/
th01_fuuin.asm
24880 lines (21923 loc) · 415 KB
/
th01_fuuin.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
;
; +-------------------------------------------------------------------------+
; | This file has been generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2009 by Hex-Rays, <support@hex-rays.com> |
; +-------------------------------------------------------------------------+
;
; Input MD5 : 2CAAD6F798E32B912A08DA327A97DDB4
; File Name : th01/FUUIN.EXE
; Format : MS-DOS executable (EXE)
; Base Address: 0h Range: 0h-147E0h Loaded length: 13ED8h
; Entry Point : 0:0
; OS type : MS DOS
; Application type: Executable 16bit
CGROUP00 group seg000
CGROUP01 group seg001
CGROUP02 group seg002
CGROUP03 group seg003
CGROUP04 group seg004
CGROUP05 group seg005
CGROUP06 group seg006
CGROUP07 group seg007
CGROUP08 group seg008
CGROUP09 group seg009
CGROUP10 group seg010
CGROUP11 group seg011
CGROUP12 group seg012
CGROUP13 group seg013
CGROUP14 group seg014
CGROUP15 group seg015
CGROUP16 group seg016
.386
.model large
include ReC98.inc
include libs/BorlandC/regs.inc
; ===========================================================================
; Segment type: Pure code
seg000 segment word public 'CODE' use16
assume cs:seg000
assume es:nothing, ss:seg018, ds:dseg, fs:nothing, gs:nothing
include libs/BorlandC/c0.asm
db 6 dup(0), 2 dup(7), 2 dup(0), 7, 0, 7, 0, 7
db 2 dup(0), 4 dup(7), 0, 3 dup(7), 5 dup(0), 2 dup(0Fh)
db 2 dup(0), 0Fh, 0, 0Fh, 0, 0Fh, 2 dup(0), 4 dup(0Fh)
db 0, 3 dup(0Fh)
word_2A2 dw 0
word_2A4 dw 0
; ---------------------------------------------------------------------------
push bp
mov bp, sp
push ds
lds dx, [bp+12h]
mov ax, [bp+0Eh]
add ax, 0Fh
shr ax, 4
add ax, [bp+10h]
mov es, ax
cld
mov si, dx
xor dx, dx
mov di, dx
lodsb
xor ch, ch
mov cl, al
rep movsb
xor al, al
stosb
push es
pop ds
mov si, [bp+0Ch]
mov ax, [bp+0Eh]
and ax, 0Fh
sub si, ax
mov bx, [bp+0Ah]
mov cx, [bp+8]
mov di, [bp+6]
mov ax, [bp+4]
call loc_3E2
pop ds
pop bp
retn 10h
; ---------------------------------------------------------------------------
mov bx, sp
push ds
mov ax, cs:word_2A4
mov ds, ax
mov es, ax
mov al, ss:[bx+2]
mov byte_12BD8, al
call sub_BE3
pop ds
retn 2
; ---------------------------------------------------------------------------
push bp
mov bp, sp
push si
push di
push ds
mov bx, ds
mov es, bx
assume es:dseg
mov dx, [bp+4]
mov ax, [bp+6]
add ax, 0Fh
shr ax, 4
add ax, bx
mov ds, ax
mov si, [bp+8]
mov ax, [bp+6]
and ax, 0Fh
sub si, ax
mov bx, [bp+0Ah]
mov cx, [bp+0Ch]
mov di, [bp+0Eh]
mov ax, [bp+10h]
call loc_3E2
pop ds
pop di
pop si
pop bp
retn
; ---------------------------------------------------------------------------
mov bx, sp
push ds
push si
push di
mov ax, cs:word_2A4
mov ds, ax
mov es, ax
assume es:nothing
mov al, ss:[bx+2]
mov byte_12BD8, al
call sub_BE3
pop di
pop si
pop ds
retn
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_35A proc far
arg_0 = dword ptr 6
arg_4 = word ptr 0Ah
arg_6 = word ptr 0Ch
arg_8 = word ptr 0Eh
arg_A = word ptr 10h
arg_C = word ptr 12h
arg_E = word ptr 14h
arg_10 = word ptr 16h
push bp
mov bp, sp
push si
push di
push ds
les dx, [bp+arg_0]
mov ax, [bp+arg_4]
add ax, 0Fh
shr ax, 4
add ax, [bp+arg_6]
mov ds, ax
mov si, [bp+arg_8]
mov ax, [bp+arg_4]
and ax, 0Fh
sub si, ax
mov bx, [bp+arg_A]
mov cx, [bp+arg_C]
mov di, [bp+arg_E]
mov ax, [bp+arg_10]
call loc_3E2
pop ds
pop di
pop si
pop bp
retf
sub_35A endp
; ---------------------------------------------------------------------------
mov bx, sp
push ds
push si
push di
mov ax, cs:word_2A4
mov ds, ax
mov es, ax
mov al, ss:[bx+4]
mov byte_12BD8, al
call sub_BE3
pop di
pop si
pop ds
retf
; ---------------------------------------------------------------------------
