Copy Link
Add to Bookmark
Report
Hexfiles Issue 4 File 007
HEX-FILES No. 4 File 007
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Wpc_Bats Family And Its Screen Payload
Ala-eh is an expression, with no specific meaning, used only in the
province of Batangas and by those who grew up in that province.
Based on this and texts found in the virus, we could safely assume
that the author of this virus is a Batangue¤o, likely from Lipa City.
The author is known by his initals, A.R.Jr. From one of the virus'
screen payloads, the A in A.R.Jr stands for Alf which could be a
shortened Alfredo or Alfred.
A.R.Jr professed his love to a girl with the initials S.V.H. which he
fondly calls She. But her real name is actually Shirly. A.R.Jr.
scrambled this to "ihsylr" probably to add a semblance of mystery.
I do not have the scantest idea what WPC BATS stands for. But judging
from the way initials found in local viruses goes, this might be the
name of a school in Batangas, in or near Lipa City. A.R.Jr probably
goes to school there or went to school there before.
Maybe we could ask the mayor of Lipa City, Vilma Santos, to conduct a
thorough investigation. Ate Vi, sa totoo lang.... :)
We could group the Wpc_Bats variants into two, Ala-Eh and Lipa. How
to differentiate the two would be difficult in the future if other
variants surfaces, either from the author or somebody who wants to
modify the virus. The way it looks, there are more in A.R.Jr's code
room.
At present three determinants are used to differentiate the two
groups are as follows:
1. The infective length of the virus. The infective length of Ala-Eh
variants varies due to paragraph alignment. The Lipa variants
infects programs at a constant length, with paragraph alignment
already compensated by the virus.
2. DIR stealth. Although all variants are stealth, only Lipa variants
exhibits stealth capability when DIR is executed.
3. FileDate.Year marking. Only Lipa variants add 100 years to the
year field of the file date stamp.
As mentioned earlier, this could be muddled by future appearances of
new variants of this virus family.
The Wpc_Bats family has several screen payloads. Some are shared by
variants and others are unique to a variant.
The most common payload is the random display of:
" a l a - e h !"
In Wpc_Bats.Lipa.3207, this was changed to:
" i h s y l r !"
because of you know who.
Another common payload is the display of the text found at the end of
the virus. Only Wpc_Bats.Lipa.2793 does not have, and therefore, does
not show this text. The common message for Ala-Eh group is:
ÜÜÜÜÜ Ü ÜÜÜÜÜ ÜÜÜÜÜ Ü Ü
³ÛÜÜÜÛ³Û ³ÛÜÜÜÛ ÜÜ ³ÛÜÜÜ ³ÛÜÜÜÛ
³ÛÄÄ¿Û³ÛÜÜÜܳÛÄÄ¿Û ³ÛÜÜÜܳÛÄÄ¿Û
ÀÙ ÀÙÀÄÄÄÄÙÀÙ ÀÙ ÀÄÄÄÄÙÀÙ ÀÙ
ÄÄÄÄÄÄ A.R.Jr W P C B A T S ÄÄÄÄÄÄÄ
Again, Wpc_Bats.Lipa.3207 went its own way with this display:
ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
º" Ûßßßß Û Û Ûßßß " I will always º
º ßßßßÛ ÛßßÛ Ûßß loves you ! º
º ßßßßß ß ß ßßßß [SVH] - LIPA º
º -o- Take a bunch of care -o- º
ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
The Alae-Eh group has another common payload among its variant. It is
the display in graphics mode of "ALA-EH!" superimposed in "ALF".
Each of the two Lipa variants has its own unique screen payload drawn
in text mode. In Wpc_Bats.Lipa.2793, has a yellow snake (or as
N.O.Phoenix describes it, a worm) formed by " a l a - e h" that
slithers all over your screen.
On the other hand, Wpc_Bats.Lipa.3207 would draw a big ALA-EH in the
middle of your screen using a yellow " i h s y l r" as its paint
brush. Unfortunately, for reasons known only to A.R.Jr, this was
disabled from the Int 1Ch handler and replaced with a system reboot.
