API tools faq
paste
Guest User

Untitled

a guest
Jan 11th, 2020
289
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.13 KB | None | 0 0
raw download clone embed print report
  1. //
  2. // Seg_0
  3. // ram: 1000:0000-2000:1011
  4. //
  5. assume CS = 0x1000
  6. assume DF = 0x0 (Default)
  7. 1000:0000 00 ?? 00h
  8. 1000:0001 00 ?? 00h
  9. 1000:0002 00 ?? 00h
  10. 1000:0003 00 ?? 00h
  11. 1000:0004 00 ?? 00h
  12. 1000:0005 00 ?? 00h
  13. 1000:0006 00 ?? 00h
  14. 1000:0007 00 ?? 00h
  15. 1000:0008 00 ?? 00h
  16. 1000:0009 00 ?? 00h
  17. 1000:000a 00 ?? 00h
  18. 1000:000b 00 ?? 00h
  19. 1000:000c 00 ?? 00h
  20. 1000:000d 00 ?? 00h
  21. 1000:000e 00 ?? 00h
  22. 1000:000f 00 ?? 00h
  23. 1000:0010 00 ?? 00h
  24. 1000:0011 00 ?? 00h
  25. 1000:0012 00 ?? 00h
  26. 1000:0013 00 ?? 00h
  27. 1000:0014 00 ?? 00h
  28. 1000:0015 00 ?? 00h
  29. 1000:0016 00 ?? 00h
  30. 1000:0017 00 ?? 00h
  31. 1000:0018 00 ?? 00h
  32. 1000:0019 00 ?? 00h
  33. 1000:001a 00 ?? 00h
  34. 1000:001b 00 ?? 00h
  35. 1000:001c 00 ?? 00h
  36. 1000:001d 00 ?? 00h
  37. 1000:001e 00 ?? 00h
  38. 1000:001f 00 ?? 00h
  39. 1000:0020 00 ?? 00h
  40. 1000:0021 00 ?? 00h
  41. 1000:0022 00 ?? 00h
  42. 1000:0023 00 ?? 00h
  43. 1000:0024 00 ?? 00h
  44. 1000:0025 00 ?? 00h
  45. 1000:0026 00 ?? 00h
  46. 1000:0027 00 ?? 00h
  47. 1000:0028 00 ?? 00h
  48. 1000:0029 00 ?? 00h
  49. 1000:002a 00 ?? 00h
  50. 1000:002b 00 ?? 00h
  51. 1000:002c 00 ?? 00h
  52. 1000:002d 00 ?? 00h
  53. 1000:002e 00 ?? 00h
  54. 1000:002f 00 ?? 00h
  55. 1000:0030 00 ?? 00h
  56. 1000:0031 00 ?? 00h
  57. 1000:0032 00 ?? 00h
  58. 1000:0033 00 ?? 00h
  59. 1000:0034 00 ?? 00h
  60. 1000:0035 00 ?? 00h
  61. 1000:0036 00 ?? 00h
  62. 1000:0037 00 ?? 00h
  63. 1000:0038 00 ?? 00h
  64. 1000:0039 00 ?? 00h
  65. 1000:003a 00 ?? 00h
  66. 1000:003b 00 ?? 00h
  67. 1000:003c 00 ?? 00h
  68. 1000:003d 00 ?? 00h
  69. 1000:003e 00 ?? 00h
  70. 1000:003f 00 ?? 00h
  71. 1000:0040 b8 ?? B8h
  72. 1000:0041 22 ?? 22h "
  73. 1000:0042 05 ?? 05h
  74. 1000:0043 2e ?? 2Eh .
  75. 1000:0044 a3 ?? A3h
  76. 1000:0045 0a ?? 0Ah
  77. 1000:0046 03 ?? 03h
  78. 1000:0047 bc ?? BCh
  79. 1000:0048 e4 ?? E4h
  80. 1000:0049 07 ?? 07h
  81. 1000:004a e9 ?? E9h
  82. 1000:004b ab ?? ABh
  83. 1000:004c 02 ?? 02h
  84. 1000:004d 0c ?? 0Ch
  85. 1000:004e 00 ?? 00h
  86. 1000:004f 0e ?? 0Eh
  87. 1000:0050 00 ?? 00h
  88. 1000:0051 00 ?? 00h
  89. 1000:0052 00 ?? 00h
  90. 1000:0053 00 ?? 00h
  91. 1000:0054 00 ?? 00h
  92. 1000:0055 00 ?? 00h
  93. 1000:0056 00 ?? 00h
  94. 1000:0057 00 ?? 00h
  95. 1000:0058 00 ?? 00h
  96. 1000:0059 00 ?? 00h
  97. 1000:005a 00 ?? 00h
  98. 1000:005b 00 ?? 00h
  99. 1000:005c 00 ?? 00h
  100. 1000:005d 00 ?? 00h
  101. 1000:005e 00 ?? 00h
  102. 1000:005f 00 ?? 00h
  103. 1000:0060 00 ?? 00h
  104. 1000:0061 00 ?? 00h
  105. 1000:0062 00 ?? 00h