push bp
mov bp, sp
push si
push di
push ds
les dx, [bp+4]
mov ax, [bp+8]
add ax, 0Fh
shr ax, 4
add ax, [bp+0Ah]
mov ds, ax
mov si, [bp+0Ch]
mov ax, [bp+8]
loc_3C8:
and ax, 0Fh
sub si, ax
mov bx, [bp+0Eh]
mov cx, [bp+10h]
mov di, [bp+12h]
mov ax, [bp+14h]
call loc_3E2
pop ds
pop di
pop si
pop bp
retn
; ---------------------------------------------------------------------------
locret_3E1:
retn
; ---------------------------------------------------------------------------
loc_3E2:
cld
mov cs:word_2A2, sp
mov cs:word_2A4, ds
mov word_12BD0, bx
mov seg_12BD2, cx
mov word ptr byte_12BD9, ax
mov ax, di
mov byte_12BD8, al
xor ax, ax
mov byte ptr unk_12BDB, al
mov ax, 0FFF8h
cmp si, 1FA2h
jb short locret_3E1
mov ax, si
sub ax, 1F60h
mov seg_12BE6, ax
add ax, 1F60h
mov word ptr cs:loc_736+2, ax
mov word ptr cs:loc_746+2, ax
mov word ptr cs:loc_756+2, ax
mov word ptr cs:loc_766+2, ax
mov word ptr cs:loc_776+2, ax
mov word ptr cs:loc_7E0+2, ax
mov word ptr cs:loc_5DA+2, ax
mov word ptr cs:loc_5EA+2, ax
mov word ptr cs:loc_614+2, ax
mov word ptr cs:loc_624+2, ax
mov word ptr cs:loc_634+2, ax
mov word ptr cs:loc_644+2, ax
mov word ptr cs:loc_6B6+2, ax
mov word ptr cs:loc_716+2, ax
mov word ptr cs:loc_726+2, ax
mov word ptr cs:loc_8B3+2, ax
loc_456:
mov word ptr cs:loc_7F0+2, ax
loc_45A:
mov word ptr cs:loc_863+2, ax
mov word ptr cs:loc_873+2, ax
mov word ptr cs:loc_883+2, ax
mov word ptr cs:loc_893+2, ax
mov word ptr cs:loc_8A3+2, ax
push es
pop ds
call sub_8D2
mov bx, cs:word_2A4
mov ds, bx
mov es, bx
jb short locret_48F
mov word_12BE0, ax
call sub_8D8
mov si, bx
lodsw
cmp ax, 4E5Ah
mov ax, 0FFE1h
jz short loc_490
locret_48F:
retn
; ---------------------------------------------------------------------------
loc_490:
test byte_12BD9, 4
jz short loc_4A4
loc_497:
lodsb
cmp al, 1Ah
jz short loc_4A4
mov dl, al
mov ah, 2
int 21h ; DOS - DISPLAY OUTPUT
; DL = character to send to standard output
jmp short loc_497
; ---------------------------------------------------------------------------
loc_4A4:
lodsb
or al, al
jnz short loc_4A4
lodsb
mov bl, al
lodsw
mov cx, ax
lodsb
cmp al, 4
mov ax, 0FFE0h
jnz short locret_48F
test byte_12BD9, 8
jz short loc_4C3
mov ax, cx
call sub_904
loc_4C3:
add si, 4
lodsw
xchg ah, al
xor cx, cx
mov dx, cx
mov di, ax
add di, si
and ax, ax
jz short loc_50C
loc_4D5:
cmp si, di
jz short loc_50C
lodsb
cmp al, 1
jz short loc_4E4
cmp al, 2
jz short loc_4F0
jmp short loc_50C
; ---------------------------------------------------------------------------
loc_4E4:
lodsw
xchg ah, al
mov cx, ax
lodsw
xchg ah, al
mov dx, ax
jmp short loc_4D5
; ---------------------------------------------------------------------------
loc_4F0:
add si, 3
lodsb
test byte_12BD9, 40h
jnz short loc_4D5
cmp seg_12BDA, 0FFh
loc_500:
jz short loc_4D5
mov seg_12BDA, al
or byte_12BD9, 40h
jmp short loc_4D5
; ---------------------------------------------------------------------------
loc_50C:
mov si, di
cmp word_12BD0, 0
jge short loc_519
mov word_12BD0, cx
loc_519:
cmp seg_12BD2, 0
jge short loc_524
mov seg_12BD2, dx
loc_524:
mov cx, word_12BD0
mov ax, seg_12BD2
shr cx, 3
shl ax, 4
add cx, ax
shl ax, 2
add cx, ax
loc_538:
mov seg_12BDE, cx
loc_53C:
lodsw
xchg ah, al
mov word_12BD4, ax
mov cx, ax
neg ax
mov word ptr cs:loc_667+1, ax
inc ax
loc_54B:
mov word ptr cs:loc_606+1, ax
dec ax
add ax, ax
mov word ptr cs:loc_5FB+1, ax
add cx, cx
mov ax, cx
add ax, 160h
mov seg_12BE2, ax
add cx, cx
mov word_12BDC, cx
add ax, cx
mov word_12BE4, ax
mov word ptr cs:loc_6A2+1, ax
mov word ptr cs:loc_6D5+2, ax
mov word ptr cs:loc_650+2, ax
mov ax, word_12BD0
and ax, 7
add ax, word_12BD4
mov word_12BEC, ax
mov cx, ax
lodsw
xchg ah, al