To better illustrate these payloads, I put together five of them into
a program for you to enjoy with having to load the virus. The source
code to this program is also made available to you for whatever
purpose it might serve you.
Just enjoy the program!
-----------
A word of caution!
One routine requires a VGA/EGA adapter (Graphics payload - Program
Menu Selection 1). I do not know what would happen if this is used in
other adapters.
The program crashes your computer or makes it unstable that it would
crash a short time later if EMM386.EXE is installed. This might also
happen with other memory managers. This might be exhibited when you
execute the routine "Text Animated [Lipa.2793]" (Program Menu
Selection 2). N.O.Phoenix had tested this in his computer without
encountering any problems. But it sure creates havoc in mine.
If you executed "Text Animated [Lipa.2793]" and your computer did not
crash, you are very lucky indeed. But I advice you to reboot. It
might crash when you are doing something very important, like playing
games. :)
Thanks to N.O.Phoenix for trying to find out what causes the problem
and to A.R.Jr for providing the codes for your entertainment.
Again, Enjoy the program.
-----------
A short pahabol....
....actually, a kick butt for Frisk and Dr. Solomon :)
AVs, specifically, Frisk's F-Prot and Dr. Solomon's FindVirus, use
uninitialized data to aid the exactness of their programs' detection
of viruses. Although this is not only the determinant for a variant,
the data in question plays a major factor.
The two AVs usually use the vector of Int 1Ch saved by the virus and
used through a direct far call or a direct far jump. I do not exactly
know if the AVs use a range of values or just a specific dword value
for the data.
If the content of this data in an infected file does not have the
expected value, the virus is detected by F-Prot with ".unknown?" and
by FindVirus as "This virus is like".
The problem with this logic is that this dword value is not always
pointing to the original BIOS handler. There are non-viral TSR
programs that hook this Int 1Ch. Another, is that Wpc_Bats family
does not tunnel interrupts other than Int 21h.
At present, F-Prot 3.03 only detects with "exactness"
Wpc_Bats.Lipa.2793. I have seen FindVirus 7.88 flag three variants
with "This is virus is like WPCB!!!". This could also happen to other
variants. And, what would happen if F-Prot starts detecting with
"exactness" other variants, remains to be seen.
I have no control over the content of these data areas. If you get an
unknown variant detection, as mentioned above, from F-Prot and
FindVirus, you know what happened.
Hope you enjoy my crap!!! :)
ÄÄ WPC-SHOW.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;
; you can use tasm or masm, or any compiler of your cjoice to compile
; this program. it does not matter anyways. you might be required to
; do some fixes for other compilers.
;
; -- Putoksa Kawayan
;
dwb macro dat1
dw 0c27h
db dat1
endm
.model tiny
.code
scrwide equ 80
scrhigh equ 24
org 100h
begin: jmp start
opmenu db 13,10
db '[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~]',13,10
db '[ Wpc_Bats Screen Payload ]',13,10
db '[_____________________________]',13,10,10
db 'put together by Putoksa Kawayan for HEX-FILES No. 4',13,10
db 'with my sincerest apology to Alf [A.R.Jr].',13,10,10
db '----> Pressing any key returns you to this menu.',13,10,10
db 'Select payload:',13,10
db ' 1. Graphics [Ala-Eh.3072 Ala-Eh.3161]',13,10
db ' 2. Text Animated [Lipa.2793]',13,10
db ' 3. Text Animated [Lipa.3207 (disabled)]',13,10
db ' 4. Show Message [Ala-Eh.2273 Ala-Eh.3072 Ala-Eh.3161]',13,10
db ' 5. Show Message [Lipa.3207]',13,10
db ' Q. Quit',13,10,10
db 'Choose 1,2,3,4,5,Q ==> $'
keypres db ' ',13,10,10,'I am waiting for you to whack that keyboard.... $'
vidmode db ?
