.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:44:19.381818801Z | 71 | PC: 12acd | Get current directory |
| 2018-12-17T22:44:19.386479054Z | 59 | PC: 12ad4 | Change current directory |
| 2018-12-17T22:44:19.39202365Z | 47 | PC: 12ae9 | Get disk transfer address |
| 2018-12-17T22:44:19.393586386Z | 26 | PC: 12af7 | Set disk transfer address |
| 2018-12-17T22:44:19.395103384Z | 78 | PC: 12b01 | Find first file |
| 2018-12-17T22:44:19.401069358Z | 47 | PC: 12b4b | Get disk transfer address |
| 2018-12-17T22:44:19.402963905Z | 26 | PC: 12b5a | Set disk transfer address |
| 2018-12-17T22:44:19.404753437Z | 78 | PC: 12b62 | Find first file |
| 2018-12-17T22:44:19.41218489Z | 26 | PC: 12b74 | Set disk transfer address |
| 2018-12-17T22:44:19.413506434Z | 26 | PC: 12b37 | Set disk transfer address |
| 2018-12-17T22:44:19.414775694Z | 59 | PC: 12ade | Change current directory |
| 2018-12-17T22:44:19.417216154Z | 71 | PC: 12acd | Get current directory |
| 2018-12-17T22:44:19.420434302Z | 59 | PC: 12ad4 | Change current directory |
| 2018-12-17T22:44:19.425294363Z | 47 | PC: 12ae9 | Get disk transfer address |
| 2018-12-17T22:44:19.427035626Z | 26 | PC: 12af7 | Set disk transfer address |
| 2018-12-17T22:44:19.428301377Z | 78 | PC: 12b01 | Find first file |
| 2018-12-17T22:44:19.433087958Z | 47 | PC: 12b4b | Get disk transfer address |
| 2018-12-17T22:44:19.43436911Z | 26 | PC: 12b5a | Set disk transfer address |
| 2018-12-17T22:44:19.436182992Z | 78 | PC: 12b62 | Find first file |
| 2018-12-17T22:44:19.443992604Z | 26 | PC: 12b74 | Set disk transfer address |
| 2018-12-17T22:44:19.4459062Z | 26 | PC: 12b37 | Set disk transfer address |
| 2018-12-17T22:44:19.448569813Z | 59 | PC: 12ade | Change current directory |
| 2018-12-17T22:44:19.451922998Z | 44 | PC: 12c05 | Get time 0x12c05: mov al, ch 0x12c07: cwde 0x12c08: ret 0x12c09: mov ah, 0x2c 0x12c0b: int 0x21 0x12c0d: mov al, cl 0x12c0f: cwde 0x12c10: ret 0x12c11: mov ah, 0x2c 0x12c13: int 0x21 0x12c15: mov al, dh 0x12c17: cwde 0x12c18: ret 0x12c19: mov ah, 0x2a 0x12c1b: int 0x21 0x12c1d: cwde 0x12c1e: ret 0x12c1f: inc dx 0x12c20: popaw 0x12c21: and byte ptr fs:[bp + di + 0x6f], ah |
| 2018-12-17T22:44:19.455710151Z | 42 | PC: 12c1d | Get date 0x12c1d: cwde 0x12c1e: ret 0x12c1f: inc dx 0x12c20: popaw 0x12c21: and byte ptr fs:[bp + di + 0x6f], ah 0x12c25: insw word ptr es:[di], dx 0x12c26: insw word ptr es:[di], dx 0x12c27: popaw 0x12c28: outsb dx, byte ptr [si] 0x12c29: and byte ptr fs:[bx + 0x72], ch 0x12c2d: and byte ptr [bp + 0x69], ah 0x12c30: insb byte ptr es:[di], dx 0x12c31: and byte ptr gs:[bp + 0x61], ch 0x12c35: insw word ptr es:[di], dx 0x12c36: or ax, 0xa 0x12c3a: das 0x12c3b: mov di, 0xa41 0x12c3e: mov word ptr [0x589], di 0x12c42: call 0x13648 0x12c45: mov ax, 0x5500 |
| 2018-12-17T22:44:21.597785722Z | 72 | PC: 8f1b9 | Allocate memory |
| 2018-12-17T22:44:21.600205991Z | 72 | PC: 8f1bd | Allocate memory |
| 2018-12-17T22:44:21.603190878Z | 99 | PC: 90858 | Get DBCS lead byte table pointer |
| 2018-12-17T22:44:21.607710769Z | 61 | PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS') |
| 2018-12-17T22:44:21.62668059Z | 66 | PC: 91f95 | Move file pointer |
| 2018-12-17T22:44:21.62885163Z | 62 | PC: 91fc1 | Close file |
| 2018-12-17T22:44:21.632700925Z | 75 | PC: 91fe0 | Execute program |
| 2018-12-17T22:44:21.665212623Z | 98 | PC: 916f1 | Get current PSP |
| 2018-12-17T22:44:21.667343396Z | 9 | PC: c605 | Display string (String= ' 6� � r�&;] u') |
| 2018-12-17T22:44:21.681014128Z | 48 | PC: c609 | Get DOS version |
| 2018-12-17T22:44:21.684693815Z | 9 | PC: c382 | Display string (String= ' Installed A20 handler number ') |
| 2018-12-17T22:44:21.687466183Z | 2 | PC: c38c | Character output (Char = '32') |
| 2018-12-17T22:44:21.690485567Z | 2 | PC: c3a7 | Character output (Char = '2e') |
