Copy Link
Add to Bookmark
Report
On Possessed! and Vindicate 1.01 (AV)
Possessed
Possessed is the first file infecting virus written in the Philippines to successfully spread throughtout the country. What complicated things is that several variants were released one after the other, if not at the same time. The author, Jonjon Gumba, claims that the release of the virii were accidental considering that his name is included in the virus code. However, most believed otherwise.
Gumba reported 11 Possessed variants, one of which he could not document. This might be because he had written many variants but did not keep track on what exactly did he passed to his friends and classmates, if not released in the wild.
Of the 11 variants mentioned by Gumba, seven were documented to be in the wild. Furthermore, a local antivirus, Vir-X Plus, reported a minor variant of Possessed 1.02 that is not detected by Vindicate 1.0 (a Possessed specific antivirus written by Gumba). I could not comment further on this as I do not have a copy of Vindicate 1.0, Possessed 1.02 nor that particular Possessed 1.02 minor variant.
Among the variants acknowledged by Gumba, two are non-memory resident COM infectors and the rest are memory resident COM and EXE infectors. A summary of the Possessed variants based on Vindicate 1.01 are as follows:
Virus Name Current Proposed INFECTION Length
Vindicate 1.01 CARO Name CARO Name Memory COM EXE
Possessed 1.00 - Possessed.1234 - Yes - 1234
Possessed 1.01 - Possessed.1242 - Yes - 1242
Possessed 1.02 Possessed.2167 Possessed.2167.A Yes Yes Yes 2167*
Possessed 1.02A - Possessed.2167.B Yes Yes Yes 2167*
Possessed 1.03 Possessed.2367 Possessed.2367 Yes Yes Yes 2367
Possessed 1.04 - -------------- NO INFO ----------------
Possessed 1.05 Possessed.2443 Possessed.2443 Yes Yes Yes 2443
Possessed 1.06 Possessed.2438 Possessed.2438 Yes Yes Yes 2438
Possessed 1.07 Possessed.2446.B Possessed.2446.B Yes Yes Yes 2446
Possessed 1.08 Possessed.2446.A Possessed.2446.A Yes Yes Yes 2446
Possessed 1.09 - Possessed.2446.C Yes Yes Yes 2446
* An additional 26 bytes is padded to COM host.The Possessed 1.02 minor variant would be given the CARO name of Possessed.2167.C if it is found out to be really a minor variant.
There is no known patched variants of Possessed. This is because Possessed protects the text string. An encrypted copy of the text is found in the virus code and used to replace the unencrypted text everytime it goes memory resident. Also, Possessed deletes infected COMs it finds that contains a patched text. Surely, there are patched copies out there but might not have prospered.
Possessed, the virus
Possessed goes reisdent as a low memory TSR. It infects COM and EXE programs on EXEC (21/4B00). It is appended at end of programs with the exception of Possessed 1.02A which is located at the start of COMs. It would delete executed programs if the disk does not enough space for it to infect programs. It also delete infected COMs with patched text.
Possessed would display the devil's face on a delayed timer trigger. This would only be displayed properly if you are using a Phoenix or AMI BIOS but not on Award BIOS. I have no info for other BIOSes.
HEX-FILES No.2 is presenting six of the seven known Possessed variants found in the wild. These are as follows: Possessed 1.02A (Possessed.2167.B), Possessed 1.03 (Possessed.2367), Possessed 1.05 (Possessed.2443), Possessed 1.06 (Possessed.2438), Possessed 1.07 (Possessed.2446.B) and Possessed 1.08 (Possessed.2446.A).
But first, here's something about the virus author's program....
Vindicate 1.01: Possessed antivirus
Vindicate 1.01 is the second release of the anti-virus created by the Possessed virus author. I could not find a copy of Vindicate 1.00. Some suspected that it could be a dropper for a new variant of Possessed as it was released encrypted. Those in the local AV community encouraged people to delete the program. To allay these fears, the virus author released the source code with Vindicate 1.01.
There are errors in vindi1.asm which could wipe out your command.com if it removes a virus in that program. Also, length of Possessed 1.03 is coded as 2322 bytes instead of 2367 bytes. Is this a program bug or is it a new variant?
Note that the program automatically disinfects a program without concurrence from the user.
I included it here so that you could have an idea on Possessed virus and its variants.
Comments in the source code are by the program author except when noted.
VINDI1.DOC
-------------------------------------------------------------------
≤≤≤≤ ≤≤≤≤≤ ≤≤ ≤≤ ≤≤ ≤≤ ≤≤≤≤≤≤ ≤≤≤≤≤
≤≤ ≤≤ ≤≤ ≤≤ ≤≤≤ ≤≤≤ ≤≤ ≤≤≤ ≤≤ ≤≤
≤≤ ≤≤ ≤≤≤ ≤≤ ≤≤ ≤≤≤≤ ≤≤≤≤ ≤≤≤≤≤≤ ≤≤≤≤≤≤≤
≤≤ ≤≤ ≤≤ ≤≤ ≤≤ ≤≤ ≤≤ ≤≤≤ ≤≤ ≤≤ ≤≤ ≤≤ ≤≤
≤≤≤≤ ≤≤ ≤≤≤≤≤ ≤≤≤≤≤ ≤≤ ≤ ≤≤ ≤≤≤≤≤≤ ≤≤ ≤≤
-------------------------------------------------------------------
Software Foundation (kuno!), 1991
-------------------------------------------------------------------
" It's time to emerge! "
Introducing...
VINDICATE Version 1.01
July Release
includes CRUCIFIX Version 1.00History
Because of the great impact of my virus in this city, I guess I should stick around in my coderoom for a while and build its antidote. I mean, really do something about it! I'm not as bad as you think. Since I don't have any authority in releasing these program, lucky those who had a copy. It's free. You can even copy some of the routines in this program (including CRUCIFIX) and build your own approach. With my consent please.
(I just don't like people accussing me of spreading my own virus. I not stupid! Spreading virus along with my name!? Thank GOD it's the curable versions that spreaded out. Not to mention the ultimate one I've just completed.)
Ok, POSSESSED! virus has eleven (11) versions. The description of 9 of the versions are explained in my VINDICATE Version 1.00 docu- mented under README.TXT. VINDICATE Version 1.00 can detect/eliminate 9 of these said versions of POSSESSED!
Due to my carelesness, two of my versions are missing in action. They are POSSESSED Version 1.02A and Version 1.04. I have hunted version 1.02A leaving only 1.04 as missing.
VINDICATE Version 1.01 can cure all the first 9 recorded versions plus Version 1.02A. I got only one left now, Version 1.04 to complete my antidote and get out from this mess.
Using VINDICATE 1.01
Like VINDICATE Version 1.00, this second version is not user friendly. That is, you have to CD\ on every subdirectories (if any) that you want to check before using this program.
For safety information, VINDICATE 1.00 & 1.01, although it automatically cure without verification, does not attempt to remove POSSESSED! if it is missing in action (not registered in its internal reference data) from an infected file. That is, you will need to either check (if it is immuned, for .EXE) or replace the suspectedly infected file.
