Precise Publishing Ltd Major.1644 is a memory-resident EXE file infector. When an infected file is executed on a PC, the virus decryptor receives control, and enters a convoluted loop which decrypts the rest of the virus.
Viruses use encryption to prevent scanners finding a fixed sequence of bytes to use for searching.
This procedure does work as intended with Major.1644, but its decryption routine is quite lengthy and fixed, and can therefore be used as a search-string. The expected result of 1234h in the AX register will be returned only if a copy of the virus is already loaded. If so, the virus need do nothing further. The starting point of the host program is retrieved from the virus body, and control passes to that address, allowing the host to run as normal. If the return value is other than 1234h, the virus must place itself in memory.