 -=( ---------------------------------------------------------------------- )=-
 -=( Natural Selection Issue #1 ------------------- Analysis of Common RNGs )=-
 -=( ---------------------------------------------------------------------- )=-

 -=( 0 : Contents --------------------------------------------------------- )=-

 1 : Introduction
 2 : "95-th Harrier from DarkLand" by Techno Rat
 3 : "Bolanzo"
 4 : "Cab_drop" by Prizzy
 5 : "Cargo", "Drol", "Hatred", and "Thunderpick" by Lord Julus
 6 : "Chainsaw" by T-2000
 7 : "Champagne" by LetahlMind, credited to Griyo
 8 : "Crypto" by Prizzy
 9 : "CTX Phage", "HPS", "Marburg", "Parvo", and "DHF" by Griyo
 10: "29A#5.5_17" by Benny
 11: "F0SF0R0" by N.B.K
 12: "Fiasko"
 13: "FLCSS"
 14: "Girigat" by Mister Sandman
 15: "Happy99" by Spanska
 16: "Nazka" and "Tuereg" by The Mental Driller, and others by Billy
 17: "Powerful"
 18: "Prizzy" by Prizzy
 19: "Sign of the Hammer" and "Undertaker" by Lord Julus
 20: Unknown (perhaps Dropper by Bhunji)
 21: "Unreal" by Qozah
 22: "aid(s)" by mort
 23: "Z0mbie" by Z0mbie
 24: "Dream" by Prizzy
 25: "Rammstein" by Lord Julus
 26: "DarkMillenium" by Clau
 27: "Sentinel" by Force
 28: "RME-32" Engine

 -=( 1 : Introduction ----------------------------------------------------- )=-

 During my research for the previous article I went back and had a look at  the
 200+ sources to windows viruses I have to look at how random number generators
 were implemented before.  I think  that you, the readers, might  be interested
 in the results and see how they measure up.

 If you happen to be one of the authors of one of the below, and you happen  to
 not have scored that well, take heart in 2 ways:

 - There are  only 35 different  routines listed here  from about 47  different
 sources.  That puts you in the top 25% right away, right?

 - The tests were anything but scientific.  The routines was only run once, the
 data file produced was quite small (10,000b), and it all happened on my PC, so
 variations in numbers produced from things  like a date change or a  different
 PC speed, were not factored into the statistics.

 Hey, it took me  WAY too long to  generate these as is,  and I'm not about  to
 spend a month of  my life doing something  some of you spent  maybe 15 minutes
 on.  So if you got a bad stat underservingly, I'm sorry but life is tough - so
 deal with it.

 Also, if you're  not in here,  then I probably  don't have the  source to your
 virus.  All the sources used were ones previously published in magazines.

 In any case, the  routines varied from great,  to good, to down-right  shitty.
 So, on to the routines!

 -=( 2 : "95-th Harrier from DarkLand" by Techno Rat ---------------------- )=-

 Entropy = 7.983913 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 221.21, and randomly
 would exceed this value 90.00 percent of the times.

 Arithmetic mean value of data bytes is 127.9086 (127.5 = random).
 Monte Carlo value for Pi is 3.126050420 (error 0.49 percent).
 Serial correlation coefficient is -0.001399 (totally uncorrelated = 0.0).

    Random:     Push    EDx                     ; Generate some random number
                Push    ECx                     ; to EAx by border in EAx
                Push    EAx                     ; (0..Border-1)
                Mov     EAx,RandSeed            ; Don't corrupt registers
                Mov     ECx,8088405h            ; [from TurboPascal v7.0]
                Mul     ECx                     ; (Based on Congruent
                Inc     EAx                     ; generating algorythm)
                Mov     RandSeed,EAx
                Pop     ECx
                Mul     ECx
                Pop     ECx
                Mov     EAx,EDx
                Pop     EDx
                Ret

 -=( 3 : "Bolanzo" -------------------------------------------------------- )=-

 Entropy = 7.979150 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 290.28, and randomly
 would exceed this value 10.00 percent of the times.