  106. 1000:0063 00 ?? 00h
  107. 1000:0064 00 ?? 00h
  108. 1000:0065 00 ?? 00h
  109. 1000:0066 00 ?? 00h
  110. 1000:0067 00 ?? 00h
  111. 1000:0068 00 ?? 00h
  112. 1000:0069 00 ?? 00h
  113. 1000:006a 00 ?? 00h
  114. 1000:006b 00 ?? 00h
  115. 1000:006c 00 ?? 00h
  116. 1000:006d 00 ?? 00h
  117. 1000:006e 00 ?? 00h
  118. 1000:006f 00 ?? 00h
  119. 1000:0070 00 ?? 00h
  120. 1000:0071 00 ?? 00h
  121. 1000:0072 00 ?? 00h
  122. 1000:0073 00 ?? 00h
  123. 1000:0074 00 ?? 00h
  124. 1000:0075 00 ?? 00h
  125. 1000:0076 00 ?? 00h
  126. 1000:0077 00 ?? 00h
  127. 1000:0078 00 ?? 00h
  128. 1000:0079 00 ?? 00h
  129. 1000:007a 00 ?? 00h
  130. 1000:007b 00 ?? 00h
  131. 1000:007c 00 ?? 00h
  132. 1000:007d 00 ?? 00h
  133. 1000:007e 00 ?? 00h
  134. 1000:007f 00 ?? 00h
  135. 1000:0080 00 ?? 00h
  136. 1000:0081 00 ?? 00h
  137. 1000:0082 00 ?? 00h
  138. 1000:0083 00 ?? 00h
  139. 1000:0084 00 ?? 00h
  140. 1000:0085 00 ?? 00h
  141. 1000:0086 00 ?? 00h
  142. 1000:0087 00 ?? 00h
  143. 1000:0088 00 ?? 00h
  144. 1000:0089 00 ?? 00h
  145. 1000:008a 00 ?? 00h
  146. 1000:008b 00 ?? 00h
  147. 1000:008c 00 ?? 00h
  148. 1000:008d 00 ?? 00h
  149. 1000:008e 00 ?? 00h
  150. 1000:008f 00 ?? 00h
  151. 1000:0090 00 ?? 00h
  152. 1000:0091 00 ?? 00h
  153. 1000:0092 00 ?? 00h
  154. 1000:0093 00 ?? 00h
  155. 1000:0094 00 ?? 00h
  156. 1000:0095 00 ?? 00h
  157. 1000:0096 00 ?? 00h
  158. 1000:0097 00 ?? 00h
  159. 1000:0098 00 ?? 00h
  160. 1000:0099 00 ?? 00h
  161. 1000:009a 00 ?? 00h
  162. 1000:009b 00 ?? 00h
  163. 1000:009c 00 ?? 00h
  164. 1000:009d 00 ?? 00h
  165. 1000:009e 00 ?? 00h
  166. 1000:009f 00 ?? 00h
  167. 1000:00a0 56 45 52 ds "VERSION 3.22"
  168. 53 49 4f
  169. 4e 20 33
  170. 1000:00b0 72 ?? 72h r
  171. 1000:00b1 5c ?? 5Ch \
  172. 1000:00b2 73 ?? 73h s
  173. 1000:00b3 66 ?? 66h f
  174. 1000:00b4 f6 ?? F6h
  175. 1000:00b5 e3 ?? E3h
  176. 1000:00b6 f6 ?? F6h
  177. 1000:00b7 e3 ?? E3h
  178. 1000:00b8 f6 ?? F6h
  179. 1000:00b9 e3 ?? E3h
  180. 1000:00ba f6 ?? F6h
  181. 1000:00bb e3 ?? E3h
  182. 1000:00bc f6 ?? F6h
  183. 1000:00bd e3 ?? E3h
  184. 1000:00be f6 ?? F6h
  185. 1000:00bf e3 ?? E3h
  186. 1000:00c0 f6 ?? F6h
  187. 1000:00c1 e3 ?? E3h
  188. 1000:00c2 f6 ?? F6h
  189. 1000:00c3 e3 ?? E3h
  190. 1000:00c4 f6 ?? F6h
  191. 1000:00c5 e3 ?? E3h
  192. 1000:00c6 f6 ?? F6h
  193. 1000:00c7 e3 ?? E3h
  194. 1000:00c8 f6 ?? F6h
  195. 1000:00c9 e3 ?? E3h
  196. 1000:00ca f6 ?? F6h
  197. 1000:00cb e3 ?? E3h
  198. 1000:00cc f6 ?? F6h
  199. 1000:00cd e3 ?? E3h
  200. 1000:00ce f6 ?? F6h
  201. 1000:00cf e3 ?? E3h
  202. 1000:00d0 f6 ?? F6h
  203. 1000:00d1 e3 ?? E3h
  204. 1000:00d2 f6 ?? F6h
  205. 1000:00d3 e3 ?? E3h
  206. 1000:00d4 8b ?? 8Bh
  207. 1000:00d5 e5 ?? E5h
  208. 1000:00d6 fc ?? FCh
  209. 1000:00d7 b8 ?? B8h
  210. 1000:00d8 22 ?? 22h "
  211. 1000:00d9 05 ?? 05h
  212. 1000:00da 2e ?? 2Eh .
