foo.asm

里面包含了N个病毒代码.汇编.c++/c编写

format  PE GUI 4.0 DLL at 76000000h
entry   _dll_entry


;
; data section...
;

section '.data' data    readable

    pszText         db      'Hello, FASM world!',0
    pszCaption      db      'Flat Assembler',0


;
; code section...
;

section '.text' code    readable executable

    _foo:
            push    0
            push    pszCaption
            push    pszText
            push    0
            call    [MessageBox]
            ret

    _dll_entry:
            xor     eax,eax
            inc     eax
            ret     0ch


;
; import section...
;

section '.idata' import data    readable

    ; image import descriptor
    dd      0,0,0,RVA usr_dll,RVA usr_thunk
    dd      0,0,0,RVA krnl_dll,RVA krnl_thunk
    dd      0,0,0,0,0

    ; dll name
    usr_dll     db      'user32.dll',0
    krnl_dll    db      'kernel32.dll',0

    ; image thunk data
    usr_thunk:
        MessageBox      dd      RVA __imp_MessageBox
                        dd      0

    krnl_thunk:
        ExitProcess     dd      RVA __imp_ExitProcess
                        dd      0

    ; image import by name
    __imp_MessageBox    dw      0
                        db      'MessageBoxA',0

    __imp_ExitProcess   dw      0
                        db      'ExitProcess',0


;
; export section...
;

section '.edata' export data    readable

    ; image export directory
    dd      0,0,0,RVA dll_name,0,1,1
    dd      RVA addr_tab
    dd      RVA name_tab
    dd      RVA ordinal_tab

    ; dll name
    dll_name        db      'foo.dll',0

    ; function address table
    addr_tab        dd      RVA _foo

    ; function name table
    name_tab        dd      RVA ex_foo

    ; export name table
    ex_foo          db      '_foo',0

    ; ordinal table
    ordinal_tab     dw      0


;
; relocation section...
;

section '.reloc' fixups data     discardable