 Arithmetic mean value of data bytes is 127.6318 (127.5 = random).
 Monte Carlo value for Pi is 3.183673469 (error 1.34 percent).
 Serial correlation coefficient is -0.001099 (totally uncorrelated = 0.0).

    GetRandNb:   mov          eax,dword ptr [RandNb + X]
                 mul          dword ptr [RMul + X]
                 div          dword ptr [RDiv + X]
                 mov          eax,edx
                 mov          dword ptr [RandNb + X],eax
                 ret
    RMul         dd           07FFFFD9h
    RDiv         dd           0FFFFFFFBh

 -=( 4 : "Cab_drop" by Prizzy --------------------------------------------- )=-

 Entropy = 3.316664 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 58 percent.

 Chi square distribution for 10000 samples is 270606.16, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 42.5273 (127.5 = random).
 Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
 Serial correlation coefficient is -0.176257 (totally uncorrelated = 0.0).

    __rnd_number:
                in      al,40h                  ;very simple random
                mov     ah,al                   ;generator intead this
                in      al,41h                  ;use yours
                push    ax
                rol     eax,16
                pop     ax
                xor     ax,0A72Fh
                ret

 -=( 5 : "Cargo", "Drol", "Hatred", and "Thunderpick" by Lord Julus ------- )=-

 Entropy = 7.983654 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 227.40, and randomly
 would exceed this value 75.00 percent of the times.

 Arithmetic mean value of data bytes is 126.9345 (127.5 = random).
 Monte Carlo value for Pi is 3.183673469 (error 1.34 percent).
 Serial correlation coefficient is 0.002391 (totally uncorrelated = 0.0).

    random32    proc near
                push ecx
                xor ecx, ecx
                mov eax, dword ptr [ebp+seed]
                mov cx, 33
    rloop:      add eax, eax
                jnc $+4
                xor al, 197
                loop rloop
                mov dword ptr [ebp+seed], eax
                pop ecx
                ret
    random32    endp
    seed        dd 0BFF81234h

 -=( 6 : "Chainsaw" by T-2000 --------------------------------------------- )=-

 Entropy = 6.185658 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 22 percent.

 Chi square distribution for 10000 samples is 28605.31, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 129.6452 (127.5 = random).
 Monte Carlo value for Pi is 2.981992797 (error 5.08 percent).
 Serial correlation coefficient is 0.108172 (totally uncorrelated = 0.0).

    Random_EAX:
                PUSH    EAX
                CALL    GetTickCount
                ADD     EAX, Random_Init
                JNP     Xor_In_Init
                RCL     EAX, 2
                XCHG    AL, AH
                ADD     AL, 66h
    Xor_In_Init:
                NOT     EAX
                PUSH    32
                POP     ECX
    CRC_Bit:    SHR     EAX, 1
                JNC     Loop_CRC_Bit
                XOR     EAX, 0EDB88320h
    Loop_CRC_Bit:
                LOOP    CRC_Bit
                POP     ECX
                XOR     EDX, EDX
                DIV     ECX
                XCHG    EDX, EAX
                INC     EAX                     ; Can't be zero.
                ROL     Random_Init, 1          ; Adjust random seed.
                RETN

 -=( 7 : "Champagne" by LetahlMind, credited to Griyo --------------------- )=-

 Entropy = 5.722619 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 28 percent.

 Chi square distribution for 10000 samples is 42180.84, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 123.9728 (127.5 = random).
 Monte Carlo value for Pi is 3.313325330 (error 5.47 percent).
 Serial correlation coefficient is 0.002069 (totally uncorrelated = 0.0).

    get_rnd32   proc
                push  ecx
                push  edx
                mov   eax,dword ptr [ebp+rnd32_seed]
                mov   ecx,eax
                imul  eax,41C64E6Dh
                add   eax,00003039h
                mov   dword ptr [ebp+rnd32_seed],eax
                xor   eax,ecx
                pop   edx
                pop   ecx
                ret
    get_rnd32   endp

 Entropy = 5.828195 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 27 percent.