  213. 1000:00db a3 ?? A3h
  214. 1000:00dc 0a ?? 0Ah
  215. 1000:00dd 03 ?? 03h
  216. 1000:00de eb ?? EBh
  217. 1000:00df 0d ?? 0Dh
  218. 1000:00e0 90 ?? 90h
  219. 1000:00e1 b1 ?? B1h
  220. 1000:00e2 08 ?? 08h
  221. 1000:00e3 be ?? BEh
  222. 1000:00e4 00 ?? 00h
  223. 1000:00e5 00 ?? 00h
  224. 1000:00e6 bf ?? BFh
  225. 1000:00e7 00 ?? 00h
  226. 1000:00e8 00 ?? 00h
  227. 1000:00e9 f3 ?? F3h
  228. 1000:00ea a5 ?? A5h
  229. 1000:00eb 1e ?? 1Eh
  230. 1000:00ec 06 ?? 06h
  231. 1000:00ed 2a ?? 2Ah *
  232. 1000:00ee ed ?? EDh
  233. 1000:00ef ff ?? FFh
  234. 1000:00f0 4e ?? 4Eh N
  235. 1000:00f1 00 ?? 00h
  236. 1000:00f2 ff ?? FFh
  237. 1000:00f3 4e ?? 4Eh N
  238. 1000:00f4 02 ?? 02h
  239. 1000:00f5 07 ?? 07h
  240. 1000:00f6 1f ?? 1Fh
  241. 1000:00f7 4a ?? 4Ah J
  242. 1000:00f8 2e ?? 2Eh .
  243. 1000:00f9 a1 ?? A1h
  244. 1000:00fa 08 ?? 08h
  245. 1000:00fb 04 ?? 04h
  246. 1000:00fc 2e ?? 2Eh .
  247. 1000:00fd a3 ?? A3h
  248. 1000:00fe 0c ?? 0Ch
  249. 1000:00ff 03 ?? 03h
  250. 1000:0100 eb ?? EBh
  251. 1000:0101 01 ?? 01h
  252. 1000:0102 90 ?? 90h
  253. 1000:0103 b8 ?? B8h
  254. 1000:0104 00 ?? 00h
  255. 1000:0105 00 ?? 00h
  256. 1000:0106 a3 ?? A3h
  257. 1000:0107 09 ?? 09h
  258. 1000:0108 03 ?? 03h
  259. 1000:0109 ea ?? EAh
  260. 1000:010a 00 ?? 00h
  261. 1000:010b 00 ?? 00h
  262. 1000:010c 00 ?? 00h
  263. 1000:010d 00 ?? 00h
  264. 1000:010e 0e ?? 0Eh
  265. 1000:010f 58 ?? 58h X
  266. 1000:0110 2d ?? 2Dh -
  267. 1000:0111 35 ?? 35h 5
  268. 1000:0112 00 ?? 00h
  269. 1000:0113 50 ?? 50h P
  270. 1000:0114 b8 ?? B8h
  271. 1000:0115 67 ?? 67h g
  272. 1000:0116 00 ?? 00h
  273. 1000:0117 50 ?? 50h P
  274. 1000:0118 9c ?? 9Ch
  275. 1000:0119 cf ?? CFh
  276. 1000:011a f9 ?? F9h
  277. 1000:011b 52 ?? 52h R
  278. 1000:011c bc ?? BCh
  279. 1000:011d 32 ?? 32h 2
  280. 1000:011e 03 ?? 03h
  281. 1000:011f b9 ?? B9h
  282. 1000:0120 e9 ?? E9h
  283. 1000:0121 5f ?? 5Fh _
  284. 1000:0122 b8 ?? B8h
  285. 1000:0123 00 ?? 00h
  286. 1000:0124 00 ?? 00h
  287. 1000:0125 2b ?? 2Bh +
  288. 1000:0126 d2 ?? D2h
  289. 1000:0127 33 ?? 33h 3
  290. 1000:0128 db ?? DBh
  291. 1000:0129 f7 ?? F7h
  292. 1000:012a e1 ?? E1h
  293. 1000:012b eb ?? EBh
  294. 1000:012c 24 ?? 24h $
  295. 1000:012d 90 ?? 90h
  296. 1000:012e 53 ?? 53h S
  297. 1000:012f 1e ?? 1Eh
  298. 1000:0130 73 ?? 73h s
  299. 1000:0131 1f ?? 1Fh
  300. 1000:0132 cf ?? CFh
  301. 1000:0133 e9 ?? E9h
  302. 1000:0134 4f ?? 4Fh O
  303. 1000:0135 98 ?? 98h
  304. 1000:0136 e9 ?? E9h
  305. 1000:0137 6f ?? 6Fh o
  306. 1000:0138 f4 ?? F4h
  307. 1000:0139 e9 ?? E9h
  308. 1000:013a 02 ?? 02h
  309. 1000:013b 5a ?? 5Ah Z
  310. 1000:013c e9 ?? E9h
  311. 1000:013d 93 ?? 93h
  312. 1000:013e 7c ?? 7Ch |
  313. 1000:013f e9 ?? E9h
  314. 1000:0140 19 ?? 19h
  315. 1000:0141 cb ?? CBh
  316. 1000:0142 e9 ?? E9h
  317. 1000:0143 ee ?? EEh
  318. 1000:0144 b0 ?? B0h
  319. 1000:0145 e9 ?? E9h
  320. 1000:0146 51 ?? 51h Q
  321. 1000:0147 4a ?? 4Ah J
  322. 1000:0148 e9 ?? E9h
  323. 1000:0149 2b ?? 2Bh +
  324. 1000:014a 10 ?? 10h
  325. 1000:014b e9 ?? E9h
  326. 1000:014c 33 ?? 33h 3
  327. 1000:014d dd ?? DDh
  328. 1000:014e e9 ?? E9h
  329. 1000:014f 8a ?? 8Ah
  330. 1000:0150 13 ?? 13h
  331. 1000:0151 73 ?? 73h s
  332. 1000:0152 3e ?? 3Eh >
  333. 1000:0153 e9 ?? E9h
  334. 1000:0154 e9 ?? E9h
  335. 1000:0155 e9 ?? E9h