CRUCIFIX 1.00
- This program is designed to block the POSSESSED! virus to reside in your system's memory.
- This program MUST BE LOADED FIRST upon computer bootup to ensure maximum protection from the DEVIL. It should be included in AUTOEXEC.BAT for automatic loading.
- Once this program is loaded, the POSSESSED! infected files to be executed will seize to control. That is, with CRUCIFIX in memory, you are safe from devil's possession.
Signing off,
JonJon Gumba
CpE-5 AdU
-- VINDI1.ASM STARTS HERE --------------------------------------------
;--------------------------------------------------
; Author: JonJon Gumba
; Date: July 18, 1991
; Program: vindi1.ASM
; Description: Dispossessor for SATAN's V1.00 - V1.09
; * Includes 1.02A detection/removal
; Size: Compiled to .COM --> 4760 bytes
; Security: Anti-alter only.
;--------------------------------------------------
code_seg segment byte public 'code'
assume cs:code_seg,ds:code_seg
org 100h
start: jmp _anti_alter
db 13,"The world is gettin' sinful everyday.",10,13
db 'Fear not the devil you see,',10,13
db "but fear most the devil you can't see.",10,13
db 'For your intangible awareness,',10,13
db 'the devil is... WITHIN YOU!',10,13
db 'Dispossess yourself! This cheap program',10,13
db 'is not designed to do that. But the great SOMEONE can.'
db 10,13,1ah
;--------------------------------------------------------------------------
_int3 dw ? ; comment out this
_int3_2 dw ? ; portion to
_int3handler proc near ; suppress program
mov si,offset bridge ; encryption
mov cx,offset __end - offset bridge ;
invert: not word ptr [si] ; --- PsK
add si,2 ;
loop invert ;
iret ;
_int3handler endp ;
;--------------------------------------------------------------------------
_anti_alter:
;--------------------------------------------------------------------------
push cs ; comment out this
pop ds ; portion to suppress
mov ax,3503h ; program encryption
int 21h ;
mov [_int3],bx ; ----- PsK
mov [_int3_2],es ;
mov dx,offset _int3handler ; all comments from
mov ax,2503h ; here on are by the
int 21h ; program author
int 3 ;
bridge: mov ax,cs ;
mov es,ax ; ----- PsK
mov ds,ax ;
push ds ;
mov dx,[_int3] ;
mov ds,[_int3_2] ;
mov ax,2503h ;
int 21h ;
pop ds ;
;--------------------------------------------------------------------------
;---- END ANTI-ALTER
call set_errors
mov dx,offset initial
mov ah,9
int 21h
;------------------ CHECK MEMORY
mov dx,offset scmem
mov ah,9
int 21h
mov bx,0bcdeh
mov ah,54h
int 21h
xor bx,0edcbh
jnz facs
mov dx,offset unnec
jmp crucifix_present
facs:
xor ax,ax
mov es,ax
cmp byte ptr es:[1ech],1
jne checkk
mem_poss:
mov dx,offset memwarn
mov ah,9
int 21h
call mem_antidote ; REMOVE DEVIL FROM MEMORY
jmp set_up
pri_rep:
mov ah,9
int 21h
jmp set_up
checkk:
mov dx,0abcdh
mov ah,30h
int 21h
xor dx,0dcbah
jz mem_poss
not_nece:
mov dx,offset clean
crucifix_present:
jmp pri_rep
set_up: ;------------------ SETUP ENVIRONMENT
push cs
pop es
mov bx,4096
mov ah,4ah
int 21h
jnc allocate_mem
cmp ax,7
jne ax_8
mov dx,offset mcbd
jmp print_error
ax_8:
cmp ax,8
jne ax_9
mov dx,offset insmem
jmp print_error
ax_9:
mov dx,offset imba
print_error:
mov ah,9
int 21h
jmp exiting
allocate_mem:
mov bx,4096
mov ah,48h
int 21h
jnc ok_alloc
cmp ax,7
jne ax_81
mov dx,offset mcbd
jmp print_error1
ax_81:
mov dx,offset insmem
print_error1:
mov ah,9
int 21h
jmp exiting
ok_alloc:
mov [alloc],ax
;------------------ THIS PORTION IS FOR GETTING THE PSP
;------------------ END FOR PSP
mainloop:
mov dx,offset get_drive_mess
mov ah,9
int 21h
mov ah,1
int 21h
cmp al,13 ; CARRIAGE RETURN?
jne not_yet
mov ah,9
mov dx,offset lfcr
int 21h
jmp exiting
not_yet:
mov [dri],al
cmp al,'A'
jb invalid_drive
cmp al,'Z'
jb caps_detected
cmp al,'a'
jb invalid_drive
cmp al,'z'
jb small_detected
invalid_drive:
mov dx,offset invalidrive
mov ah,9
int 21h
jmp mainloop
caps_detected:
sub al,64
jmp put_id
small_detected:
sub byte ptr [dri],32
sub al,96
jmp put_id
put_id:
mov dl,al
mov si,offset dir_buffer
mov ah,47h ; GET CURRENT DIRECTORY
int 21h
jc invalid_drive
look_0:
cmp byte ptr [si],0
je make_string
inc si
jmp look_0
make_string:
mov byte ptr [si],'$'
mov [point_0],si
mov dx,offset drip
mov ah,9
int 21h
mov byte ptr [si],0
;-----------------------
mov dx,offset dta ; SET DTA
mov ah,1ah
int 21h
;----------------------- ; FIX PATH
mov di,[point_0]
mov si,offset all_files
cmp byte ptr [di-1],'\'
jne move_param
inc si
move_param:
mov cx,5
cld
rep movsb ; TRANSFER PARAMETER
;-----------------------
mov si,offset dri
mov di,offset temp_buffer
mov cx,68
cld
rep movsb
mov si,offset temp_buffer
mark_0:
cmp byte ptr [si],0
je markit
inc si
jmp mark_0
markit:
sub si,3
mov [putfile],si
;-----------------------
mov dx,offset dri ; PATH TO SEARCH
mov cx,00100111b ; FILE ATTRIBUTE (FILE)
mov ah,4eh ; SEARCH FIRST MATCH
int 21h
;-----------------------
jnc find_next
cmp ax,2
jne ax_3
mov dx,offset fle_nfou
jmp s_mess
ax_3:
