DOS32AWE disassembly

; ---------------------------------------------------------------------------

i31_handler     struc ; (sizeof=0x4)
func            dw ?
handler         dw ?                    ; offset (00010060)
i31_handler     ends

; ---------------------------------------------------------------------------

dfn_struc       struc ; (sizeof=0x6)
name            dw ?                    ; offset (00012F00)
namelen         dw ?
handler         dw ?                    ; offset (00012F00)
dfn_struc       ends

; ---------------------------------------------------------------------------

errtabentry     struc ; (sizeof=0x4)
category        db ?
kind            db ?
table           dw ?                    ; offset (00012F00)
errtabentry     ends

; ---------------------------------------------------------------------------

vec8            struc ; (sizeof=0x8)
_ip             dd ?
_cs             dw ?
_rsvd           dw ?
vec8            ends

; ---------------------------------------------------------------------------

str4            struc ; (sizeof=0x5)
str             db 5 dup(?)             ; string(C)
str4            ends

; ---------------------------------------------------------------------------

str2            struc ; (sizeof=0x3)
field_0         db 3 dup(?)             ; string(C)
str2            ends


;
; +-------------------------------------------------------------------------+
; |   This file has been generated by The Interactive Disassembler (IDA)    |
; |        Copyright (c) 2009 by Hex-Rays, <support@hex-rays.com>           |
; +-------------------------------------------------------------------------+
;
; Input MD5   : 9B2E82344CEA87814EDA8A3D5C35C8C5

; File Name   : C:\Users\Michael\Documents\Reversing\drivers\sound\DOS32AWE\DOS32AWE.EXE
; Format      : MS-DOS executable (EXE)
; Base Address: 1000h Range: 10000h-174C0h Loaded length: 6CC0h
; Entry Point : 12F0:2C6C

                .686p
                .mmx
                .model large

; ===========================================================================

; Segment type: Regular
ID32            segment byte public 'UNK' use16
                assume cs:ID32
                assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
ID_magic        db 'ID32'
ID_mode         db 3Fh
ID_maxpages     db 40h
ID_maxfpages    db 2
ID_callbacks    db 10h
ID_selectors    dw 100h
ID_rmstacks     db 8
ID_pmstacks     db 8
ID_rmstacklen   dw 20h
ID_pmstacklen   dw 20h
ID_maxextmem    dd 0FFFFFFFFh
ID_misc1        db 77h                  ; DOS32AWE: -report modified ints
                                        ;           +cls on exception
ID_misc2        db 49h                  ; DOS32AWE: +lock configuration
ID_lowmembuf    dw 200h
ID_version      dw 90Ch
ID_rsvd         dw 0
aDos32a         db 'DOS/32A',0
aCopyrightC19962006ByNa db 'Copyright (C) 1996-2006 by Narech K.',0
a100721         db '10/07/21',0
a234911         db '23:49:11',0
                db    0
                db    0
                db    0
                db    0
                db    0
ID32            ends

; ===========================================================================

; Segment type: Pure code
KERNEL          segment byte public 'CODE' use16
                assume cs:KERNEL
                assume es:nothing, ss:nothing, ds:KERNEL, fs:nothing, gs:nothing
pm32_mode       db 0FFh
pm32_maxpages   db 0FFh
pm32_maxfpages  db 0FFh
pm32_callbacks  db 0FFh
pm32_selectors  dw 0FFFFh
pm32_rmstacks   db 0FFh
pm32_pmstacks   db 0FFh
pm32_rmstacklen dw 0FFFFh
pm32_pmstacklen dw 0FFFFh
pm32_maxextmem  dd 0FFFFFFFFh
client_call     dw 2 dup(0)
client_version  dw 0
kernel_code     dw 0
cputype         db 0
fputype         db 0
pmodetype       db 0
pagetables      db 0
picslave        db 0
picmaster       db 0
_rsvd1          db 0
A20_state       db 0
cpuidlvl        dd 0
codebase        dd 0
dpmiepmode      dd 0
selzero         dw 18h
seldata         dw 10h
selcallback     dw 48h
gdtseg          dw 0
gdtlimit        dw 0
gdtbase         dd 0
idtseg          dw 0
idtlimit        dw 7FFh
idtbase         dd 0
rmidtlimit      dw 3FFh
rmidtbase       dd 0
rmtopmswrout    dw offset v_rmtopmsw
pmtormswrout    dd 115Ch
xms_call        dd 0
xms_data        dd 0
xms_handle      dw 0
vcpi_cr3        dd 0
vcpi_gdtaddx    dd offset gdtlimit
vcpi_idtaddx    dd offset idtlimit
vcpi_selldt     dw 0
vcpi_seltss     dw 20h
vcpi_eip        dd offset v_rmtopmswpm
vcpi_cs         dw 8
vcpi_calleip    dd 0
vcpi_callcs     dw 28h
vcpi_allocmem   dw 0
vcpistrucaddx   dd offset vcpi_cr3
vcpiswitchstack dd 0
int31h_cache_fn dw 0EEFFh
int31h_cache_ptr dw offset int31_EEFF
                align 4

; =============== S U B R O U T I N E =======================================

; also mem_ptr

pm32_info       proc far
                cld
                push    ds

loc_100E6:
                push    es
                push    cs

mem_free:
                push    cs
                pop     ds
                pop     es

mem_top_minus1:                         ; also _pc_irqrmtopm
                call    cpu_detect
                cmp     al, 3

mem_used:                               ; also base of real mode alias table
                mov     ax, 1
                jnb     short @@0
                jmp     @@fail
; ---------------------------------------------------------------------------

@@0:
                call    fpu_detect
                mov     ah, 30h
                int     21h             ; DOS - GET DOS VERSION
                                        ; Return: AL = major version number (00h for DOS 1.x)
                cmp     al, 4
                mov     ax, 0
                jb      @@fail
                mov     ax, 4300h
                int     2Fh             ; - Multiplex - XMS - INSTALLATION CHECK
                                        ; Return: AL = 80h XMS driver installed
                                        ; AL <> 80h no driver
                cmp     al, 80h ; '€'
                jnz     short @@1
                push    es
                mov     ax, 4310h
                int     2Fh             ; - Multiplex - XMS - GET DRIVER ADDRESS
                                        ; Return: ES:BX -> driver entry point
                mov     word ptr xms_call, bx

loc_1011B:
                mov     word ptr xms_call+2, es
                mov     ah, 30h
                int     21h             ; DOS - GET DOS VERSION
                                        ; Return: AL = major version number (00h for DOS 1.x)
                mov     ah, 88h ; 'ˆ'
                xor     bx, bx
                call    xms_call
                test    bl, bl
                jz      short @@xms1
                mov     ah, 8

_pc_irqcbrmtopm:                        ; also irqset_rm - 3
                call    xms_call

irqset_pm_minus1:
                movzx   eax, ax

irqtabrm_minus1:
@@xms1:
                mov     xms_data, eax
                pop     es
                pushf
                pop     ax
                and     ah, 0CFh
                push    ax
                popf
                pushf
                pop     ax
                test    ah, 30h
                jz      short @@4

@@1:
                call    @@detect_VCPI
                call    @@detect_DPMI
                smsw    ax
                and     al, 1
                mov     ax, 2
                jnz     short @@fail

@@4:
                cmp     xms_data, 0
                setnz   ch
                mov     bx, 80h ; '€'

@@vcpi:
                movzx   ax, pm32_rmstacks
                imul    ax, pm32_rmstacklen
                add     bx, ax
                movzx   ax, pm32_pmstacks

irqtab_pm_minus1:
                imul    ax, pm32_pmstacklen

irqtab_pm_plus4:
                add     bx, ax
                movzx   ax, pm32_callbacks
                imul    ax, 19h
                add     ax, 0Fh
                shr     ax, 4
                add     bx, ax
                mov     ax, pm32_selectors
                add     ax, 0Bh
                shr     ax, 1
                add     bx, ax

@@done:
                xor     ax, ax
                mov     cl, cputype
                mov     pmodetype, ch
                mov     dx, (offset get_default_config - 0FFFFD6B0h)
                mov     di, offset v_init__cbdata1B

@@exit:
                pop     es
                pop     ds
                retf
; ---------------------------------------------------------------------------

@@fail:
                stc
                jmp     short @@exit
; ---------------------------------------------------------------------------

@@detect_DPMI:
                pop     bp
                mov     ax, 1687h
                int     2Fh             ; - Multiplex - MS WINDOWS - Mode Interface - INSTALLATION CHECK
                                        ; Return: AX = 0000h if installed, BX = flags
                                        ; CL = processor type, DH = DPMI major version
                                        ; DL = DPMI minor version
                                        ; SI = number of paragraphs
                                        ; ES:DI -> DPMI mode-switch entry point
                test    ax, ax
                jnz     short @@d0
                mov     ax, 1
                cmp     cl, 3
                jb      short @@fail
                mov     al, 3
                test    bl, 1
                jz      short @@fail
                mov     word ptr dpmiepmode, di
                mov     word ptr dpmiepmode+2, es
                mov     bx, si
                mov     ch, 3
                jmp     short @@done
; ---------------------------------------------------------------------------

@@d0:
                jmp     bp
; ---------------------------------------------------------------------------

@@detect_VCPI:
                pop     bp
                xor     ax, ax
                mov     es, ax
                assume es:nothing
                mov     ax, es:19Ch
                or      ax, es:19Eh
                jz      short @@d0
                mov     ax, 0DE00h
                int     67h             ;  - LIM EMS Program Interface - INSTALLATION CHECK
                                        ; Return: AH = 00h    VCPI is present, BH = major version number
                                        ; BL = minor version number, AH nonzero  VCPI not present
                test    ah, ah
                jnz     short @@d0
                mov     ax, 0DE0Ah
                int     67h             ;  - LIM EMS Program Interface - GET 8259 INTERRUPT VECTOR MAPPINGS
                                        ; Return: AH = 00h successful, BX = first vector used by master 8259 (IRQ0)
                                        ; CX = first vector used by slave 8259 (IRQ8)
                                        ; AH nonzero: failed

exctabpm_minus3:
                mov     picmaster, bl

exctabpm_plus1:
                mov     picslave, cl
                mov     ax, 4
                cmp     bl, cl
                jz      short @@fail
                cmp     bl, 30h
                jz      short @@fail
                cmp     cl, 30h
                jz      short @@fail
                cmp     cl, 8
                jz      short @@fail
                test    bl, bl
                jz      short @@fail
                test    cl, cl
                jz      short @@fail
                mov     edx, xms_data
                mov     ecx, edx
                jecxz   @@v1
                test    pm32_mode, 8
                jz      short loc_10237
                call    xms_allocmem
                mov     di, dx
                dec     ax
                jz      short @@v1

loc_10237:
                xor     ecx, ecx

@@v1:
                mov     ax, 0DE03h
                int     67h             ;  - LIM EMS Program Interface - GET NUMBER OF FREE 4K PAGES
                                        ; Return: AH = 00h  successful, EDX = number of free 4K pages
                                        ; AH nonzero: failed
                push    es
                push    ecx
                push    edx
                push    di
                test    pm32_mode, 4
                jz      short @@v1a     ; __linkproc__ v1a
                mov     ah, 48h ; 'H'
                mov     bx, 100h
                int     21h             ; DOS - 2+ - ALLOCATE MEMORY
                                        ; BX = number of 16-byte paragraphs desired
                jb      short @@v1a     ; __linkproc__ v1a
                mov     es, ax
                assume es:nothing
                xor     di, di
                sub     sp, 18h
                mov     si, sp
                push    ds
                push    ss
                pop     ds
                mov     ax, 0DE01h
                int     67h             ;  - LIM EMS Program Interface - GET PROTECTED MODE INTERFACE
                                        ; ES:DI -> 4K page table buffer
                                        ; DS:SI -> three descriptor table entries in GDT
                                        ; Return: AH = 00h successful, AH = nonzero  failed
                pop     ds
                add     sp, 18h
                mov     ah, 49h
                int     21h             ; DOS - 2+ - FREE MEMORY
                                        ; ES = segment address of area to be freed
                mov     eax, 1000h
                sub     ax, di
                shr     ax, 2
                jmp     short @@v1b
; ---------------------------------------------------------------------------

; __linkproc__ v1a
@@v1a:
                xor     eax, eax

tempw1:
@@v1b:
                pop     di

tempw2_aka_tempd1:
                pop     edx
                pop     ecx
                pop     es
                assume es:nothing

oldcr0:
                mov     esi, ecx

oldint15h:
                shr     esi, 2

oldint1Bh_and_1Ch:
                lea     esi, [edx+esi+3FFh]

oldint21h:
                sub     esi, eax

oldint23h_minus1:
                jnb     short @@v1c
                adc     esi, eax

oldint24h:
@@v1c:
                shr     esi, 0Ah

oldint2Fh:                              ; __linkproc__ v2
                jecxz   @@v2

newint1Bh:
                mov     dx, di
                mov     ah, 0Ah

newint1Ch:
                call    xms_call

; __linkproc__ v2
@@v2:
                movzx   ax, pm32_maxpages

newint24h:
                cmp     ax, si
                jbe     short @@v3

id32_mem_free:
                mov     ax, si

@@v3:
                test    ax, ax

id32_mem_ptr:
                jnz     short @@v5
                pushad

id32_mem_vcpi:
                mov     bp, sp

id32_process_id_minus2:
                mov     ax, 0FF88h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION

pagetablebase_minus5:                   ; also id32_tsrmode - 3
                cmp     eax, 'ID32'     ; also id32_spawned_id - 1
                jnz     short @@v4

pagetabletop:
                mov     [bp+1Ch], si

@@v4:
                popad

pagetablefree:
@@v5:
                cmp     al, 40h ; '@'
                jbe     short phystabletop_minus2

phystablebase:
                mov     al, 40h ; '@'

phystabletop_minus2:
                mov     pagetables, al
                add     al, pm32_maxfpages
                shl     ax, 8
                add     ax, 100h+100h+0FFh+7+80h

_pc_intrmtopm_minus1:
                mov     bx, ax
                mov     ch, 2

_pc_intpmtorm:
                jmp     @@vcpi
; ---------------------------------------------------------------------------
                jmp     bp
pm32_info       endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================

; also _pc_irqrmtopm

cpu_detect      proc near
                cli
                mov     cl, 2
                pushf

_pc_irqpmtorm:
                pop     ax
                or      ax, 0F000h

loc_102F4:
                push    ax
                popf
                pushf
                pop     ax

_pc_irqcbpmtorm:
                and     ax, 0F000h

_pc_cbrmtopm:                           ; also _pc_cbpmtorm-1
                jnz     short @@1
                jmp     short @@x1
; ---------------------------------------------------------------------------

; __linkproc__ 1
@@1:                                    ; also _pc_cbpmtorm-1
                inc     cl
                pushfd

pmstacklen_minus1:
                pop     eax
                mov     edx, eax

pmstackbase_and_top:
                xor     eax, 40000h
                push    eax

pmstacktop2:
                popfd
                pushfd

rmstacklen:
                pop     eax

rmstackbase_and_top:
                xor     eax, edx

rmstacktop2:
                jnz     short @@2
                jmp     short @@x1
; ---------------------------------------------------------------------------

@@2:
                inc     cl
                push    edx
                popfd

rmstackesp:
                pushfd
                pushfd

rmstackss:
                pop     eax
                mov     edx, eax

callbackbase_and_seg:
                xor     eax, 200000h
                push    eax

irqcallbackptr:
                popfd

oldNMI:
                pushfd
                pop     eax

newNMI:
                xor     eax, edx
                jnz     short @@3
                jmp     short @@x2
; ---------------------------------------------------------------------------

@@3:
                xor     eax, eax
                cpuid
                mov     cpuidlvl, eax
                mov     eax, 1
                cpuid
                and     ah, 0Fh
                mov     cl, ah

@@x2:
                popfd
                xor     eax, eax
                xor     edx, edx

@@x1:
                mov     al, cl
                mov     cputype, al
                sti
                retn
cpu_detect      endp


; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame fpd=4

fpu_detect      proc near

_fpu_type       = word ptr -4
_control_word   = word ptr -2

                push    large 0
                mov     bp, sp
                fninit
                fnstcw  [bp+4+_control_word]
                mov     ax, [bp+4+_control_word]
                cmp     ah, 3
                jnz     short loc_103C7
                mov     [bp+4+_fpu_type], 1
                and     [bp+4+_control_word], 0FF7Fh
                wait
                fldcw   [bp+4+_control_word]
                fdisi
                fstcw   [bp+4+_control_word]
                wait
                test    [bp+4+_control_word], 80h
                jnz     short loc_103C7
                mov     [bp+4+_fpu_type], 2
                fninit
                wait
                fld1
                wait
                fldz
                wait
                fdivp   st(1), st
                wait
                fld     st
                wait
                fchs
                wait
                fcompp
                fstsw   ax
                fclex
                wait
                sahf
                jz      short loc_103C7
                mov     [bp+4+_fpu_type], 3
                mov     al, cputype
                cmp     al, 4
                jb      short loc_103C7
                mov     byte ptr [bp+4+_fpu_type], al

loc_103C7:
                pop     eax
                and     eax, 7
                jz      short loc_103D9
                mov     cx, 8

loc_103D2:
                fldz
                loop    loc_103D2
                finit

loc_103D9:
                mov     fputype, al
                retn
fpu_detect      endp

; ---------------------------------------------------------------------------
                align 4

; =============== S U B R O U T I N E =======================================


pm32_init_new   proc far

; FUNCTION CHUNK AT 0526 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 0550 SIZE 0000011F BYTES
; FUNCTION CHUNK AT 07AF SIZE 0000047A BYTES

                push    ax              ; DOS32AWE ADDITION: This seems to patch AWEUTIL
                push    bx
                push    ds
                xor     ax, ax
                mov     ds, ax
                assume ds:nothing
                mov     ax, ds:0Ah
                mov     bx, ds:8
                add     bx, 9
                mov     ds, ax
                assume ds:KERNEL
                cmp     dword ptr [bx], 40A861E4h
                jnz     short loc_1040E
                cmp     byte ptr [bx+4], 74h ; 't'
                jnz     short loc_1040E
                mov     dword ptr [bx], 90909090h
                mov     word ptr [bx+4], 9090h

loc_1040E:
                pop     ds
                pop     bx
                pop     ax              ; DOS32AWE ADDITION END

pm32_init:
                cld
                pushad
                push    ds
                push    cs
                pop     ds
                xor     eax, eax
                mov     kernel_code, cs
                mov     client_version, bx
                mov     client_call, dx
                mov     ax, cs
                shl     eax, 4
                mov     codebase, eax
                add     vcpi_gdtaddx, eax
                add     vcpi_idtaddx, eax
                add     vcpistrucaddx, eax
                btr     pm32_maxextmem, 1Fh
                push    es
                push    cs
                pop     es
                assume es:KERNEL
                mov     di, offset pm32_info ; also mem_ptr
                mov     cx, 17Eh
                xor     ax, ax
                rep stosw
                pop     es
                assume es:nothing
                mov     bp, sp
                mov     [bp+2], ax
                mov     ax, 0FF88h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                cmp     eax, 'ID32'
                jnz     short loc_10490
                mov     [bp+2], bx
                cmp     bx, client_version
                jnz     short loc_10490
                mov     dword ptr id32_mem_free, ecx
                mov     dword ptr id32_mem_ptr, edx
                mov     dword ptr id32_mem_vcpi, edi
                shr     esi, 10h
                inc     si
                mov     word ptr id32_process_id_minus2+2, si
                mov     pm32_maxextmem, 0

loc_10490:
                movzx   bx, pmodetype
                add     bx, bx
                jmp     word ptr @@init[bx]
; ---------------------------------------------------------------------------
@@init:
                dw offset r_init
                dw offset x_init
                dw offset v_init__cbdata1B
                dw offset d_init
; ---------------------------------------------------------------------------

dxvr_init:
                xor     ax, ax
                mov     cx, 1
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE LDT DESCRS
                                        ; CX = number of descriptors to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful, AX = base selector
                jnb     short @@0

@@err:
                mov     ax, 4CFFh
                int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
                                        ; AL = exit code
; ---------------------------------------------------------------------------

@@0:
                mov     bp, sp
                mov     bx, ax
                mov     ax, 7
                mov     dx, [bp+24h]
                mov     cx, dx
                shl     dx, 4
                shr     cx, 0Ch
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT BASE ADDRESS
                                        ; BX = selector, CX:DX = linear base address
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                inc     ax
                xor     cx, cx
                mov     dx, 0FFFFh
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT LIMIT
                                        ; BX = selector, CX:DX = segment limit
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                inc     ax
                mov     dx, cs
                lar     cx, dx
                shr     cx, 8
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET DESCRIPTOR ACCESS RIGHTS
                                        ; BX = selector, CL = access rights/type byte
                                        ; CH = 80386 extended rights/type byte (32-bit DPMI implementations only)
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     [bp+24h], bx
                cmp     cs:pmodetype, 3
                jz      short @@1_dxvr
                push    ds
                mov     ds, cs:seldata
                mov     client_call+2, bx
                pop     ds

@@1_dxvr:
                xor     bx, bx

init_done:
                mov     [bp+1Eh], bx
                jb      short @@1_id
                mov     eax, dword ptr cs:mem_free
                mov     edx, dword ptr cs:pm32_info ; also mem_ptr
                mov     [bp+1Ah], eax
                mov     [bp+16h], edx
                or      eax, edx
                jnz     short @@1_id
                call    init_done_id32

@@1_id:
                pop     ds
                popad
                mov     bx, cs
                mov     si, word ptr cs:id32_process_id_minus2+2
                cld
                retf
pm32_init_new   endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


init_done_id32  proc near
                cmp     cs:pmodetype, 3
                jz      short locret_10585
                mov     ds, cs:seldata
                cmp     word ptr id32_process_id_minus2+2, 0
                jz      short locret_10585
                mov     eax, dword ptr id32_mem_free
                mov     edx, dword ptr id32_mem_ptr
                mov     [bp+1Ah], eax
                mov     [bp+16h], edx
                mov     dword ptr mem_free, eax
                mov     dword ptr pm32_info, edx ; also mem_ptr
                lea     ecx, [eax+10h]
                lea     eax, [ecx+edx]
                mov     dword ptr mem_top_minus1+1, eax
                mov     al, pmodetype
                cmp     al, 0
                jz      short locret_10585
                cmp     al, 1
                jz      short locret_10585
                push    es

loc_1056A:
                mov     esi, dword ptr id32_mem_vcpi
                mov     edi, dword ptr pagetablefree
                mov     es, selzero
                mov     ds, selzero
                shr     ecx, 0Ch
                rep movs dword ptr es:[edi], dword ptr [esi]
                pop     es

locret_10585:
                retn
init_done_id32  endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR pm32_init_new

d_init:
                pop     ds
                mov     ax, 1
                call    cs:dpmiepmode
                push    ds
                jnb     dxvr_init
                mov     bx, 6
                cmp     ax, 8011h
                stc
                jz      init_done
                dec     bx
                jmp     init_done
; END OF FUNCTION CHUNK FOR pm32_init_new
; ---------------------------------------------------------------------------
                align 10h
; START OF FUNCTION CHUNK FOR pm32_init_new

v_init__cbdata1B:
                xor     eax, eax
                mov     ax, es
                add     ax, 0FFh
                xor     al, al
                mov     es, ax
                assume es:nothing
                mov     dx, ax
                shl     eax, 4
                add     eax, 1000h
                mov     dword ptr pagetablebase_minus5+5, eax ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                add     eax, 1000h
                movzx   ecx, pagetables
                shl     ecx, 0Ch
                add     eax, ecx

cbdata1Ch:
                mov     dword ptr pagetabletop+1, eax
                mov     dword ptr phystablebase, eax
                movzx   ecx, pm32_maxfpages
                shl     ecx, 0Ch
                add     eax, ecx
                mov     dword ptr phystabletop_minus2+2, eax
                xor     di, di
                xor     eax, eax
                mov     cx, 800h
                rep stosd
                mov     gs, dx
                assume gs:nothing
                mov     ax, dx
                add     ax, 100h
                mov     es, ax
                assume es:nothing
                mov     fs, ax
                assume fs:nothing
                sub     sp, 18h
                mov     si, sp

cbdata23h:
                xor     di, di
                push    ds
                push    ss
                pop     ds
                mov     ax, 0DE01h
                int     67h             ;  - LIM EMS Program Interface - GET PROTECTED MODE INTERFACE
                                        ; ES:DI -> 4K page table buffer
                                        ; DS:SI -> three descriptor table entries in GDT
                                        ; Return: AH = 00h successful, AH = nonzero  failed
                pop     ds
                push    di
                mov     vcpi_calleip, ebx

@@1_v:
                and     byte ptr es:[di+1], 0F1h
                sub     di, 4
                jnb     short @@1_v
                mov     cx, dx
                shr     cx, 8
                mov     ax, 0DE06h
                int     67h             ;  - LIM EMS Program Interface - GET PHYS ADDR OF PAGE IN FIRST MB
                                        ; CX = page number (linear address shifted right 12 bits)
                                        ; Return: AH = 00h successful, EDX = physical address of page
                                        ; AH nonzero: invalid page number (AH = 8Bh recommended)
                and     dx, 0F000h
                mov     vcpi_cr3, edx
                mov     cx, es
                shr     cx, 8

cbdata24:
                mov     ax, 0DE06h
                int     67h             ;  - LIM EMS Program Interface - GET PHYS ADDR OF PAGE IN FIRST MB
                                        ; CX = page number (linear address shifted right 12 bits)
                                        ; Return: AH = 00h successful, EDX = physical address of page
                                        ; AH nonzero: invalid page number (AH = 8Bh recommended)
                and     dh, 0F0h
                mov     dl, 7
                mov     gs:0, edx
                mov     ax, es
                add     ax, 100h
                mov     es, ax
                assume es:nothing
                mov     si, ax
                mov     al, pagetables
                mov     ebx, 1
                call    vcpi_setup_pagetables
                mov     ax, gs
                add     ax, 80h ; '€'
                mov     gs, ax
                assume gs:nothing
                mov     al, pm32_maxfpages
                xor     ebx, ebx
                call    vcpi_setup_pagetables
                pop     di
                xor     eax, eax
                test    pm32_mode, 4
                jnz     short @@2_v
                mov     di, 1000h

@@2_v:
                mov     ax, di
                add     eax, dword ptr pagetablebase_minus5+5 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                mov     dword ptr pagetablefree, eax
                push    si
                push    es
                call    vcpi_alloc_ems
                pop     es
                assume es:nothing
                pop     si
                push    si
                xor     di, di
                mov     cx, 34h ; '4'
                xor     ax, ax
                rep stosw
                mov     eax, vcpi_cr3
                mov     es:1Ch, eax

loc_106AE:
                mov     dword ptr es:64h, 680000h
                add     si, 7
                mov     es, si
                mov     rmtopmswrout, offset v_rmtopmsw
                mov     pmtormswrout, offset v_pmtormsw
                jmp     vxr_init
; END OF FUNCTION CHUNK FOR pm32_init_new

; =============== S U B R O U T I N E =======================================


vcpi_setup_pagetables proc near
                push    bp
                movzx   bp, al
                test    bp, bp
                jz      short loc_10705

loc_106D7:
                mov     cx, si
                shr     cx, 8
                mov     ax, 0DE06h
                int     67h             ;  - LIM EMS Program Interface - GET PHYS ADDR OF PAGE IN FIRST MB
                                        ; CX = page number (linear address shifted right 12 bits)
                                        ; Return: AH = 00h successful, EDX = physical address of page
                                        ; AH nonzero: invalid page number (AH = 8Bh recommended)
                and     dh, 0F0h
                mov     dl, 7
                mov     gs:0[ebx*4], edx
                add     si, 100h
                mov     es, si
                xor     di, di
                xor     eax, eax
                mov     cx, 400h
                rep stosd
                inc     bx
                dec     bp
                jnz     short loc_106D7

loc_10705:
                pop     bp
                retn
vcpi_setup_pagetables endp


; =============== S U B R O U T I N E =======================================


vcpi_alloc_ems  proc near
                push    fs
                pop     es
                assume es:nothing
                movzx   eax, pagetables
                shl     eax, 16h
                mov     ecx, 1000h
                sub     cx, di
                and     cl, 0FCh
                shl     ecx, 0Ah
                add     eax, ecx
                mov     ecx, pm32_maxextmem
                cmp     ecx, eax
                jbe     short @@0
                mov     ecx, eax

@@0:
                xor     ebx, ebx
                jecxz   @@done

@@1:
                cmp     di, 1000h
                jb      short @@2
                mov     ax, es
                add     ax, 100h
                mov     es, ax
                assume es:nothing
                xor     di, di

@@2:
                mov     ax, 0DE04h
                int     67h             ;  - LIM EMS Program Interface - ALLOCATE A 4K PAGE
                                        ; Return: AH = 00h successful, EDX = physical address of allocated page
                                        ; AH nonzero: failed
                test    ah, ah
                jnz     short @@3
                and     dh, 0F0h
                mov     dl, 7
                mov     es:[di], edx
                add     di, 4
                inc     bx
                sub     ecx, 1000h
                ja      short @@1

@@3:
                mov     vcpi_allocmem, bx
                cmp     ecx, 1000h
                jb      short loc_1077E
                test    pm32_mode, 8
                jz      short loc_1077E
                call    vcpi_alloc_xms

loc_1077E:
                shl     ebx, 0Ch
                jz      short @@done
                mov     dword ptr mem_free, ebx
                mov     eax, dword ptr pagetablefree
                sub     eax, dword ptr pagetablebase_minus5+5 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                shl     eax, 0Ah
                mov     dword ptr pm32_info, eax ; also mem_ptr

@@done:
                retn
vcpi_alloc_ems  endp


; =============== S U B R O U T I N E =======================================


vcpi_alloc_xms  proc near
                push    ebx
                shr     ecx, 0Ah
                and     cl, 0FCh

@@1:
                mov     edx, ecx
                jecxz   @@done
                call    xms_allocmem
                dec     ax
                jz      short @@2
                sub     ecx, 4
                jnb     short @@1
                jmp     short @@done
; ---------------------------------------------------------------------------

@@2:
                mov     xms_handle, dx
                mov     ah, 0Ch
                call    xms_call
                dec     ax
                jz      short @@3
                xor     dx, dx
                xchg    dx, xms_handle
                mov     ah, 0Ah
                call    xms_call
                jmp     short @@done
; ---------------------------------------------------------------------------

@@3:
                shl     edx, 10h
                mov     dx, bx
                shr     ecx, 2
                movzx   eax, cx
                pop     ebx
                add     ebx, eax
                push    ebx

@@4:
                cmp     di, 1000h
                jb      short @@5
                mov     ax, es
                add     ax, 100h
                mov     es, ax
                assume es:nothing
                xor     di, di

@@5:
                and     dh, 0F0h
                mov     dl, 7
                mov     es:[di], edx
                add     di, 4
                add     edx, 1000h
                loop    @@4

@@done:
                pop     ebx
                retn
vcpi_alloc_xms  endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR pm32_init_new

x_init:
                mov     ah, 7
                call    xms_call
                mov     A20_state, al
                mov     ah, 3
                call    xms_call
                mov     bx, 7
                dec     ax
                stc
                jnz     init_done
                mov     eax, xms_data
                mov     edx, pm32_maxextmem
                shr     edx, 0Ah
                cmp     edx, eax
                jbe     short loc_1083C
                mov     edx, eax

loc_1083C:
                mov     esi, edx
                test    edx, edx
                jz      short loc_10876
                call    xms_allocmem
                dec     ax
                jnz     short loc_10876
                mov     xms_handle, dx
                mov     ah, 0Ch
                call    xms_call
                dec     ax
                jz      short loc_10865
                xor     dx, dx
                xchg    dx, xms_handle
                mov     ah, 0Ah
                call    xms_call
                jmp     short loc_10876
; ---------------------------------------------------------------------------

loc_10865:                              ; also mem_ptr
                mov     word ptr pm32_info, bx
                mov     word ptr loc_100E6, dx
                shl     esi, 0Ah
                mov     dword ptr mem_free, esi

loc_10876:
                jmp     xr_init
; ---------------------------------------------------------------------------

r_init:
                call    enable_A20
                mov     bx, 7
                jb      init_done
                push    es
                push    ss
                pop     es
                assume es:nothing
                xor     eax, eax
                mov     ebx, eax
                mov     ecx, eax
                mov     edi, eax
                sub     sp, 20h
                mov     di, sp

@@0_r:
                mov     cl, 14h
                mov     eax, 0E820h
                mov     edx, 'SMAP'
                int     15h
                jb      short @@noE820
                jcxz    short @@noE820
                cmp     eax, 'SMAP'
                jnz     short @@noE820
                xor     eax, eax
                cmp     eax, es:[di+4]
                jnz     short @@0_r
                cmp     eax, es:[di+0Ch]
                jnz     short @@0_r
                inc     ax
                cmp     eax, es:[di+10h]
                jnz     short @@0_r
                mov     edx, es:[di]
                cmp     edx, 100000h
                jnz     short @@0_r
                mov     eax, es:[di+8]
                add     edx, eax
                add     sp, 20h
                pop     es
                jmp     short @@temper
; ---------------------------------------------------------------------------

@@noE820:
                add     sp, 20h
                pop     es
                xor     bx, bx
                xor     cx, cx
                xor     dx, dx
                mov     ax, 0E801h
                stc
                int     15h
                jb      short @@noE801
                mov     di, cx
                or      di, dx
                jz      short @@useE801
                mov     ax, cx
                mov     bx, dx

@@useE801:
                mov     di, ax
                or      di, bx
                jz      short @@noE801
                movzx   eax, ax
                movzx   ebx, bx
                shl     ebx, 6
                add     eax, ebx
                jmp     short @@calcmem
; ---------------------------------------------------------------------------

@@noE801:
                xor     eax, eax
                mov     ah, 88h ; 'ˆ'
                int     15h             ; EXTENDED MEMORY - GET MEMORY SIZE (AT,XT286,PS)
                                        ; Return: AX = memory size in K
                test    ax, ax
                jz      short xr_init

@@calcmem:
                shl     eax, 0Ah
                lea     edx, [eax+100000h]

@@temper:
                cmp     eax, pm32_maxextmem
                jbe     short loc_1093C
                mov     eax, pm32_maxextmem

loc_1093C:
                add     eax, 3FFh
                and     eax, 0FFFFFC00h
                sub     edx, eax
                mov     dword ptr pm32_info, edx ; also mem_ptr
                mov     dword ptr mem_free, eax
                shr     eax, 0Ah
                test    eax, 0FFFF0000h
                jz      short loc_10963
                or      ax, 0FFFFh

loc_10963:                              ; also base of real mode alias table
                mov     word ptr mem_used, ax

xr_init:
                mov     word ptr picslave, 870h
                mov     rmtopmswrout, offset xr_rmtopmsw
                mov     pmtormswrout, offset xr_pmtormsw

vxr_init:
                call    install_ints
                xor     eax, eax
                mov     ax, es
                mov     idtseg, ax
                mov     ebx, eax
                shl     ebx, 4
                mov     idtbase, ebx
                add     ax, 80h ; '€'
                mov     word ptr rmstackbase_and_top, ax
                movzx   bx, pm32_rmstacks
                mov     cx, pm32_rmstacklen
                mov     word ptr rmstacklen, cx
                imul    bx, cx
                add     ax, bx
                mov     word ptr rmstackbase_and_top+2, ax
                mov     word ptr rmstacktop2+1, ax
                shl     eax, 4
                mov     dword ptr pmstackbase_and_top, eax
                movzx   ebx, pm32_pmstacks
                movzx   ecx, pm32_pmstacklen
                shl     ecx, 4
                mov     dword ptr pmstacklen_minus1+1, ecx
                imul    ebx, ecx
                add     eax, ebx
                mov     dword ptr pmstackbase_and_top+4, eax
                mov     dword ptr pmstacktop2, eax
                mov     dword ptr callbackbase_and_seg, eax
                shr     eax, 4
                mov     word ptr callbackbase_and_seg+4, ax
                mov     es, ax
                call    allocate_callbacks
                xor     eax, eax
                mov     ax, es
                mov     gdtseg, ax
                shl     eax, 4
                mov     gdtbase, eax
                movzx   ecx, pm32_selectors
                lea     ecx, ds:4Fh[ecx*8]
                mov     gdtlimit, cx
                xor     di, di
                inc     cx
                shr     cx, 1
                xor     eax, eax
                rep stosw
                cmp     pmodetype, 2
                jnz     short @@f0
                pop     ax
                shl     eax, 4
                mov     es:22h, eax
                mov     byte ptr es:20h, 67h ; 'g'
                mov     byte ptr es:25h, 89h ; '‰'
                add     eax, 40h ; '@'
                mov     vcpiswitchstack, eax
                mov     di, 28h ; '('
                mov     si, sp
                mov     cl, 0Ch
                rep movs word ptr es:[di], word ptr ss:[si]
                add     sp, 18h

