Virus.DOS.Butterfly.298.a.xml

<?xml version="1.0" standalone="yes"?>

<?program_dtd version="1"?>

<!DOCTYPE PROGRAM [

<!ELEMENT PROGRAM (DESCRIPTION?,
                   INFO_SOURCE?,
                   PROCESSOR?,
                   COMPILER?,
                   DATATYPES?,
                   MEMORY_MAP?,
                   REGISTER_VALUES?,
                   CODE?,
                   DATA?,
                   EQUATES?,
                   COMMENTS?,
                   PROPERTIES?,
                   BOOKMARKS?,
                   PROGRAM_TREES?,
                   PROGRAM_ENTRY_POINTS?,
                   RELOCATION_TABLE?,
                   SYMBOL_TABLE?,
                   FUNCTIONS?,
                   MARKUP?,
                   EXT_LIBRARY_TABLE?)>
  <!ATTLIST PROGRAM NAME       CDATA #REQUIRED>
  <!ATTLIST PROGRAM EXE_PATH   CDATA #IMPLIED>
  <!ATTLIST PROGRAM EXE_FORMAT CDATA #IMPLIED>
  <!ATTLIST PROGRAM IMAGE_BASE CDATA #IMPLIED>

<!ELEMENT DISPLAY_SETTINGS EMPTY>
  <!ATTLIST DISPLAY_SETTINGS FORMAT           (hex | decimal | octal | binary | char) #IMPLIED>
  <!ATTLIST DISPLAY_SETTINGS SIGNED           (y | n)                                 #IMPLIED>
  <!ATTLIST DISPLAY_SETTINGS ZERO_PAD         (y | n)                                 #IMPLIED>
  <!ATTLIST DISPLAY_SETTINGS ENDIAN           (big | little)                          #IMPLIED>
  <!ATTLIST DISPLAY_SETTINGS SHOW_TERMINATOR  (y | n)                                 #IMPLIED>

<!ELEMENT DESCRIPTION    (#PCDATA)>
<!ELEMENT REGULAR_CMT    (#PCDATA)>
<!ELEMENT REPEATABLE_CMT (#PCDATA)>
<!ELEMENT TYPEINFO_CMT   (#PCDATA)>

<!ELEMENT INFO_SOURCE EMPTY>
  <!ATTLIST INFO_SOURCE USER      CDATA #IMPLIED>
  <!ATTLIST INFO_SOURCE TOOL      CDATA #IMPLIED>
  <!ATTLIST INFO_SOURCE FILE      CDATA #IMPLIED>
  <!ATTLIST INFO_SOURCE TIMESTAMP CDATA #IMPLIED>

<!ELEMENT PROCESSOR EMPTY>
  <!ATTLIST PROCESSOR NAME              CDATA          #REQUIRED>
  <!ATTLIST PROCESSOR FAMILY            CDATA          #IMPLIED>
  <!ATTLIST PROCESSOR LANGUAGE_PROVIDER CDATA          #IMPLIED>
  <!ATTLIST PROCESSOR ENDIAN            (big | little) #IMPLIED>
  <!ATTLIST PROCESSOR ADDRESS_MODEL     CDATA          #IMPLIED>

<!-- TODO: expand compiler tag -->
<!ELEMENT COMPILER EMPTY>
  <!ATTLIST COMPILER NAME CDATA #REQUIRED>

<!ELEMENT MEMORY_MAP (MEMORY_SECTION*)>

<!ELEMENT MEMORY_SECTION ((MEMORY_CONTENTS*) | (BIT_MAPPED?))>
  <!ATTLIST MEMORY_SECTION NAME         CDATA                             #REQUIRED>
  <!ATTLIST MEMORY_SECTION START_ADDR   CDATA                             #REQUIRED>
  <!ATTLIST MEMORY_SECTION LENGTH       CDATA                             #REQUIRED>
  <!ATTLIST MEMORY_SECTION PERMISSIONS  (r | w | x | rw | rx | wx | rwx)  #IMPLIED>
  <!ATTLIST MEMORY_SECTION VOLATILE     (y | n)                           #IMPLIED>
  <!ATTLIST MEMORY_SECTION ARTIFICIAL   (y | n)                           #IMPLIED>
  <!ATTLIST MEMORY_SECTION COMMENT      CDATA                             #IMPLIED>

<!ELEMENT MEMORY_CONTENTS EMPTY>
  <!ATTLIST MEMORY_CONTENTS START_ADDR   CDATA  #IMPLIED>
  <!ATTLIST MEMORY_CONTENTS FILE_NAME    CDATA  #REQUIRED>
  <!ATTLIST MEMORY_CONTENTS FILE_OFFSET  CDATA  #REQUIRED>
  <!ATTLIST MEMORY_CONTENTS LENGTH       CDATA  #IMPLIED>

<!ELEMENT BIT_MAPPED EMPTY>
  <!ATTLIST BIT_MAPPED SOURCE_ADDRESS  CDATA  #REQUIRED>

<!ELEMENT REGISTER_VALUES (REGISTER_VALUE_RANGE*)>

<!ELEMENT REGISTER_VALUE_RANGE EMPTY>
  <!ATTLIST REGISTER_VALUE_RANGE REGISTER      CDATA #REQUIRED>
  <!ATTLIST REGISTER_VALUE_RANGE VALUE         CDATA #REQUIRED>
  <!ATTLIST REGISTER_VALUE_RANGE START_ADDRESS CDATA #REQUIRED>
  <!ATTLIST REGISTER_VALUE_RANGE LENGTH        CDATA #REQUIRED>