cmp ax,3
jne ax_4
mov dx,offset pth_nfou
jmp s_mess
ax_4:
mov dx,offset nm_fle
s_mess:
mov ah,9
int 21h
exiting:
push cs
pop ds
call reset_errors
mov ax,4c00h
int 21h
;-----------------------
find_next:
;----- FIX FILE SEARCHED TO PRINT
mov si,offset dta+1eh
look_0_1:
cmp byte ptr [si],0
je look_comexe
inc si
jmp look_0_1
look_comexe:
push si
mov di,offset comfile
sub si,3
push si
mov cx,3
cld
repe cmpsb
je put_dollar1
mov byte ptr [status],2 ; 2 FOR .EXE FILE
mov cx,3
pop si
mov di,offset exefile
cld
repe cmpsb
je put_dollar
pop si
jmp next_file
put_dollar1:
pop si
mov byte ptr [status],1 ; 1 FOR .COM FILE
put_dollar:
pop si
push si
mov si,offset dta+1eh
mov di,[putfile]
mov cx,13
cld
rep movsb
pop si
mov byte ptr [si],'$'
mov dx,offset lfcr
mov ah,9
int 21h
mov dx,offset dta+1eh
int 21h
call scanner
;-----
next_file:
mov ah,4fh
int 21h
jnc find_next
mov dx,offset nm_fle
mov ah,9
int 21h
jmp mainloop
scanner proc near
push cs
pop ds
mov dx,offset temp_buffer
mov ax,3d00h ; OPEN FILE (FOR READING ONLY)
int 21h
jnc read_file
cmp ax,4
jne ax5
mov dx,offset nha
jmp print_error2
ax5:
cmp ax,5
jne ax6
mov dx,offset acd
jmp print_error2
ax6:
mov dx,offset iac
print_error2:
mov ah,9
int 21h
read_file:
mov [handle],ax ; SAVE HANDLE
;-----------------
mov bx,ax
mov cx,100 ; READ 100
xor dx,dx
mov ds,[alloc]
mov ah,3fh
int 21h
jnc no_err
mov dx,offset blank
jmp print_rep
no_err:
mov cs:[fil_red],ax
cmp byte ptr cs:[status],1
je check_com
cmp word ptr ds:[12h],1970h
je infected_exe
none:
mov dx,offset no_virus
jmp print_rep
infected_exe:
;************* CHECK VERSIONS FOR .EXE
; THAT IS FOR COLDV2X AND ABOVE
; IF NO SIGNATURE FOUND, JUMP TO <NONE>
push cs
pop ds
mov byte ptr [curex_2x],0
mov byte ptr [curex_3x],0
mov byte ptr [curex_2xa],0 ;*** NEW ENTRy
mov byte ptr [curex_5x],0
mov byte ptr [curex_6x],0
mov byte ptr [curex_7x],0
mov byte ptr [curex_8x],0
mov byte ptr [curex_9x],0
call infected_com
cmp byte ptr cs:[_cure],1
jne _nxte
jmp _exit_exe
_nxte:
cmp byte ptr cs:[replace_status],1
jne exe_exe_anti
ret
exe_exe_anti:
;**********
call exe_antidote
;**********
ret
_exit_exe:
jmp close_file
print_rep:
call print_version
jmp close_file
check_com:
push cs
pop es
mov si,3 ; CRUCIFIX I.D. OFFSET @ ALLOC:0
mov di,offset crucifix
mov cx,8
cld
repe cmpsw
je baptized
jmp continue_check
baptized:
;------- SECOND CHECK
cmp word ptr cs:[dta+1ah],1709
je ok
mov dx,offset replace
jmp print_rep
;-------
ok:
mov dx,offset immune
jmp print_rep
continue_check:
mov si,16
mov di,offset jonjon_sig
mov cx,33
cld
repe cmpsw
je infected_com
; SCAN FOR OLDER VERSIONS
mov si,3
mov di,offset jonjon_sig
mov cx,33
cld
repe cmpsw
je infected_com
; SCAN E. DAYA VERSION
mov si,16
mov di,offset signn
mov cx,36
cld
repe cmpsw
je infected_com
jmp none
infected_com:
call close_file
mov dx,offset have_virus
call print_version
call com_antidote
mov ax,cs
mov ds,ax
mov es,ax
ret
close_file: ;-----------------
push cs
pop ds
mov ah,3eh
mov bx,[handle]
int 21h
ret
scanner endp
print_version proc near
push dx
mov ah,03h ; ALLIGN CURSOR
xor bx,bx
int 10h
mov dl,12
mov ah,02
xor bx,bx
int 10h
pop dx
push cs
pop ds
mov ah,9
int 21h
ret
print_version endp
comprar proc near
push si
push cx
cld
repe cmpsw
je equal_str
stc
equal_str:
pop cx
pop si
ret
comprar endp
com_antidote proc near
mov byte ptr [replace_status],0 ; REPLACE FILE ADVICE FLAG
mov byte ptr [_cure],0 ; SET To 1 IF DISK NOT WRI. PROT.
mov ax,4301h ; SET FILE ATTRIBUTE TO ACCESS
mov dx,offset temp_buffer
mov cx,20h
int 21h
jnc attr_ok
mov byte ptr cs:[_cure],1
mov ax,3d00h ; DO OPEN FILE READ ONLY ACCESS
jmp tonk
error_com:
push cs
pop ds
mov dx,offset unab
mov ah,9
int 21h
ret
attr_ok:
mov ax,3d02h ; OPEN FILE FOR READ/WRITE
tonk:
push cs
pop ds
mov dx,offset temp_buffer
int 21h
error0_com:
jc error_com
mov [handle],ax
mov byte ptr [coldv89x],0 ; MARKER FOR COMMAND.COM
xor cx,cx
mov dx,cx
mov bx,[handle]
mov ax,4202h ; POINTER TO END OF FILE
int 21h
error1_com:
jc error0_com
mov [fil_red],ax
mov [fil_redx],ax
; ---------- .EXE INSERT
mov [fil_redh],dx
cmp byte ptr [status],2
je ok_hword
; ---------- .EXE INSERT END
cmp dx,0 ; HIGH ORDER WORD?
je ok_hword
mov byte ptr [replace_status],1 ; REPLACE FLAG SET
ok_hword:
xor cx,cx
mov dx,cx
mov ax,4200h ; POINTER TO BEG.
int 21h
error2_com:
jc error1_com
mov cx,cs:[fil_red]
cmp byte ptr cs:[status],2
jne _prit
mov cx,28
_prit: ; ---------- _exe_ca is USED BY .EXE
call read_fi
error3_com:
jc error2_com
cmp byte ptr cs:[status],2
jne _kxc
call getlorhir ; GET LOR & HIR W/OUT VIR.
call lodvir
ret
_exe_ca:
call read_fi
jc error2_com
_kxc:
push cs ; MAKE ES=CS, (DS=ALLOC)
pop es
; ****************** LOOK VIRUS VERSION ***********
mov si,2c5h ; OFFSET OF SIG.
mov di,offset sv ; VIRUS SIG.
mov cx,8 ; NO. OF WORDS TO COMPARE
call comprar ; COMPARE IT
jc test_coldv2
mov si,4ah ; OFFSET FOR vector & clock
call stor_vectors
mov bx,4bdh ; OFFSET OF PROG.