@@f0:
                mov     ax, 0FFFFh
                mov     es:18h, ax
                mov     es:48h, ax
                mov     ax, 0DF92h
                mov     es:1Dh, ax
                mov     es:4Dh, ax
                mov     ax, cs
                mov     bx, 8
                mov     cx, 0FFFFh
                mov     dx, 109Ah
                call    vxr_initsetdsc
                mov     bx, 10h
                mov     dx, 1092h
                call    vxr_initsetdsc
                mov     ax, 40h ; '@'
                mov     bx, 40h ; '@'
                call    vxr_initsetdsc
                mov     bx, 50h ; 'P'
                push    bx
                mov     ax, ss
                mov     dx, 5092h
                call    vxr_initsetdsc
                mov     ax, [bp+0]
                mov     [bp+0], bx
                call    vxr_initsetdsc
                push    bx
                mov     ah, 51h
                int     21h             ; DOS - 2+ internal - GET PSP SEGMENT
                                        ; Return: BX = current PSP segment
                mov     si, bx
                pop     bx
                push    ds
                mov     ds, si
                assume ds:nothing
                mov     ax, ds:2Ch
                test    ax, ax
                jz      short loc_10AB1
                mov     ds:2Ch, bx
                call    vxr_initsetdsc
                mov     ax, si

loc_10AB1:
                mov     cx, 0FFh
                call    vxr_initsetdsc
                pop     ds
                assume ds:KERNEL
                sub     bx, 8
                mov     cx, bx
                pop     dx
                mov     ax, 18h
                movzx   ebx, sp
                mov     si, 8
                mov     edi, offset loc_10AD2
                jmp     rmtopmswrout
; ---------------------------------------------------------------------------

loc_10AD2:
                cli
                mov     edi, cs:codebase
                mov     eax, cs:vcpi_cr3
                mov     cr3, eax
                mov     eax, cr0
                mov     dword ptr oldcr0[edi], eax
                xor     eax, eax
                mov     cr2, eax
                cmp     eax, cs:cpuidlvl
                jz      short loc_10B18
                mov     al, 1
                cpuid
                test    edx, 1000000h
                jz      short loc_10B18
                mov     eax, cr4
                or      ax, 200h
                mov     cr4, eax
                mov     eax, cr0
                and     al, 0F9h
                mov     cr0, eax
                assume ds:nothing

loc_10B18:
                clts
                mov     eax, ds:54h
                mov     dword ptr ds:(oldint15h+1)[edi], eax
                mov     eax, ds:6Ch
                mov     dword ptr ds:(oldint1Bh_and_1Ch+1)[edi], eax
                mov     eax, ds:70h
                mov     dword ptr ds:(oldint1Bh_and_1Ch+5)[edi], eax
                mov     eax, ds:84h
                mov     dword ptr ds:oldint21h[edi], eax
                mov     eax, ds:8Ch
                mov     dword ptr ds:(oldint23h_minus1+1)[edi], eax
                mov     eax, ds:90h
                mov     dword ptr ds:oldint24h[edi], eax
                mov     eax, ds:0BCh
                mov     dword ptr ds:oldint2Fh[edi], eax
                mov     eax, ds:8       ; DOS32AWE addition
                mov     dword ptr ds:oldNMI[edi], eax ; DOS32AWE addition
                mov     ax, cs:kernel_code
                shl     eax, 10h
                mov     ax, offset int21h_rm
                mov     ds:84h, eax
                mov     ax, cs:kernel_code ; DOS32AWE addition
                shl     eax, 10h        ; DOS32AWE addition
                mov     ax, offset NMI_rm ; DOS32AWE addition
                mov     ds:8, eax       ; DOS32AWE addition
                mov     dword ptr ds:newNMI[edi], eax
                cmp     cs:pmodetype, 0
                jnz     short @@1
                cmp     word ptr cs:id32_process_id_minus2+2, 0
                jnz     short @@1
                mov     ax, offset int15h_rm
                mov     ds:54h, eax

@@1:
                push    ds
                push    es
                push    edi
                push    cs
                pop     ds
                assume ds:KERNEL
                mov     es, seldata
                assume es:nothing
                mov     ax, 303h
                mov     esi, offset int1Bh
                mov     edi, offset v_init__cbdata1B
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE REAL MODE CALL-BACK ADDRESS
                                        ; DS:SI=selector:offset of procedure to call
                                        ; ES:DI=selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok, CX:DX = segment:offset of real mode call address
                push    cx
                push    dx
                mov     si, offset int1Ch
                mov     di, (offset cbdata1Ch+3)
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE REAL MODE CALL-BACK ADDRESS
                                        ; DS:SI=selector:offset of procedure to call
                                        ; ES:DI=selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok, CX:DX = segment:offset of real mode call address
                push    cx
                push    dx
                mov     si, offset int23h
                mov     di, (offset cbdata23h+1)
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE REAL MODE CALL-BACK ADDRESS
                                        ; DS:SI=selector:offset of procedure to call
                                        ; ES:DI=selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok, CX:DX = segment:offset of real mode call address
                push    cx
                push    dx
                mov     si, offset int24h
                mov     di, offset cbdata24
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE REAL MODE CALL-BACK ADDRESS
                                        ; DS:SI=selector:offset of procedure to call
                                        ; ES:DI=selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok, CX:DX = segment:offset of real mode call address
                push    cx
                push    dx
                mov     ds, seldata
                assume ds:nothing
                pop     large [dword ptr ds:newint24h]
                pop     large [dword ptr ds:@@v2+1]
                pop     large [dword ptr ds:newint1Ch+1]
                pop     large [dword ptr ds:newint1Bh+1]
                pop     edi
                pop     es
                assume es:nothing
                pop     ds
                assume ds:KERNEL
                xor     eax, eax
                mov     ebx, dword ptr cs:pm32_info ; also mem_ptr
                mov     ecx, dword ptr cs:mem_free
                mov     edx, ebx
                add     ebx, 0Fh
                and     bl, 0F0h
                mov     esi, ebx
                sub     esi, edx
                add     esi, 10h
                sub     ecx, esi
                ja      short loc_10C48
                mov     dword ptr pm32_info[edi], eax ; also mem_ptr
                mov     dword ptr mem_free[edi], eax
                jmp     short loc_10C85
; ---------------------------------------------------------------------------

loc_10C48:
                mov     eax, 12345678h
                mov     [ebx], eax
                mov     [ebx+0Ch], eax
                movzx   eax, word ptr id32_process_id_minus2+2
                mov     [ebx+8], eax
                mov     [ebx+4], ecx
                lea     edx, [ebx+ecx+10h]
                mov     dword ptr (mem_top_minus1+1)[edi], edx
                mov     dword ptr pm32_info[edi], ebx ; also mem_ptr
                mov     dword ptr mem_free[edi], ecx

loc_10C85:
                sti
                jmp     dxvr_init
; END OF FUNCTION CHUNK FOR pm32_init_new

; =============== S U B R O U T I N E =======================================


install_ints    proc near
                xor     di, di
                xor     ecx, ecx
                mov     dx, word ptr picslave

loc_10C92:
                lea     eax, (intmatrix - 0FFF80000h)[ecx*4]
                stosd
                mov     eax, 8E00h
                mov     bl, cl
                and     bl, 0F8h
                test    cl, 0F0h
                jz      short loc_10CBD
                cmp     bl, dl
                jz      short loc_10CBD
                cmp     bl, dh
                jz      short loc_10CBD
                cmp     cl, 2
                jz      short loc_10CBD
                mov     ax, 8F00h

loc_10CBD:
                stosd
                inc     cl
                jnz     short loc_10C92
                mov     word ptr es:108h, offset int21h_pm
                mov     word ptr es:188h, offset int31h_pm
                push    ds
                push    es
                push    ds
                pop     es
                assume es:KERNEL
                xor     ax, ax
                mov     ds, ax
                assume ds:nothing
                mov     di, (offset irqtabrm_minus1+1)
                movzx   si, dh
                shl     si, 2
                mov     cx, 8
                rep movsd
                movzx   si, dl
                shl     si, 2
                mov     cl, 8
                rep movsd
                mov     cl, 10h
                mov     di, (offset exctabpm_minus3+3)
                mov     ax, offset excmatrix

loc_10CFB:
                stosw
                mov     word ptr es:[di+2], 8
                add     di, 6
                add     ax, 4
                loop    loc_10CFB
                pop     es
                assume es:nothing
                pop     ds
                assume ds:KERNEL
                mov     ax, offset irq_fail
                sub     ax, offset irq_pastcall
                mov     di, (offset irq_atcall+1)
                mov     cl, 0Fh

loc_10D17:
                mov     [di], ax
                sub     ax, 4
                add     di, 4
                loop    loc_10D17
                movzx   dx, picmaster
                call    setup_irqs
                movzx   dx, picslave
                call    setup_irqs
                mov     ax, (offset nmi_forward - 126Ch) ; DOS32AWE addition
                mov     word ptr intmatrix_entry02_plus1+1, ax ; DOS32AWE addition
                cmp     picmaster, 10h
                jnb     short locret_10D44
                mov     ax, (offset irq_normal - 12A0h)
                mov     word ptr intmatrix_entry0F_plus1+1, ax

locret_10D44:
                retn
install_ints    endp


; =============== S U B R O U T I N E =======================================


setup_irqs      proc near
                cmp     dl, 0Fh
                mov     ax, offset irq_tester
                jbe     short loc_10D50
                mov     ax, offset irq_normal

loc_10D50:
                shl     dx, 2
                sub     ax, offset irq_pastcall
                sub     ax, dx
                mov     di, (offset irq_atcall+1)
                add     di, dx
                mov     cl, 8

loc_10D5F:
                mov     [di], ax
                sub     ax, 4
                add     di, 4
                loop    loc_10D5F
                retn
setup_irqs      endp


; =============== S U B R O U T I N E =======================================


allocate_callbacks proc near
                movzx   cx, pm32_callbacks
                jcxz    short locret_10DB1
                xor     di, di
                mov     ax, 6866h
                mov     dx, kernel_code
                push    ds
                push    es
                pop     ds

loc_10D7D:
                mov     word ptr [di], 6066h
                mov     [di+2], ah
                mov     word ptr [di+3], 0
                mov     [di+5], ax
                mov     byte ptr [di+0Bh], 0B9h ; '¹'
                mov     [di+0Eh], ax
                mov     byte ptr [di+14h], 0EAh ; 'ê'
                mov     word ptr [di+15h], offset callback
                mov     [di+17h], dx
                add     di, 19h
                loop    loc_10D7D
                pop     ds
                add     di, 0Fh
                shr     di, 4
                mov     ax, es
                add     ax, di
                mov     es, ax
                assume es:nothing

locret_10DB1:
                retn
allocate_callbacks endp


; =============== S U B R O U T I N E =======================================


vxr_initsetdsc  proc near
                push    ax
                movzx   eax, ax
                shl     eax, 4
                mov     es:[bx], cx
                mov     es:[bx+2], eax
                mov     es:[bx+5], dx
                add     bx, 8
                pop     ax
                retn
vxr_initsetdsc  endp


; =============== S U B R O U T I N E =======================================


xms_allocmem    proc near
                push    edi
                mov     edi, edx
                mov     ah, 89h ; '‰'
                call    xms_call
                cmp     ax, 1
                jz      short loc_10DE4
                mov     dx, di
                mov     ah, 9
                call    xms_call

loc_10DE4:
                pop     edi
                retn
xms_allocmem    endp


; =============== S U B R O U T I N E =======================================


int21h_pm       proc near
                cmp     ah, 4Ch ; 'L'
                jnz     short @@done
                cli
                cld
                push    ax
                mov     ds, cs:seldata
                assume ds:nothing
                mov     es, word ptr ds:2Ch
                assume es:nothing, ds:KERNEL
                mov     eax, dword ptr oldcr0
                mov     cr0, eax
                mov     eax, dword ptr oldint1Bh_and_1Ch+1
                mov     es:6Ch, eax
                mov     eax, dword ptr oldNMI ; DOS32AWE ADDITION
                mov     es:8, eax       ; DOS32AWE ADDITION
                mov     eax, dword ptr oldint1Bh_and_1Ch+5
                mov     es:70h, eax
                mov     eax, dword ptr oldint21h
                mov     es:84h, eax
                mov     eax, dword ptr oldint23h_minus1+1
                mov     es:8Ch, eax
                mov     eax, dword ptr oldint24h
                mov     es:90h, eax
                mov     eax, dword ptr oldint2Fh
                mov     es:0BCh, eax
                call    mem_dealloc
                movzx   bx, pmodetype
                add     bx, bx
                call    word ptr @@exit[bx]
                pop     ax

@@done:
                jmp     intmatrix_entry21
; ---------------------------------------------------------------------------
@@exit:
                dw offset r_exit
                dw offset x_exit
                dw offset v_exit
                dw offset d_exit
int21h_pm       endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


mem_dealloc     proc near
                cmp     word ptr id32_process_id_minus2+2, 0
                jz      short locret_10E9F
                mov     esi, dword ptr pm32_info ; also mem_ptr
                mov     eax, dword ptr mem_free
                or      eax, esi
                jz      short locret_10E9F

@@1:
                mov     eax, es:[esi+4]
                mov     edx, es:[esi+8]
                btr     eax, 1Fh
                cmp     edx, dword ptr id32_process_id_minus2+2
                jnz     short @@2
                mov     es:[esi+4], eax

@@2:
                lea     esi, [esi+eax+10h]
                cmp     esi, dword ptr mem_top_minus1+1
                jb      short @@1
                push    ds
                push    es
                pop     ds
                call    int31_linkfreeblocks
                pop     ds

locret_10E9F:
                retn
mem_dealloc     endp


; =============== S U B R O U T I N E =======================================


r_exit          proc near
                mov     eax, dword ptr oldint15h+1
                mov     es:54h, eax
                retn
r_exit          endp


; =============== S U B R O U T I N E =======================================


x_exit          proc near
                call    xms_dealloc
                mov     ah, A20_state
                and     ah, 1
                xor     ah, 1
                add     ah, 3
                jmp     short xms_call_pm
x_exit          endp


; =============== S U B R O U T I N E =======================================


v_exit          proc near
                mov     cx, vcpi_allocmem
                mov     esi, dword ptr pagetablefree
                jcxz    short xms_dealloc

loc_10EC7:
                mov     edx, es:[esi]
                add     esi, 4
                and     dx, 0F000h
                mov     ax, 0DE05h
                call    large [fword ptr vcpi_calleip]
                loop    loc_10EC7
                mov     eax, vcpi_cr3
                mov     cr3, eax
v_exit          endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


xms_dealloc     proc near
                mov     dx, xms_handle
                test    dx, dx
                jz      short d_exit
                mov     ah, 0Dh
                call    xms_call_pm
                mov     ah, 0Ah
xms_dealloc     endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


xms_call_pm     proc near

var_1E          = word ptr -1Eh
var_16          = word ptr -16h
var_12          = word ptr -12h
var_8           = dword ptr -8
var_4           = dword ptr -4

                push    ss
                pop     es
                sub     esp, 32h
                mov     edi, esp
                xor     ecx, ecx
                mov     [esp+32h+var_1E], dx
                mov     [esp+32h+var_16], ax
                mov     eax, xms_call
                mov     [esp+32h+var_12], cx
                mov     [esp+32h+var_4], ecx
                mov     [esp+32h+var_8], eax
                xor     bx, bx
                mov     ax, 301h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; CALL REAL MODE PROC WITH FAR RET FRAME
                                        ; CX = number of words to copy from protected mode to real mode stack
                                        ; ES:DI / ES:EDI = selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if successful
                add     esp, 32h

d_exit:
                retn
xms_call_pm     endp


; =============== S U B R O U T I N E =======================================


NMI_rm          proc far
                push    ax              ; DOS32AWE ADDITION BEGIN
                pushf
                call    dword ptr cs:oldNMI
                xor     al, al
                out     70h, al         ; CMOS Memory:
                                        ; used by real-time clock
                pop     ax
                iret                    ; DOS32AWE ADDITION END
NMI_rm          endp


; =============== S U B R O U T I N E =======================================


int15h_rm       proc far
                cmp     ah, 88h ; 'ˆ'
                jz      short @@1
                cmp     ax, 0E801h
                jz      short @@err
                cmp     ax, 0E820h
                jz      short @@err
                jmp     dword ptr cs:oldint15h+1
; ---------------------------------------------------------------------------

@@1:
                pushf
                call    dword ptr cs:oldint15h+1
                sub     ax, word ptr cs:mem_used ; also base of real mode alias table
                jnb     short loc_10F5B
                xor     ax, ax

loc_10F5B:
                push    bp
                mov     bp, sp
                and     byte ptr [bp+6], 0FEh
                pop     bp
                iret
; ---------------------------------------------------------------------------

@@err:
                push    bp
                mov     bp, sp
                or      byte ptr [bp+6], 1
                pop     bp
                iret
int15h_rm       endp


; =============== S U B R O U T I N E =======================================


int21h_rm       proc far
                cmp     byte ptr cs:pagetablebase_minus5+3, 0 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                jnz     short loc_10F91
                cmp     ax, 0FF88h
                jz      short loc_10FD6
                cmp     byte ptr cs:pagetablebase_minus5+1, 0 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                jnz     short loc_10F91
                cmp     ah, 4Ch ; 'L'
                jz      short int21h_exit
                cmp     ah, 4Bh ; 'K'
                jz      short int21h_spawn
                cmp     ah, 31h ; '1'
                jz      short int21h_tsr

loc_10F91:
                jmp     dword ptr cs:oldint21h
; ---------------------------------------------------------------------------

int21h_exit:
                cli
                mov     bp, ax
                mov     al, 80h ; '€'
                out     70h, al         ; CMOS Memory:
                                        ;
                mov     ax, 10h
                mov     cx, ax
                mov     dx, 18h
                mov     ebx, dword ptr cs:pmstackbase_and_top+4
                mov     si, 8
                mov     edi, offset @@1
                jmp     cs:rmtopmswrout
; ---------------------------------------------------------------------------

@@1:
                mov     ax, bp
                jmp     int21h_pm
; ---------------------------------------------------------------------------

int21h_spawn:                           ; also id32_tsrmode - 3
                mov     byte ptr cs:pagetablebase_minus5+1, 1 ; also id32_spawned_id - 1
                pushf
                call    dword ptr cs:oldint21h
                mov     byte ptr cs:pagetablebase_minus5+1, 0 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                pop     bx
                pop     cx
                pop     dx
                push    cx
                push    bx
                retf
; ---------------------------------------------------------------------------

loc_10FD6:
                mov     eax, 'ID32'
                movzx   ebx, cs:client_version
                mov     ecx, dword ptr cs:mem_free
                mov     edx, dword ptr cs:pm32_info ; also mem_ptr
                mov     si, word ptr cs:id32_process_id_minus2+2
                shl     esi, 10h
                movzx   si, cs:pagetables
                mov     edi, dword ptr cs:pagetablefree
                iret
; ---------------------------------------------------------------------------

int21h_tsr:                             ; also id32_tsrmode - 3
                mov     byte ptr cs:pagetablebase_minus5+3, 1 ; also id32_spawned_id - 1
                jmp     dword ptr cs:oldint21h
int21h_rm       endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int1Bh          proc near
                call    intold_save
                int     1Bh             ; CTRL-BREAK KEY
                mov     ax, 6
                jmp     intold_restore
int1Bh          endp


; =============== S U B R O U T I N E =======================================


int1Ch          proc near
                call    intold_save
                push    ds
                mov     ds, cs:selzero
                mov     eax, dword ptr cs:oldint1Bh_and_1Ch+5
                assume ds:nothing
                mov     ds:70h, eax
                pop     ds
                assume ds:KERNEL
                int     1Ch             ; CLOCK TICK
                push    ds
                mov     ds, cs:selzero
                mov     eax, dword ptr cs:newint1Ch+1
                assume ds:nothing
                mov     ds:70h, eax
                pop     ds
                assume ds:KERNEL
                mov     ax, 6
                jmp     intold_restore
int1Ch          endp


; =============== S U B R O U T I N E =======================================


int23h          proc near
                call    intold_save
                clc
                mov     ebp, esp
                int     23h             ; DOS - CONTROL "C" EXIT ADDRESS
                                        ; Return: return via RETF 2 with CF set
                                        ; DOS will abort program with errorlevel 0
                                        ; else
                                        ; interrupted DOS call continues
                mov     esp, ebp
                setb    ah
                mov     al, es:[edi+20h]
                and     al, 0FEh
                add     al, ah
                mov     es:[edi+20h], al
                mov     ax, 4
                jmp     short intold_restore
int23h          endp

; ---------------------------------------------------------------------------

int24h:
                call    intold_save
                push    edi
                push    large dword ptr [esi+1Ah]
                push    large dword ptr [esi+16h]
                push    large dword ptr [esi+12h]
                push    large dword ptr [esi+0Eh]
                push    large dword ptr [esi+0Ah]
                push    large dword ptr [esi+6]
                mov     ax, es:[edi+1Ch]
                mov     bp, es:[edi+8]
                mov     si, es:[edi+4]
                mov     di, es:[edi]
                int     24h             ; DOS - FATAL ERROR HANDLER ADDRESS
                                        ; Automatically called upon detection of unrecoverable I/O error.
                add     esp, 18h
                pop     edi
                mov     es:[edi+1Ch], al
                mov     ax, 6
                jmp     short intold_restore

; =============== S U B R O U T I N E =======================================


intold_save     proc near
                pop     bp
                mov     ax, [esi+4]
                mov     es:[edi+20h], ax
                mov     eax, [esi]
                mov     es:[edi+2Ah], eax
                push    es
                push    edi
                jmp     bp
intold_save     endp


; =============== S U B R O U T I N E =======================================


intold_restore  proc near
                pop     edi
                pop     es
                add     es:[edi+2Eh], ax
                iretd
intold_restore  endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


enable_A20      proc near
                pushf
                cli
                mov     al, 80h ; '€'
                out     70h, al         ; CMOS Memory:
                                        ;
                call    enablea20test
                setz    al
                mov     A20_state, al
                jz      short @@done
                in      al, 92h         ; try PS/2 like "fast A20 gate"
                or      al, 2
                jmp     short $+2
                jmp     short $+2
                jmp     short $+2
                out     92h, al
                call    enablea20test
                jz      short @@done
                call    enablea20kbwait
                jnz     short loc_1110A
                mov     al, 0D1h ; 'Ñ'
                out     64h, al         ; AT Keyboard controller 8042.
                call    enablea20kbwait
                jnz     short loc_1110A
                mov     al, 0DFh ; 'ß'
                out     60h, al         ; AT Keyboard controller 8042.
                call    enablea20kbwait

loc_1110A:
                mov     cx, 800h

loc_1110D:
                call    enablea20test
                jz      short @@done
                in      al, 40h         ; Timer 8253-5 (AT: 8254.2).
                jmp     short $+2
                jmp     short $+2
                jmp     short $+2
                in      al, 40h         ; Timer 8253-5 (AT: 8254.2).
                mov     ah, al

loc_1111E:                              ; Timer 8253-5 (AT: 8254.2).
                in      al, 40h
                jmp     short $+2
                jmp     short $+2
                jmp     short $+2
                in      al, 40h         ; Timer 8253-5 (AT: 8254.2).
                cmp     al, ah
                jz      short loc_1111E
                loop    loc_1110D
                popf
                stc
                retn
; ---------------------------------------------------------------------------

@@done:
                popf
                clc
                retn
enable_A20      endp


; =============== S U B R O U T I N E =======================================


enablea20kbwait proc near
                xor     cx, cx

loc_11136:
                jmp     short $+2
                jmp     short $+2
                jmp     short $+2
                in      al, 64h         ; AT Keyboard controller 8042.
                test    al, 2
                loopne  loc_11136
                retn
enablea20kbwait endp


; =============== S U B R O U T I N E =======================================


enablea20test   proc near
                push    fs
                push    gs
                xor     ax, ax
                mov     fs, ax
                assume fs:nothing
                dec     ax
                mov     gs, ax
                assume gs:nothing
                mov     al, fs:0
                mov     ah, al
                not     al
                xchg    al, gs:10h
                cmp     ah, fs:0
                mov     gs:10h, al
                pop     gs
                pop     fs
                assume fs:nothing
                retn
enablea20test   endp

; ---------------------------------------------------------------------------
                align 4

; =============== S U B R O U T I N E =======================================


v_rmtopmsw      proc near
                pushf
                mov     ds, cs:kernel_code
                pop     word ptr @@v1a+1
                mov     word ptr tempw1, ax
                mov     al, 80h         ; DOS32AWE ADDITION: block NMI & IRQ during mode switch
                out     70h, al         ; DOS32AWE ADDITION
                cli                     ; DOS32AWE ADDITION
                mov     word ptr tempw2_aka_tempd1+1, si
                mov     esi, vcpistrucaddx
                mov     ax, 0DE0Ch
                int     67h             ;  - LIM EMS Program Interface - SWITCH TO PROTECTED MODE
                                        ; ESI = linear address in first megabyte of values for system registers
                                        ; Return: interrupts disabled
                                        ; GDTR, IDTR, LDTR, TR loaded

v_rmtopmswpm:
                mov     ss, dx
                mov     esp, ebx
                mov     ds, word ptr cs:tempw1
                assume ds:nothing
                mov     es, cx
                xor     ax, ax
                mov     fs, ax
                assume fs:nothing
                mov     gs, ax
                assume gs:nothing
                pushfd
                mov     ax, word ptr cs:@@v1a+1
                and     ah, 0Fh
                mov     [esp], ax
                push    large [dword ptr cs:tempw2_aka_tempd1+1]
                push    edi
                xor     al, al          ; DOS32AWE ADDITION: unblock NMI after mode switch.
                out     70h, al         ; DOS32AWE ADDITION: IRQs will be unblocked by IRET
                iretd
v_rmtopmsw      endp

; ---------------------------------------------------------------------------
                align 4

; =============== S U B R O U T I N E =======================================


v_pmtormsw      proc far
                pushf
                cli
                push    ax
                mov     al, 80h         ; DOS32AWE ADDITON: block NMI during mode switch
                out     70h, al         ; DOS32AWE ADDITION
                mov     ds, cs:selzero
                assume ds:KERNEL
                movzx   ebx, bx
                mov     eax, cs:vcpiswitchstack
                movzx   edx, dx
                mov     dword ptr [eax+20h], 0
                movzx   ecx, cx
                mov     dword ptr [eax+1Ch], 0
                mov     [eax+14h], ecx
                pop     cx
                mov     [eax+18h], ecx
                mov     [eax+10h], edx
                mov     [eax+0Ch], ebx
                mov     dword ptr [eax+4], seg KERNEL
                mov     dword ptr [eax], offset @@0
                pop     bx
                mov     ss, cs:selzero
                mov     esp, eax
                mov     ax, 0DE0Ch
                call    large [fword ptr cs:vcpi_calleip]

@@0:
                push    bx
                push    si
                push    di              ; DOS32AWE possible bug:
                                        ;  not unblocking NMI during real mode execution.
                                        ;  might be intentional to avoid NMI handling issues, though, but is different in non-VCPI path.
                                        ;  might be the cause why memory managers are incompatible
                                        ;  might be intentional to prevent use with memory managers.
                iret
v_pmtormsw      endp ; sp-analysis failed

; ---------------------------------------------------------------------------
                align 4

; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

xr_rmtopmsw     proc near
                pushfd
                cli
                push    ax
                mov     al, 80h         ; DOS32AWE ADDITON: block NMI during mode switch
                out     70h, al         ; DOS32AWE ADDITION
                lidt    fword ptr cs:idtlimit
                lgdt    fword ptr cs:gdtlimit
                mov     eax, cr0
                or      al, 1
                mov     cr0, eax
                jmp     far ptr loc_11249 ; uses selector 8

loc_11249:
                pop     ds
                mov     es, cx
                xor     ax, ax
                mov     fs, ax
                mov     gs, ax
                pop     eax
                mov     ss, dx
                mov     esp, ebx
                and     ah, 0BFh
                push    ax
                popf
                push    eax
                push    esi
                push    edi
                xor     al, al          ; DOS32AWE ADDITON: unblock NMI after mode switch
                out     70h, al         ; DOS32AWE ADDITION
                iretd
xr_rmtopmsw     endp

; ---------------------------------------------------------------------------
                align 4

; =============== S U B R O U T I N E =======================================


xr_pmtormsw     proc far
                pushf
                cli
                push    ax
                mov     al, 80h         ; DOS32AWE ADDITON: block NMI during mode switch
                out     70h, al         ; DOS32AWE ADDITION
                mov     ds, cs:seldata
                assume ds:nothing
                pop     word ptr ds:@@v1a+1
                pop     word ptr ds:tempw1
                mov     ax, 10h
                mov     ds, ax
                mov     es, ax
                assume es:nothing
                mov     fs, ax
                assume fs:nothing
                mov     gs, ax
                assume gs:nothing
                mov     ss, ax
                assume ss:nothing
                movzx   esp, bx
                lidt    fword ptr ds:rmidtlimit
                mov     eax, cr0
                and     al, 0FEh
                mov     cr0, eax
                jmp     loc_112A3

loc_112A3:
                mov     ss, dx
                assume ss:nothing
                mov     ds, word ptr cs:@@v1a+1
                assume ds:KERNEL
                mov     es, cx
                assume es:nothing
                xor     ax, ax
                mov     fs, ax
                assume fs:nothing
                mov     gs, ax
                assume gs:nothing
                push    word ptr cs:tempw1
                push    si
                push    di
                out     70h, al         ; DOS32AWE ADDITON: unblock NMI after mode switch
                iret
xr_pmtormsw     endp ; sp-analysis failed

; ---------------------------------------------------------------------------

prefixed_retf:
                db      66h
                retf
; ---------------------------------------------------------------------------
                align 4

intmatrix:
                push    ax

irq_atcall:
                call    int_main
; ---------------------------------------------------------------------------

irq_pastcall:
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax

intmatrix_entry02_plus1:
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax

intmatrix_entry0F_plus1:
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------

intmatrix_entry21:
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------
                push    ax
                call    int_main
; ---------------------------------------------------------------------------

std_matrix:
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------
                push    ax
                call    irq_standard
; ---------------------------------------------------------------------------

back_matrix:
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------
                push    ax
                call    near ptr irq_callback
; ---------------------------------------------------------------------------

excmatrix:
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler
; ---------------------------------------------------------------------------
                push    ax
                call    exc_handler

; =============== S U B R O U T I N E =======================================


critical_error_rm proc near
                cli
                mov     ds, cs:seldata
                mov     es, selzero
                mov     eax, dword ptr oldint1Bh_and_1Ch+5
                mov     es:70h, eax
                mov     ax, word ptr rmstacktop2+1
                mov     word ptr rmstackbase_and_top+2, ax
                mov     ax, 8200h
                jmp     dword ptr client_call
critical_error_rm endp


; =============== S U B R O U T I N E =======================================


critical_error_pm proc near
                cli
                xor     ax, ax
                mov     ds, cs:kernel_code
                mov     es, ax
                assume es:nothing
                mov     eax, dword ptr oldint1Bh_and_1Ch+5
                mov     es:70h, eax
                mov     eax, dword ptr pmstacktop2
                mov     dword ptr pmstackbase_and_top+4, eax
                mov     ebx, eax
                mov     ax, 10h
                mov     cx, ax
                mov     dx, 18h
                mov     si, 8
                mov     edi, offset loc_117D3
                jmp     rmtopmswrout
; ---------------------------------------------------------------------------

loc_117D3:
                mov     ax, 8300h
                jmp     dword ptr client_call
critical_error_pm endp


; =============== S U B R O U T I N E =======================================


nmi_forward     proc near
                pop     ax              ; DOS32AWE ADDITION BEGIN
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                mov     ds, cs:seldata
                movzx   eax, al
                mov     dx, word ptr rmstackbase_and_top+2
                mov     bx, word ptr rmstacklen
                movzx   esi, dx
                sub     dx, bx
                shl     esi, 4
                cmp     dx, word ptr rmstackbase_and_top
                jb      critical_error_rm
                mov     word ptr rmstackbase_and_top+2, dx
                shl     bx, 4
                mov     edi, dword ptr newNMI
                mov     ds, selzero
                mov     dword ptr pm32_rmstacklen, edi
                mov     word ptr [esi-2], ss
                mov     [esi-6], esp
                mov     dword ptr [esi-0Ah], seg KERNEL
                mov     word ptr [esi-0Ch], offset @@0
                shld    esi, edi, 10h
                sub     bx, 0Ch
                jmp     large [cs:pmtormswrout]
; ---------------------------------------------------------------------------

@@0:
                cli
                mov     ax, 10h
                mov     cx, ax
                pop     ebx
                pop     dx
                mov     si, 8
                mov     edi, offset @@1
                jmp     cs:rmtopmswrout
; ---------------------------------------------------------------------------

@@1:
                mov     ax, word ptr rmstacklen
                add     word ptr rmstackbase_and_top+2, ax
                mov     ds, selzero
                pop     gs
                assume gs:nothing
                pop     fs
                assume fs:nothing
                pop     es
                assume es:nothing
                pop     ds
                popad
                pop     ax
                iretd                   ; DOS32AWE ADDITION END
nmi_forward     endp


; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

int_main        proc near

var_1E          = byte ptr -1Eh
arg_0           = word ptr  2
arg_6           = word ptr  8

                cli
                pop     ax
                sub     ax, offset irq_atcall
                shr     ax, 2
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                mov     ds, cs:seldata
                inc     dword ptr _pc_intpmtorm+1
                mov     byte ptr @@N+1, al
                mov     dx, word ptr rmstackbase_and_top+2
                mov     bx, word ptr rmstacklen
                movzx   esi, dx
                sub     dx, bx
                shl     esi, 4
                cmp     dx, word ptr rmstackbase_and_top
                jb      critical_error_rm
                mov     word ptr rmstackbase_and_top+2, dx
                shl     bx, 4
                mov     es, selzero
                mov     ds, selzero
                lea     edi, [esi-26h]
                mov     ecx, 8
                mov     word ptr [esi-2], ss
                mov     [esi-6], esp
                lea     esi, [esp+26h+var_1E]
                cld
                rep movs dword ptr es:[edi], dword ptr ss:[esi]
                mov     ax, [esp+26h+arg_0]
                mov     [edi-4], ax
                mov     si, seg KERNEL
                mov     di, offset @@0
                sub     bx, 26h ; '&'
                jmp     large [cs:pmtormswrout]
; ---------------------------------------------------------------------------

@@0:
                popad

@@N:                                    ; - internal hardware - DIVIDE ERROR
                int     0               ; Automatically called at end of DIV or IDIV operation that results in error
                                        ; or overflow.   Normally set by DOS to display an error message and abort
                                        ; the program.
                pushad
                pushf
                cli
                xor     eax, eax
                mov     ebp, eax
                mov     ax, ss
                shl     eax, 4
                mov     bp, sp
                mov     ebx, [bp+22h]
                mov     dx, [bp+26h]
                add     ebp, eax
                mov     ax, 18h
                mov     cx, 10h
                mov     si, 8
                mov     edi, offset @@1
                jmp     cs:rmtopmswrout
; ---------------------------------------------------------------------------

@@1:
                inc     dword ptr es:_pc_intrmtopm_minus1+1
                mov     ax, word ptr es:rmstacklen
                add     word ptr es:rmstackbase_and_top+2, ax
                mov     ax, ds:[ebp+0]
                and     ax, 8D5h
                mov     dx, [esp+2Ah+arg_6]
                and     dx, not 8D5h
                or      ax, dx
                mov     [esp+2Ah+arg_6], ax
                mov     eax, ebp
                mov     edi, [eax+2]
                mov     esi, [eax+6]
                mov     ebp, [eax+0Ah]
                mov     ebx, [eax+12h]
                mov     edx, [eax+16h]
                mov     ecx, [eax+1Ah]
                mov     eax, [eax+1Eh]
                pop     gs
                pop     fs
                pop     es
                pop     ds
                add     esp, 22h
                iretd
int_main        endp