; data for textmode2 = you selects 3
lipatempo label byte
dwb ' ' ; ignore word dat in macro.
lipatext label byte ; textmode2 change this anyways
dwb 'r'
dwb ' '
dwb 'l'
dwb ' '
dwb 'y'
dwb ' '
dwb 's'
dwb ' '
dwb 'h'
dwb ' '
dwb 'i'
dwb ' '
lipacolumn equ byte ptr $
liparow equ byte ptr $+1
dwb 1
; data for textmode1 = you selects 2
tempo label byte
dwb ' '
texto label byte
dwb ' '
dwb 'h'
dwb ' '
dwb 'e'
dwb ' '
dwb '-'
dwb ' '
dwb 'a'
dwb ' '
dwb 'l'
dwb ' '
dwb 'a'
dwb ' '
column equ byte ptr $
row equ byte ptr $+1
dwb 1
;------------------- if you don't get alaehmes and lipames right in
;------------------- your computer, use their corresponding equivalent
;------------------- found at the end of the program listing
; data for showmess = you selects 4
alaehmes db ' ÜÜÜÜÜ Ü ÜÜÜÜÜ ÜÜÜÜÜ Ü Ü ',0
db ' ³ÛÜÜÜÛ³Û ³ÛÜÜÜÛ ÜÜ ³ÛÜÜÜ ³ÛÜÜÜÛ ',0
db ' ³ÛÄÄ¿Û³ÛÜÜÜܳÛÄÄ¿Û ³ÛÜÜÜܳÛÄÄ¿Û ',0
db ' ÀÙ ÀÙÀÄÄÄÄÙÀÙ ÀÙ ÀÄÄÄÄÙÀÙ ÀÙ ',0
db 'ÄÄÄÄÄÄ A.R.Jr W P C B A T S ÄÄÄÄÄÄÄ',13
; me big problem :)
bit db 13,10,10,'who robbed berto of sun rays?',13,10,'$'
; data for showmess = you selects 5
lipames db 'ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»',0
db 'º" Ûßßßß Û Û Ûßßß " I will always º',0
db 'º ßßßßÛ ÛßßÛ Ûßß loves you ! º',0
db 'º ßßßßß ß ß ßßßß [SVH] - LIPA º',0
db 'º -o- Take a bunch of care -o- º',0
metros db 'ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ',13
meswide equ ($-metros)-1
meshigh equ ($-lipames)/(meswide+1)
align 2
counter dw 'rr'
counter2 dw 'sd'
; data for graphics = you selects 1
horzdat dw 178,109,258,109,218,114,378,109,335,80,335,109,335,114
vertdat dw 80,210,80,220,80,260,80,337,80,380,80,410
; data for textmode2 = you selects 3
alaehdat dw 907h,508h,901h,406h,805h,201h,903h,904h,901h,907h,508h
dw 901h,406h,805h,201h,903h,801h,802h,404h,701h,702h,504h
dw 0d01h,903h,404h,0c01h,403h,904h,201h,104h,2d02h
db -1
align 2
start: cld
mov ah,0fh ; get vid mode coz show message and
int 10h ; show graphics needs it
mov [vidmode],al
setscrn:mov ax,600h
mov bx,700h
xor cx,cx
mov dx,184fh
int 10h ; clear screen
xor dx,dx
mov bh,dh
mov ah,2
int 10h ; shove cursor to top left
mov ah,9
mov dx,offset opmenu
int 21h ; show menu
call clearkb
getkey: xor ah,ah ; get your selects
int 16h
cmp al,'1' ; check for valid keys 1 to 5
jb getkey
cmp al,'5'
jbe gotkey
and al,5fh ; to upper
cmp al,'Q' ; is quit key?
jne getkey
mov ah,9 ; ask question? really bbbiiiggg problem :)
mov dx,offset bit
int 21h
mov ax,4c00h ; paalam.....