mov cs:[virsize],1234 ; VIRUS SIZE
mov dx,offset coldv ; VERSION NUMBER STRING
jmp cure
test_coldv2:
mov si,2f2h
mov di,offset sv2_sv2x
mov cx,8
call comprar
jc test_coldv2x
mov si,4ah
call stor_vectors
mov bx,4c5h
mov cs:[virsize],1242
mov dx,offset coldv2
jmp cure
test_coldv2x:
mov si,431h
mov di,offset sv2_sv2x
mov cx,8
call comprar
jc test_coldv2xa
mov si,4ah
call stor_vectors
mov bx,877h
mov cs:[virsize],2193
mov byte ptr cs:[curex_2x],1 ; SET COLDV2X
mov dx,offset coldv2x
jmp cure
test_coldv2xa: ; ********************* NEW ENTRY (VINDI 1.01)
mov si,430h
mov di,offset sv2_sv2x
mov cx,8
call comprar
jc test_coldv356789x
mov si,4ah
call stor_vectors
mov bx,877h
mov cs:[virsize],2193
mov byte ptr cs:[curex_2xa],1 ; SET COLDV2X
mov dx,offset coldv2xa
jmp cure
test_coldv356789x:
; -------- .EXE INSERT
cmp byte ptr cs:[status],2
je test_coldv3x
; ------- .EXE INSERT END
mov si,0
mov di,offset sv356789x
mov cx,6
call comprar
jnc test_coldv3x
sign_not_found:
; ---------- .EXE INSERT
cmp byte ptr cs:[status],2
jne _uni_com
mov byte ptr cs:[mem_stat],3
ret
; ---------- .EXE INSERT END
_uni_com:
mov dx,offset unidentifd
mov byte ptr cs:[replace_status],1
jmp cure
test_coldv3x: ; *** DIFFERENT METHOD OF DETECTION
mov ax,6b4h ; DIFF. W/END AS FOR JUMPER
mov bx,5ah ; RELATIVE TO END OF FILE
mov cs:[virsize],2322 ; FILE's SIZE
mov word ptr cs:[sizemark],67h ; RELATIVE TO START OF VIR.
; LOCATED @ THE BOTTOM OF FILE
mov dx,offset coldv3x ; VERSION MESSAGE
with_fil_red: ;************* COMMON ************
call prep_comprar
jc test_coldv5x
push bx
mov si,4fh
call stor_vectors
pop bx
mov byte ptr cs:[curex_3x],1 ; SET COLDV3X
jmp curex3
test_coldv5x:
mov ax,6c4h
mov bx,5ah
mov cs:[virsize],2443
mov dx,offset coldv5x
call prep_comprar
jc test_coldv6x
push bx
mov si,4fh
call stor_vectors
pop bx
mov byte ptr cs:[curex_5x],1 ; SET COLDV5X
jmp curex3
test_coldv6x:
mov ax,6cah
mov bx,5ah
mov cs:[virsize],2438
mov word ptr cs:[sizemark],6dh
mov dx,offset coldv6x
call prep_comprar
jc test_coldv789x
push bx
mov si,55h
call stor_vectors
pop bx
mov byte ptr cs:[curex_6x],1 ; SET COLDV6X
jmp curex3
test_coldv789x:
mov ax,6bdh
mov bx,5ah
mov cs:[virsize],2446
mov word ptr cs:[sizemark],67h
mov dx,offset coldv7x
call prep_comprar
jnc test_coldv7x
jmp sign_not_found
test_coldv7x:
mov si,cs:[fil_red]
sub si,78bh ; 'Fuck......'
mov di,offset fuck ; TEST COLDV8x
mov cx,2
call comprar
jnc its_coldv8x
;----------------- ; NOW TEST COLDV9X
mov si,cs:[fil_red]
sub si,798h ; 'Doom......'
mov di,offset doom
mov cx,2
call comprar
jnc its_coldv9x ; IT'S COLDV9X
push bx
mov si,4fh
call stor_vectors
pop bx
mov dx,offset coldv7x
mov byte ptr cs:[curex_7x],1 ; SET COLDV7X
jmp curex3 ; IT'S COLDV7X, CURE IT.
its_coldv8x:
; NOTE: COLDV8X & 9X HAS A SPECIAL TREATMENT FOR
; COMMAND.COM, BECAUSE, UNLIKE OTHER VERSIONS,
; IT GARBAGES THE fil_red IN MEMORY
;---------------------------------------------------
mov byte ptr cs:[coldv89x],1 ; SET FLAG NOW FOR COLDV8X & 9X
mov word ptr cs:[range],5bh
mov dx,offset coldv8x
push bx
mov si,4ah
call stor_vectors
pop bx
mov byte ptr cs:[curex_8x],1 ; SET COLDV8X
jmp curex3
its_coldv9x:
mov byte ptr cs:[coldv89x],1
mov word ptr cs:[range],55h
mov dx,offset coldv9x
push bx
mov si,4ah
call stor_vectors
pop bx
mov byte ptr cs:[curex_9x],1 ; SET COLDV9X
jmp curex3
cure: push bx
push cs
pop ds
mov ah,9
int 21h
mov dx,offset reviving
int 21h
cmp byte ptr [replace_status],1
jne curex
exit_on_uniden:
mov dx,offset replacemess
mov ah,9
int 21h
pop bx
call clean_exit
ret
return_pnt:
mov ah,9
int 21h
pop bx
call close_file
ret
curex:
cmp byte ptr cs:[_cure],1
jne _cure_it
mov dx,offset cant_cure
jmp return_pnt
_cure_it:
; --------- .EXE INSERT
cmp byte ptr cs:[status],2
jne _g_com
; CHECK COLDV2X
cmp word ptr cs:[virsize],2193
jne __check_coldv3x
mov cs:[virsize],2167
__check_coldv3x:
pop bx
ret
; --------- .EXE INSERT END
_g_com:
xor cx,cx
mov dx,cx
mov bx,cs:[handle]
mov ax,4200h ; POINT TO BEG
int 21h
pop dx
mov ds,cs:[alloc]
mov cx,cs:[fil_red]
sub cx,word ptr cs:[virsize]
mov ah,40h ; WRITE TO FILE
int 21h
mov cx,0
mov ah,40h ; IN ORDER TO UPDATE FILE SIZE
int 21h
close_filex:
call clean_exit
mov ah,9
mov dx,offset eliminated
int 21h
ret
curex3:
push bx
push cs
pop ds
mov ah,9
int 21h
mov dx,offset reviving
int 21h
cmp byte ptr cs:[replace_status],1
jne curex3x
jmp exit_on_uniden
curex3x:
cmp byte ptr [_cure],1
jne _cure_itx
mov dx,offset cant_cure
jmp return_pnt
_cure_itx:
; --------- .EXE INSERT
cmp byte ptr cs:[status],2
jne _g_como
pop bx
ret
; --------- .EXE INSERT END
_g_como:
mov si,cs:[fil_red]
mov ds,cs:[alloc]
;----------- TRANSFER TRUECODE
pop cx
push si
sub si,cx
push ds ; MAKE ES = DS = ALLOC
pop es
xor di,di ; MOVE TRUECODE @ ALLOC:0
mov cx,45
cld
rep movsw
pop si
;----------- END TRANSFER
cmp byte ptr cs:[coldv89x],1
jne not_coldv89x
;--------------- ************** ------
mov bx,word ptr cs:[range]
cmp byte ptr [si-2446+bx],11 ; COMMAND.COM?