; =============== S U B R O U T I N E =======================================


irq_tester      proc near

var_14          = dword ptr -14h
var_10          = dword ptr -10h
var_C           = dword ptr -0Ch
var_8           = dword ptr -8
var_2           = word ptr -2
arg_2           = dword ptr  4
arg_6           = dword ptr  8
arg_A           = dword ptr  0Ch
arg_E           = dword ptr  10h

                mov     al, 0Bh
                out     20h, al         ; Interrupt controller, 8259A.
                in      al, 20h         ; Interrupt controller, 8259A.
                test    al, al
                jz      irq_fail
                mov     ax, [esp]
                sub     ax, offset irq_atcall
                shr     ax, 2
                mov     [esp], ax
                and     al, 7
                bt      word ptr cs:irqset_pm_minus1+1, ax
                pop     ax
                jnb     short loc_119D8
                and     al, 7
                shl     ax, 3
                xchg    ax, bx
                sub     esp, 6
                mov     [esp+4], ax
                mov     ax, word ptr cs:(irqtab_pm_minus1+1)[bx]
                mov     [esp], ax
                mov     ax, word ptr cs:(irqtab_pm_minus1+3)[bx]
                mov     [esp+4+var_2], ax
                mov     bx, word ptr cs:irqtab_pm_plus4[bx]
                xchg    bx, [esp+4]
                mov     ax, [esp+6]
                db      66h
                retf
irq_tester      endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


irq_normal      proc near
                pop     ax
                sub     ax, offset irq_atcall
                shr     ax, 2

loc_119D8:
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                mov     ds, cs:seldata
                inc     dword ptr _pc_irqpmtorm
                movzx   eax, al
                mov     dx, word ptr rmstackbase_and_top+2
                mov     bx, word ptr rmstacklen
                movzx   esi, dx
                sub     dx, bx
                shl     esi, 4
                cmp     dx, word ptr rmstackbase_and_top
                jb      critical_error_rm
                mov     word ptr rmstackbase_and_top+2, dx
                shl     bx, 4
                mov     ds, selzero
                mov     edi, dword ptr pm32_mode[eax*4]
                mov     word ptr [esi-2], ss
                mov     [esi-6], esp
                mov     dword ptr [esi-0Ah], seg KERNEL
                mov     word ptr [esi-0Ch], offset @irq
                shld    esi, edi, 10h
                sub     bx, 0Ch
                jmp     large [cs:pmtormswrout]
irq_normal      endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


irq_fail        proc near

var_14          = dword ptr -14h
var_10          = dword ptr -10h
var_C           = dword ptr -0Ch
var_8           = dword ptr -8
var_4           = dword ptr -4
arg_2           = dword ptr  4
arg_6           = dword ptr  8
arg_A           = dword ptr  0Ch
arg_E           = dword ptr  10h

                pop     ax
                sub     ax, offset irq_atcall
                shr     ax, 2
                cmp     al, 8
                jb      @@2
                cmp     al, 9
                jz      short @@2
                cmp     al, 0Eh
                ja      short @@2
                sub     esp, 16h
                mov     [esp+14h+var_C], eax
                movzx   eax, ax
                mov     eax, dword ptr cs:exctabpm_minus3+3[eax*8]
                mov     [esp], eax
                movzx   eax, word ptr [esp+14h+var_C]
                mov     eax, dword ptr cs:exctabpm_plus1+3[eax*8]
                mov     [esp+14h+var_10], eax
                mov     ax, [esp+16h]
                mov     word ptr [esp+14h+var_C], ax
                mov     ax, cs
                mov     [esp+14h+var_8], eax
                mov     eax, [esp+14h+arg_2]
                mov     [esp+14h+var_4], eax
                mov     eax, [esp+14h+arg_6]
                mov     [esp+14h], eax
                mov     eax, [esp+14h+arg_A]
                mov     [esp+14h+arg_2], eax
                mov     eax, [esp+14h+arg_E]
                mov     [esp+14h+arg_6], eax
                jmp     short @@run
; ---------------------------------------------------------------------------

@@2:
                sub     esp, 1Ah
                mov     [esp+18h+var_10], eax
                movzx   eax, ax
                mov     eax, dword ptr cs:exctabpm_minus3+3[eax*8]
                mov     [esp], eax
                movzx   eax, word ptr [esp+18h+var_10]
                mov     eax, dword ptr cs:exctabpm_plus1+3[eax*8]
                mov     [esp+18h+var_14], eax
                mov     ax, [esp+1Ah]
                mov     word ptr [esp+18h+var_10], ax
                mov     ax, cs
                mov     [esp+18h+var_C], eax
                xor     eax, eax
                mov     [esp+18h+var_8], eax
                mov     eax, [esp+18h+arg_2]
                mov     [esp+18h+var_4], eax
                mov     eax, [esp+18h+arg_6]
                mov     [esp+18h], eax
                mov     eax, [esp+18h+arg_A]
                mov     [esp+18h+arg_2], eax

@@run:
                lea     eax, [esp+18h+arg_E]
                mov     [esp+18h+arg_6], eax
                mov     ax, ss
                movzx   eax, ax
                mov     [esp+18h+arg_A], eax
                mov     ax, offset @@ret
                xchg    eax, [esp+18h+var_10]
                db      66h
                retf
; ---------------------------------------------------------------------------

@@ret:
                mov     [esp], eax
                mov     eax, [esp+18h+var_C]
                mov     [esp+18h+var_4], eax
                mov     eax, [esp+18h+var_10]
                mov     [esp+18h+var_8], eax
                mov     eax, [esp+18h+var_14]
                mov     [esp+18h+var_C], eax
                mov     eax, [esp]
                add     esp, 0Ch
                iretd
irq_fail        endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

exc_handler     proc near
                pop     ax
                sub     ax, (offset excmatrix+1)
                shr     ax, 2
                mov     ah, 81h
                jmp     dword ptr cs:client_call
exc_handler     endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

irq_standard    proc near
                cli
                pop     ax
                sub     ax, (offset std_matrix+1)
                shr     ax, 2
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                mov     ds, cs:seldata
                inc     dword ptr _pc_irqpmtorm
                movzx   eax, al
                mov     dx, word ptr rmstackbase_and_top+2
                mov     bx, word ptr rmstacklen
                movzx   esi, dx
                sub     dx, bx
                shl     esi, 4
                cmp     dx, word ptr rmstackbase_and_top
                jb      critical_error_rm
                mov     word ptr rmstackbase_and_top+2, dx
                shl     bx, 4
                mov     edi, dword ptr irqtabrm_minus1+1[eax*4]
                mov     ds, selzero
                mov     word ptr [esi-2], ss
                mov     [esi-6], esp
                mov     dword ptr [esi-0Ah], seg KERNEL
                mov     word ptr [esi-0Ch], offset @irq
                shld    esi, edi, 10h
                sub     bx, 0Ch
                jmp     large [cs:pmtormswrout]
irq_standard    endp


; =============== S U B R O U T I N E =======================================


@irq            proc near
                cli
                mov     ax, 10h
                mov     cx, ax
                pop     ebx
                pop     dx
                mov     si, 8
                mov     edi, offset loc_11C30
                jmp     cs:rmtopmswrout
; ---------------------------------------------------------------------------

loc_11C30:                              ; also _pc_irqrmtopm
                inc     dword ptr cpu_detect
                mov     ax, word ptr rmstacklen
                add     word ptr rmstackbase_and_top+2, ax
                pop     gs
                pop     fs
                pop     es
                pop     ds
                popad
                pop     ax
                iretd
@irq            endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

irq_callback    proc far
                cli
                pop     ax
                sub     ax, (offset back_matrix+1)
                shr     ax, 2
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                mov     ds, cs:kernel_code
                inc     dword ptr loc_102F4
                mov     byte ptr _pc_irqcbrmtopm+2, al ; also irqset_rm - 3
                mov     edx, dword ptr pmstackbase_and_top+4
                mov     ebx, edx
                sub     edx, dword ptr pmstacklen_minus1+1
                cmp     edx, dword ptr pmstackbase_and_top
                jb      critical_error_pm
                mov     dword ptr pmstackbase_and_top+4, edx
                mov     bp, ss
                shl     ebp, 10h
                mov     bp, sp
                mov     si, word ptr irqcallbackptr
                mov     dword ptr (v_init__cbdata1B+100h)[si], esp
                add     word ptr irqcallbackptr, 4
                mov     ax, 8
                mov     cx, 18h
                mov     dx, cx
                mov     si, ax
                mov     edi, offset @@0
                jmp     rmtopmswrout
; ---------------------------------------------------------------------------

@@0:                                    ; also irqset_rm - 3
                movzx   bx, byte ptr _pc_irqcbrmtopm+2
                shl     bx, 3
                pushfd
                push    large 8
                push    large offset @@1
                jmp     large fword ptr (irqtab_pm_minus1+1)[bx]
; ---------------------------------------------------------------------------

@@1:
                mov     ax, seg KERNEL
                mov     si, ax
                mov     di, offset @@2
                mov     bx, bp
                shr     ebp, 10h
                mov     dx, bp
                jmp     large [cs:pmtormswrout]
; ---------------------------------------------------------------------------

@@2:
                inc     dword ptr _pc_irqcbpmtorm
                mov     eax, dword ptr pmstacklen_minus1+1
                add     dword ptr pmstackbase_and_top+4, eax
                sub     word ptr irqcallbackptr, 4
                mov     si, word ptr irqcallbackptr
                mov     esp, dword ptr (v_init__cbdata1B+100h)[si]
                pop     gs
                pop     fs
                pop     es
                pop     ds
                popad
                pop     ax
                iret
irq_callback    endp


; =============== S U B R O U T I N E =======================================


callback        proc far

arg_8           = byte ptr  0Ah

                mov     ax, sp
                push    ss
                push    ax
                push    gs
                push    fs
                push    ds
                push    es
                pushf
                cli
                push    cs
                pop     ds
                inc     dword ptr _pc_cbrmtopm+1
                mov     ebp, dword ptr pmstackbase_and_top+4
                mov     ebx, ebp
                sub     ebx, dword ptr pmstacklen_minus1+1
                mov     dword ptr pmstackbase_and_top+4, ebx
                cmp     ebx, dword ptr pmstackbase_and_top
                jb      critical_error_pm
                xor     eax, eax
                mov     ebx, eax
                mov     ax, ss
                shl     eax, 4
                mov     bx, sp
                add     ebx, eax
                mov     es, gdtseg
                or      eax, 92000000h
                mov     es:4Ah, eax
                mov     ax, 18h
                mov     dx, ax
                mov     si, 8
                mov     edi, offset @@0
                jmp     rmtopmswrout
; ---------------------------------------------------------------------------

@@0:
                mov     edi, [esp+0Eh]
                lea     esi, [esp+18h]
                mov     ecx, 8
                cld
                rep movs dword ptr es:[edi], dword ptr [esi]
                mov     esi, esp
                movs    word ptr es:[edi], word ptr [esi]
                movs    dword ptr es:[edi], dword ptr [esi]
                movs    dword ptr es:[edi], dword ptr [esi]
                lods    dword ptr [esi]
                add     ax, 2Ah ; '*'
                mov     es:[edi+4], eax
                mov     ds, cs:selcallback
                assume ds:nothing
                sub     edi, 2Ah ; '*'
                movzx   esi, ax
                xchg    esp, ebp
                pushfd
                db      66h
                push    cs
                push    large offset @@1
                movzx   eax, word ptr [ebp+16h]
                push    eax
                push    large dword ptr [ebp+12h]
                db      66h
                retf
; ---------------------------------------------------------------------------

@@1:
                cli
                push    es
                pop     ds
                assume ds:KERNEL
                mov     esi, edi
                mov     es, cs:selzero
                movzx   ebx, word ptr [esi+2Eh]
                movzx   edx, word ptr [esi+30h]
                sub     bx, 2Ah ; '*'
                mov     ebp, [esi+0Ch]
                mov     bp, bx
                lea     edi, ds:0[edx*4]
                lea     edi, [ebx+edi*4]
                mov     ecx, 8
                cld
                rep movs dword ptr es:[edi], dword ptr [esi]
                mov     eax, [esi+6]
                mov     es:[edi], eax
                mov     eax, [esi+0Ah]
                mov     es:[edi+4], eax
                mov     ax, [esi]
                mov     es:[edi+8], ax
                mov     ax, [esi+4]
                mov     cx, [esi+2]
                mov     si, seg KERNEL
                mov     di, offset @@2
                jmp     large [cs:pmtormswrout]
; ---------------------------------------------------------------------------

@@2:                                    ; also _pc_cbpmtorm-1
                inc     dword ptr cs:@@1+1
                mov     esp, ebp
                mov     eax, dword ptr cs:pmstacklen_minus1+1
                add     dword ptr cs:pmstackbase_and_top+4, eax
                popad
                pop     fs
                pop     gs
                iret
callback        endp ; sp-analysis failed

; ---------------------------------------------------------------------------
int31h_tab      i31_handler <300h, offset int31_0300>
                i31_handler <301h, offset int31_0301>
                i31_handler <302h, offset int31_0301>
                i31_handler <0, offset int31_0000>
                i31_handler <1, offset int31_0001>
                i31_handler <2, offset int31_0002>
                i31_handler <3, offset int31_0003>
                i31_handler <6, offset int31_0006>
                i31_handler <7, offset int31_0007>
                i31_handler <8, offset int31_0008>
                i31_handler <9, offset int31_0009>
                i31_handler <0Ah, offset int31_000A>
                i31_handler <0Bh, offset int31_000B>
                i31_handler <0Ch, offset int31_000C>
                i31_handler <0Eh, offset int31_000E>
                i31_handler <0Fh, offset int31_000F>
                i31_handler <100h, offset int31_0100>
                i31_handler <101h, offset int31_0101>
                i31_handler <102h, offset int31_0102>
                i31_handler <200h, offset int31_0200>
                i31_handler <201h, offset int31_0201>
                i31_handler <202h, offset int31_0202>
                i31_handler <203h, offset int31_0203>
                i31_handler <204h, offset int31_0204>
                i31_handler <205h, offset int31_0205>
                i31_handler <303h, offset int31_0303>
                i31_handler <304h, offset int31_0304>
                i31_handler <305h, offset int31_0305>
                i31_handler <306h, offset int31_0306>
                i31_handler <400h, offset int31_0400>
                i31_handler <500h, offset int31_0500>
                i31_handler <501h, offset int31_0501>
                i31_handler <502h, offset int31_0502>
                i31_handler <503h, offset int31_0503>
                i31_handler <50Ah, offset int31_050A>
                i31_handler <600h, offset int31_0600>
                i31_handler <601h, offset int31_0600>
                i31_handler <602h, offset int31_0600>
                i31_handler <603h, offset int31_0600>
                i31_handler <604h, offset int31_0604>
                i31_handler <702h, offset int31_0600>
                i31_handler <703h, offset int31_0600>
                i31_handler <800h, offset int31_0800>
                i31_handler <801h, offset int31_0801>
                i31_handler <900h, offset int31_0900>
                i31_handler <901h, offset int31_0901>
                i31_handler <902h, offset int31_0902>
                i31_handler <0A00h, offset int31_0A00>
                i31_handler <0E00h, offset int31_0E00>
                i31_handler <0E01h, offset int31_0E01>
                i31_handler <0EEFFh, offset int31_EEFF>

; =============== S U B R O U T I N E =======================================


int31h_pm       proc near

var_18          = word ptr -18h
var_10          = word ptr -10h
var_C           = word ptr -0Ch
arg_6           = byte ptr  8

                cli
                cld
                push    ds
                push    es
                push    fs
                push    gs
                pushad
                push    bx
                mov     ds, cs:seldata
                cmp     ax, int31h_cache_fn
                mov     bx, int31h_cache_ptr
                jz      short loc_11F3F
                xor     bx, bx

loc_11F22:
                cmp     ax, word ptr int31h_tab.func[bx]
                jz      short loc_11F34
                add     bx, 4
                cmp     bx, 0CCh ; 'Ì'
                jb      short loc_11F22
                pop     bx
                jmp     short int31fail8001
; ---------------------------------------------------------------------------

loc_11F34:
                mov     bx, int31h_tab.handler[bx]
                mov     int31h_cache_fn, ax
                mov     int31h_cache_ptr, bx

loc_11F3F:
                mov     ds, selzero
                xchg    bx, [esp]
                retn
; ---------------------------------------------------------------------------

int31fail8001:
                mov     al, 1
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8010:
                mov     al, 10h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8011:
                mov     al, 11h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8012:
                mov     al, 12h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8013:
                mov     al, 13h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8015:
                mov     al, 15h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8016:
                mov     al, 16h
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8021:
                mov     al, 21h ; '!'
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8022:
                mov     al, 22h ; '"'
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8023:
                mov     al, 23h ; '#'
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8024:
                mov     al, 24h ; '$'
                jmp     short int31failx
; ---------------------------------------------------------------------------

int31fail8025:
                mov     al, 25h ; '%'

int31failx:
                mov     ah, 80h ; '€'
                mov     [esp+28h+var_C], ax
                jmp     short int31fail
; ---------------------------------------------------------------------------

int31failbx:
                mov     [esp+28h+var_18], bx
                jmp     short int31failax
; ---------------------------------------------------------------------------

int31failcx:
                mov     [esp+28h+var_10], cx

int31failax:
                mov     [esp+28h+var_C], ax

int31fail:
                popad
                pop     gs
                pop     fs
                pop     es
                pop     ds

int31failnopop:
                or      [esp+arg_6], 1
                iretd
int31h_pm       endp ; sp-analysis failed

; ---------------------------------------------------------------------------

int31okedx:
                mov     [esp+14h], edx
                jmp     short int31okcx
; ---------------------------------------------------------------------------

int31okdx:
                mov     [esp+14h], dx
                jmp     short int31okcx
; ---------------------------------------------------------------------------

int31oksinoax:
                mov     ax, [esp+1Ch]
                mov     [esp+4], si
                mov     [esp], di

int31okbx:
                mov     [esp+10h], bx

int31okcx:
                mov     [esp+18h], cx

int31okax:
                mov     [esp+1Ch], ax

int31ok:
                popad
                pop     gs
                pop     fs
                pop     es
                pop     ds

int31oknopop:
                and     byte ptr [esp+8], 0FEh
                iretd

; =============== S U B R O U T I N E =======================================


int31testsel    proc near
                pop     bp
                cmp     bx, cs:gdtlimit
                ja      short int31fail8022
                mov     edi, cs:gdtbase
                and     ebx, 0FFF8h
                test    byte ptr [edi+ebx+6], 10h
                jz      int31fail8022
                jmp     bp
int31testsel    endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31testaccess proc near
                pop     bp
                test    ch, 20h
                jnz     int31fail8021
                test    cl, 90h
                jz      int31fail8021
                jnp     int31fail8021
                test    cl, 60h
                jnz     int31fail8021
                test    cl, 8
                jz      short loc_1202A
                test    cl, 2
                jz      int31fail8021
                test    cl, 4
                jnz     int31fail8021

loc_1202A:
                jmp     bp
int31testaccess endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31_testint   proc near
                movzx   ebx, bl
                mov     al, bl
                mov     ah, bl
                and     ax, 0F807h
                movzx   esi, al
                cmp     ah, picmaster
                jz      short locret_1204D
                add     si, 8
                cmp     ah, picslave
                jz      short locret_1204D
                or      si, 0FFFFh

locret_1204D:
                retn
int31_testint   endp

; ---------------------------------------------------------------------------

int31_0000:
                test    cx, cx
                jz      int31fail8021
                mov     edx, cs:gdtbase
                movzx   eax, cs:gdtlimit
                and     al, 0F8h
                mov     bx, cx

loc_12065:
                test    byte ptr [edx+eax+6], 10h
                jnz     short loc_1208E
                dec     bx
                jnz     short loc_12090
                mov     ebx, eax

loc_12073:
                mov     dword ptr [edx+ebx], 0
                mov     dword ptr [edx+ebx+4], 109200h
                add     bx, 8
                loop    loc_12073
                jmp     int31okax
; ---------------------------------------------------------------------------

loc_1208E:
                mov     bx, cx

loc_12090:
                sub     ax, 8
                cmp     ax, 50h ; 'P'
                jnb     short loc_12065
                jmp     int31fail8011
; ---------------------------------------------------------------------------

int31_0001:
                mov     ax, cs
                cmp     ax, bx
                jz      int31fail8022
                mov     ax, ss
                cmp     ax, bx
                jz      int31fail8022
                call    int31testsel
                xor     eax, eax
                mov     [edi+ebx], eax
                mov     [edi+ebx+4], eax
                mov     cx, 4
                lea     ebp, [esp+20h]

loc_120C5:
                cmp     [ebp+0], bx
                jnz     short loc_120CF
                mov     [ebp+0], ax

loc_120CF:
                add     ebp, 2
                loop    loc_120C5
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0002:
                mov     ds, cs:seldata
                assume ds:nothing
                mov     cx, 10h
                mov     si, (offset mem_used+2) ; also base of real mode alias table

loc_120E3:
                mov     ax, [si]
                test    ax, ax
                jz      short loc_120F0
                cmp     bx, [si+2]
                jz      int31okax

loc_120F0:
                add     si, 4
                loop    loc_120E3
                mov     cl, 10h
                mov     si, 92h ; '’'

loc_120FA:
                cmp     word ptr [si], 0
                jz      short loc_12107
                add     si, 4
                loop    loc_120FA
                jmp     int31fail8010
; ---------------------------------------------------------------------------

loc_12107:
                mov     [si+2], bx
                movzx   edi, bx
                shl     edi, 4
                mov     cl, 1
                xor     ax, ax
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE LDT DESCRS
                                        ; CX = number of descriptors to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful, AX = base selector
                jb      int31failax
                mov     [si], ax
                mov     bx, ax
                xor     cx, cx
                mov     dx, 0FFFFh
                mov     ax, 8
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT LIMIT
                                        ; BX = selector, CX:DX = segment limit
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     dx, di
                shr     edi, 10h
                mov     cx, di
                mov     ax, 7
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT BASE ADDRESS
                                        ; BX = selector, CX:DX = linear base address
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     cx, 92h ; '’'
                mov     ax, 9
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET DESCRIPTOR ACCESS RIGHTS
                                        ; BX = selector, CL = access rights/type byte
                                        ; CH = 80386 extended rights/type byte (32-bit DPMI implementations only)
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     ax, bx
                jmp     int31okax
; ---------------------------------------------------------------------------

int31_0003:
                mov     ax, 8
                jmp     int31okax
; ---------------------------------------------------------------------------

int31_0006:
                call    int31testsel
                mov     dx, [edi+ebx+2]
                mov     cl, [edi+ebx+4]
                mov     ch, [edi+ebx+7]
                jmp     int31okdx
; ---------------------------------------------------------------------------

int31_0007:
                call    int31testsel
                mov     [edi+ebx+2], dx
                mov     [edi+ebx+4], cl
                mov     [edi+ebx+7], ch
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0008:
                call    int31testsel
                cmp     cx, 0Fh
                jbe     short loc_1218A
                or      dx, 0FFFh
                shrd    dx, cx, 0Ch
                shr     cx, 0Ch
                or      cl, 80h

loc_1218A:
                mov     [edi+ebx], dx
                and     byte ptr [edi+ebx+6], 50h
                or      [edi+ebx+6], cl
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0009:
                call    int31testsel
                call    int31testaccess
                or      ch, 10h
                and     ch, 0D0h
                and     byte ptr [edi+ebx+6], 0Fh
                or      [edi+ebx+6], ch
                mov     [edi+ebx+5], cl
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_000A:
                call    int31testsel
                xor     ax, ax
                mov     cx, 1
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE LDT DESCRS
                                        ; CX = number of descriptors to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful, AX = base selector
                jb      int31fail8011
                push    ax
                push    ds
                pop     es
                assume es:nothing
                movzx   edi, ax
                mov     esi, cs:gdtbase
                add     edi, esi
                add     esi, ebx
                movs    dword ptr es:[edi], dword ptr [esi]
                lods    dword ptr [esi]
                mov     ah, 92h ; '’'
                stos    dword ptr es:[edi]
                pop     ax
                jmp     int31okax
; ---------------------------------------------------------------------------

int31_000B:
                call    int31testsel
                lea     esi, [edi+ebx]
                mov     edi, [esp]
                movs    dword ptr es:[edi], dword ptr [esi]
                movs    dword ptr es:[edi], dword ptr [esi]
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_000C:
                call    int31testsel
                mov     esi, [esp]
                mov     cx, es:[esi+5]
                call    int31testaccess
                push    ds
                push    es
                pop     ds
                pop     es
                assume es:nothing
                add     edi, ebx
                movs    dword ptr es:[edi], dword ptr [esi]
                lods    dword ptr [esi]
                or      al, 10h
                stos    word ptr es:[edi]
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_000E:
                mov     ax, 0Bh
                jmp     short loc_1222D
; ---------------------------------------------------------------------------

int31_000F:
                mov     ax, 0Ch

loc_1222D:
                test    cx, cx
                jz      int31ok
                mov     dx, cx
                xor     cx, cx

loc_12237:
                mov     bx, es:[edi]
                add     edi, 2
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET DESCRIPTOR
                                        ; BX = selector, ES:DI / ES:EDI -> 8-byte buffer for copy of descriptor
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      int31failcx
                add     edi, 8
                inc     cx
                dec     dx
                jnz     short loc_12237
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0100:
                mov     ah, 48h ; 'H'
                call    int31010x_f2
                jb      int31failbx
                mov     dx, ax
                xor     ax, ax
                mov     cx, 1
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE LDT DESCRS
                                        ; CX = number of descriptors to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful, AX = base selector
                jnb     short loc_1226C
                mov     ah, 49h ; 'I'
                call    int31010x_f2
                jmp     int31fail8011
; ---------------------------------------------------------------------------

loc_1226C:
                mov     [esp+14h], ax
                mov     [esp+1Ch], dx
                mov     bx, ax
                mov     cx, dx
                shl     dx, 4
                shr     cx, 0Ch
                mov     ax, 7
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT BASE ADDRESS
                                        ; BX = selector, CX:DX = linear base address
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     cx, 92h ; '’'
                mov     al, 9
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET DESCRIPTOR ACCESS RIGHTS
                                        ; BX = selector, CL = access rights/type byte
                                        ; CH = 80386 extended rights/type byte (32-bit DPMI implementations only)
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jmp     short int31010x
; ---------------------------------------------------------------------------

int31_0101:
                mov     ah, 49h ; 'I'
                mov     si, dx
                call    int31010x_f1
                jb      int31failax
                mov     bx, si
                jmp     int31_0001
; ---------------------------------------------------------------------------

int31_0102:
                mov     ah, 4Ah ; 'J'
                mov     si, dx
                call    int31010x_f1
                jb      int31failbx
                mov     bx, si

int31010x:
                movzx   edx, word ptr [esp+10h]
                shl     edx, 4
                dec     edx
                shld    ecx, edx, 10h
                mov     ax, 8
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT LIMIT
                                        ; BX = selector, CX:DX = segment limit
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jmp     int31ok

; =============== S U B R O U T I N E =======================================


int31010x_f1    proc near
                pop     bp
                push    ax
                push    bx
                mov     bx, dx
                mov     ax, 6
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET SEGMENT BASE ADDRESS
                                        ; BX = selector
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX = linear base address of segment
                pop     bx
                pop     ax
                jb      int31failax
                shrd    dx, cx, 4
                push    bp
int31010x_f1    endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31010x_f2    proc near

var_22          = word ptr -22h
var_16          = word ptr -16h
var_12          = word ptr -12h

                xor     cx, cx
                push    cx
                push    cx
                sub     esp, 0Ah
                push    dx
                push    cx
                pushad
                push    ss
                pop     es
                mov     edi, esp
                mov     bl, 21h ; '!'
                mov     ax, 300h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SIMULATE REAL MODE INTERRUPT
                                        ; BL=interrupt number
                                        ; CX=number of words to copy from protected mode to real mode stack
                                        ; ES:DI / ES:EDI = selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok
                mov     bx, [esp+32h+var_22]
                mov     ax, [esp+32h+var_16]
                lea     esp, [esp+32h]
                pop     bp
                jb      int31failax
                bt      [esp-2+var_12], 0
                jmp     bp
int31010x_f2    endp ; sp-analysis failed

; ---------------------------------------------------------------------------

int31_0200:
                movzx   ebx, bl
                mov     dx, ds:0[ebx*4]
                mov     cx, ds:2[ebx*4]
                jmp     int31okdx
; ---------------------------------------------------------------------------

int31_0201:
                mov     ebp, dr7
                xor     eax, eax
                mov     dr7, eax
                movzx   ebx, bl
                mov     ds:0[ebx*4], dx
                mov     ds:2[ebx*4], cx
                mov     dr7, ebp
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0202:
                mov     ds, cs:seldata
                cmp     bl, 20h ; ' '
                jnb     int31fail8021
                xor     cx, cx
                xor     edx, edx
                cmp     bl, 10h
                jnb     short loc_12375
                movzx   ebx, bl
                assume ds:KERNEL
                mov     cx, word ptr exctabpm_plus1+3[ebx*8]
                mov     edx, dword ptr exctabpm_minus3+3[ebx*8]

loc_12375:
                mov     ax, [esp+1Ch]
                jmp     int31okedx
; ---------------------------------------------------------------------------

int31_0203:
                xchg    bx, cx
                call    int31testsel
                xchg    bx, cx
                mov     ds, cs:seldata
                assume ds:nothing
                cmp     bl, 20h ; ' '
                jnb     int31fail8021
                cmp     bl, 10h
                jnb     short loc_123AA
                movzx   ebx, bl
                assume ds:KERNEL
                mov     word ptr exctabpm_plus1+3[ebx*8], cx
                mov     dword ptr exctabpm_minus3+3[ebx*8], edx

loc_123AA:
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0204:
                mov     ds, cs:seldata
                call    int31_testint
                jz      short loc_123D2

loc_123B7:
                shl     ebx, 3
                add     ebx, idtbase
                mov     ds, selzero
                mov     edx, [ebx+4]
                mov     dx, [ebx]
                mov     cx, [ebx+2]
                jmp     short loc_123FD
; ---------------------------------------------------------------------------

loc_123D2:
                bt      word ptr irqset_pm_minus1+1, si
                jnb     short loc_123F1
                test    bl, 0F0h
                jnz     short loc_123B7
                mov     cx, word ptr irqtab_pm_plus4[esi*8]
                mov     edx, dword ptr irqtab_pm_minus1+1[esi*8]
                jmp     short loc_123FD
; ---------------------------------------------------------------------------

loc_123F1:
                mov     cx, 8
                lea     edx, ds:1660h[esi*4]

loc_123FD:
                mov     ax, [esp+1Ch]
                jmp     int31okedx
; ---------------------------------------------------------------------------

int31_0205:
                xchg    bx, cx
                call    int31testsel
                xchg    bx, cx
                mov     ds, cs:seldata
                mov     es, selzero
                movzx   ecx, cx
                call    int31_testint
                jz      short loc_12457
                cmp     bl, 1Bh
                jz      setpmint_1B
                cmp     bl, 1Ch
                jz      setpmint_1C
                cmp     bl, 23h
                jz      setpmint_23
                cmp     bl, 24h
                jz      setpmint_24

loc_1243A:
                shl     ebx, 3
                add     ebx, idtbase
                mov     es:[ebx], dx
                shr     edx, 10h
                mov     es:[ebx+6], dx
                mov     es:[ebx+2], cx
                jmp     short loc_124D2
; ---------------------------------------------------------------------------

loc_12457:
                cmp     cx, 8
                jnz     short loc_12480
                btr     word ptr _pc_irqcbrmtopm+3, si ; also irqset_rm - 3
                btr     word ptr irqset_pm_minus1+1, si
                mov     eax, dword ptr irqtabrm_minus1+1[esi*4]
                mov     es:0[ebx*4], eax
                cmp     bl, 10h
                jnb     short loc_1243A
                jmp     short loc_124D2
; ---------------------------------------------------------------------------

loc_12480:                              ; also irqset_rm - 3
                bts     word ptr _pc_irqcbrmtopm+3, si
                bts     word ptr irqset_pm_minus1+1, si
                mov     eax, es:0[ebx*4]
                mov     dword ptr irqtabrm_minus1+1[esi*4], eax
                lea     eax, back_matrix[esi*4]
                mov     es:0[ebx*4], ax
                mov     word ptr es:2[ebx*4], seg KERNEL
                cmp     bl, 10h
                jnb     loc_1243A
                mov     word ptr irqtab_pm_plus4[esi*8], cx
                mov     dword ptr irqtab_pm_minus1+1[esi*8], edx

loc_124D2:
                jmp     int31ok
; ---------------------------------------------------------------------------

setpmint_1B:
                cmp     cx, 8
                mov     eax, dword ptr newint1Bh+1
                jnz     short loc_124E2
                mov     eax, dword ptr oldint1Bh_and_1Ch+1

loc_124E2:
                mov     es:6Ch, eax
                jmp     loc_1243A
; ---------------------------------------------------------------------------

setpmint_1C:
                cmp     cx, 8
                mov     eax, dword ptr newint1Ch+1
                jnz     short loc_124F7
                mov     eax, dword ptr oldint1Bh_and_1Ch+5

loc_124F7:
                mov     es:70h, eax
                jmp     loc_1243A
; ---------------------------------------------------------------------------

setpmint_23:
                cmp     cx, 8
                mov     eax, dword ptr @@v2+1
                jnz     short loc_1250C
                mov     eax, dword ptr oldint23h_minus1+1

loc_1250C:
                mov     es:8Ch, eax
                jmp     loc_1243A
; ---------------------------------------------------------------------------

setpmint_24:
                cmp     cx, 8
                mov     eax, dword ptr newint24h
                jnz     short loc_12521
                mov     eax, dword ptr oldint24h

loc_12521:
                mov     es:90h, eax
                jmp     loc_1243A
; ---------------------------------------------------------------------------

int31_0900:
                add     esp, 26h
                pop     ds
                btr     word ptr [esp+8], 9
                setb    al
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0901:
                add     esp, 26h
                pop     ds
                bts     word ptr [esp+8], 9
                setb    al
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0902:
                add     esp, 26h
                pop     ds
                bt      word ptr [esp+8], 9
                setb    al
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0301:
                mov     ebp, es:[edi+2Ah]
                jmp     short loc_12574
; ---------------------------------------------------------------------------

int31_0300:
                movzx   ebx, bl
                mov     ebp, [ebx*4+0]

loc_12574:
                mov     gs, cs:seldata
                assume gs:KERNEL
                movzx   ebx, word ptr es:[edi+2Eh]
                movzx   edx, word ptr es:[edi+30h]
                mov     ax, bx
                or      ax, dx
                jnz     short loc_125AA
                mov     dx, word ptr cs:rmstackbase_and_top+2
                mov     bx, word ptr cs:rmstacklen
                sub     dx, bx
                cmp     dx, word ptr cs:rmstackbase_and_top
                jb      int31fail8012
                mov     word ptr gs:rmstackbase_and_top+2, dx
                shl     bx, 4

loc_125AA:
                lea     edi, ds:0[edx*4]
                lea     edi, [ebx+edi*4]
                mov     ax, ss
                xchg    ax, word ptr gs:rmstackss+1
                push    ax
                lea     eax, [esp-4]
                xchg    eax, dword ptr gs:rmstackesp+1
                push    eax
                movzx   ecx, cx
                mov     ax, cx
                add     ax, ax
                sub     bx, 2Eh ; '.'
                sub     bx, ax
                push    ds
                push    es
                pop     ds
                pop     es
                std
                sub     edi, 2
                lea     esi, [esp+ecx*2+38h]
                rep movs word ptr es:[edi], word ptr ss:[esi]
                mov     esi, [esp+6]
                mov     ax, [esi+20h]
                cmp     byte ptr [esp+22h], 1
                jz      short loc_12608
                and     ah, 0FCh
                stos    word ptr es:[edi]
                sub     bx, 2

loc_12608:
                cld
                lea     edi, ds:0[edx*4]
                lea     edi, [ebx+edi*4]
                mov     cl, 8
                rep movs dword ptr es:[edi], dword ptr [esi]
                add     esi, 6
                movs    dword ptr es:[edi], dword ptr [esi]
                mov     word ptr es:[edi+8], seg KERNEL
                mov     word ptr es:[edi+6], offset loc_12657
                mov     es:[edi+4], ax
                mov     es:[edi], ebp
                mov     ax, [esi-6]
                mov     cx, [esi-8]
                mov     si, seg KERNEL
                mov     di, offset loc_12650
                jmp     large [cs:pmtormswrout]
; ---------------------------------------------------------------------------

loc_12650:
                popad
                pop     fs
                pop     gs
                assume gs:nothing
                iret
; ---------------------------------------------------------------------------

loc_12657:
                push    gs
                push    fs
                push    ds
                push    es
                pushf
                cli
                pushad
                xor     eax, eax
                mov     ax, ss
                xor     ebp, ebp
                shl     eax, 4
                mov     bp, sp
                add     ebp, eax
                mov     dx, word ptr cs:rmstackss+1
                mov     ebx, dword ptr cs:rmstackesp+1
                mov     ax, 18h
                mov     cx, 10h
                mov     si, 8
                mov     edi, offset loc_12691
                jmp     cs:rmtopmswrout
; ---------------------------------------------------------------------------

loc_12691:
                push    es
                pop     gs
                assume es:KERNEL
                pop     large [dword ptr es:rmstackesp+1]
                pop     word ptr es:rmstackss+1
                mov     esi, ebp
                mov     edi, [esp]
                mov     es, word ptr [esp+24h]
                assume es:nothing
                mov     ecx, 15h
                cld
                rep movs word ptr es:[edi], word ptr [esi]
                cmp     dword ptr es:[edi+4], 0
                jnz     int31ok
                mov     ax, word ptr cs:rmstacklen
                assume gs:KERNEL
                add     word ptr gs:rmstackbase_and_top+2, ax
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0303:
                mov     bl, cs:pm32_callbacks
                test    bl, bl
                jz      int31fail8015
                mov     edx, dword ptr cs:callbackbase_and_seg
                mov     ecx, edx

loc_126E1:
                cmp     word ptr [edx+3], 0
                jz      short loc_126F3
                add     edx, 19h
                dec     bl
                jnz     short loc_126E1
                jmp     int31fail8015
; ---------------------------------------------------------------------------

loc_126F3:
                mov     bx, [esp+26h]
                mov     [edx+3], bx
                mov     [edx+7], esi
                mov     word ptr [edx+0Ch], es
                mov     [edx+10h], edi
                sub     edx, ecx
                shr     ecx, 4
                jmp     int31okdx
; ---------------------------------------------------------------------------

int31_0304:
                cmp     cx, word ptr cs:callbackbase_and_seg+4
                jnz     int31fail8024
                movzx   ebx, dx
                xor     ax, ax
                xchg    ax, dx
                mov     cx, 19h
                div     cx
                test    dx, dx
                jnz     int31fail8024
                test    ah, ah
                jnz     int31fail8024
                cmp     al, cs:pm32_callbacks
                jnb     int31fail8024
                add     ebx, dword ptr cs:callbackbase_and_seg
                mov     word ptr [ebx+3], 0
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0305:
                add     esp, 26h
                pop     ds
                xor     ax, ax
                mov     bx, cs:kernel_code
                mov     cx, (offset prefixed_retf+1)
                mov     si, cs
                mov     edi, offset prefixed_retf
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0306:
                add     esp, 26h
                pop     ds
                mov     si, cs
                mov     edi, cs:pmtormswrout
                mov     bx, cs:kernel_code
                mov     cx, cs:rmtopmswrout
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0400:
                add     esp, 26h
                pop     ds
                mov     ax, 5Ah ; 'Z'
                mov     bx, 3
                cmp     cs:pmodetype, 2
                jnz     short loc_12796
                mov     bl, 1

loc_12796:
                mov     cl, cs:cputype
                mov     dx, word ptr cs:picslave
                jmp     int31oknopop
; ---------------------------------------------------------------------------

int31_0A00:
                add     esp, 26h
                pop     ds
                push    es
                push    edi
                push    ecx
                push    esi
                push    cs
                pop     es
                assume es:KERNEL
                mov     ecx, 0Fh
                mov     edi, offset aSunsysDos32a ; "SUNSYS DOS/32A"
                push    esi
                repe cmps byte ptr [esi], byte ptr es:[edi]
                pop     esi
                mov     edi, offset sunsys_entry
                jz      short loc_127F2
                test    cs:pm32_mode, 80h
                jnz     short loc_12822
                mov     cl, 10h
                mov     edi, offset aRationalDos4g ; "RATIONAL DOS/4G"
                repe cmps byte ptr [esi], byte ptr es:[edi]
                jnz     short loc_12822
                mov     edi, offset rational_entry
                pop     esi
                pop     ecx
                add     esp, 6
                jmp     int31oknopop
; ---------------------------------------------------------------------------

loc_127F2:
                add     esp, 0Eh
                xor     eax, eax
                mov     ebx, eax
                mov     ecx, eax
                mov     edx, eax
                mov     ax, cs:client_version
                mov     bl, cs:pm32_mode
                mov     bh, cs:pmodetype
                mov     cl, cs:cputype
                mov     ch, cs:fputype
                mov     dx, word ptr cs:picslave
                jmp     int31oknopop
; ---------------------------------------------------------------------------

loc_12822:
                pop     esi
                pop     ecx
                pop     edi
                pop     es
                assume es:nothing
                mov     ax, 8001h
                jmp     int31failnopop
; ---------------------------------------------------------------------------
aSunsysDos32a   db 'SUNSYS DOS/32A',0
aRationalDos4g  db 'RATIONAL DOS/4G',0
; ---------------------------------------------------------------------------

rational_entry:
                mov     ax, 8500h
                jmp     dword ptr cs:client_call
; ---------------------------------------------------------------------------

sunsys_entry:
                test    al, al
                jz      short API_func00
                cmp     al, 1
                jz      short API_func01
                cmp     al, 2
                jz      short API_func02
                cmp     al, 3
                jz      short API_func03
                cmp     al, 4
                jz      API_func04
                cmp     al, 5
                jz      API_func05
                cmp     al, 6
                jz      API_func06
                cmp     al, 7
                jz      API_func07
                cmp     al, 8
                jz      API_func08
                cmp     al, 9
                jz      API_func09
                stc
                db      66h
                retf
; ---------------------------------------------------------------------------