| 2018-12-17T22:44:21.694419231Z | 9 | PC: c6d9 | Display string (String= '���� �VH�VD���V@������� �� ���� �_���Ku��t1��� ���� �D�����t �� ��������a 1��Z � �� � �W���� ����� �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-17T22:44:21.698650082Z | 9 | PC: c6e0 | Display string (String= ' �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-17T22:44:21.704030117Z | 61 | PC: 91f88 | Open file (Filename = 'C:\WINDOWS\SMARTDRV.EXE') |
| 2018-12-17T22:44:21.716297873Z | 66 | PC: 91f95 | Move file pointer |
| 2018-12-17T22:44:21.717945896Z | 62 | PC: 91fc1 | Close file |
| 2018-12-17T22:44:21.720252396Z | 75 | PC: 91fe0 | Execute program |
| 2018-12-17T22:44:21.744646763Z | 98 | PC: 916f1 | Get current PSP |
| 2018-12-17T22:44:21.749389771Z | 82 | PC: 13d46 | Get DOS internal pointers (SYSVARS) |
| 2018-12-17T22:44:21.751467123Z | 53 | PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-17T22:44:21.753713432Z | 37 | PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-17T22:44:21.755513879Z | 53 | PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-17T22:44:21.757384776Z | 37 | PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-17T22:44:21.759436067Z | 9 | PC: 13a0d | Display string (Could not find end pointer) |
| 2018-12-17T22:44:21.768552904Z | 62 | PC: 8f8eb | Close file |
| 2018-12-17T22:44:21.771061574Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.774517268Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.77859152Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.78066937Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.783495019Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.78565321Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.787695315Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.789940288Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.792668023Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.795526641Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.797555497Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.800490967Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.802543428Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.804569578Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.807370498Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.809379704Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.811414291Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.814117428Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.81600806Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.818023149Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.820844526Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.82299988Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.825075932Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.827853822Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.830007291Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.832009566Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.834048968Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.83655675Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.838562455Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.840567809Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-17T22:44:21.843434044Z | 61 | PC: 8f8ff | Open file (Filename = '') |
| 2018-12-17T22:44:21.849180064Z | 62 | PC: 8f90e | Close file |
| 2018-12-17T22:44:21.851528225Z | 69 | PC: 8f915 | Duplicate handle |
| 2018-12-17T22:44:21.854571948Z | 69 | PC: 8f919 | Duplicate handle |
| 2018-12-17T22:44:21.860799539Z | 61 | PC: 9387b | Open file (Filename = '') |
| 2018-12-17T22:44:21.86605963Z | 68 | PC: 9386b | I/O control for devices (Set for = '') |
| 2018-12-17T22:44:21.868568417Z | 61 | PC: 9387b | Open file (Filename = '') |
