By the way, for those wondering how we didn't die the instant the engine read:
mov fs, bx
is because of a really nice thing we discovered about how the engine (and apparently 8086 proccesses segment codes). We planned on using that knowledge of us to prevent anyone using a newer disassembler from understanding what we did. The trick is this:
Each opcode associated with segment registers defines the specific register according to three bits. Virtually almost any processor translates them as follows:
000: es
001: cs
010: ss
011: ds
100: fs
101: gs
However, the original 8086 (and the game engine) ignore the first of the three bits, thereby enabling access only to es, cs, ss and ds. As a result, the engine will translate:
mov fs, bx
as:
mov es, bx
while any newer 16-bit disassembler will still display:
mov fs, bx
(note that push is encoded differently, so this doesn't work with it)