.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:04:21.815359303Z | 44 | PC: 1444f | Get time 0x1444f: cmp dl, 0x11 0x14452: jne 0x14477 0x14454: mov ax, 0x4301 0x14457: xor cx, cx 0x14459: lea dx, word ptr [bp + 0x2ad] 0x1445d: int 0x21 0x1445f: mov ah, 0x3c 0x14461: int 0x21 0x14463: xchg ax, bx 0x14464: mov ah, 0x40 0x14466: mov cx, 0x50 0x14469: lea dx, word ptr [bp + 0x2bd] 0x1446d: int 0x21 0x1446f: mov ah, 0x3e 0x14471: lea dx, word ptr [bp + 0x2ad] 0x14475: int 0x21 0x14477: mov ah, 0x2c 0x14479: int 0x21 0x1447b: cmp dl, 1 0x1447e: ja 0x144a6 |
| 2018-12-17T23:04:21.817777112Z | 44 | PC: 1447b | Get time 0x1447b: cmp dl, 1 0x1447e: ja 0x144a6 0x14480: mov ax, 3 0x14483: int 0x10 0x14485: mov ah, 2 0x14487: xor bh, bh 0x14489: mov dx, 0xa14 0x1448c: int 0x10 0x1448e: dec ah 0x14490: mov cx, 0x2020 0x14493: int 0x10 0x14495: lea si, word ptr [bp + 0x280] 0x14499: loop 0x14499 0x1449b: lodsb al, byte ptr [si] 0x1449c: or al, al 0x1449e: je 0x144a6 0x144a0: mov ah, 0xe 0x144a2: int 0x10 0x144a4: jmp 0x14499 0x144a6: cld |
| 2018-12-17T23:04:21.821041656Z | 26 | PC: 144af | Set disk transfer address |
| 2018-12-17T23:04:21.822310768Z | 78 | PC: 144d6 | Find first file |
| 2018-12-17T23:04:21.830155916Z | 61 | PC: 144e4 | Open file (Filename = 'TEST.EXE') |
| 2018-12-17T23:04:21.838209902Z | 63 | PC: 144f0 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-17T23:04:21.841431185Z | 62 | PC: 14589 | Close file |
| 2018-12-17T23:04:21.84333667Z | 67 | PC: 14597 | Get or set file attributes |
| 2018-12-17T23:04:21.869804433Z | 79 | PC: 144d6 | Find next file |
| 2018-12-17T23:04:21.872829751Z | 53 | PC: 13198 | Get interrupt vector (Interrupt = '46' AKA 'Set verify flag') |
| 2018-12-17T23:04:21.874539525Z | 48 | PC: 131e1 | Get DOS version |
| 2018-12-17T23:04:21.877016069Z | 9 | PC: 138b6 | Display string (String= ' Microsoft (R) SIZER Version 1.0 Copyright (C) Microsoft Corp 1992. All rights reserved. SIZER.EXE is used by MemMaker during the memory-optimization process and is not intended to be started from the command prompt. ') |
| 2018-12-17T23:04:21.891613514Z | 77 | PC: 13893 | Get program return code |
| 2018-12-17T23:04:21.893160415Z | 76 | PC: 13897 | Terminate with return code (Return code = '0') |