  336. 1000:0156 e9 ?? E9h
  337. 1000:0157 e9 ?? E9h
  338. 1000:0158 e9 ?? E9h
  339. 1000:0159 e9 ?? E9h
  340. 1000:015a e9 ?? E9h
  341. 1000:015b e9 ?? E9h
  342. 1000:015c e9 ?? E9h
  343. 1000:015d e9 ?? E9h
  344. 1000:015e e9 ?? E9h
  345. 1000:015f e9 ?? E9h
  346. 1000:0160 e9 ?? E9h
  347. 1000:0161 e9 ?? E9h
  348. 1000:0162 e9 ?? E9h
  349. 1000:0163 e9 ?? E9h
  350. 1000:0164 e9 ?? E9h
  351. 1000:0165 e9 ?? E9h
  352. 1000:0166 e9 ?? E9h
  353. 1000:0167 e9 ?? E9h
  354. 1000:0168 e9 ?? E9h
  355. 1000:0169 e9 ?? E9h
  356. 1000:016a e9 ?? E9h
  357. 1000:016b e9 ?? E9h
  358. 1000:016c e9 ?? E9h
  359. 1000:016d e9 ?? E9h
  360. 1000:016e e9 ?? E9h
  361. 1000:016f e9 ?? E9h
  362. 1000:0170 e9 ?? E9h
  363. 1000:0171 76 ?? 76h v
  364. 1000:0172 73 ?? 73h s
  365. 1000:0173 76 ?? 76h v
  366. 1000:0174 73 ?? 73h s
  367. 1000:0175 76 ?? 76h v
  368. 1000:0176 73 ?? 73h s
  369. 1000:0177 76 ?? 76h v
  370. 1000:0178 73 ?? 73h s
  371. 1000:0179 76 ?? 76h v
  372. 1000:017a 73 ?? 73h s
  373. 1000:017b 76 ?? 76h v
  374. 1000:017c 73 ?? 73h s
  375. 1000:017d 76 ?? 76h v
  376. 1000:017e 73 ?? 73h s
  377. 1000:017f 76 ?? 76h v
  378. 1000:0180 73 ?? 73h s
  379. 1000:0181 76 ?? 76h v
  380. 1000:0182 73 ?? 73h s
  381. 1000:0183 76 ?? 76h v
  382. 1000:0184 73 ?? 73h s
  383. 1000:0185 76 ?? 76h v
  384. 1000:0186 73 ?? 73h s
  385. 1000:0187 76 ?? 76h v
  386. 1000:0188 73 ?? 73h s
  387. 1000:0189 76 ?? 76h v
  388. 1000:018a 73 ?? 73h s
  389. 1000:018b 76 ?? 76h v
  390. 1000:018c 73 ?? 73h s
  391. 1000:018d 76 ?? 76h v
  392. 1000:018e 73 ?? 73h s
  393. 1000:018f 76 ?? 76h v
  394. 1000:0190 73 ?? 73h s
  395. 1000:0191 e9 ?? E9h
  396. 1000:0192 ac ?? ACh
  397. 1000:0193 fc ?? FCh
  398. 1000:0194 7e ?? 7Eh ~
  399. 1000:0195 75 ?? 75h u
  400. 1000:0196 7e ?? 7Eh ~
  401. 1000:0197 75 ?? 75h u
  402. 1000:0198 7e ?? 7Eh ~
  403. 1000:0199 75 ?? 75h u
  404. 1000:019a 7e ?? 7Eh ~
  405. 1000:019b 75 ?? 75h u
  406. 1000:019c 7e ?? 7Eh ~
  407. 1000:019d 75 ?? 75h u
  408. 1000:019e 7e ?? 7Eh ~
  409. 1000:019f 75 ?? 75h u
  410. 1000:01a0 7e ?? 7Eh ~
  411. 1000:01a1 75 ?? 75h u
  412. 1000:01a2 7e ?? 7Eh ~
  413. 1000:01a3 75 ?? 75h u
  414. 1000:01a4 7e ?? 7Eh ~
  415. 1000:01a5 75 ?? 75h u
  416. 1000:01a6 7e ?? 7Eh ~
  417. 1000:01a7 75 ?? 75h u
  418. 1000:01a8 7e ?? 7Eh ~
  419. 1000:01a9 75 ?? 75h u
  420. 1000:01aa 7e ?? 7Eh ~
  421. 1000:01ab 75 ?? 75h u
  422. 1000:01ac 7e ?? 7Eh ~
  423. 1000:01ad 75 ?? 75h u
  424. 1000:01ae 7e ?? 7Eh ~
  425. 1000:01af 75 ?? 75h u
  426. 1000:01b0 7e ?? 7Eh ~
  427. 1000:01b1 75 ?? 75h u
  428. 1000:01b2 7e ?? 7Eh ~
  429. 1000:01b3 75 ?? 75h u
  430. 1000:01b4 7e ?? 7Eh ~
  431. 1000:01b5 75 ?? 75h u
  432. 1000:01b6 7e ?? 7Eh ~
  433. 1000:01b7 75 ?? 75h u
  434. 1000:01b8 7e ?? 7Eh ~
  435. 1000:01b9 75 ?? 75h u
  436. 1000:01ba 7e ?? 7Eh ~
  437. 1000:01bb 75 ?? 75h u
  438. 1000:01bc 7e ?? 7Eh ~
  439. 1000:01bd 75 ?? 75h u
  440. 1000:01be 7e ?? 7Eh ~
  441. 1000:01bf 75 ?? 75h u
  442. 1000:01c0 7e ?? 7Eh ~
  443. 1000:01c1 75 ?? 75h u
  444. 1000:01c2 7e ?? 7Eh ~
  445. 1000:01c3 75 ?? 75h u
  446. 1000:01c4 7e ?? 7Eh ~
  447. 1000:01c5 75 ?? 75h u
  448. 1000:01c6 7e ?? 7Eh ~
  449. 1000:01c7 75 ?? 75h u
  450. 1000:01c8 7e ?? 7Eh ~
  451. 1000:01c9 75 ?? 75h u
  452. 1000:01ca 7e ?? 7Eh ~
  453. 1000:01cb 75 ?? 75h u
  454. 1000:01cc 7e ?? 7Eh ~
