format PE GUI 4.0
include ‘win32ax.inc’
entry start
section ‘.data’ data readable writable
wHMain dd ?
wHInstance dd ?
wTitle db ‘Tutorial 3.0’, 0
wClsName db ‘TUT3’, 0
wMsg MSG
wCls WNDCLASS
section ‘.code’ code readable executable
start:
;; register the window class
invoke GetModuleHandleA, NULL
mov [wHInstance], eax
mov [wCls.hInstance], eax
mov [wCls.style], CS_HREDRAW or CS_VREDRAW
mov [wCls.lpfnWndProc], window_procedure
mov [wCls.lpszClassName], wClsName
mov [wCls.hbrBackground], COLOR_WINDOW+1
invoke LoadIcon, NULL, IDI_APPLICATION
mov [wCls.hIcon], eax
invoke LoadCursor, NULL, IDC_ARROW
mov [wCls.hCursor], eax
invoke RegisterClass, wCls
;; create the main window
invoke CreateWindowEx,\
0,\
wClsName,\
wTitle,\
WS_OVERLAPPEDWINDOW,\
CW_USEDEFAULT,\
CW_USEDEFAULT,\
CW_USEDEFAULT,\
NULL,\
NULL,\
[wHInstance],\
NULL
mov [wHMain], eax
invoke ShowWindow, [wHMain], SW_SHOW
;; entering the message loop
window_message_loop_start:
invoke GetMessage, wMsg, NULL, 0, 0
or eax, eax
je window_message_loop_end
invoke TranslateMessage, wMsg
invoke DispatchMessage, wMsg
jmp window_message_loop_start
window_message_loop_end:
invoke ExitProcess, 0
;; window_procedure
proc window_procedure, hWnd, uMsg, wParam, lParam
push ebx esi edi
cmp [uMsg], WM_DESTROY
je wmDESTROY
wmDEFAULT:
invoke DefWindowProc, [hWnd], [uMsg], [wParam], [lParam]
jmp wmBYE
wmDESTROY:
invoke PostQuitMessage, 0
wmBYE:
pop edi esi ebx
ret
endp
section ‘.idata’ import data readable writable
library kernel32, ‘kernel32.dll’,\
user32, ‘user32.dll’
import kernel32,\
GetModuleHandleA, ‘GetModuleHandleA’,\
ExitProcess, ‘ExitProcess’
import user32,\
RegisterClass, ‘RegisterClassA’,\
CreateWindowEx, ‘CreateWindowExA’,\
DefWindowProc, ‘DefWindowProcA’,\
ShowWindow, ‘ShowWindow’,\
LoadCursor, ‘LoadCursorA’,\
LoadIcon, ‘LoadIconA’,\
GetMessage, ‘GetMessageA’,\
TranslateMessage, ‘TranslateMessage’,\
DispatchMessage, ‘DispatchMessageA’,\
PostQuitMessage, ‘PostQuitMessage’
Reverse Engineering, Malware Deep Insight 