API_func00:
                mov     bx, 18h
                movzx   ecx, cs:gdtlimit
                movzx   edx, cs:idtlimit
                mov     esi, cs:gdtbase
                mov     edi, cs:idtbase
                jmp     loc_12972
; ---------------------------------------------------------------------------

API_func01:
                mov     bx, 18h
                movzx   ecx, cs:pagetables
                movzx   edx, cs:pm32_maxfpages
                mov     esi, dword ptr cs:pagetablebase_minus5+5 ; also id32_tsrmode - 3
                                        ; also id32_spawned_id - 1
                mov     edi, dword ptr cs:phystablebase
                inc     cx
                jmp     loc_12972
; ---------------------------------------------------------------------------

API_func02:
                mov     bx, 10h
                mov     esi, (offset _pc_irqcbrmtopm+3) ; also irqset_rm - 3
                mov     edi, (offset irqtabrm_minus1+1)
                jmp     loc_12972
; ---------------------------------------------------------------------------

API_func03:
                mov     bx, 18h
                mov     ecx, dword ptr cs:mem_free
                mov     edx, dword ptr cs:pm32_info ; also mem_ptr
                mov     esi, dword ptr cs:mem_top_minus1+1
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func04:
                mov     bx, 18h
                movzx   ecx, word ptr cs:rmstacklen
                movzx   edx, word ptr cs:rmstackbase_and_top+2
                movzx   esi, word ptr cs:rmstackbase_and_top
                movzx   edi, word ptr cs:rmstacktop2+1
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func05:
                mov     bx, 18h
                mov     ecx, dword ptr cs:pmstacklen_minus1+1
                mov     edx, dword ptr cs:pmstackbase_and_top+4
                mov     esi, dword ptr cs:pmstackbase_and_top
                mov     edi, dword ptr cs:pmstacktop2
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func06:
                mov     bx, 8
                mov     cx, 10h
                mov     dx, 18h
                movzx   esi, cs:kernel_code
                mov     di, cs:client_call+2
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func07:
                mov     cx, cs:client_call+2
                mov     dx, cs:client_call
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func08:
                push    ds
                mov     ds, cs:seldata
                assume ds:nothing
                mov     ds:12h, cx
                mov     ds:10h, dx
                pop     ds
                assume ds:KERNEL
                jmp     short loc_12972
; ---------------------------------------------------------------------------

API_func09:
                mov     cx, 10h
                mov     edx, (offset _pc_intrmtopm_minus1+1)

loc_12972:
                clc
                db      66h
                retf
; ---------------------------------------------------------------------------

int31_0500:
                or      eax, 0FFFFFFFFh
                mov     ecx, 0Ch
                push    edi
                rep stos dword ptr es:[edi]
                pop     edi
                mov     eax, dword ptr cs:pm32_info ; also mem_ptr
                or      eax, dword ptr cs:mem_free
                jz      short loc_1299A
                call    int31_checkblocks
                call    int31_getfreemem

loc_1299A:
                mov     ebx, eax
                mov     edx, eax
                mov     eax, dword ptr cs:mem_free
                shr     eax, 0Ch
                shr     ebx, 0Ch
                shr     ecx, 0Ch
                push    es
                pop     ds
                mov     [edi], edx
                mov     [edi+4], ebx
                mov     [edi+8], ebx
                mov     [edi+0Ch], eax
                mov     [edi+10h], ebx
                mov     [edi+14h], ecx
                mov     [edi+18h], eax
                mov     [edi+1Ch], ecx
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0501:
                call    int31_checkifmemavail
                call    int31_testbxcxtoebx
                add     ebx, 1000h      ; DOS32AWE ADDITION: crash prevention - add 4K to every allocation
                call    int31_checkblocks
                mov     esi, dword ptr cs:pm32_info ; also mem_ptr

loc_129F3:
                mov     eax, [esi+4]
                btr     eax, 1Fh
                jb      short loc_12A06
                cmp     eax, ebx
                jnb     int31_allocblock

loc_12A06:
                lea     esi, [esi+eax+10h]
                cmp     esi, dword ptr cs:mem_top_minus1+1
                jb      short loc_129F3
                jmp     int31fail8013
; ---------------------------------------------------------------------------

int31_0502:
                shl     esi, 10h
                mov     si, di
                call    int31_checkifmemavail
                call    int31_checkblocks
                call    int31_checkhandle
                btr     dword ptr [esi+4], 1Fh
                call    int31_linkfreeblocks
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0503:
                shl     esi, 10h
                mov     si, di
                call    int31_checkifmemavail
                call    int31_testbxcxtoebx
                add     ebx, 1000h      ; DOS32AWE ADDITION: crash prevention - add 4K to every allocation
                call    int31_checkblocks
                call    int31_checkhandle
                mov     eax, [esi+4]
                btr     eax, 1Fh
                jnb     int31fail8023
                cmp     eax, ebx
                jnb     int31_allocblock
                mov     [esi+4], eax
                lea     edi, [esi+eax+10h]
                cmp     edi, dword ptr cs:mem_top_minus1+1
                jnb     short loc_12A96
                mov     edx, [edi+4]
                btr     edx, 1Fh
                jb      short loc_12A96
                lea     edx, [eax+edx+10h]
                cmp     edx, ebx
                jb      short loc_12A96
                mov     eax, edx
                mov     [esi+4], eax
                jmp     int31_allocblock
; ---------------------------------------------------------------------------

loc_12A96:                              ; also mem_ptr
                mov     edi, dword ptr cs:pm32_info

loc_12A9C:
                mov     edx, [edi+4]
                btr     edx, 1Fh
                jb      short loc_12AAD
                cmp     edx, ebx
                jnb     short loc_12AC8

loc_12AAD:
                lea     edi, [edi+edx+10h]
                cmp     edi, dword ptr cs:mem_top_minus1+1
                jb      short loc_12A9C
                bts     eax, 1Fh
                mov     [esi+4], eax
                jmp     int31fail8013
; ---------------------------------------------------------------------------

loc_12AC8:
                push    esi
                push    edi
                mov     ecx, eax
                shr     ecx, 2
                add     esi, 10h
                add     edi, 10h
                rep movs dword ptr es:[edi], dword ptr [esi]
                mov     cl, al
                and     cl, 3
                rep movs byte ptr es:[edi], byte ptr [esi]
                pop     edi
                pop     esi
                call    int31_linkfreeblocks
                mov     esi, edi
                mov     eax, edx
                jmp     int31_allocblock
; ---------------------------------------------------------------------------

int31_050A:
                shl     esi, 10h
                mov     si, di
                call    int31_checkifmemavail
                call    int31_checkblocks
                call    int31_checkhandle
                mov     ebx, [esi+4]
                btr     ebx, 1Fh
                jnb     int31fail8023
                add     esi, 10h
                xchg    ebx, esi
                mov     cx, bx
                shr     ebx, 10h
                mov     di, si
                shr     esi, 10h
                jmp     int31oksinoax

; =============== S U B R O U T I N E =======================================


int31_checkifmemavail proc near
                pop     bp
                push    eax
                mov     eax, dword ptr cs:pm32_info ; also mem_ptr
                or      eax, dword ptr cs:mem_free
                pop     eax
                jz      int31fail8013
                jmp     bp
int31_checkifmemavail endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31_checkblocks proc near
                push    eax
                push    esi
                mov     esi, dword ptr cs:pm32_info ; also mem_ptr

loc_12B4A:
                test    si, 0Fh
                jnz     short loc_12B8A
                mov     eax, 12345678h
                cmp     eax, [esi]
                jnz     short loc_12B8A
                cmp     eax, [esi+0Ch]
                jnz     short loc_12B8A
                mov     eax, [esi+4]
                btr     eax, 1Fh
                lea     esi, [esi+eax+10h]
                cmp     esi, dword ptr cs:pm32_info ; also mem_ptr
                jb      short loc_12B8A
                cmp     esi, dword ptr cs:mem_top_minus1+1
                ja      short loc_12B8A
                jb      short loc_12B4A
                pop     esi
                pop     eax
                retn
; ---------------------------------------------------------------------------

loc_12B8A:
                mov     ds, cs:seldata
                xor     eax, eax
                mov     dword ptr pm32_info, eax ; also mem_ptr
                mov     dword ptr mem_free, eax
                mov     ax, 8400h
                jmp     dword ptr client_call
int31_checkblocks endp


; =============== S U B R O U T I N E =======================================


int31_checkhandle proc near
                pop     bp
                cmp     esi, dword ptr cs:pm32_info ; also mem_ptr
                jb      short loc_12BC7
                cmp     esi, dword ptr cs:mem_top_minus1+1
                ja      short loc_12BC7
                mov     eax, 12345678h
                cmp     eax, [esi]
                jnz     short loc_12BC7
                cmp     eax, [esi+0Ch]
                jnz     short loc_12BC7
                jmp     bp
; ---------------------------------------------------------------------------

loc_12BC7:
                jmp     int31fail8023
int31_checkhandle endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31_testbxcxtoebx proc near
                pop     bp
                shl     ebx, 10h
                mov     bx, cx
                test    ebx, ebx
                jz      int31fail8021
                add     ebx, 0Fh
                and     bl, 0F0h
                bt      ebx, 1Fh
                jb      int31fail8021
                jmp     bp
int31_testbxcxtoebx endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


int31_getfreemem proc near
                xor     eax, eax
                xor     ecx, ecx
                mov     esi, dword ptr cs:pm32_info ; also mem_ptr

loc_12BF6:
                mov     edx, [esi+4]
                btr     edx, 1Fh
                jb      short loc_12C0D
                add     ecx, edx
                cmp     eax, edx
                ja      short loc_12C0D
                mov     eax, edx

loc_12C0D:
                lea     esi, [esi+edx+10h]
                cmp     esi, dword ptr cs:mem_top_minus1+1
                jb      short loc_12BF6
                retn
int31_getfreemem endp

; ---------------------------------------------------------------------------

int31_allocblock:
                mov     ecx, 12345678h
                movzx   edx, word ptr cs:id32_process_id_minus2+2
                sub     eax, ebx
                sub     eax, 10h
                jb      short loc_12C4B
                lea     edi, [esi+ebx+10h]
                mov     [edi], ecx
                mov     [edi+4], eax
                mov     [edi+8], edx
                mov     [edi+0Ch], ecx

loc_12C4B:
                bts     ebx, 1Fh
                mov     [esi], ecx
                mov     [esi+4], ebx
                mov     [esi+8], edx
                mov     [esi+0Ch], ecx
                call    int31_linkfreeblocks
                lea     ebx, [esi+10h]
                mov     cx, bx
                shr     ebx, 10h
                mov     di, si
                shr     esi, 10h
                jmp     int31oksinoax

; =============== S U B R O U T I N E =======================================


int31_linkfreeblocks proc near
                pushad
                mov     edi, dword ptr cs:pm32_info ; also mem_ptr
                mov     ebp, dword ptr cs:mem_top_minus1+1
                mov     eax, [edi+4]
                btr     eax, 1Fh
                lea     esi, [edi+eax+10h]
                cmp     esi, ebp
                jnb     short loc_12CFD
                mov     esi, edi

loc_12CA0:
                mov     eax, [esi+4]
                btr     eax, 1Fh
                jb      short loc_12CF2
                xor     ebx, ebx
                xor     ecx, ecx
                mov     edi, esi
                jmp     short loc_12CDD
; ---------------------------------------------------------------------------

loc_12CB7:
                add     ecx, 10h
                mov     eax, [esi+4]
                btr     eax, 1Fh
                lea     ebx, [eax+ebx]
                jnb     short loc_12CDD
                sub     ebx, eax
                sub     ecx, 10h
                add     ebx, ecx
                add     [edi+4], ebx
                jmp     short loc_12CF2
; ---------------------------------------------------------------------------

loc_12CDD:
                lea     esi, [esi+eax+10h]
                cmp     esi, ebp
                jb      short loc_12CB7
                add     ebx, ecx
                add     [edi+4], ebx
                jmp     short loc_12CFD
; ---------------------------------------------------------------------------

loc_12CF2:
                lea     esi, [esi+eax+10h]
                cmp     esi, ebp
                jb      short loc_12CA0

loc_12CFD:
                popad
                retn
int31_linkfreeblocks endp

; ---------------------------------------------------------------------------

int31_0600:
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0604:
                xor     bx, bx
                mov     cx, 1000h
                jmp     int31okbx
; ---------------------------------------------------------------------------

int31_0800:
                shl     ebx, 10h
                shl     esi, 10h
                mov     bx, cx
                mov     si, di
                cmp     ebx, 100000h
                jb      int31fail8021
                test    esi, esi
                jz      int31fail8021
                cmp     cs:pmodetype, 2
                jz      short loc_12D34
                jmp     int31ok
; ---------------------------------------------------------------------------

loc_12D34:
                cmp     cs:pm32_maxfpages, 0
                jz      int31fail8012
                push    ds
                pop     es
                assume es:KERNEL
                mov     edi, dword ptr cs:phystablebase

loc_12D46:
                mov     eax, ebx
                lea     ecx, [esi+0FFFh]
                and     ax, 0F000h
                shr     ecx, 0Ch
                mov     edx, edi

loc_12D5B:
                cmp     edi, dword ptr cs:phystabletop_minus2+2
                jnb     short loc_12D90
                mov     ebp, [edi]
                and     bp, 0F000h
                cmp     eax, ebp
                jz      short loc_12D76
                add     edi, 4
                jmp     short loc_12D46
; ---------------------------------------------------------------------------

loc_12D76:
                add     edi, 4
                add     eax, 1000h
                dec     ecx
                jnz     short loc_12D5B
                mov     eax, ebx
                and     ax, 0F000h
                sub     ebx, eax
                jmp     loc_12E0F
; ---------------------------------------------------------------------------

loc_12D90:
                mov     edi, dword ptr cs:phystablebase
                mov     ecx, dword ptr cs:phystabletop_minus2+2
                sub     ecx, edi
                shr     ecx, 2
                mov     eax, ebx
                and     ax, 0F000h
                lea     ebp, [ebx+esi+0FFFh]
                sub     ebp, eax
                shr     ebp, 0Ch

loc_12DB9:
                test    ecx, ecx
                jz      int31fail8021
                xor     eax, eax
                repne scas dword ptr es:[edi]
                lea     edx, [edi-4]
                repe scas dword ptr es:[edi]
                mov     eax, edi
                sub     eax, edx
                shr     eax, 2
                cmp     eax, ebp
                jb      short loc_12DB9
                mov     eax, ebx
                and     ax, 0F000h
                sub     ebx, eax
                mov     edi, edx
                mov     ecx, ebp
                mov     al, 7
                cmp     cs:cputype, 3
                jbe     short loc_12DFA
                mov     al, 1Fh

loc_12DFA:
                stos    dword ptr es:[edi]
                add     eax, 1000h
                loop    loc_12DFA
                or      byte ptr [edx+1], 2
                or      byte ptr [edi-3], 4

loc_12E0F:
                sub     edx, dword ptr cs:phystablebase
                shl     edx, 0Ah
                add     edx, ebx
                mov     [esp+18h], dx
                shr     edx, 10h
                or      dx, 8000h
                mov     [esp+10h], dx
                mov     eax, cs:vcpi_cr3
                mov     cr3, eax
                xor     eax, eax
                mov     cr2, eax
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0801:
                cmp     cs:pmodetype, 2
                jz      short loc_12E4A
                jmp     int31ok
; ---------------------------------------------------------------------------

loc_12E4A:
                cmp     cs:pm32_maxfpages, 0
                jz      int31fail8012
                and     bx, 7FFFh
                shl     ebx, 10h
                mov     bx, cx
                shr     ebx, 0Ah
                and     bl, 0FCh
                add     ebx, dword ptr cs:phystablebase
                cmp     ebx, dword ptr cs:phystablebase
                jb      int31fail8025
                cmp     ebx, dword ptr cs:phystabletop_minus2+2
                jnb     int31fail8025
                test    byte ptr [ebx+1], 2
                jz      int31fail8025

loc_12E88:
                xor     eax, eax
                xchg    eax, [ebx]
                add     ebx, 4
                test    ah, 4
                jz      short loc_12E88
                mov     eax, cs:vcpi_cr3
                mov     cr3, eax
                xor     eax, eax
                mov     cr2, eax
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_0E00:
                movzx   ax, cs:fputype
                shl     ax, 4
                smsw    dx
                and     dl, 6
                shr     dl, 1
                or      al, dl
                shl     dl, 2
                or      al, dl
                jmp     int31okax
; ---------------------------------------------------------------------------

int31_0E01:
                mov     ds, cs:seldata
                assume ds:nothing
                and     bl, 3
                shl     bl, 1
                smsw    ax
                or      al, bl
                lmsw    ax
                jmp     int31ok
; ---------------------------------------------------------------------------

int31_EEFF:
                add     esp, 26h
                pop     ds
                assume ds:KERNEL
                push    cs
                pop     es
                mov     eax, 'D32A'
                mov     ebx, 2E88h
                mov     ch, cs:pmodetype
                mov     cl, cs:cputype
                mov     dx, cs:client_version
                jmp     int31oknopop
; ---------------------------------------------------------------------------
                align 10h
KERNEL          ends

; ===========================================================================

; Segment type: Pure code
TEXT16          segment byte public 'CODE' use16
                assume cs:TEXT16
                assume es:nothing, ss:nothing, ds:TEXT16, fs:nothing, gs:nothing

; =============== S U B R O U T I N E =======================================


get_default_config proc near
                push    ds
                push    es
                mov     ax, seg ID32
                mov     dx, seg KERNEL
                mov     _seg_id32, ax
                mov     _seg_kernel, dx
                push    ax
                push    dx
                mov     ax, 0FF87h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                cmp     dx, 'ID'
                jnz     short loc_12F37
                cmp     ax, '32'
                jnz     short loc_12F37
                mov     es, cs:_seg_id32
                xor     di, di
                mov     cx, 0Ch
                rep movsw
                mov     ds, cs:_seg_ds
                or      _sys_misc, 1

loc_12F37:
                pop     dx
                pop     ax
                mov     ds, ax
                mov     es, dx
                xor     si, si
                mov     di, 0
                lodsw
                cmp     ax, 'DI'
                jnz     short loc_12F6E
                lodsw
                cmp     ax, '23'
                jnz     short loc_12F6E
                mov     cx, 10h
                rep movsb
                mov     es, cs:_seg_ds
                assume es:TEXT16
                and     word ptr [si], 7FFFh
                lodsw
                mov     word ptr es:_misc_byte_1, ax
                lodsw
                mov     es:_lowmembuf, ax
                lodsw
                mov     es:_version, ax
                clc
                jmp     short loc_12F6F
; ---------------------------------------------------------------------------

loc_12F6E:
                stc

loc_12F6F:
                pop     es
                assume es:nothing
                pop     ds
                retn
get_default_config endp


; =============== S U B R O U T I N E =======================================

; also _app_buf_allocsel

get_environ_config proc near
                push    ds
                push    es
                jb      short @@done
                test    _misc_byte_2, 1
                jz      short @@done
                mov     es, _seg_env
                xor     di, di
                mov     cx, 0FFFFh
                xor     ax, ax

loc_12F88:
                push    cx
                mov     cx, 7
                mov     si, offset aDos32aweQuietpr ; "DOS32AWE="
                repe cmpsb
                pop     cx
                jz      short loc_12F9D
                repne scasb
                cmp     al, es:[di]
                jnz     short loc_12F88
                jmp     short @@done
; ---------------------------------------------------------------------------

loc_12F9D:
                call    skip_env_spaces
                cmp     byte ptr es:[di], 0
                jz      short @@done
                call    get_env_word
                call    skip_env_nonspaces
                cmp     byte ptr es:[di], 0
                jnz     short loc_12F9D

@@done:
                pop     es
                pop     ds
                retn
get_environ_config endp


; =============== S U B R O U T I N E =======================================


get_env_word    proc near

; FUNCTION CHUNK AT 0170 SIZE 000000DE BYTES

                xor     bx, bx

loc_12FB7:
                mov     si, word ptr dfn_tab.name[bx]
                cmp     si, 0FFFFh
                jz      short locret_12FCF
                mov     cx, dfn_tab.namelen[bx]
                push    di
                repe cmpsb
                pop     di
                jz      short loc_12FD0

loc_12FCA:
                add     bx, 6
                jmp     short loc_12FB7
; ---------------------------------------------------------------------------

locret_12FCF:
                retn
; ---------------------------------------------------------------------------

loc_12FD0:
                add     di, dfn_tab.namelen[bx]
                jmp     cs:dfn_tab.handler[bx]
get_env_word    endp


; =============== S U B R O U T I N E =======================================


skip_env_spaces proc near
                mov     al, es:[di]
                test    al, al
                jz      short locret_12FEC
                cmp     al, '/'
                jz      short loc_12FEB
                cmp     al, ' '
                jnz     short locret_12FEC
                inc     di
                jmp     short skip_env_spaces
; ---------------------------------------------------------------------------

loc_12FEB:
                inc     di

locret_12FEC:
                retn
skip_env_spaces endp


; =============== S U B R O U T I N E =======================================


skip_env_nonspaces proc near
                mov     al, es:[di]
                test    al, al

_app_buf_allocbase:
                jz      short locret_13000
                cmp     al, '/'
                jz      short loc_12FFF
                cmp     al, ' '
                jz      short locret_13000
                inc     di
                jmp     short skip_env_nonspaces
; ---------------------------------------------------------------------------

loc_12FFF:
                inc     di

locret_13000:
                retn
skip_env_nonspaces endp


; =============== S U B R O U T I N E =======================================


get_env_swc     proc near
                cmp     byte ptr es:[di], ':'
                jnz     short loc_13008
                inc     di

loc_13008:
                xor     ax, ax
                cmp     byte ptr es:[di], '0'
                jz      short @@x1
                inc     ax
                cmp     byte ptr es:[di], '1'
                jz      short @@x1
                cmp     word ptr es:[di], 'NO'
                jz      short @@x2
                dec     ax
                cmp     word ptr es:[di], 'FO'
                jnz     short @@x0
                cmp     byte ptr es:[di+2], 'F'
                jz      short @@x3

@@x0:
                stc
                retn
; ---------------------------------------------------------------------------

@@x3:
                inc     di

@@x2:
                inc     di

@@x1:
                inc     di
                test    al, al
                retn
get_env_swc     endp


; =============== S U B R O U T I N E =======================================


get_env_num     proc near
                cmp     byte ptr es:[di], ':'
                jnz     short loc_1303C
                inc     di

loc_1303C:
                xor     ax, ax
                xor     bx, bx
                mov     cx, 10
                mov     al, es:[di]
                sub     al, '0'
                jb      short loc_1306E
                cmp     al, 9
                ja      short loc_1306E
                xchg    ax, bx
                mul     cx
                xchg    ax, bx
                add     bx, ax

loc_13054:
                inc     di
                xor     ax, ax
                mov     al, es:[di]
                sub     al, '0'
                jb      short loc_1306A
                cmp     al, 9
                ja      short loc_1306A
                xchg    ax, bx
                mul     cx
                xchg    ax, bx
                add     bx, ax
                jmp     short loc_13054
; ---------------------------------------------------------------------------

loc_1306A:
                mov     ax, bx
                clc
                retn
; ---------------------------------------------------------------------------

loc_1306E:
                stc
                retn
get_env_num     endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR get_env_word

cfg_env_quiet:
                and     word ptr _misc_byte_1, not 803h
                retn
; ---------------------------------------------------------------------------

cfg_env_print:
                call    get_env_swc
                jb      short locret_1308B
                jz      short loc_13085
                or      word ptr _misc_byte_1, 801h
                retn
; ---------------------------------------------------------------------------

loc_13085:
                and     word ptr _misc_byte_1, not 801h

locret_1308B:
                retn
; ---------------------------------------------------------------------------

cfg_env_sound:
                call    get_env_swc
                jb      short locret_1309E
                jz      short loc_13099
                or      _misc_byte_1, 2
                retn
; ---------------------------------------------------------------------------

loc_13099:
                and     _misc_byte_1, not 2

locret_1309E:
                retn
; ---------------------------------------------------------------------------

cfg_env_extmem:
                call    get_env_num
                jb      short locret_130CE
                push    ds
                mov     ds, _seg_kernel
                assume ds:KERNEL
                push    ax
                mov     bx, 1024
                mul     bx
                mov     word ptr pm32_maxextmem, ax
                mov     word ptr pm32_maxextmem+2, dx
                pop     ax
                add     ax, 0FFFh
                and     ax, 0F000h
                xor     dx, dx
                mov     bx, 1000h
                div     bx
                test    al, al
                jnz     short loc_130CA
                inc     al

loc_130CA:
                mov     pm32_maxpages, al
                pop     ds
                assume ds:TEXT16

locret_130CE:
                retn
; ---------------------------------------------------------------------------

cfg_env_dosbuf:
                call    get_env_num
                cmp     ax, 1
                jb      short locret_130EA
                cmp     ax, 40h ; '@'
                ja      short locret_130EA
                jnz     short loc_130E3
                mov     ax, 0FFFh
                jmp     short loc_130E7
; ---------------------------------------------------------------------------

loc_130E3:
                mov     cl, 6
                shl     ax, cl

loc_130E7:
                mov     _lowmembuf, ax

locret_130EA:
                retn
; ---------------------------------------------------------------------------

cfg_env_test:
                call    get_env_swc
                retn
; ---------------------------------------------------------------------------

cfg_env_restore:
                call    get_env_swc
                jb      short locret_13101
                jz      short loc_130FC
                or      _misc_byte_1, 4
                retn
; ---------------------------------------------------------------------------

loc_130FC:
                and     _misc_byte_1, not 4

locret_13101:
                retn
; ---------------------------------------------------------------------------

cfg_env_nullp:
                call    get_env_swc
                jb      short loc_13109
                jz      short loc_1310F

loc_13109:
                or      _misc_byte_1, 80h
                retn
; ---------------------------------------------------------------------------

loc_1310F:
                and     _misc_byte_1, 7Fh
                retn
; ---------------------------------------------------------------------------

cfg_env_verbose:
                call    get_env_swc
                jb      short loc_1311C
                jz      short loc_13122

loc_1311C:
                or      _misc_byte_2, 10h
                retn
; ---------------------------------------------------------------------------

loc_13122:
                and     _misc_byte_2, 0EFh
                retn
; ---------------------------------------------------------------------------

cfg_env_nowarn:
                call    get_env_num
                sub     ax, 9000
                jb      short locret_13147
                cmp     al, 6
                ja      short locret_13147
                add     ax, ax
                mov     bx, ax
                mov     errtab_90xx[bx], 0
                cmp     byte ptr es:[di], ','
                jnz     short locret_13147
                inc     di
                jmp     short cfg_env_nowarn
; ---------------------------------------------------------------------------

locret_13147:
                retn
; ---------------------------------------------------------------------------

cfg_env_noc:
                and     _misc_byte_2, not 8
                retn
; END OF FUNCTION CHUNK FOR get_env_word
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR alloc_block

report_errorm:
                mov     ax, cs:_err_code
; END OF FUNCTION CHUNK FOR alloc_block

; =============== S U B R O U T I N E =======================================


report_error    proc near

; FUNCTION CHUNK AT 0488 SIZE 00000039 BYTES

                push    bx
                push    ds
                cmp     cs:_sel_ds, 0
                jnz     short loc_13163
                mov     ds, cs:_seg_ds
                jmp     short loc_13168
; ---------------------------------------------------------------------------

loc_13163:
                mov     ds, cs:_sel_ds

loc_13168:
                xor     bx, bx

loc_1316A:
                cmp     ah, byte ptr g_errtab.category[bx]
                jz      short loc_1317A
                cmp     [bx+errtabentry.category], 0FFh
                jz      short loc_131C4
                add     bx, 4
                jmp     short loc_1316A
; ---------------------------------------------------------------------------

loc_1317A:
                cmp     g_errtab.kind[bx], 1
                jnz     short loc_13188
                test    _misc_byte_1, 1
                jz      short loc_131C4

loc_13188:
                push    ax
                push    cx
                push    dx
                push    bx
                mov     bl, g_errtab.kind[bx]
                mov     bh, 0
                mov     cx, bx
                add     bx, bx
                mov     dx, h_errtab[bx]
                pop     bx
                push    di
                push    si
                mov     si, g_errtab.table[bx]
                mov     bl, al
                mov     bh, 0
                add     bx, bx
                mov     di, [bx+si]
                test    di, di
                jz      short loc_131BA
                push    ax
                call    prints
                pop     ax
                mov     dx, di
                call    prints
                call    printcr

loc_131BA:
                pop     si
                pop     di
                cmp     cl, 1
                jnz     short loc_131C7
                pop     dx
                pop     cx
                pop     ax

loc_131C4:
                pop     ds
                pop     bx
                retn
; ---------------------------------------------------------------------------

loc_131C7:
                mov     al, 0FFh
                cmp     _sel_cs, 0
                jnz     short loc_131D3
                jmp     exit86
; ---------------------------------------------------------------------------

loc_131D3:
                jmp     exit386
report_error    endp


; =============== S U B R O U T I N E =======================================


copyright       proc near
                test    _misc_byte_2, 8
                jz      short locret_13209
                mov     ax, _version
                mov     bx, (offset cpr_msg+21h)
                mov     si, offset cpr_msg ; "DOS32AWE -- DOS Extender version x.x.x\r"...
                push    ax
                mov     al, ah
                aam
                add     al, '0'
                mov     [bx], al
                pop     ax
                aam
                add     ax, '00'
                mov     [bx+2], ah
                mov     [bx+4], al
                mov     cx, (offset aDos32aweFatalW - offset cpr_msg) ; "DOS32AWE -- DOS Extender version x.x.x\r"...

loc_131FE:
                lodsb
                push    cx
                xor     bx, bx
                mov     ah, 0Eh
                int     10h             ; - VIDEO - WRITE CHARACTER AND ADVANCE CURSOR (TTY WRITE)
                                        ; AL = character, BH = display page (alpha modes)
                                        ; BL = foreground color (graphics modes)
                pop     cx
                loop    loc_131FE

locret_13209:
                retn
copyright       endp

; ---------------------------------------------------------------------------
@char           db 2 dup(0)
@crlf           db 0Dh,0Ah,0

; =============== S U B R O U T I N E =======================================


printc          proc near
                push    dx
                mov     @char, al
                mov     dx, offset @char
                jmp     short @prnt
printc          endp


; =============== S U B R O U T I N E =======================================


printcr         proc near
                push    dx
                mov     dx, offset @crlf ; "\r\n"

@prnt:
                call    prints
                pop     dx
                retn
printcr         endp


; =============== S U B R O U T I N E =======================================


prints          proc near
                push    ax
                push    bx
                push    cx
                push    dx
                push    si
                push    di
                push    bp
                push    ds
                push    es
                push    ss
                pop     es
                mov     bp, sp
                sub     sp, 100h
                add     bp, 14h
                mov     si, dx
                mov     di, sp
                push    di

loc_1323A:
                lodsb
                cmp     al, '%'
                jz      short @@args
                cmp     al, '$'
                jnz     short @@next
                mov     al, '?'