  455. 1000:01cd 75 ?? 75h u
  456. 1000:01ce 7e ?? 7Eh ~
  457. 1000:01cf 75 ?? 75h u
  458. 1000:01d0 7e ?? 7Eh ~
  459. 1000:01d1 75 ?? 75h u
  460. 1000:01d2 7e ?? 7Eh ~
  461. 1000:01d3 75 ?? 75h u
  462. 1000:01d4 00 ?? 00h
  463. 1000:01d5 00 ?? 00h
  464. 1000:01d6 00 ?? 00h
  465. 1000:01d7 00 ?? 00h
  466. 1000:01d8 0d ?? 0Dh
  467. 1000:01d9 00 ?? 00h
  468. 1000:01da 00 ?? 00h
  469. 1000:01db 00 ?? 00h
  470. 1000:01dc 00 ?? 00h
  471. 1000:01dd 00 ?? 00h
  472. 1000:01de 00 ?? 00h
  473. 1000:01df 00 ?? 00h
  474. 1000:01e0 00 ?? 00h
  475. 1000:01e1 00 ?? 00h
  476. 1000:01e2 00 ?? 00h
  477. 1000:01e3 00 ?? 00h
  478. 1000:01e4 00 ?? 00h
  479. 1000:01e5 00 ?? 00h
  480. 1000:01e6 00 ?? 00h
  481. 1000:01e7 00 ?? 00h
  482. 1000:01e8 00 ?? 00h
  483. 1000:01e9 00 ?? 00h
  484. 1000:01ea 00 ?? 00h
  485. 1000:01eb 00 ?? 00h
  486. 1000:01ec 00 ?? 00h
  487. 1000:01ed 00 ?? 00h
  488. 1000:01ee 00 ?? 00h
  489. 1000:01ef 00 ?? 00h
  490. 1000:01f0 00 ?? 00h
  491. 1000:01f1 00 ?? 00h
  492. 1000:01f2 00 ?? 00h
  493. 1000:01f3 00 ?? 00h
  494. 1000:01f4 00 ?? 00h
  495. 1000:01f5 00 ?? 00h
  496. 1000:01f6 00 ?? 00h
  497. 1000:01f7 00 ?? 00h
  498. 1000:01f8 00 ?? 00h
  499. 1000:01f9 00 ?? 00h
  500. 1000:01fa 00 ?? 00h
  501. 1000:01fb 00 ?? 00h
  502. 1000:01fc 00 ?? 00h
  503. 1000:01fd 00 ?? 00h
  504. 1000:01fe 00 ?? 00h
  505. 1000:01ff 00 ?? 00h
  506. 1000:0200 12 ?? 12h
  507. 1000:0201 10 ?? 10h
  508. 1000:0202 01 ?? 01h
  509. 1000:0203 00 ?? 00h
  510. DAT_1000_0204 XREF[1]: FUN_1000_0364:1000:037c(R)
  511. 1000:0204 00 00 undefined2 0000h
  512. 1000:0206 00 ?? 00h
  513. 1000:0207 00 ?? 00h
  514. 1000:0208 00 ?? 00h
  515. 1000:0209 00 ?? 00h
  516. 1000:020a 00 ?? 00h
  517. 1000:020b 00 ?? 00h
  518. 1000:020c 00 ?? 00h
  519. 1000:020d 00 ?? 00h
  520. 1000:020e 00 ?? 00h
  521. 1000:020f 00 ?? 00h
  522. DAT_1000_0210 XREF[2]: 1000:029e(R),
  523. FUN_1000_0364:1000:0370(W)
  524. 1000:0210 00 00 undefined2 0000h
  525. assume SS = 0x0
  526. assume SP = 0x800
  527. entry XREF[1]: Entry Point(*)
  528. 1000:0212 eb 06 JMP LAB_1000_021a
  529. assume SS = <UNKNOWN>
  530. assume SP = <UNKNOWN>
  531. 1000:0214 00 ?? 00h
  532. 1000:0215 00 ?? 00h
  533. 1000:0216 00 ?? 00h
  534. 1000:0217 00 ?? 00h
  535. 1000:0218 00 ?? 00h
  536. 1000:0219 00 ?? 00h
  537. LAB_1000_021a XREF[1]: 1000:0212(j)
  538. 1000:021a 00 ?? 00h
  539. DAT_1000_021b XREF[1]: FUN_1000_0364:1000:0367(R)
  540. 1000:021b 00 ?? 00h
  541. 1000:021c 00 ?? 00h
  542. 1000:021d 00 ?? 00h
  543. 1000:021e 00 ?? 00h
  544. **************************************************************
  545. * FUNCTION *
  546. **************************************************************
  547. undefined __cdecl16near FUN_1000_021f()
  548. assume CS = 0x1000
  549. undefined AL:1 <RETURN>
  550. FUN_1000_021f XREF[1]: 1000:02ad(c)
  551. 1000:021f 58 POP AX
  552. 1000:0220 bf 00 00 MOV DI,0x0
  553. 1000:0223 f3 a5 MOVSW.REP ES:DI,SI
  554. 1000:0225 50 PUSH AX
  555. 1000:0226 c3 RET
  556. 1000:0227 8c ?? 8Ch
  557. 1000:0228 0e ?? 0Eh
  558. 1000:0229 1f ?? 1Fh
  559. 1000:022a 04 ?? 04h
  560. LAB_1000_022b XREF[1]: 1000:0306(j)
  561. 1000:022b 0e PUSH CS
  562. 1000:022c 2b c0 SUB AX,AX AX=0
  563. 1000:022e 8e d8 MOV DS,AX DS=0
  564. 1000:0230 bf 84 00 MOV DI,0x84
  565. 1000:0233 90 NOP