je clear_stack
jmp not_commandcom
not_coldv89x:
mov bx,si
sub bx,word ptr cs:[virsize]
add bx,word ptr cs:[sizemark]
cmp si,word ptr [bx]
jne not_commandcom
clear_stack: ;----------- IF COMMAND.COM, ERASE VIRUS ON STACK
sub si,cs:[virsize]
mov cx,si
put_zeros:
mov byte ptr [si],0
inc si
loop put_zeros
mov cs:[virsize],0 ; NO CHANGE IN SIZE FOR COMMAND.COM
not_commandcom:
xor bx,bx
push bx
jmp curex
com_antidote endp
exe_antidote proc near
mov ds,[alloc]
xor si,si
cmp byte ptr cs:[curex_2x],1
jne test_curex_2xa
mov ax,word ptr [si+6eh] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+70h] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+74h] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+72h] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_2xa:
cmp byte ptr cs:[curex_2xa],1
jne test_curex_3x
mov ax,word ptr [si+6dh] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+6fh] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+73h] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+71h] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_3x:
cmp byte ptr cs:[curex_3x],1
jne test_curex_5x
_common_par:
mov ax,word ptr [si+73h] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+75h] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+79h] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+77h] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_5x:
cmp byte ptr cs:[curex_5x],1
jne test_curex_6x
jmp _common_par
test_curex_6x:
cmp byte ptr cs:[curex_6x],1
jne test_curex_7x
mov ax,word ptr [si+79h] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+7bh] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+7fh] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+7dh] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_7x:
cmp byte ptr cs:[curex_7x],1
jne test_curex_8x
jmp _common_par
test_curex_8x:
cmp byte ptr cs:[curex_8x],1
jne test_curex_9x
mov ax,word ptr [si+60h] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+62h] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+66h] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+64h] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_9x:
cmp byte ptr cs:[curex_9x],1
jne test_curex_xx
mov ax,word ptr [si+5ah] ; GET segof_ssx
sub ax,10h
push ax ; PUSH IT ON SATCK
mov ax,word ptr [si+5ch] ; GET ofof_spx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+60h] ; GET for_ipx
push ax ; PUSH IT ON STACK
mov ax,word ptr [si+5eh] ; GET for_csx
sub ax,10h
push ax ; PUSH IT ON STACK
jmp execure
test_curex_xx:
ret
execure:
mov bx,cs:[handle]
xor cx,cx
mov dx,cx
mov ax,4200h ; POINTER TO BEG.
int 21h
mov cx,28 ; READ FILE HEADER INTO ALLOC:0
xor dx,dx
mov ah,3fh
int 21h
pop ax ; RESTORE for_csx
xor si,si
mov [si+16h],ax
pop ax ; RESTORE for_ipx
mov [si+14h],ax
pop ax ; RESTORE ofof_spx
mov [si+10h],ax
pop ax ; RESTORE segof_ssx
mov [si+0eh],ax
mov ax,6666h
mov [si+12h],ax
;-----------------; COMPUTE MODULE
xor dx,dx
mov ax,[si+4] ; GET 512 PAGES MODULE LOAD SIZE
mov cx,[si+2]
or cx,cx
jz its_02
dec ax
its_02:
mov bx,200h
mul bx
add ax,cx
adc dx,0
sub ax,cs:[virsize]
sbb dx,0
mov cs:[loro],ax
mov cs:[hiro],dx
sub ax,0fh
sbb dx,0
or ax,0fh
div bx
or dx,dx
je its_02z
inc ax
its_02z:
mov [si+4],ax
mov [si+2],dx
; --------------- ; END OF COMPUTING MODULE
mov bx,cs:[handle]
xor cx,cx
mov dx,cx
mov ax,4200h ; POINTER TO BEG.
int 21h
mov cx,28 ; RE-WRITE NEW HEADER...
xor dx,dx ; STARTING AT ALLOC:0
mov ah,40h
int 21h
; DECIDE NEW SIZE
mov cx,cs:[hir] ; HERE, HIR & LOR ARE...
mov dx,cs:[lor] ; RELATIVE TO, WITH VIRUS.
cmp dx,cs:[fil_redx]
jne _at_end
cmp cx,cs:[fil_redh]
jne _at_end
jmp _decsize
_at_end:
mov cx,cs:[hiro] ; HERE, HIRO & LORO ARE...
mov dx,cs:[loro] ; RELATIVE TO, MINUS THE VIRUS
mov ax,4200h
int 21h
mov cx,cs:[virsize]
xor si,si
push cx
_agoi:
mov byte ptr [si],0 ; CLEAR MEMORY WITH 0s
inc si
loop _agoi
pop cx
xor dx,dx
mov ah,40h ; TRANSFER IT ON FILE, CLEAN VIR.
int 21h
xor cx,cx
mov dx,cx
mov ax,4202h ; GO TO END OF FILE
int 21h
jmp updt
; DECIDE NEW SIZE ENDS
_decsize:
mov cx,cs:[hiro]
mov dx,cs:[loro]
mov ax,4200h
int 21h
updt:
xor cx,cx
mov ah,40h
int 21h
call clean_exit
mov ax,cs
mov ds,ax
mov es,ax
mov dx,offset eliminated
mov ah,9
int 21h
ret
exe_antidote endp
mem_antidote proc near
mov ax,3521h
int 21h ; GET ES
mov ax,es
add ax,10h
mov ds,ax
mov byte ptr cs:[status],2
push ax
mov byte ptr cs:[mem_stat],1
call _kxc
pop ax
cmp byte ptr cs:[mem_stat],3
jne okl
sub ax,10h ; CHECK MORE TO ENSURE
mov ds,ax
mov byte ptr cs:[mem_stat],1
push ax
call _kxc
pop ax
cmp byte ptr cs:[mem_stat],3 ; STILL NOT FOUND?
