		    push    edx                         ; [esp] = 0x00000A0D
		    mov     edx, esp                    ; edx -> "\r\n"
		
		    xor     ecx, ecx
		    push    ecx
		    push    ecx
		    push    2
		    push    edx
		    push    dword ptr [ebp-30h]
		    call    ebx                        ; WriteFile
		    add     esp, 4                     ; remove temporary "\r\n"
		    sub     dword ptr [ebp-44h], 2
		
		    ; next
		    add     esi, 24h                   ; sizeof(ENUM_SERVICE_STATUSA)
		    dec     dword ptr [ebp-38h]
		    jmp     ES_Each
		

	main endp
	end main