int 21h ; me ask you reboot. computer unstable!!!! :(
align 2
gotkey: push ax
mov bx,offset keypres
mov [bx],al
mov dx,bx
mov ah,9 ; print your key and remind you to
int 21h ; press key. you not see if selects 1
pop ax
and ax,7 ; gets low 3 bits
dec ax ; you selcts 1
jz isgraph
dec ax ; you selcts 2
jz istext1
dec ax ; you selcts 3
jz istext2
mov si,offset LipaMes ; you selcts 5
dec ax
jnz ismess
mov si,offset AlaehMes ; you selcts 4
ismess: call showmess ; same display engine only change message
jmp setscrn
align 2
isgraph:call showgraphics ; this needs ega/vga me no check kasi
jmp setscrn ; virus no check also
align 2
istext1:call showtextmode1 ; make snakey snakey on your screen
jmp setscrn ; make problem problem also
align 2
istext2:call showtextmode2 ; no know why alf not use? only lacks
jmp setscrn ; popa in virus code.
align 2
doiexit:push ax ; checks if theres a key in buffer
mov ah,1 ; is key pressed since start show?
int 16h
jz nokey ; couldnt make loop coz of showtextmode1
stc ; set found key
nokey: pop ax
ret
align 2
clearkb:mov ah,1 ; clear keyboard buffer
int 16h ; is kiss in kiss buff?
jz cleared ; no kiss
xor ah,ah
int 16h ; remove that kiss
jmp clearkb ; check again for more kiss
align 2
cleared:ret
align 2
showtextmode1: ; all belows from here are doing of alf
call clearkb ; me only maked it work (?) in here
nextloc:mov ah,2 ; want to know more about this, write alf
int 1ah ; where? you no ask me. :) me not know
xor dl,dl ; alf (a.r.jr) but svh/she/shirly must
mov bx,dx ; be proud of alf. :) know why? selects
mov cx,0 ; 3 or 5 to know why.... and alf/a.r.jr
mov dx,15ah ; "will always loves" svh/she/shirly
mov ax,'E5'
xchg si,ax
xchg dx,ax
test ax,ax
jz zroskip
mul bx
zroskip:jcxz skipzro
xchg cx,ax
mul si
add ax,cx
skipzro:xchg si,ax
mul bx
add bx,si
add ax,1
adc dx,0
mov ax,dx
cwd
and ax,7fffh
xor dx,dx
mov cx,9
div cx
cmp dl,1
jne random2
inc [column]
cmp [column],79
jb random2
mov [column],79
random2:cmp dl,2
jne random3
dec [column]
cmp [column],0
jg random3
mov [column],0
random3:cmp dl,3
jne random4
inc [row]
cmp [row],24
jb random4
mov [row],24
random4:cmp dl,4
jne random5
dec [row]
cmp [row],0
jg random5
mov [row],0
random5:cmp dl,5
jne random6
inc [column]
inc [row]
random6:cmp dl,6
jne random7
dec [column]
dec [row]
random7:cmp dl,7
jne random8
dec [row]
inc [column]
random8:cmp dl,8
jne toexit
inc [row]
dec [column]
toexit: call doiexit
jz starts
ret
align 2
starts: mov di,offset tempo
mov si,offset texto
mov [counter],14
nxtchar:
;-----------------------------------------------------------------------
; mov bp,4 ; if you feel the one in the virus is too
;nxtloop:mov cx,-1 ; fast in your computer, remove the comment
; align 2 ; at the start of each line of instructions
; nop ; in this block.
; nop ; to adjust speed of snake, increase/decrease
; loop $-1 ; the value of bp until you get the right
; dec bp ; speed for your computer.
; jnz nxtloop ; the speed in virus is set for 386 or 486.