 Chi square distribution for 10000 samples is 37180.80, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 125.9952 (127.5 = random).
 Monte Carlo value for Pi is 3.001200480 (error 4.47 percent).
 Serial correlation coefficient is 0.041824 (totally uncorrelated = 0.0).

    get_rnd32f  proc
                push     ecx
                push     edx
                mov      eax,dword ptr [ebp+rnd32_seedfast]
                mov      ecx,eax
                imul     eax,41C64E6Dh
                add      eax,02F4D527h
                mov      dword ptr [ebp+rnd32_seedfast],eax
                xor      eax,ecx
                pop      edx
                pop      ecx
                ret
    get_rnd32f  endp

 -=( 8 : "Crypto" by Prizzy ----------------------------------------------- )=-

 Entropy = 6.995293 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 12 percent.

 Chi square distribution for 10000 samples is 15256.19, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 125.2733 (127.5 = random).
 Monte Carlo value for Pi is 3.255702281 (error 3.63 percent).
 Serial correlation coefficient is -0.002544 (totally uncorrelated = 0.0).

    ppe_get_rnd32:
                push    ebx ecx edx             ;my special algorithm to
                mov     eax,[ebp+poly_seed]     ;calculate a random number
                mov     ecx,41C64E6Dh           ;for Win32
                mul     ecx
                xchg    eax,ecx
                call    [ebp+ddGetTickCount]
                mov     ebx,eax
                db      0Fh, 31h                ;RDTCS instruction - read
                xor     eax,ebx
                xchg    ecx,eax                 ;PCs ticks to EDX:EAX
                mul     ecx
                add     eax,00003039h
                mov     [ebp+poly_seed],eax
                pop       edx ecx ebx
                ret

 -=( 9 : "CTX Phage", "HPS", "Marburg", "Parvo", and "DHF" by Griyo ------- )=-

 Entropy = 7.999973 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 0.38, and randomly
 would exceed this value 99.99 percent of the times.

 Arithmetic mean value of data bytes is 127.4760 (127.5 = random).
 Monte Carlo value for Pi is 3.157262905 (error 0.50 percent).
 Serial correlation coefficient is 0.016660 (totally uncorrelated = 0.0).

    get_rnd32:  push ecx
                push edx
                mov eax,dword ptr [ebp+rnd32_seed]
                mov ecx,41C64E6Dh
                mul ecx
                add eax,00003039h
                and eax,7FFFFFFFh
                mov dword ptr [ebp+rnd32_seed],eax
                pop edx
                pop ecx
                ret

 -=( 10: "29A#5.5_17" by Benny -------------------------------------------- )=-

 Entropy = 6.576315 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 17 percent.

 Chi square distribution for 10000 samples is 19513.98, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 123.0033 (127.5 = random).
 Monte Carlo value for Pi is 3.291716687 (error 4.78 percent).
 Serial correlation coefficient is -0.128785 (totally uncorrelated = 0.0).

    Random_EAX: PUSH    ECX                     ; Save registers that get
                PUSH    EDX                     ; changed.
                PUSH    EAX                     ; Save Max_Val.
                CALL    GetTickCount            ; Get random value.
                MOV     ECX, Random_Seed        ; Get random seed.
                ADD     EAX, ECX                ; Adjust random value with
                                                ; random seed.
                ROL     ECX, 1                  ; Adjust random seed.
                ADD     ECX, 666h
                MOV     Random_Seed, ECX
                ; Perform CRC-32 on semi-random number
                ; to obtain a truely random number.
                PUSH    32
                POP     ECX
    CRC_Bit:    SHR     EAX, 1                  ; Bit is set?
                JNC     Loop_CRC_Bit
                XOR     EAX, 0EDB88320h
    Loop_CRC_Bit:
                LOOP    CRC_Bit                 ; Do all 32 bits.
                POP     ECX                     ; ECX = Max_Val.
                XOR     EDX, EDX                ; Divide truely random value
                DIV     ECX                     ; by Max_Val.
                XCHG    EDX, EAX                ; Remainder is the
                                                ; random-in-range number.
                OR      EAX, EAX                ; Test for zero.
                POP     EDX
                POP     ECX
                RETN

 -=( 11: "F0SF0R0" by N.B.K ----------------------------------------------- )=-

 Entropy = 7.999973 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 0.38, and randomly
 would exceed this value 99.99 percent of the times.

