Sample viewer

vx.netlux.org/Virus.DOS.LAVI.1495

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:12:40.09576749Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-17T23:12:40.098295635Z 185 PC: 12b22 | UNKNOWN!
2018-12-17T23:12:40.099569196Z 74 PC: 12b79 | Reallocate memory
2018-12-17T23:12:40.100789306Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:40.102451013Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:40.103520678Z 75 PC: 12c35 | Execute program
2018-12-17T23:12:40.116961379Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-17T23:12:40.119625276Z 76 PC: 132a4 | Terminate with return code (Return code = '1')
2018-12-17T23:12:40.122386202Z 73 PC: 12c52 | Release memory
2018-12-17T23:12:40.123485627Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:08.440012763Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:08.443502037Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:08.445866742Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:08.447532958Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.448740246Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.45040061Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:08.461909927Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:08.464208121Z 76 PC: 132a4 | Terminate with return code (Return code = '2')
2018-12-25T12:56:08.468224035Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:08.469516535Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:08.48514375Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:08.490644194Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:08.492296629Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:08.494040259Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.496679652Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.49853261Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:08.521235041Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:08.524174873Z 76 PC: 132a4 | Terminate with return code (Return code = '6')
2018-12-25T12:56:08.528536052Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:08.530367795Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":29,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:08.737216669Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:08.791223695Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:08.793304953Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:08.795666125Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.797785165Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.801921667Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:08.818939307Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:08.87013116Z 76 PC: 132a4 | Terminate with return code (Return code = '32')
2018-12-25T12:56:08.873981571Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:08.876000713Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:08.743254098Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:08.746494464Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:08.74769319Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:08.749311785Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.750746485Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.753229683Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:08.769202788Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:08.771738558Z 76 PC: 132a4 | Terminate with return code (Return code = '2')
2018-12-25T12:56:08.77571489Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:08.77837768Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:08.975326836Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:08.977811598Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:08.979781827Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:08.981390769Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.982759905Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:08.98464512Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:09.001218071Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:09.004103562Z 76 PC: 132a4 | Terminate with return code (Return code = '6')
2018-12-25T12:56:09.008261575Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:09.010202192Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":29,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:09.362381993Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:09.406336929Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:09.408386409Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:09.409988097Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:09.411270537Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:09.413897111Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:09.429911572Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:09.475457649Z 76 PC: 132a4 | Terminate with return code (Return code = '32')
2018-12-25T12:56:09.479426594Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:09.480874974Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:10.127141252Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:10.129611592Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:10.130852281Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:10.132102805Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.138495636Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.139669285Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:10.152676471Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:10.155172001Z 76 PC: 132a4 | Terminate with return code (Return code = '2')
2018-12-25T12:56:10.157975339Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:10.159153021Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":1,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:10.479950432Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:10.481657802Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:10.482564405Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:10.483489474Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.484894246Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.485933404Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:10.496115735Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:10.498691269Z 76 PC: 132a4 | Terminate with return code (Return code = '6')
2018-12-25T12:56:10.501652782Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:10.502830569Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')

{"DateBased":true,"Day":29,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":17588,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:56:10.70273368Z 42 PC: 12aec | Get date 0x12aec: add dx, 0
0x12aef: mov dx, dx
0x12af1: cmp dh, 0xb
0x12af4: jne 0x12b04
0x12af6: cmp dl, 0x1d
0x12af9: jne 0x12b04
0x12afb: call 0x12c95
0x12afe: add ch, 0
0x12b01: sub ax, 0
0x12b04: sub cx, 0
0x12b07: push cs
0x12b08: pop es
0x12b09: add ah, 0
0x12b0c: mov cl, cl
0x12b0e: mov si, 0x140
0x12b11: cmp word ptr [bp + si + 1], 0x414c
0x12b16: jne 0x12b2a
0x12b18: mov ah, 0xb9
0x12b1a: add cx, 0
0x12b1d: sub bx, 0
2018-12-25T12:56:10.733727125Z 185 PC: 12b22 | UNKNOWN!
2018-12-25T12:56:10.735437856Z 74 PC: 12b79 | Reallocate memory
2018-12-25T12:56:10.737011744Z 53 PC: 12b82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.738624998Z 37 PC: 12baa | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:56:10.740773803Z 75 PC: 12c35 | Execute program
2018-12-25T12:56:10.756887666Z 42 PC: 1334c | Get date 0x1334c: add dx, 0
0x1334f: mov dx, dx
0x13351: cmp dh, 0xb
0x13354: jne 0x13364
0x13356: cmp dl, 0x1d
0x13359: jne 0x13364
0x1335b: call 0x134f5
0x1335e: add ch, 0
0x13361: sub ax, 0
0x13364: sub cx, 0
0x13367: push cs
0x13368: pop es
0x13369: add ah, 0
0x1336c: mov cl, cl
0x1336e: mov si, 0x140
0x13371: cmp word ptr [bp + si + 1], 0x414c
0x13376: jne 0x1338a
0x13378: mov ah, 0xb9
0x1337a: add cx, 0
0x1337d: sub bx, 0
2018-12-25T12:56:10.799834654Z 76 PC: 132a4 | Terminate with return code (Return code = '32')
2018-12-25T12:56:10.804469279Z 73 PC: 12c52 | Release memory
2018-12-25T12:56:10.807203566Z 49 PC: 12c67 | Terminate and stay resident (Return code = '1' | Memory size = '128')