@@next:
                stosb
                test    al, al
                jnz     short loc_1323A
                pop     di
                call    writes
                add     sp, 100h
                pop     es
                pop     ds
                pop     bp
                pop     di
                pop     si
                pop     dx
                pop     cx
                pop     bx
                pop     ax
                retn
; ---------------------------------------------------------------------------

@@args:
                lodsb
                cmp     al, 25h ; '%'
                jz      short @@next
                cmp     al, 63h ; 'c'
                jz      short @@c
                cmp     al, 73h ; 's'
                jz      short @@s
                cmp     al, 62h ; 'b'
                jz      short @@b
                cmp     al, 77h ; 'w'
                jz      short @@w
                cmp     al, 6Ch ; 'l'
                jz      short @@l
                cmp     al, 64h ; 'd'
                jz      short @@d
                jmp     short @@next
; ---------------------------------------------------------------------------

@@c:
                mov     al, [bp+0]
                add     bp, 2
                jmp     short @@next
; ---------------------------------------------------------------------------

@@s:
                mov     bx, [bp+0]
                add     bp, 2

loc_13289:
                mov     al, [bx]
                inc     bx
                test    al, al
                jz      short loc_1323A
                cmp     al, '$'
                jnz     short loc_13296
                mov     al, '?'

loc_13296:
                stosb
                jmp     short loc_13289
; ---------------------------------------------------------------------------

@@b:
                mov     ah, [bp+0]
                add     bp, 2
                mov     cx, 2
                call    hex
                jmp     short loc_1323A
; ---------------------------------------------------------------------------

@@w:
                mov     ax, [bp+0]
                add     bp, 2
                mov     cx, 4
                call    hex
                jmp     short loc_1323A
; ---------------------------------------------------------------------------

@@l:
                mov     ax, [bp+2]
                mov     cx, 4
                call    hex
                mov     ax, [bp+0]
                add     bp, 4
                mov     cx, 4
                call    hex
                jmp     loc_1323A
; ---------------------------------------------------------------------------

@@d:
                mov     ax, [bp+0]
                add     bp, 2
                xor     cx, cx
                call    dec
                jmp     loc_1323A
prints          endp


; =============== S U B R O U T I N E =======================================


hex             proc near
                rol     ax, 1
                rol     ax, 1
                rol     ax, 1
                rol     ax, 1
                mov     bl, al
                and     bl, 0Fh
                add     bl, '0'
                cmp     bl, '9'
                jbe     short loc_132F3
                add     bl, 7

loc_132F3:
                xchg    ax, bx
                stosb
                xchg    ax, bx
                loop    hex
                retn
hex             endp


; =============== S U B R O U T I N E =======================================


dec             proc near
                mov     bx, 10000
                call    dec0
                mov     bx, 1000
                call    dec0
                mov     bx, 100
                call    dec0
                mov     bx, 10
                call    dec0
                jmp     short loc_13320
dec             endp


; =============== S U B R O U T I N E =======================================


dec0            proc near
                xor     dx, dx
                div     bx
                test    ax, ax
                jz      short loc_1331C
                inc     cx

loc_1331C:
                test    cx, cx
                jz      short loc_13323

loc_13320:
                add     al, '0'
                stosb

loc_13323:
                mov     ax, dx
                retn
dec0            endp


; =============== S U B R O U T I N E =======================================


writes          proc near
                xor     al, al
                mov     dx, di
                mov     cx, 0FFFFh
                repne scasb
                dec     di
                push    es
                pop     ds
                mov     ax, 924h        ; Add dollar terminator
                mov     [di], al
                cmp     cs:_sel_cs, 0
                jnz     short @@pm
                int     21h             ; DOS - PRINT STRING
                                        ; DS:DX -> string terminated by "$"
                retn
; ---------------------------------------------------------------------------

@@pm:
                push    ebp
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+14h], dx
                mov     ax, cs:_seg_ss
                mov     [ebp+24h], ax
                call    int21h
                add     esp, 32h
                pop     ebp
                retn
writes          endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR unload_fixups

file_error:
                mov     si, offset start
                jmp     report_error
; END OF FUNCTION CHUNK FOR unload_fixups
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR alloc_block

file_errorm:
                mov     si, offset start
                jmp     report_errorm
; END OF FUNCTION CHUNK FOR alloc_block
; ---------------------------------------------------------------------------

dos_error:
                mov     si, ax
                mov     ax, 8002h
                jmp     short common_error
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR int21h

dpmi_error:
                mov     si, ax
                mov     ax, 8003h

common_error:
                cli
                lss     esp, fword ptr cs:_sel_esp
                jmp     report_error
; END OF FUNCTION CHUNK FOR int21h
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR report_error

exit86:
                cli
                cld
                mov     ds, cs:_seg_ds
                mov     es, _seg_es
                mov     ss, _seg_ss
                mov     sp, 800h
                mov     ax, _seg_env
                mov     es:2Ch, ax
                mov     ax, 4CFFh
                int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
                                        ; AL = exit code
; ---------------------------------------------------------------------------

exit386:
                cli
                cld
                mov     ds, cs:_sel_ds
                mov     es, _sel_es
                lss     esp, fword ptr _sel_esp
                xor     dx, dx
                mov     fs, dx
                assume fs:nothing
                mov     gs, dx
                assume gs:nothing
                mov     ah, 4Ch
                int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
; END OF FUNCTION CHUNK FOR report_error ; AL = exit code

; =============== S U B R O U T I N E =======================================


save_inttab     proc near
                push    cx
                push    si
                push    di
                push    ds
                push    es
                xor     si, si
                mov     di, 800h
                mov     ds, cs:_sel_zero
                mov     es, cs:_sel_ss
                mov     cx, 200h
                cld
                rep movsw
                in      al, 21h         ; Interrupt controller, 8259A.
                mov     ah, al
                in      al, 0A1h        ; Interrupt Controller #2, 8259A
                pop     es
                pop     ds
                pop     di
                pop     si
                pop     cx
                mov     _pic_mask, ax
                retn
save_inttab     endp


; =============== S U B R O U T I N E =======================================


restore_inttab  proc near
                test    cs:_misc_byte_1, 4
                jz      short locret_1342A
                cmp     cs:_sys_type, 3
                jz      short loc_13400
                xor     eax, eax
                mov     dr7, eax

loc_13400:
                pushf
                cli
                push    si
                push    di
                push    ds
                push    es
                xor     di, di
                mov     si, 800h
                mov     es, cs:_sel_zero
                mov     ds, cs:_sel_ss
                mov     cx, 200h
                cld
                rep movsw
                mov     ax, cs:_pic_mask
                out     0A1h, al        ; Interrupt Controller #2, 8259A
                mov     al, ah
                out     21h, al         ; Interrupt controller, 8259A.
                pop     es
                pop     ds
                pop     di
                pop     si
                popf

locret_1342A:
                retn
restore_inttab  endp


; =============== S U B R O U T I N E =======================================


check_inttab    proc near
                test    cs:_misc_byte_1, 8
                jz      short locret_1345D
                pushad
                push    ds
                push    es
                xor     bx, bx
                mov     ds, cs:_sel_ss
                mov     es, cs:_sel_zero
                mov     esi, 800h
                xor     edi, edi
                cld

loc_1344D:
                cmps    dword ptr [esi], dword ptr es:[edi]
                jnz     short loc_1345E

loc_13452:
                inc     bx
                cmp     bx, 100h
                jb      short loc_1344D
                pop     es
                pop     ds
                popad

locret_1345D:
                retn
; ---------------------------------------------------------------------------

loc_1345E:
                mov     ax, 9003h
                push    bx
                push    si
                mov     si, bx
                call    report_error
                pop     si
                pop     bx
                jmp     short loc_13452
check_inttab    endp


; =============== S U B R O U T I N E =======================================


restore_pit     proc near
                push    ax
                mov     al, 36h ; '6'
                out     43h, al         ; Timer 8253-5 (AT: 8254.2).
                mov     al, 0
                out     40h, al         ; Timer 8253-5 (AT: 8254.2).
                out     40h, al         ; Timer 8253-5 (AT: 8254.2).
                pop     ax
                retn
restore_pit     endp


; =============== S U B R O U T I N E =======================================


set_descriptor  proc near
                push    ebx
                push    ecx
                push    edx
                push    ebp
                mov     ebp, ecx
                xor     ax, ax
                mov     cx, 1
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE LDT DESCRS
                                        ; CX = number of descriptors to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful, AX = base selector
                jb      short loc_134B6
                mov     bx, ax
                mov     ax, 9
                mov     cx, dx
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET DESCRIPTOR ACCESS RIGHTS
                                        ; BX = selector, CL = access rights/type byte
                                        ; CH = 80386 extended rights/type byte (32-bit DPMI implementations only)
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_134B6
                dec     ax
                mov     ecx, ebp
                mov     dx, cx
                shr     ecx, 10h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT LIMIT
                                        ; BX = selector, CX:DX = segment limit
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_134B6
                dec     ax
                mov     ecx, edi
                mov     dx, cx
                shr     ecx, 10h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT BASE ADDRESS
                                        ; BX = selector, CX:DX = linear base address
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_134B6
                mov     ax, bx

loc_134B6:
                pop     ebp
                pop     edx
                pop     ecx
                pop     ebx
                retn
set_descriptor  endp


; =============== S U B R O U T I N E =======================================


_int23          proc near
                push    ds
                mov     ds, cs:_sel_ds
                or      _sys_misc, 100h
                pop     ds
                iretd
_int23          endp


; =============== S U B R O U T I N E =======================================


int10h          proc near
                push    bx
                mov     bx, 10h
                jmp     short intxxh
int10h          endp


; =============== S U B R O U T I N E =======================================


int33h          proc near
                push    bx
                mov     bx, 33h ; '3'
                jmp     short intxxh
int33h          endp


; =============== S U B R O U T I N E =======================================


int21h          proc near

; FUNCTION CHUNK AT 0478 SIZE 00000010 BYTES

                push    bx
                mov     bx, 21h ; '!'

intxxh:
                push    cx
                push    edi
                push    es
                xor     eax, eax
                mov     [ebp+20h], ax
                mov     [ebp+2Eh], eax
                xor     cx, cx
                push    ss
                pop     es
                mov     edi, ebp
                mov     ax, 300h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SIMULATE REAL MODE INTERRUPT
                                        ; BL=interrupt number
                                        ; CX=number of words to copy from protected mode to real mode stack
                                        ; ES:DI / ES:EDI = selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok
                pop     es
                pop     edi
                pop     cx
                pop     bx
                jb      dpmi_error
                retn
int21h          endp


; =============== S U B R O U T I N E =======================================


setup_dta_buffer proc near
                sub     esp, 32h
                mov     ebp, esp
                mov     ax, _seg_ss
                add     ax, 10h
                mov     _seg_dta, ax
                mov     [ebp+24h], ax
                add     ax, 8
                mov     _seg_mus, ax
                mov     ax, ss
                mov     _dta_sel, ax
                mov     _app_dta_sel, ax
                mov     eax, 100h
                mov     _dta_ofs, eax
                mov     _app_dta_ofs, eax
                mov     byte ptr [ebp+1Dh], 1Ah
                mov     word ptr [ebp+14h], 0
                call    int21h
                add     esp, 32h
                retn
setup_dta_buffer endp


; =============== S U B R O U T I N E =======================================


initialize_mouse proc near
                push    ds
                mov     ds, _sel_zero
                assume ds:nothing
                cmp     dword ptr ds:0CCh, 0
                pop     ds
                assume ds:TEXT16
                jz      short @@err
                mov     ax, 21h ; '!'
                int     33h             ; - MS MOUSE - SOFTWARE RESET
                                        ; Return: AX = FFFFh if mouse driver installed
                                        ; AX = 0021h if mouse driver not installed
                                        ; BX = 2 if mouse driver is installed
                cmp     ax, 21h ; '!'
                jnz     short loc_13566
                xor     ax, ax
                int     33h             ; - MS MOUSE - RESET DRIVER AND READ STATUS
                                        ; Return: AX = status
                                        ; BX = number of buttons
                inc     ax
                jnz     short @@err

loc_13566:
                mov     ax, 15h
                int     33h             ; - MS MOUSE - RETURN DRIVER STORAGE REQUIREMENTS
                                        ; Return: BX = size of buffer needed to store driver state
                movzx   eax, bx
                cmp     eax, _lobufsize
                jnb     short @@err
                mov     _mus_size, eax
                push    ds
                push    es
                push    cs
                pop     ds
                push    ss
                pop     es
                mov     esi, offset _mus_int_pm
                mov     edi, 7C0h
                mov     ax, 303h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE REAL MODE CALL-BACK ADDRESS
                                        ; DS:SI=selector:offset of procedure to call
                                        ; ES:DI=selector:offset of real mode call structure
                                        ; Return: CF set on error
                                        ; CF clear if ok, CX:DX = segment:offset of real mode call address
                pop     es
                pop     ds
                jb      dpmi_error
                mov     _mus_backofs, dx
                mov     _mus_backseg, cx
                retn
; ---------------------------------------------------------------------------

@@err:                                  ; dummy int33
                mov     word ptr _int33, 0CF66h
                mov     ax, 9004h
                jmp     report_error
initialize_mouse endp


; =============== S U B R O U T I N E =======================================


install_client_ints proc near
                mov     ax, 205h
                mov     cx, cs
                mov     bl, 10h
                mov     edx, offset _int10
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @@err
                mov     bl, 21h ; '!'
                mov     dx, offset _int21
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @@err
                mov     bl, 23h ; '#'
                mov     dx, offset _int23
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @@err
                mov     bl, 33h ; '3'
                mov     dx, offset _int33
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @@err
                mov     ax, 203h
                mov     bl, 0
                mov     dx, offset eh00
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                nop
                nop
                mov     bl, 1
                mov     dx, offset eh01
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 2
                mov     dx, offset eh02
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 3
                mov     dx, offset eh03
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 4
                mov     dx, offset eh04
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 5
                mov     dx, offset eh05
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 6
                mov     dx, offset eh06
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 7
                mov     dx, offset eh07
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 8
                mov     dx, offset eh08
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 9
                mov     dx, offset eh09
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 0Ah
                mov     dx, offset eh0A
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 0Bh
                mov     dx, offset eh0B
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 0Ch
                mov     dx, offset eh0C
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 0Dh
                mov     dx, offset eh0D
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short @@err
                mov     bl, 0Eh
                mov     dx, offset eh0E
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                clc

@@err:
                retn
install_client_ints endp


; =============== S U B R O U T I N E =======================================


uninstall_client_ints proc near
                mov     ax, 205h
                mov     bl, 10h
                mov     cx, cs:_int10_._cs
                mov     edx, cs:_int10_._ip
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     bl, 21h
                mov     cx, cs:_int21_._cs
                mov     edx, cs:_int21_._ip
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     bl, 23h
                mov     cx, cs:_int23_._cs
                mov     edx, cs:_int23_._ip
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     bl, 33h
                mov     cx, cs:_int33_._cs
                mov     edx, cs:_int33_._ip
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                mov     ax, 203h
                xor     ebx, ebx

loc_136B1:
                mov     cx, cs:_exc_tab._cs[ebx*8]
                mov     edx, cs:_exc_tab._ip[ebx*8]
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh), CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                inc     bl
                cmp     bl, 0Fh
                jb      short loc_136B1
                clc
                retn
uninstall_client_ints endp


; =============== S U B R O U T I N E =======================================


install_nullptr_protect proc near
                cmp     _sys_type, 3
                jz      short locret_136FE
                test    _misc_byte_1, 80h
                jz      short locret_136FE
                xor     eax, eax
                mov     dr6, eax
                mov     dr0, eax
                add     al, 4
                mov     dr1, eax
                add     al, 4
                mov     dr2, eax
                add     al, 4
                mov     dr3, eax
                mov     eax, 0DDDD03FFh
                mov     dr7, eax

locret_136FE:
                retn
install_nullptr_protect endp


; =============== S U B R O U T I N E =======================================


setup_selector  proc near
                xor     edi, edi
                or      ecx, 0FFFFFFFFh
                mov     ax, cs
                lar     dx, ax
                mov     dl, 0C0h ; 'À'
                xchg    dh, dl
                and     dl, 60h
                or      dl, 92h
                mov     _acc_rights, dx
                call    set_descriptor
                jb      short loc_13730
                mov     _sel_zero, ax
                mov     ax, 8
                mov     bx, ds
                mov     cx, 0FFFFh
                mov     dx, cx
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET SEGMENT LIMIT
                                        ; BX = selector, CX:DX = segment limit
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_13730
                retn
; ---------------------------------------------------------------------------

loc_13730:
                mov     ax, 4CFFh
                int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
setup_selector  endp                    ; AL = exit code


; =============== S U B R O U T I N E =======================================


check_command_line proc near
                mov     di, 80h ; '€'
                movzx   cx, byte ptr es:[di]
                jcxz    short loc_13764
                inc     di
                mov     al, ' '
                repe scasb
                jz      short loc_13764
                dec     di
                inc     cx
                mov     bx, di

loc_13749:
                mov     al, es:[di]
                cmp     al, 9
                jz      short loc_1375B
                cmp     al, 0Dh
                jz      short loc_1375B
                cmp     al, ' '
                jz      short loc_1375B
                inc     di
                loop    loc_13749

loc_1375B:
                mov     cx, di
                mov     si, bx
                mov     di, bx
                sub     cx, bx
                retn
; ---------------------------------------------------------------------------

loc_13764:
                xor     si, si
                retn
check_command_line endp


; =============== S U B R O U T I N E =======================================


remove_name_from_cmd proc near
                call    check_command_line
                jz      short locret_13770
                mov     al, ' '
                rep stosb

locret_13770:
                retn
remove_name_from_cmd endp


; =============== S U B R O U T I N E =======================================


check_if_fullname proc near
                push    ds
                push    es
                call    check_command_line
                jz      short loc_13792
                mov     al, '\'
                mov     bx, cx
                repne scasb
                jcxz    short loc_13792
                push    ds
                push    es
                pop     ds
                pop     es
                mov     cx, bx
                mov     di, (offset loc_15BAA+2)
                rep movsb
                xor     al, al
                stosb
                pop     es
                pop     ds
                stc
                retn
; ---------------------------------------------------------------------------

loc_13792:
                pop     es
                pop     ds
                clc
                retn
check_if_fullname endp


; =============== S U B R O U T I N E =======================================


update_environment proc near
                push    ds
                push    es
                call    check_if_fullname
                jb      short loc_137DB
                mov     ah, 19h
                int     21h             ; DOS - GET DEFAULT DISK NUMBER
                mov     dl, al
                add     al, 41h ; 'A'
                mov     byte ptr loc_15BAA+2, al
                mov     word ptr loc_15BAD, 5C3Ah
                inc     dx
                mov     ah, 47h ; 'G'
                mov     esi, (offset loc_15BAD+2)
                int     21h             ; DOS - 2+ - GET CURRENT DIRECTORY
                                        ; DL = drive (0=default, 1=A, etc.)
                                        ; DS:SI points to 64-byte buffer area
                push    ds
                pop     es
                assume es:TEXT16
                xor     al, al
                mov     di, si
                mov     cx, 40h ; '@'
                repne scasb
                cmp     byte ptr [di-2], '\'
                jnz     short loc_137CB
                dec     di

loc_137CB:
                mov     byte ptr [di-1], '\'
                mov     si, offset start
                mov     cx, 40h ; '@'

loc_137D5:
                lodsb
                stosb
                test    al, al
                loopne  loc_137D5

loc_137DB:
                push    ds
                pop     es
                xor     al, al
                mov     cx, 0FFFFh
                mov     di, (offset loc_15BAA+2)
                repne scasb
                not     cx
                mov     bx, cx
                pop     es
                assume es:nothing
                push    es
                mov     ax, es:2Ch
                test    ax, ax
                jz      short loc_13823
                lar     cx, ax
                jnz     short loc_13823
                mov     es, ax
                xor     al, al
                xor     di, di
                mov     cx, 0FFFFh

loc_13803:
                repne scasb
                scasb
                jnz     short loc_13803
                inc     di
                inc     di
                mov     cx, 0FFFFh
                mov     dx, di
                repne scasb
                not     cx
                cmp     bx, cx
                ja      short create_new_environment
                mov     cx, bx
                mov     di, dx
                mov     si, (offset loc_15BAA+2)
                rep movsb
                pop     es
                pop     ds
                retn
; ---------------------------------------------------------------------------

loc_13823:
                mov     ax, 2000h
                jmp     report_error
; ---------------------------------------------------------------------------

create_new_environment:
                push    bx
                mov     cx, 0FFFFh
                xor     di, di

loc_1382F:
                repne scasb
                dec     cx
                scasb
                jnz     short loc_1382F
                not     cx
                inc     cx
                inc     cx
                push    cx
                add     bx, cx
                shr     bx, 4
                inc     bx
                mov     ax, 100h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE DOS MEMORY BLOCK
                                        ; BX = number of paragraphs to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful
                pop     cx
                jb      short loc_13862
                push    es
                pop     ds
                mov     es, dx
                xor     si, si
                xor     di, di
                rep movsb
                pop     cx
                mov     si, 2CACh
                push    cs
                pop     ds
                rep movsb
                pop     es
                pop     ds
                mov     es:2Ch, dx
                retn
; ---------------------------------------------------------------------------

loc_13862:
                mov     ax, 2000h
                jmp     report_error
update_environment endp


; =============== S U B R O U T I N E =======================================


open_exec       proc near
                push    ds
                push    es
                mov     ax, es:2Ch
                test    ax, ax
                jz      short loc_138B0
                lar     cx, ax
                jnz     short loc_138B0
                mov     es, ax
                xor     ax, ax
                xor     di, di
                mov     cx, 0FFFFh

loc_13880:
                repne scasb
                scasb
                jcxz    short loc_138B0
                jnz     short loc_13880
                inc     di
                inc     di
                push    ds
                push    es
                pop     ds
                pop     es
                push    di
                mov     si, di
                mov     di, offset start

loc_13893:
                lodsb
                stosb
                test    al, al
                jnz     short loc_13893
                pop     di
                movzx   edx, di
                mov     ax, 3DC0h
                int     21h             ; DOS - 2+ - OPEN DISK FILE WITH HANDLE
                                        ; DS:DX -> ASCIZ filename
                                        ; AL = access mode
                                        ; 0 - read, 1 - write, 2 - read & write
                pop     es
                pop     ds
                mov     word ptr aThisProgramRequ+4, ax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ax, 2001h
                jb      file_error
                retn
; ---------------------------------------------------------------------------

loc_138B0:
                mov     ax, 2000h
                jmp     report_error
open_exec       endp


; =============== S U B R O U T I N E =======================================


load_exec_header proc near
                xor     edx, edx
                mov     ecx, 40h ; '@'
                mov     _err_code, 2002h
                call    load_fs_block
                cmp     word ptr fs:0, 'ZM'
                jnz     file_errorm
                mov     eax, fs:3Ch
                mov     edx, fs:18h
                mov     dword ptr aThisProgramRequ+8, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
load_exec_header endp


; =============== S U B R O U T I N E =======================================


open_extrn_exec proc near
                push    ds
                push    es
                push    ds
                push    es
                pop     ds
                pop     es
                mov     di, offset start
                rep movsb
                push    es
                pop     ds
                mov     byte ptr [di], 0
                mov     edx, offset start
                mov     ax, 3DC0h
                int     21h             ; DOS - 2+ - OPEN DISK FILE WITH HANDLE
                                        ; DS:DX -> ASCIZ filename
                                        ; AL = access mode
                                        ; 0 - read, 1 - write, 2 - read & write
                jb      short loc_13906
                pop     es
                pop     ds
                mov     word ptr aThisProgramRequ+4, ax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
; ---------------------------------------------------------------------------

loc_13906:
                mov     bx, offset start

loc_13909:
                cmp     byte ptr [bx], '.'
                stc
                jz      short loc_1393A
                inc     bx
                cmp     bx, di
                jb      short loc_13909
                mov     eax, 'EXE.'
                cmp     eax, [di-4]
                stc
                jz      short loc_1393A
                mov     eax, 'exe.'
                cmp     eax, [di-4]
                stc
                jz      short loc_1393A
                mov     [di], eax
                mov     byte ptr [di+4], 0
                mov     ax, 3DC0h
                int     21h             ; DOS - 2+ - OPEN DISK FILE WITH HANDLE
                                        ; DS:DX -> ASCIZ filename
                                        ; AL = access mode
                                        ; 0 - read, 1 - write, 2 - read & write

loc_1393A:
                pop     es
                pop     ds
                mov     word ptr aThisProgramRequ+4, ax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ax, 3001h
                jb      file_error
                retn
open_extrn_exec endp


; =============== S U B R O U T I N E =======================================


load_extrn_exec_header proc near
                xor     edx, edx
                mov     ecx, 40h ; '@'
                mov     _err_code, 3002h
                call    load_fs_block
                call    seek_from_start
                xor     ebp, ebp
                mov     dword ptr aThisProgramRequ+8, ebp ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dword ptr a80386ProcessorO, ebp ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                cmp     word ptr fs:0, 'ZM'
                jnz     search_for_le
                mov     eax, fs:18h
                cmp     ax, 40h ; '@'
                jnz     short search_for_mz
                mov     eax, fs:3Ch
                test    ax, ax
                jz      short search_for_mz
                mov     dword ptr aThisProgramRequ+8, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
; ---------------------------------------------------------------------------

search_for_mz:
                xor     esi, esi

loc_1398F:
                movzx   eax, word ptr fs:4
                shl     eax, 9
                movzx   ebx, word ptr fs:2
                add     eax, ebx
                mov     bx, fs:0
                cmp     bx, 'ZM'
                jz      short loc_139B7
                cmp     bx, 'WB'
                jz      short loc_139BD
                jmp     short loc_139E0
; ---------------------------------------------------------------------------

loc_139B7:
                sub     eax, 200h

loc_139BD:
                mov     esi, ebp
                add     ebp, eax
                mov     edx, ebp
                call    seek_from_start
                mov     ecx, 40h ; '@'
                xor     edx, edx
                call    load_fs_block
                test    eax, eax
                jnz     short loc_1398F
                mov     ax, 3003h
                jmp     file_error
; ---------------------------------------------------------------------------

loc_139E0:
                mov     bx, fs:0
                cmp     bx, 'EL'
                jz      short loc_13A06
                cmp     bx, 'XL'
                jz      short loc_13A06
                cmp     bx, 'CL'
                jz      short loc_13A06
                cmp     bx, 'EP'
                jz      short loc_13A06
                mov     edx, ebp
                call    seek_from_start
                call    search_for_le

loc_13A06:
                cmp     eax, esi
                jz      short locret_13A2A
                mov     edx, esi
                add     eax, 10h
                add     edx, 10h
                and     al, 0F0h
                and     dl, 0F0h
                cmp     eax, edx
                jz      short locret_13A2A
                mov     dword ptr aThisProgramRequ+8, ebp ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dword ptr a80386ProcessorO, esi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage

locret_13A2A:
                retn
load_extrn_exec_header endp


; =============== S U B R O U T I N E =======================================


search_for_le   proc near
                mov     edx, _lobufzero
                mov     ecx, _lobufsize
                call    load_gs_block
                test    ax, ax
                mov     ax, 3003h
                jz      file_error
                shr     cx, 1

loc_13A43:
                mov     ax, gs:[edx]
                mov     bx, gs:[edx+2]
                test    bx, bx
                jnz     short loc_13A64
                cmp     ax, 'EL'
                jz      short locret_13A70
                cmp     ax, 'XL'
                jz      short locret_13A70
                cmp     ax, 'CL'
                jz      short locret_13A70
                cmp     ax, 'PE'
                jz      short locret_13A70

loc_13A64:
                add     edx, 2
                add     ebp, 2
                loop    loc_13A43
                jmp     short search_for_le
; ---------------------------------------------------------------------------

locret_13A70:
                retn
search_for_le   endp


; =============== S U B R O U T I N E =======================================


close_exec      proc near
                mov     bx, word ptr cs:aThisProgramRequ+4 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ah, 3Eh
                int     21h             ; DOS - 2+ - CLOSE A FILE WITH HANDLE
                                        ; BX = file handle
                retn
close_exec      endp


; =============== S U B R O U T I N E =======================================


seek_from_start proc near
                push    bx
                push    ecx
                push    edx
                push    eax
                mov     ecx, edx
                shr     ecx, 10h
                mov     bx, word ptr cs:aThisProgramRequ+4 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ax, 4200h
                int     21h             ; DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
                                        ; AL = method: offset from beginning of file
                pop     eax
                pop     edx
                pop     ecx
                pop     bx
                jb      file_errorm
                retn
seek_from_start endp


; =============== S U B R O U T I N E =======================================


load_fs_block   proc near
                push    bx
                push    ds
                push    fs
                pop     ds
                assume ds:nothing
                jmp     short loc_13AAB
load_fs_block   endp


; =============== S U B R O U T I N E =======================================


load_gs_block   proc near
                push    bx
                push    ds
                push    gs
                pop     ds

loc_13AAB:                              ; +4: _exec_handle
                mov     bx, word ptr cs:aThisProgramRequ+4 ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ah, 3Fh
                int     21h             ; DOS - 2+ - READ FROM FILE WITH HANDLE
                                        ; BX = file handle, CX = number of bytes to read
                                        ; DS:DX -> buffer
                pop     ds
                assume ds:TEXT16
                pop     bx
                jb      file_errorm
                retn
load_gs_block   endp


; =============== S U B R O U T I N E =======================================


verbose_getmem  proc near
                pop     bp
                mov     ax, 0FF90h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                shr     eax, 0Ah
                test    eax, 0FFFF0000h
                mov     dx, offset aKb  ; "KB"
                jz      short loc_13AD7
                mov     dx, offset aMb  ; "MB"
                shr     eax, 0Ah

loc_13AD7:
                push    dx
                push    ax
                mov     ah, 48h ; 'H'
                mov     bx, 0FFFFh
                int     21h             ; DOS - 2+ - ALLOCATE MEMORY
                                        ; BX = number of 16-byte paragraphs desired
                shr     bx, 6
                push    bx
                jmp     bp
verbose_getmem  endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


verbose_showsys proc near
                test    _misc_byte_2, 10h
                jz      short locret_13B15
                call    verbose_getmem
                movzx   eax, _sys_type
                lea     eax, systypes.str[eax+eax*4]
                push    ax
                movzx   ax, _cpu_type
                imul    ax, 100
                add     ax, 86
                push    ax
                mov     dx, offset aProcessorDSyste ; "Processor: %d, System: %s, Memory: DOS="...
                call    prints
                add     sp, 0Ah

locret_13B15:
                retn
verbose_showsys endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


verbose_showloadhdr proc near
                test    _misc_byte_2, 10h
                jz      short locret_13B39
                movzx   eax, byte ptr aSystemSoftwareD+3 ; +3: _app_type
                                        ; +4: _app_load
                lea     eax, header_types.field_0[eax+eax*2]
                push    ax
                push    offset start
                mov     dx, offset aLoadingProgramS ; "Loading program \"%s\", %s-style\r\n"
                call    prints
                add     sp, 4

locret_13B39:
                retn
verbose_showloadhdr endp


; =============== S U B R O U T I N E =======================================


verbose_showloadobj proc near
                test    _misc_byte_2, 10h
                jz      short locret_13B61
                pushad
                mov     ax, dx
                shr     edx, 10h
                shl     ebx, 0Ch
                push    dx
                push    ax
                push    ebp
                push    ebx
                push    edi
                push    cx
                mov     dx, offset aObjectDLoadedAt ; "Object #%d loaded at %l, V/Psize: %l/%l"...
                call    prints
                add     sp, 12h
                popad

locret_13B61:
                retn
verbose_showloadobj endp


; =============== S U B R O U T I N E =======================================


verbose_showstartup proc near
                test    _misc_byte_2, 10h
                jz      short locret_13BA6
                push    _seg_env
                push    word ptr es:2Ch
                push    _sel_es
                call    verbose_getmem
                mov     eax, dword ptr a80386ProcessorO+10h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                sub     eax, dword ptr a80386ProcessorO+18h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                push    eax
                push    word ptr a80386ProcessorO+8 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                push    offset aUnrelocated ; "Unrelocated"
                push    large [dword ptr a80386ProcessorO+14h] ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                push    _sel32_ss
                push    large [dword ptr a80386ProcessorO+10h] ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                push    _sel32_cs
                mov     dx, offset aStartupCsEipWLS ; "Startup CS:EIP=%w:%l, SS:ESP=%w:%l, %s "...
                call    prints
                add     sp, 20h

locret_13BA6:
                retn
verbose_showstartup endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


win_focus_vm    proc near
                test    _misc_byte_2, 2
                jz      short locret_13BB5
                xor     bx, bx
                mov     ax, 168Bh
                int     2Fh             ; - Multiplex - MS WINDOWS - SET FOCUS TO SPECIFIED VIRTUAL MACHINE
                                        ; BX = virtual machine id (0 - for current DOS box)

locret_13BB5:
                retn
win_focus_vm    endp


; =============== S U B R O U T I N E =======================================


critical_handler proc near
                cli
                cld
                mov     ds, cs:_sel_ds
                lss     esp, fword ptr _sel_esp
                push    ax
                mov     al, 20h ; ' '
                out     0A0h, al        ; PIC 2  same as 0020 for PIC 1
                out     20h, al         ; Interrupt controller, 8259A.
                mov     ax, _pic_mask
                out     0A1h, al        ; Interrupt Controller #2, 8259A
                mov     al, ah
                out     21h, al         ; Interrupt controller, 8259A.
                call    restore_pit
                call    restore_inttab
                call    tone
                call    scr_on
                pop     dx
                mov     ax, 6001h
                cmp     dh, 81h ; ''
                jz      short @@arg_dl
                mov     al, 2
                cmp     dh, 82h ; '‚'
                jz      short @@report
                mov     al, 3
                cmp     dh, 83h ; 'ƒ'
                jz      short @@report
                mov     al, 4
                cmp     dh, 84h ; '„'
                jz      short @@arg_esi
                mov     al, 5
                cmp     dh, 85h ; '…'
                jz      short @@report
                mov     al, 0

@@arg_dl:
                movzx   si, dl
                jmp     short @@report
; ---------------------------------------------------------------------------

@@arg_esi:
                rol     esi, 10h
                mov     di, si
                shr     esi, 10h

@@report:
                call    report_error
                mov     al, 0FFh
                jmp     exit386
critical_handler endp

; ---------------------------------------------------------------------------

eh00:
                push    0
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh01:
                push    1
                jmp     short eh_debug
; ---------------------------------------------------------------------------

eh02:
                push    2
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh03:
                push    3
                jmp     short eh_debug
; ---------------------------------------------------------------------------

eh04:
                push    4
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh05:
                push    5
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh06:
                push    6
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh07:
                push    7
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh08:
                push    8
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh09:
                push    9
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh0A:
                push    0Ah
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh0B:
                push    0Bh
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh0C:
                push    0Ch
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh0D:
                push    0Dh
                jmp     short eh_common
; ---------------------------------------------------------------------------

eh0E:
                push    0Eh
                jmp     short eh_common

; =============== S U B R O U T I N E =======================================


eh_debug        proc near

arg_15          = byte ptr  17h

                cmp     cs:_sys_type, 3
                jz      short loc_13C6C
                push    eax
                mov     eax, dr6
                and     al, 0Fh
                pop     eax
                jnz     short eh_common

loc_13C6C:
                add     esp, 2
                and     [esp-2+arg_15], 0FEh
                db      66h
                retf
eh_debug        endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


eh_common       proc near
                cli
                cld
                push    ax
                mov     ax, ds
                mov     ds, cs:_sel_ds
                mov     word ptr aPresentDpmiHost+12h, ax
                pop     ax
                pop     word ptr aPresentDpmiHost+16h
                mov     word ptr aPresentDpmiHost+0Eh, ss
                mov     dword ptr aPresentDpmiHost+0Ah, esp
                lss     esp, fword ptr _sel_esp
                push    word ptr aPresentDpmiHost+12h
                push    es
                push    fs
                push    gs
                pushad
                mov     es, word ptr aPresentDpmiHost+0Eh
                mov     ebp, dword ptr aPresentDpmiHost+0Ah
                mov     eax, es:[ebp+8]
                mov     dword ptr aSystemSoftwareD+37h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     eax, es:[ebp+14h]
                mov     dword ptr aSystemSoftwareD+33h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     ax, es:[ebp+10h]
                call    check_selector
                mov     fs, ax
                assume fs:nothing
                mov     ax, es:[ebp+1Ch]
                call    check_selector
                mov     gs, ax
                assume gs:nothing
                mov     esi, es:[ebp+0Ch]
                mov     edi, es:[ebp+18h]
                xor     eax, eax
                mov     dword ptr aSystemSoftwareD+23h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     dword ptr aSystemSoftwareD+27h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     dword ptr aSystemSoftwareD+2Bh, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     dword ptr aSystemSoftwareD+2Fh, eax ; +3: _app_type
                                        ; +4: _app_load
                cmp     _sys_type, 3
                jz      short loc_13D17
                mov     eax, cr0
                mov     dword ptr aSystemSoftwareD+23h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     eax, cr2
                mov     dword ptr aSystemSoftwareD+27h, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     eax, cr3
                mov     dword ptr aSystemSoftwareD+2Bh, eax ; +3: _app_type
                                        ; +4: _app_load
                mov     eax, dr6
                mov     dword ptr aSystemSoftwareD+2Fh, eax ; +3: _app_type
                                        ; +4: _app_load

loc_13D17:
                mov     ebp, esp
                mov     al, 20h ; ' '
                out     0A0h, al        ; PIC 2  same as 0020 for PIC 1
                out     20h, al         ; Interrupt controller, 8259A.
                mov     ax, _pic_mask
                out     0A1h, al        ; Interrupt Controller #2, 8259A
                mov     al, ah
                out     21h, al         ; Interrupt controller, 8259A.
                call    restore_pit
                call    restore_inttab
                call    tone
                call    scr_on
                call    dump_description
                call    dump_description2
                push    _process_id
                push    offset start
                mov     dx, offset aModuleNameSProc ; "Module name: \"%s\", ProcessId=%w\r\n"
                call    prints
                add     sp, 4
                call    dump_origin
                call    dump_eflags
                call    dump_opcodes
                call    dump_regs
                call    dump_selectors
                mov     al, -1
                jmp     exit386
eh_common       endp