 Arithmetic mean value of data bytes is 127.4808 (127.5 = random).
 Monte Carlo value for Pi is 3.188475390 (error 1.49 percent).
 Serial correlation coefficient is 0.016589 (totally uncorrelated = 0.0).

    rnd proc
                pushad
                mov eax,dword ptr [ebp+seed]
                mov ecx, 41C64E6Dh
                mul ecx
                add eax, 00003039h
                and eax, 7FFFFFFFh
                mov dword ptr [ebp+seed],eax
                mov dr0,eax
                popad
                mov eax,dr0
                ret
                seed dd 'FUCK'
    rnd endp

 -=( 12: "Fiasko" by mort ------------------------------------------------- )=-

 Entropy = 5.797739 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 27 percent.

 Chi square distribution for 10000 samples is 41074.15, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 30.9206 (127.5 = random).
 Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
 Serial correlation coefficient is 0.020574 (totally uncorrelated = 0.0).

    @random:    push ecx
                pushf
                in eax,040h
                and eax,03fh
                mov ecx,eax
                inc ecx
                xor ch,bh
    @delay:     loop @delay
                popf
                jc @hops
                and eax,07
    @hops:      pop ecx
                ret

 -=( 13: "FLCSS" ---------------------------------------------------------- )=-

 Entropy = 7.982929 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 236.42, and randomly
 would exceed this value 75.00 percent of the times.

 Arithmetic mean value of data bytes is 127.7182 (127.5 = random).
 Monte Carlo value for Pi is 3.135654262 (error 0.19 percent).
 Serial correlation coefficient is 0.146776 (totally uncorrelated = 0.0).

    GetRand     PROC         NEAR
                push         ecx
                push         edx
                mov          eax,[Rand @]
                xor          edx,edx
                mov          ecx,7FFFFFFF
                mul          ecx
                inc          eax
                mov          ecx,0FFFFFFFBh
                div          ecx
                mov          eax,edx
                mov          [Rand @],eax
                pop          edx
                pop          ecx
                ret
    GetRand     ENDP

 -=( 14: "Girigat" by Mister Sandman -------------------------------------- )=-

 Entropy = 5.722561 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 28 percent.

 Chi square distribution for 10000 samples is 42188.77, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 123.9664 (127.5 = random).
 Monte Carlo value for Pi is 3.313325330 (error 5.47 percent).
 Serial correlation coefficient is 0.002559 (totally uncorrelated = 0.0).

    get_random: push    ecx edx
                mov     eax,dword ptr [ebp+random_seed]
                mov     ecx,eax
                imul    eax,41c64e6dh
                add     eax,3039h
                mov     dword ptr [ebp+random_seed],eax
                xor     eax,ecx
                pop     edx ecx
                ret

 -=( 15: "Happy99" by Spanska --------------------------------------------- )=-

 Entropy = 6.999987 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 12 percent.

 Chi square distribution for 10000 samples is 10000.36, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 128.4872 (127.5 = random).
 Monte Carlo value for Pi is 3.123649460 (error 0.57 percent).
 Serial correlation coefficient is 0.021893 (totally uncorrelated = 0.0).

    random:     mov eax, 214013h
                imul seed
                sub edx, edx
                add eax, 2531011h
                mov seed, eax
                ret

 -=( 16: "Nazka" and "Tuereg" by The Mental Driller, and others by Billy -- )=-

 Entropy = 7.979183 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 286.08, and randomly
 would exceed this value 10.00 percent of the times.

 Arithmetic mean value of data bytes is 126.3669 (127.5 = random).
 Monte Carlo value for Pi is 3.157262905 (error 0.50 percent).
 Serial correlation coefficient is 0.000334 (totally uncorrelated = 0.0).

