Assembler for reading HDD serial number using driver

Here is a small program hdsn32.asm, I wrote in 2000, read the serial number of the hard drive under Win9x, it took advantage of similar CIH virus method to obtain RING0 permissions, under the Win2000 can not run.
; Hdsn32.asm
.386
. Model flat, stdcall; Bit memory model
Option Casemap:none; Case sensitive

Include \masm32\include\windows.inc
Include \masm32\include\shell32.inc
Include \masm32\include\masm32.inc
Include \masm32\include\user32.inc
Include \masm32\include\kernel32.inc

Includelib \masm32\lib\shell32.lib
Includelib \masm32\lib\masm32.lib
Includelib \masm32\lib\user32.lib
Includelib \masm32\lib\kernel32.lib

. Data

IDTR DF 0; This would receive the contents of the IDTR
; Register

Savedgate DQ 0; We save the gate we replace in

Ourgate DW 0; Offset Low-order Word
DW 028h; Segment Selector
DW 0ee00h;
DW 0; Offset High-order Word
BUFF1 DW 256 DUP (20H)
Hdsn_1 db ' hard drive C serial number: ', 0dh,0ah
Hdsn_2 DB 256 dup (0)
Hdsn_3 db DUP (0)
Szcaption DB ' Hdsn32 v1.0 for Win9x Shandong Haitian group Sheng Yu increased 2000.12.21 ', 0
Name_buffer db ' Hdsn.bin ', 0

. Data?
hfile HANDLE?
Sizereadwrite DWORD?

. Code
Start:
mov eax, offset ring0proc
mov [ourgate], Ax; Put the offset words
shr eax, 16; into our descriptor
mov [ourgate+6], ax

Sidt Fword ptr IDTR
mov ebx, DWORD ptr [idtr+2]; Load IDT Base Address
add ebx, 8*3; Address of int 3 descriptor in EBX

mov edi, offset savedgate
mov esi, ebx
Movsd; Save the old descriptor
Movsd; Into Savedgate

mov edi, ebx
mov esi, offset ourgate
Movsd; Replace the old handler
Movsd; With our new one

int 3h; Trigger the exception, thus
; Passing control to our RING0
; Procedure

mov edi, ebx
mov esi, offset savedgate
Movsd; Restore the old handler
Movsd

Invoke Messagebox,null,addr hdsn_1,addr SZCAPTION,MB_OK

Invoke Createfile,addr name_buffer,\
Generic_read or generic_write, \
File_share_read or file_share_write,\
Null,create_always,file_attribute_archive,\
Null
MOV hfile,eax
Push offset hdsn_2
Pop esi
Push offset Hdsn_3
Pop EDI
MOV ecx,20
Jm_1:
Lodsb
XOR al,36h
Stosb
Loop jm_1
Invoke Writefile,hfile,addr hdsn_3,20,\
ADDR Sizereadwrite,null
Invoke Closehandle,hfile
Invoke Exitprocess,eax

Ring0proc PROC
Start_1:
MOV edx,1f7h
In AL,DX
CMP al,50h
JNZ start_1
Dec DX
MOV al,0a0h
Out Dx,al
MOV dx,1f7h
MOV Al,0ech
Out Dx,al
MOV dx,1f7h
St_1:
In AL,DX
CMP al,58h
JNZ st_1
MOV dx,1f0h
MOV Edi,offset BUFF1
MOV ecx,0
MOV cx,256
St_2:
In AX,DX
Xchg Ah,al
Stosw
Loop st_2
STi
Push offset buff1[20]
Pop esi
Push offset hdsn_2
Pop EDI
MOV ecx,20
Rep MOVSB
Iretd

Ring0proc ENDP
End Start