;-----------------------------------------------------------------------
lodsw
stosw
mov dx,ax
mov bx,0
mov ah,2
int 10h
lodsb
inc di
mov ah,9
mov bl,0eh
mov cx,1
int 10h
dec [counter]
jnz nxtchar
mov [counter],20
dodelay:mov cx,-1
loop $
dec [counter]
jnz dodelay
jmp nextloc
align 2
writepixel:
mov ax,0c0fh
int 10h
ret
align 2
showgraphics:
mov ax,0eh
int 10h
mov cx,235
mov dx,55
mov bx,4bh
drawleftlega_alf:
call writepixel
inc dx
dec cx
dec bx
jnz drawleftlega_alf
mov cx,323
mov dx,55
mov bx,4bh
drawvertlinel_alf:
call writepixel
inc dx
dec bx
jnz drawvertlinel_alf
dec dx
mov bx,2dh
drawhorizlinel_alf:
call writepixel
add cx,2
dec bx
jnz drawhorizlinel_alf
mov cx,420
mov bx,4bh
drawvertlinef_alf:
call writepixel
dec dx
dec bx
jnz drawvertlinef_alf
mov bx,28h
drawtophorizlinef_alf:
call writepixel
add cx,2
dec bx
jnz drawtophorizlinef_alf
mov di,6
mov si,offset vertdat
drawverticals_alaeh:
lodsw
mov dx,ax
lodsw
mov cx,ax
mov bx,23h
verticalpixelloop:
call writepixel
inc dx
dec bx
jnz verticalpixelloop
dec di
jnz drawverticals_alaeh
mov cx,235
mov dx,55
mov bx,4bh
drawrightlega_alf:
call writepixel
inc dx
inc cx
dec bx
jnz drawrightlega_alf
mov si,offset horzdat
mov di,7
drawhorizontals_alaeh:
lodsw
mov cx,ax
lodsw
mov dx,ax
mov bx,23h
horizontalpixelloop:
call writepixel
inc cx
dec bx
jnz horizontalpixelloop
dec di
jnz drawhorizontals_alaeh
mov dx,82
mov cx,430
mov bx,0ch
drawexclamationloop1:
call writepixel
add dx,2
inc cx
dec bx
jnz drawexclamationloop1
mov bx,0dh
drawexclamationloop2:
call writepixel
sub dx,2
inc cx
dec bx
jnz drawexclamationloop2
mov bx,0ch
drawexclamationloop3:
sub cx,2
call writepixel
dec bx
jnz drawexclamationloop3
mov cx,435
mov dx,109
mov bx,7
drawexclamationloop4:
call writepixel
add cx,2
dec bx
jnz drawexclamationloop4
mov bx,3
drawexclamationloop5:
call writepixel
add dx,2
dec bx
jnz drawexclamationloop5
mov dx,114
mov bx,7
drawexclamationloop6:
call writepixel
sub cx,2
dec bx
jnz drawexclamationloop6
mov bx,3
drawexclamationloop7:
call writepixel
sub dx,2
dec bx
jnz drawexclamationloop7
mov cx,160
mov dx,120
mov bx,0a0h
drawexclamationloop8:
call writepixel
add cx,2
dec bx
jnz drawexclamationloop8
mov cx,302
mov dx,100
mov bx,0fh
drawexclamationloop9:
call writepixel
inc cx
dec bx
jnz drawexclamationloop9
call clearkb
waitforkey:
call doiexit
jnc waitforkey
mov ah,0
mov al,[vidmode]
int 10h
ret
align 2
showtextmode2:
mov di,offset lipatempo
mov ax,0f03h
mov cx,14
setloc: stosw
inc di
loop setloc
mov bp,offset alaehdat
getdata:mov si,bp
lodsw
cmp al,-1
jne _go_
call clearkb
getexit:call doiexit
jnc getexit
ret
align 2
_go_: mov [counter2],ax
nextshe:mov si,offset lipatempo
mov [counter],14
loadpos:lodsw
mov dx,ax
mov bx,0
mov ah,2
int 10h
mov bl,7eh
mov cx,2
cmp dh,16
jb yezrow
mov bl,14
mov cx,1
yezrow: mov al,[si]
mov ah,9
int 10h