    random      proc
                push    ecx
                mov     eax,dword ptr [ebp+rnd_seed1]
                dec     dword ptr [ebp+rnd_seed1]
                xor     eax,dword ptr [ebp+rnd_seed2]
                mov     ecx,eax
                rol     dword ptr [ebp+rnd_seed1],cl
                add     dword ptr [ebp+rnd_seed2],eax
                adc     eax,dword ptr [ebp+rnd_seed2]
                add     eax,ecx
                ror     eax,cl
                not     eax
                sub     eax,3
                xor     dword ptr [ebp+rnd_seed2],eax
                xor     eax,dword ptr [ebp+rnd_seed3]
                rol     dword ptr [ebp+rnd_seed3],1
                sub     dword ptr [ebp+rnd_seed3],ecx
                sbb     dword ptr [ebp+rnd_seed3],4
                inc     dword ptr [ebp+rnd_seed2]
                pop     ecx
                ret
    random      endp

 -=( 17: "Powerful" ------------------------------------------------------- )=-

 Entropy = 7.999973 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 0.38, and randomly
 would exceed this value 99.99 percent of the times.

 Arithmetic mean value of data bytes is 127.5048 (127.5 = random).
 Monte Carlo value for Pi is 3.001200480 (error 4.47 percent).
 Serial correlation coefficient is 0.050657 (totally uncorrelated = 0.0).

    random_any_edx:
                mov      edx,0fffffffeh
    random_edx:
                push     eax ebx edx
                call     init_rnd_proc
    cell_for_rnd_number         dd 0100h
    init_rnd_proc:
                pop      ebx
                imul     eax,dword ptr [ebx],4dh
                inc      eax
                mov      dword ptr [ebx],eax
                pop      ebx
                inc      ebx
                xor      edx,edx
                or       ebx,ebx
                jz       quit_from_rnd
                div      ebx   ;EDX:EAX / EBX  -> EAX:EDX
    quit_from_rnd:
                pop      ebx eax
        retn

 -=( 18: "Prizzy" by Prizzy ----------------------------------------------- )=-

 Entropy = 7.983739 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 221.06, and randomly
 would exceed this value 90.00 percent of the times.

 Arithmetic mean value of data bytes is 126.7564 (127.5 = random).
 Monte Carlo value for Pi is 3.176470588 (error 1.11 percent).
 Serial correlation coefficient is -0.005314 (totally uncorrelated = 0.0).

    ppe_get_rnd32:
                push    ebx
                mov     ebx,dword ptr [ebp+rnd_last-virus_start]
                in      al,40h
                xor     bl,al
                in      al,41h
                add     bh,al
                rol     ebx,13
                in      al,41h
                xor     bl,al
                in      al,42h
                sub     bh,al
                rol     ebx,11
                xor     ebx,eax
                xor     ebx,ecx
                xor     ebx,edx
                xor     ebx,esp
                xor     ebx,esi
                xor     ebx,edi
                xor     ebx,ebp
                mov     dword ptr [ebp+rnd_last-virus_start],ebx
                mov     eax,ebx
                pop     ebx
                ret

 -=( 19: "Sign of the Hammer" and "Undertaker" by Lord Julus -------------- )=-

 Entropy = 7.895734 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 1 percent.

 Chi square distribution for 10000 samples is 1450.52, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 127.2381 (127.5 = random).
 Monte Carlo value for Pi is 3.034813926 (error 3.40 percent).
 Serial correlation coefficient is -0.214502 (totally uncorrelated = 0.0).

    random32    proc near
                call random16
                shl eax, 10h
    random16:   push ebx
                xor bx, 0F00Dh
                in al, 40h
                xor bl, al
                in al, 42h
                add bh, al
                in al, 41h
                sub bl, al
                in al, 41h
                xor bh, al
                in al, 42h
                add bl, al
                in al, 40h
                sub bh, al
                xchg bx, ax
                pop ebx
                ret
    random32 endp

 -=( 20: Unknown (perhaps Dropper by Bhunji) ------------------------------ )=-

 Entropy = 7.979564 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 295.60, and randomly
 would exceed this value 5.00 percent of the times.

 Arithmetic mean value of data bytes is 127.6108 (127.5 = random).
 Monte Carlo value for Pi is 3.116446579 (error 0.80 percent).
 Serial correlation coefficient is 0.171004 (totally uncorrelated = 0.0).