  566. 1000:0234 f6 45 03 02 TEST byte ptr [DI + 0x3]=>DAT_0000_00
  567. 1000:0238 07 POP ES ES=CS
  568. 1000:0239 26 a1 08 02 MOV AX,ES:[0x208] Segment pointing to buffer after first 0x800 bytes of EXE
  569. 1000:023d 8e d8 MOV DS,AX Set it as DS segment
  570. 1000:023f 26 8a 2e MOV CH,byte ptr ES:[0x1d4] old_reloc1_offset[0] (0x27)
  571. d4 01
  572. 1000:0244 8b ec MOV BP,SP
  573. 1000:0246 26 8a 36 MOV DH,byte ptr ES:[0x1d5] old_reloc1_offset[1] (0x00)
  574. d5 01
  575. 1000:024b b1 02 MOV CL,0x2
  576. 1000:024d e8 b9 00 CALL call_decrypt_1 undefined call_decrypt_1()
  577. 1000:0250 bb 00 00 MOV BX,0x0
  578. 1000:0253 8b 46 04 MOV AX,word ptr [BP + 0x4]
  579. 1000:0256 b9 03 00 MOV CX,0x3 Read 3 sectors
  580. This will overwrite DS:0 to DS:5ff, which
  581. overlaps part of the previously decrypted
  582. section by decrypt_1 (0x51c-0x5ff)
  583. 1000:0259 cd 25 INT 0x25 Read into offset 0 of segment pointing to buffer after first 0x800 bytes of EXE
  584. 1000:025b 8c da MOV DX,DS
  585. 1000:025d 83 c2 10 ADD DX,0x10
  586. 1000:0260 bb ec 06 MOV BX,0x6ec
  587. 1000:0263 e8 be 00 CALL save_config undefined4 save_config(undefined2 param_1, undefined2 param_2, undefined2 para
  588. 1000:0266 1f POP DS Popping from the overridden code segment (value popped is 0x7212)
  589. 1000:0267 fa CLI
  590. 1000:0268 51 PUSH CX
  591. 1000:0269 0e PUSH CS
  592. 1000:026a 1f POP DS DS=CS
  593. 1000:026b bb dc 07 MOV BX,0x7dc
  594. 1000:026e a1 08 02 MOV AX,[0x208] Segment pointing to buffer after first 0x800 bytes of EXE
  595. 1000:0271 89 47 02 MOV word ptr [BX + 0x2],AX
  596. 1000:0274 b8 1c 05 MOV AX,0x51c
  597. 1000:0277 89 07 MOV word ptr [BX],AX
  598. 1000:0279 b1 fe MOV CL,0xfe
  599. 1000:027b 8b ec MOV BP,SP
  600. 1000:027d 83 ed 04 SUB BP,0x4
  601. 1000:0280 b9 04 00 MOV CX,0x4
  602. 1000:0283 8b 16 00 02 MOV DX,word ptr [0x200]
  603. 1000:0287 83 e2 f0 AND DX,0xfff0
  604. 1000:028a 0b 16 02 02 OR DX,word ptr [0x202]
  605. 1000:028e d3 ca ROR DX,CL
  606. 1000:0290 42 INC DX
  607. 1000:0291 a1 04 02 MOV AX,[0x204]
  608. 1000:0294 03 c2 ADD AX,DX
  609. 1000:0296 05 0f 00 ADD AX,0xf
  610. 1000:0299 8e d8 MOV DS,AX
  611. 1000:029b e8 c6 00 CALL FUN_1000_0364 undefined FUN_1000_0364()
  612. 1000:029e 2e 2b 06 SUB AX,word ptr CS:[DAT_1000_0210]
  613. 10 02
  614. 1000:02a3 8e c0 MOV ES,AX
  615. 1000:02a5 90 NOP
  616. 1000:02a6 90 NOP
  617. 1000:02a7 fc CLD
  618. LAB_1000_02a8 XREF[1]: 1000:02bd(j)
  619. 1000:02a8 b1 08 MOV CL,0x8
  620. 1000:02aa be 00 00 MOV SI,0x0
  621. 1000:02ad e8 6f ff CALL FUN_1000_021f This function eventually overrides the next command and execution continues fr
  622. 1000:02b0 1e PUSH DS
  623. 1000:02b1 06 PUSH ES
  624. 1000:02b2 2a ed SUB CH,CH
  625. 1000:02b4 ff 4e 00 DEC word ptr [BP + 0x0]
  626. 1000:02b7 ff 4e 02 DEC word ptr [BP + 0x2]
  627. 1000:02ba 07 POP ES
  628. 1000:02bb 1f POP DS
  629. 1000:02bc 4a DEC DX
  630. 1000:02bd 75 e9 JNZ LAB_1000_02a8
  631. 1000:02bf f9 STC
  632. 1000:02c0 83 ec 08 SUB SP,0x8
  633. 1000:02c3 cb RET
  634. 1000:02c4 ff ?? FFh
  635. 1000:02c5 27 ?? 27h '
  636. 1000:02c6 ff ?? FFh
  637. 1000:02c7 96 ?? 96h
  638. 1000:02c8 0f ?? 0Fh
  639. 1000:02c9 02 ?? 02h
  640. 1000:02ca 72 ?? 72h r
  641. 1000:02cb dc ?? DCh
  642. 1000:02cc 54 ?? 54h T
  643. 1000:02cd 48 ?? 48h H
  644. 1000:02ce 49 ?? 49h I
  645. 1000:02cf 53 ?? 53h S