<!ELEMENT CODE (CODE_BLOCK*)>

<!ELEMENT CODE_BLOCK EMPTY>
  <!ATTLIST CODE_BLOCK  START  CDATA  #REQUIRED>
  <!ATTLIST CODE_BLOCK  END    CDATA  #REQUIRED>

<!ELEMENT DATA (DEFINED_DATA*)>

<!ELEMENT DEFINED_DATA (TYPEINFO_CMT?, DISPLAY_SETTINGS?)>
  <!ATTLIST DEFINED_DATA ADDRESS             CDATA  #REQUIRED>
  <!ATTLIST DEFINED_DATA DATATYPE            CDATA  #REQUIRED>
  <!ATTLIST DEFINED_DATA DATATYPE_NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST DEFINED_DATA SIZE                CDATA  #IMPLIED>

<!ELEMENT EQUATES (EQUATE_GROUP*)>

<!ELEMENT EQUATE_GROUP (REGULAR_CMT?, REPEATABLE_CMT?, DISPLAY_SETTINGS?, (EQUATE | BIT_MASK)*)>
  <!ATTLIST EQUATE_GROUP NAME       CDATA       #IMPLIED>
  <!ATTLIST EQUATE_GROUP BIT_FIELD  (yes | no)  #IMPLIED>

<!ELEMENT EQUATE (REGULAR_CMT?, REPEATABLE_CMT?)>
  <!ATTLIST EQUATE NAME     CDATA  #REQUIRED>
  <!ATTLIST EQUATE VALUE    CDATA  #REQUIRED>
  <!ATTLIST EQUATE BIT_MASK CDATA  #IMPLIED>

<!ELEMENT BIT_MASK (REGULAR_CMT?, REPEATABLE_CMT?)>
  <!ATTLIST BIT_MASK NAME   CDATA  #REQUIRED>
  <!ATTLIST BIT_MASK VALUE  CDATA  #REQUIRED>

<!ELEMENT COMMENTS (COMMENT*)>

<!ELEMENT COMMENT (#PCDATA)>
  <!ATTLIST COMMENT ADDRESS  CDATA                                            #REQUIRED>
  <!ATTLIST COMMENT TYPE     (end-of-line | repeatable | pre | post | plate)  #REQUIRED>

<!ELEMENT PROPERTIES (PROPERTY*)>

<!ELEMENT PROPERTY EMPTY>
  <!ATTLIST PROPERTY NAME     CDATA                                                #REQUIRED>
  <!ATTLIST PROPERTY ADDRESS  CDATA                                                #IMPLIED>
  <!ATTLIST PROPERTY TYPE     (string | long | int | double | void | bool | date | custom)  #IMPLIED>
  <!ATTLIST PROPERTY VALUE    CDATA                                                #IMPLIED>

<!ELEMENT BOOKMARKS (BOOKMARK*)>

<!ELEMENT BOOKMARK EMPTY>
  <!ATTLIST BOOKMARK ADDRESS     CDATA  #REQUIRED>
  <!ATTLIST BOOKMARK TYPE        CDATA  #IMPLIED>
  <!ATTLIST BOOKMARK CATEGORY    CDATA  #IMPLIED>
  <!ATTLIST BOOKMARK DESCRIPTION CDATA  #IMPLIED>

<!ELEMENT PROGRAM_TREES (TREE*)>

<!ELEMENT TREE ((FOLDER | FRAGMENT)*)>
  <!ATTLIST TREE NAME CDATA #REQUIRED>

<!ELEMENT FOLDER ((FOLDER | FRAGMENT)*)>
  <!ATTLIST FOLDER NAME CDATA #REQUIRED>

<!ELEMENT FRAGMENT (ADDRESS_RANGE)*>
  <!ATTLIST FRAGMENT NAME CDATA #REQUIRED>

<!ELEMENT ADDRESS_RANGE EMPTY>
  <!ATTLIST ADDRESS_RANGE START  CDATA  #REQUIRED>
  <!ATTLIST ADDRESS_RANGE END    CDATA  #REQUIRED>

<!ELEMENT PROGRAM_ENTRY_POINTS (PROGRAM_ENTRY_POINT*)>

<!ELEMENT PROGRAM_ENTRY_POINT EMPTY>
  <!ATTLIST PROGRAM_ENTRY_POINT  ADDRESS  CDATA  #REQUIRED>

<!ELEMENT RELOCATION_TABLE (RELOCATION*)>

<!ELEMENT RELOCATION EMPTY>
  <!ATTLIST RELOCATION ADDRESS  	CDATA	#REQUIRED>
  <!ATTLIST RELOCATION STATUS    	( UNKNOWN | SKIPPED | UNSUPPORTED | FAILURE | PARTIAL | APPLIED | APPLIED_OTHER )	#IMPLIED>
  <!-- STATUS defaults to APPLIED if BYTES specified and TYPE is non-zero  -->
  <!-- STATUS defaults to APPLIED_OTHER if BYTES specified and TYPE is zero  -->
  <!-- STATUS defaults to UNKNOWN if BYTES are not specified  -->
  <!ATTLIST RELOCATION TYPE     	CDATA	#REQUIRED>
  <!ATTLIST RELOCATION VALUE    	CDATA	#IMPLIED>
  <!ATTLIST RELOCATION BYTES    	CDATA	#IMPLIED>
  <!ATTLIST RELOCATION SYMBOL_NAME	CDATA	#IMPLIED>