; =============== S U B R O U T I N E =======================================


dump_description proc near
                mov     eax, dword ptr aSystemSoftwareD+2Fh ; +3: _app_type
                                        ; +4: _app_load
                and     al, 0Fh
                jz      short loc_13D78
                call    check_faultsel
                push    esi
                push    fs
                mov     dx, offset aNullPointerProt ; "Null-pointer protection at %w:%l\r\n"
                call    prints
                add     sp, 6
                retn
; ---------------------------------------------------------------------------

loc_13D78:
                push    6001h
                mov     dx, offset aDos32aweRunTim ; "DOS32AWE run-time (%w): "
                call    prints
                pop     ax
                mov     ebx, -2
                call    loadl_cs_eip
                mov     bl, 0CDh
                mov     bh, byte ptr aPresentDpmiHost+16h
                cmp     ax, bx
                mov     cx, offset aException ; "exception"
                jnz     short loc_13D9B
                mov     cx, offset aUnexpectedInter ; "unexpected interrupt"

loc_13D9B:
                mov     ax, word ptr aPresentDpmiHost+16h
                mov     bx, ax
                add     bx, bx
                push    esi
                push    fs
                push    i_msg[bx]
                push    ax
                push    cx
                mov     dx, offset aSBhIdentitySAtW ; "%s %bh\r\nIdentity: %s at %w:%l\r\n"
                call    prints
                add     sp, 0Ch
                retn
dump_description endp


; =============== S U B R O U T I N E =======================================


dump_description2 proc near
                call    check_faultsel
                push    eax
                push    cx
                mov     ax, offset aLinear ; "Linear"
                jb      short loc_13DC4
                mov     ax, offset aUnrelocated ; "Unrelocated"

loc_13DC4:
                push    ax
                mov     dx, offset aSCrashAddressDL ; "%s crash address %d:%l"
                call    prints
                add     sp, 8
                mov     ax, word ptr aPresentDpmiHost+16h
                cmp     al, 8
                jb      short loc_13DEB
                cmp     al, 9
                jz      short loc_13DDD
                cmp     al, 0Eh
                ja      short loc_13DEB

loc_13DDD:                              ; +3: _app_type
                push    large [dword ptr aSystemSoftwareD+37h] ; +4: _app_load
                mov     dx, offset aErrorCodePushed ; ", error code pushed on stack %l"
                call    prints
                add     sp, 4

loc_13DEB:
                call    printcr
                retn
dump_description2 endp


; =============== S U B R O U T I N E =======================================


dump_origin     proc near
                mov     al, '='
                mov     cx, 72

loc_13DF4:
                call    printc
                loop    loc_13DF4
                mov     ax, fs
                cmp     ax, 8
                mov     dx, offset aKernel ; "KERNEL="
                jz      short loc_13E18
                cmp     ax, _sel_cs
                mov     dx, offset aClient ; "CLIENT="
                jz      short loc_13E18
                cmp     ax, _sel32_cs
                mov     dx, offset aApp32 ; "APP/32="
                jz      short loc_13E18
                mov     dx, offset aApp?? ; "APP/??="

loc_13E18:
                call    prints
                jmp     printcr
dump_origin     endp


; =============== S U B R O U T I N E =======================================


dump_eflags     proc near
                mov     cl, 8
                mov     ebx, dword ptr aSystemSoftwareD+33h ; +3: _app_type
                                        ; +4: _app_load
                xor     eax, eax
                xor     edx, edx

loc_13E2B:
                shr     bl, 1
                rcr     eax, 4
                shr     bh, 1
                rcr     edx, 4
                loop    loc_13E2B
                push    eax
                push    edx
                push    large [dword ptr aSystemSoftwareD+33h] ; +3: _app_type
                                        ; +4: _app_load
                mov     dx, offset aEflagsLL_L ; "EFLAGS = %l [%l.%l]  "
                call    prints
                add     sp, 0Ch
                retn
dump_eflags     endp


; =============== S U B R O U T I N E =======================================


dump_opcodes    proc near
                mov     cl, 0Ah
                mov     ebx, 9

loc_13E54:
                call    loadb_cs_eip
                push    ax
                dec     ebx
                loop    loc_13E54
                mov     dx, offset aCsEipBBBBBBBBBB ; "CS:[EIP] = %b %b %b %b %b %b %b %b %b %"...
                call    prints
                add     sp, 14h
                jmp     printcr
dump_opcodes    endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


dump_regs       proc near
                xor     ebx, ebx
                call    loadl_ss_esp
                push    eax
                push    large [dword ptr aSystemSoftwareD+2Fh] ; +3: _app_type
                                        ; +4: _app_load
                push    large dword ptr [ebp+4]
                push    large dword ptr [ebp+1Ch]
                mov     dx, offset aEaxLEsiLDr6LSsE ; "EAX = %l    ESI = %l       DR6 = %l    "...
                call    prints
                add     sp, 10h
                add     bx, 4
                call    loadl_ss_esp
                push    eax
                push    large [dword ptr aSystemSoftwareD+23h] ; +3: _app_type
                                        ; +4: _app_load
                push    large dword ptr [ebp+0]
                push    large dword ptr [ebp+10h]
                mov     dx, offset aEbxLEdiLCr0LSsE ; "EBX = %l    EDI = %l       CR0 = %l    "...
                call    prints
                add     sp, 10h
                add     bx, 4
                call    loadl_ss_esp
                push    eax
                push    large [dword ptr aSystemSoftwareD+27h] ; +3: _app_type
                                        ; +4: _app_load
                push    large dword ptr [ebp+8]
                push    large dword ptr [ebp+18h]
                mov     dx, offset aEcxLEbpLCr2LSsE ; "ECX = %l    EBP = %l       CR2 = %l    "...
                call    prints
                add     sp, 10h
                add     bx, 4
                call    loadl_ss_esp
                push    eax
                push    large [dword ptr aSystemSoftwareD+2Bh] ; +3: _app_type
                                        ; +4: _app_load
                push    edi
                push    large dword ptr [ebp+14h]
                mov     dx, offset aEdxLEspLCr3LSsE ; "EDX = %l    ESP = %l       CR3 = %l    "...
                call    prints
                add     sp, 10h
                retn
dump_regs       endp


; =============== S U B R O U T I N E =======================================


dump_selectors  proc near
                mov     dx, offset aCsW ; "CS: = %w  "
                mov     ax, fs
                call    describe_selector
                mov     dx, offset aDsW ; "DS: = %w  "
                mov     ax, [ebp+26h]
                call    describe_selector
                mov     dx, offset aEsW ; "ES: = %w  "
                mov     ax, [ebp+24h]
                call    describe_selector
                mov     dx, offset aSsW ; "SS: = %w  "
                mov     ax, gs
                call    describe_selector
                mov     dx, offset aFsW ; "FS: = %w  "
                mov     ax, [ebp+22h]
                call    describe_selector
                mov     dx, offset aGsW ; "GS: = %w  "
                mov     ax, [ebp+20h]
                call    describe_selector
                retn
dump_selectors  endp


; =============== S U B R O U T I N E =======================================


describe_selector proc near
                push    ax
                call    prints
                pop     ax
                test    ax, ax
                jnz     short loc_13F31
                mov     dx, offset aNullSelector ; "NULL selector"
                call    prints
                jmp     printcr
; ---------------------------------------------------------------------------

loc_13F31:
                mov     bx, ax
                sub     sp, 8
                push    ss
                pop     es
                mov     edi, esp
                mov     ax, 0Bh
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET DESCRIPTOR
                                        ; BX = selector, ES:DI / ES:EDI -> 8-byte buffer for copy of descriptor
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jnb     short loc_13F4E
                add     sp, 8
                mov     dx, offset aInvalidSelector ; "Invalid selector"
                call    prints
                jmp     printcr
; ---------------------------------------------------------------------------

loc_13F4E:
                mov     ax, es:[edi+5]
                mov     dx, ax
                push    ax
                shr     al, 1
                and     ax, 7
                push    ax
                mov     cl, dh
                shr     cl, 6
                and     cl, 1
                mov     ax, 10h
                shl     ax, cl
                push    ax
                mov     al, dl
                shr     al, 3
                and     eax, 1
                lea     eax, selmsg8.str[eax+eax*4]
                push    ax
                mov     al, dh
                shr     al, 7
                and     eax, 1
                lea     eax, selmsg9.str[eax+eax*4]
                push    ax
                mov     al, dh
                and     eax, 0Fh
                shl     eax, 10h
                mov     ax, es:[edi]
                push    eax
                mov     ah, es:[edi+7]
                mov     al, es:[edi+4]
                shl     eax, 10h
                mov     ax, es:[edi+2]
                push    eax
                mov     dx, offset aBaseLLimitLGrSS ; "Base=%l Limit=%l Gr=%s Seg=%s/%dbit Typ"...
                call    prints
                add     sp, 1Ah
                retn
describe_selector endp


; =============== S U B R O U T I N E =======================================


check_faultsel  proc near
                mov     ax, 6
                mov     bx, fs
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET SEGMENT BASE ADDRESS
                                        ; BX = selector
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX = linear base address of segment
                shl     ecx, 10h
                mov     cx, dx
                lea     eax, [ecx+esi]
                mov     ecx, dword ptr aThisProgramRequ+14h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                jcxz    short loc_13FE4

loc_13FD8:                              ; also _app_buf_allocsel
                cmp     bx, word ptr get_environ_config[ecx*2]
                jz      short loc_13FE6
                loop    loc_13FD8

loc_13FE4:
                stc
                retn
; ---------------------------------------------------------------------------

loc_13FE6:
                sub     eax, dword ptr _app_buf_allocbase[ecx*4]
                clc
                retn
check_faultsel  endp


; =============== S U B R O U T I N E =======================================


check_selector  proc near
                lar     bx, ax
                jnz     short loc_14003
                verr    ax
                jnz     short loc_14003
                not     bx
                test    bh, 80h
                jnz     short loc_14003
                retn
; ---------------------------------------------------------------------------

loc_14003:
                xor     ax, ax
                retn
check_selector  endp


; =============== S U B R O U T I N E =======================================


loadb_cs_eip    proc near
                mov     ax, fs
                test    ax, ax
                jnz     short loc_14010
                xor     eax, eax
                retn
; ---------------------------------------------------------------------------

loc_14010:
                movzx   eax, byte ptr fs:[esi+ebx]
                retn
loadb_cs_eip    endp


; =============== S U B R O U T I N E =======================================


loadl_cs_eip    proc near
                mov     ax, fs
                test    ax, ax
                jnz     short loc_14022
                xor     eax, eax
                retn
; ---------------------------------------------------------------------------

loc_14022:
                mov     eax, fs:[esi+ebx]
                retn
loadl_cs_eip    endp


; =============== S U B R O U T I N E =======================================


loadl_ss_esp    proc near
                mov     ax, gs
                test    ax, ax
                jnz     short loc_14033
                xor     eax, eax
                retn
; ---------------------------------------------------------------------------

loc_14033:
                mov     eax, gs:[edi+ebx]
                retn
loadl_ss_esp    endp


; =============== S U B R O U T I N E =======================================


tone            proc near
                push    ax
                push    cx
                mov     ax, 500h
                mov     cx, 110h
                call    beep
                mov     ax, 300h
                call    beep
                pop     cx
                pop     ax
                retn
tone            endp


; =============== S U B R O U T I N E =======================================


beep            proc near
                test    cs:_misc_byte_1, 2
                jnz     short loc_14057
                retn
; ---------------------------------------------------------------------------

loc_14057:
                push    cx
                push    dx
                push    ax
                mov     al, 0B6h ; '¶'
                out     43h, al         ; Timer 8253-5 (AT: 8254.2).
                pop     ax
                out     42h, al         ; Timer 8253-5 (AT: 8254.2).
                mov     al, ah
                out     42h, al         ; Timer 8253-5 (AT: 8254.2).
                in      al, 61h         ; PC/XT PPI port B bits:
                                        ; 0: Tmr 2 gate ÍËÍ OR 03H=spkr ON
                                        ; 1: Tmr 2 data ͼ  AND  0fcH=spkr OFF
                                        ; 3: 1=read high switches
                                        ; 4: 0=enable RAM parity checking
                                        ; 5: 0=enable I/O channel check
                                        ; 6: 0=hold keyboard clock low
                                        ; 7: 0=enable kbrd
                or      al, 3
                out     61h, al         ; PC/XT PPI port B bits:
                                        ; 0: Tmr 2 gate ÍËÍ OR 03H=spkr ON
                                        ; 1: Tmr 2 data ͼ  AND  0fcH=spkr OFF
                                        ; 3: 1=read high switches
                                        ; 4: 0=enable RAM parity checking
                                        ; 5: 0=enable I/O channel check
                                        ; 6: 0=hold keyboard clock low
                                        ; 7: 0=enable kbrd

loc_1406B:                              ; Timer 8253-5 (AT: 8254.2).
                in      al, 40h
                in      al, 40h         ; Timer 8253-5 (AT: 8254.2).
                mov     ah, al

loc_14071:                              ; Timer 8253-5 (AT: 8254.2).
                in      al, 40h
                in      al, 40h         ; Timer 8253-5 (AT: 8254.2).
                cmp     ah, al
                jz      short loc_14071
                loop    loc_1406B
                in      al, 61h         ; PC/XT PPI port B bits:
                                        ; 0: Tmr 2 gate ÍËÍ OR 03H=spkr ON
                                        ; 1: Tmr 2 data ͼ  AND  0fcH=spkr OFF
                                        ; 3: 1=read high switches
                                        ; 4: 0=enable RAM parity checking
                                        ; 5: 0=enable I/O channel check
                                        ; 6: 0=hold keyboard clock low
                                        ; 7: 0=enable kbrd
                and     al, 0FCh
                out     61h, al         ; PC/XT PPI port B bits:
                                        ; 0: Tmr 2 gate ÍËÍ OR 03H=spkr ON
                                        ; 1: Tmr 2 data ͼ  AND  0fcH=spkr OFF
                                        ; 3: 1=read high switches
                                        ; 4: 0=enable RAM parity checking
                                        ; 5: 0=enable I/O channel check
                                        ; 6: 0=hold keyboard clock low
                                        ; 7: 0=enable kbrd
                pop     dx
                pop     cx
                retn
beep            endp


; =============== S U B R O U T I N E =======================================


scr_on          proc near
                push    ax
                push    bx
                push    cx
                push    dx
                test    cs:_misc_byte_1, 40h
                jz      short loc_14095
                mov     ax, 3
                int     10h             ; - VIDEO - SET VIDEO MODE
                                        ; AL = mode

loc_14095:
                mov     dx, 3C4h
                mov     al, 1
                out     dx, al          ; EGA: sequencer address reg
                                        ; clocking mode. Data bits:
                                        ; 0: 1=8 dots/char; 0=9 dots/char
                                        ; 1: CRT bandwidth: 1=low; 0=high
                                        ; 2: 1=shift every char; 0=every 2nd char
                                        ; 3: dot clock: 1=halved
                inc     dx
                in      al, dx          ; EGA port: sequencer data register
                and     al, 0DFh
                out     dx, al          ; EGA port: sequencer data register
                pop     dx
                pop     cx
                pop     bx
                pop     ax
                retn
scr_on          endp


; =============== S U B R O U T I N E =======================================


_int10          proc near

var_14          = dword ptr -14h
var_C           = dword ptr -0Ch
var_8           = dword ptr -8
var_4           = word ptr -4
arg_E           = dword ptr  10h
arg_1A          = dword ptr  1Ch

; FUNCTION CHUNK AT 134E SIZE 0000012F BYTES
; FUNCTION CHUNK AT 149C SIZE 00000020 BYTES

                cld
                push    ds
                push    es
                pushad
                cmp     ah, 1Bh
                jz      short v_1B
                cmp     ah, 1Ch
                jz      v_1C
                cmp     ax, 4F00h
                jz      v_4F00
                cmp     ax, 4F01h
                jz      v_4F00
                cmp     ax, 4F04h
                jz      v_4F04
                cmp     ax, 4F09h
                jz      v_4F09
                cmp     ax, 4F0Ah
                jz      v_4F0A
                popad
                pop     es
                pop     ds
                jmp     large [fword ptr cs:_int10_._ip]
; ---------------------------------------------------------------------------

v_1B:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+10h], bx
                mov     ds, cs:_sel_ds
                mov     ax, _seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+0], 0
                call    int10h
                mov     ecx, 10h
                mov     esi, _lobufbase
                rep movs dword ptr es:[edi], dword ptr [esi]
                movzx   eax, word ptr [ebp+1Ch]
                movzx   ebx, word ptr [ebp+10h]
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                mov     [esp+24h+var_14], ebx
                jmp     @__ok
; ---------------------------------------------------------------------------

v_1C:
                test    al, al
                jz      short loc_14144
                cmp     al, 1
                jz      short loc_14163
                cmp     al, 2
                jz      short loc_1418D
                jmp     loc_143AF
; ---------------------------------------------------------------------------

loc_14144:
                pushfd
                call    large [fword ptr cs:_int10_._ip]
                movzx   eax, ax
                movzx   ebx, bx
                mov     [esp+arg_1A], eax
                mov     [esp+arg_E], ebx
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14163:
                sub     esp, 32h
                mov     ebp, esp
                call    @v_std
                call    int10h
                mov     esi, _lobufbase
                mov     edi, ebx
                mov     ax, 1C00h
                xor     bx, bx
                int     10h             ; - VIDEO - SAVE/RESTORE VIDEO STATE (PS50+,VGA)
                                        ; return state buffer size, return: BX = number of 64 byte blocks needed
                mov     ecx, ebx
                shl     ecx, 4
                rep movs dword ptr es:[edi], dword ptr [esi]
                jmp     loc_1439C
; ---------------------------------------------------------------------------

loc_1418D:
                sub     esp, 32h
                mov     ebp, esp
                call    @v_std
                mov     esi, ebx
                mov     edi, _lobufbase
                mov     ax, 1C00h
                xor     bx, bx
                int     10h             ; - VIDEO - SAVE/RESTORE VIDEO STATE (PS50+,VGA)
                                        ; return state buffer size, return: BX = number of 64 byte blocks needed
                mov     ecx, ebx
                shl     ecx, 4
                push    ds
                push    es
                pop     ds
                pop     es
                rep movs dword ptr es:[edi], dword ptr [esi]
                call    int10h
                jmp     loc_1439C
; ---------------------------------------------------------------------------

v_4F00:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     dx, ax
                mov     ds, cs:_sel_ds
                mov     ax, _seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+0], 0
                call    int10h
                mov     esi, _lobufbase
                test    dl, dl
                mov     ecx, 40h ; '@'
                jnz     short loc_1421E
                lea     ebx, [esi+6]
                call    _int10_mod
                lea     ebx, [esi+0Eh]
                call    _int10_mod
                lea     ebx, [esi+16h]
                call    _int10_mod
                lea     ebx, [esi+1Ah]
                call    _int10_mod
                lea     ebx, [esi+1Eh]
                call    _int10_mod
                mov     ecx, 80h ; '€'

loc_1421E:
                rep movs dword ptr es:[edi], dword ptr [esi]
                jmp     loc_1439C
_int10          endp


; =============== S U B R O U T I N E =======================================


_int10_mod      proc near
                movzx   edx, word ptr [ebx]
                movzx   eax, word ptr [ebx+2]
                shl     eax, 4
                add     eax, edx
                mov     dx, [ebx+2]
                cmp     dx, _seg_buf
                jnz     short loc_14249
                sub     eax, _lobufzero
                add     eax, edi

loc_14249:
                mov     [ebx], eax
                retn
_int10_mod      endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int10

v_4F04:
                test    dl, dl
                jz      loc_14144
                cmp     dl, 1
                jz      short loc_14261
                cmp     dl, 2
                jz      short loc_1428D
                jmp     loc_143AF
; ---------------------------------------------------------------------------

loc_14261:
                sub     esp, 32h
                mov     ebp, esp
                call    @v_std
                call    int10h
                mov     esi, _lobufbase
                mov     edi, ebx
                mov     ax, 4F04h
                xor     dl, dl
                xor     bx, bx
                int     10h             ; - VIDEO - VESA SuperVGA BIOS -  SAVE/RESTORE SuperVGA VIDEO STATE
                                        ; DL = get state buffer size
                mov     ecx, ebx
                shl     ecx, 4
                rep movs dword ptr es:[edi], dword ptr [esi]
                jmp     loc_1439C
; ---------------------------------------------------------------------------

loc_1428D:
                sub     esp, 32h
                mov     ebp, esp
                call    @v_std
                mov     esi, ebx
                mov     edi, _lobufbase
                mov     ax, 4F04h
                xor     dl, dl
                xor     bx, bx
                int     10h             ; - VIDEO - VESA SuperVGA BIOS -  SAVE/RESTORE SuperVGA VIDEO STATE
                                        ; DL = get state buffer size
                mov     ecx, ebx
                shl     ecx, 4
                push    ds
                push    es
                pop     ds
                pop     es
                rep movs dword ptr es:[edi], dword ptr [esi]
                call    int10h
                jmp     loc_1439C
; ---------------------------------------------------------------------------

v_4F09:
                cmp     bl, 3
                jbe     short loc_142C9
                cmp     bl, 80h
                jnz     loc_143AF

loc_142C9:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     [ebp+14h], dx
                mov     [ebp+10h], bx
                mov     ds, cs:_sel_ds
                mov     ax, _seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+0], 0
                test    bl, bl
                jz      short loc_14302
                dec     bl
                jz      short loc_14318
                dec     bl
                jz      short loc_14302
                dec     bl
                jz      short loc_14318

loc_14302:
                mov     esi, edi
                mov     edi, _lobufbase
                push    ds
                push    es
                pop     ds
                pop     es
                rep movs dword ptr es:[edi], dword ptr [esi]
                call    int10h
                jmp     loc_1439C
; ---------------------------------------------------------------------------

loc_14318:
                call    int10h
                mov     esi, _lobufbase
                rep movs dword ptr es:[edi], dword ptr [esi]
                jmp     short loc_1439C
; ---------------------------------------------------------------------------

v_4F0A:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+10h], bx
                call    int10h
                movzx   eax, word ptr [ebp+1Ch]
                movzx   ecx, word ptr [ebp+18h]
                movzx   edx, word ptr [ebp+22h]
                movzx   edi, word ptr [ebp+0]
                cmp     ax, 4Fh ; 'O'
                jnz     short loc_1439C
                shl     edx, 4
                add     edi, edx
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                mov     [esp+24h+var_C], ecx
                mov     [esp], edi
                mov     ax, cs:_sel_zero
                mov     [esp+24h+var_4], ax
                jmp     @__ok
; END OF FUNCTION CHUNK FOR _int10

; =============== S U B R O U T I N E =======================================


@v_std          proc near
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     [ebp+14h], dx
                mov     ds, cs:_sel_ds
                mov     ax, _seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+10h], 0
                retn
@v_std          endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int10

loc_1439C:
                movzx   eax, word ptr [ebp+1Ch]
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_143AF:
                mov     [esp+24h+var_8], 0FFFFFFFFh
                jmp     @__ok
; END OF FUNCTION CHUNK FOR _int10

; =============== S U B R O U T I N E =======================================


_int21          proc near

var_20          = dword ptr -20h
var_1C          = dword ptr -1Ch
var_14          = dword ptr -14h
var_10          = dword ptr -10h
var_C           = dword ptr -0Ch
var_8           = dword ptr -8
var_4           = word ptr -4
var_2           = word ptr -2
arg_6           = byte ptr  8

; FUNCTION CHUNK AT 2047 SIZE 0000001F BYTES
; FUNCTION CHUNK AT 2128 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 214D SIZE 0000000C BYTES

                cld
                test    cs:_sys_misc, 100h
                jnz     loc_14522
                push    ds
                push    es
                pushad
                cmp     ah, 9
                jz      @__09h
                cmp     ah, 1Ah
                jz      @__1Ah
                cmp     ah, 1Bh
                jz      @__1Bh
                cmp     ah, 1Ch
                jz      @__1Bh
                cmp     ah, 1Fh
                jz      @__1Fh
                cmp     ah, 25h ; '%'
                jz      @__25h
                cmp     ah, 2Fh ; '/'
                jz      @__2Fh
                cmp     ah, 31h ; '1'
                jz      @__31h
                cmp     ah, 32h ; '2'
                jz      @__1Fh
                cmp     ah, 34h ; '4'
                jz      @__34h
                cmp     ah, 35h ; '5'
                jz      @__35h
                cmp     ah, 39h ; '9'
                jz      @__39h
                cmp     ah, 3Ah ; ':'
                jz      @__39h
                cmp     ah, 3Bh ; ';'
                jz      @__39h
                cmp     ah, 3Ch ; '<'
                jz      @__3Ch
                cmp     ah, 3Dh ; '='
                jz      @__3Ch
                cmp     ah, 3Fh ; '?'
                jz      @__3Fh
                cmp     ah, 40h ; '@'
                jz      @__40h
                cmp     ah, 41h ; 'A'
                jz      @__39h
                cmp     ah, 42h ; 'B'
                jz      @__42h
                cmp     ah, 43h ; 'C'
                jz      @__43h
                cmp     ax, 4402h
                jz      @__3Fh
                cmp     ax, 4403h
                jz      @__40h
                cmp     ax, 4404h
                jz      @__3Fh
                cmp     ax, 4405h
                jz      @__40h
                cmp     ah, 47h ; 'G'
                jz      @__47h
                cmp     ah, 48h ; 'H'
                jz      @__48h
                cmp     ah, 49h ; 'I'
                jz      @__49h
                cmp     ah, 4Ah ; 'J'
                jz      @__4Ah
                cmp     ah, 4Bh ; 'K'
                jz      @__4Bh
                cmp     ah, 4Ch ; 'L'
                jz      @__4Ch
                cmp     ah, 4Eh ; 'N'
                jz      @__4Eh
                cmp     ah, 4Fh ; 'O'
                jz      @__4Fh
                cmp     ah, 51h ; 'Q'
                jz      @__51h
                cmp     ah, 56h ; 'V'
                jz      @__56h
                cmp     ah, 5Ah ; 'Z'
                jz      @__39h
                cmp     ah, 5Bh ; '['
                jz      @__39h
                cmp     ah, 62h ; 'b'
                jz      @__62h
                cmp     ah, 0FFh
                jz      @__FFh
                cmp     ah, 71h ; 'q'
                jnz     short @__go21
                cmp     al, 39h ; '9'
                jz      @__39h
                cmp     al, 3Ah ; ':'
                jz      @__39h
                cmp     al, 3Bh ; ';'
                jz      @__39h
                cmp     al, 41h ; 'A'
                jz      @__39h
                cmp     al, 43h ; 'C'
                jz      @__43h
                cmp     al, 47h ; 'G'
                jz      @__47h
                cmp     al, 56h ; 'V'
                jz      @__56h
                cmp     al, 60h ; '`'
                jz      @_7160
                cmp     al, 6Ch ; 'l'
                jz      @_716C

@__go21:
                popad
                pop     es
                pop     ds
                jmp     large [fword ptr cs:_int21_._ip]
; ---------------------------------------------------------------------------

loc_14522:
                mov     ax, 4CFFh
                jmp     @__4Ch
; ---------------------------------------------------------------------------

@__09h:
                push    ds
                pop     es
                assume es:TEXT16
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     esi, edx
                mov     edi, edx
                mov     al, 24h ; '$'
                or      ecx, 0FFFFFFFFh
                repne scas byte ptr es:[edi]
                not     ecx
                mov     es, cs:_sel_ds
                assume es:nothing
                mov     edi, cs:_lobufbase
                rep movs byte ptr es:[edi], byte ptr [esi]
                stos    byte ptr es:[edi]
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+14h], 0
                call    int21h
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__1Ah:
                mov     es, cs:_sel_ds
                assume es:TEXT16
                mov     es:_app_dta_sel, ds
                mov     es:_app_dta_ofs, edx
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     ax, cs:_seg_dta
                mov     [ebp+24h], ax
                mov     word ptr [ebp+14h], 0
                call    int21h
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__1Bh:
                call    @__all
                mov     byte ptr [esp+24h+var_8], al
                cmp     al, 0FFh
                jz      short loc_145D0
                mov     [esp+24h+var_10], edx
                mov     [esp+24h+var_C], ecx
                shl     esi, 4
                add     ebx, esi
                mov     [esp+24h+var_14], ebx
                mov     ax, cs:_sel_zero
                mov     [esp+24h+var_2], ax

loc_145D0:
                jmp     @__ok
; ---------------------------------------------------------------------------

@__1Fh:
                call    @__all
                mov     byte ptr [esp+24h+var_8], al
                cmp     al, 0FFh
                jz      short loc_145F5
                shl     esi, 4
                add     ebx, esi
                mov     [esp+24h+var_14], ebx
                mov     ax, cs:_sel_zero
                mov     [esp+24h+var_2], ax

loc_145F5:
                jmp     @__ok
; ---------------------------------------------------------------------------

@__25h:
                mov     bl, al
                mov     cx, ds
                mov     ax, 205h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; SET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number, CX:DX / CX:EDX = selector:offset of handler
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

@__2Fh:
                mov     ax, cs:_app_dta_sel
                mov     [esp+24h+var_4], ax
                mov     eax, cs:_app_dta_ofs
                mov     [esp+24h+var_14], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@__31h:
                sub     esp, 32h
                mov     ebp, esp
                mov     bx, cs:_membase
                add     bx, cs:_buf_size
                sub     bx, cs:_seg_es
                mov     [ebp+1Ch], ax
                mov     [ebp+14h], bx
                call    int21h
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__34h:
                call    @__all
                shl     edi, 4
                add     ebx, edi
                mov     [esp+24h+var_14], ebx
                mov     ax, cs:_sel_zero
                mov     [esp+24h+var_4], ax
                jmp     @__ok
; ---------------------------------------------------------------------------

@__35h:
                mov     bl, al
                mov     ax, 204h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     [esp+24h+var_4], cx
                mov     [esp+24h+var_14], edx
                jmp     @__ok
; ---------------------------------------------------------------------------

@__39h:
                call    @__std
                jz      @__ok
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__3Ch:
                call    @__std
                mov     [esp+24h+var_8], eax
                jz      @__ok
                jmp     @__err
; ---------------------------------------------------------------------------

@__3Fh:
                push    ds
                pop     es
                mov     ds, cs:_sel_ds
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+10h], bx
                mov     edi, edx
                mov     ebx, ecx
                xor     edx, edx

loc_146B3:
                mov     [ebp+1Ch], ax
                mov     ax, _seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+14h], 0
                mov     eax, ebx
                cmp     eax, _lobufsize
                jbe     short loc_146D2
                mov     eax, _lobufsize

loc_146D2:
                mov     [ebp+18h], ax
                call    int21h
                movzx   eax, word ptr [ebp+1Ch]
                test    byte ptr [ebp+20h], 1
                jnz     short loc_14712
                test    ax, ax
                jz      short loc_14705
                mov     esi, _lobufbase
                call    @__cp2
                add     edx, eax
                cmp     word ptr [ebp+10h], 0
                jz      short loc_14705
                sub     ebx, eax
                mov     ax, [ebp+4Eh]
                ja      short loc_146B3

loc_14705:
                add     esp, 32h
                mov     [esp+24h+var_8], edx
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14712:
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__40h:
                mov     es, cs:_sel_ds
                assume es:nothing
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+10h], bx
                mov     esi, edx
                mov     ebx, ecx
                xor     edx, edx

loc_14738:
                mov     [ebp+1Ch], ax
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+14h], 0
                mov     eax, ebx
                cmp     eax, cs:_lobufsize
                jbe     short loc_1475A
                mov     eax, cs:_lobufsize

loc_1475A:
                mov     [ebp+18h], ax
                mov     edi, cs:_lobufbase
                call    @__cp2
                call    int21h
                movzx   eax, word ptr [ebp+1Ch]
                test    byte ptr [ebp+20h], 1
                jnz     short loc_14794
                test    ax, ax
                jz      short loc_14787
                add     edx, eax
                sub     ebx, eax
                mov     ax, [ebp+4Eh]
                ja      short loc_14738

loc_14787:
                add     esp, 32h
                mov     [esp+24h+var_8], edx
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14794:
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__42h:
                call    @__all
                mov     [esp+24h+var_8], eax
                jnz     @__err
                mov     [esp+24h+var_10], edx
                jmp     @__ok
; ---------------------------------------------------------------------------

@__43h:
                call    @__std
                jz      short loc_147C5
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

loc_147C5:
                mov     [esp+24h+var_C], ecx
                jmp     @__ok
; ---------------------------------------------------------------------------

@__47h:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+14h], dx
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+4], 0
                call    int21h
                test    byte ptr [ebp+20h], 1
                jnz     short loc_14813
                push    ds
                pop     es
                assume es:TEXT16
                mov     edi, esi
                mov     ds, cs:_sel_ds
                mov     esi, _lobufbase

loc_14804:
                lods    byte ptr [esi]
                stos    byte ptr es:[edi]
                test    al, al
                jnz     short loc_14804
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14813:
                movzx   eax, word ptr [ebp+1Ch]
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__48h:
                mov     ax, 100h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE DOS MEMORY BLOCK
                                        ; BX = number of paragraphs to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_1483A
                movzx   edx, dx
                mov     [esp+24h+var_8], edx
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_1483A:
                movzx   eax, ax
                movzx   ebx, bx
                mov     [esp+24h+var_8], eax
                mov     [esp+24h+var_14], ebx
                jmp     @__err
; ---------------------------------------------------------------------------

@__49h:
                mov     ax, 101h
                mov     dx, es
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE DOS MEMORY BLOCK
                                        ; DX = selector of block
                                        ; Return: CF set on error
                                        ; CF set if successful
                jnb     short loc_14867
                movzx   eax, ax
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

loc_14867:
                mov     [esp+24h+var_4], 0
                jmp     @__ok
; ---------------------------------------------------------------------------

@__4Ah:
                mov     ax, 102h
                mov     dx, es
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; RESIZE DOS MEMORY BLOCK
                                        ; BX = new block size in paragraphs, DX = selector of block
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jnb     @__ok
                movzx   eax, ax
                movzx   ebx, bx
                mov     [esp+24h+var_8], eax
                mov     [esp+24h+var_14], ebx
                jmp     @__err
; ---------------------------------------------------------------------------

@__4Bh:
                test    al, al
                jnz     @__err
                cmp     cs:_lobufsize, 400h
                jb      @__err
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                push    es
                mov     es, cs:_sel_ds
                assume es:nothing
                mov     edi, cs:_lobufbase
                mov     esi, edx
                add     edi, 100h

loc_148C8:
                lods    byte ptr [esi]
                stos    byte ptr es:[edi]
                test    al, al
                jnz     short loc_148C8
                pop     es
                push    ds
                push    es
                mov     esi, es:[ebx+6]
                mov     edi, cs:_lobufbase
                mov     ds, word ptr es:[ebx+0Ah]
                mov     es, cs:_sel_ds
                add     edi, 180h
                movzx   ecx, byte ptr [esi]
                inc     cx
                inc     cx
                rep movs byte ptr es:[edi], byte ptr [esi]
                pop     es
                pop     ds
                push    ds
                push    es
                mov     edi, es:[ebx]
                mov     ax, es:[ebx+4]
                test    ax, ax
                jz      short loc_1493A
                mov     es, ax
                xor     ax, ax
                mov     esi, edi
                or      ecx, 0FFFFFFFFh

loc_14917:
                repne scas byte ptr es:[edi]
                dec     ecx
                scas    byte ptr es:[edi]
                jnz     short loc_14917
                not     ecx
                mov     ax, 100h
                mov     bx, cx
                shr     bx, 4
                inc     bx
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE DOS MEMORY BLOCK
                                        ; BX = number of paragraphs to allocate
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      short loc_1496B
                push    es
                pop     ds
                mov     es, dx
                assume es:TEXT16
                xor     edi, edi
                rep movs byte ptr es:[edi], byte ptr [esi]

loc_1493A:
                mov     ds, cs:_sel_ds
                mov     edi, _lobufbase
                mov     [edi], ax
                mov     ax, _seg_buf
                mov     word ptr [edi+2], 180h
                mov     [edi+4], ax
                mov     ax, _seg_es
                mov     word ptr [edi+6], 5Ch ; '\'
                mov     [edi+8], ax
                mov     word ptr [edi+0Ah], 6Ch ; 'l'
                mov     [edi+0Ch], ax

loc_1496B:
                pop     es
                assume es:nothing
                pop     ds
                jb      short loc_149D5
                push    dx
                mov     ds, cs:_sel_ds
                mov     ax, _seg_buf
                mov     [ebp+22h], ax
                mov     [ebp+24h], ax
                mov     word ptr [ebp+10h], 0
                mov     word ptr [ebp+14h], 100h
                cmp     _sys_type, 3
                jz      short loc_1499E
                mov     eax, cr0
                mov     edi, eax
                and     al, 0FBh
                mov     cr0, eax

loc_1499E:
                call    uninstall_client_ints
                call    int21h
                call    install_client_ints
                cmp     _sys_type, 3
                jz      short loc_149B1
                mov     cr0, edi

loc_149B1:
                pop     dx
                mov     ax, 101h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE DOS MEMORY BLOCK
                                        ; DX = selector of block
                                        ; Return: CF set on error
                                        ; CF set if successful
                movzx   eax, word ptr [ebp+1Ch]
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                mov     [esp+24h+var_8], eax
                jnz     @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_149D5:
                add     esp, 32h
                mov     [esp+24h+var_8], 0FFFFFFFFh
                jmp     @__err
; ---------------------------------------------------------------------------