  646. 1000:02d0 20 ?? 20h
  647. 1000:02d1 49 ?? 49h I
  648. 1000:02d2 53 ?? 53h S
  649. 1000:02d3 20 ?? 20h
  650. 1000:02d4 54 ?? 54h T
  651. 1000:02d5 48 ?? 48h H
  652. 1000:02d6 45 ?? 45h E
  653. 1000:02d7 20 ?? 20h
  654. 1000:02d8 54 ?? 54h T
  655. 1000:02d9 49 ?? 49h I
  656. 1000:02da 4d ?? 4Dh M
  657. 1000:02db 42 ?? 42h B
  658. 1000:02dc 41 ?? 41h A
  659. 1000:02dd 4b ?? 4Bh K
  660. 1000:02de 55 ?? 55h U
  661. 1000:02df 4b ?? 4Bh K
  662. 1000:02e0 20 ?? 20h
  663. 1000:02e1 4f ?? 4Fh O
  664. 1000:02e2 46 ?? 46h F
  665. 1000:02e3 20 ?? 20h
  666. 1000:02e4 4d ?? 4Dh M
  667. 1000:02e5 41 ?? 41h A
  668. 1000:02e6 4c ?? 4Ch L
  669. 1000:02e7 49 ?? 49h I
  670. 1000:02e8 4e ?? 4Eh N
  671. 1000:02e9 45 ?? 45h E
  672. 1000:02ea 5a ?? 5Ah Z
  673. 1000:02eb 42 ?? 42h B
  674. 1000:02ec 59 ?? 59h Y
  675. 1000:02ed 20 ?? 20h
  676. 1000:02ee 42 ?? 42h B
  677. 1000:02ef 59 ?? 59h Y
  678. 1000:02f0 20 ?? 20h
  679. 1000:02f1 42 ?? 42h B
  680. 1000:02f2 41 ?? 41h A
  681. 1000:02f3 4d ?? 4Dh M
  682. 1000:02f4 42 ?? 42h B
  683. 1000:02f5 49 ?? 49h I
  684. 1000:02f6 4e ?? 4Eh N
  685. 1000:02f7 4f ?? 4Fh O
  686. 1000:02f8 20 ?? 20h
  687. 1000:02f9 20 ?? 20h
  688. 1000:02fa fa ?? FAh
  689. 1000:02fb 90 ?? 90h
  690. 1000:02fc fc ?? FCh
  691. 1000:02fd f9 STC
  692. 1000:02fe 90 NOP
  693. ExecutionStartsFromHere
  694. 1000:02ff f5 CMC
  695. 1000:0300 9f LAHF
  696. 1000:0301 90 NOP
  697. 1000:0302 8b 26 0a 02 MOV SP,word ptr [0x20a] Restore stack pointer from some previous stage
  698. 1000:0306 e9 22 ff JMP LAB_1000_022b
  699. **************************************************************
  700. * FUNCTION *
  701. **************************************************************
  702. undefined __cdecl16near call_decrypt_1()
  703. assume CS = 0x1000
  704. undefined AL:1 <RETURN>
  705. call_decrypt_1 XREF[1]: 1000:024d(c)
  706. 1000:0309 50 PUSH AX
  707. 1000:030a 1e PUSH DS
  708. 1000:030b 06 PUSH ES
  709. 1000:030c 51 PUSH CX
  710. 1000:030d e8 85 00 CALL decrypt_1 undefined decrypt_1(void)
  711. 1000:0310 59 POP CX
  712. 1000:0311 07 POP ES
  713. 1000:0312 1f POP DS
  714. 1000:0313 d0 e5 SHL CH,1
  715. 1000:0315 0a ee OR CH,DH
  716. 1000:0317 b0 09 MOV AL,0x9
  717. 1000:0319 f6 e5 MUL CH
  718. 1000:031b b5 00 MOV CH,0x0
  719. 1000:031d 03 c1 ADD AX,CX
  720. 1000:031f 48 DEC AX
  721. 1000:0320 8b d0 MOV DX,AX
  722. 1000:0322 58 POP AX
  723. 1000:0323 c3 RET
  724. **************************************************************
  725. * FUNCTION *
  726. **************************************************************
  727. undefined4 __cdecl16near save_config(undefined2 param_
  728. assume CS = 0x1000
  729. undefined4 DX:2,AX:2 <RETURN>
  730. undefined2 Stack[0x2]:2 param_1
  731. undefined2 Stack[0x4]:2 param_2
  732. undefined2 Stack[0x6]:2 param_3
  733. undefined2 Stack[0x8]:2 param_4
  734. undefined2 Stack[0xa]:2 param_5
  735. save_config XREF[1]: 1000:0263(c)
  736. 1000:0324 50 PUSH AX
  737. 1000:0325 53 PUSH BX
  738. 1000:0326 51 PUSH CX
  739. 1000:0327 52 PUSH DX
  740. 1000:0328 bb 65 00 MOV BX,0x65
  741. 1000:032b bd 00 07 MOV BP,0x700 SS is CS
  742. 1000:032e 8b 46 04 MOV AX,word ptr [BP + 0x4] Offset of original IVT IR#1 written there
  743. DS is segment pointing to buffer
  744. after first 0x800 bytes of EXE
  745. 1000:0331 89 07 MOV word ptr [BX],AX