<!ELEMENT SYMBOL_TABLE (SYMBOL*)>

<!ELEMENT SYMBOL EMPTY>
  <!ATTLIST SYMBOL ADDRESS   		CDATA            					 #REQUIRED>
  <!ATTLIST SYMBOL NAME      		CDATA             					 #REQUIRED>
  <!ATTLIST SYMBOL NAMESPACE 		CDATA             					 #IMPLIED>
  <!ATTLIST SYMBOL TYPE      		(global | local)  					 #IMPLIED>
  <!ATTLIST SYMBOL SOURCE_TYPE      (USER_DEFINED | IMPORTED | ANALYSIS) #IMPLIED>
  <!ATTLIST SYMBOL PRIMARY   		(y | n)           					 #IMPLIED>
  <!ATTLIST SYMBOL MANGLED   		CDATA             					 #IMPLIED>

<!ELEMENT FUNCTIONS (FUNCTION*)>

<!ELEMENT FUNCTION (RETURN_TYPE?, ADDRESS_RANGE*, REGULAR_CMT?, REPEATABLE_CMT?, TYPEINFO_CMT?, STACK_FRAME?, REGISTER_VAR*)>
  <!ATTLIST FUNCTION ENTRY_POINT       CDATA   #REQUIRED>
  <!ATTLIST FUNCTION NAME              CDATA   #IMPLIED>
  <!-- TODO: create xml attrs for each known attribute type -->
  <!ATTLIST FUNCTION LIBRARY_FUNCTION  (y | n) #IMPLIED>

<!ELEMENT RETURN_TYPE EMPTY>
  <!ATTLIST RETURN_TYPE DATATYPE            CDATA  #REQUIRED>
  <!ATTLIST RETURN_TYPE DATATYPE_NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST RETURN_TYPE SIZE                CDATA  #IMPLIED>

<!ELEMENT STACK_FRAME (STACK_VAR*)>
  <!ATTLIST STACK_FRAME LOCAL_VAR_SIZE         CDATA    #IMPLIED>
  <!ATTLIST STACK_FRAME PARAM_OFFSET           CDATA    #IMPLIED>
  <!ATTLIST STACK_FRAME REGISTER_SAVE_SIZE     CDATA    #IMPLIED>
  <!ATTLIST STACK_FRAME RETURN_ADDR_SIZE       CDATA    #IMPLIED>
  <!ATTLIST STACK_FRAME BYTES_PURGED           CDATA    #IMPLIED>

<!ELEMENT STACK_VAR (REGULAR_CMT?, REPEATABLE_CMT?)>
  <!ATTLIST STACK_VAR STACK_PTR_OFFSET    CDATA  #REQUIRED> <!-- offset from the stack ptr value at function entry -->
  <!ATTLIST STACK_VAR FRAME_PTR_OFFSET    CDATA  #IMPLIED>
  <!ATTLIST STACK_VAR NAME                CDATA  #IMPLIED>
  <!ATTLIST STACK_VAR DATATYPE            CDATA  #REQUIRED>
  <!ATTLIST STACK_VAR DATATYPE_NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST STACK_VAR SIZE                CDATA  #IMPLIED>

<!ELEMENT REGISTER_VAR (REGULAR_CMT?)>
  <!ATTLIST REGISTER_VAR NAME                CDATA  #REQUIRED>
  <!ATTLIST REGISTER_VAR REGISTER            CDATA  #REQUIRED>
  <!ATTLIST REGISTER_VAR DATATYPE            CDATA  #IMPLIED>
  <!ATTLIST REGISTER_VAR DATATYPE_NAMESPACE  CDATA  #IMPLIED>

<!ELEMENT MARKUP (MEMORY_REFERENCE      |
                  STACK_REFERENCE       |
                  EXT_LIBRARY_REFERENCE |
                  EQUATE_REFERENCE      |
                  MANUAL_OPERAND        |
                  MANUAL_INSTRUCTION)*>

<!-- An OPERAND_INDEX is omitted for a mnemonic reference    -->
<!-- The first operand is identified with OPERAND_INDEX=0 -->
<!ELEMENT MEMORY_REFERENCE EMPTY>
  <!ATTLIST MEMORY_REFERENCE ADDRESS        CDATA    #REQUIRED>
  <!ATTLIST MEMORY_REFERENCE OPERAND_INDEX  CDATA    #IMPLIED>
  <!ATTLIST MEMORY_REFERENCE USER_DEFINED   (y | n)  #IMPLIED>
  <!ATTLIST MEMORY_REFERENCE TO_ADDRESS     CDATA    #REQUIRED>
  <!ATTLIST MEMORY_REFERENCE BASE_ADDRESS   CDATA    #IMPLIED>
  <!ATTLIST MEMORY_REFERENCE PRIMARY        (y | n)  #IMPLIED>

