Get address of profiling table

        Entry:
          AH = 03h

        Return:
          ES:BX -> profiling table

        Note:   SYS_PROF.EXE is the TSR portion of a profiler from
                Micro Cornucopia #47