  746. 1000:0333 8b 46 06 MOV AX,word ptr [BP + 0x6] Segment of original IVT IR#1 written there
  747. 1000:0336 89 47 02 MOV word ptr [BX + 0x2],AX
  748. 1000:0339 8b 46 0c MOV AX,word ptr [BP + 0xc] Offset of original IVT IR#3 written there
  749. 1000:033c 89 47 04 MOV word ptr [BX + 0x4],AX
  750. 1000:033f 8b 46 0e MOV AX,word ptr [BP + 0xe] Segment of original IVT IR#3 written there
  751. 1000:0342 89 47 06 MOV word ptr [BX + 0x6],AX
  752. 1000:0345 cd 11 INT 0x11 BIOS Equipment Determination
  753. 1000:0347 89 47 08 MOV word ptr [BX + 0x8],AX
  754. 1000:034a cd 12 INT 0x12 Memory Size Determination
  755. 1000:034c 89 47 0a MOV word ptr [BX + 0xa],AX
  756. 1000:034f b9 ef 32 MOV CX,0x32ef
  757. 1000:0352 ba 80 00 MOV DX,0x80 drive 0
  758. 1000:0355 b4 08 MOV AH,0x8
  759. 1000:0357 cd 13 INT 0x13 Get Current Drive Parameters
  760. 1000:0359 89 4f 0c MOV word ptr [BX + 0xc],CX CH = cylinders, CL = sectors per track
  761. 1000:035c 89 57 0e MOV word ptr [BX + 0xe],DX DH = number of sides (0 based), DL = number of drives attached
  762. 1000:035f 5a POP DX
  763. 1000:0360 59 POP CX
  764. 1000:0361 5b POP BX
  765. 1000:0362 58 POP AX
  766. 1000:0363 c3 RET
  767. **************************************************************
  768. * FUNCTION *
  769. **************************************************************
  770. undefined __cdecl16near FUN_1000_0364()
  771. assume CS = 0x1000
  772. undefined AL:1 <RETURN>
  773. FUN_1000_0364 XREF[1]: 1000:029b(c)
  774. 1000:0364 05 20 00 ADD AX,0x20
  775. 1000:0367 2e f7 06 TEST word ptr CS:[DAT_1000_021b],0x40
  776. 1b 02 40 00
  777. 1000:036e 74 24 JZ LAB_1000_0394
  778. 1000:0370 2e c7 06 MOV word ptr CS:[DAT_1000_0210],0x20
  779. 10 02 20 00
  780. 1000:0377 83 ec 20 SUB SP,0x20
  781. 1000:037a 06 PUSH ES
  782. 1000:037b 50 PUSH AX
  783. 1000:037c 2e 8e 06 MOV ES,word ptr CS:[DAT_1000_0204]
  784. 04 02
  785. 1000:0381 b4 49 MOV AH,0x49
  786. 1000:0383 cd 21 INT 0x21
  787. 1000:0385 58 POP AX
  788. 1000:0386 07 POP ES
  789. 1000:0387 fa CLI
  790. 1000:0388 83 c4 20 ADD SP,0x20
  791. 1000:038b 55 PUSH BP
  792. 1000:038c 8b ec MOV BP,SP
  793. 1000:038e c7 46 0c MOV word ptr [BP + 0xc],0x20
  794. 20 00
  795. 1000:0393 5d POP BP
  796. LAB_1000_0394 XREF[1]: 1000:036e(j)
  797. 1000:0394 c3 RET
  798. **************************************************************
  799. * FUNCTION *
  800. **************************************************************
  801. undefined __cdecl16near decrypt_1(void)
  802. assume CS = 0x1000
  803. undefined AL:1 <RETURN>
  804. decrypt_1 XREF[1]: call_decrypt_1:1000:030d(c)
  805. 1000:0395 1e PUSH DS
  806. 1000:0396 07 POP ES Segment pointing to buffer after first 0x800 bytes of EXE
  807. 1000:0397 0e PUSH CS
  808. 1000:0398 1f POP DS DS=CS
  809. 1000:0399 be 00 08 MOV SI,0x800
  810. 1000:039c bf 1c 05 MOV DI,0x51c
  811. 1000:039f b9 00 03 MOV CX,0x300
  812. 1000:03a2 fc CLD
  813. This loop decrypts 0x300 words by taking
  814. the word at (cs:0x800 + i), performing
  815. two RORs and storing it at (es:0x51c + i)
  816. LAB_1000_03a3 XREF[1]: 1000:03a9(j)
  817. 1000:03a3 ad LODSW SI
  818. 1000:03a4 d1 c8 ROR AX,1
  819. 1000:03a6 d1 c8 ROR AX,1
  820. 1000:03a8 ab STOSW ES:DI
  821. 1000:03a9 e2 f8 LOOP LAB_1000_03a3
  822. 1000:03ab c3 RET
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!