<!ELEMENT STACK_REFERENCE EMPTY>
  <!ATTLIST STACK_REFERENCE ADDRESS          CDATA    #REQUIRED>
  <!ATTLIST STACK_REFERENCE OPERAND_INDEX    CDATA    #IMPLIED>
  <!ATTLIST STACK_REFERENCE USER_DEFINED     (y | n)  #IMPLIED>
  <!ATTLIST STACK_REFERENCE STACK_PTR_OFFSET CDATA    #REQUIRED> <!-- offset from the stack ptr value at function entry -->
  <!ATTLIST STACK_REFERENCE FRAME_PTR_OFFSET CDATA    #IMPLIED>

<!ELEMENT EXT_LIBRARY_REFERENCE EMPTY>
  <!ATTLIST EXT_LIBRARY_REFERENCE ADDRESS        CDATA    #REQUIRED>
  <!ATTLIST EXT_LIBRARY_REFERENCE OPERAND_INDEX  CDATA    #IMPLIED>
  <!ATTLIST EXT_LIBRARY_REFERENCE USER_DEFINED   (y | n)  #IMPLIED>
  <!ATTLIST EXT_LIBRARY_REFERENCE LIB_PROG_NAME  CDATA    #REQUIRED>
  <!ATTLIST EXT_LIBRARY_REFERENCE LIB_LABEL      CDATA    #IMPLIED>
  <!ATTLIST EXT_LIBRARY_REFERENCE LIB_ORDINAL    CDATA    #IMPLIED>
  <!ATTLIST EXT_LIBRARY_REFERENCE LIB_ADDR       CDATA    #IMPLIED>

<!ELEMENT EQUATE_REFERENCE EMPTY>
  <!ATTLIST EQUATE_REFERENCE ADDRESS        CDATA  #REQUIRED>
  <!ATTLIST EQUATE_REFERENCE OPERAND_INDEX  CDATA  #IMPLIED>
  <!ATTLIST EQUATE_REFERENCE NAME           CDATA  #REQUIRED>
  <!ATTLIST EQUATE_REFERENCE VALUE          CDATA  #IMPLIED>

<!ELEMENT MANUAL_OPERAND (#PCDATA)>
  <!ATTLIST MANUAL_OPERAND ADDRESS        CDATA  #REQUIRED>
  <!ATTLIST MANUAL_OPERAND OPERAND_INDEX  CDATA  #REQUIRED>

<!ELEMENT MANUAL_INSTRUCTION (#PCDATA)>
  <!ATTLIST MANUAL_INSTRUCTION ADDRESS CDATA #REQUIRED>

<!ELEMENT EXT_LIBRARY_TABLE (EXT_LIBRARY*)>

<!ELEMENT EXT_LIBRARY EMPTY>
  <!ATTLIST EXT_LIBRARY NAME  CDATA  #REQUIRED>
  <!ATTLIST EXT_LIBRARY PATH  CDATA  #IMPLIED>

<!-- ************************************************************* -->
<!--                                                               -->
<!--                Data DTD                                       -->
<!--                                                               -->
<!-- ************************************************************* -->

<!ELEMENT DATATYPES (STRUCTURE | UNION | FUNCTION_DEF | ENUM | TYPE_DEF)*>

<!ELEMENT MEMBER (REGULAR_CMT?, REPEATABLE_CMT?, DISPLAY_SETTINGS?)>
  <!ATTLIST MEMBER OFFSET              CDATA  #REQUIRED>
  <!ATTLIST MEMBER DATATYPE            CDATA  #REQUIRED>
  <!ATTLIST MEMBER DATATYPE_NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST MEMBER NAME                CDATA  #IMPLIED>
  <!ATTLIST MEMBER SIZE                CDATA  #IMPLIED>

<!ELEMENT STRUCTURE (REGULAR_CMT?, REPEATABLE_CMT?, MEMBER*)>
  <!ATTLIST STRUCTURE NAME             CDATA   #REQUIRED>
  <!ATTLIST STRUCTURE NAMESPACE        CDATA   #IMPLIED>
  <!ATTLIST STRUCTURE SIZE             CDATA   #IMPLIED>
  <!ATTLIST STRUCTURE VARIABLE_LENGTH  (y | n) #IMPLIED>

<!ELEMENT UNION (REGULAR_CMT?, REPEATABLE_CMT?, MEMBER*)>
  <!ATTLIST UNION NAME       CDATA  #REQUIRED>
  <!ATTLIST UNION NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST UNION SIZE       CDATA  #IMPLIED>

<!ELEMENT FUNCTION_DEF (REGULAR_CMT?, REPEATABLE_CMT?, RETURN_TYPE?, PARAMETER*)>
  <!ATTLIST FUNCTION_DEF NAME       CDATA  #REQUIRED>
  <!ATTLIST FUNCTION_DEF NAMESPACE  CDATA  #IMPLIED>

<!ELEMENT PARAMETER (REGULAR_CMT?, REPEATABLE_CMT?, DISPLAY_SETTINGS?)>
  <!ATTLIST PARAMETER ORDINAL             CDATA  #REQUIRED>
  <!ATTLIST PARAMETER DATATYPE            CDATA  #REQUIRED>
  <!ATTLIST PARAMETER DATATYPE_NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST PARAMETER NAME                CDATA  #IMPLIED>
  <!ATTLIST PARAMETER SIZE                CDATA  #IMPLIED>