@__4Ch:
                cli
                cld
                mov     ds, cs:_sel_ds
                mov     es, _sel_es
                lss     esp, fword ptr _sel_esp
                push    ax
                mov     ax, _sel_env
                mov     es:2Ch, ax
                cmp     _sys_type, 3
                jz      short loc_14A0C
                xor     eax, eax
                mov     dr7, eax

loc_14A0C:
                push    es
                mov     ax, 0Ch
                xor     edx, edx
                mov     cx, dx
                mov     es, dx
                assume es:nothing
                int     33h             ; - MS MOUSE - DEFINE INTERRUPT SUBROUTINE PARAMETERS
                                        ; CX = call mask, ES:DX -> FAR routine
                pop     es
                assume es:nothing
                mov     dx, _mus_backofs
                mov     cx, _mus_backseg
                mov     ax, cx
                or      ax, dx
                jz      short loc_14A2D
                mov     ax, 304h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE REAL MODE CALL-BACK ADDRESS
                                        ; CX:DX = real mode call-back address
                                        ; Return: CF set on error
                                        ; CF clear if successful

loc_14A2D:                              ; +4: _exec_handle
                mov     ecx, dword ptr aThisProgramRequ+14h ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                jcxz    short loc_14A43

loc_14A34:
                mov     ax, 1
                mov     bx, word ptr get_environ_config[ecx*2] ; also _app_buf_allocsel
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE LDT DESCRIPTOR
                                        ; BX = selector to free
                                        ; Return: CF set on error
                                        ; CF clear if successful
                loop    loc_14A34

loc_14A43:
                call    check_inttab
                call    restore_inttab
                call    uninstall_client_ints
                mov     ax, 1
                mov     bx, cs:_sel_zero
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE LDT DESCRIPTOR
                                        ; BX = selector to free
                                        ; Return: CF set on error
                                        ; CF clear if successful
                xor     ax, ax
                mov     fs, ax
                assume fs:nothing
                mov     gs, ax
                assume gs:nothing
                pop     ax
                jmp     large [fword ptr cs:_int21_._ip]
; ---------------------------------------------------------------------------

@__4Eh:
                call    @__std
                jnz     short loc_14A8A
                mov     ds, cs:_dta_sel
                mov     esi, cs:_dta_ofs
                mov     es, cs:_app_dta_sel
                mov     edi, cs:_app_dta_ofs
                mov     ecx, 2Bh ; '+'
                rep movs byte ptr es:[edi], byte ptr [esi]
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14A8A:
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__4Fh:
                mov     ds, cs:_app_dta_sel
                mov     esi, cs:_app_dta_ofs
                mov     es, cs:_dta_sel
                mov     edi, cs:_dta_ofs
                mov     ecx, 2Bh ; '+'
                rep movs byte ptr es:[edi], byte ptr [esi]
                call    @__all
                jnz     short loc_14AD9
                mov     ds, cs:_dta_sel
                mov     esi, cs:_dta_ofs
                mov     es, cs:_app_dta_sel
                mov     edi, cs:_app_dta_ofs
                mov     ecx, 2Bh ; '+'
                rep movs byte ptr es:[edi], byte ptr [esi]
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14AD9:
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@__51h:
                movzx   eax, cs:_seg_es
                mov     [esp+24h+var_14], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@__56h:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                or      ecx, 0FFFFFFFFh
                xor     al, al
                repne scas byte ptr es:[edi]
                not     ecx
                sub     edi, ecx
                mov     esi, edi
                push    ds
                push    es
                pop     ds
                mov     es, cs:_sel_ds
                mov     edi, cs:_lobufbase
                rep movs byte ptr es:[edi], byte ptr [esi]
                pop     ds
                mov     ecx, edi
                mov     ebx, cs:_lobufbase
                sub     ecx, ebx
                xchg    ecx, ebx
                push    ds
                pop     es
                assume es:TEXT16
                mov     esi, edx
                xchg    esi, edi
                or      ecx, 0FFFFFFFFh
                xor     al, al
                repne scas byte ptr es:[edi]
                not     ecx
                sub     edi, ecx
                xchg    esi, edi
                mov     es, cs:_sel_ds
                assume es:nothing
                rep movs byte ptr es:[edi], byte ptr [esi]
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     [ebp+22h], ax
                mov     word ptr [ebp+0], 0
                mov     [ebp+14h], bx
                call    int21h
                jmp     @__tst
; ---------------------------------------------------------------------------

@__62h:
                movzx   eax, cs:_sel_es
                mov     [esp+24h+var_14], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@_7160:
                sub     esp, 32h
                mov     ebp, esp
                push    es
                push    edi
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     es, cs:_sel_ds
                mov     edi, cs:_lobufbase
                add     edi, 200h

loc_14BA2:
                lods    byte ptr [esi]
                stos    byte ptr es:[edi]
                test    al, al
                jnz     short loc_14BA2
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     [ebp+22h], ax
                mov     word ptr [ebp+4], 200h
                mov     word ptr [ebp+0], 0
                call    int21h
                push    es
                pop     ds
                mov     esi, cs:_lobufbase
                pop     edi
                pop     es
                test    byte ptr [ebp+20h], 1
                jnz     short loc_14BE6

loc_14BD7:
                lods    byte ptr [esi]
                stos    byte ptr es:[edi]
                test    al, al
                jnz     short loc_14BD7
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

loc_14BE6:
                movzx   eax, word ptr [ebp+1Ch]
                add     esp, 32h
                mov     [esp+24h+var_8], eax
                jmp     @__err
; ---------------------------------------------------------------------------

@_716C:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+0], di
                mov     [ebp+10h], bx
                mov     [ebp+14h], dx
                mov     [ebp+18h], cx
                mov     [ebp+1Ch], ax
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+4], 0
                mov     es, cs:_sel_ds
                mov     edi, cs:_lobufbase

loc_14C2D:
                lods    byte ptr [esi]
                stos    byte ptr es:[edi]
                test    al, al
                jnz     short loc_14C2D
                call    int21h
                movzx   eax, word ptr [ebp+1Ch]
                movzx   ecx, word ptr [ebp+18h]
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                mov     [esp+24h+var_8], eax
                jnz     @__err
                mov     [esp+24h+var_C], ecx
                jmp     @__ok
; ---------------------------------------------------------------------------

@__FFh:
                cmp     al, 88h ; 'ˆ'
                jz      @_FF88
                cmp     al, 89h ; '‰'
                jz      @_FF89
                cmp     al, 8Ah ; 'Š'
                jz      @_FF8A
                cmp     al, 8Dh ; ''
                jz      @_FF8D
                cmp     al, 8Eh ; 'Ž'
                jz      @_FF8E
                cmp     al, 8Fh ; ''
                jz      @_FF8F
                cmp     al, 80h ; '€'
                jz      @_FF80
                cmp     al, 90h ; ''
                jz      @_FF90
                cmp     al, 91h ; '‘'
                jz      @_FF91
                cmp     al, 92h ; '’'
                jz      @_FF92
                cmp     al, 93h ; '“'
                jz      @_FF93
                cmp     al, 94h ; '”'
                jz      @_FF94
                cmp     al, 95h ; '•'
                jz      @_FF95
                cmp     al, 96h ; '–'
                jz      @_FF96
                cmp     al, 97h ; '—'
                jz      @_FF97
                cmp     al, 98h ; '˜'
                jz      @_FF98
                cmp     al, 99h ; '™'
                jz      @_FF99
                cmp     al, 9Ah ; 'š'
                jz      @_FF9A
                cmp     dx, 78h ; 'x'
                jnz     @__go21
                mov     gs, cs:_sel_ds
                assume gs:nothing
                mov     [esp+24h+var_8], 4734FFFFh
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF88:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                call    int21h
                mov     eax, 'ID32'
                movzx   ebx, cs:_version
                mov     ecx, [ebp+18h]
                mov     edx, [ebp+14h]
                mov     esi, [ebp+4]
                mov     edi, [ebp+0]
                mov     ebp, [esp+56h+var_1C]
                add     esp, 52h
                jmp     @__exi
; ---------------------------------------------------------------------------

@_FF89:
                mov     eax, 49443332h
                movzx   esi, cs:_seg_id32
                shl     esi, 4
                mov     fs, cs:_sel_zero
                assume fs:nothing
                movzx   ebx, cs:_version
                mov     ecx, cs:_lobufsize
                movzx   edx, word ptr cs:_misc_byte_1
                add     esp, 20h
                jmp     @__exi
; ---------------------------------------------------------------------------

@_FF8A:
                mov     eax, 'ID32'
                movzx   esi, cs:_seg_kernel
                shl     esi, 4
                add     esi, 0
                mov     fs, cs:_sel_zero
                movzx   ebx, cs:_version
                mov     cl, cs:_cpu_type
                mov     ch, cs:_sys_type
                mov     dl, fs:[esi]
                add     esp, 20h
                jmp     @__exi
; ---------------------------------------------------------------------------

@_FF8D:
                push    gs
                push    ds
                pop     gs
                assume gs:TEXT16
                mov     ds, cs:_sel_ds
                call    decompress
                mov     eax, dword ptr aThisProgramRequ+10h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                sub     eax, edi
                pop     gs
                assume gs:nothing
                mov     [esp+24h+var_8], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF8E:
                mov     gs, cs:_sel_ds
                mov     edx, offset start
                mov     esi, offset get_environ_config ; also _app_buf_allocsel
                mov     edi, offset _misc_byte_1
                add     esp, 20h
                jmp     @__exi
; ---------------------------------------------------------------------------

@_FF8F:
                mov     ds, cs:_sel_ds
                xchg    ebx, _lobufsize
                mov     [esp+24h+var_14], ebx
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF80:
                mov     es, cs:_sel_ds
                mov     edi, cs:_lobufbase
                mov     esi, edx
                mov     dx, di

loc_14DED:
                lods    byte ptr [esi]
                stosb
                test    al, al
                jnz     short loc_14DED
                push    es
                pop     ds
                mov     word ptr a80386ProcessorO+38h, ss ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     dword ptr a80386ProcessorO+34h, esp ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                lss     esp, fword ptr _sel_esp
                push    ecx
                push    ebx
                call    prints
                lss     esp, fword ptr a80386ProcessorO+34h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF90:
                push    ss
                pop     es
                sub     esp, 30h
                mov     edi, esp
                mov     ax, 500h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET FREE MEMORY INFORMATION
                                        ; ES:DI / ES:EDI -> buffer for memory information
                                        ; Return: CF clear
                mov     eax, [esp]
                add     esp, 30h
                mov     [esp+24h+var_8], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF91:
                call    @_FF9x1
                mov     ax, 501h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; ALLOCATE MEMORY BLOCK
                                        ; BX:CX = size in bytes
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jmp     @_FF9x2
; ---------------------------------------------------------------------------

@_FF92:
                call    @_FF9x1
                mov     ax, 502h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; FREE MEMORY BLOCK
                                        ; SI:DI = handle of memory block
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jb      @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF93:
                call    @_FF9x1
                mov     ax, 503h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; RESIZE MEMORY BLOCK
                                        ; BX:CX = new size in bytes, SI:DI = handle of memory block
                                        ; Return: CF set on error
                                        ; CF clear if successful
                jmp     @_FF9x2
; ---------------------------------------------------------------------------

@_FF94:
                mov     ah, 48h ; 'H'
                mov     bx, 0FFFFh
                call    @__all
                shl     ebx, 4
                mov     [esp+24h+var_8], ebx
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF95:
                add     ebx, 0Fh
                shr     ebx, 4
                test    ebx, 0FFFF0000h
                jnz     @__err
                test    bx, bx
                jz      @__err
                mov     ah, 48h ; 'H'
                call    @__all
                jnz     @__err
                mov     [esp+24h+var_20], eax
                shl     eax, 4
                mov     [esp+24h+var_14], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF96:
                sub     esp, 32h
                mov     ebp, esp
                mov     byte ptr [ebp+1Dh], 49h ; 'I'
                mov     [ebp+22h], si
                call    int21h
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                jnz     @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF97:
                add     ebx, 0Fh
                shr     ebx, 4
                test    ebx, 0FFFF0000h
                jnz     @__err
                test    bx, bx
                jz      @__err
                sub     esp, 32h
                mov     ebp, esp
                mov     byte ptr [ebp+1Dh], 4Ah ; 'J'
                mov     [ebp+10h], bx
                mov     [ebp+22h], si
                call    int21h
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                jnz     @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF98:
                call    @_FF9x1
                mov     ax, 800h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; PHYSICAL ADDRESS MAPPING
                                        ; BX:CX = physical address, SI:DI = size in bytes
                                        ; Return: CF set on error
                                        ; CF clear if successful
                                        ; BX:CX = linear address which maps the requested physical memory
                jb      @__err
                jmp     short loc_14F57
; ---------------------------------------------------------------------------

@_FF99:
                call    @_FF9x1
                mov     ax, 801h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; free physical address mapping
                jb      @__err
                jmp     @__ok
; ---------------------------------------------------------------------------

@_FF9A:
                mov     edi, ebx
                call    set_descriptor
                jb      @__err
                mov     word ptr [esp+24h+var_8], ax
                jmp     @__ok
_int21          endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


@_FF9x1         proc near
                mov     cx, bx
                shr     ebx, 10h
                mov     di, si
                shr     esi, 10h
                retn
@_FF9x1         endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int21

@_FF9x2:
                jb      @__err
                shl     esi, 10h
                mov     si, di
                mov     [esp+24h+var_20], esi

loc_14F57:
                shl     ebx, 10h
                mov     bx, cx
                mov     [esp+24h+var_14], ebx
                jmp     @__ok
; END OF FUNCTION CHUNK FOR _int21

; =============== S U B R O U T I N E =======================================


@__cpy          proc near
                push    ds
                pop     es
                assume es:TEXT16
                xor     ax, ax
                mov     esi, edx
                mov     edi, edx
                or      ecx, 0FFFFFFFFh
                repne scas byte ptr es:[edi]
                not     ecx
                mov     es, cs:_sel_ds
                assume es:nothing
                mov     edi, cs:_lobufbase
                rep movs byte ptr es:[edi], byte ptr [esi]
                mov     ax, cs:_seg_buf
                mov     [ebp+24h], ax
                mov     word ptr [ebp+14h], 0
                jmp     int21h
@__cpy          endp


; =============== S U B R O U T I N E =======================================


@__cp2          proc near
                mov     ecx, eax
                shr     cx, 2
                rep movs dword ptr es:[edi], dword ptr [esi]
                mov     cl, al
                and     cl, 3
                rep movs byte ptr es:[edi], byte ptr [esi]
                retn
@__cp2          endp


; =============== S U B R O U T I N E =======================================


@__std          proc near
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+4], si
                mov     [ebp+10h], bx
                mov     [ebp+18h], cx
                mov     [ebp+1Ch], ax
                call    @__cpy
                movzx   eax, word ptr [ebp+1Ch]
                movzx   ecx, word ptr [ebp+18h]
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                retn
@__std          endp


; =============== S U B R O U T I N E =======================================


@__all          proc near
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+10h], bx
                mov     [ebp+14h], dx
                mov     [ebp+18h], cx
                mov     [ebp+1Ch], ax
                call    int21h
                movzx   eax, word ptr [ebp+1Ch]
                movzx   ecx, word ptr [ebp+18h]
                movzx   edx, word ptr [ebp+14h]
                movzx   ebx, word ptr [ebp+10h]
                movzx   edi, word ptr [ebp+22h]
                movzx   esi, word ptr [ebp+24h]
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                retn
@__all          endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int21

@__tst:
                movzx   eax, word ptr [ebp+1Ch]
                test    byte ptr [ebp+20h], 1
                lea     esp, [esp+32h]
                mov     [esp+24h+var_8], eax
                jnz     short @__err
; END OF FUNCTION CHUNK FOR _int21
; START OF FUNCTION CHUNK FOR _int33

@__ok:
                popad

@__exi:
                pop     es
                pop     ds
                and     [esp+arg_6], 0FEh
                iretd
; END OF FUNCTION CHUNK FOR _int33
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int21

@__err:
                popad
                pop     es
                pop     ds
                or      [esp+arg_6], 1
                iretd
; END OF FUNCTION CHUNK FOR _int21

; =============== S U B R O U T I N E =======================================


_int33          proc near

var_14          = word ptr -14h
var_10          = dword ptr -10h
var_8           = dword ptr -8
var_4           = word ptr -4
arg_6           = byte ptr  8

; FUNCTION CHUNK AT 2141 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 2306 SIZE 00000090 BYTES

                cld
                push    ds
                push    es
                pushad
                cmp     ax, 9
                jz      short @__0009h
                cmp     ax, 0Ch
                jz      short @__000Ch
                cmp     ax, 14h
                jz      short @__0014h
                cmp     ax, 16h
                jz      @__0016h
                cmp     ax, 17h
                jz      @__0017h
                cmp     ax, 18h
                jz      @__0018h
                cmp     ax, 19h
                jz      @__0019h
                cmp     ax, 20h
                jz      @__0020h
                popad
                pop     es
                pop     ds
                jmp     large [fword ptr cs:_int33_._ip]
; ---------------------------------------------------------------------------

@__0009h:
                push    es
                pop     ds
                sub     esp, 32h
                mov     ebp, esp
                mov     esi, edx
                mov     es, cs:_sel_zero
                movzx   edi, cs:_seg_mus
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     [ebp+10h], bx
                mov     [ebp+22h], di
                mov     word ptr [ebp+14h], 0
                shl     edi, 4
                mov     ecx, 10h
                rep movs dword ptr es:[edi], dword ptr [esi]
                call    int33h
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__000Ch:
                call    _mus_int_def
                jmp     @__ok
; ---------------------------------------------------------------------------

@__0014h:
                mov     si, cs:_mus_._cs
                mov     edi, cs:_mus_._ip
                call    _mus_int_def
                mov     [esp+24h+var_10], edi
                mov     [esp+24h+var_4], si
                jmp     @__ok
; ---------------------------------------------------------------------------

@__0018h:
                call    _mus_int_def
                mov     [esp+24h+var_8], eax
                jmp     @__ok
; ---------------------------------------------------------------------------

@__0019h:
                mov     ax, cs:_mus_._cs
                mov     edx, cs:_mus_._ip
                mov     [esp+24h+var_10], edx
                mov     [esp+24h+var_14], ax
                jmp     @__ok
_int33          endp


; =============== S U B R O U T I N E =======================================


_mus_int_def    proc near
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                mov     [ebp+18h], cx
                mov     ds, cs:_sel_ds
                xor     eax, eax
                mov     _mus_._ip, edx
                mov     _mus_._cs, es
                mov     ax, es
                or      eax, edx
                jz      short loc_15153
                mov     ax, _seg_ds
                mov     dx, offset _mus_int_rm

loc_15153:
                mov     [ebp+14h], dx
                mov     [ebp+22h], ax
                cli
                call    int33h
                movzx   eax, word ptr [ebp+1Ch]
                add     esp, 32h
                sti
                retn
_mus_int_def    endp


; =============== S U B R O U T I N E =======================================


_mus_int_rm     proc far
                cmp     cs:_mus_data, 0
                mov     cs:_mus_data, 1
                jnz     short locret_1517E
                jmp     dword ptr cs:_mus_backofs
; ---------------------------------------------------------------------------

locret_1517E:
                retf
_mus_int_rm     endp


; =============== S U B R O U T I N E =======================================


_mus_int_pm     proc far
                cld
                pushad
                push    ds
                push    es
                push    fs
                push    gs
                xor     eax, eax
                mov     ax, ds
                mov     ds, cs:_sel_ds
                mov     dword ptr aSystemSoftwareD+7, esp ; +3: _app_type
                                        ; +4: _app_load
                mov     word ptr aSystemSoftwareD+0Bh, ss ; +3: _app_type
                                        ; +4: _app_load
                mov     ds, ax
                mov     ax, ss
                lar     eax, eax
                shr     eax, 17h
                jb      short loc_151AD
                movzx   esp, sp

loc_151AD:
                mov     ax, cs:_seg_ds
                mov     es:[edi+2Ch], ax
                mov     word ptr es:[edi+2Ah], offset @@done
                movzx   eax, word ptr es:[edi+1Ch]
                movzx   ecx, word ptr es:[edi+18h]
                movzx   edx, word ptr es:[edi+14h]
                movzx   ebx, word ptr es:[edi+10h]
                movzx   esi, word ptr es:[edi+4]
                movzx   edi, word ptr es:[edi]
                pushfd
                call    large [fword ptr cs:_mus_._ip]
                lss     esp, fword ptr cs:aSystemSoftwareD+7 ; +3: _app_type
                                        ; +4: _app_load
                pop     gs
                pop     fs
                pop     es
                pop     ds
                popad
                iretd
; ---------------------------------------------------------------------------

@@done:
                mov     cs:_mus_data, 0
                retf
_mus_int_pm     endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR _int33

@__0016h:
                sub     esp, 32h
                mov     ebp, esp
                mov     edi, edx
                mov     [ebp+1Ch], ax
                mov     ax, cs:_seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+14h], 0
                call    int33h
                mov     ds, cs:_sel_ds
                mov     esi, _lobufbase
                mov     ecx, _mus_size
                rep movs byte ptr es:[edi], byte ptr [esi]
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__0017h:
                push    es
                pop     ds
                sub     esp, 32h
                mov     ebp, esp
                mov     esi, edx
                mov     [ebp+1Ch], ax
                mov     ax, cs:_seg_buf
                mov     [ebp+22h], ax
                mov     word ptr [ebp+14h], 0
                mov     es, cs:_sel_ds
                mov     edi, cs:_lobufbase
                mov     ecx, cs:_mus_size
                rep movs byte ptr es:[edi], byte ptr [esi]
                call    int33h
                add     esp, 32h
                jmp     @__ok
; ---------------------------------------------------------------------------

@__0020h:
                sub     esp, 32h
                mov     ebp, esp
                mov     [ebp+1Ch], ax
                call    int33h
                add     esp, 32h
                mov     word ptr [esp+24h+var_8], 0FFFFh
                jmp     @__ok
; END OF FUNCTION CHUNK FOR _int33
; Runtime extender ends here
; -----------------------------------------------
; Loader starts here

; =============== S U B R O U T I N E =======================================


load_le_app     proc near
                mov     byte ptr aSystemSoftwareD+3, 0 ; +3: _app_type
                                        ; +4: _app_load
                jmp     short load_application
load_le_app     endp


; =============== S U B R O U T I N E =======================================


load_lx_app     proc near
                mov     byte ptr aSystemSoftwareD+3, 1 ; +3: _app_type
                                        ; +4: _app_load
                jmp     short load_application
load_lx_app     endp


; =============== S U B R O U T I N E =======================================


load_lc_app     proc near
                mov     byte ptr aSystemSoftwareD+3, 2 ; +3: _app_type
load_lc_app     endp ; sp-analysis failed ; +4: _app_load


; =============== S U B R O U T I N E =======================================


load_application proc near
                call    load_header
                call    verbose_showloadhdr
                mov     ecx, 1

loc_152B5:
                call    load_object
                call    create_selector
                call    verbose_showloadobj
                push    edx
                push    edi
                push    esi
                push    ebx
                inc     cx
                cmp     cx, word ptr aThisProgramRequ+14h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                jbe     short loc_152B5
                call    preload_fixups
                mov     ebp, esp
                mov     ebx, dword ptr aThisProgramRequ+14h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                dec     bx
                shl     bx, 4
                mov     dword ptr aThisProgramRequ+0Ch, ebx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab

loc_152E1:
                call    relocate_object
                sub     bx, 10h
                jnb     short loc_152E1
                call    unload_fixups
                call    close_exec
                mov     esp, _sel_esp
                call    verbose_showstartup
                jmp     enter_32bit_code
load_application endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


load_header     proc near

; FUNCTION CHUNK AT 2A41 SIZE 00000052 BYTES

                mov     ecx, 0A8h ; '¨'
                mov     edx, 4
                mov     _err_code, 3002h
                cmp     byte ptr aSystemSoftwareD+3, 2 ; +3: _app_type
                                        ; +4: _app_load
                jz      load_lc_header
                call    load_fs_block
                mov     edx, dword ptr aThisProgramRequ+8 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ax, fs:10h
                and     ax, 2000h
                mov     ax, 3005h
                jnz     file_error
                mov     ax, fs:44h
                mov     cx, ax
                cmp     ax, 40h ; '@'
                mov     ax, 4001h
                ja      file_error
                mov     dword ptr aThisProgramRequ+14h, ecx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     eax, fs:40h
                add     eax, edx
                mov     dword ptr aThisProgramRequ+18h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     eax, fs:48h
                add     eax, edx
                mov     dword ptr aThisProgramRequ+1Ch, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     eax, fs:68h
                add     eax, edx
                mov     dword ptr aThisProgramRequ+20h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     eax, fs:6Ch
                add     eax, edx
                mov     dword ptr aThisProgramRequ+24h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     eax, fs:80h
                add     dword ptr a80386ProcessorO, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:18h
                mov     dword ptr a80386ProcessorO+8, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:20h
                mov     dword ptr a80386ProcessorO+0Ch, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:1Ch
                mov     dword ptr a80386ProcessorO+10h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:24h
                mov     dword ptr a80386ProcessorO+14h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:30h
                mov     dword ptr a80386ProcessorO+20h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:2Ch
                mov     dword ptr a80386ProcessorO+28h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, 0FFFh
                cmp     byte ptr aSystemSoftwareD+3, 0 ; +3: _app_type
                                        ; +4: _app_load
                jz      short loc_153C8
                mov     ax, 1
                mov     cx, fs:2Ch
                shl     ax, cl
                dec     ax

loc_153C8:                              ;  +0: _app_off_datapages
                mov     dword ptr a80386ProcessorO+4, eax ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                retn
load_header     endp


; =============== S U B R O U T I N E =======================================


load_object     proc near

var_4           = word ptr -4

; FUNCTION CHUNK AT 2A93 SIZE 00000088 BYTES

                push    ecx
                cmp     byte ptr aSystemSoftwareD+3, 2 ; +3: _app_type
                                        ; +4: _app_load
                jz      load_lc_object
                mov     _err_code, 3002h
                mov     edx, dword ptr aThisProgramRequ+18h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                call    seek_from_start
                mov     ecx, 18h
                xor     edx, edx
                call    load_fs_block
                add     dword ptr aThisProgramRequ+18h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     edx, dword ptr a80386ProcessorO ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                call    seek_from_start
                mov     eax, fs:0
                mov     ebx, fs:10h
                mov     ecx, fs:8
                mov     esi, fs:0Ch
                push    ecx
                call    alloc_block
                mov     ecx, eax
                mov     ebp, eax
                mov     edx, edi
                call    fill_zero_pages
                mov     eax, ebx
                test    eax, eax
                jz      short loc_1548E
                shl     eax, 0Ch
                cmp     eax, ecx
                jnb     short loc_1543B
                mov     ecx, eax

loc_1543B:
                mov     ax, [esp+8+var_4]
                cmp     ax, word ptr aThisProgramRequ+14h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                jnz     short loc_15464
                cmp     byte ptr aSystemSoftwareD+3, 0 ; +3: _app_type
                                        ; +4: _app_load
                jnz     short loc_1545D
                lea     ecx, [ebx-1]
                shl     ecx, 0Ch
                add     ecx, dword ptr a80386ProcessorO+28h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jmp     short loc_15464
; ---------------------------------------------------------------------------

loc_1545D:
                mov     ecx, ebx
                shl     ecx, 0Ch

loc_15464:
                mov     _err_code, 3002h
                call    load_gs_block
                mov     eax, ecx
                mov     edx, dword ptr a80386ProcessorO+4 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                test    eax, edx
                jz      short loc_15489
                mov     ecx, edx
                not     edx
                and     eax, edx
                lea     eax, [eax+ecx+1]

loc_15489:                              ;  +0: _app_off_datapages
                add     dword ptr a80386ProcessorO, eax ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage

loc_1548E:
                pop     edx
                pop     ecx
                retn
load_object     endp


; =============== S U B R O U T I N E =======================================


relocate_object proc near

var_4           = dword ptr -4

                xor     eax, eax
                cmp     eax, [ebp+ebx+0]
                jnz     short loc_1549F
                retn
; ---------------------------------------------------------------------------

loc_1549F:                              ; +3: _app_type
                cmp     byte ptr aSystemSoftwareD+3, 0 ; +4: _app_load
                jnz     short relocate_lx_object
                mov     ecx, [ebp+ebx+4]
                mov     edx, dword ptr aThisProgramRequ+1Ch ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                lea     edx, [edx+ecx*4-4]
                mov     _err_code, 3002h
                call    seek_from_start

loc_154C0:
                push    eax
                mov     ecx, 4
                xor     edx, edx
                mov     _err_code, 3002h
                call    load_fs_block
                xor     ecx, ecx
                mov     ch, fs:1
                mov     cl, fs:2
                jcxz    short loc_15517
                mov     eax, dword ptr aThisProgramRequ+20h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                lea     eax, [eax+ecx*4-4]
                mov     esi, gs:[eax]
                mov     ecx, gs:[eax+4]
                sub     ecx, esi
                jz      short loc_15517
                add     esi, dword ptr aThisProgramRequ+24h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     edi, [esp]
                shl     edi, 0Ch
                add     edi, [ebp+ebx+8]
                add     ecx, esi
                call    apply_fixups

loc_15517:
                pop     eax
                inc     ax
                cmp     ax, [ebp+ebx+0]
                jb      short loc_154C0
                retn
; ---------------------------------------------------------------------------

relocate_lx_object:
                mov     ecx, [ebp+ebx+4]
                mov     edx, dword ptr aThisProgramRequ+20h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                lea     edx, [edx+ecx*4-4]

loc_15533:
                push    eax
                push    edx
                mov     esi, gs:[edx]
                mov     ecx, gs:[edx+4]
                sub     ecx, esi
                jz      short loc_15562
                add     esi, dword ptr aThisProgramRequ+24h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     edi, [esp+8+var_4]
                shl     edi, 0Ch
                add     edi, [ebp+ebx+8]
                add     ecx, esi
                call    apply_fixups

loc_15562:
                pop     edx
                pop     eax
                add     edx, 4
                inc     ax
                cmp     ax, [ebp+ebx+0]
                jb      short loc_15533
                retn
relocate_object endp


; =============== S U B R O U T I N E =======================================


apply_fixups    proc near
                push    ecx
                push    edi
                mov     _err_code, 4005h
                mov     cx, gs:[esi]
                movsx   edx, word ptr gs:[esi+2]
                movzx   eax, word ptr gs:[esi+4]
                add     edi, edx
                test    cx, 0F20h
                jnz     file_errorm
                test    cx, 4000h
                jnz     short loc_155A4
                mov     ah, 0
                dec     esi

loc_155A4:
                add     esi, 6
                dec     eax
                shl     eax, 4
                mov     edx, dword ptr aThisProgramRequ+0Ch ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                sub     edx, eax
                jb      file_errorm
                mov     dword ptr aThisProgramRequ+10h, edx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     edx, [ebp+edx+8]
                mov     al, cl
                and     al, 0Fh
                cmp     al, 2
                jz      short loc_155EA
                cmp     al, 8
                ja      file_errorm
                mov     eax, gs:[esi]
                test    cx, 1000h
                jnz     short loc_155E6
                movzx   eax, ax
                sub     esi, 2

loc_155E6:
                add     esi, 4

loc_155EA:
                cmp     cl, 7
                jnz     short loc_15603
                add     eax, edx
                mov     gs:[edi], eax

loc_155F7:
                pop     edi
                pop     ecx
                cmp     esi, ecx
                jb      apply_fixups
                retn
; ---------------------------------------------------------------------------

loc_15603:
                push    si
                mov     si, cx
                and     si, 0Fh
                add     si, si
                mov     _err_code, 4006h
                call    fix_tab[si]
                pop     si
                jmp     short loc_155F7
apply_fixups    endp

; ---------------------------------------------------------------------------

fix_byte:
                mov     gs:[edi], al
                retn
; ---------------------------------------------------------------------------

fix_16off:
                mov     gs:[edi], ax
                retn
; ---------------------------------------------------------------------------

fix_32off:
                add     eax, edx
                mov     gs:[edi], eax
                retn
; ---------------------------------------------------------------------------

fix_32selfref:
                add     eax, edx
                lea     ecx, [edi+4]
                sub     eax, ecx
                test    word ptr [ebp+ebx+0Ch], 2000h
                jnz     short loc_15654
                lea     ecx, [eax+8002h]
                shr     ecx, 10h
                jnz     file_errorm
                mov     gs:[edi], ax
                retn
; ---------------------------------------------------------------------------

loc_15654:
                mov     gs:[edi], eax
                retn
; ---------------------------------------------------------------------------

fix_16sel:
                call    check_range
                mov     gs:[edi], dx
                retn
; ---------------------------------------------------------------------------

fix_1616ptr:
                call    check_range
                mov     gs:[edi], ax
                mov     gs:[edi+2], dx
                retn
; ---------------------------------------------------------------------------

fix_1632ptr:
                add     eax, edx
                mov     gs:[edi], eax
                call    check_range
                mov     gs:[edi+4], dx
                retn
; ---------------------------------------------------------------------------

fix_invalid:
                mov     ax, 4005h
                jmp     file_error

; =============== S U B R O U T I N E =======================================


check_range     proc near
                test    word ptr [ebp+ebx+0Ch], 1000h
                jnz     short loc_1569F
                test    cl, 10h
                jnz     short loc_1569F

loc_15694:                              ; +4: _exec_handle
                mov     ecx, dword ptr aThisProgramRequ+10h ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dx, [ebp+ecx+0Eh]
                retn
; ---------------------------------------------------------------------------

loc_1569F:
                test    cl, 10h
                jz      short loc_15694
                mov     ecx, dword ptr aThisProgramRequ+10h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dx, [ebp+ecx+0Eh]
                test    eax, 0FFFF0000h
                jnz     file_errorm
                retn
check_range     endp

; ---------------------------------------------------------------------------
                align 2
fix_tab         dw offset fix_byte
                dw offset fix_invalid
                dw offset fix_16sel
                dw offset fix_1616ptr
                dw offset fix_invalid
                dw offset fix_16off
                dw offset fix_1632ptr
                dw offset fix_32off
                dw offset fix_32selfref

; =============== S U B R O U T I N E =======================================


fill_zero_pages proc near
                push    es
                push    dx
                push    eax
                push    ecx
                push    edi
                push    gs
                pop     es
                mov     dl, cl
                shr     ecx, 2
                xor     eax, eax
                rep stos dword ptr es:[edi]
                mov     cl, dl
                and     cl, 3
                rep stos byte ptr es:[edi]
                pop     edi
                pop     ecx
                pop     eax
                pop     dx
                pop     es
                retn
fill_zero_pages endp


; =============== S U B R O U T I N E =======================================


alloc_block     proc near

arg_4           = word ptr  6

; FUNCTION CHUNK AT 024E SIZE 00000004 BYTES
; FUNCTION CHUNK AT 046B SIZE 00000006 BYTES

                push    dx
                test    eax, eax
                jz      short loc_15712
                mov     dl, _misc_byte_1
                shr     dx, 4
                and     dx, 3
                jz      short loc_15726
                dec     dx
                jz      short loc_15739
                dec     dx
                jz      short loc_15758
                dec     dx
                jz      short loc_15766

loc_15710:
                pop     dx
                retn
; ---------------------------------------------------------------------------

loc_15712:
                push    ax
                push    si
                mov     si, [esp+6+arg_4]
                mov     ax, 9005h
                call    report_error
                pop     si
                pop     ax
                pop     dx
                xor     edi, edi
                retn
; ---------------------------------------------------------------------------

loc_15726:
                call    alloc_dos_mem
                jnb     short loc_15710
                mov     _err_code, 4003h
                call    alloc_dpmi_mem
                jnb     short loc_15710
                jmp     file_errorm
; ---------------------------------------------------------------------------

loc_15739:
                test    cx, 2000h
                jnz     short loc_1574A
                mov     _err_code, 4002h
                call    alloc_dos_mem
                jnb     short loc_15710

loc_1574A:
                mov     _err_code, 4003h
                call    alloc_dpmi_mem
                jnb     short loc_15710
                jmp     file_errorm
; ---------------------------------------------------------------------------

loc_15758:
                mov     _err_code, 4002h
                call    alloc_dos_mem
                jnb     short loc_15710
                jmp     file_errorm
; ---------------------------------------------------------------------------

loc_15766:
                mov     _err_code, 4003h
                call    alloc_dpmi_mem
                jnb     short loc_15710
                jmp     file_errorm
alloc_block     endp ; sp-analysis failed