| 2018-12-17T22:44:21.874028729Z | 68 | PC: 9386b | I/O control for devices (Set for = '') |
| 2018-12-17T22:44:21.876276661Z | 74 | PC: 8f9c4 | Reallocate memory |
| 2018-12-17T22:44:21.878795411Z | 72 | PC: 8f9e0 | Allocate memory |
| 2018-12-17T22:44:21.881698072Z | 72 | PC: 8f9e4 | Allocate memory |
| 2018-12-17T22:44:21.883687412Z | 74 | PC: 8f9fb | Reallocate memory |
| 2018-12-17T22:44:21.885800884Z | 72 | PC: 8fa02 | Allocate memory |
| 2018-12-17T22:44:21.88802835Z | 72 | PC: 8fa06 | Allocate memory |
| 2018-12-17T22:44:21.890059718Z | 73 | PC: 8fa11 | Release memory |
| 2018-12-17T22:44:21.892088871Z | 73 | PC: 8efea | Release memory |
| 2018-12-17T22:44:21.894352525Z | 74 | PC: 8f003 | Reallocate memory |
| 2018-12-17T22:44:21.896436384Z | 72 | PC: 8f054 | Allocate memory |
| 2018-12-17T22:44:21.898679967Z | 72 | PC: 8f058 | Allocate memory |
| 2018-12-17T22:44:21.900958586Z | 73 | PC: 8f060 | Release memory |
| 2018-12-17T22:44:21.902648332Z | 61 | PC: 8f080 | Open file (Filename = '') |
| 2018-12-17T22:44:21.912933626Z | 63 | PC: 8f095 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-17T22:44:21.919815495Z | 66 | PC: 8f0ad | Move file pointer |
| 2018-12-17T22:44:21.92175672Z | 62 | PC: 8f0d1 | Close file |
| 2018-12-17T22:44:21.924212051Z | 75 | PC: 8f0f2 | Execute program |
| 2018-12-17T22:44:21.949255651Z | 80 | PC: 12be9 | Set current PSP |
| 2018-12-17T22:44:21.950312475Z | 48 | PC: 12bee | Get DOS version |
| 2018-12-17T22:44:21.952060582Z | 99 | PC: 193d0 | Get DBCS lead byte table pointer |
| 2018-12-17T22:44:21.955575435Z | 101 | PC: 12c74 | Get extended country info |
| 2018-12-17T22:44:21.957078674Z | 99 | PC: 12c7a | Get DBCS lead byte table pointer |
| 2018-12-17T22:44:21.958522828Z | 74 | PC: 12cdc | Reallocate memory |
| 2018-12-17T22:44:21.960946806Z | 72 | PC: 1355d | Allocate memory |
| 2018-12-17T22:44:21.964337947Z | 25 | PC: 13596 | Get default drive |
| 2018-12-17T22:44:21.965617626Z | 71 | PC: 135ad | Get current directory |
| 2018-12-17T22:44:21.968519431Z | 59 | PC: 135ba | Change current directory |
| 2018-12-17T22:44:21.97545841Z | 59 | PC: 135c8 | Change current directory |
| 2018-12-17T22:44:21.982483669Z | 59 | PC: 135d3 | Change current directory |
| 2018-12-17T22:44:21.987095212Z | 25 | PC: 12d13 | Get default drive |
| 2018-12-17T22:44:21.989935955Z | 37 | PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write') |
| 2018-12-17T22:44:21.991751124Z | 37 | PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records') |
| 2018-12-17T22:44:21.993572414Z | 37 | PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:44:21.997188701Z | 80 | PC: 1301d | Set current PSP |
| 2018-12-17T22:44:21.998739677Z | 37 | PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag') |
| 2018-12-17T22:44:22.000753738Z | 53 | PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-17T22:44:22.003055732Z | 37 | PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-17T22:44:22.004788638Z | 51 | PC: 13417 | Get or set Ctrl-Break |
| 2018-12-17T22:44:22.007611658Z | 72 | PC: 130ec | Allocate memory |
| 2018-12-17T22:44:22.010866066Z | 61 | PC: 131b2 | Open file (Filename = '') |
| 2018-12-17T22:44:22.017901898Z | 62 | PC: 131ba | Close file |
| 2018-12-17T22:44:22.020713568Z | 51 | PC: 1344c | Get or set Ctrl-Break |
| 2018-12-17T22:44:22.023155712Z | 74 | PC: 1197c | Reallocate memory |
| 2018-12-17T22:44:22.025177393Z | 72 | PC: 11991 | Allocate memory |
| 2018-12-17T22:44:22.027380036Z | 73 | PC: 119b2 | Release memory |
| 2018-12-17T22:44:22.030009815Z | 72 | PC: 119bd | Allocate memory |
| 2018-12-17T22:44:22.033147462Z | 73 | PC: 119df | Release memory |
| 2018-12-17T22:44:22.035027281Z | 72 | PC: 119f5 | Allocate memory |
| 2018-12-17T22:44:22.037969013Z | 72 | PC: 119fd | Allocate memory |