home *** CD-ROM | disk | FTP | other *** search
/ telefisk.org / virusCollection.lzx / VirusResearch / DataType-trojan / decode.e < prev   
Text File  |  2012-02-06  |  1KB  |  88 lines
  1. MODULE    'tools/file'
  2.  
  3. PROC main()
  4.  
  5.     DEF    datasize=NIL,
  6.         dataddr=NIL
  7.  
  8.     ->WriteF('\d\n',{enddata}-{data})
  9.     ->CleanUp()
  10.  
  11.     datasize:={enddata}-{data}
  12.     dataddr:={data}
  13.  
  14.     MOVE.L    datasize,D7
  15.     LSR.L    #2,D7
  16.     SUB.L    #1,D7
  17.  
  18.     MOVEQ    #0,D6
  19.     MOVEA.L    #$4,A0
  20.     MOVEA.L    dataddr,A2
  21.     MOVE.L    dataddr,
  22.  
  23. lab_0004:
  24.     MOVEQ    #2,D0
  25.     CMP    D0,D6
  26.     BCC.B    lab_0005
  27.     SWAP    D6
  28.     CLR    D6
  29.     SWAP    D6
  30.     MOVE.L    D6,D0
  31.     ASL.L    #2,D0
  32.     SUB.L    D6,D0
  33.     ASL.L    #3,D0
  34.     SUB.L    D6,D0
  35.     ADD.L    D0,D0
  36.     MOVEA.L    A2,A0
  37.     ADDA.L    D0,A0
  38.     LEA    92(A0),A1
  39.     MOVEA.L    A1,A0
  40.     ->MOVEA.L    #$4,A6
  41.     ->JSR    -558(A6)
  42.     ADDQ    #1,D6
  43.     DBRA.B    D7,lab_0004
  44.  
  45. lab_0005:
  46.     writefile('RAM:DataType.decode',{data},datasize)
  47. ENDPROC
  48.  
  49.  
  50. data:    LONG    $FFFF0814,
  51.         $09C80A24,
  52.         $0B364EFE,
  53.         $0C3C14CA,
  54.         $1518191A,
  55.         $1960198A,
  56.         $19F21A60,
  57.         $1BF81D82,
  58.         $1DD81E38,
  59.         $1E882076,
  60.         $21A021E0,
  61.         $22502276,
  62.         $22C622D4,
  63.         $22E222F0,
  64.         $22FE230C,
  65.         $231A2328,
  66.         $23362344,
  67.         $23522360,
  68.         $236E237C,
  69.         $238A2398,
  70.         $148E23A6,
  71.         $24622724,
  72.         $27542A54,
  73.         $2B342A38,
  74.         $2C8A2816,
  75.         $27A22992,
  76.         $2D4E2D5C,
  77.         $FFFFA008,
  78.         $0900800A,
  79.         $00007A34,
  80.         $A00E0600,
  81.         $9014002D,
  82.         $90160004,
  83.         $80180000,
  84.         $7A4C0000,
  85.         $4E71
  86.  
  87. enddata:    LONG    $FFFFFFFF
  88.