Sample viewer




Time Syscall Op Syscall Name
2018-12-17T22:26:59.35937322Z 42 PC: 139e8 | Get date 0x139e8: cmp cx, 0x70b
0x139ec: jb 0x13a0c
0x139ee: ja 0x139fc
0x139f0: cmp dh, 2
0x139f3: jb 0x13a0c
0x139f5: ja 0x139fc
0x139f7: cmp dl, 0x15
0x139fa: jb 0x13a0c
0x139fc: mov ax, 0xb73
0x139ff: mov bx, 0x7373
0x13a02: int 0x21
0x13a04: cmp ah, 0x73
0x13a07: je 0x13a0c
0x13a09: jmp 0x14277
0x13a0c: push cs
0x13a0d: pop ax
0x13a0e: push ds
0x13a0f: pop bx
0x13a10: sub ax, bx
0x13a12: jne 0x13a2c
2018-12-17T22:26:59.361848801Z 11 PC: 13a04 | Get input status
2018-12-17T22:26:59.364954047Z 42 PC: 13349 | Get date 0x13349: sub cx, word ptr [0x2b2]
0x1334d: jg 0x13364
0x1334f: jl 0x1335f
0x13351: sub dh, byte ptr [0x2b4]
0x13355: jg 0x1336e
0x13357: jl 0x1335f
0x13359: sub dl, byte ptr [0x2b5]
0x1335d: ja 0x13380
0x1335f: mov cx, 0
0x13362: jmp 0x13397
0x13364: sub dh, byte ptr [0x2b4]
0x13368: jae 0x1336e
0x1336a: add dh, 0xc
0x1336d: dec cx
0x1336e: sub dl, byte ptr [0x2b5]
0x13372: jae 0x13380
0x13374: add dl, 0x1e
0x13377: sub dh, 1
0x1337a: jae 0x13380
0x1337c: add dh, 0xc
2018-12-17T22:26:59.367442133Z 44 PC: 131f1 | Get time 0x131f1: mov ax, 2
0x131f4: mul dl
0x131f6: add ax, 0x1e
0x131f9: mov word ptr [0x2a5], ax
0x131fc: mov ax, 0x3508
0x131ff: int 0x21
0x13201: mov word ptr [0x1c8], bx
0x13205: mov bx, es
0x13207: mov word ptr [0x1ca], bx
0x1320b: push cs
0x1320c: pop es
0x1320d: mov ax, 0x2508
0x13210: lea dx, word ptr [0x2cd]
0x13214: int 0x21
0x13216: mov ax, 0x3521
0x13219: int 0x21
0x1321b: mov word ptr [0x1cc], bx
0x1321f: mov bx, es
0x13221: mov word ptr [0x1ce], bx
0x13225: push cs
2018-12-17T22:26:59.369139752Z 53 PC: 13201 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:26:59.370825797Z 37 PC: 13216 | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:26:59.371836807Z 53 PC: 1321b | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:26:59.372869627Z 37 PC: 13230 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:26:59.374724507Z 74 PC: 1325a | Reallocate memory
2018-12-17T22:26:59.388243451Z 67 PC: 12ebb | Get or set file attributes
2018-12-17T22:26:59.395565972Z 67 PC: 12ed3 | Get or set file attributes
2018-12-17T22:26:59.409872176Z 65 PC: 12f32 | Delete file (Filename = 'A:\CHKLIST.CPS')
2018-12-17T22:26:59.416601061Z 65 PC: 12f4e | Delete file (Filename = 'A:\CHKLIST.MS')
2018-12-17T22:26:59.42425327Z 86 PC: 12f85 | Rename file
2018-12-17T22:26:59.441904985Z 61 PC: 12f91 | Open file (Filename = 'A:\TEST.TXT')
2018-12-17T22:26:59.45055014Z 66 PC: 12fa6 | Move file pointer
2018-12-17T22:26:59.451811907Z 66 PC: 12fc9 | Move file pointer
2018-12-17T22:26:59.453037961Z 63 PC: 12fdb | Read file or device (Read 8 bytes on handle 5)
2018-12-17T22:26:59.458177873Z 62 PC: 131a2 | Close file
2018-12-17T22:26:59.459780494Z 86 PC: 131b1 | Rename file
2018-12-17T22:26:59.46772023Z 67 PC: 131c1 | Get or set file attributes
2018-12-17T22:26:59.475402188Z 75 PC: 132b3 | Execute program
2018-12-17T22:26:59.486556578Z 42 PC: 148b8 | Get date 0x148b8: cmp cx, 0x70b
0x148bc: jb 0x148dc
0x148be: ja 0x148cc
0x148c0: cmp dh, 2
0x148c3: jb 0x148dc
0x148c5: ja 0x148cc
0x148c7: cmp dl, 0x15
0x148ca: jb 0x148dc
0x148cc: mov ax, 0xb73
0x148cf: mov bx, 0x7373
0x148d2: int 0x21
0x148d4: cmp ah, 0x73
0x148d7: je 0x148dc
0x148d9: jmp 0x15147
0x148dc: push cs
0x148dd: pop ax
0x148de: push ds
0x148df: pop bx
0x148e0: sub ax, bx
0x148e2: jne 0x148fc
2018-12-17T22:26:59.48829869Z 9 PC: 13952 | Display string (String= 'Goat file (EXE). Size=000011A0h/0000004512d bytes. ')
2018-12-17T22:26:59.492074262Z 76 PC: 13956 | Terminate with return code (Return code = '36')
2018-12-17T22:26:59.494414006Z 73 PC: 132c1 | Release memory
2018-12-17T22:26:59.495695576Z 77 PC: 132c6 | Get program return code
2018-12-17T22:26:59.497435616Z 49 PC: 132d7 | Terminate and stay resident (Return code = '36' | Memory size = '231')