<!ELEMENT TYPE_DEF (REGULAR_CMT?, REPEATABLE_CMT?)>
  <!ATTLIST TYPE_DEF NAME                CDATA #REQUIRED>
  <!ATTLIST TYPE_DEF NAMESPACE           CDATA #IMPLIED>
  <!ATTLIST TYPE_DEF DATATYPE            CDATA #REQUIRED>
  <!ATTLIST TYPE_DEF DATATYPE_NAMESPACE  CDATA #IMPLIED>

<!ELEMENT ENUM (REGULAR_CMT?, REPEATABLE_CMT?, DISPLAY_SETTINGS?, ENUM_ENTRY*)>
  <!ATTLIST ENUM NAME       CDATA  #REQUIRED>
  <!ATTLIST ENUM NAMESPACE  CDATA  #IMPLIED>
  <!ATTLIST ENUM SIZE       CDATA  #IMPLIED>

<!ELEMENT ENUM_ENTRY (REGULAR_CMT?, REPEATABLE_CMT?)>
  <!ATTLIST ENUM_ENTRY NAME   	CDATA  #REQUIRED>
  <!ATTLIST ENUM_ENTRY VALUE  	CDATA  #REQUIRED>
  <!ATTLIST ENUM_ENTRY COMMENT  CDATA  #REQUIRED>