jne okl
push cs
pop ds
mov ah,9
mov dx,offset quest
int 21h
mov dx,offset reviving
int 21h
mov dx,offset canc
int 21h
mov dx,offset tsr
call print_version
mov byte ptr [mem_stat],0
ret
okl:
sub ax,10h ; POINT TO VIR. PROG. WITH PSP
mov byte ptr [mem_stat],0
; ---- SET VECTORS TO OLD
push ax ; PUSH AX -- SEG. TO FREE
mov ax,2521h ; SET FIRST DOS
cli
mov dx,word ptr cs:[vectorr]
mov ds,word ptr cs:[vectorr+2]
sti
int 21h
mov ax,2508h ; THEN THE HARDWARE TIMER
cli
mov dx,word ptr cs:[clockk]
mov ds,word ptr cs:[clockk+2]
sti
int 21h
pop ax
;---- DONE WITH VECTORS
mov es,ax
mov ah,49h ; NOW FREE THE VIRUS
int 21h
xor ax,ax
mov es,ax
mov byte ptr es:[01ech],0
push cs
pop ds
jc _eronfr
mov dx,offset eliminated
_vwd:
mov ah,9
int 21h
ret
_eronfr:
mov dx,offset unabmem
jmp _vwd
mem_antidote endp
prep_comprar proc near
cmp byte ptr cs:[mem_stat],1
jne wx
mov cx,cs:[virsize]
mov cs:[fil_red],cx
wx:
mov si,cs:[fil_red]
sub si,ax
mov di,offset sv356789x ; JUMPER SIG. ON TOP
mov cx,6
call comprar
ret
prep_comprar endp
reset_attr proc near
xor cx,cx
mov cl,byte ptr [dta+15h] ; RESET FILE ATTRIBUTE
mov dx,offset temp_buffer
mov ax,4301h
int 21h
ret
reset_attr endp
clean_exit proc near
mov bx,cs:[handle]
mov dx,word ptr cs:[dta+18h] ; DATE STAMP
mov cx,word ptr cs:[dta+16h] ; TIME STAMP
mov ax,5701h
int 21h
call close_file
call reset_attr
ret
clean_exit endp
set_errors proc near
push cs
mov ax,3524h
int 21h
mov [i24],bx
mov [i242],es
mov ax,2524h
mov dx,offset _int24
int 21h
pop es
ret
set_errors endp
reset_errors proc near
push cs
push cs
pop ds
mov ax,2524h
mov dx,[i24]
mov ds,[i242]
int 21h
pop ds
ret
reset_errors endp
getlorhir proc near
xor dx,dx
xor si,si
mov ax,[si+4] ; GET 512 PAGES MODULE LOAD SIZE
mov cx,[si+2]
or cx,cx
jz its_02s
dec ax
its_02s:
mov bx,200h
mul bx
add ax,cx
adc dx,0
mov cs:[lor],ax
mov cs:[hir],dx
sub ax,0fh
sbb dx,0
or ax,0fh
div bx
or dx,dx
je its_02zz
inc ax
its_02zz:
ret
getlorhir endp
stor_vectors proc near
mov bx,[si]
mov word ptr cs:[vectorr],bx
mov bx,[si+2]
mov word ptr cs:[vectorr+2],bx
mov bx,[si+4]
mov word ptr cs:[clockk],bx
mov bx,[si+6]
mov word ptr cs:[clockk+2],bx
ret
stor_vectors endp
read_fi proc near
xor dx,dx
mov ds,cs:[alloc]
mov bx,cs:[handle]
mov ah,3fh ; READ FILE INTO ALLOC:0
int 21h
ret
read_fi endp
_goki proc near
mov cx,cs:[hir]
mov dx,cs:[lor]
mov cs:[virsize],bx
sub dx,bx
sbb cx,0
mov bx,cs:[handle]
mov ax,4200h
int 21h
mov cx,cs:[virsize]
mov cs:[fil_red],cx
call read_fi
ret
_goki endp
lodvir proc near
mov bx,2167
call _goki
call _kxc
cmp byte ptr cs:[curex_2x],1
jne load_coldv2xa
ret
load_coldv2xa:
cmp byte ptr cs:[curex_2xa],1
jne load_coldv3x
mov bx,2167
call _goki
ret
load_coldv3x:
cmp byte ptr cs:[curex_3x],1
jne load_coldv5x
mov bx,2322
call _goki
ret
load_coldv5x:
cmp byte ptr cs:[curex_5x],1
jne load_coldv6x
mov bx,2443
call _goki
ret
load_coldv6x:
cmp byte ptr cs:[curex_6x],1
jne load_coldv7x
mov bx,2438
call _goki
ret
load_coldv7x:
cmp byte ptr cs:[curex_7x],1
jne load_coldv8x
mov bx,2446
call _goki
ret
load_coldv8x:
cmp byte ptr cs:[curex_8x],1
jne load_coldv9x
mov bx,2446
call _goki
ret
load_coldv9x:
cmp byte ptr cs:[curex_9x],1
jne _coldnone
mov bx,2446
call _goki
ret
_coldnone:
call _uni_com
ret
lodvir endp
_iret proc near
iret
_iret endp
_int24 proc near
mov al,3
stc
iret
_int24 endp
alloc dw ?
handle dw ?
status db ?
point_0 dw ?
putfile dw ?
fil_red dw ?
drip db 08
;------
dri db ?,':\'
dir_buffer db 65 dup(0)
;------
temp_buffer db 68 dup(0)
dta db 44 dup(0)
initial db 214,53 dup(196),183,10,13
db 186,' (c) VINDICATE Version 1.01, July 1991 ',186,10,13
db 186,' Created by JonJon Gumba, CpE - 5 AdU ',186,10,13
db 186," Use: Detects/Eliminates SATAN's V1.00 - V1.09 ",186,10,13
db 211,53 dup(196),189,10,13,'$'
scmem db 'The memory... $'
memwarn db 'is POSSESSED!',7,' by Version $'
sol db 'Soulution: REBOOT THE SYSTEM to wipe the DEVIL out.$'
unnec db 'is safe! CRUCIFIX is there.$'
clean db 'has no DEVIL.$'
jonjon_sig db 13,'POSSESSED! Bwa! ha! ha! ha! ha!$',8,32,10,13
db 'Author: JonJon Gumba of AdU',10,1ah
signn db 13,'POSSESSED! Bwa! ha! ha! ha! ha!$',8,32,10,13
db 'Author: '
authorr db 'A. Gumba & E. Daya of AdU',10,1ah
crucifix db 13,'666 Protector',13,1ah
invalidrive db ' ----> Invalid drive I.D.',7,'$'
lfcr db 10,13,'$'
get_drive_mess db 10,10,13,'Enter Drive: $'
comfile db 'COM'
exefile db 'EXE'
fle_nfou db 10,13,'File not found.$'
pth_nfou db 10,13,'Path not found.$'
nm_fle db 10,13,'No more files...........$'
mcbd db 10,13,'Memory control blocks destroyed.$'
insmem db 10,13,'Insufficient memory.$'
imba db 10,13,'Invalid memory block address.$'
nha db 10,13,'No handles available.$'
acd db 10,13,'Access denied.$'
iac db 10,13,'Invalid access code.$'
all_files db '\*.*',0
no_virus db ' No Devil.$'
immune db ' Utility code integrity checking O.K.$'
replace db ' Altered! Replace this with backup.',7,'$'
; **** Versions ****
have_virus db ' Warning: POSSESSED!',7,' Version $'
quest db '?.??$'
tsr db ' A possible TSR program(s) resided above the devil.$'
i24 dw ?
i242 dw ?
vectorr dd ?
clockk dd ?
replace_status db ?
coldv89x db ?