cmp dh,15
ja lastrow
mov cx,1
mov al,0dbh
int 10h
lastrow:inc si
dec [counter]
jnz loadpos
mov di,offset lipatempo
mov si,offset lipatext
mov cx,13
copyshe:movsw
inc di
inc si
loop copyshe
mov ax,[counter2]
cmp al,1
jne check2
inc [lipacolumn]
check2: cmp al,2
jne check3
dec [lipacolumn]
check3: cmp al,3
jne check4
dec [liparow]
check4: cmp al,4
jne check5
inc [liparow]
check5: cmp al,5
jne check6
inc [lipacolumn]
inc [liparow]
check6: cmp al,6
jne check7
dec [lipacolumn]
dec [liparow]
check7: cmp al,7
jne check8
dec [liparow]
inc [lipacolumn]
check8: cmp al,8
jne checked
inc [liparow]
dec [lipacolumn]
checked:mov [counter],5
delay: mov cx,-1
loop $
dec [counter]
jnz delay
dec byte ptr [counter2][1]
jz nextdat
jmp nextshe
align 2
nextdat:add bp,2
jmp getdata
align 2
showmess:
mov ax,0b000h
cmp byte ptr [vidmode],7
je usemono
mov ax,0b800h
usemono:mov es,ax
mov di,((((scrhigh-meshigh)/2)*scrwide)+((scrwide-meswide)/2))*2
getchar:mov ah,es:[di+1]
or ah,15
lodsb
cmp al,13
je donesho
or al,al
jz nxtline
cmp al,20h
jne usechar
mov ax,es:[di]
usechar:stosw
jmp getchar
align 2
nxtline:add di,(scrwide-meswide)*2
jmp getchar
align 2
donesho:push cs
pop es
call clearkb
ispause:call doiexit
jnc ispause
ret
end begin
;------- this are the replacement for alaehmess and lipames
;------- if you have problems viewing extended chars in your
;------- computer.
;-------
;------- some compilers might require you to delete these portion.
lipames db 0c9h, 35 dup (0cdh),0bbh,0
db 0bah,34,32,0dbh,4 dup (0dfh),32,0dbh,32,32,0dbh,32,0dbh
db 0dfh,0dfh,0dfh,' " I will always ',0bah,0
db 0bah,32,32,4 dup (0dfh),0dbh,32,0dbh,0dfh,0dfh,0dbh,32
db 0dbh,0dfh,0dfh,5 dup (32),'loves you ! ',0bah,0
db 0bah,32,32,5 dup (0dfh),32,0dfh,32,32,0dfh,32,4 dup (0dfh)
db 5 dup (32),'[SVH] - LIPA ',0bah,0
db 0bah,' -o- Take a bunch of care -o- ',0bah,0
metros db 0c8h,35 dup (0cdh),0bch,13
meswide equ ($-metros)-1
meshigh equ ($-lipames)/(meswide+1)
alaehmes db 32,32,5 dup (0dch),32,0dch,5 dup (32),5 dup (0dch)
db 5 dup (32),5 dup (0dch),32,0dch,32,32,32,0dch,32,32,0
db 32,0b3h,0dbh,0dch,0dch,0dch,0dbh,0b3h,0dbh,32,32,32,32
db 0b3h,0dbh,0dch,0dch,0dch,0dbh,32,0dch,0dch,32,0b3h,0dbh
db 0dch,0dch,0dch,32,0b3h,0dbh,0dch,0dch,0dch,0dbh,32,32,0
db 32,0b3h,0dbh,0c4h,0c4h,0bfh,0dbh,0b3h,0dbh,0dch,0dch,0dch
db 0dch,0b3h,0dbh,0c4h,0c4h,0bfh,0dbh,32,32,32,32,0b3h,0dbh
db 0dch,0dch,0dch,0dch,0b3h,0dbh,0c4h,0c4h,0bfh,0dbh,32,32,0
db 32,0c0h,0d9h,32,32,0c0h,0d9h,0c0h,0c4h,0c4h,0c4h,0c4h,0d9h
db 0c0h,0d9h,32,32,0c0h,0d9h,32,32,32,32,0c0h,4 dup (0c4h)
db 0d9h,0c0h,0d9h,32,32,0c0h,0d9h,32,32,0
db 6 dup (0c4h),32,'A.R.Jr W P C B A T S ',7 dup (0c4h),13
ÄÄ WPC-SHOW.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
I could not recall if this was compiled in TASM or MASM. But if it got
a lot of cs: override, then it is MASM compiled.