]>
<PROGRAM NAME="Virus.DOS.Butterfly.298.a" EXE_PATH="/path/to/Virus.DOS.Butterfly.298.a" EXE_FORMAT="Raw Binary" IMAGE_BASE="0000:0000">
    <INFO_SOURCE USER="myuser" TOOL="Ghidra 12.0.4" TIMESTAMP="Tue Mar 24 00:00:00 CET 2026" />
    <PROCESSOR NAME="x86" LANGUAGE_PROVIDER="x86:LE:16:Real Mode:default" ENDIAN="little" />
    <DATATYPES>
        <STRUCTURE NAME="DOS_DTA" NAMESPACE="/" SIZE="0x2b">
            <MEMBER OFFSET="0x0" DATATYPE="byte[21]" DATATYPE_NAMESPACE="/" NAME="reserved" SIZE="0x15">
                <REGULAR_CMT>Reserved (DOS internal use)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x15" DATATYPE="byte" DATATYPE_NAMESPACE="/" NAME="attribute" SIZE="0x1">
                <REGULAR_CMT>File attribute</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x16" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="time" SIZE="0x2">
                <REGULAR_CMT>File time</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x18" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="date" SIZE="0x2">
                <REGULAR_CMT>File date</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x1a" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="size" SIZE="0x4">
                <REGULAR_CMT>File size</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x1e" DATATYPE="char[13]" DATATYPE_NAMESPACE="/" NAME="filename" SIZE="0xd">
                <REGULAR_CMT>Filename (null-terminated, 8.3)</REGULAR_CMT>
            </MEMBER>
        </STRUCTURE>
        <STRUCTURE NAME="DOS_PSP" NAMESPACE="/" SIZE="0x100">
            <MEMBER OFFSET="0x0" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="int20" SIZE="0x2">
                <REGULAR_CMT>CP/M-like exit (INT 20h)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x2" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="mem_size" SIZE="0x2">
                <REGULAR_CMT>Segment of first byte beyond program</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x4" DATATYPE="byte" DATATYPE_NAMESPACE="/" NAME="reserved1" SIZE="0x1">
                <REGULAR_CMT>Reserved</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x5" DATATYPE="byte[5]" DATATYPE_NAMESPACE="/" NAME="dos_dispatcher" SIZE="0x5">
                <REGULAR_CMT>CP/M-like far call entry into DOS</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0xa" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="int22_vector" SIZE="0x4">
                <REGULAR_CMT>Terminate address of previous program (old INT 22h)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0xe" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="int23_vector" SIZE="0x4">
                <REGULAR_CMT>Break address of previous program (old INT 23h)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x12" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="int24_vector" SIZE="0x4">
                <REGULAR_CMT>Critical error address of previous program (old INT 24h)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x16" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="parent_psp" SIZE="0x2">
                <REGULAR_CMT>Parent&apos;s PSP segment</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x18" DATATYPE="byte[20]" DATATYPE_NAMESPACE="/" NAME="jft" SIZE="0x14">
                <REGULAR_CMT>Job File Table (JFT)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x2c" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="env_segment" SIZE="0x2">
                <REGULAR_CMT>Environment segment</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x2e" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="ss_sp_last_int21" SIZE="0x4">
                <REGULAR_CMT>SS:SP on entry to last INT 21h call</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x32" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="jft_size" SIZE="0x2">
                <REGULAR_CMT>JFT size</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x34" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="jft_ptr" SIZE="0x4">
                <REGULAR_CMT>Pointer to JFT</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x38" DATATYPE="dword" DATATYPE_NAMESPACE="/" NAME="prev_psp" SIZE="0x4">
                <REGULAR_CMT>Pointer to previous PSP</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x3c" DATATYPE="byte[4]" DATATYPE_NAMESPACE="/" NAME="reserved2" SIZE="0x4">
                <REGULAR_CMT>Reserved</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x40" DATATYPE="word" DATATYPE_NAMESPACE="/" NAME="dos_version" SIZE="0x2">
                <REGULAR_CMT>DOS version to return (DOS 5+)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x42" DATATYPE="byte[14]" DATATYPE_NAMESPACE="/" NAME="reserved3" SIZE="0xe">
                <REGULAR_CMT>Reserved</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x50" DATATYPE="byte[3]" DATATYPE_NAMESPACE="/" NAME="dos_call" SIZE="0x3">
                <REGULAR_CMT>Unix-like far call into DOS (INT 21h + RETF)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x53" DATATYPE="byte[2]" DATATYPE_NAMESPACE="/" NAME="reserved4" SIZE="0x2">
                <REGULAR_CMT>Reserved</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x55" DATATYPE="byte[7]" DATATYPE_NAMESPACE="/" NAME="reserved5" SIZE="0x7">
                <REGULAR_CMT>Reserved (extended FCB prefix area)</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x5c" DATATYPE="byte[16]" DATATYPE_NAMESPACE="/" NAME="fcb1" SIZE="0x10">
                <REGULAR_CMT>Unopened Standard FCB 1</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x6c" DATATYPE="byte[20]" DATATYPE_NAMESPACE="/" NAME="fcb2" SIZE="0x14">
                <REGULAR_CMT>Unopened Standard FCB 2</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x80" DATATYPE="byte" DATATYPE_NAMESPACE="/" NAME="cmdtail_len" SIZE="0x1">
                <REGULAR_CMT>Number of bytes on command-line</REGULAR_CMT>
            </MEMBER>
            <MEMBER OFFSET="0x81" DATATYPE="char[127]" DATATYPE_NAMESPACE="/" NAME="cmdtail" SIZE="0x7f">
                <REGULAR_CMT>Command-line tail (terminated by 0Dh); default DTA</REGULAR_CMT>
            </MEMBER>
        </STRUCTURE>
    </DATATYPES>
    <MEMORY_MAP>
        <MEMORY_SECTION NAME="PSP" START_ADDR="1000:0000" LENGTH="0x100" PERMISSIONS="rw" />
        <MEMORY_SECTION NAME="File body" START_ADDR="1000:0100" LENGTH="0x140" PERMISSIONS="rwx">
            <MEMORY_CONTENTS FILE_NAME="Virus.DOS.Butterfly.298.a.bytes" FILE_OFFSET="0x0" />
        </MEMORY_SECTION>
    </MEMORY_MAP>