    Random proc RndMax:dword
                local   time:SYSTEMTIME

                push    ebx
                push    edx
                mov     eax,RndMax
                inc     eax
                mov     ebx,eax
                lea     eax,time
                invoke  GetLocalTime, eax
                mov     ax,time.wMilliseconds
                shl     eax,16
                mov     ax,time.wSecond
                rol     ax,8
                or      ax,time.wMinute
                rol     ax,16
                or      ax,time.wHour
                add     eax,RandomNumber
                rol     eax,cl
                add     eax,14
                xor     ecx,46
                ror     eax,cl
                add     RandomNumber,eax
                cmp     ebx,0
                jz      NoMod
                xor     edx,edx
                div     ebx
                xchg    eax,edx
    NoMod:
                pop     edx
                pop     ebx
                ret
    Random endp

 -=( 21: "Unreal" by Qozah ------------------------------------------------ )=-

 Entropy = 7.940431 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 841.24, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 128.9338 (127.5 = random).
 Monte Carlo value for Pi is 3.063625450 (error 2.48 percent).
 Serial correlation coefficient is 0.026059 (totally uncorrelated = 0.0).

    GetRandomNumber:
                push    ecx
                mov     ax,word ptr ds:[Miliseconds+ebp]
                xor     ax,1264h
    RndVal      equ $-2
                mov     cx,ax
                add     ax,word ptr ds:[Second+ebp]
                xor     ax,word ptr ds:[Miliseconds+ebp]
                rol     ax,1
                add     cx,ax
                xor     word ptr ds:[RndVal+ebp],ax
                ror     ax,7d
                add     ax,cx
                add     ax,word ptr ds:[Miliseconds+ebp]
                rol     ax,4d
                xor     cx,ax
                sub     ax,word ptr ds:[RndVal+ebp]
                ror     ax,3d
                add     word ptr ds:[RndVal+ebp],ax
                mov     word ptr ds:[Miliseconds+ebp],ax
                add     ax,cx
                rol     ax,11d
                pop     ecx
                ret

 -=( 22: "aid(s)" by mort ------------------------------------------------- )=-

 Entropy = 7.693583 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 3 percent.

 Chi square distribution for 10000 samples is 3972.22, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 136.7535 (127.5 = random).
 Monte Carlo value for Pi is 3.034813926 (error 3.40 percent).
 Serial correlation coefficient is -0.017482 (totally uncorrelated = 0.0).

    @gr:        mov eax,[_seed]
                rol eax,3
                xor eax,[_seed]
                adc [_seed],eax
                mov ebx,eax
                sbb eax,[_seed]
                and eax,0fffffffh
    @grl:       cmp eax,[esp + 4]
                jl @grDone
                sub eax,[esp + 4]
                xor [_seed],eax
                jmp @grl
    @grDone:    ret 4

 -=( 23: "Z0mbie" by Z0mbie ----------------------------------------------- )=-

 Entropy = 7.977857 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 307.48, and randomly
 would exceed this value 2.50 percent of the times.

 Arithmetic mean value of data bytes is 127.9662 (127.5 = random).
 Monte Carlo value for Pi is 3.080432173 (error 1.95 percent).
 Serial correlation coefficient is -0.408597 (totally uncorrelated = 0.0).

    random:     call    random16bit
                shl     eax, 16
    random16bit:push    ebx
                mov     bx, 1234h
    rndword     equ     word ptr $-2
                in      al, 40h
                xor     bl, al
                in      al, 40h
                add     bh, al
                in      al, 41h
                sub     bl, al
                in      al, 41h
                xor     bh, al
                in      al, 42h
                add     bl, al
                in      al, 42h
                sub     bh, al
                mov     rndword[ebp], bx
                xchg    bx, ax
                pop     ebx
                test    al, 1
                ret

 -=( 24: "Dream" by Prizzy ------------------------------------------------ )=-

 Entropy = 7.981948 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 245.73, and randomly
 would exceed this value 50.00 percent of the times.

 Arithmetic mean value of data bytes is 128.0532 (127.5 = random).
 Monte Carlo value for Pi is 3.130852341 (error 0.34 percent).
 Serial correlation coefficient is -0.003105 (totally uncorrelated = 0.0).

    random:     mov     eax,0BFF71234h
                push    ecx 33
                pop     ecx
    @@r:        add     eax,eax
                jnc     $+4
                xor     al,197
                loop    @@r
                mov     [ebp+random+1-poly_engine],eax
                pop     ecx
                ret

 -=( 25: "Rammstein" by Lord Julus ---------------------------------------- )=-

 Entropy = 3.783164 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 52 percent.