; =============== S U B R O U T I N E =======================================


alloc_dos_mem   proc near
                push    eax
                push    ebp
                add     eax, 0Fh
                shr     eax, 4
                test    eax, 0FFFF0000h
                stc
                jnz     short loc_157B2
                sub     esp, 32h
                mov     ebp, esp
                mov     byte ptr [ebp+1Dh], 48h ; 'H'
                mov     [ebp+10h], ax
                call    int21h
                movzx   edi, word ptr [ebp+1Ch]
                shl     edi, 4
                bt      word ptr [ebp+20h], 0
                lea     esp, [esp+32h]

loc_157B2:
                pop     ebp
                pop     eax
                retn
alloc_dos_mem   endp


; =============== S U B R O U T I N E =======================================


alloc_dpmi_mem  proc near
                push    esi
                push    ebx
                push    ecx
                push    edx
                push    eax
                mov     ebx, eax
                mov     ax, 0FF91h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                jb      short loc_1582A
                mov     eax, ebx
                xor     edx, edx
                test    _misc_byte_2, 4
                jnz     short loc_157DE
                test    al, 0Fh
                jz      short loc_15810
                jmp     short loc_157E3
; ---------------------------------------------------------------------------

loc_157DE:
                test    ax, 0FFFh
                jz      short loc_15810

loc_157E3:
                test    _misc_byte_2, 4
                jnz     short loc_157F3
                add     ebx, 0Fh
                and     bl, 0F0h
                jmp     short loc_157FE
; ---------------------------------------------------------------------------

loc_157F3:
                add     ebx, 0FFFh
                and     bx, 0F000h

loc_157FE:
                sub     ebx, eax
                mov     edx, ebx
                add     ebx, [esp]
                mov     ax, 0FF93h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                jb      short loc_1582A

loc_15810:
                lea     edi, [ebx+edx]
                test    _misc_byte_2, 4
                jnz     short loc_15822
                test    di, 0Fh
                jmp     short loc_15826
; ---------------------------------------------------------------------------

loc_15822:
                test    di, 0FFFh

loc_15826:
                stc
                jnz     short loc_1582A
                clc

loc_1582A:
                pop     eax
                pop     edx
                pop     ecx
                pop     ebx
                pop     esi
                retn
alloc_dpmi_mem  endp


; =============== S U B R O U T I N E =======================================


create_selector proc near

var_A           = word ptr -0Ah

                push    ebx
                push    ecx
                push    edx
                push    esi
                push    edi
                mov     ax, dx
                mov     ecx, ebp
                mov     dx, _acc_rights
                test    al, 4
                jz      short loc_1584F
                or      dl, 8

loc_1584F:
                test    ax, 2000h
                jz      short loc_1586B
                xor     edi, edi
                or      ecx, 0FFFFFFFFh
                test    al, 4
                mov     ax, _sel32_cs
                jnz     short loc_15865
                mov     ax, _sel32_ss

loc_15865:
                test    ax, ax
                jnz     short loc_15876
                jmp     short loc_1586F
; ---------------------------------------------------------------------------

loc_1586B:
                and     dx, 0BFFFh

loc_1586F:
                call    set_descriptor
                jb      dpmi_error

loc_15876:
                pop     edi
                pop     esi
                mov     [esp+0Ch+var_A], ax
                pop     edx
                pop     ecx
                pop     ebx
                mov     word ptr get_environ_config[ecx*2], ax ; also _app_buf_allocsel
                mov     dword ptr _app_buf_allocbase[ecx*4], edi
                cmp     cx, word ptr a80386ProcessorO+8 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jnz     short loc_158AF
                mov     _sel32_cs, ax
                mov     dword ptr a80386ProcessorO+18h, edi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                test    dx, 2000h
                jz      short loc_158AF
                add     dword ptr a80386ProcessorO+10h, edi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage

loc_158AF:                              ;  +0: _app_off_datapages
                cmp     cx, word ptr a80386ProcessorO+0Ch ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jnz     short locret_158C2
                mov     _sel32_ss, ax
                mov     dword ptr a80386ProcessorO+1Ch, edi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                add     dword ptr a80386ProcessorO+14h, edi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage

locret_158C2:
                retn
create_selector endp


; =============== S U B R O U T I N E =======================================


preload_fixups  proc near

; FUNCTION CHUNK AT 2B1B SIZE 00000080 BYTES

                cmp     byte ptr aSystemSoftwareD+3, 2 ; +3: _app_type
                                        ; +4: _app_load
                jz      preload_lc_fixups
                mov     ebx, dword ptr a80386ProcessorO+20h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     byte ptr aSystemSoftwareD+4, 0 ; +3: _app_type
                                        ; +4: _app_load
                mov     ax, 0FF95h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                jnb     short loc_158ED
                mov     byte ptr aSystemSoftwareD+4, 1 ; +3: _app_type
                                        ; +4: _app_load
                mov     al, 91h ; '‘'
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                mov     ax, 4004h
                jb      file_error

loc_158ED:                              ;  +0: _app_off_datapages
                mov     dword ptr a80386ProcessorO+24h, esi ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     _err_code, 3002h
                mov     edx, dword ptr aThisProgramRequ+20h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                call    seek_from_start
                mov     edx, ebx
                mov     ecx, dword ptr a80386ProcessorO+20h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                call    load_gs_block
                mov     eax, dword ptr aThisProgramRequ+24h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     ebx, dword ptr aThisProgramRequ+20h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                sub     eax, ebx
                add     eax, edx
                mov     dword ptr aThisProgramRequ+20h, edx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dword ptr aThisProgramRequ+24h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
preload_fixups  endp


; =============== S U B R O U T I N E =======================================


unload_fixups   proc near

; FUNCTION CHUNK AT 0465 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 2B9B SIZE 0000000B BYTES

                cmp     byte ptr aSystemSoftwareD+3, 2 ; +3: _app_type
                                        ; +4: _app_load
                jz      unload_lc_fixups
                mov     esi, dword ptr a80386ProcessorO+24h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     ax, 0FF96h
                cmp     byte ptr aSystemSoftwareD+4, 0 ; +3: _app_type
                                        ; +4: _app_load
                jz      short loc_1593E
                mov     al, 92h ; '’'

loc_1593E:                              ; DOS - DOS v??? - OEM FUNCTION
                int     21h
                retn
unload_fixups   endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR load_header

load_lc_header:
                mov     cl, 0Ch
                call    load_fs_block
                xor     eax, eax
                mov     al, fs:4
                mov     dword ptr aThisProgramRequ+14h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     al, fs:6
                mov     dword ptr a80386ProcessorO+8, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     al, fs:7
                mov     dword ptr a80386ProcessorO+0Ch, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:8
                mov     dword ptr a80386ProcessorO+10h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     eax, fs:0Ch
                mov     dword ptr a80386ProcessorO+14h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     al, fs:5
                and     al, 0Fh
                cmp     al, 4
                mov     ax, 3006h
                jnz     file_error
                mov     ax, 4007h
                cmp     _lobufsize, 2000h
                jb      file_error
                retn
; END OF FUNCTION CHUNK FOR load_header
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR load_object

load_lc_object:
                mov     ecx, 10h
                xor     edx, edx
                mov     _err_code, 3002h
                call    load_fs_block
                mov     eax, fs:0
                btr     eax, 1Fh
                setb    byte ptr a80386ProcessorO+2Ch ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                push    eax
                call    alloc_block
                mov     ecx, eax
                mov     edx, edi
                call    fill_zero_pages
                mov     _err_code, 3002h
                mov     ebx, fs:4
                mov     ecx, ebx
                jecxz   loc_15A01
                cmp     byte ptr a80386ProcessorO+2Ch, 0 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jnz     short loc_159FE
                mov     ax, 0FF91h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                mov     ax, 4003h
                jb      file_error
                mov     dword ptr a80386ProcessorO+24h, esi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     edx, ebx
                call    decompress_data
                mov     ax, 0FF92h
                mov     esi, dword ptr a80386ProcessorO+24h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                jmp     short loc_15A01
; ---------------------------------------------------------------------------

loc_159FE:
                call    load_gs_block

loc_15A01:
                pop     ebp
                movzx   ebx, word ptr fs:0Eh
                movzx   edx, word ptr fs:8
                movzx   esi, word ptr fs:0Ch
                pop     ecx
                retn
; END OF FUNCTION CHUNK FOR load_object
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR preload_fixups

preload_lc_fixups:
                mov     ecx, 0Ch
                xor     edx, edx
                mov     _err_code, 3002h
                call    load_fs_block
                mov     ax, 0FF91h
                mov     ebx, fs:0
                btr     ebx, 1Fh
                setb    byte ptr a80386ProcessorO+2Ch ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     ecx, ebx
                inc     ebx
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                mov     ax, 4003h
                jb      file_error
                mov     edx, ebx
                mov     edi, ebx
                mov     dword ptr a80386ProcessorO+24h, esi ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                call    fill_zero_pages
                mov     ebx, fs:4
                mov     ecx, ebx
                cmp     byte ptr a80386ProcessorO+2Ch, 0 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                jnz     short loc_15A87
                mov     ax, 0FF91h
                inc     ebx
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                mov     ax, 4003h
                jb      file_error
                mov     edx, ebx
                call    decompress_data
                mov     ax, 0FF92h
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                jmp     short loc_15A8A
; ---------------------------------------------------------------------------

loc_15A87:
                call    load_gs_block

loc_15A8A:                              ; +4: _exec_handle
                mov     dword ptr aThisProgramRequ+20h, edi ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                add     edi, fs:8
                mov     dword ptr aThisProgramRequ+24h, edi ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
; END OF FUNCTION CHUNK FOR preload_fixups
; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR unload_fixups

unload_lc_fixups:
                mov     ax, 0FF92h
                mov     esi, dword ptr a80386ProcessorO+24h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                int     21h             ; DOS - DOS v??? - OEM FUNCTION
                retn
; END OF FUNCTION CHUNK FOR unload_fixups

; =============== S U B R O U T I N E =======================================


decompress_data proc near
                call    load_gs_block

decompress:
                pushad
                mov     byte ptr aSystemSoftwareD+4, 0 ; +3: _app_type
                                        ; +4: _app_load
                mov     dword ptr aThisProgramRequ+0Ch, ebx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dword ptr aThisProgramRequ+10h, ecx ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                push    edi
                mov     ecx, _lobufsize
                mov     esi, _lobufbase
                mov     edi, _lobufzero
                call    fill_zero_pages
                pop     edi
                xor     bx, bx
                mov     edx, 0FEEh

loc_15AD8:
                shr     bx, 1
                and     dx, 0FFFh
                test    bh, 1
                jz      short loc_15B02

loc_15AE3:
                test    bl, 1
                jz      short loc_15B0E
                call    getbyte
                js      short loc_15AFA
                mov     [esi+edx], al
                mov     gs:[edi], al
                inc     dx
                inc     edi
                jmp     short loc_15AD8
; ---------------------------------------------------------------------------

loc_15AFA:                              ; +4: _exec_handle
                mov     dword ptr aThisProgramRequ+10h, edi ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                popad
                retn
; ---------------------------------------------------------------------------

loc_15B02:
                call    getbyte
                js      short loc_15AFA
                or      ah, 0FFh
                mov     bx, ax
                jmp     short loc_15AE3
; ---------------------------------------------------------------------------

loc_15B0E:
                call    getbyte
                js      short loc_15AFA
                mov     cl, al
                call    getbyte
                js      short loc_15AFA
                mov     ch, al
                shr     ch, 4
                and     ax, 0Fh
                add     al, 2
                mov     bp, ax
                test    ax, ax
                jl      short loc_15AD8

loc_15B2A:
                and     cx, 0FFFh
                and     dx, 0FFFh
                mov     al, [esi+ecx]
                mov     [esi+edx], al
                mov     gs:[edi], al
                inc     cx
                inc     dx
                inc     edi
                dec     bp
                jns     short loc_15B2A
                jmp     short loc_15AD8
decompress_data endp


; =============== S U B R O U T I N E =======================================


getbyte         proc near
                mov     eax, dword ptr aThisProgramRequ+0Ch ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     al, gs:[eax]
                xor     al, byte ptr aSystemSoftwareD+4 ; +3: _app_type
                                        ; +4: _app_load
                inc     dword ptr aThisProgramRequ+0Ch ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     byte ptr aSystemSoftwareD+4, al ; +3: _app_type
                                        ; +4: _app_load
                dec     dword ptr aThisProgramRequ+10h ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                retn
getbyte         endp

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR start

load_pe_app:                            ; +3: _app_type
                mov     byte ptr aSystemSoftwareD+3, 3 ; +4: _app_load
                mov     ax, 3004h
                jmp     file_error
; END OF FUNCTION CHUNK FOR start
                assume ss:seg003, ds:nothing

; =============== S U B R O U T I N E =======================================


                public start
start           proc near

var_12          = byte ptr -12h

; FUNCTION CHUNK AT 2C61 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 2E0A SIZE 0000005D BYTES

                push    cs
                pop     ds
                assume ds:TEXT16
                mov     _seg_ds, ds
                mov     _seg_es, es
                mov     _seg_ss, ss
                mov     ax, es:2Ch
                mov     _seg_env, ax
                sti
                cld
                call    get_default_config
                call    get_environ_config ; also _app_buf_allocsel
                call    copyright
                mov     ax, ss
                mov     si, es:2
                add     ax, 0C0h ; 'À'
                mov     _seg_buf, ax
                add     ax, _lowmembuf
                mov     _membase, ax
                sub     si, ax
                jnb     short loc_15BB6

@err1:
                neg     si
                mov     cl, 6
                shr     si, cl

loc_15BAA:
                mov     ax, 1001h

loc_15BAD:
                jmp     report_error
; ---------------------------------------------------------------------------

@err2:
                mov     ax, 1002h
                jmp     report_error
; ---------------------------------------------------------------------------

loc_15BB6:
                sub     ax, _seg_es
                mov     bx, ax
                mov     ah, 4Ah
                int     21h             ; DOS - 2+ - ADJUST MEMORY BLOCK SIZE (SETBLOCK)
                                        ; ES = segment address of block to change
                                        ; BX = new size in paragraphs
                jb      short @err2
                call    pm32_info       ; also mem_ptr
                pushf                   ; DOS32AWE ADDITION BEGIN: reject VCPI/DPMI
                cmp     ch, 1
                jle     short loc_15BD4
                mov     ax, 8
                popf
                jmp     report_error
; ---------------------------------------------------------------------------

loc_15BD4:                              ; DOS32AWE ADDITION END
                popf
                jnb     short loc_15BDA
                jmp     report_error
; ---------------------------------------------------------------------------

loc_15BDA:
                mov     _buf_size, bx
                mov     word ptr _cpu_type, cx
                call    remove_kernel
                mov     ax, _membase
                mov     si, es:2
                add     ax, bx
                sub     si, ax
                jb      short @err1
                add     bx, _membase
                sub     bx, _seg_es
                mov     ah, 4Ah
                int     21h             ; DOS - 2+ - ADJUST MEMORY BLOCK SIZE (SETBLOCK)
                                        ; ES = segment address of block to change
                                        ; BX = new size in paragraphs
                jb      short @err2
                movzx   eax, _seg_buf
                mov     edx, eax
                sub     ax, _seg_ds
                shl     edx, 4
                shl     eax, 4
                mov     _lobufbase, eax
                mov     _lobufzero, edx
                movzx   eax, _seg_ds
                shl     eax, 4
                mov     dword_15FB6, eax
                movzx   eax, _lowmembuf
                shl     eax, 4
                mov     _lobufsize, eax
                mov     es, _membase
                mov     bx, _version
                mov     dx, offset critical_handler
                call    pm32_init_new
                jb      report_error
                cli
                mov     _sel_cs, cs
                mov     _sel_ds, ds
                mov     _sel_es, es
                mov     _sel_ss, ss
                mov     _sel_esp, esp
                mov     ax, es:2Ch
                mov     _sel_env, ax
                mov     _process_id, si
                push    di
                push    ecx
                call    init_system
                call    save_inttab
                call    verbose_showsys
                pop     ecx
                pop     di
                sti
                call    check_system
                mov     fs, _sel_ss
                mov     gs, _sel_zero
                call    open_exec
                call    load_exec_header
                call    check_command_line
                cmp     dx, 40h ; '@'
                jnz     short loc_15CA2
                mov     edx, dword ptr aThisProgramRequ+8 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                test    dx, dx
                jnz     short load_bound_app

loc_15CA2:
                test    si, si
                jnz     short load_extrn_app
                call    close_exec
                mov     ax, 8001h
                jmp     report_error
; ---------------------------------------------------------------------------

load_extrn_app:
                call    close_exec
                call    open_extrn_exec
                call    load_extrn_exec_header
                call    update_environment
                call    remove_name_from_cmd
                mov     edx, dword ptr aThisProgramRequ+8 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab

load_bound_app:
                mov     _err_code, 3002h
                call    seek_from_start
                mov     ecx, 4
                xor     edx, edx
                call    load_fs_block
                mov     ax, fs:0
                mov     bx, fs:2
                test    bx, bx
                jnz     short loc_15D01
                cmp     ax, 'EL'
                jz      load_le_app
                cmp     ax, 'XL'
                jz      load_lx_app
                cmp     ax, 'CL'
                jz      load_lc_app
                cmp     ax, 'EP'
                jz      load_pe_app

loc_15D01:
                call    close_exec
                mov     ax, 3004h
                jmp     file_error
start           endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START OF FUNCTION CHUNK FOR start

enter_32bit_code:
                test    cs:_misc_byte_2, 10h
                jz      short loc_15D1F
                sti
                mov     al, '>'
                call    printc
                xor     ax, ax
                int     16h             ; KEYBOARD - READ CHAR FROM BUFFER, WAIT IF EMPTY
                                        ; Return: AH = scan code, AL = character
                call    printcr

loc_15D1F:
                cli
                cld
                call    install_nullptr_protect
                mov     ss, _sel32_ss
                assume ss:nothing
                mov     esp, dword ptr a80386ProcessorO+14h ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     es, _sel_es
                mov     fs, _sel_zero
                mov     ds, _sel32_ss
                xor     eax, eax
                xor     ebx, ebx
                xor     ecx, ecx
                xor     edx, edx
                xor     esi, esi
                xor     edi, edi
                xor     ebp, ebp
                mov     gs, ax
                assume gs:nothing
                pushfd
                push    large [dword ptr cs:_sel32_cs]
                push    large [dword ptr cs:a80386ProcessorO+10h] ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                or      byte ptr [esp+9], 2
                sti
                iretd
; END OF FUNCTION CHUNK FOR start

; =============== S U B R O U T I N E =======================================


init_system     proc near
                xor     eax, eax
                mov     dword ptr a80386ProcessorO+14h, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                mov     dword ptr aThisProgramRequ+14h, eax ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
                mov     dword ptr a80386ProcessorO, eax ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
                call    setup_selector
                call    setup_dta_buffer
                call    initialize_mouse
                mov     ax, 204h
                mov     bl, 10h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     _int10_._cs, cx
                mov     _int10_._ip, edx
                mov     bl, 21h ; '!'
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     _int21_._cs, cx
                mov     _int21_._ip, edx
                mov     bl, 23h ; '#'
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     _int23_._cs, cx
                mov     _int23_._ip, edx
                mov     bl, 33h ; '3'
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET PROTECTED MODE INTERRUPT VECTOR
                                        ; BL = interrupt number
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     _int33_._cs, cx
                mov     _int33_._ip, edx
                mov     ax, 202h
                xor     ebx, ebx

loc_15DBC:                              ; DPMI Services   ax=func xxxxh
                int     31h             ; GET PROCESSOR EXCEPTION HANDLER VECTOR
                                        ; BL = exception number (00h-1Fh)
                                        ; Return: CF set on error
                                        ; CF clear if successful, CX:DX / CX:EDX = selector:offset of handler
                mov     _exc_tab._cs[ebx*8], cx
                mov     _exc_tab._ip[ebx*8], edx
                inc     bl
                cmp     bl, 0Fh
                jb      short loc_15DBC
                call    install_client_ints
                jb      dpmi_error
                call    win_focus_vm
                cmp     _sys_type, 3
                jz      short locret_15DF1
                cmp     _process_id, 0
                jnz     short locret_15DF1
                call    restore_pit

locret_15DF1:
                retn
init_system     endp


; =============== S U B R O U T I N E =======================================


check_system    proc near
                test    di, di
                jz      short loc_15E02
                cmp     di, _version
                jz      short loc_15E02
                mov     ax, 9006h
                call    report_error

loc_15E02:
                cmp     _sys_type, 3
                jz      short loc_15E14
                test    ecx, ecx
                jnz     short loc_15E14
                mov     ax, 9001h
                call    report_error

loc_15E14:
                mov     ax, 400h
                int     31h             ; DPMI Services   ax=func xxxxh
                                        ; GET DPMI VERSION
                                        ; Return: CF clear, AH = major version, AL = minor version
                                        ; BX = flags, CL = processor type
                                        ; DH = curr value of virtual master interrupt controller base
                                        ; DL = curr value of virtual slave interrupt controller base
                cmp     dh, 8
                jnz     short loc_15E23
                cmp     dl, 70h ; 'p'
                jz      short locret_15E2F

loc_15E23:
                movzx   si, dh
                movzx   di, dl
                mov     ax, 9002h
                call    report_error

locret_15E2F:
                retn
check_system    endp


; =============== S U B R O U T I N E =======================================


remove_kernel   proc near
                cmp     _sys_type, 3
                jnz     short locret_15E6C
                cli
                pop     bp
                push    es
                mov     es, _seg_kernel
                mov     si, 0
                mov     cx, 1EE0h
                rep movsw
                pop     es
                mov     ax, dx
                shr     ax, 4
                mov     dx, ss
                sub     dx, ax
                mov     ss, dx
                mov     dx, ds
                sub     dx, ax
                mov     ds, dx
                sub     _seg_ds, ax
                sub     _seg_ss, ax
                sub     _seg_buf, ax
                sub     _membase, ax
                push    dx
                push    bp
                sti
                retf
; ---------------------------------------------------------------------------

locret_15E6C:
                retn
remove_kernel   endp ; sp-analysis failed

; ---------------------------------------------------------------------------
                align 2
dfn_tab         dfn_struc <offset aQuiet, 5, offset cfg_env_quiet> ; "QUIET"
                dfn_struc <offset aPrint, 5, offset cfg_env_print>
                dfn_struc <offset aSound, 5, offset cfg_env_sound>
                dfn_struc <offset aExtmem, 6, offset cfg_env_extmem>
                dfn_struc <offset aDosbuf, 6, offset cfg_env_dosbuf>
                dfn_struc <offset aDpmitst, 7, offset cfg_env_test>
                dfn_struc <offset aRestore, 7, offset cfg_env_restore>
                dfn_struc <offset aNullp, 5, offset cfg_env_nullp>
                dfn_struc <offset aVerbose, 7, offset cfg_env_verbose>
                dfn_struc <offset aNowarn, 6, offset cfg_env_nowarn>
                dfn_struc <offset aNo, 3, offset cfg_env_noc>
                dw 0FFFFh
g_errtab        errtabentry <0, 0, offset errtab_00xx>
                errtabentry <10h, 0, offset errtab_10xx>
                errtabentry <20h, 0, offset errtab_20xx>
                errtabentry <30h, 0, offset errtab_30xx>
                errtabentry <40h, 0, offset errtab_40xx>
                errtabentry <60h, 2, offset errtab_60xx>
                errtabentry <80h, 0, offset errtab_80xx>
                errtabentry <90h, 1, offset errtab_90xx>
                dw 0FFFFh
h_errtab        dw offset aDos32aweFatalW ; "DOS32AWE fatal (%w): "
                dw offset aDos32aweWarnin
                dw offset aDos32aweRunTim
errtab_00xx     dw offset aThisProgramRequ ; +4: _exec_handle
                dw offset a80386ProcessorO ; +8: _exec_start
                dw offset aSystemSoftwareD ; +C: _srcaddr
                dw offset aPresentDpmiHost ; +10: _codesize
                dw offset aIncompatibleVcp ; +14: _app_num_objects
                dw offset aCouldNotEnter32 ; +18: _app_off_objects
                dw offset aCouldNotAllocat ; +1C: _app_off_pagetab
                dw offset aCouldNotEnableA ; +20: _app_off_fixpagetab
                dw offset aPleaseRunDos32a ; +24: _app_off_fixrectab
errtab_10xx     dw offset _emptystring  ; "not enough DOS memory, additional %dKB "...
                dw offset aNotEnoughDosMem
                dw offset aDosReportedInsu
errtab_20xx     dw offset aInvalidEnvironm ; "invalid environment"
                dw offset aCouldNotOpenExe
                dw offset aErrorInExecFile
errtab_30xx     dw offset _emptystring  ; "could not open application file \"%s\""
                dw offset aCouldNotOpenApp
                dw offset aErrorInApplicat
                dw offset aFileSDoesNotCon
                dw offset aExecFormatNotSu
                dw offset aErrorInApplicat
                dw offset aExecFormatNotSu
errtab_40xx     dw offset _emptystring  ; "too many objects in application exec \"%"...
                dw offset aTooManyObjectsI
                dw offset aNotEnoughDosM_0
                dw offset aNotEnoughExtend
                dw offset aNotEnoughExte_0
                dw offset aUnrecognizedFix
                dw offset a16bitFixupOverf
                dw offset aNotEnoughDosTra
errtab_60xx     dw offset aUnknownErrorCod ; "unknown error code (#%bh)"
                dw offset _emptystring
                dw offset aOutOfRealModeVi
                dw offset aOutOfProtectedM
                dw offset aExtendedMemoryB
                dw offset aDos4gApiCallsNo
errtab_80xx     dw offset _emptystring  ; "syntax is DOS32AWE <execname.xxx>"
                dw offset aSyntaxIsDos32aw
                dw offset aDosReportedAnEr
                dw offset aDpmiHostReporte
errtab_90xx     dw offset _emptystring  ; "no extended memory has been allocated"
                dw offset aNoExtendedMemor
                dw offset aPicsHaveBeenRel
                dw offset aRealModeInterru
                dw offset aMouseInitializa
                dw offset aObjectDContains
                dw offset aIncompatibleVer
i_msg           dw offset aIntegerDivision ; "integer division by zero"
                dw offset aHardwareBreakpo
                dw offset aNmi
                dw offset aSoftwareBreakpo
                dw offset aOverflowCheckFa
                dw offset aBoundsCheckFaul
                dw offset aInvalidOpcodeFa
                dw offset aCoprocessorNotA
                dw offset aDoubleFault
                dw offset aCoprocessorSegm
                dw offset aInvalidTssFault
                dw offset aSegmentNotPrese
                dw offset aStackFault
                dw offset aGeneralProtecti
                dw offset aPageFault
                dw offset _emptystring
_misc_byte_1    db 3
_misc_byte_2    db 7
_version        dw 0
_cpu_type       db 0
_sys_type       db 0
_sys_misc       dw 0
_buf_size       dw 0
_pic_mask       dw 0
_err_code       dw 0
_acc_rights     dw 0
_mus_size       dd 0
_mus_backofs    dw 0
_mus_backseg    dw 0
_mus_           vec8 <0>
_mus_data       db 0
                db    0
_seg_ds         dw 0
_seg_es         dw 0
_seg_ss         dw 0
_seg_env        dw 0
_seg_buf        dw 0
_seg_dta        dw 0
_seg_mus        dw 0
_seg_id32       dw 0
_seg_kernel     dw 0
_sel_cs         dw 0
_sel_ds         dw 0
_sel_es         dw 0
_sel_esp        dd 0
_sel_ss         dw 0
_sel_zero       dw 0
_sel_env        dw 0
_process_id     dw 0
_sel32_cs       dw 0
                db    0
                db    0
_sel32_ss       dw 0
                db 2 dup(0)
_membase        dw 0
_lowmembuf      dw 0
_lobufzero      dd 0
_lobufbase      dd 0
_lobufsize      dd 0
dword_15FB6     dd 0
_dta_sel        dw 0
_dta_ofs        dd 0
_app_dta_sel    dw 0
_app_dta_ofs    dd 0
_int10_         vec8 <0>
_int21_         vec8 <0>
_int23_         vec8 <0>
_int33_         vec8 <0>
_exc_tab        vec8 10h dup(<0>)
_emptystring    db 0
cpr_msg         db 'DOS32AWE -- DOS Extender version x.x.x',0Dh,0Ah
                db 'Copyright (C) 1996-2006 by Narech K.',0Dh,0Ah
                db 0Dh,0Ah
                db 'AWEUTIL support V1.9 by George L',0Dh,0Ah
                db 0Dh,0Ah
aDos32aweFatalW db 'DOS32AWE fatal (%w): ',0
aDos32aweWarnin db 'DOS32AWE warning (%w): ',0
aDos32aweRunTim db 'DOS32AWE run-time (%w): ',0
aDos32aweQuietpr db 'DOS32AWE='
aQuiet          db 'QUIET'
aPrint          db 'PRINT'
aSound          db 'SOUND'
aExtmem         db 'EXTMEM'
aDosbuf         db 'DOSBUF'
aDpmitst        db 'DPMITST'
aRestore        db 'RESTORE'
aNullp          db 'NULLP'
aVerbose        db 'VERBOSE'
aNowarn         db 'NOWARN'
aNo             db 'NOC'
                align 4
aThisProgramRequ db 'this program requires DOS 4.0 or higher',0 ; +4: _exec_handle
                                        ; +8: _exec_start
                                        ; +C: _srcaddr
                                        ; +10: _codesize
                                        ; +14: _app_num_objects
                                        ; +18: _app_off_objects
                                        ; +1C: _app_off_pagetab
                                        ; +20: _app_off_fixpagetab
                                        ; +24: _app_off_fixrectab
a80386ProcessorO db '80386 processor or better required to run protected mode',0 ;  +0: _app_off_datapages
                                        ;  +4: _app_off_pageshift
                                        ;  +8: _app_eip_object
                                        ;  +C: _app_esp_object
                                        ; +10: _app_eip
                                        ; +14: _app_esp
                                        ; +18: _unreloc_eip
                                        ; +20: _app_siz_fixrectab
                                        ; +24: _app_buf_fixrscstab
                                        ; +28: _app_size_lastpage
aSystemSoftwareD db 'system software does not follow VCPI/DPMI specifications',0 ; +3: _app_type
                                        ; +4: _app_load
aPresentDpmiHost db 'present DPMI host does not support 32bit applications',0
aIncompatibleVcp db 'incompatible VCPI PIC mappings',0
aCouldNotEnter32 db 'could not enter 32bit protected mode',0
aCouldNotAllocat db 'could not allocate system selectors',0
aCouldNotEnableA db 'could not enable A20 line',0
aPleaseRunDos32a db 'Please run DOS32AWE under Real Mode DOS only (remove EMM)',0
aNotEnoughDosMem db 'not enough DOS memory, additional %dKB needed',0
aDosReportedInsu db 'DOS reported insufficient memory',0
aInvalidEnvironm db 'invalid environment',0
aCouldNotOpenExe db 'could not open exec file "%s"',0
aErrorInExecFile db 'error in exec file "%s"',0
aCouldNotOpenApp db 'could not open application file "%s"',0
aErrorInApplicat db 'error in application file "%s"',0
aFileSDoesNotCon db 'file "%s" does not contain any valid exec format',0
aExecFormatNotSu db 'exec format not supported in file "%s"',0
aTooManyObjectsI db 'too many objects in application exec "%s"',0
aNotEnoughDosM_0 db 'not enough DOS memory to load application exec "%s"',0
aNotEnoughExtend db 'not enough extended memory to load application exec "%s"',0
aNotEnoughExte_0 db 'not enough extended memory to load fixups for exec "%s"',0
aUnrecognizedFix db 'unrecognized fixup data in application exec "%s"',0
a16bitFixupOverf db '16bit fixup overflow in application exec "%s"',0
aNotEnoughDosTra db 'not enough DOS Transfer Buffer space to load LC-exec "%s"',0
aSyntaxIsDos32aw db 'syntax is DOS32AWE <execname.xxx>',0
aDosReportedAnEr db 'DOS reported an error (#%wh)',0
aDpmiHostReporte db 'DPMI host reported an error (#%wh)',0
aNoExtendedMemor db 'no extended memory has been allocated',0
aPicsHaveBeenRel db 'PICs have been relocated to INT %bh, INT %bh',0
aRealModeInterru db 'real mode interrupt vector has been modified: INT %bh',0
aMouseInitializa db 'mouse initialization failed',0
aObjectDContains db 'object #%d contains no data or code',0
aIncompatibleVer db 'incompatible version of DOS/32A already running',0
aUnknownErrorCod db 'unknown error code (#%bh)',0
aOutOfRealModeVi db 'out of real-mode virtual stacks',0
aOutOfProtectedM db 'out of protected-mode virtual stacks',0
aExtendedMemoryB db 'extended memory blocks have been corrupted (#%l)',0
aDos4gApiCallsNo db 'DOS/4G API calls not supported',0
aProcessorDSyste db 'Processor: %d, System: %s, Memory: DOS=%dKB, DPMI=%d%s',0Dh,0Ah,0
systypes        str4 <'NONE'>
                str4 <'XMS'>
                str4 <'VCPI'>
                str4 <'DPMI'>
header_types    str2 <'LE'>
                str2 <'LX'>
                str2 <'LC'>
                str2 <'PE'>
aKb             db 'KB',0
aMb             db 'MB',0
aLoadingProgramS db 'Loading program "%s", %s-style',0Dh,0Ah,0
aObjectDLoadedAt db 'Object #%d loaded at %l, V/Psize: %l/%l, Flags=%w, Sel=%w',0Dh,0Ah,0
aStartupCsEipWLS db 'Startup CS:EIP=%w:%l, SS:ESP=%w:%l, %s EIP=%d:%l',0Dh,0Ah
                db 'Memory left: DOS=%dKB, DPMI=%d%s. PSP_Sel=%w, Env_Sel=%w, Env_Seg'
                db '=%w',0Dh,0Ah,0
aException      db 'exception',0
aUnexpectedInter db 'unexpected interrupt',0
aSBhIdentitySAtW db '%s %bh',0Dh,0Ah
                db 'Identity: %s at %w:%l',0Dh,0Ah,0
aSCrashAddressDL db '%s crash address %d:%l',0
aErrorCodePushed db ', error code pushed on stack %l',0
aLinear         db 'Linear',0
aUnrelocated    db 'Unrelocated',0
aModuleNameSProc db 'Module name: "%s", ProcessId=%w',0Dh,0Ah,0
aNullPointerProt db 'Null-pointer protection at %w:%l',0Dh,0Ah,0
aEflagsLL_L     db 'EFLAGS = %l [%l.%l]  ',0
aCsEipBBBBBBBBBB db 'CS:[EIP] = %b %b %b %b %b %b %b %b %b %b',0
aEaxLEsiLDr6LSsE db 'EAX = %l    ESI = %l       DR6 = %l    SS:[ESP+00] = %l',0Dh,0Ah,0
aEbxLEdiLCr0LSsE db 'EBX = %l    EDI = %l       CR0 = %l    SS:[ESP+04] = %l',0Dh,0Ah,0
aEcxLEbpLCr2LSsE db 'ECX = %l    EBP = %l       CR2 = %l    SS:[ESP+08] = %l',0Dh,0Ah,0
aEdxLEspLCr3LSsE db 'EDX = %l    ESP = %l       CR3 = %l    SS:[ESP+0C] = %l',0Dh,0Ah,0
aInvalidSelector db 'Invalid selector',0
aNullSelector   db 'NULL selector',0
aCsW            db 'CS: = %w  ',0
aDsW            db 'DS: = %w  ',0
aEsW            db 'ES: = %w  ',0
aSsW            db 'SS: = %w  ',0
aFsW            db 'FS: = %w  ',0
aGsW            db 'GS: = %w  ',0
aBaseLLimitLGrSS db 'Base=%l Limit=%l Gr=%s Seg=%s/%dbit Type=%d Acc=%w',0Dh,0Ah,0
selmsg9         str4 <'BYTE'>
                str4 <'PAGE'>
selmsg8         str4 <'DATA'>
                str4 <'CODE'>
aKernel         db 'KERNEL=',0
aClient         db 'CLIENT=',0
aApp32          db 'APP/32=',0
aApp??          db 'APP/??=',0
aIntegerDivision db 'integer division by zero',0
aHardwareBreakpo db 'hardware breakpoint',0
aNmi            db 'NMI',0
aSoftwareBreakpo db 'software breakpoint',0
aOverflowCheckFa db 'overflow check fault',0
aBoundsCheckFaul db 'bounds check fault',0
aInvalidOpcodeFa db 'invalid opcode fault',0
aCoprocessorNotA db 'coprocessor not available',0
aDoubleFault    db 'double fault',0
aCoprocessorSegm db 'coprocessor segment overrun',0
aInvalidTssFault db 'invalid TSS fault',0
aSegmentNotPrese db 'segment not present fault',0
aStackFault     db 'stack fault',0
aGeneralProtecti db 'general protection fault',0
aPageFault      db 'page fault',0
                align 10h
TEXT16          ends

; ===========================================================================

; Segment type: Uninitialized
seg003          segment byte stack 'STACK' use16
                assume cs:seg003
                assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
byte_16CC0      db 800h dup(?)
seg003          ends


                end start