    <REGISTER_VALUES>
        <REGISTER_VALUE_RANGE REGISTER="BP" VALUE="0x0" START_ADDRESS="1000:0111" LENGTH="0x35" />
    </REGISTER_VALUES>
    <CODE>
        <CODE_BLOCK START="1000:0100" END="1000:0104" />
        <CODE_BLOCK START="1000:0109" END="1000:0175" />
        <CODE_BLOCK START="1000:017f" END="1000:020b" />
    </CODE>
    <DATA>
        <DEFINED_DATA ADDRESS="1000:0000" DATATYPE="DOS_PSP" DATATYPE_NAMESPACE="/" SIZE="0x100" />
        <DEFINED_DATA ADDRESS="1000:0105" DATATYPE="byte[4]" DATATYPE_NAMESPACE="/" SIZE="0x4" />
        <DEFINED_DATA ADDRESS="1000:0176" DATATYPE="string" DATATYPE_NAMESPACE="/" SIZE="0x9" />
        <DEFINED_DATA ADDRESS="1000:020c" DATATYPE="string" DATATYPE_NAMESPACE="/" SIZE="0x6" />
        <DEFINED_DATA ADDRESS="1000:0212" DATATYPE="DOS_DTA" DATATYPE_NAMESPACE="/" SIZE="0x2b" />
        <DEFINED_DATA ADDRESS="1000:023e" DATATYPE="word" DATATYPE_NAMESPACE="/" SIZE="0x2" />
    </DATA>
    <EQUATES>
        <EQUATE_GROUP>
            <EQUATE NAME="SET_DTA" VALUE="0x1a" />
            <EQUATE NAME="FIND_FIRST_FILE" VALUE="0x4e" />
            <EQUATE NAME="OPEN_FILE_RW" VALUE="0x3d02" />
            <EQUATE NAME="FIND_NEXT_FILE" VALUE="0x4f" />
            <EQUATE NAME="CLOSE_FILE" VALUE="0x3e" />
            <EQUATE NAME="SET_FILE_TIMESTAMP" VALUE="0x5701" />
            <EQUATE NAME="READ_FILE" VALUE="0x3f" />
            <EQUATE NAME="WRITE_FILE" VALUE="0x40" />
            <EQUATE NAME="MAX_INFECTABLE_FILE_SIZE" VALUE="0xfd00" />
            <EQUATE NAME="SEEK_FROM_START" VALUE="0x4200" />
            <EQUATE NAME="NEAR_JUMP" VALUE="0xe9" />
            <EQUATE NAME="INFECTION_MARKER" VALUE="0x1" />
            <EQUATE NAME="SEEK_FROM_END" VALUE="0x4202" />
            <EQUATE NAME="MAX_INFECTIONS" VALUE="0x6" />
        </EQUATE_GROUP>
    </EQUATES>
    <COMMENTS>
        <COMMENT ADDRESS="1000:0105" TYPE="pre">Also used as buffer for testing the executable type</COMMENT>
        <COMMENT ADDRESS="1000:010d" TYPE="plate">Bug: operand should be 0x10c
Analysis will assume the correct value</COMMENT>
        <COMMENT ADDRESS="1000:013a" TYPE="end-of-line">Should set 0x81 instead of 0x80</COMMENT>
        <COMMENT ADDRESS="1000:0149" TYPE="end-of-line">Clean if there was a file handle</COMMENT>
        <COMMENT ADDRESS="1000:014d" TYPE="end-of-line">Redundant (overwritten at 0x156)</COMMENT>
        <COMMENT ADDRESS="1000:014f" TYPE="end-of-line">(same)</COMMENT>
        <COMMENT ADDRESS="1000:0164" TYPE="end-of-line">Redundant (reset again at 0x16d)</COMMENT>
        <COMMENT ADDRESS="1000:016a" TYPE="end-of-line">Include: Readonly, hidden, system</COMMENT>
        <COMMENT ADDRESS="1000:0199" TYPE="end-of-line">Check COMMAND.COM via &quot;ND&quot;</COMMENT>
        <COMMENT ADDRESS="1000:01b2" TYPE="end-of-line">Seek to end (DX=0, from above)</COMMENT>
        <COMMENT ADDRESS="1000:01ce" TYPE="end-of-line">Unnecessarily includes part of buffers</COMMENT>
        <COMMENT ADDRESS="1000:01d8" TYPE="end-of-line">Sets DX to 0</COMMENT>
    </COMMENTS>
    <PROPERTIES>
        <PROPERTY NAME="Program Information.Analysis Times.Times" TYPE="custom" VALUE="&amp;lt;SAVE_STATE&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;ASCII Strings&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Apply Data Archives&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;5&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;CUSTOM_OPTION_CLASS&amp;quot; TYPE=&amp;quot;string&amp;quot; VALUE=&amp;quot;ghidra.app.plugin.core.analysis.StoredAnalyzerTimes&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Create Function&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Data Reference&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;1&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Decompiler Switch Analysis&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Demangler GNU&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;46&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Disassemble Entry Points&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Embedded Media&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;4&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;External Entry References&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Function ID&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Function Start Search&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;2&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Non-Returning Functions - Discovered&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Reference&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;1&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Shared Return Calls&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;1&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;Subroutine References&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;0&amp;quot; /&amp;gt;
    &amp;lt;STATE NAME=&amp;quot;x86 Constant Reference Analyzer&amp;quot; TYPE=&amp;quot;long&amp;quot; VALUE=&amp;quot;35&amp;quot; /&amp;gt;
&amp;lt;/SAVE_STATE&amp;gt;" />
        <PROPERTY NAME="Program Information.Analyzed" TYPE="bool" VALUE="y" />
        <PROPERTY NAME="Program Information.Created With Ghidra Version" TYPE="string" VALUE="12.0.4" />
        <PROPERTY NAME="Program Information.Date Created" TYPE="date" VALUE="0x19d1fac3946" />
        <PROPERTY NAME="Program Information.Executable Format" TYPE="string" VALUE="Raw Binary" />
        <PROPERTY NAME="Program Information.Executable Location" TYPE="string" VALUE="/path/to/Virus.DOS.Butterfly.298.a" />
        <PROPERTY NAME="Program Information.Executable MD5" TYPE="string" VALUE="29745cc5f7787873cdf7619743bed0c1" />
        <PROPERTY NAME="Program Information.Executable SHA256" TYPE="string" VALUE="4281d1cbd33cfd80e00028d6d53ff4e8f97ef2eb5e632bf56a5b31f02fb79ec8" />
        <PROPERTY NAME="Program Information.FSRL" TYPE="string" VALUE="file:///path/to/Virus.DOS.Butterfly.298.a?MD5=29745cc5f7787873cdf7619743bed0c1" />
        <PROPERTY NAME="Program Information.Should Ask To Analyze" TYPE="bool" VALUE="n" />
    </PROPERTIES>
    <BOOKMARKS>
        <BOOKMARK ADDRESS="1000:010d" TYPE="Note" CATEGORY="BUG" />
        <BOOKMARK ADDRESS="1000:013a" TYPE="Note" CATEGORY="BUG" />
    </BOOKMARKS>
    <PROGRAM_TREES>
        <TREE NAME="Program Tree">
            <FRAGMENT NAME="File body">
                <ADDRESS_RANGE START="1000:0100" END="1000:023f" />
            </FRAGMENT>
            <FRAGMENT NAME="PSP">