_cure db ?
fil_redh dw ?
fil_redx dw ?
lor dw ?
hir dw ?
loro dw ?
hiro dw ?
mem_stat db ?
curex_2x db ?
curex_2xa db ? ;****** NEW ENTRY (VINDI 1.01)
curex_3x db ?
curex_5x db ?
curex_6x db ?
curex_7x db ?
curex_8x db ?
curex_9x db ?
coldv db '1.00$'
coldv2 db '1.01$'
coldv2x db '1.02$'
coldv2xa db '1.02A$'
coldv3x db '1.03$'
coldv5x db '1.05$'
coldv6x db '1.06$'
coldv7x db '1.07$'
coldv8x db '1.08$'
coldv9x db '1.09$'
virsize dw ?
sizemark dw ?
range dw ?
; ---------------- SIGNATURES
sv db 9ch,2eh,0ffh,1eh,4ah,1,9ch,2eh,80h,3eh,62h
db 1,1,75h,9,2eh
sv2_sv2x db 55h,06h,50h,33h,0c0h,8eh,0c0h,26h,89h
db 26h,0f4h,01,26h,8ch,16h,0f6h
sv356789x db 2eh,8bh,1eh,0ch,1,2eh,8bh,36h,0eh,1,0ffh,0e3h
fuck db 'Fuck'
doom db 'Doom'
; ---------------- END SIGNATURES
unidentifd db 8,8,8,8,8,8,8,8
db 'Miscalculated structure.',7,'$'
replacemess db 'CANCELLED!'
db 10,13
db ' You better check/replace this one.$'
unab db 8,8,8,8,8,8,8,8,'Unable to open/access file.',7,'$'
eliminated db 'SUCCESSFUL!$'
reviving db 10,13,' Dispossessing ',7 dup(16),' $'
canc db 'CANCELLED!',10,13,'$'
cant_cure db 'UNABLE, possibly WRITE-PROTECTED.$'
unabmem db 'UNABLE, error in memory. Better REBOOT the system.$'
blank db ' Eof.$'
; BALANCER
__end:
code_seg ends
end start
-- VINDI1.ASM ENDS HERE -----------------------------------------------If you want to use the encrypted version of the program as released by the program author, here's a copy. But aren't you scared that the author (Gumba) could have hidden a new variant of Possessed under that encryption? This is what the local AVs at that time said.
But isn't that possible? Nah.... He wouldn't dare do it.
If you're having second thoughts, compile VINDI1.ASM instead.
By the way, I won't be giving you the Crucifix TSR program of Gumba because it does not really do anything but waits for the SelfRec call of Possessed and marks 0:1EC with 1. A waste of memory.
-- VINDI1.SCR STARTS HERE --------------------------------------------
N VINDI1.COM
E 0100 E9 1E 01 0D 54 68 65 20 77 6F 72 6C 64 20 69 73
E 0110 20 67 65 74 74 69 6E 27 20 73 69 6E 66 75 6C 20
E 0120 65 76 65 72 79 64 61 79 2E 0A 0D 46 65 61 72 20
E 0130 6E 6F 74 20 74 68 65 20 64 65 76 69 6C 20 79 6F
E 0140 75 20 73 65 65 2C 0A 0D 62 75 74 20 66 65 61 72
E 0150 20 6D 6F 73 74 20 74 68 65 20 64 65 76 69 6C 20
E 0160 79 6F 75 20 63 61 6E 27 74 20 73 65 65 2E 0A 0D
E 0170 46 6F 72 20 79 6F 75 72 20 69 6E 74 61 6E 67 69
E 0180 62 6C 65 20 61 77 61 72 65 6E 65 73 73 2C 0A 0D
E 0190 74 68 65 20 64 65 76 69 6C 20 69 73 2E 2E 2E 20
E 01A0 57 49 54 48 49 4E 20 59 4F 55 21 0A 0D 44 69 73
E 01B0 70 6F 73 73 65 73 73 20 79 6F 75 72 73 65 6C 66
E 01C0 21 20 54 68 69 73 20 63 68 65 61 70 20 70 72 6F
E 01D0 67 72 61 6D 0A 0D 69 73 20 6E 6F 74 20 64 65 73
E 01E0 69 67 6E 65 64 20 74 6F 20 64 6F 20 74 68 61 74
E 01F0 2E 20 42 75 74 20 74 68 65 20 67 72 65 61 74 20
E 0200 53 4F 4D 45 4F 4E 45 20 63 61 6E 2E 0A 0D 1A 00
E 0210 00 00 00 BE 39 02 B9 5F 11 F7 14 83 C6 02 E2 F9
E 0220 CF 0E 1F B8 03 35 CD 21 89 1E 0F 02 8C 06 11 02
E 0230 BA 13 02 B8 03 25 CD 21 CC 73 37 71 3F 71 27 E1
E 0240 74 E9 F0 FD 71 E1 EE FD 47 FC DA 32 DE E0 17 84
E 0250 F6 45 35 F2 4B F6 32 DE 45 17 F1 4B F6 32 DE 44
E 0260 21 43 4B AB 32 DE 7E 0C 34 12 8A F9 45 B6 F0 14
E 0270 CE 6F CC 3F 71 3F D9 7F C1 13 FE FE 8A EB 45 06
E 0280 F1 4B F6 32 DE 17 B1 F7 14 E5 6F 4B F6 32 DE 14
E 0290 EC 6F 45 32 54 4B CF 32 DE 7E 0D 45 23 8B 20 45
E 02A0 9A F0 14 18 F1 F8 44 FF EF 4B B5 32 DE 8C DF C2
E 02B0 F8 FF 8A F9 45 7C EF 14 F0 6F C2 F7 FF 8A F9 45
E 02C0 59 EF 14 FB 6F 45 42 EF 4B F6 32 DE 16 14 FF 44
E 02D0 FF EF 4B B7 32 DE 8C EA C2 F8 FF 8A F9 45 7C EF
E 02E0 14 FB 6F 45 59 EF 4B F6 32 DE 16 32 FF 5C F5 F2
E 02F0 45 D2 EF 4B F6 32 DE 4B FE 32 DE C3 F2 8A F5 4B
E 0300 F6 45 D5 EF 32 DE 16 4E FF 5D E9 F2 C3 BE 8D F3
E 0310 C3 A5 8D EE C3 9E 8D FB C3 85 8D F1 45 F2 EF 4B