ÄÄ WPC-SHOW.UUE STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
begin 644 wpc-show.com
MZ<T$#0I;?GY^?GY^?GY^?GY^?GY^?GY^?GY^?GY^?GY^?GY=#0I;("`@5W!C
M7T)A=',@4V-R965N(%!A>6QO860@("!=#0I;7U]?7U]?7U]?7U]?7U]?7U]?
M7U]?7U]?7U]?7U]=#0H*<'5T('1O9V5T:&5R(&)Y(%!U=&]K<V$@2V%W87EA
M;B!F;W(@2$58+49)3$53($YO+B`T#0IW:71H(&UY('-I;F-E<F5S="!A<&]L
M;V=Y('1O($%L9B!;02Y2+DIR72X-"@HM+2TM/B!0<F5S<VEN9R!A;GD@:V5Y
M(')E='5R;G,@>6]U('1O('1H:7,@;65N=2X-"@I396QE8W0@<&%Y;&]A9#H-
M"B`@(#$N($=R87!H:6-S(%M!;&$M16@N,S`W,B!!;&$M16@N,S$V,5T-"B`@
M(#(N(%1E>'0@06YI;6%T960@6TQI<&$N,C<Y,UT-"B`@(#,N(%1E>'0@06YI
M;6%T960@6TQI<&$N,S(P-R`H9&ES86)L960I70T*("`@-"X@4VAO=R!-97-S
M86=E(%M!;&$M16@N,C(W,R!!;&$M16@N,S`W,B!!;&$M16@N,S$V,5T-"B`@
M(#4N(%-H;W<@365S<V%G92!;3&EP82XS,C`W70T*("`@42X@475I=`T*"D-H
M;V]S92`Q+#(L,RPT+#4L42`]/3X@)"`-"@I)(&%M('=A:71I;F<@9F]R('EO
M=2!T;R!W:&%C:R!T:&%T(&ME>6)O87)D+BXN+B`D`"<,("<,<B<,("<,;"<,
M("<,>2<,("<,<R<,("<,:"<,("<,:2<,("<,`2<,("<,("<,:"<,("<,92<,
M("<,+2<,("<,82<,("<,;"<,("<,82<,("<,`2`@W-S<W-P@W"`@("`@W-S<
MW-P@("`@(-S<W-S<(-P@("#<("``(+/;W-S<V[/;("`@(+/;W-S<VR#<W""S
MV]S<W""SV]S<W-L@(``@L]O$Q+_;L]O<W-S<L]O$Q+_;("`@(+/;W-S<W+/;
MQ,2_VR`@`"#`V2`@P-G`Q,3$Q-G`V2`@P-D@("`@P,3$Q,39P-D@(,#9("``
MQ,3$Q,3$($$N4BY*<B`@5R!0($,@($(@02!4(%,@Q,3$Q,3$Q`T-"@IW:&\@
M<F]B8F5D(&)E<G1O(&]F('-U;B!R87ES/PT*),G-S<W-S<W-S<W-S<W-S<W-
MS<W-S<W-S<W-S<W-S<W-S<W-S;L`NB(@V]_?W]\@VR`@VR#;W]_?("`B($D@
M=VEL;"!A;'=A>7,@N@"Z("#?W]_?VR#;W]_;(-O?WR`@("`@;&]V97,@>6]U
M("$@(""Z`+H@(-_?W]_?(-\@(-\@W]_?WR`@("`@6U-62%T@+2!,25!!(+H`
MNB`@("UO+2`@5&%K92!A(&)U;F-H(&]F(&-A<F4@("UO+2`@N@#(S<W-S<W-
MS<W-S<W-S<W-S<W-S<W-S<W-S<W-S<W-S<W-S<V\#9!R<F1SL@!M``(!;0#:
M`'(`>@%M`$\!4`!/`6T`3P%R`%``T@!0`-P`4``$`5``40%0`'P!4`":`0<)
M"`4!"08$!0@!`@,)!`D!"0<)"`4!"08$!0@!`@,)`0@""`0$`0<"!P0%`0T#
M"00$`0P#!`0)`0($`0(M_Y#\M`_-$"ZB.@.X``:[``<SR;I/&,T0,]**_K0"
MS1"T";H#`<TAZ&(`,N3-%CPQ<O@\-782)%\\477NM`FZ4`3-(;@`3,TA4+L%
M`X@'B].T"<TA6"4'`$AT%4AT&$AT&[YS!$AU`[Z2`^AK`^N<D.A+`>N6D.@A
M`.N0D.AG`NN*D%"T`<T6=`'Y6,.T`<T6=`8RY,T6Z_3#D.CO_[0"S1HRTHO:
MN0``NEH!N#5%EI*%P'0"]^/C!9'WY@/!EO?C`]X%`0"#T@"+PIDE_W\STKD)
M`/?Q@/H!=1,N_@:/`RZ`/H\#3W(&+L8&CP-/@/H"=1,N_@Z/`RZ`/H\#`'\&
M+L8&CP,`@/H#=1,N_@:0`RZ`/I`#&'(&+L8&D`,8@/H$=1,N_@Z0`RZ`/I`#
M`'\&+L8&D`,`@/H%=0HN_@:/`R[^!I`#@/H&=0HN_@Z/`R[^#I`#@/H'=0HN
M_@Z0`R[^!H\#@/H(=0HN_@:0`R[^#H\#Z`[_=`+#D+]E`[YH`R['!E@%#@"M
MJXO0NP``M`+-$*Q'M`FS#KD!`,T0+O\.6`5UXR['!E@%%`"Y___B_B[_#E@%
M=?3IY?ZX#PS-$,.X#@#-$+GK`+HW`+M+`.CI_T))2W7XN4,!NC<`NTL`Z-C_
M0DMU^4J[+0#HS?^#P0)+=?>YI`&[2P#HOO]*2W7YNR@`Z+3_@\$"2W7WOP8`
MOG@%K8O0K8O(NR,`Z)S_0DMU^4]U[;GK`+HW`+M+`.B)_T)!2W7XOEP%OP<`
MK8O(K8O0NR,`Z'+_04MU^4]U[;I2`+FN`;L,`.A?_X/"`D%+=?:[#0#H4O^#
MZ@)!2W7VNPP`@^D"Z$+_2W7WN;,!NFT`NP<`Z#/_@\$"2W7WNP,`Z"?_@\("
M2W7WNG(`NP<`Z!C_@^D"2W7WNP,`Z`S_@^H"2W7WN:``NG@`NZ``Z/K^@\$"
M2W7WN2X!NF0`NP\`Z.C^04MU^>BU_>BH_7/[M``NH#H#S1##D+\[`[@##[D.
M`*M'XOR]D`6+]:T\_W4)Z(S]Z'_]<_O#+J-:!;X[`R['!E@%#@"MB]"[``"T
M`LT0LWZY`@"`_A!R!;,.N0$`B@2T"<T0@/X/=P>Y`0"PV\T01B[_#E@%=<V_
M.P.^/@.Y#0"E1T;B^RZA6@4\`74%+OX&8@,\`G4%+OX.8@,\`W4%+OX.8P,\
M!'4%+OX&8P,\!74*+OX&8@,N_@9C`SP&=0HN_@YB`R[^#F,#/`=U"B[^#F,#
M+OX&8@,\"'4*+OX&8P,N_@YB`R['!E@%!0"Y___B_B[_#E@%=?0N_@Y;!70#
MZ3C_@\4"Z1[_N`"P+H`^.@,'=`.X`+B.P+_*!2:*90&`S`^L/`UT%0K`=`L\
;('4#)HL%J^OFD(/'5NO@D`X'Z'O\Z&[\<_O#
`
end
ÄÄ WPC-SHOW.UUE ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
-=<{[* HF4 *]}>=-