                <ADDRESS_RANGE START="1000:0080" END="1000:009f" />
            </FRAGMENT>
            <FRAGMENT NAME="PSP.exp">
                <ADDRESS_RANGE START="1000:0000" END="1000:007f" />
                <ADDRESS_RANGE START="1000:00a0" END="1000:00ff" />
            </FRAGMENT>
        </TREE>
    </PROGRAM_TREES>
    <PROGRAM_ENTRY_POINTS />
    <RELOCATION_TABLE />
    <SYMBOL_TABLE>
        <SYMBOL ADDRESS="1000:0100" NAME="COM_ENTRY_POINT" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0105" NAME="SAVE_ORIG_ENTRY_POINT_BYTES" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0109" NAME="VIRUS_START" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:010c" NAME="FIND_BASE_ADDRESS" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0111" NAME="RESTORE_ORIG_ENTRY_POINT" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0138" NAME="EXIT_PROCEDURE" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0149" NAME="CLEAN_AND_CLOSE" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0166" NAME="FIND_NEXT_FILE" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0168" NAME="INVOKE_FILE_SEARCH" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:017f" NAME="OPEN_CANDIDATE_FOR_INFECTION" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0209" NAME="JMP_TO_EXIT_PROCEDURE" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:020c" NAME="COM_FILES_PATTERN" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:0212" NAME="DTA_BUFFER" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:023d" NAME="INFECTION_COUNTER" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
        <SYMBOL ADDRESS="1000:023e" NAME="FILE_SIZE" NAMESPACE="" TYPE="global" SOURCE_TYPE="USER_DEFINED" PRIMARY="y" />
    </SYMBOL_TABLE>
    <FUNCTIONS />
    <MARKUP>
        <MEMORY_REFERENCE ADDRESS="1000:0111" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0100" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0114" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0105" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0120" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0212" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0126" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:023d" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:012d" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0230" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0131" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:020c" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:013a" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0080" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0142" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0100" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:014f" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0227" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0156" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0228" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:015a" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:022a" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:018f" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0105" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:0195" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0235" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:019e" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:0108" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01a5" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:022c" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01bb" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:023e" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01bf" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0105" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01ca" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0109" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01dd" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:023e" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01e2" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:0106" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01e6" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:0105" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01eb" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:0108" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01f0" OPERAND_INDEX="0x1" USER_DEFINED="y" TO_ADDRESS="1000:0105" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01fb" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:023d" PRIMARY="y" />
        <MEMORY_REFERENCE ADDRESS="1000:01ff" OPERAND_INDEX="0x0" USER_DEFINED="y" TO_ADDRESS="1000:023d" PRIMARY="y" />
        <EQUATE_REFERENCE ADDRESS="1000:011e" OPERAND_INDEX="0x1" NAME="SET_DTA" VALUE="0x1a" />
        <EQUATE_REFERENCE ADDRESS="1000:0138" OPERAND_INDEX="0x1" NAME="SET_DTA" VALUE="0x1a" />
        <EQUATE_REFERENCE ADDRESS="1000:012b" OPERAND_INDEX="0x1" NAME="FIND_FIRST_FILE" VALUE="0x4e" />
        <EQUATE_REFERENCE ADDRESS="1000:0181" OPERAND_INDEX="0x1" NAME="OPEN_FILE_RW" VALUE="0x3d02" />
        <EQUATE_REFERENCE ADDRESS="1000:0166" OPERAND_INDEX="0x1" NAME="FIND_NEXT_FILE" VALUE="0x4f" />
        <EQUATE_REFERENCE ADDRESS="1000:0160" OPERAND_INDEX="0x1" NAME="CLOSE_FILE" VALUE="0x3e" />
        <EQUATE_REFERENCE ADDRESS="1000:0153" OPERAND_INDEX="0x1" NAME="SET_FILE_TIMESTAMP" VALUE="0x5701" />
        <EQUATE_REFERENCE ADDRESS="1000:018a" OPERAND_INDEX="0x1" NAME="READ_FILE" VALUE="0x3f" />
        <EQUATE_REFERENCE ADDRESS="1000:01c6" OPERAND_INDEX="0x1" NAME="WRITE_FILE" VALUE="0x40" />
        <EQUATE_REFERENCE ADDRESS="1000:01d1" OPERAND_INDEX="0x1" NAME="WRITE_FILE" VALUE="0x40" />
        <EQUATE_REFERENCE ADDRESS="1000:01f4" OPERAND_INDEX="0x1" NAME="WRITE_FILE" VALUE="0x40" />
        <EQUATE_REFERENCE ADDRESS="1000:01b6" OPERAND_INDEX="0x1" NAME="MAX_INFECTABLE_FILE_SIZE" VALUE="0xfd00" />
        <EQUATE_REFERENCE ADDRESS="1000:01d5" OPERAND_INDEX="0x1" NAME="SEEK_FROM_START" VALUE="0x4200" />
        <EQUATE_REFERENCE ADDRESS="1000:01e6" OPERAND_INDEX="0x1" NAME="NEAR_JUMP" VALUE="0xe9" />
        <EQUATE_REFERENCE ADDRESS="1000:01eb" OPERAND_INDEX="0x1" NAME="INFECTION_MARKER" VALUE="0x1" />
        <EQUATE_REFERENCE ADDRESS="1000:01ae" OPERAND_INDEX="0x1" NAME="SEEK_FROM_END" VALUE="0x4202" />
        <EQUATE_REFERENCE ADDRESS="1000:01ff" OPERAND_INDEX="0x1" NAME="MAX_INFECTIONS" VALUE="0x6" />
    </MARKUP>
    <EXT_LIBRARY_TABLE />
</PROGRAM>