E 0320 F6 32 DE 14 34 D3 BF 14 F4 6F 7F D1 E9 F2 DF D3
E 0330 9F 14 FE 6F 75 2F 41 E6 F2 4B B8 32 DE 8D 22 7F
E 0340 C3 FF 8B FC B9 14 07 39 FB DB 76 C9 F0 F2 45 EA
E 0350 F2 4B F6 32 DE 39 FB FF 45 61 F2 4B E5 32 DE 74
E 0360 C1 F0 F2 41 E2 EE 7F 82 00 A3 8A FE B9 46 FA FF
E 0370 03 0C 5B 41 E9 F2 40 A5 F2 46 BB FF 03 0C 5B 41
E 0380 A5 F2 7F C3 FF 8B FC B9 14 07 7C 11 FC 76 C9 EE
E 0390 F2 45 E9 F2 46 D8 FF 4B B1 32 DE 8C D8 C2 FD FF
E 03A0 8A F9 45 BB EF 14 F0 6F C2 FC FF 8A F9 45 A9 EF
E 03B0 14 FB 6F 45 97 EF 4B F6 32 DE F1 E0 17 DA F7 47
E 03C0 FF B3 32 DE 41 43 F2 7F C3 FF 8B FC B9 14 07 A9
E 03D0 40 C1 EF 7C 11 FC A9 46 FC FF 03 0C 59 8B EA 39
E 03E0 F9 F1 F2 FD 46 FC FF A1 40 BE EF 03 0C 59 8B F5
E 03F0 A1 14 D6 6F A1 39 F9 F1 F2 FE A1 A9 41 43 F2 74
E 0400 C1 EE F2 46 F2 FF 03 0C 5B A1 39 FB DB 45 D5 EF
E 0410 4B F6 32 DE 45 43 F2 32 DE 17 EF FF 4B B0 32 DE
E 0420 8C 5D 45 97 EF 4B F6 32 DE 16 3B 01 F1 E0 45 A5
E 0430 F2 47 FF C2 32 DE 8C E2 C2 FB FF 8A F9 45 22 EF
E 0440 14 F0 6F C2 FA FF 8A F9 45 0A EF 14 FB 6F 45 F9
E 0450 EE 4B F6 32 DE 5C F3 F2 74 27 46 9B FF CC 2D 71
E 0460 E1 F5 F2 4B C0 32 DE 8C F9 45 70 EC 14 9C 6F D1
E 0470 5C EC F2 D1 7F C1 F1 F2 FE 8B A3 7E C1 ED FF 8F
E 0480 E6 8B F9 45 DD EE 14 B6 6F F1 E0 39 F9 02 EE FF
E 0490 39 F9 00 EE FF 39 F9 01 EE FF 39 F9 FF ED FF 39
E 04A0 F9 FE ED FF 39 F9 FD ED FF 39 F9 FC ED FF 39 F9
E 04B0 FB ED FF 17 8B FF D1 7F C1 10 EE FE 8A FC 14 F1
E 04C0 6F D1 7F C1 12 EE FE 8A FE 3C 17 CC FB 3C 14 92
E 04D0 6F 17 8B FF 14 98 6F F1 F8 41 FC FF 40 02 F0 46
E 04E0 F7 FF 03 0C 58 8B FC 14 EB 6F D1 7E C1 47 F2 52
E 04F0 F9 8B FA 45 A6 EE 14 26 45 CF EE 14 2B 41 EF FF
E 0500 40 8C F0 46 DE FF 03 0C 58 8B E0 41 FC FF 40 8C
E 0510 F0 46 DE FF 03 0C 58 8B EE 41 EF FF 40 4A F0 46
E 0520 DB FF 03 0C 58 8B FC 16 A6 00 17 EF FF 45 7E EE
E 0530 17 EA FF 17 CB FF 73 37 71 27 71 3F 3C F1 E0 4B
E 0540 C1 74 E1 F3 F2 32 DE 3C AD 4B FC CC 24 32 EF 4D
E 0550 F3 4B FD CC 24 32 EF A5 F1 E0 4B F6 32 DE 3C A9
E 0560 AE 03 0C 58 8B FE 06 A6 A1 3C 39 F9 12 EE FF 39
E 0570 F9 10 EE FF 47 FE BC 45 A5 F2 46 DF FF 32 DE 8C
E 0580 E9 D1 39 F9 10 EE FE 47 FF C2 14 F1 6F F1 E0 45
E 0590 2C ED 4B F6 32 DE 3C 47 FD C2 F1 E0 45 A5 F2 32
E 05A0 DE 8D 15 5C F3 F2 39 F9 11 EE FF CC 36 74 2E 74
E 05B0 E1 F3 F2 47 FD BD 32 DE 8D 18 5C EC F2 5C 0D EE
E 05C0 76 E9 0F EE 7F C1 F1 F2 FD 8B F5 7C 05 FF 8B FA
E 05D0 39 F9 12 EE FE CC 36 74 2E 47 FF BD 32 DE 8D 27
E 05E0 D1 74 F1 EC F2 D1 7F C1 F1 F2 FD 8A FC 46 E3 FF
E 05F0 17 A9 F9 8D 16 D1 7F C1 F1 F2 FD 8A F3 17 09 FA
E 0600 17 7C F9 3C 17 BD F9 8D 2A F1 F8 41 3A FD 40 C1
E 0610 ED 46 F7 FF 17 B7 00 8D E9 41 B5 FF 17 F5 F9 44
E 0620 42 FB D1 38 F9 C7 ED 2D FB 45 FA ED 16 39 FE 41
E 0630 0D FD 40 B1 ED 46 F7 FF 17 DB 00 8D E9 41 B5 FF
E 0640 17 19 FA 44 3A FB D1 38 F9 C7 ED 25 FB 45 F5 ED
E 0650 16 5D FE 41 CE FB 40 B1 ED 46 F7 FF 17 FF 00 8D
E 0660 E3 41 B5 FF 17 3D FA 44 88 F7 D1 38 F9 C7 ED 6E
E 0670 F7 D1 39 F9 02 EE FE 45 F0 ED 16 87 FE 41 CF FB
E 0680 40 B1 ED 46 F7 FF 17 29 01 8D E3 41 B5 FF 17 67
E 0690 FA 44 88 F7 D1 38 F9 C7 ED 6E F7 D1 39 F9 01 EE
E 06A0 FE 45 EB ED 16 B1 FE D1 7F C1 F1 F2 FD 8B D6 41
E 06B0 FF FF 40 A1 ED 46 F9 FF 17 5B 01 8C E4 D1 7F C1
E 06C0 F1 F2 FD 8A F8 D1 39 F9 03 EE FC 3C 45 8D ED D1
E 06D0 39 F9 12 EE FE 16 E2 FE 47 4B F9 44 A5 FF D1 38
E 06E0 F9 C7 ED ED F6 D1 38 F9 C5 ED 98 FF 45 E5 ED 17
E 06F0 72 FB 8D EE AC 41 B0 FF 17 D1 FA A4 D1 39 F9 00
E 0700 EE FE 16 8C FE 47 3B F9 44 A5 FF D1 38 F9 C7 ED
E 0710 74 F6 45 E0 ED 17 98 FB 8D EE AC 41 B0 FF 17 F7
E 0720 FA A4 D1 39 F9 FF ED FE 16 B2 FE 47 35 F9 44 A5
E 0730 FF D1 38 F9 C7 ED 79 F6 D1 38 F9 C5 ED 92 FF 45
E 0740 DB ED 17 C5 FB 8D EE AC 41 AA FF 17 24 FB A4 D1
E 0750 39 F9 FE ED FE 16 DF FE 47 42 F9 44 A5 FF D1 38
E 0760 F9 C7 ED 71 F6 D1 38 F9 C5 ED 98 FF 45 D6 ED 17
E 0770 F2 FB 8C FC 16 B9 00 D1 74 C9 EC
