Si c'est une blague, elle est élaborée

It seems that the virus author did not realise that the relocation table is always properly aligned, so copying it can be done in just two instructions instead of 11.

Faux monsieur l'analyseur