;As TCPPATCH is no longer part of Safe it is PublicDomain now.
;If You want it then use C:Resident commant to add my NewShell
;replacement to the list instead the ROM one.
;It is no longer required because all the versions
;of Fungus/Vaginitis systems seems to be known now.
;Sorry if my code looks like virus or black magic. It isn't.



; tcp_trojan_founder 7 (14.4.2001)

; coded by Zbigniew `Zeeball` Trzcionkowski

; NewShell replacement




Be:
	lea.l	Buffer(pc),a4

	lea.l	NS(pc),a1
	move.l	(a1)+,(a4)+
	move.l	(a1)+,(a4)+
	
	movem.l	d0-a0/a6,-(sp)
	move.l	a0,a2
	move.l	d0,d2
	beq.b	.overjump

.loop:
	move.l	(a2),d4
	or.l	#%00100000001000000010000000100000,d4
	cmp.l	#"tcp:",d4
	beq.b	.found
	addq.l	#1,a2
	dbra	d2,.loop

.overjump:
	movem.l	(sp)+,d0-a0/a6
	bra.b	RUN

.found:
	move.l	4.w,a6
	lea	$17a(a6),a0	;LibList
	lea.l	IntuiName(pc),a1;Name
	move.l	#"ion.",6(a1)
	jsr	-276(a6)	;FindName
	move.l	d0,a6

	pea.l	Ok(pc)
	pea.l	Text(pc)
	clr.l	-(a7)
	clr.l	-(a7)
	clr.l	-(a7)

	move.l	a7,a1
	sub.l	a0,a0
	move.l	a0,a2
	move.l	a0,a3
	jsr	-$24c(a6)	;EasyRequestArgs

	lea.l	20(a7),a7

	movem.l	(sp)+,d0-a0/a6

RUN:	lea.l	-1(a4),a2
	tst.l	d0
	beq.b	.x
.copy:
	move.b	(a0)+,(a2)+
	dbra	d0,.copy
.x
	clr.b	(a2)+

	move.l	4.w,a6
	lea	$17a(a6),a0	;LibList
	lea.l	DosName(pc),a1	;DosName
	move.l	#"dos.",(a1)
	jsr	-276(a6)	;FindName
	move.l	d0,a6
	
	lea.l	-8(a4),a1
	move.l	a1,d1
	moveq	#0,d2
	move.l	d2,d3
	jsr	-222(a6)	;Execute
	moveq	#0,d0
	rts
	
IntuiName:	dc.b	"intuit"
DosName:
	dc.b	"ion.library",0

Text:	dc.b	10," NewShell in TCP!",10
	dc.b	10," This could be a TCP Trojan!",10,0
	
NS:	dc.b	"NewCLI ",0 ; heheheheheheheheh!!!!!!!!!!!!!!!!

	dc.b	"$VER: TCP_TrojanFounder 7 (15.04.01) by Zbigniew `Zeeball` Trzcionkowski",0
OK:	dc.b	"OK",0
	cnop	0,4
Buffer:
	ds.b	256