mov seg_12BD6, ax
mov word ptr off_12BE8+2, ax
test bl, 80h
jnz short loc_5A5
mov cx, 30h ; '0'
mov di, 100h
loc_59A:
lodsb
shr al, 4
stosb
loop loc_59A
mov bx, si
jmp short loc_5B3
; ---------------------------------------------------------------------------
loc_5A5:
mov bx, si
mov si, 272h
mov di, 100h
mov cx, 0Ch
rep movs word ptr es:[di], word ptr cs:[si]
loc_5B3:
test byte_12BD9, 1
jz short loc_5BD
call sub_BE3
loc_5BD:
call sub_8BE
mov dh, 1
mov di, 160h
xor al, al
call loc_796
mov cx, word_12BD4
rep stosw
xor bp, bp
; Hack (jmp loc_659)
db 0e9h
db 084h
db 000h
; ---------------------------------------------------------------------------
loc_5D5:
mov dl, [bx]
inc bx
mov dh, 8
loc_5DA:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_5F9
call sub_8D8
jmp short loc_5F9
; ---------------------------------------------------------------------------
loc_5E5:
mov dl, [bx]
inc bx
mov dh, 8
loc_5EA:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_604
call sub_8D8
jmp short loc_604
; ---------------------------------------------------------------------------
loc_5F5:
dec dh
jz short loc_5D5
loc_5F9:
add dl, dl
loc_5FB:
mov si, 0
jnb short loc_676
dec dh
jz short loc_5E5
loc_604:
add dl, dl
loc_606:
mov si, 0
jnb short loc_676
dec si
dec si
jmp short loc_676
; ---------------------------------------------------------------------------
loc_60F:
mov dl, [bx]
inc bx
mov dh, 8
loc_614:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_65D
call sub_8D8
jmp short loc_65D
; ---------------------------------------------------------------------------
loc_61F:
mov dl, [bx]
inc bx
mov dh, 8
loc_624:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_665
call sub_8D8
jmp short loc_665
; ---------------------------------------------------------------------------
loc_62F:
mov dl, [bx]
inc bx
mov dh, 8
loc_634:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_682
call sub_8D8
jmp short loc_682
; ---------------------------------------------------------------------------
loc_63F:
mov dl, [bx]
inc bx
mov dh, 8
loc_644:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_690
call sub_8D8
jmp short loc_690
; ---------------------------------------------------------------------------
loc_64F:
movsw
loc_650:
; Hack (cmp di, 0)
db 081h
db 0ffh
db 000h
db 000h
jnz short loc_659
call sub_930
loc_659:
dec dh
jz short loc_60F
loc_65D:
add dl, dl
jb short loc_5F5
dec dh
jz short loc_61F
loc_665:
add dl, dl
loc_667:
mov si, 0
jb short loc_676
mov si, 0FFFCh
mov ax, [di-2]
cmp ah, al
jz short loc_6C1
loc_676:
cmp si, bp
mov bp, si
jz short loc_6CC
add si, di
loc_67E:
dec dh
jz short loc_62F
loc_682:
add dl, dl
jnb short loc_64F
mov ax, 1
xor cx, cx
loc_68B:
inc cx
dec dh
jz short loc_63F
loc_690:
add dl, dl
jb short loc_68B
loc_694:
dec dh
jz short loc_6B1
loc_698:
add dl, dl
adc ax, ax
loop loc_694
jb short loc_6FB
loc_6A0:
mov cx, ax
loc_6A2:
mov ax, 0
sub ax, di
shr ax, 1
cmp cx, ax
jnb short loc_6ED
rep movsw
jmp short loc_659
; ---------------------------------------------------------------------------
loc_6B1:
mov dl, [bx]
inc bx
mov dh, 8
loc_6B6:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_698
call sub_8D8
jmp short loc_698
; ---------------------------------------------------------------------------
loc_6C1:
cmp si, bp
mov bp, si
jz short loc_6CC
lea si, [di-2]
jmp short loc_67E
; ---------------------------------------------------------------------------
loc_6CC:
mov al, [di-1]
loc_6CF:
call loc_796
stosw
mov al, ah
loc_6D5:
; Hack (cmp di, 0)
db 081h
db 0ffh
db 000h
db 000h
jz short loc_6E8
loc_6DB:
dec dh
jz short loc_711
loc_6DF:
add dl, dl
jb short loc_6CF
xor bp, bp
jmp loc_659
