It is possible to write an assembly routine of just 22 machine instructions that does full FROG encryption and decryption.
2.
CIH infects Portable Executable files by splitting the bulk of its code into small slivers inserted into the inter-section gaps commonly seen in PE files, and writing a small re-assembly routine and table of its own code segments'locations into unused space in the tail of the PE header.