 Chi square distribution for 10000 samples is 258066.00, and randomly
 would exceed this value 0.01 percent of the times.

 Arithmetic mean value of data bytes is 49.1364 (127.5 = random).
 Monte Carlo value for Pi is 3.997599040 (error 27.25 percent).
 Serial correlation coefficient is 0.270153 (totally uncorrelated = 0.0).

    random32    proc                            ;this is a random nr
                push edx                        ;generator. It's a
                call [ebp+_GetTickCount]        ;modified version of
                rcl eax, 2                      ;some random gen I found
                add eax, 12345678h              ;someday and it had
    random_seed = dword ptr $-4                 ;some flaws I fixed...
                adc eax, esp                    ;
                xor eax, ecx                    ;
                xor [ebp+random_seed], eax      ;
                add eax, [esp-8]                ;
                rcl eax, 1                      ;
                pop edx                         ;
                ret                             ;
    random32    endp                            ;

 -=( 26: "DarkMillenium" by Clau ------------------------------------------ )=-

 Entropy = 7.984645 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 213.89, and randomly
 would exceed this value 95.00 percent of the times.

 Arithmetic mean value of data bytes is 127.6328 (127.5 = random).
 Monte Carlo value for Pi is 3.243697479 (error 3.25 percent).
 Serial correlation coefficient is 0.211992 (totally uncorrelated = 0.0).

    get_rnd     proc
                push    bx
                xor     bx, ax
                xor     bx, cx
                xor     bx, dx
                xor     bx, sp
                xor     bx, bp
                xor     bx, si
                xor     bx, di
                in      al, 40h
                xor     bl, al
                in      al, 40h
                add     bh, al
                in      al, 41h
                sub     bl, al
                in      al, 41h
                xor     bh, al
                in      al, 42h
                add     bl, al
                in      al, 42h
                sub     bh, al
                xchg    bx, ax
                pop     bx
                ret
    get_rnd     endp

 -=( 27: "Sentinel" by Force ---------------------------------------------- )=-

 Entropy = 7.985640 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 196.84, and randomly
 would exceed this value 99.50 percent of the times.

 Arithmetic mean value of data bytes is 127.8283 (127.5 = random).
 Monte Carlo value for Pi is 3.104441777 (error 1.18 percent).
 Serial correlation coefficient is 0.003077 (totally uncorrelated = 0.0).

    GET_RANDOM_NUMBER proc
                push    eax ebx
                lea eax, [ebp + AGetTickCount]
                call GETAPI
                lea     ebx, [ebp + random_number] ; EBX = pointer to random_number
                mul     dword ptr [ebx]            ; Multiply previous miliseconds with
                sbb     edx,eax                    ; Add low-order word of 32-bit random
                cmc                                ; Complement carry flag
                adc     [ebx],edx                  ; Store 32-bit random number
                pop     ebx eax
                ret
    GET_RANDOM_NUMBER endp

 -=( 28: "RME-32" Engine -------------------------------------------------- )=-

 Entropy = 7.999973 bits per byte.

 Optimum compression would reduce the size
 of this 10000 byte file by 0 percent.

 Chi square distribution for 10000 samples is 0.38, and randomly
 would exceed this value 99.99 percent of the times.

 Arithmetic mean value of data bytes is 127.4712 (127.5 = random).
 Monte Carlo value for Pi is 3.157262905 (error 0.50 percent).
 Serial correlation coefficient is 0.031546 (totally uncorrelated = 0.0).

    @@random:   mov     eax, randseed   ; standard PASCAL's algorithm
                imul    eax, 214013
                add     eax, 2531011
                mov     randseed, eax
                retn

 -=( ---------------------------------------------------------------------- )=-
 -=( Natural Selection Issue #1 --------------- (c) 2002 Feathered Serpents )=-
 -=( ---------------------------------------------------------------------- )=-