; ---------------------------------------------------------------------------
loc_6E8:
call sub_930
jmp short loc_6DB
; ---------------------------------------------------------------------------
loc_6ED:
sub cx, ax
xchg ax, cx
rep movsw
call sub_930
sub si, word_12BDC
jmp short loc_6A0
; ---------------------------------------------------------------------------
loc_6FB:
xor cx, cx
loc_6FD:
movsw
cmp di, word_12BE4
loopne loc_6FD
jnz short loc_6A0
call sub_930
sub si, word_12BDC
jcxz short loc_6A0
jmp short loc_6FD
; ---------------------------------------------------------------------------
loc_711:
mov dl, [bx]
inc bx
mov dh, 8
loc_716:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_6DF
call sub_8D8
jmp short loc_6DF
; ---------------------------------------------------------------------------
loc_721:
mov dl, [bx]
inc bx
mov dh, 8
loc_726:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_785
call sub_8D8
jmp short loc_785
; ---------------------------------------------------------------------------
loc_731:
mov dl, [bx]
inc bx
mov dh, 8
loc_736:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7A0
call sub_8D8
jmp short loc_7A0
; ---------------------------------------------------------------------------
loc_741:
mov dl, [bx]
inc bx
mov dh, 8
loc_746:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7A8
call sub_8D8
jmp short loc_7A8
; ---------------------------------------------------------------------------
loc_751:
mov dl, [bx]
inc bx
mov dh, 8
loc_756:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7B3
call sub_8D8
jmp short loc_7B3
; ---------------------------------------------------------------------------
loc_761:
mov dl, [bx]
inc bx
mov dh, 8
loc_766:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7BB
call sub_8D8
jmp short loc_7BB
; ---------------------------------------------------------------------------
loc_771:
mov dl, [bx]
inc bx
mov dh, 8
loc_776:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7C3
call sub_8D8
jmp short loc_7C3
; ---------------------------------------------------------------------------
loc_781:
dec dh
jz short loc_721
loc_785:
add dl, dl
jb short loc_78C
lodsb
jmp short loc_7FB
; ---------------------------------------------------------------------------
loc_78C:
mov ax, [si]
xchg ah, al
mov [si], ax
xor ah, ah
jmp short loc_7FB
; ---------------------------------------------------------------------------
loc_796:
mov bp, di
xor ah, ah
mov si, ax
dec dh
jz short loc_731
loc_7A0:
add dl, dl
jb short loc_781
dec dh
jz short loc_741
loc_7A8:
add dl, dl
mov cx, 1
jnb short loc_7C7
dec dh
jz short loc_751
loc_7B3:
add dl, dl
jnb short loc_7BF
dec dh
jz short loc_761
loc_7BB:
add dl, dl
adc cx, cx
loc_7BF:
dec dh
jz short loc_771
loc_7C3:
add dl, dl
adc cx, cx
loc_7C7:
dec dh
jz short loc_7DB
loc_7CB:
add dl, dl
adc cx, cx
add si, cx
std
lodsb
lea di, [si+1]
rep movsb
stosb
jmp short loc_7FB
; ---------------------------------------------------------------------------
loc_7DB:
mov dl, [bx]
inc bx
mov dh, 8
loc_7E0:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_7CB
call sub_8D8
jmp short loc_7CB
; ---------------------------------------------------------------------------
loc_7EB:
mov dl, [bx]
inc bx
mov dh, 8
loc_7F0:
; Hack (cmp bx, 0)
db 081h
db 0fbh
db 000h
db 000h
jnz short loc_803
call sub_8D8
jmp short loc_803
; ---------------------------------------------------------------------------
loc_7FB:
xor ah, ah
mov si, ax
dec dh
jz short loc_7EB
loc_803:
add dl, dl
jb short loc_844
dec dh
jz short loc_85E
loc_80B:
add dl, dl
mov cx, 1
jnb short loc_82A
dec dh
jz short loc_86E
loc_816:
add dl, dl
jnb short loc_822
dec dh
jz short loc_87E
loc_81E:
add dl, dl
adc cx, cx